projects / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
tls-server: Select cipher suite also when handling HelloRetryRequest
[strongswan.git] / src / libtls / tls_server.c
1 /*
2 * Copyright (C) 2020-2021 Pascal Knecht
3 * HSR Hochschule fuer Technik Rapperswil
4 *
5 * Copyright (C) 2010 Martin Willi
6 * Copyright (C) 2010 revosec AG
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include "tls_server.h"
20
21 #include <time.h>
22
23 #include <utils/debug.h>
24 #include <credentials/certificates/x509.h>
25 #include <collections/array.h>
26
27 typedef struct private_tls_server_t private_tls_server_t;
28
29 /**
30 * Size of a session ID
31 */
32 #define SESSION_ID_SIZE 16
33
34 typedef enum {
35 STATE_INIT,
36 STATE_HELLO_RECEIVED,
37 STATE_HELLO_SENT,
38 STATE_CERT_SENT,
39 STATE_KEY_EXCHANGE_SENT,
40 STATE_CERTREQ_SENT,
41 STATE_HELLO_DONE,
42 STATE_CERT_RECEIVED,
43 STATE_KEY_EXCHANGE_RECEIVED,
44 STATE_CERT_VERIFY_RECEIVED,
45 STATE_CIPHERSPEC_CHANGED_IN,
46 STATE_FINISHED_RECEIVED,
47 STATE_CIPHERSPEC_CHANGED_OUT,
48 STATE_FINISHED_SENT,
49 /* new states in TLS 1.3 */
50 STATE_ENCRYPTED_EXTENSIONS_SENT,
51 STATE_CERT_VERIFY_SENT,
52 STATE_KEY_UPDATE_REQUESTED,
53 STATE_KEY_UPDATE_SENT,
54 STATE_FINISHED_SENT_KEY_SWITCHED,
55 } server_state_t;
56
57 /**
58 * Private data of an tls_server_t object.
59 */
60 struct private_tls_server_t {
61
62 /**
63 * Public tls_server_t interface.
64 */
65 tls_server_t public;
66
67 /**
68 * TLS stack
69 */
70 tls_t *tls;
71
72 /**
73 * TLS crypto context
74 */
75 tls_crypto_t *crypto;
76
77 /**
78 * TLS alert handler
79 */
80 tls_alert_t *alert;
81
82 /**
83 * Server identity
84 */
85 identification_t *server;
86
87 /**
88 * Peer identity, NULL for no client authentication
89 */
90 identification_t *peer;
91
92 /**
93 * State we are in
94 */
95 server_state_t state;
96
97 /**
98 * Hello random data selected by client
99 */
100 char client_random[32];
101
102 /**
103 * Hello random data selected by server
104 */
105 char server_random[32];
106
107 /**
108 * Auth helper for peer authentication
109 */
110 auth_cfg_t *peer_auth;
111
112 /**
113 * Auth helper for server authentication
114 */
115 auth_cfg_t *server_auth;
116
117 /**
118 * Peer private key
119 */
120 private_key_t *private;
121
122 /**
123 * DHE exchange
124 */
125 diffie_hellman_t *dh;
126
127 /**
128 * Requested DH group
129 */
130 tls_named_group_t requested_curve;
131
132 /**
133 * Selected TLS cipher suite
134 */
135 tls_cipher_suite_t suite;
136
137 /**
138 * Offered TLS version of the client
139 */
140 tls_version_t client_version;
141
142 /**
143 * TLS session identifier
144 */
145 chunk_t session;
146
147 /**
148 * Do we resume a session?
149 */
150 bool resume;
151
152 /**
153 * Hash and signature algorithms supported by peer
154 */
155 chunk_t hashsig;
156
157 /**
158 * Elliptic curves supported by peer
159 */
160 chunk_t curves;
161
162 /**
163 * Did we receive the curves from the client?
164 */
165 bool curves_received;
166
167 /**
168 * Whether to include CAs in CertificateRequest messages
169 */
170 bool send_certreq_authorities;
171 };
172
173 /**
174 * Find a trusted public key to encrypt/verify key exchange data
175 */
176 public_key_t *tls_find_public_key(auth_cfg_t *peer_auth)
177 {
178 public_key_t *public = NULL, *current;
179 certificate_t *cert, *found;
180 enumerator_t *enumerator;
181 auth_cfg_t *auth;
182
183 cert = peer_auth->get(peer_auth, AUTH_HELPER_SUBJECT_CERT);
184 if (cert)
185 {
186 enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
187 KEY_ANY, cert->get_subject(cert),
188 peer_auth, TRUE);
189 while (enumerator->enumerate(enumerator, &current, &auth))
190 {
191 found = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
192 if (found && cert->equals(cert, found))
193 {
194 public = current->get_ref(current);
195 peer_auth->merge(peer_auth, auth, FALSE);
196 break;
197 }
198 }
199 enumerator->destroy(enumerator);
200 }
201 return public;
202 }
203
204 /**
205 * Find a cipher suite and a server key
206 */
207 static bool select_suite_and_key(private_tls_server_t *this,
208 tls_cipher_suite_t *suites, int count)
209 {
210 tls_version_t version_min, version_max;
211 private_key_t *key;
212 auth_cfg_t *auth;
213 enumerator_t *enumerator;
214
215 version_min = this->tls->get_version_min(this->tls);
216 version_max = this->tls->get_version_max(this->tls);
217 enumerator = tls_create_private_key_enumerator(version_min, version_max,
218 this->hashsig, this->server);
219 if (!enumerator)
220 {
221 DBG1(DBG_TLS, "no common signature algorithms found");
222 return FALSE;
223 }
224 if (!enumerator->enumerate(enumerator, &key, &auth))
225 {
226 DBG1(DBG_TLS, "no usable TLS server certificate found for '%Y'",
227 this->server);
228 enumerator->destroy(enumerator);
229 return FALSE;
230 }
231
232 if (version_max >= TLS_1_3)
233 {
234 this->suite = this->crypto->select_cipher_suite(this->crypto, suites,
235 count, KEY_ANY);
236 }
237 else
238 {
239 this->suite = this->crypto->select_cipher_suite(this->crypto, suites,
240 count, key->get_type(key));
241 while (!this->suite &&
242 enumerator->enumerate(enumerator, &key, &auth))
243 { /* find a key and cipher suite for one of the remaining key types */
244 this->suite = this->crypto->select_cipher_suite(this->crypto,
245 suites, count,
246 key->get_type(key));
247 }
248 }
249 if (!this->suite)
250 {
251 DBG1(DBG_TLS, "received cipher suites or signature schemes unacceptable");
252 enumerator->destroy(enumerator);
253 return FALSE;
254 }
255 DBG1(DBG_TLS, "using key of type %N", key_type_names, key->get_type(key));
256 DESTROY_IF(this->private);
257 this->private = key->get_ref(key);
258 this->server_auth->purge(this->server_auth, FALSE);
259 this->server_auth->merge(this->server_auth, auth, FALSE);
260 enumerator->destroy(enumerator);
261 return TRUE;
262 }
263
264 /**
265 * Check if the peer supports a given TLS curve
266 */
267 static bool peer_supports_curve(private_tls_server_t *this,
268 tls_named_group_t curve)
269 {
270 bio_reader_t *reader;
271 uint16_t current;
272
273 if (!this->curves_received)
274 { /* none received, assume yes */
275 return TRUE;
276 }
277 reader = bio_reader_create(this->curves);
278 while (reader->remaining(reader) && reader->read_uint16(reader, &current))
279 {
280 if (current == curve)
281 {
282 reader->destroy(reader);
283 return TRUE;
284 }
285 }
286 reader->destroy(reader);
287 return FALSE;
288 }
289
290 /**
291 * TLS 1.3 key exchange key share
292 */
293 typedef struct {
294 uint16_t curve;
295 chunk_t key_share;
296 } key_share_t;
297
298 /**
299 * Check if peer sent a key share of a given TLS named DH group
300 */
301 static bool peer_offered_curve(array_t *key_shares, tls_named_group_t curve,
302 key_share_t *out)
303 {
304 key_share_t peer;
305 int i;
306
307 for (i = 0; i < array_count(key_shares); i++)
308 {
309 array_get(key_shares, i, &peer);
310 if (curve == peer.curve)
311 {
312 if (out)
313 {
314 *out = peer;
315 }
316 return TRUE;
317 }
318 }
319 return FALSE;
320 }
321
322 /**
323 * Check if client is currently retrying to connect to the server.
324 */
325 static bool retrying(private_tls_server_t *this)
326 {
327 return this->state == STATE_INIT && this->requested_curve;
328 }
329
330 /**
331 * Process client hello message
332 */
333 static status_t process_client_hello(private_tls_server_t *this,
334 bio_reader_t *reader)
335 {
336 uint16_t legacy_version = 0, version = 0, extension_type = 0;
337 chunk_t random, session, ciphers, versions = chunk_empty, compression;
338 chunk_t ext = chunk_empty, key_shares = chunk_empty;
339 key_share_t peer = {0};
340 chunk_t extension_data = chunk_empty;
341 bio_reader_t *extensions, *extension;
342 tls_cipher_suite_t *suites;
343 tls_version_t original_version_max;
344 int count, i;
345 rng_t *rng;
346
347 this->crypto->append_handshake(this->crypto,
348 TLS_CLIENT_HELLO, reader->peek(reader));
349
350 if (!reader->read_uint16(reader, &legacy_version) ||
351 !reader->read_data(reader, sizeof(this->client_random), &random) ||
352 !reader->read_data8(reader, &session) ||
353 !reader->read_data16(reader, &ciphers) ||
354 !reader->read_data8(reader, &compression) ||
355 (reader->remaining(reader) && !reader->read_data16(reader, &ext)))
356 {
357 DBG1(DBG_TLS, "received invalid ClientHello");
358 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
359 return NEED_MORE;
360 }
361
362 /* before we do anything version-related, determine our supported suites
363 * as that might change the min./max. versions */
364 this->crypto->get_cipher_suites(this->crypto, NULL);
365
366 extensions = bio_reader_create(ext);
367 while (extensions->remaining(extensions))
368 {
369 if (!extensions->read_uint16(extensions, &extension_type) ||
370 !extensions->read_data16(extensions, &extension_data))
371 {
372 DBG1(DBG_TLS, "received invalid ClientHello Extensions");
373 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
374 extensions->destroy(extensions);
375 return NEED_MORE;
376 }
377 extension = bio_reader_create(extension_data);
378 DBG2(DBG_TLS, "received TLS '%N' extension",
379 tls_extension_names, extension_type);
380 DBG3(DBG_TLS, "%B", &extension_data);
381 switch (extension_type)
382 {
383 case TLS_EXT_SIGNATURE_ALGORITHMS:
384 if (!extension->read_data16(extension, &extension_data))
385 {
386 DBG1(DBG_TLS, "invalid %N extension",
387 tls_extension_names, extension_type);
388 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
389 extensions->destroy(extensions);
390 extension->destroy(extension);
391 return NEED_MORE;
392 }
393 chunk_free(&this->hashsig);
394 this->hashsig = chunk_clone(extension_data);
395 break;
396 case TLS_EXT_SUPPORTED_GROUPS:
397 if (!extension->read_data16(extension, &extension_data))
398 {
399 DBG1(DBG_TLS, "invalid %N extension",
400 tls_extension_names, extension_type);
401 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
402 extensions->destroy(extensions);
403 extension->destroy(extension);
404 return NEED_MORE;
405 }
406 chunk_free(&this->curves);
407 this->curves_received = TRUE;
408 this->curves = chunk_clone(extension_data);
409 break;
410 case TLS_EXT_SUPPORTED_VERSIONS:
411 if (!extension->read_data8(extension, &versions))
412 {
413 DBG1(DBG_TLS, "invalid %N extension",
414 tls_extension_names, extension_type);
415 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
416 extensions->destroy(extensions);
417 extension->destroy(extension);
418 return NEED_MORE;
419 }
420 break;
421 case TLS_EXT_KEY_SHARE:
422 if (!extension->read_data16(extension, &key_shares))
423 {
424 DBG1(DBG_TLS, "invalid %N extension",
425 tls_extension_names, extension_type);
426 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
427 extensions->destroy(extensions);
428 extension->destroy(extension);
429 return NEED_MORE;
430 }
431 break;
432 default:
433 break;
434 }
435 extension->destroy(extension);
436 }
437 extensions->destroy(extensions);
438
439 if (this->tls->get_version_max(this->tls) >= TLS_1_3 && !this->hashsig.len)
440 {
441 DBG1(DBG_TLS, "no %N extension received", tls_extension_names,
442 TLS_MISSING_EXTENSION);
443 this->alert->add(this->alert, TLS_FATAL, TLS_MISSING_EXTENSION);
444 return NEED_MORE;
445 }
446
447 memcpy(this->client_random, random.ptr, sizeof(this->client_random));
448
449 htoun32(&this->server_random, time(NULL));
450 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
451 if (!rng ||
452 !rng->get_bytes(rng, sizeof(this->server_random) - 4,
453 this->server_random + 4))
454 {
455 DBG1(DBG_TLS, "failed to generate server random");
456 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
457 DESTROY_IF(rng);
458 return NEED_MORE;
459 }
460 rng->destroy(rng);
461
462 original_version_max = this->tls->get_version_max(this->tls);
463
464 if (versions.len)
465 {
466 bio_reader_t *client_versions;
467
468 client_versions = bio_reader_create(versions);
469 while (client_versions->remaining(client_versions))
470 {
471 if (client_versions->read_uint16(client_versions, &version))
472 {
473 if (this->tls->set_version(this->tls, version, version))
474 {
475 this->client_version = version;
476 break;
477 }
478 }
479 }
480 client_versions->destroy(client_versions);
481 }
482 else
483 {
484 version = legacy_version;
485 if (this->tls->set_version(this->tls, version, version))
486 {
487 this->client_version = version;
488 }
489 }
490
491 /* downgrade protection (see RFC 8446, section 4.1.3) */
492 if ((original_version_max == TLS_1_3 && version < TLS_1_3) ||
493 (original_version_max == TLS_1_2 && version < TLS_1_2))
494 {
495 chunk_t downgrade_protection = tls_downgrade_protection_tls11;
496
497 if (version == TLS_1_2)
498 {
499 downgrade_protection = tls_downgrade_protection_tls12;
500 }
501 memcpy(&this->server_random[24], downgrade_protection.ptr,
502 downgrade_protection.len);
503 }
504
505 if (!this->client_version)
506 {
507 DBG1(DBG_TLS, "proposed version %N not supported", tls_version_names,
508 version);
509 this->alert->add(this->alert, TLS_FATAL, TLS_PROTOCOL_VERSION);
510 return NEED_MORE;
511 }
512
513 if (this->tls->get_version_max(this->tls) < TLS_1_3)
514 {
515 this->suite = this->crypto->resume_session(this->crypto, session,
516 this->peer,
517 chunk_from_thing(this->client_random),
518 chunk_from_thing(this->server_random));
519 }
520
521 if (this->suite && !retrying(this))
522 {
523 this->session = chunk_clone(session);
524 this->resume = TRUE;
525 DBG1(DBG_TLS, "resumed %N using suite %N",
526 tls_version_names, this->tls->get_version_max(this->tls),
527 tls_cipher_suite_names, this->suite);
528 }
529 else
530 {
531 tls_cipher_suite_t original_suite = this->suite;
532
533 count = ciphers.len / sizeof(uint16_t);
534 suites = alloca(count * sizeof(tls_cipher_suite_t));
535 DBG2(DBG_TLS, "received %d TLS cipher suites:", count);
536 for (i = 0; i < count; i++)
537 {
538 suites[i] = untoh16(&ciphers.ptr[i * sizeof(uint16_t)]);
539 DBG2(DBG_TLS, " %N", tls_cipher_suite_names, suites[i]);
540 }
541 if (!select_suite_and_key(this, suites, count))
542 {
543 this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
544 return NEED_MORE;
545 }
546 if (retrying(this) && original_suite != this->suite)
547 {
548 DBG1(DBG_TLS, "selected %N instead of %N during retry",
549 tls_cipher_suite_names, this->suite, tls_cipher_suite_names,
550 original_suite);
551 this->alert->add(this->alert, TLS_FATAL, TLS_ILLEGAL_PARAMETER);
552 return NEED_MORE;
553 }
554 if (this->tls->get_version_max(this->tls) < TLS_1_3)
555 {
556 rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
557 if (!rng ||
558 !rng->allocate_bytes(rng, SESSION_ID_SIZE, &this->session))
559 {
560 DBG1(DBG_TLS, "generating TLS session identifier failed, skipped");
561 }
562 DESTROY_IF(rng);
563 }
564 else
565 {
566 chunk_free(&this->session);
567 this->session = chunk_clone(session);
568 }
569 DBG1(DBG_TLS, "negotiated %N using suite %N",
570 tls_version_names, this->tls->get_version_max(this->tls),
571 tls_cipher_suite_names, this->suite);
572 }
573
574 if (this->tls->get_version_max(this->tls) >= TLS_1_3)
575 {
576 diffie_hellman_group_t group;
577 tls_named_group_t curve, requesting_curve = 0;
578 enumerator_t *enumerator;
579 array_t *peer_key_shares;
580
581 peer_key_shares = array_create(sizeof(key_share_t), 1);
582 extension = bio_reader_create(key_shares);
583 while (extension->remaining(extension))
584 {
585 if (!extension->read_uint16(extension, &peer.curve) ||
586 !extension->read_data16(extension, &peer.key_share) ||
587 !peer.key_share.len)
588 {
589 DBG1(DBG_TLS, "invalid %N extension",
590 tls_extension_names, extension_type);
591 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
592 extension->destroy(extension);
593 array_destroy(peer_key_shares);
594 return NEED_MORE;
595 }
596 array_insert(peer_key_shares, ARRAY_TAIL, &peer);
597 }
598 extension->destroy(extension);
599
600 enumerator = this->crypto->create_ec_enumerator(this->crypto);
601 while (enumerator->enumerate(enumerator, &group, &curve))
602 {
603 if (!requesting_curve &&
604 peer_supports_curve(this, curve) &&
605 !peer_offered_curve(peer_key_shares, curve, NULL))
606 {
607 requesting_curve = curve;
608 }
609 if (peer_supports_curve(this, curve) &&
610 peer_offered_curve(peer_key_shares, curve, &peer))
611 {
612 DBG1(DBG_TLS, "using key exchange %N",
613 tls_named_group_names, curve);
614 this->dh = lib->crypto->create_dh(lib->crypto, group);
615 break;
616 }
617 }
618 enumerator->destroy(enumerator);
619 array_destroy(peer_key_shares);
620
621 if (!this->dh)
622 {
623 if (retrying(this))
624 {
625 DBG1(DBG_TLS, "already replied with a hello retry request");
626 this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE);
627 return NEED_MORE;
628 }
629
630 if (!requesting_curve)
631 {
632 DBG1(DBG_TLS, "no mutual supported group in client hello");
633 this->alert->add(this->alert, TLS_FATAL, TLS_ILLEGAL_PARAMETER);
634 return NEED_MORE;
635 }
636 this->requested_curve = requesting_curve;
637
638 if (!this->crypto->hash_handshake(this->crypto, NULL))
639 {
640 DBG1(DBG_TLS, "failed to hash handshake messages");
641 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
642 return NEED_MORE;
643 }
644 }
645 else
646 {
647 if (peer.key_share.len &&
648 peer.curve != TLS_CURVE25519 &&
649 peer.curve != TLS_CURVE448)
650 { /* classic format (see RFC 8446, section 4.2.8.2) */
651 if (peer.key_share.ptr[0] != TLS_ANSI_UNCOMPRESSED)
652 {
653 DBG1(DBG_TLS, "DH point format '%N' not supported",
654 tls_ansi_point_format_names, peer.key_share.ptr[0]);
655 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
656 return NEED_MORE;
657 }
658 peer.key_share = chunk_skip(peer.key_share, 1);
659 }
660 if (!peer.key_share.len ||
661 !this->dh->set_other_public_value(this->dh, peer.key_share))
662 {
663 DBG1(DBG_TLS, "DH key derivation failed");
664 this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
665 return NEED_MORE;
666 }
667 this->requested_curve = 0;
668 }
669 }
670
671 this->state = STATE_HELLO_RECEIVED;
672 return NEED_MORE;
673 }
674
675 /**
676 * Process certificate
677 */
678 static status_t process_certificate(private_tls_server_t *this,
679 bio_reader_t *reader)
680 {
681 certificate_t *cert;
682 bio_reader_t *certs;
683 chunk_t data;
684 bool first = TRUE;
685
686 this->crypto->append_handshake(this->crypto,
687 TLS_CERTIFICATE, reader->peek(reader));
688
689 if (this->tls->get_version_max(this->tls) > TLS_1_2)
690 {
691 if (!reader->read_data8(reader, &data))
692 {
693 DBG1(DBG_TLS, "certificate request context invalid");
694 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
695 return NEED_MORE;
696 }
697 }
698
699 if (!reader->read_data24(reader, &data))
700 {
701 DBG1(DBG_TLS, "certificate message header invalid");
702 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
703 return NEED_MORE;
704 }
705 certs = bio_reader_create(data);
706 if (!certs->remaining(certs))
707 {
708 DBG1(DBG_TLS, "no certificate sent by peer");
709 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
710 return NEED_MORE;
711 }
712 while (certs->remaining(certs))
713 {
714 if (!certs->read_data24(certs, &data))
715 {
716 DBG1(DBG_TLS, "certificate message invalid");
717 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
718 certs->destroy(certs);
719 return NEED_MORE;
720 }
721 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
722 BUILD_BLOB_ASN1_DER, data, BUILD_END);
723 if (cert)
724 {
725 if (first)
726 {
727 this->peer_auth->add(this->peer_auth,
728 AUTH_HELPER_SUBJECT_CERT, cert);
729 DBG1(DBG_TLS, "received TLS peer certificate '%Y'",
730 cert->get_subject(cert));
731 first = FALSE;
732 }
733 else
734 {
735 DBG1(DBG_TLS, "received TLS intermediate certificate '%Y'",
736 cert->get_subject(cert));
737 this->peer_auth->add(this->peer_auth, AUTH_HELPER_IM_CERT, cert);
738 }
739 }
740 else
741 {
742 DBG1(DBG_TLS, "parsing TLS certificate failed, skipped");
743 this->alert->add(this->alert, TLS_WARNING, TLS_BAD_CERTIFICATE);
744 }
745 if (this->tls->get_version_max(this->tls) > TLS_1_2)
746 {
747 if (!certs->read_data16(certs, &data))
748 {
749 DBG1(DBG_TLS, "failed to read extensions of CertificateEntry");
750 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
751 return NEED_MORE;
752 }
753 }
754 }
755 certs->destroy(certs);
756 this->state = STATE_CERT_RECEIVED;
757 return NEED_MORE;
758 }
759
760 /**
761 * Process Client Key Exchange, using premaster encryption
762 */
763 static status_t process_key_exchange_encrypted(private_tls_server_t *this,
764 bio_reader_t *reader)
765 {
766 chunk_t encrypted, decrypted;
767 char premaster[48];
768 rng_t *rng;
769
770 this->crypto->append_handshake(this->crypto,
771 TLS_CLIENT_KEY_EXCHANGE, reader->peek(reader));
772
773 if (!reader->read_data16(reader, &encrypted))
774 {
775 DBG1(DBG_TLS, "received invalid Client Key Exchange");
776 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
777 return NEED_MORE;
778 }
779
780 htoun16(premaster, this->client_version);
781 /* pre-randomize premaster for failure cases */
782 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
783 if (!rng || !rng->get_bytes(rng, sizeof(premaster) - 2, premaster + 2))
784 {
785 DBG1(DBG_TLS, "failed to generate premaster secret");
786 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
787 DESTROY_IF(rng);
788 return NEED_MORE;
789 }
790 rng->destroy(rng);
791
792 if (this->private &&
793 this->private->decrypt(this->private,
794 ENCRYPT_RSA_PKCS1, encrypted, &decrypted))
795 {
796 if (decrypted.len == sizeof(premaster) &&
797 untoh16(decrypted.ptr) == this->client_version)
798 {
799 memcpy(premaster + 2, decrypted.ptr + 2, sizeof(premaster) - 2);
800 }
801 else
802 {
803 DBG1(DBG_TLS, "decrypted premaster has invalid length/version");
804 }
805 chunk_clear(&decrypted);
806 }
807 else
808 {
809 DBG1(DBG_TLS, "decrypting Client Key Exchange failed");
810 }
811
812 if (!this->crypto->derive_secrets(this->crypto, chunk_from_thing(premaster),
813 this->session, this->peer,
814 chunk_from_thing(this->client_random),
815 chunk_from_thing(this->server_random)))
816 {
817 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
818 return NEED_MORE;
819 }
820
821 this->state = STATE_KEY_EXCHANGE_RECEIVED;
822 return NEED_MORE;
823 }
824
825 /**
826 * Process client key exchange, using DHE exchange
827 */
828 static status_t process_key_exchange_dhe(private_tls_server_t *this,
829 bio_reader_t *reader)
830 {
831 chunk_t premaster, pub;
832 bool ec;
833
834 this->crypto->append_handshake(this->crypto,
835 TLS_CLIENT_KEY_EXCHANGE, reader->peek(reader));
836
837 ec = diffie_hellman_group_is_ec(this->dh->get_dh_group(this->dh));
838 if ((ec && !reader->read_data8(reader, &pub)) ||
839 (!ec && (!reader->read_data16(reader, &pub) || pub.len == 0)))
840 {
841 DBG1(DBG_TLS, "received invalid Client Key Exchange");
842 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
843 return NEED_MORE;
844 }
845
846 if (ec)
847 {
848 if (pub.ptr[0] != TLS_ANSI_UNCOMPRESSED)
849 {
850 DBG1(DBG_TLS, "DH point format '%N' not supported",
851 tls_ansi_point_format_names, pub.ptr[0]);
852 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
853 return NEED_MORE;
854 }
855 pub = chunk_skip(pub, 1);
856 }
857 if (!this->dh->set_other_public_value(this->dh, pub))
858 {
859 DBG1(DBG_TLS, "applying DH public value failed");
860 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
861 return NEED_MORE;
862 }
863 if (!this->dh->get_shared_secret(this->dh, &premaster))
864 {
865 DBG1(DBG_TLS, "calculating premaster from DH failed");
866 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
867 return NEED_MORE;
868 }
869
870 if (!this->crypto->derive_secrets(this->crypto, premaster,
871 this->session, this->peer,
872 chunk_from_thing(this->client_random),
873 chunk_from_thing(this->server_random)))
874 {
875 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
876 chunk_clear(&premaster);
877 return NEED_MORE;
878 }
879 chunk_clear(&premaster);
880
881 this->state = STATE_KEY_EXCHANGE_RECEIVED;
882 return NEED_MORE;
883 }
884
885 /**
886 * Process Client Key Exchange
887 */
888 static status_t process_key_exchange(private_tls_server_t *this,
889 bio_reader_t *reader)
890 {
891 if (this->dh)
892 {
893 return process_key_exchange_dhe(this, reader);
894 }
895 return process_key_exchange_encrypted(this, reader);
896 }
897
898 /**
899 * Process Certificate verify
900 */
901 static status_t process_cert_verify(private_tls_server_t *this,
902 bio_reader_t *reader)
903 {
904 public_key_t *public;
905 chunk_t msg;
906
907 public = tls_find_public_key(this->peer_auth);
908 if (!public)
909 {
910 DBG1(DBG_TLS, "no trusted certificate found for '%Y' to verify TLS peer",
911 this->peer);
912 this->alert->add(this->alert, TLS_FATAL, TLS_CERTIFICATE_UNKNOWN);
913 return NEED_MORE;
914 }
915
916 msg = reader->peek(reader);
917 if (!this->crypto->verify_handshake(this->crypto, public, reader))
918 {
919 public->destroy(public);
920 DBG1(DBG_TLS, "signature verification failed");
921 this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
922 return NEED_MORE;
923 }
924 public->destroy(public);
925 this->state = STATE_CERT_VERIFY_RECEIVED;
926 this->crypto->append_handshake(this->crypto, TLS_CERTIFICATE_VERIFY, msg);
927 return NEED_MORE;
928 }
929
930 /**
931 * Process finished message
932 */
933 static status_t process_finished(private_tls_server_t *this,
934 bio_reader_t *reader)
935 {
936 chunk_t received, verify_data;
937 u_char buf[12];
938
939 if (this->tls->get_version_max(this->tls) < TLS_1_3)
940 {
941 if (!reader->read_data(reader, sizeof(buf), &received))
942 {
943 DBG1(DBG_TLS, "received client finished too short");
944 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
945 return NEED_MORE;
946 }
947 if (!this->crypto->calculate_finished_legacy(this->crypto,
948 "client finished", buf))
949 {
950 DBG1(DBG_TLS, "calculating client finished failed");
951 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
952 return NEED_MORE;
953 }
954 verify_data = chunk_from_thing(buf);
955 }
956 else
957 {
958 received = reader->peek(reader);
959 if (!this->crypto->calculate_finished(this->crypto, FALSE, &verify_data))
960 {
961 DBG1(DBG_TLS, "calculating client finished failed");
962 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
963 return NEED_MORE;
964 }
965 this->crypto->change_cipher(this->crypto, TRUE);
966 }
967
968 if (!chunk_equals_const(received, verify_data))
969 {
970 DBG1(DBG_TLS, "received client finished invalid");
971 this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
972 return NEED_MORE;
973 }
974
975 if (verify_data.ptr != buf)
976 {
977 chunk_free(&verify_data);
978 }
979
980 this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
981 this->state = STATE_FINISHED_RECEIVED;
982 return NEED_MORE;
983 }
984
985 /**
986 * Process KeyUpdate message
987 */
988 static status_t process_key_update(private_tls_server_t *this,
989 bio_reader_t *reader)
990 {
991 uint8_t update_requested;
992
993 if (!reader->read_uint8(reader, &update_requested) ||
994 update_requested > 1)
995 {
996 DBG1(DBG_TLS, "received invalid KeyUpdate");
997 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
998 return NEED_MORE;
999 }
1000
1001 if (!this->crypto->update_app_keys(this->crypto, TRUE))
1002 {
1003 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1004 return NEED_MORE;
1005 }
1006 this->crypto->change_cipher(this->crypto, TRUE);
1007
1008 if (update_requested)
1009 {
1010 DBG1(DBG_TLS, "client requested KeyUpdate");
1011 this->state = STATE_KEY_UPDATE_REQUESTED;
1012 }
1013 return NEED_MORE;
1014 }
1015
1016 METHOD(tls_handshake_t, process, status_t,
1017 private_tls_server_t *this, tls_handshake_type_t type, bio_reader_t *reader)
1018 {
1019 tls_handshake_type_t expected;
1020
1021 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1022 {
1023 switch (this->state)
1024 {
1025 case STATE_INIT:
1026 if (type == TLS_CLIENT_HELLO)
1027 {
1028 return process_client_hello(this, reader);
1029 }
1030 expected = TLS_CLIENT_HELLO;
1031 break;
1032 case STATE_HELLO_DONE:
1033 if (type == TLS_CERTIFICATE)
1034 {
1035 return process_certificate(this, reader);
1036 }
1037 if (this->peer)
1038 {
1039 expected = TLS_CERTIFICATE;
1040 break;
1041 }
1042 /* otherwise fall through to next state */
1043 case STATE_CERT_RECEIVED:
1044 if (type == TLS_CLIENT_KEY_EXCHANGE)
1045 {
1046 return process_key_exchange(this, reader);
1047 }
1048 expected = TLS_CLIENT_KEY_EXCHANGE;
1049 break;
1050 case STATE_KEY_EXCHANGE_RECEIVED:
1051 if (type == TLS_CERTIFICATE_VERIFY)
1052 {
1053 return process_cert_verify(this, reader);
1054 }
1055 if (this->peer)
1056 {
1057 expected = TLS_CERTIFICATE_VERIFY;
1058 break;
1059 }
1060 return INVALID_STATE;
1061 case STATE_CIPHERSPEC_CHANGED_IN:
1062 if (type == TLS_FINISHED)
1063 {
1064 return process_finished(this, reader);
1065 }
1066 expected = TLS_FINISHED;
1067 break;
1068 default:
1069 DBG1(DBG_TLS, "TLS %N not expected in current state",
1070 tls_handshake_type_names, type);
1071 this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE);
1072 return NEED_MORE;
1073 }
1074 }
1075 else
1076 {
1077 switch (this->state)
1078 {
1079 case STATE_INIT:
1080 if (type == TLS_CLIENT_HELLO)
1081 {
1082 return process_client_hello(this, reader);
1083 }
1084 expected = TLS_CLIENT_HELLO;
1085 break;
1086 case STATE_CIPHERSPEC_CHANGED_IN:
1087 case STATE_FINISHED_SENT:
1088 case STATE_FINISHED_SENT_KEY_SWITCHED:
1089 if (type == TLS_CERTIFICATE)
1090 {
1091 return process_certificate(this, reader);
1092 }
1093 if (this->peer)
1094 {
1095 expected = TLS_CERTIFICATE;
1096 break;
1097 }
1098 /* otherwise fall through to next state */
1099 case STATE_CERT_RECEIVED:
1100 if (type == TLS_CERTIFICATE_VERIFY)
1101 {
1102 return process_cert_verify(this, reader);
1103 }
1104 if (this->peer)
1105 {
1106 expected = TLS_CERTIFICATE_VERIFY;
1107 break;
1108 }
1109 /* otherwise fall through to next state */
1110 case STATE_CERT_VERIFY_RECEIVED:
1111 if (type == TLS_FINISHED)
1112 {
1113 return process_finished(this, reader);
1114 }
1115 return NEED_MORE;
1116 case STATE_FINISHED_RECEIVED:
1117 if (type == TLS_KEY_UPDATE)
1118 {
1119 return process_key_update(this, reader);
1120 }
1121 return INVALID_STATE;
1122 default:
1123 DBG1(DBG_TLS, "TLS %N not expected in current state",
1124 tls_handshake_type_names, type);
1125 this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE);
1126 return NEED_MORE;
1127 }
1128 }
1129 DBG1(DBG_TLS, "TLS %N expected, but received %N",
1130 tls_handshake_type_names, expected, tls_handshake_type_names, type);
1131 this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE);
1132 return NEED_MORE;
1133 }
1134
1135 /**
1136 * Write public key into key share extension
1137 */
1138 bool tls_write_key_share(bio_writer_t **key_share, diffie_hellman_t *dh)
1139 {
1140 bio_writer_t *writer;
1141 tls_named_group_t curve;
1142 chunk_t pub;
1143
1144 if (!dh)
1145 {
1146 return FALSE;
1147 }
1148 curve = tls_ec_group_to_curve(dh->get_dh_group(dh));
1149 if (!curve || !dh->get_my_public_value(dh, &pub))
1150 {
1151 return FALSE;
1152 }
1153 *key_share = writer = bio_writer_create(pub.len + 7);
1154 writer->write_uint16(writer, curve);
1155 if (curve == TLS_CURVE25519 ||
1156 curve == TLS_CURVE448)
1157 {
1158 writer->write_data16(writer, pub);
1159 }
1160 else
1161 { /* classic format (see RFC 8446, section 4.2.8.2) */
1162 writer->write_uint16(writer, pub.len + 1);
1163 writer->write_uint8(writer, TLS_ANSI_UNCOMPRESSED);
1164 writer->write_data(writer, pub);
1165 }
1166 free(pub.ptr);
1167 return TRUE;
1168 }
1169
1170 /**
1171 * Send ServerHello message
1172 */
1173 static status_t send_server_hello(private_tls_server_t *this,
1174 tls_handshake_type_t *type, bio_writer_t *writer)
1175 {
1176 bio_writer_t *key_share, *extensions;
1177 tls_version_t version;
1178
1179 version = this->tls->get_version_max(this->tls);
1180
1181 /* cap legacy version at TLS 1.2 for middlebox compatibility */
1182 writer->write_uint16(writer, min(TLS_1_2, version));
1183
1184 if (this->requested_curve)
1185 {
1186 writer->write_data(writer, tls_hello_retry_request_magic);
1187 }
1188 else
1189 {
1190 writer->write_data(writer, chunk_from_thing(this->server_random));
1191 }
1192
1193 /* session identifier if we have one */
1194 writer->write_data8(writer, this->session);
1195
1196 /* add selected TLS cipher suite */
1197 writer->write_uint16(writer, this->suite);
1198
1199 /* NULL compression only */
1200 writer->write_uint8(writer, 0);
1201
1202 if (version >= TLS_1_3)
1203 {
1204 extensions = bio_writer_create(32);
1205
1206 DBG2(DBG_TLS, "sending extension: %N",
1207 tls_extension_names, TLS_EXT_SUPPORTED_VERSIONS);
1208 extensions->write_uint16(extensions, TLS_EXT_SUPPORTED_VERSIONS);
1209 extensions->write_uint16(extensions, 2);
1210 extensions->write_uint16(extensions, version);
1211
1212 DBG2(DBG_TLS, "sending extension: %N",
1213 tls_extension_names, TLS_EXT_KEY_SHARE);
1214 extensions->write_uint16(extensions, TLS_EXT_KEY_SHARE);
1215 if (this->requested_curve)
1216 {
1217 DBG1(DBG_TLS, "requesting key exchange with %N",
1218 tls_named_group_names, this->requested_curve);
1219 extensions->write_uint16(extensions, 2);
1220 extensions->write_uint16(extensions, this->requested_curve);
1221 }
1222 else
1223 {
1224 if (!tls_write_key_share(&key_share, this->dh))
1225 {
1226 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1227 extensions->destroy(extensions);
1228 return NEED_MORE;
1229 }
1230 extensions->write_data16(extensions, key_share->get_buf(key_share));
1231 key_share->destroy(key_share);
1232 }
1233
1234 writer->write_data16(writer, extensions->get_buf(extensions));
1235 extensions->destroy(extensions);
1236 }
1237
1238 *type = TLS_SERVER_HELLO;
1239 this->state = this->requested_curve ? STATE_INIT : STATE_HELLO_SENT;
1240 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1241 return NEED_MORE;
1242 }
1243
1244 /**
1245 * Send encrypted extensions message
1246 */
1247 static status_t send_encrypted_extensions(private_tls_server_t *this,
1248 tls_handshake_type_t *type,
1249 bio_writer_t *writer)
1250 {
1251 chunk_t shared_secret = chunk_empty;
1252
1253 if (!this->dh->get_shared_secret(this->dh, &shared_secret) ||
1254 !this->crypto->derive_handshake_keys(this->crypto, shared_secret))
1255 {
1256 DBG1(DBG_TLS, "DH key derivation failed");
1257 this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
1258 chunk_clear(&shared_secret);
1259 return NEED_MORE;
1260 }
1261 chunk_clear(&shared_secret);
1262
1263 this->crypto->change_cipher(this->crypto, TRUE);
1264 this->crypto->change_cipher(this->crypto, FALSE);
1265
1266 /* currently no extensions are supported */
1267 writer->write_uint16(writer, 0);
1268
1269 *type = TLS_ENCRYPTED_EXTENSIONS;
1270 this->state = STATE_ENCRYPTED_EXTENSIONS_SENT;
1271 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1272 return NEED_MORE;
1273 }
1274
1275 /**
1276 * Send Certificate
1277 */
1278 static status_t send_certificate(private_tls_server_t *this,
1279 tls_handshake_type_t *type, bio_writer_t *writer)
1280 {
1281 enumerator_t *enumerator;
1282 certificate_t *cert;
1283 auth_rule_t rule;
1284 bio_writer_t *certs;
1285 chunk_t data;
1286
1287 /* certificate request context as described in RFC 8446, section 4.4.2 */
1288 if (this->tls->get_version_max(this->tls) > TLS_1_2)
1289 {
1290 writer->write_uint8(writer, 0);
1291 }
1292
1293 /* generate certificate payload */
1294 certs = bio_writer_create(256);
1295 cert = this->server_auth->get(this->server_auth, AUTH_RULE_SUBJECT_CERT);
1296 if (cert)
1297 {
1298 if (cert->get_encoding(cert, CERT_ASN1_DER, &data))
1299 {
1300 DBG1(DBG_TLS, "sending TLS server certificate '%Y'",
1301 cert->get_subject(cert));
1302 certs->write_data24(certs, data);
1303 free(data.ptr);
1304 }
1305 /* extensions see RFC 8446, section 4.4.2 */
1306 if (this->tls->get_version_max(this->tls) > TLS_1_2)
1307 {
1308 certs->write_uint16(certs, 0);
1309 }
1310 }
1311 enumerator = this->server_auth->create_enumerator(this->server_auth);
1312 while (enumerator->enumerate(enumerator, &rule, &cert))
1313 {
1314 if (rule == AUTH_RULE_IM_CERT)
1315 {
1316 if (cert->get_encoding(cert, CERT_ASN1_DER, &data))
1317 {
1318 DBG1(DBG_TLS, "sending TLS intermediate certificate '%Y'",
1319 cert->get_subject(cert));
1320 certs->write_data24(certs, data);
1321 free(data.ptr);
1322 }
1323 }
1324 }
1325 enumerator->destroy(enumerator);
1326
1327 writer->write_data24(writer, certs->get_buf(certs));
1328 certs->destroy(certs);
1329
1330 *type = TLS_CERTIFICATE;
1331 this->state = STATE_CERT_SENT;
1332 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1333 return NEED_MORE;
1334 }
1335
1336 /**
1337 * Send Certificate Verify
1338 */
1339 static status_t send_certificate_verify(private_tls_server_t *this,
1340 tls_handshake_type_t *type,
1341 bio_writer_t *writer)
1342 {
1343 if (!this->crypto->sign_handshake(this->crypto, this->private, writer,
1344 this->hashsig))
1345 {
1346 DBG1(DBG_TLS, "signature generation failed");
1347 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1348 return NEED_MORE;
1349 }
1350
1351 *type = TLS_CERTIFICATE_VERIFY;
1352 this->state = STATE_CERT_VERIFY_SENT;
1353 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1354 return NEED_MORE;
1355 }
1356
1357 /*
1358 * Write all available certificate authorities to output writer
1359 */
1360 static void write_certificate_authorities(bio_writer_t *writer)
1361 {
1362 bio_writer_t *authorities;
1363 enumerator_t *enumerator;
1364 certificate_t *cert;
1365 x509_t *x509;
1366 identification_t *id;
1367
1368 authorities = bio_writer_create(64);
1369 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr, CERT_X509,
1370 KEY_RSA, NULL, TRUE);
1371 while (enumerator->enumerate(enumerator, &cert))
1372 {
1373 x509 = (x509_t*)cert;
1374 if (x509->get_flags(x509) & X509_CA)
1375 {
1376 id = cert->get_subject(cert);
1377 DBG1(DBG_TLS, "sending TLS cert request for '%Y'", id);
1378 authorities->write_data16(authorities, id->get_encoding(id));
1379 }
1380 }
1381 enumerator->destroy(enumerator);
1382 writer->write_data16(writer, authorities->get_buf(authorities));
1383 authorities->destroy(authorities);
1384 }
1385
1386 /**
1387 * Send Certificate Request
1388 */
1389 static status_t send_certificate_request(private_tls_server_t *this,
1390 tls_handshake_type_t *type,
1391 bio_writer_t *writer)
1392 {
1393 bio_writer_t *authorities, *supported, *extensions;
1394
1395 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1396 {
1397 supported = bio_writer_create(4);
1398 /* we propose both RSA and ECDSA */
1399 supported->write_uint8(supported, TLS_RSA_SIGN);
1400 supported->write_uint8(supported, TLS_ECDSA_SIGN);
1401 writer->write_data8(writer, supported->get_buf(supported));
1402 supported->destroy(supported);
1403 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
1404 {
1405 this->crypto->get_signature_algorithms(this->crypto, writer, TRUE);
1406 }
1407
1408 if (this->send_certreq_authorities)
1409 {
1410 write_certificate_authorities(writer);
1411 }
1412 else
1413 {
1414 writer->write_data16(writer, chunk_empty);
1415 }
1416 }
1417 else
1418 {
1419 /* certificate request context as described in RFC 8446, section 4.3.2 */
1420 writer->write_uint8(writer, 0);
1421
1422 extensions = bio_writer_create(32);
1423
1424 if (this->send_certreq_authorities)
1425 {
1426 DBG2(DBG_TLS, "sending extension: %N",
1427 tls_extension_names, TLS_EXT_CERTIFICATE_AUTHORITIES);
1428 authorities = bio_writer_create(64);
1429 write_certificate_authorities(authorities);
1430 extensions->write_uint16(extensions, TLS_EXT_CERTIFICATE_AUTHORITIES);
1431 extensions->write_data16(extensions, authorities->get_buf(authorities));
1432 authorities->destroy(authorities);
1433 }
1434
1435 DBG2(DBG_TLS, "sending extension: %N",
1436 tls_extension_names, TLS_EXT_SIGNATURE_ALGORITHMS);
1437 extensions->write_uint16(extensions, TLS_EXT_SIGNATURE_ALGORITHMS);
1438 supported = bio_writer_create(32);
1439 this->crypto->get_signature_algorithms(this->crypto, supported, TRUE);
1440 extensions->write_data16(extensions, supported->get_buf(supported));
1441 supported->destroy(supported);
1442 writer->write_data16(writer, extensions->get_buf(extensions));
1443 extensions->destroy(extensions);
1444 }
1445
1446 *type = TLS_CERTIFICATE_REQUEST;
1447 this->state = STATE_CERTREQ_SENT;
1448 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1449 return NEED_MORE;
1450 }
1451
1452 /**
1453 * Try to find a curve supported by both, client and server
1454 */
1455 static bool find_supported_curve(private_tls_server_t *this,
1456 tls_named_group_t *curve)
1457 {
1458 tls_named_group_t current;
1459 enumerator_t *enumerator;
1460
1461 enumerator = this->crypto->create_ec_enumerator(this->crypto);
1462 while (enumerator->enumerate(enumerator, NULL, &current))
1463 {
1464 if (peer_supports_curve(this, current))
1465 {
1466 *curve = current;
1467 enumerator->destroy(enumerator);
1468 return TRUE;
1469 }
1470 }
1471 enumerator->destroy(enumerator);
1472 return FALSE;
1473 }
1474
1475 /**
1476 * Send Server key Exchange
1477 */
1478 static status_t send_server_key_exchange(private_tls_server_t *this,
1479 tls_handshake_type_t *type, bio_writer_t *writer,
1480 diffie_hellman_group_t group)
1481 {
1482 diffie_hellman_params_t *params = NULL;
1483 tls_named_group_t curve;
1484 chunk_t chunk;
1485
1486 if (diffie_hellman_group_is_ec(group))
1487 {
1488 curve = tls_ec_group_to_curve(group);
1489 if (!curve || (!peer_supports_curve(this, curve) &&
1490 !find_supported_curve(this, &curve)))
1491 {
1492 DBG1(DBG_TLS, "no EC group supported by client and server");
1493 this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
1494 return NEED_MORE;
1495 }
1496 DBG2(DBG_TLS, "selected ECDH group %N", tls_named_group_names, curve);
1497 writer->write_uint8(writer, TLS_ECC_NAMED_CURVE);
1498 writer->write_uint16(writer, curve);
1499 }
1500 else
1501 {
1502 params = diffie_hellman_get_params(group);
1503 if (!params)
1504 {
1505 DBG1(DBG_TLS, "no parameters found for DH group %N",
1506 diffie_hellman_group_names, group);
1507 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1508 return NEED_MORE;
1509 }
1510 DBG2(DBG_TLS, "selected DH group %N", diffie_hellman_group_names, group);
1511 writer->write_data16(writer, params->prime);
1512 writer->write_data16(writer, params->generator);
1513 }
1514 this->dh = lib->crypto->create_dh(lib->crypto, group);
1515 if (!this->dh)
1516 {
1517 DBG1(DBG_TLS, "DH group %N not supported",
1518 diffie_hellman_group_names, group);
1519 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1520 return NEED_MORE;
1521 }
1522 if (!this->dh->get_my_public_value(this->dh, &chunk))
1523 {
1524 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1525 return NEED_MORE;
1526 }
1527 if (params)
1528 {
1529 writer->write_data16(writer, chunk);
1530 }
1531 else
1532 { /* ECP uses 8bit length header only, but a point format */
1533 writer->write_uint8(writer, chunk.len + 1);
1534 writer->write_uint8(writer, TLS_ANSI_UNCOMPRESSED);
1535 writer->write_data(writer, chunk);
1536 }
1537 free(chunk.ptr);
1538
1539 chunk = chunk_cat("ccc", chunk_from_thing(this->client_random),
1540 chunk_from_thing(this->server_random), writer->get_buf(writer));
1541 if (!this->private || !this->crypto->sign(this->crypto, this->private,
1542 writer, chunk, this->hashsig))
1543 {
1544 DBG1(DBG_TLS, "signing DH parameters failed");
1545 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1546 free(chunk.ptr);
1547 return NEED_MORE;
1548 }
1549 free(chunk.ptr);
1550 *type = TLS_SERVER_KEY_EXCHANGE;
1551 this->state = STATE_KEY_EXCHANGE_SENT;
1552 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1553 return NEED_MORE;
1554 }
1555
1556 /**
1557 * Send Hello Done
1558 */
1559 static status_t send_hello_done(private_tls_server_t *this,
1560 tls_handshake_type_t *type, bio_writer_t *writer)
1561 {
1562 *type = TLS_SERVER_HELLO_DONE;
1563 this->state = STATE_HELLO_DONE;
1564 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1565 return NEED_MORE;
1566 }
1567
1568 /**
1569 * Send Finished
1570 */
1571 static status_t send_finished(private_tls_server_t *this,
1572 tls_handshake_type_t *type, bio_writer_t *writer)
1573 {
1574 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1575 {
1576 char buf[12];
1577
1578 if (!this->crypto->calculate_finished_legacy(this->crypto,
1579 "server finished", buf))
1580 {
1581 DBG1(DBG_TLS, "calculating server finished data failed");
1582 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1583 return FAILED;
1584 }
1585
1586 writer->write_data(writer, chunk_from_thing(buf));
1587 }
1588 else
1589 {
1590 chunk_t verify_data;
1591
1592 if (!this->crypto->calculate_finished(this->crypto, TRUE, &verify_data))
1593 {
1594 DBG1(DBG_TLS, "calculating server finished data failed");
1595 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1596 return NEED_MORE;
1597 }
1598
1599 writer->write_data(writer, verify_data);
1600 chunk_free(&verify_data);
1601 }
1602
1603 *type = TLS_FINISHED;
1604 this->state = STATE_FINISHED_SENT;
1605 this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
1606
1607 return NEED_MORE;
1608 }
1609
1610 /**
1611 * Send KeyUpdate message
1612 */
1613 static status_t send_key_update(private_tls_server_t *this,
1614 tls_handshake_type_t *type, bio_writer_t *writer)
1615 {
1616 *type = TLS_KEY_UPDATE;
1617
1618 /* we currently only send this as reply, so we never request an update */
1619 writer->write_uint8(writer, 0);
1620
1621 this->state = STATE_KEY_UPDATE_SENT;
1622 return NEED_MORE;
1623 }
1624
1625 METHOD(tls_handshake_t, build, status_t,
1626 private_tls_server_t *this, tls_handshake_type_t *type, bio_writer_t *writer)
1627 {
1628 diffie_hellman_group_t group;
1629
1630 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1631 {
1632 switch (this->state)
1633 {
1634 case STATE_HELLO_RECEIVED:
1635 return send_server_hello(this, type, writer);
1636 case STATE_HELLO_SENT:
1637 return send_certificate(this, type, writer);
1638 case STATE_CERT_SENT:
1639 group = this->crypto->get_dh_group(this->crypto);
1640 if (group)
1641 {
1642 return send_server_key_exchange(this, type, writer, group);
1643 }
1644 /* otherwise fall through to next state */
1645 case STATE_KEY_EXCHANGE_SENT:
1646 if (this->peer)
1647 {
1648 return send_certificate_request(this, type, writer);
1649 }
1650 /* otherwise fall through to next state */
1651 case STATE_CERTREQ_SENT:
1652 return send_hello_done(this, type, writer);
1653 case STATE_CIPHERSPEC_CHANGED_OUT:
1654 return send_finished(this, type, writer);
1655 case STATE_FINISHED_SENT:
1656 return INVALID_STATE;
1657 default:
1658 return INVALID_STATE;
1659 }
1660 }
1661 else
1662 {
1663 switch (this->state)
1664 {
1665 case STATE_HELLO_RECEIVED:
1666 return send_server_hello(this, type, writer);
1667 case STATE_HELLO_SENT:
1668 case STATE_CIPHERSPEC_CHANGED_OUT:
1669 return send_encrypted_extensions(this, type, writer);
1670 case STATE_ENCRYPTED_EXTENSIONS_SENT:
1671 if (this->peer)
1672 {
1673 return send_certificate_request(this, type, writer);
1674 }
1675 /* otherwise fall through to next state */
1676 case STATE_CERTREQ_SENT:
1677 return send_certificate(this, type, writer);
1678 case STATE_CERT_SENT:
1679 return send_certificate_verify(this, type, writer);
1680 case STATE_CERT_VERIFY_SENT:
1681 return send_finished(this, type, writer);
1682 case STATE_FINISHED_SENT:
1683 if (!this->crypto->derive_app_keys(this->crypto))
1684 {
1685 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1686 return NEED_MORE;
1687 }
1688 /* inbound key switches after process client finished message */
1689 this->crypto->change_cipher(this->crypto, FALSE);
1690 this->state = STATE_FINISHED_SENT_KEY_SWITCHED;
1691 return INVALID_STATE;
1692 case STATE_KEY_UPDATE_REQUESTED:
1693 return send_key_update(this, type, writer);
1694 case STATE_KEY_UPDATE_SENT:
1695 if (!this->crypto->update_app_keys(this->crypto, FALSE))
1696 {
1697 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
1698 return NEED_MORE;
1699 }
1700 this->crypto->change_cipher(this->crypto, FALSE);
1701 this->state = STATE_FINISHED_RECEIVED;
1702 default:
1703 return INVALID_STATE;
1704 }
1705 }
1706 }
1707
1708 METHOD(tls_handshake_t, cipherspec_changed, bool,
1709 private_tls_server_t *this, bool inbound)
1710 {
1711 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1712 {
1713 if (inbound)
1714 {
1715 if (this->resume)
1716 {
1717 return this->state == STATE_FINISHED_SENT;
1718 }
1719 if (this->peer)
1720 {
1721 return this->state == STATE_CERT_VERIFY_RECEIVED;
1722 }
1723 return this->state == STATE_KEY_EXCHANGE_RECEIVED;
1724 }
1725 else
1726 {
1727 if (this->resume)
1728 {
1729 return this->state == STATE_HELLO_SENT;
1730 }
1731 return this->state == STATE_FINISHED_RECEIVED;
1732 }
1733 return FALSE;
1734 }
1735 else
1736 {
1737 if (inbound)
1738 { /* accept ChangeCipherSpec after ServerFinish or HelloRetryRequest */
1739 return this->state == STATE_FINISHED_SENT ||
1740 this->state == STATE_FINISHED_SENT_KEY_SWITCHED ||
1741 retrying(this);
1742 }
1743 else
1744 {
1745 return this->state == STATE_HELLO_SENT;
1746 }
1747 }
1748 }
1749
1750 METHOD(tls_handshake_t, change_cipherspec, void,
1751 private_tls_server_t *this, bool inbound)
1752 {
1753 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1754 {
1755 this->crypto->change_cipher(this->crypto, inbound);
1756 }
1757
1758 if (retrying(this))
1759 { /* client might send a ChangeCipherSpec after a HelloRetryRequest and
1760 * before a new ClientHello which should not cause any state changes */
1761 return;
1762 }
1763
1764 if (inbound)
1765 {
1766 this->state = STATE_CIPHERSPEC_CHANGED_IN;
1767 }
1768 else
1769 {
1770 this->state = STATE_CIPHERSPEC_CHANGED_OUT;
1771 }
1772 }
1773
1774 METHOD(tls_handshake_t, finished, bool,
1775 private_tls_server_t *this)
1776 {
1777 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1778 {
1779 if (this->resume)
1780 {
1781 return this->state == STATE_FINISHED_RECEIVED;
1782 }
1783 return this->state == STATE_FINISHED_SENT;
1784 }
1785 else
1786 {
1787 return this->state == STATE_FINISHED_RECEIVED;
1788 }
1789 }
1790
1791 METHOD(tls_handshake_t, get_peer_id, identification_t*,
1792 private_tls_server_t *this)
1793 {
1794 return this->peer;
1795 }
1796
1797 METHOD(tls_handshake_t, get_server_id, identification_t*,
1798 private_tls_server_t *this)
1799 {
1800 return this->server;
1801 }
1802
1803 METHOD(tls_handshake_t, get_auth, auth_cfg_t*,
1804 private_tls_server_t *this)
1805 {
1806 return this->peer_auth;
1807 }
1808
1809 METHOD(tls_handshake_t, destroy, void,
1810 private_tls_server_t *this)
1811 {
1812 DESTROY_IF(this->private);
1813 DESTROY_IF(this->dh);
1814 DESTROY_IF(this->peer);
1815 this->server->destroy(this->server);
1816 this->peer_auth->destroy(this->peer_auth);
1817 this->server_auth->destroy(this->server_auth);
1818 free(this->hashsig.ptr);
1819 free(this->curves.ptr);
1820 free(this->session.ptr);
1821 free(this);
1822 }
1823
1824 /**
1825 * See header
1826 */
1827 tls_server_t *tls_server_create(tls_t *tls,
1828 tls_crypto_t *crypto, tls_alert_t *alert,
1829 identification_t *server, identification_t *peer)
1830 {
1831 private_tls_server_t *this;
1832
1833 INIT(this,
1834 .public = {
1835 .handshake = {
1836 .process = _process,
1837 .build = _build,
1838 .cipherspec_changed = _cipherspec_changed,
1839 .change_cipherspec = _change_cipherspec,
1840 .finished = _finished,
1841 .get_peer_id = _get_peer_id,
1842 .get_server_id = _get_server_id,
1843 .get_auth = _get_auth,
1844 .destroy = _destroy,
1845 },
1846 },
1847 .tls = tls,
1848 .crypto = crypto,
1849 .alert = alert,
1850 .server = server->clone(server),
1851 .peer = peer ? peer->clone(peer) : NULL,
1852 .state = STATE_INIT,
1853 .peer_auth = auth_cfg_create(),
1854 .server_auth = auth_cfg_create(),
1855 .send_certreq_authorities = lib->settings->get_bool(lib->settings,
1856 "%s.tls.send_certreq_authorities",
1857 TRUE, lib->ns),
1858 );
1859
1860 return &this->public;
1861 }
strongSwan - IPsec VPN