src/libtls/tls_server.c

   1 /*
   2  * Copyright (C) 2010 Martin Willi
   3  * Copyright (C) 2010 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tls_server.h"
  17
  18 #include <time.h>
  19
  20 #include <debug.h>
  21 #include <credentials/certificates/x509.h>
  22
  23 typedef struct private_tls_server_t private_tls_server_t;
  24
  25 /**
  26  * Size of a session ID
  27  */
  28 #define SESSION_ID_SIZE 16
  29
  30 typedef enum {
  31         STATE_INIT,
  32         STATE_HELLO_RECEIVED,
  33         STATE_HELLO_SENT,
  34         STATE_CERT_SENT,
  35         STATE_KEY_EXCHANGE_SENT,
  36         STATE_CERTREQ_SENT,
  37         STATE_HELLO_DONE,
  38         STATE_CERT_RECEIVED,
  39         STATE_KEY_EXCHANGE_RECEIVED,
  40         STATE_CERT_VERIFY_RECEIVED,
  41         STATE_CIPHERSPEC_CHANGED_IN,
  42         STATE_FINISHED_RECEIVED,
  43         STATE_CIPHERSPEC_CHANGED_OUT,
  44         STATE_FINISHED_SENT,
  45 } server_state_t;
  46
  47 /**
  48  * Private data of an tls_server_t object.
  49  */
  50 struct private_tls_server_t {
  51
  52         /**
  53          * Public tls_server_t interface.
  54          */
  55         tls_server_t public;
  56
  57         /**
  58          * TLS stack
  59          */
  60         tls_t *tls;
  61
  62         /**
  63          * TLS crypto context
  64          */
  65         tls_crypto_t *crypto;
  66
  67         /**
  68          * TLS alert handler
  69          */
  70         tls_alert_t *alert;
  71
  72         /**
  73          * Server identity
  74          */
  75         identification_t *server;
  76
  77         /**
  78          * Peer identity, NULL for no client authentication
  79          */
  80         identification_t *peer;
  81
  82         /**
  83          * State we are in
  84          */
  85         server_state_t state;
  86
  87         /**
  88          * Hello random data selected by client
  89          */
  90         char client_random[32];
  91
  92         /**
  93          * Hello random data selected by server
  94          */
  95         char server_random[32];
  96
  97         /**
  98          * Auth helper for peer authentication
  99          */
 100         auth_cfg_t *peer_auth;
 101
 102         /**
 103          * Auth helper for server authentication
 104          */
 105         auth_cfg_t *server_auth;
 106
 107         /**
 108          * Peer private key
 109          */
 110         private_key_t *private;
 111
 112         /**
 113          * DHE exchange
 114          */
 115         diffie_hellman_t *dh;
 116
 117         /**
 118          * Selected TLS cipher suite
 119          */
 120         tls_cipher_suite_t suite;
 121
 122         /**
 123          * Offered TLS version of the client
 124          */
 125         tls_version_t client_version;
 126
 127         /**
 128          * TLS session identifier
 129          */
 130         chunk_t session;
 131
 132         /**
 133          * Do we resume a session?
 134          */
 135         bool resume;
 136
 137         /**
 138          * Hash and signature algorithms supported by peer
 139          */
 140         chunk_t hashsig;
 141
 142         /**
 143          * Elliptic curves supported by peer
 144          */
 145         chunk_t curves;
 146
 147         /**
 148          * Did we receive the curves from the client?
 149          */
 150         bool curves_received;
 151 };
 152
 153 /**
 154  * Find a cipher suite and a server key
 155  */
 156 static bool select_suite_and_key(private_tls_server_t *this,
 157                                                                  tls_cipher_suite_t *suites, int count)
 158 {
 159         private_key_t *key;
 160         key_type_t type;
 161
 162         key = lib->credmgr->get_private(lib->credmgr, KEY_ANY, this->server,
 163                                                                         this->server_auth);
 164         if (!key)
 165         {
 166                 DBG1(DBG_TLS, "no usable TLS server certificate found for '%Y'",
 167                          this->server);
 168                 return FALSE;
 169         }
 170         this->suite = this->crypto->select_cipher_suite(this->crypto,
 171                                                                                         suites, count, key->get_type(key));
 172         if (!this->suite)
 173         {       /* no match for this key, try to find another type */
 174                 if (key->get_type(key) == KEY_ECDSA)
 175                 {
 176                         type = KEY_RSA;
 177                 }
 178                 else
 179                 {
 180                         type = KEY_ECDSA;
 181                 }
 182                 key->destroy(key);
 183
 184                 this->suite = this->crypto->select_cipher_suite(this->crypto,
 185                                                                                         suites, count, type);
 186                 if (!this->suite)
 187                 {
 188                         DBG1(DBG_TLS, "received cipher suites inacceptable");
 189                         return FALSE;
 190                 }
 191                 this->server_auth->destroy(this->server_auth);
 192                 this->server_auth = auth_cfg_create();
 193                 key = lib->credmgr->get_private(lib->credmgr, type, this->server,
 194                                                                                 this->server_auth);
 195                 if (!key)
 196                 {
 197                         DBG1(DBG_TLS, "received cipher suites inacceptable");
 198                         return FALSE;
 199                 }
 200         }
 201         this->private = key;
 202         return TRUE;
 203 }
 204
 205 /**
 206  * Process client hello message
 207  */
 208 static status_t process_client_hello(private_tls_server_t *this,
 209                                                                          bio_reader_t *reader)
 210 {
 211         u_int16_t version, extension;
 212         chunk_t random, session, ciphers, compression, ext = chunk_empty;
 213         bio_reader_t *extensions;
 214         tls_cipher_suite_t *suites;
 215         int count, i;
 216         rng_t *rng;
 217
 218         this->crypto->append_handshake(this->crypto,
 219                                                                    TLS_CLIENT_HELLO, reader->peek(reader));
 220
 221         if (!reader->read_uint16(reader, &version) ||
 222                 !reader->read_data(reader, sizeof(this->client_random), &random) ||
 223                 !reader->read_data8(reader, &session) ||
 224                 !reader->read_data16(reader, &ciphers) ||
 225                 !reader->read_data8(reader, &compression) ||
 226                 (reader->remaining(reader) && !reader->read_data16(reader, &ext)))
 227         {
 228                 DBG1(DBG_TLS, "received invalid ClientHello");
 229                 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 230                 return NEED_MORE;
 231         }
 232
 233         if (ext.len)
 234         {
 235                 extensions = bio_reader_create(ext);
 236                 while (extensions->remaining(extensions))
 237                 {
 238                         if (!extensions->read_uint16(extensions, &extension) ||
 239                                 !extensions->read_data16(extensions, &ext))
 240                         {
 241                                 DBG1(DBG_TLS, "received invalid ClientHello Extensions");
 242                                 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 243                                 extensions->destroy(extensions);
 244                                 return NEED_MORE;
 245                         }
 246                         DBG2(DBG_TLS, "received TLS '%N' extension",
 247                                  tls_extension_names, extension);
 248                         DBG3(DBG_TLS, "%B", &ext);
 249                         switch (extension)
 250                         {
 251                                 case TLS_EXT_SIGNATURE_ALGORITHMS:
 252                                         this->hashsig = chunk_clone(ext);
 253                                         break;
 254                                 case TLS_EXT_ELLIPTIC_CURVES:
 255                                         this->curves_received = TRUE;
 256                                         this->curves = chunk_clone(ext);
 257                                         break;
 258                                 default:
 259                                         break;
 260                         }
 261                 }
 262                 extensions->destroy(extensions);
 263         }
 264
 265         memcpy(this->client_random, random.ptr, sizeof(this->client_random));
 266
 267         htoun32(&this->server_random, time(NULL));
 268         rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 269         if (!rng ||
 270                 !rng->get_bytes(rng, sizeof(this->server_random) - 4,
 271                                                 this->server_random + 4))
 272         {
 273                 DBG1(DBG_TLS, "failed to generate server random");
 274                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 275                 DESTROY_IF(rng);
 276                 return NEED_MORE;
 277         }
 278         rng->destroy(rng);
 279
 280         if (!this->tls->set_version(this->tls, version))
 281         {
 282                 DBG1(DBG_TLS, "negotiated version %N not supported",
 283                          tls_version_names, version);
 284                 this->alert->add(this->alert, TLS_FATAL, TLS_PROTOCOL_VERSION);
 285                 return NEED_MORE;
 286         }
 287
 288         this->client_version = version;
 289         this->suite = this->crypto->resume_session(this->crypto, session, this->peer,
 290                                                                                 chunk_from_thing(this->client_random),
 291                                                                                 chunk_from_thing(this->server_random));
 292         if (this->suite)
 293         {
 294                 this->session = chunk_clone(session);
 295                 this->resume = TRUE;
 296                 DBG1(DBG_TLS, "resumed %N using suite %N",
 297                          tls_version_names, this->tls->get_version(this->tls),
 298                          tls_cipher_suite_names, this->suite);
 299         }
 300         else
 301         {
 302                 count = ciphers.len / sizeof(u_int16_t);
 303                 suites = alloca(count * sizeof(tls_cipher_suite_t));
 304                 DBG2(DBG_TLS, "received %d TLS cipher suites:", count);
 305                 for (i = 0; i < count; i++)
 306                 {
 307                         suites[i] = untoh16(&ciphers.ptr[i * sizeof(u_int16_t)]);
 308                         DBG2(DBG_TLS, "  %N", tls_cipher_suite_names, suites[i]);
 309                 }
 310                 if (!select_suite_and_key(this, suites, count))
 311                 {
 312                         this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
 313                         return NEED_MORE;
 314                 }
 315                 rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
 316                 if (rng)
 317                 {
 318                         rng->allocate_bytes(rng, SESSION_ID_SIZE, &this->session);
 319                         rng->destroy(rng);
 320                 }
 321                 DBG1(DBG_TLS, "negotiated %N using suite %N",
 322                          tls_version_names, this->tls->get_version(this->tls),
 323                          tls_cipher_suite_names, this->suite);
 324         }
 325         this->state = STATE_HELLO_RECEIVED;
 326         return NEED_MORE;
 327 }
 328
 329 /**
 330  * Process certificate
 331  */
 332 static status_t process_certificate(private_tls_server_t *this,
 333                                                                         bio_reader_t *reader)
 334 {
 335         certificate_t *cert;
 336         bio_reader_t *certs;
 337         chunk_t data;
 338         bool first = TRUE;
 339
 340         this->crypto->append_handshake(this->crypto,
 341                                                                    TLS_CERTIFICATE, reader->peek(reader));
 342
 343         if (!reader->read_data24(reader, &data))
 344         {
 345                 DBG1(DBG_TLS, "certificate message header invalid");
 346                 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 347                 return NEED_MORE;
 348         }
 349         certs = bio_reader_create(data);
 350         while (certs->remaining(certs))
 351         {
 352                 if (!certs->read_data24(certs, &data))
 353                 {
 354                         DBG1(DBG_TLS, "certificate message invalid");
 355                         this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 356                         certs->destroy(certs);
 357                         return NEED_MORE;
 358                 }
 359                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 360                                                                   BUILD_BLOB_ASN1_DER, data, BUILD_END);
 361                 if (cert)
 362                 {
 363                         if (first)
 364                         {
 365                                 this->peer_auth->add(this->peer_auth,
 366                                                                          AUTH_HELPER_SUBJECT_CERT, cert);
 367                                 DBG1(DBG_TLS, "received TLS peer certificate '%Y'",
 368                                          cert->get_subject(cert));
 369                                 first = FALSE;
 370                         }
 371                         else
 372                         {
 373                                 DBG1(DBG_TLS, "received TLS intermediate certificate '%Y'",
 374                                          cert->get_subject(cert));
 375                                 this->peer_auth->add(this->peer_auth, AUTH_HELPER_IM_CERT, cert);
 376                         }
 377                 }
 378                 else
 379                 {
 380                         DBG1(DBG_TLS, "parsing TLS certificate failed, skipped");
 381                         this->alert->add(this->alert, TLS_WARNING, TLS_BAD_CERTIFICATE);
 382                 }
 383         }
 384         certs->destroy(certs);
 385         this->state = STATE_CERT_RECEIVED;
 386         return NEED_MORE;
 387 }
 388
 389 /**
 390  * Process Client Key Exchange, using premaster encryption
 391  */
 392 static status_t process_key_exchange_encrypted(private_tls_server_t *this,
 393                                                                                            bio_reader_t *reader)
 394 {
 395         chunk_t encrypted, decrypted;
 396         char premaster[48];
 397         rng_t *rng;
 398
 399         this->crypto->append_handshake(this->crypto,
 400                                                                    TLS_CLIENT_KEY_EXCHANGE, reader->peek(reader));
 401
 402         if (!reader->read_data16(reader, &encrypted))
 403         {
 404                 DBG1(DBG_TLS, "received invalid Client Key Exchange");
 405                 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 406                 return NEED_MORE;
 407         }
 408
 409         htoun16(premaster, this->client_version);
 410         /* pre-randomize premaster for failure cases */
 411         rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 412         if (!rng || !rng->get_bytes(rng, sizeof(premaster) - 2, premaster + 2))
 413         {
 414                 DBG1(DBG_TLS, "failed to generate premaster secret");
 415                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 416                 DESTROY_IF(rng);
 417                 return NEED_MORE;
 418         }
 419         rng->destroy(rng);
 420
 421         if (this->private &&
 422                 this->private->decrypt(this->private,
 423                                                            ENCRYPT_RSA_PKCS1, encrypted, &decrypted))
 424         {
 425                 if (decrypted.len == sizeof(premaster) &&
 426                         untoh16(decrypted.ptr) == this->client_version)
 427                 {
 428                         memcpy(premaster + 2, decrypted.ptr + 2, sizeof(premaster) - 2);
 429                 }
 430                 else
 431                 {
 432                         DBG1(DBG_TLS, "decrypted premaster has invalid length/version");
 433                 }
 434                 chunk_clear(&decrypted);
 435         }
 436         else
 437         {
 438                 DBG1(DBG_TLS, "decrypting Client Key Exchange failed");
 439         }
 440
 441         if (!this->crypto->derive_secrets(this->crypto, chunk_from_thing(premaster),
 442                                                                           this->session, this->peer,
 443                                                                           chunk_from_thing(this->client_random),
 444                                                                           chunk_from_thing(this->server_random)))
 445         {
 446                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 447                 return NEED_MORE;
 448         }
 449
 450         this->state = STATE_KEY_EXCHANGE_RECEIVED;
 451         return NEED_MORE;
 452 }
 453
 454 /**
 455  * Process client key exchange, using DHE exchange
 456  */
 457 static status_t process_key_exchange_dhe(private_tls_server_t *this,
 458                                                                                  bio_reader_t *reader)
 459 {
 460         chunk_t premaster, pub;
 461         bool ec;
 462
 463         this->crypto->append_handshake(this->crypto,
 464                                                                    TLS_CLIENT_KEY_EXCHANGE, reader->peek(reader));
 465
 466         ec = diffie_hellman_group_is_ec(this->dh->get_dh_group(this->dh));
 467         if ((ec && !reader->read_data8(reader, &pub)) ||
 468                 (!ec && (!reader->read_data16(reader, &pub) || pub.len == 0)))
 469         {
 470                 DBG1(DBG_TLS, "received invalid Client Key Exchange");
 471                 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 472                 return NEED_MORE;
 473         }
 474
 475         if (ec)
 476         {
 477                 if (pub.ptr[0] != TLS_ANSI_UNCOMPRESSED)
 478                 {
 479                         DBG1(DBG_TLS, "DH point format '%N' not supported",
 480                                  tls_ansi_point_format_names, pub.ptr[0]);
 481                         this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 482                         return NEED_MORE;
 483                 }
 484                 pub = chunk_skip(pub, 1);
 485         }
 486         this->dh->set_other_public_value(this->dh, pub);
 487         if (this->dh->get_shared_secret(this->dh, &premaster) != SUCCESS)
 488         {
 489                 DBG1(DBG_TLS, "calculating premaster from DH failed");
 490                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 491                 return NEED_MORE;
 492         }
 493
 494         if (!this->crypto->derive_secrets(this->crypto, premaster,
 495                                                                           this->session, this->peer,
 496                                                                           chunk_from_thing(this->client_random),
 497                                                                           chunk_from_thing(this->server_random)))
 498         {
 499                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 500                 chunk_clear(&premaster);
 501                 return NEED_MORE;
 502         }
 503         chunk_clear(&premaster);
 504
 505         this->state = STATE_KEY_EXCHANGE_RECEIVED;
 506         return NEED_MORE;
 507 }
 508
 509 /**
 510  * Process Client Key Exchange
 511  */
 512 static status_t process_key_exchange(private_tls_server_t *this,
 513                                                                          bio_reader_t *reader)
 514 {
 515         if (this->dh)
 516         {
 517                 return process_key_exchange_dhe(this, reader);
 518         }
 519         return process_key_exchange_encrypted(this, reader);
 520 }
 521
 522 /**
 523  * Process Certificate verify
 524  */
 525 static status_t process_cert_verify(private_tls_server_t *this,
 526                                                                         bio_reader_t *reader)
 527 {
 528         bool verified = FALSE;
 529         enumerator_t *enumerator;
 530         public_key_t *public;
 531         auth_cfg_t *auth;
 532         bio_reader_t *sig;
 533
 534         enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
 535                                                                                 KEY_ANY, this->peer, this->peer_auth);
 536         while (enumerator->enumerate(enumerator, &public, &auth))
 537         {
 538                 sig = bio_reader_create(reader->peek(reader));
 539                 verified = this->crypto->verify_handshake(this->crypto, public, sig);
 540                 sig->destroy(sig);
 541                 if (verified)
 542                 {
 543                         break;
 544                 }
 545                 DBG1(DBG_TLS, "signature verification failed, trying another key");
 546         }
 547         enumerator->destroy(enumerator);
 548
 549         if (!verified)
 550         {
 551                 DBG1(DBG_TLS, "no trusted certificate found for '%Y' to verify TLS peer",
 552                          this->peer);
 553                 this->alert->add(this->alert, TLS_FATAL, TLS_CERTIFICATE_UNKNOWN);
 554                 return NEED_MORE;
 555         }
 556
 557         this->crypto->append_handshake(this->crypto,
 558                                                                    TLS_CERTIFICATE_VERIFY, reader->peek(reader));
 559         this->state = STATE_CERT_VERIFY_RECEIVED;
 560         return NEED_MORE;
 561 }
 562
 563 /**
 564  * Process finished message
 565  */
 566 static status_t process_finished(private_tls_server_t *this,
 567                                                                  bio_reader_t *reader)
 568 {
 569         chunk_t received;
 570         char buf[12];
 571
 572         if (!reader->read_data(reader, sizeof(buf), &received))
 573         {
 574                 DBG1(DBG_TLS, "received client finished too short");
 575                 this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
 576                 return NEED_MORE;
 577         }
 578         if (!this->crypto->calculate_finished(this->crypto, "client finished", buf))
 579         {
 580                 DBG1(DBG_TLS, "calculating client finished failed");
 581                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 582                 return NEED_MORE;
 583         }
 584         if (!chunk_equals(received, chunk_from_thing(buf)))
 585         {
 586                 DBG1(DBG_TLS, "received client finished invalid");
 587                 this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
 588                 return NEED_MORE;
 589         }
 590
 591         this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
 592         this->state = STATE_FINISHED_RECEIVED;
 593         return NEED_MORE;
 594 }
 595
 596 METHOD(tls_handshake_t, process, status_t,
 597         private_tls_server_t *this, tls_handshake_type_t type, bio_reader_t *reader)
 598 {
 599         tls_handshake_type_t expected;
 600
 601         switch (this->state)
 602         {
 603                 case STATE_INIT:
 604                         if (type == TLS_CLIENT_HELLO)
 605                         {
 606                                 return process_client_hello(this, reader);
 607                         }
 608                         expected = TLS_CLIENT_HELLO;
 609                         break;
 610                 case STATE_HELLO_DONE:
 611                         if (type == TLS_CERTIFICATE)
 612                         {
 613                                 return process_certificate(this, reader);
 614                         }
 615                         if (this->peer)
 616                         {
 617                                 expected = TLS_CERTIFICATE;
 618                                 break;
 619                         }
 620                         /* otherwise fall through to next state */
 621                 case STATE_CERT_RECEIVED:
 622                         if (type == TLS_CLIENT_KEY_EXCHANGE)
 623                         {
 624                                 return process_key_exchange(this, reader);
 625                         }
 626                         expected = TLS_CLIENT_KEY_EXCHANGE;
 627                         break;
 628                 case STATE_KEY_EXCHANGE_RECEIVED:
 629                         if (type == TLS_CERTIFICATE_VERIFY)
 630                         {
 631                                 return process_cert_verify(this, reader);
 632                         }
 633                         if (this->peer)
 634                         {
 635                                 expected = TLS_CERTIFICATE_VERIFY;
 636                                 break;
 637                         }
 638                         return INVALID_STATE;
 639                 case STATE_CIPHERSPEC_CHANGED_IN:
 640                         if (type == TLS_FINISHED)
 641                         {
 642                                 return process_finished(this, reader);
 643                         }
 644                         expected = TLS_FINISHED;
 645                         break;
 646                 default:
 647                         DBG1(DBG_TLS, "TLS %N not expected in current state",
 648                                  tls_handshake_type_names, type);
 649                         this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE);
 650                         return NEED_MORE;
 651         }
 652         DBG1(DBG_TLS, "TLS %N expected, but received %N",
 653                  tls_handshake_type_names, expected, tls_handshake_type_names, type);
 654         this->alert->add(this->alert, TLS_FATAL, TLS_UNEXPECTED_MESSAGE);
 655         return NEED_MORE;
 656 }
 657
 658 /**
 659  * Send ServerHello message
 660  */
 661 static status_t send_server_hello(private_tls_server_t *this,
 662                                                         tls_handshake_type_t *type, bio_writer_t *writer)
 663 {
 664         /* TLS version */
 665         writer->write_uint16(writer, this->tls->get_version(this->tls));
 666         writer->write_data(writer, chunk_from_thing(this->server_random));
 667
 668         /* session identifier if we have one */
 669         writer->write_data8(writer, this->session);
 670
 671         /* add selected TLS cipher suite */
 672         writer->write_uint16(writer, this->suite);
 673
 674         /* NULL compression only */
 675         writer->write_uint8(writer, 0);
 676
 677         *type = TLS_SERVER_HELLO;
 678         this->state = STATE_HELLO_SENT;
 679         this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
 680         return NEED_MORE;
 681 }
 682
 683 /**
 684  * Send Certificate
 685  */
 686 static status_t send_certificate(private_tls_server_t *this,
 687                                                         tls_handshake_type_t *type, bio_writer_t *writer)
 688 {
 689         enumerator_t *enumerator;
 690         certificate_t *cert;
 691         auth_rule_t rule;
 692         bio_writer_t *certs;
 693         chunk_t data;
 694
 695         /* generate certificate payload */
 696         certs = bio_writer_create(256);
 697         cert = this->server_auth->get(this->server_auth, AUTH_RULE_SUBJECT_CERT);
 698         if (cert)
 699         {
 700                 if (cert->get_encoding(cert, CERT_ASN1_DER, &data))
 701                 {
 702                         DBG1(DBG_TLS, "sending TLS server certificate '%Y'",
 703                                  cert->get_subject(cert));
 704                         certs->write_data24(certs, data);
 705                         free(data.ptr);
 706                 }
 707         }
 708         enumerator = this->server_auth->create_enumerator(this->server_auth);
 709         while (enumerator->enumerate(enumerator, &rule, &cert))
 710         {
 711                 if (rule == AUTH_RULE_IM_CERT)
 712                 {
 713                         if (cert->get_encoding(cert, CERT_ASN1_DER, &data))
 714                         {
 715                                 DBG1(DBG_TLS, "sending TLS intermediate certificate '%Y'",
 716                                          cert->get_subject(cert));
 717                                 certs->write_data24(certs, data);
 718                                 free(data.ptr);
 719                         }
 720                 }
 721         }
 722         enumerator->destroy(enumerator);
 723
 724         writer->write_data24(writer, certs->get_buf(certs));
 725         certs->destroy(certs);
 726
 727         *type = TLS_CERTIFICATE;
 728         this->state = STATE_CERT_SENT;
 729         this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
 730         return NEED_MORE;
 731 }
 732
 733 /**
 734  * Send Certificate Request
 735  */
 736 static status_t send_certificate_request(private_tls_server_t *this,
 737                                                         tls_handshake_type_t *type, bio_writer_t *writer)
 738 {
 739         bio_writer_t *authorities, *supported;
 740         enumerator_t *enumerator;
 741         certificate_t *cert;
 742         x509_t *x509;
 743         identification_t *id;
 744
 745         supported = bio_writer_create(4);
 746         /* we propose both RSA and ECDSA */
 747         supported->write_uint8(supported, TLS_RSA_SIGN);
 748         supported->write_uint8(supported, TLS_ECDSA_SIGN);
 749         writer->write_data8(writer, supported->get_buf(supported));
 750         supported->destroy(supported);
 751         if (this->tls->get_version(this->tls) >= TLS_1_2)
 752         {
 753                 this->crypto->get_signature_algorithms(this->crypto, writer);
 754         }
 755
 756         authorities = bio_writer_create(64);
 757         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 758                                                                                                 CERT_X509, KEY_RSA, NULL, TRUE);
 759         while (enumerator->enumerate(enumerator, &cert))
 760         {
 761                 x509 = (x509_t*)cert;
 762                 if (x509->get_flags(x509) & X509_CA)
 763                 {
 764                         id = cert->get_subject(cert);
 765                         DBG1(DBG_TLS, "sending TLS cert request for '%Y'", id);
 766                         authorities->write_data16(authorities, id->get_encoding(id));
 767                 }
 768         }
 769         enumerator->destroy(enumerator);
 770         writer->write_data16(writer, authorities->get_buf(authorities));
 771         authorities->destroy(authorities);
 772
 773         *type = TLS_CERTIFICATE_REQUEST;
 774         this->state = STATE_CERTREQ_SENT;
 775         this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
 776         return NEED_MORE;
 777 }
 778
 779 /**
 780  * Get the TLS curve of a given EC DH group
 781  */
 782 static tls_named_curve_t ec_group_to_curve(private_tls_server_t *this,
 783                                                                                    diffie_hellman_group_t group)
 784 {
 785         diffie_hellman_group_t current;
 786         tls_named_curve_t curve;
 787         enumerator_t *enumerator;
 788
 789         enumerator = this->crypto->create_ec_enumerator(this->crypto);
 790         while (enumerator->enumerate(enumerator, &current, &curve))
 791         {
 792                 if (current == group)
 793                 {
 794                         enumerator->destroy(enumerator);
 795                         return curve;
 796                 }
 797         }
 798         enumerator->destroy(enumerator);
 799         return 0;
 800 }
 801
 802 /**
 803  * Check if the peer supports a given TLS curve
 804  */
 805 bool peer_supports_curve(private_tls_server_t *this, tls_named_curve_t curve)
 806 {
 807         bio_reader_t *reader;
 808         u_int16_t current;
 809
 810         if (!this->curves_received)
 811         {       /* none received, assume yes */
 812                 return TRUE;
 813         }
 814         reader = bio_reader_create(this->curves);
 815         while (reader->remaining(reader) && reader->read_uint16(reader, &current))
 816         {
 817                 if (current == curve)
 818                 {
 819                         reader->destroy(reader);
 820                         return TRUE;
 821                 }
 822         }
 823         reader->destroy(reader);
 824         return FALSE;
 825 }
 826
 827 /**
 828  * Try to find a curve supported by both, client and server
 829  */
 830 static bool find_supported_curve(private_tls_server_t *this,
 831                                                                  tls_named_curve_t *curve)
 832 {
 833         tls_named_curve_t current;
 834         enumerator_t *enumerator;
 835
 836         enumerator = this->crypto->create_ec_enumerator(this->crypto);
 837         while (enumerator->enumerate(enumerator, NULL, &current))
 838         {
 839                 if (peer_supports_curve(this, current))
 840                 {
 841                         *curve = current;
 842                         enumerator->destroy(enumerator);
 843                         return TRUE;
 844                 }
 845         }
 846         enumerator->destroy(enumerator);
 847         return FALSE;
 848 }
 849
 850 /**
 851  * Send Server key Exchange
 852  */
 853 static status_t send_server_key_exchange(private_tls_server_t *this,
 854                                                         tls_handshake_type_t *type, bio_writer_t *writer,
 855                                                         diffie_hellman_group_t group)
 856 {
 857         diffie_hellman_params_t *params = NULL;
 858         tls_named_curve_t curve;
 859         chunk_t chunk;
 860
 861         if (diffie_hellman_group_is_ec(group))
 862         {
 863                 curve = ec_group_to_curve(this, group);
 864                 if (!curve || (!peer_supports_curve(this, curve) &&
 865                                            !find_supported_curve(this, &curve)))
 866                 {
 867                         DBG1(DBG_TLS, "no EC group supported by client and server");
 868                         this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
 869                         return NEED_MORE;
 870                 }
 871                 DBG2(DBG_TLS, "selected ECDH group %N", tls_named_curve_names, curve);
 872                 writer->write_uint8(writer, TLS_ECC_NAMED_CURVE);
 873                 writer->write_uint16(writer, curve);
 874         }
 875         else
 876         {
 877                 params = diffie_hellman_get_params(group);
 878                 if (!params)
 879                 {
 880                         DBG1(DBG_TLS, "no parameters found for DH group %N",
 881                                  diffie_hellman_group_names, group);
 882                         this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 883                         return NEED_MORE;
 884                 }
 885                 DBG2(DBG_TLS, "selected DH group %N", diffie_hellman_group_names, group);
 886                 writer->write_data16(writer, params->prime);
 887                 writer->write_data16(writer, params->generator);
 888         }
 889         this->dh = lib->crypto->create_dh(lib->crypto, group);
 890         if (!this->dh)
 891         {
 892                 DBG1(DBG_TLS, "DH group %N not supported",
 893                          diffie_hellman_group_names, group);
 894                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 895                 return NEED_MORE;
 896         }
 897         this->dh->get_my_public_value(this->dh, &chunk);
 898         if (params)
 899         {
 900                 writer->write_data16(writer, chunk);
 901         }
 902         else
 903         {       /* ECP uses 8bit length header only, but a point format */
 904                 writer->write_uint8(writer, chunk.len + 1);
 905                 writer->write_uint8(writer, TLS_ANSI_UNCOMPRESSED);
 906                 writer->write_data(writer, chunk);
 907         }
 908         free(chunk.ptr);
 909
 910         chunk = chunk_cat("ccc", chunk_from_thing(this->client_random),
 911                                 chunk_from_thing(this->server_random), writer->get_buf(writer));
 912         if (!this->private || !this->crypto->sign(this->crypto, this->private,
 913                                                                                           writer, chunk, this->hashsig))
 914         {
 915                 DBG1(DBG_TLS, "signing DH parameters failed");
 916                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 917                 free(chunk.ptr);
 918                 return NEED_MORE;
 919         }
 920         free(chunk.ptr);
 921         *type = TLS_SERVER_KEY_EXCHANGE;
 922         this->state = STATE_KEY_EXCHANGE_SENT;
 923         this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
 924         return NEED_MORE;
 925 }
 926
 927 /**
 928  * Send Hello Done
 929  */
 930 static status_t send_hello_done(private_tls_server_t *this,
 931                                                         tls_handshake_type_t *type, bio_writer_t *writer)
 932 {
 933         *type = TLS_SERVER_HELLO_DONE;
 934         this->state = STATE_HELLO_DONE;
 935         this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
 936         return NEED_MORE;
 937 }
 938
 939 /**
 940  * Send Finished
 941  */
 942 static status_t send_finished(private_tls_server_t *this,
 943                                                           tls_handshake_type_t *type, bio_writer_t *writer)
 944 {
 945         char buf[12];
 946
 947         if (!this->crypto->calculate_finished(this->crypto, "server finished", buf))
 948         {
 949                 DBG1(DBG_TLS, "calculating server finished data failed");
 950                 this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
 951                 return FAILED;
 952         }
 953
 954         writer->write_data(writer, chunk_from_thing(buf));
 955
 956         *type = TLS_FINISHED;
 957         this->state = STATE_FINISHED_SENT;
 958         this->crypto->append_handshake(this->crypto, *type, writer->get_buf(writer));
 959
 960         return NEED_MORE;
 961 }
 962
 963 METHOD(tls_handshake_t, build, status_t,
 964         private_tls_server_t *this, tls_handshake_type_t *type, bio_writer_t *writer)
 965 {
 966         diffie_hellman_group_t group;
 967
 968         switch (this->state)
 969         {
 970                 case STATE_HELLO_RECEIVED:
 971                         return send_server_hello(this, type, writer);
 972                 case STATE_HELLO_SENT:
 973                         return send_certificate(this, type, writer);
 974                 case STATE_CERT_SENT:
 975                         group = this->crypto->get_dh_group(this->crypto);
 976                         if (group)
 977                         {
 978                                 return send_server_key_exchange(this, type, writer, group);
 979                         }
 980                         /* otherwise fall through to next state */
 981                 case STATE_KEY_EXCHANGE_SENT:
 982                         if (this->peer)
 983                         {
 984                                 return send_certificate_request(this, type, writer);
 985                         }
 986                         /* otherwise fall through to next state */
 987                 case STATE_CERTREQ_SENT:
 988                         return send_hello_done(this, type, writer);
 989                 case STATE_CIPHERSPEC_CHANGED_OUT:
 990                         return send_finished(this, type, writer);
 991                 case STATE_FINISHED_SENT:
 992                         return INVALID_STATE;
 993                 default:
 994                         return INVALID_STATE;
 995         }
 996 }
 997
 998 METHOD(tls_handshake_t, cipherspec_changed, bool,
 999         private_tls_server_t *this, bool inbound)
1000 {
1001         if (inbound)
1002         {
1003                 if (this->resume)
1004                 {
1005                         return this->state == STATE_FINISHED_SENT;
1006                 }
1007                 if (this->peer)
1008                 {
1009                         return this->state == STATE_CERT_VERIFY_RECEIVED;
1010                 }
1011                 return this->state == STATE_KEY_EXCHANGE_RECEIVED;
1012         }
1013         else
1014         {
1015                 if (this->resume)
1016                 {
1017                         return this->state == STATE_HELLO_SENT;
1018                 }
1019                 return this->state == STATE_FINISHED_RECEIVED;
1020         }
1021         return FALSE;
1022 }
1023
1024 METHOD(tls_handshake_t, change_cipherspec, void,
1025         private_tls_server_t *this, bool inbound)
1026 {
1027         this->crypto->change_cipher(this->crypto, inbound);
1028         if (inbound)
1029         {
1030                 this->state = STATE_CIPHERSPEC_CHANGED_IN;
1031         }
1032         else
1033         {
1034                 this->state = STATE_CIPHERSPEC_CHANGED_OUT;
1035         }
1036 }
1037
1038 METHOD(tls_handshake_t, finished, bool,
1039         private_tls_server_t *this)
1040 {
1041         if (this->resume)
1042         {
1043                 return this->state == STATE_FINISHED_RECEIVED;
1044         }
1045         return this->state == STATE_FINISHED_SENT;
1046 }
1047
1048 METHOD(tls_handshake_t, destroy, void,
1049         private_tls_server_t *this)
1050 {
1051         DESTROY_IF(this->private);
1052         DESTROY_IF(this->dh);
1053         this->peer_auth->destroy(this->peer_auth);
1054         this->server_auth->destroy(this->server_auth);
1055         free(this->hashsig.ptr);
1056         free(this->curves.ptr);
1057         free(this->session.ptr);
1058         free(this);
1059 }
1060
1061 /**
1062  * See header
1063  */
1064 tls_server_t *tls_server_create(tls_t *tls,
1065                                                 tls_crypto_t *crypto, tls_alert_t *alert,
1066                                                 identification_t *server, identification_t *peer)
1067 {
1068         private_tls_server_t *this;
1069
1070         INIT(this,
1071                 .public = {
1072                         .handshake = {
1073                                 .process = _process,
1074                                 .build = _build,
1075                                 .cipherspec_changed = _cipherspec_changed,
1076                                 .change_cipherspec = _change_cipherspec,
1077                                 .finished = _finished,
1078                                 .destroy = _destroy,
1079                         },
1080                 },
1081                 .tls = tls,
1082                 .crypto = crypto,
1083                 .alert = alert,
1084                 .server = server,
1085                 .peer = peer,
1086                 .state = STATE_INIT,
1087                 .peer_auth = auth_cfg_create(),
1088                 .server_auth = auth_cfg_create(),
1089         );
1090
1091         return &this->public;
1092 }