]> git.ipfire.org Git - thirdparty/strongswan.git/blame - src/libtls/tls_crypto.c
projects / thirdparty / strongswan.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Update copyright headers after acquisition by secunet
[thirdparty/strongswan.git] / src / libtls / tls_crypto.c
CommitLineData
536dbc00 1/*
53ba0801 2 * Copyright (C) 2020 Tobias Brunner
e5b65657 3 * Copyright (C) 2020-2021 Pascal Knecht
53ba0801 4 * Copyright (C) 2020 Méline Sieber
48d6b57c 5 * Copyright (C) 2010-2014 Martin Willi
19ef2aec
TB		 6 *
7 * Copyright (C) secunet Security Networks AG
536dbc00
MW		 8 *
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by the
11 * Free Software Foundation; either version 2 of the License, or (at your
12 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 *
14 * This program is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
16 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 * for more details.
18 */
19
20#include "tls_crypto.h"
7a2b0266 21#include "tls_hkdf.h"
536dbc00 22
f05b4272 23#include <utils/debug.h>
48d6b57c 24#include <plugins/plugin_feature.h>
9803fb82 25#include <collections/hashtable.h>
d8e42a3d 26#include <collections/array.h>
18010de2 27
4657b3a4
AS		 28ENUM_BEGIN(tls_cipher_suite_names, TLS_NULL_WITH_NULL_NULL,
29 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
30 "TLS_NULL_WITH_NULL_NULL",
31 "TLS_RSA_WITH_NULL_MD5",
32 "TLS_RSA_WITH_NULL_SHA",
33 "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
34 "TLS_RSA_WITH_RC4_128_MD5",
35 "TLS_RSA_WITH_RC4_128_SHA",
36 "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
37 "TLS_RSA_WITH_IDEA_CBC_SHA",
38 "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
39 "TLS_RSA_WITH_DES_CBC_SHA",
40 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
41 "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
42 "TLS_DH_DSS_WITH_DES_CBC_SHA",
43 "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
44 "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
45 "TLS_DH_RSA_WITH_DES_CBC_SHA",
46 "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
47 "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
37d2d7e1 48 "TLS_DHE_DSS_WITH_DES_CBC_SHA",
4657b3a4
AS		 49 "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
50 "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
51 "TLS_DHE_RSA_WITH_DES_CBC_SHA",
52 "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
53 "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
54 "TLS_DH_anon_WITH_RC4_128_MD5",
55 "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
56 "TLS_DH_anon_WITH_DES_CBC_SHA",
57 "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA");
58ENUM_NEXT(tls_cipher_suite_names, TLS_KRB5_WITH_DES_CBC_SHA,
59 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
60 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
61 "TLS_KRB5_WITH_DES_CBC_SHA",
62 "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
63 "TLS_KRB5_WITH_RC4_128_SHA",
64 "TLS_KRB5_WITH_IDEA_CBC_SHA",
65 "TLS_KRB5_WITH_DES_CBC_MD5",
66 "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
67 "TLS_KRB5_WITH_RC4_128_MD5",
68 "TLS_KRB5_WITH_IDEA_CBC_MD5",
69 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
37d2d7e1 70 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
4657b3a4
AS		 71 "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
72 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
73 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
74 "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
75 "TLS_PSK_WITH_NULL_SHA",
76 "TLS_DHE_PSK_WITH_NULL_SHA",
77 "TLS_RSA_PSK_WITH_NULL_SHA",
78 "TLS_RSA_WITH_AES_128_CBC_SHA",
79 "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
80 "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
81 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
82 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
83 "TLS_DH_anon_WITH_AES_128_CBC_SHA",
84 "TLS_RSA_WITH_AES_256_CBC_SHA",
85 "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
86 "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
87 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
88 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
89 "TLS_DH_anon_WITH_AES_256_CBC_SHA",
90 "TLS_RSA_WITH_NULL_SHA256",
e67e8dd1 91 "TLS_RSA_WITH_AES_128_CBC_SHA256",
4657b3a4
AS		 92 "TLS_RSA_WITH_AES_256_CBC_SHA256",
93 "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
94 "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
95 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
96 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
97 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
98 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
99 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
37d2d7e1 100 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
4657b3a4
AS		 101 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA");
102ENUM_NEXT(tls_cipher_suite_names, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
103 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
104 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
105 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
106 "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
107 "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
108 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
109 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
110 "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
111 "TLS_DH_anon_WITH_AES_256_CBC_SHA256");
112ENUM_NEXT(tls_cipher_suite_names, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
37d2d7e1 113 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
4657b3a4
AS		 114 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
115 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
116 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
117 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
118 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
119 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
120 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
121 "TLS_PSK_WITH_RC4_128_SHA",
e67e8dd1 122 "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
4657b3a4
AS		 123 "TLS_PSK_WITH_AES_128_CBC_SHA",
124 "TLS_PSK_WITH_AES_256_CBC_SHA",
125 "TLS_DHE_PSK_WITH_RC4_128_SHA",
126 "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
127 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
e67e8dd1 128 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA",
4657b3a4
AS		 129 "TLS_RSA_PSK_WITH_RC4_128_SHA",
130 "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
131 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
132 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
133 "TLS_RSA_WITH_SEED_CBC_SHA",
134 "TLS_DH_DSS_WITH_SEED_CBC_SHA",
135 "TLS_DH_RSA_WITH_SEED_CBC_SHA",
136 "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
137 "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
138 "TLS_DH_anon_WITH_SEED_CBC_SHA",
139 "TLS_RSA_WITH_AES_128_GCM_SHA256",
140 "TLS_RSA_WITH_AES_256_GCM_SHA384",
141 "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
142 "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
143 "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
144 "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
145 "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
146 "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
147 "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
148 "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
149 "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
150 "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
151 "TLS_PSK_WITH_AES_128_GCM_SHA256",
152 "TLS_PSK_WITH_AES_256_GCM_SHA384",
153 "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
154 "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
155 "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
156 "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
157 "TLS_PSK_WITH_AES_128_CBC_SHA256",
158 "TLS_PSK_WITH_AES_256_CBC_SHA384",
159 "TLS_PSK_WITH_NULL_SHA256",
160 "TLS_PSK_WITH_NULL_SHA384",
161 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
162 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
163 "TLS_DHE_PSK_WITH_NULL_SHA256",
164 "TLS_DHE_PSK_WITH_NULL_SHA384",
165 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
166 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
167 "TLS_RSA_PSK_WITH_NULL_SHA256",
168 "TLS_RSA_PSK_WITH_NULL_SHA384",
169 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
170 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
171 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
172 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
173 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
174 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
175 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
176 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
177 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
178 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
179 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
180 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256");
181ENUM_NEXT(tls_cipher_suite_names, TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
37d2d7e1 182 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
4657b3a4
AS		 183 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
184 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
7a2b0266 185ENUM_NEXT(tls_cipher_suite_names, TLS_AES_128_GCM_SHA256,
186 TLS_AES_128_CCM_8_SHA256,
187 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
188 "TLS_AES_128_GCM_SHA256",
189 "TLS_AES_256_GCM_SHA384",
190 "TLS_CHACHA20_POLY1305_SHA256",
191 "TLS_AES_128_CCM_SHA256",
192 "TLS_AES_128_CCM_8_SHA256");
4657b3a4 193ENUM_NEXT(tls_cipher_suite_names, TLS_ECDH_ECDSA_WITH_NULL_SHA,
37d2d7e1 194 TLS_ECDHE_PSK_WITH_NULL_SHA384,
7a2b0266 195 TLS_AES_128_CCM_8_SHA256,
4657b3a4
AS		 196 "TLS_ECDH_ECDSA_WITH_NULL_SHA",
197 "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
198 "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
199 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
200 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
201 "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
202 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
203 "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
204 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
205 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
206 "TLS_ECDH_RSA_WITH_NULL_SHA",
207 "TLS_ECDH_RSA_WITH_RC4_128_SHA",
208 "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
209 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
210 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
211 "TLS_ECDHE_RSA_WITH_NULL_SHA",
212 "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
213 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
214 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
215 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
216 "TLS_ECDH_anon_WITH_NULL_SHA",
217 "TLS_ECDH_anon_WITH_RC4_128_SHA",
218 "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
219 "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
220 "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
221 "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
222 "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
223 "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
224 "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
225 "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
226 "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
227 "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
228 "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
229 "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
230 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
231 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
232 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
233 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
234 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
235 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
236 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
237 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
238 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
239 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
240 "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
241 "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
242 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
243 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
244 "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
245 "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
246 "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
247 "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
248 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
249 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
250 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
251 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
252 "TLS_ECDHE_PSK_WITH_NULL_SHA",
253 "TLS_ECDHE_PSK_WITH_NULL_SHA256",
254 "TLS_ECDHE_PSK_WITH_NULL_SHA384");
f81c04e9
PK		 255ENUM_NEXT(tls_cipher_suite_names, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
257 TLS_ECDHE_PSK_WITH_NULL_SHA384,
258 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
259 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
260 "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256");
261ENUM_END(tls_cipher_suite_names, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256);
262
4657b3a4 263
9dd2ca92
MW		 264ENUM(tls_hash_algorithm_names, TLS_HASH_NONE, TLS_HASH_SHA512,
265 "NONE",
266 "MD5",
267 "SHA1",
268 "SHA224",
269 "SHA256",
270 "SHA384",
271 "SHA512",
272);
273
1b593e1d
TB		 274ENUM_BEGIN(tls_signature_scheme_names,
275 TLS_SIG_RSA_PKCS1_SHA1, TLS_SIG_RSA_PKCS1_SHA1,
276 "RSA_PKCS1_SHA1");
277ENUM_NEXT(tls_signature_scheme_names,
278 TLS_SIG_ECDSA_SHA1, TLS_SIG_ECDSA_SHA1, TLS_SIG_RSA_PKCS1_SHA1,
279 "ECDSA_SHA1");
280ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 281 TLS_SIG_RSA_PKCS1_SHA224, TLS_SIG_ECDSA_SHA224, TLS_SIG_ECDSA_SHA1,
282 "RSA_PKCS1_SHA224",
283 "DSA_SHA224",
284 "ECDSA_SHA224");
1b593e1d 285ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 286 TLS_SIG_RSA_PKCS1_SHA256, TLS_SIG_ECDSA_SHA256, TLS_SIG_ECDSA_SHA224,
287 "RSA_PKCS1_SHA256",
288 "DSA_SHA256",
1b593e1d
TB		 289 "ECDSA_SHA256");
290ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 291 TLS_SIG_RSA_PKCS1_SHA384, TLS_SIG_ECDSA_SHA384, TLS_SIG_ECDSA_SHA256,
292 "RSA_PKCS1_SHA384",
293 "DSA_SHA384",
1b593e1d
TB		 294 "ECDSA_SHA384");
295ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 296 TLS_SIG_RSA_PKCS1_SHA512, TLS_SIG_ECDSA_SHA512, TLS_SIG_ECDSA_SHA384,
297 "RSA_PKCS1_SHA512",
298 "DSA_SHA512",
1b593e1d
TB		 299 "ECDSA_SHA512");
300ENUM_NEXT(tls_signature_scheme_names,
301 TLS_SIG_RSA_PSS_RSAE_SHA256, TLS_SIG_RSA_PSS_PSS_SHA512, TLS_SIG_ECDSA_SHA512,
302 "RSA_PSS_RSAE_SHA256",
303 "RSA_PSS_RSAE_SHA384",
304 "RSA_PSS_RSAE_SHA512",
305 "ED25519",
306 "ED448",
307 "RSA_PSS_PSS_SHA256",
308 "RSA_PSS_PSS_SHA384",
309 "RSA_PSS_PSS_SHA512",
9dd2ca92 310);
1b593e1d 311ENUM_END(tls_signature_scheme_names, TLS_SIG_RSA_PSS_PSS_SHA512);
9dd2ca92 312
99dcaea9
MW		 313ENUM_BEGIN(tls_client_certificate_type_names,
314 TLS_RSA_SIGN, TLS_DSS_EPHEMERAL_DH,
315 "RSA_SIGN",
316 "DSA_SIGN",
317 "RSA_FIXED_DH",
318 "DSS_FIXED_DH",
319 "RSA_EPHEMERAL_DH",
320 "DSS_EPHEMERAL_DH");
321ENUM_NEXT(tls_client_certificate_type_names,
322 TLS_FORTEZZA_DMS, TLS_FORTEZZA_DMS, TLS_DSS_EPHEMERAL_DH,
323 "FORTEZZA_DMS");
324ENUM_NEXT(tls_client_certificate_type_names,
325 TLS_ECDSA_SIGN, TLS_ECDSA_FIXED_ECDH, TLS_FORTEZZA_DMS,
326 "ECDSA_SIGN",
327 "RSA_FIXED_ECDH",
328 "ECDSA_FIXED_ECDH");
329ENUM_END(tls_client_certificate_type_names, TLS_ECDSA_FIXED_ECDH);
330
691ca54d
MW		 331ENUM(tls_ecc_curve_type_names, TLS_ECC_EXPLICIT_PRIME, TLS_ECC_NAMED_CURVE,
332 "EXPLICIT_PRIME",
333 "EXPLICIT_CHAR2",
334 "NAMED_CURVE",
335);
336
7a2b0266 337ENUM_BEGIN(tls_named_group_names, TLS_SECT163K1, TLS_SECP521R1,
691ca54d
MW		 338 "SECT163K1",
339 "SECT163R1",
340 "SECT163R2",
341 "SECT193R1",
342 "SECT193R2",
343 "SECT233K1",
344 "SECT233R1",
345 "SECT239K1",
346 "SECT283K1",
347 "SECT283R1",
348 "SECT409K1",
349 "SECT409R1",
350 "SECT571K1",
351 "SECT571R1",
352 "SECP160K1",
353 "SECP160R1",
354 "SECP160R2",
355 "SECP192K1",
356 "SECP192R1",
357 "SECP224K1",
358 "SECP224R1",
359 "SECP256K1",
360 "SECP256R1",
361 "SECP384R1",
362 "SECP521R1",
363);
3101120c 364ENUM_NEXT(tls_named_group_names, TLS_CURVE25519, TLS_CURVE448, TLS_SECP521R1,
7a2b0266 365 "CURVE25519",
366 "CURVE448",
367);
3101120c 368ENUM_NEXT(tls_named_group_names, TLS_FFDHE2048, TLS_FFDHE8192, TLS_CURVE448,
7a2b0266 369 "FFDHE2048",
370 "FFDHE3072",
371 "FFDHE4096",
372 "FFDHE6144",
373 "FFDHE8192",
374);
375ENUM_END(tls_named_group_names, TLS_FFDHE8192);
691ca54d 376
ec7d4e70 377ENUM(tls_ansi_point_format_names, TLS_ANSI_COMPRESSED, TLS_ANSI_HYBRID_Y,
e6cce7ff
MW		 378 "compressed",
379 "compressed y",
380 "uncompressed",
381 "uncompressed y",
382 "hybrid",
383 "hybrid y",
384);
99dcaea9 385
02281c87
MW		 386ENUM(tls_ec_point_format_names,
387 TLS_EC_POINT_UNCOMPRESSED, TLS_EC_POINT_ANSIX962_COMPRESSED_CHAR2,
388 "uncompressed",
389 "ansiX962 compressed prime",
390 "ansiX962 compressed char2",
391);
392
536dbc00
MW		 393typedef struct private_tls_crypto_t private_tls_crypto_t;
394
395/**
396 * Private data of an tls_crypto_t object.
397 */
398struct private_tls_crypto_t {
399
400 /**
401 * Public tls_crypto_t interface.
402 */
403 tls_crypto_t public;
18010de2 404
dc9f34be
MW		 405 /**
406 * Protection layer
407 */
408 tls_protection_t *protection;
409
18010de2
MW		 410 /**
411 * List of supported/acceptable cipher suites
412 */
413 tls_cipher_suite_t *suites;
414
415 /**
416 * Number of supported suites
417 */
418 int suite_count;
419
7a2b0266 420 /**
421 * HKDF for TLS 1.3
422 */
423 tls_hkdf_t *hkdf;
424
18010de2
MW		 425 /**
426 * Selected cipher suite
427 */
428 tls_cipher_suite_t suite;
429
4254257f
MW		 430 /**
431 * RSA supported?
432 */
433 bool rsa;
434
435 /**
436 * ECDSA supported?
437 */
438 bool ecdsa;
439
18010de2
MW		 440 /**
441 * TLS context
442 */
443 tls_t *tls;
444
6a5c86b7
MW		 445 /**
446 * TLS session cache
447 */
448 tls_cache_t *cache;
449
84d67ead 450 /**
2db6d5b8 451 * All handshake data concatenated
84d67ead
MW		 452 */
453 chunk_t handshake;
454
18010de2
MW		 455 /**
456 * Connection state TLS PRF
457 */
458 tls_prf_t *prf;
84543e6e
MW		 459
460 /**
d3204677 461 * AEAD transform for inbound traffic
84543e6e 462 */
d3204677 463 tls_aead_t *aead_in;
84543e6e
MW		 464
465 /**
d3204677 466 * AEAD transform for outbound traffic
84543e6e 467 */
d3204677 468 tls_aead_t *aead_out;
51313a39
MW		 469
470 /**
a6444fcd 471 * EAP-[T]TLS MSK
51313a39
MW		 472 */
473 chunk_t msk;
a6444fcd
AS		 474
475 /**
476 * ASCII string constant used as seed for EAP-[T]TLS MSK PRF
477 */
478 char *msk_label;
536dbc00
MW		 479};
480
84543e6e
MW		 481typedef struct {
482 tls_cipher_suite_t suite;
4cdade5a
MW		 483 key_type_t key;
484 diffie_hellman_group_t dh;
84543e6e
MW		 485 hash_algorithm_t hash;
486 pseudo_random_function_t prf;
487 integrity_algorithm_t mac;
488 encryption_algorithm_t encr;
489 size_t encr_size;
281766c5
TB		 490 tls_version_t min_version;
491 tls_version_t max_version;
84543e6e
MW		 492} suite_algs_t;
493
494/**
495 * Mapping suites to a set of algorithms
d107198f
PK		 496 *
497 * The order represents the descending preference of cipher suites and follows
498 * this rule set:
499 *
500 * 1. TLS 1.3 > Legacy TLS
501 * 2. AES > CAMELLIA > NULL
502 * 3. AES256 > AES128
503 * 4. GCM > CBC
504 * 5. ECDHE > DHE > NULL
505 * 6. ECDSA > RSA
506 * 7. SHA384 > SHA256 > SHA1
507 *
84543e6e
MW		 508 */
509static suite_algs_t suite_algs[] = {
7a2b0266 510 /* Cipher suites of TLS 1.3: key exchange and authentication
511 * delegated to extensions, therefore KEY_ANY, MODP_NONE, PRF_UNDEFINED */
7a2b0266 512 { TLS_AES_256_GCM_SHA384,
513 KEY_ANY, MODP_NONE,
514 HASH_SHA384, PRF_UNDEFINED,
515 AUTH_HMAC_SHA2_384_384, ENCR_AES_GCM_ICV16, 32,
281766c5 516 TLS_1_3, TLS_1_3,
7a2b0266 517 },
d107198f
PK		 518 { TLS_AES_128_GCM_SHA256,
519 KEY_ANY, MODP_NONE,
520 HASH_SHA256, PRF_UNDEFINED,
521 AUTH_HMAC_SHA2_256_256, ENCR_AES_GCM_ICV16, 16,
522 TLS_1_3, TLS_1_3,
523 },
7a2b0266 524 { TLS_CHACHA20_POLY1305_SHA256,
525 KEY_ANY, MODP_NONE,
526 HASH_SHA256, PRF_UNDEFINED,
b7ea969b 527 AUTH_HMAC_SHA2_256_256, ENCR_CHACHA20_POLY1305, 32,
281766c5 528 TLS_1_3, TLS_1_3,
7a2b0266 529 },
530 { TLS_AES_128_CCM_SHA256,
281766c5
TB		 531 KEY_ANY, MODP_NONE,
532 HASH_SHA256, PRF_UNDEFINED,
533 AUTH_HMAC_SHA2_256_256, ENCR_AES_CCM_ICV16, 16,
534 TLS_1_3, TLS_1_3,
7a2b0266 535 },
536 { TLS_AES_128_CCM_8_SHA256,
281766c5
TB		 537 KEY_ANY, MODP_NONE,
538 HASH_SHA256, PRF_UNDEFINED,
539 AUTH_HMAC_SHA2_256_256, ENCR_AES_CCM_ICV8, 16,
540 TLS_1_3, TLS_1_3,
7a2b0266 541 },
542 /* Legacy TLS cipher suites */
d107198f
PK		 543 { TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
544 KEY_ECDSA, ECP_384_BIT,
545 HASH_SHA384, PRF_HMAC_SHA2_384,
546 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
547 TLS_1_2, TLS_1_2,
2066918d 548 },
d107198f
PK		 549 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
550 KEY_ECDSA, ECP_384_BIT,
551 HASH_SHA384, PRF_HMAC_SHA2_384,
552 AUTH_HMAC_SHA2_384_384, ENCR_AES_CBC, 32,
281766c5 553 TLS_1_2, TLS_1_2,
2066918d
MW		 554 },
555 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
556 KEY_ECDSA, ECP_384_BIT,
ed57dfca 557 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 558 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
281766c5 559 TLS_1_0, TLS_1_2,
2066918d 560 },
d06890d6
MW		 561 { TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
562 KEY_ECDSA, ECP_256_BIT,
563 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 564 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 565 TLS_1_2, TLS_1_2,
d06890d6 566 },
d107198f
PK		 567 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
568 KEY_ECDSA, ECP_256_BIT,
569 HASH_SHA256, PRF_HMAC_SHA2_256,
570 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 571 TLS_1_2, TLS_1_2,
d06890d6 572 },
d107198f
PK		 573 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
574 KEY_ECDSA, ECP_256_BIT,
ed57dfca 575 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 576 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
281766c5 577 TLS_1_0, TLS_1_2,
2066918d 578 },
d107198f 579 { TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
f9c0cf86 580 KEY_RSA, ECP_384_BIT,
d107198f
PK		 581 HASH_SHA384, PRF_HMAC_SHA2_384,
582 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
583 TLS_1_2, TLS_1_2,
2066918d
MW		 584 },
585 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
f9c0cf86 586 KEY_RSA, ECP_384_BIT,
2066918d 587 HASH_SHA384, PRF_HMAC_SHA2_384,
7a2b0266 588 AUTH_HMAC_SHA2_384_384, ENCR_AES_CBC, 32,
281766c5 589 TLS_1_2, TLS_1_2,
2066918d 590 },
d107198f
PK		 591 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
592 KEY_RSA, ECP_384_BIT,
593 HASH_SHA256, PRF_HMAC_SHA2_256,
594 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
595 TLS_1_0, TLS_1_2,
596 },
d06890d6
MW		 597 { TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
598 KEY_RSA, ECP_256_BIT,
599 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 600 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 601 TLS_1_2, TLS_1_2,
d06890d6 602 },
d107198f
PK		 603 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
604 KEY_RSA, ECP_256_BIT,
605 HASH_SHA256, PRF_HMAC_SHA2_256,
606 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 607 TLS_1_2, TLS_1_2,
d06890d6 608 },
d107198f
PK		 609 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
610 KEY_RSA, ECP_256_BIT,
611 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 612 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
d107198f 613 TLS_1_0, TLS_1_2,
ef0a8e58 614 },
d107198f
PK		 615 { TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
616 KEY_RSA, MODP_4096_BIT,
617 HASH_SHA384, PRF_HMAC_SHA2_384,
618 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
619 TLS_1_2, TLS_1_2,
620 },
621 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
622 KEY_RSA, MODP_4096_BIT,
4cdade5a 623 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 624 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32,
281766c5 625 TLS_1_2, TLS_1_2,
ef0a8e58
MW		 626 },
627 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
4cdade5a 628 KEY_RSA, MODP_3072_BIT,
ed57dfca 629 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 630 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
281766c5 631 SSL_3_0, TLS_1_2,
ef0a8e58 632 },
d107198f 633 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
4cdade5a
MW		 634 KEY_RSA, MODP_4096_BIT,
635 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 636 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32,
281766c5 637 TLS_1_2, TLS_1_2,
ef0a8e58 638 },
d107198f
PK		 639 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
640 KEY_RSA, MODP_3072_BIT,
641 HASH_SHA256, PRF_HMAC_SHA2_256,
642 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32,
643 SSL_3_0, TLS_1_2,
644 },
d06890d6
MW		 645 { TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
646 KEY_RSA, MODP_3072_BIT,
647 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 648 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 649 TLS_1_2, TLS_1_2,
d06890d6 650 },
d107198f
PK		 651 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
652 KEY_RSA, MODP_3072_BIT,
653 HASH_SHA256, PRF_HMAC_SHA2_256,
654 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 655 TLS_1_2, TLS_1_2,
d06890d6 656 },
d107198f 657 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
4cdade5a 658 KEY_RSA, MODP_2048_BIT,
d107198f
PK		 659 HASH_SHA256,PRF_HMAC_SHA2_256,
660 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
281766c5 661 SSL_3_0, TLS_1_2,
ef0a8e58
MW		 662 },
663 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
4cdade5a
MW		 664 KEY_RSA, MODP_3072_BIT,
665 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 666 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16,
281766c5 667 TLS_1_2, TLS_1_2,
ef0a8e58 668 },
d107198f 669 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
4cdade5a 670 KEY_RSA, MODP_2048_BIT,
ed57dfca 671 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 672 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16,
281766c5 673 SSL_3_0, TLS_1_2,
ef0a8e58 674 },
d107198f 675 { TLS_RSA_WITH_AES_256_GCM_SHA384,
4cdade5a 676 KEY_RSA, MODP_NONE,
d107198f
PK		 677 HASH_SHA384, PRF_HMAC_SHA2_384,
678 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
679 TLS_1_2, TLS_1_2,
6e413d9c 680 },
d107198f 681 { TLS_RSA_WITH_AES_256_CBC_SHA256,
4cdade5a
MW		 682 KEY_RSA, MODP_NONE,
683 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 684 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32,
281766c5 685 TLS_1_2, TLS_1_2,
84543e6e
MW		 686 },
687 { TLS_RSA_WITH_AES_256_CBC_SHA,
4cdade5a 688 KEY_RSA, MODP_NONE,
ed57dfca 689 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 690 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
281766c5 691 SSL_3_0, TLS_1_2,
84543e6e 692 },
d06890d6
MW		 693 { TLS_RSA_WITH_AES_128_GCM_SHA256,
694 KEY_RSA, MODP_NONE,
695 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 696 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 697 TLS_1_2, TLS_1_2,
d06890d6 698 },
d107198f 699 { TLS_RSA_WITH_AES_128_CBC_SHA256,
d06890d6 700 KEY_RSA, MODP_NONE,
d107198f
PK		 701 HASH_SHA256, PRF_HMAC_SHA2_256,
702 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 703 TLS_1_2, TLS_1_2,
d06890d6 704 },
d107198f 705 { TLS_RSA_WITH_AES_128_CBC_SHA,
4cdade5a 706 KEY_RSA, MODP_NONE,
ed57dfca 707 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 708 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
281766c5 709 SSL_3_0, TLS_1_2,
6e413d9c 710 },
d107198f 711 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
4cdade5a
MW		 712 KEY_RSA, MODP_NONE,
713 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 714 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32,
281766c5 715 TLS_1_2, TLS_1_2,
6e413d9c
MW		 716 },
717 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
4cdade5a 718 KEY_RSA, MODP_NONE,
ed57dfca 719 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 720 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32,
281766c5 721 SSL_3_0, TLS_1_2,
6e413d9c 722 },
d107198f 723 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
4cdade5a
MW		 724 KEY_RSA, MODP_NONE,
725 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 726 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16,
281766c5 727 TLS_1_2, TLS_1_2,
84543e6e 728 },
d107198f 729 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
4cdade5a 730 KEY_RSA, MODP_NONE,
ed57dfca 731 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 732 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16,
281766c5 733 SSL_3_0, TLS_1_2,
2bf0e74c 734 },
2066918d
MW		 735 { TLS_ECDHE_ECDSA_WITH_NULL_SHA,
736 KEY_ECDSA, ECP_256_BIT,
ed57dfca 737 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 738 AUTH_HMAC_SHA1_160, ENCR_NULL, 0,
281766c5 739 TLS_1_0, TLS_1_2,
2066918d
MW		 740 },
741 { TLS_ECDHE_RSA_WITH_NULL_SHA,
742 KEY_ECDSA, ECP_256_BIT,
ed57dfca 743 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 744 AUTH_HMAC_SHA1_160, ENCR_NULL, 0,
281766c5 745 TLS_1_0, TLS_1_2,
2066918d 746 },
2bf0e74c 747 { TLS_RSA_WITH_NULL_SHA256,
4cdade5a
MW		 748 KEY_RSA, MODP_NONE,
749 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 750 AUTH_HMAC_SHA2_256_256, ENCR_NULL, 0,
281766c5 751 TLS_1_2, TLS_1_2,
2bf0e74c 752 },
d107198f 753 { TLS_RSA_WITH_NULL_SHA,
4cdade5a 754 KEY_RSA, MODP_NONE,
ed57dfca 755 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f
PK		 756 AUTH_HMAC_SHA1_160, ENCR_NULL, 0,
757 SSL_3_0, TLS_1_2,
2bf0e74c 758 },
84543e6e
MW		 759};
760
761/**
f3bb1bd0 762 * Look up algorithms by a suite
84543e6e
MW		 763 */
764static suite_algs_t *find_suite(tls_cipher_suite_t suite)
765{
766 int i;
767
768 for (i = 0; i < countof(suite_algs); i++)
769 {
770 if (suite_algs[i].suite == suite)
771 {
772 return &suite_algs[i];
773 }
774 }
775 return NULL;
776}
777
18010de2 778/**
a2bfc45b 779 * Filter a suite list using a transform enumerator
18010de2 780 */
ac5717c9 781static void filter_suite(suite_algs_t suites[], int *count, int offset,
a2bfc45b 782 enumerator_t*(*create_enumerator)(crypto_factory_t*))
536dbc00 783{
5932f41f 784 const char *plugin_name;
a2bfc45b 785 suite_algs_t current;
f10e7234 786 int *current_alg, i, remaining = 0;
a2bfc45b 787 enumerator_t *enumerator;
536dbc00 788
a2bfc45b 789 memset(&current, 0, sizeof(current));
f10e7234
AS		 790 current_alg = (int*)((char*)&current + offset);
791
a2bfc45b 792 for (i = 0; i < *count; i++)
536dbc00 793 {
b886dad4
MW		 794 if (create_enumerator == lib->crypto->create_crypter_enumerator &&
795 encryption_algorithm_is_aead(suites[i].encr))
796 { /* filtering crypters, but current suite uses an AEAD, apply */
797 suites[remaining] = suites[i];
798 remaining++;
799 continue;
800 }
801 if (create_enumerator == lib->crypto->create_aead_enumerator &&
802 !encryption_algorithm_is_aead(suites[i].encr))
803 { /* filtering AEADs, but current suite doesn't use one, apply */
804 suites[remaining] = suites[i];
805 remaining++;
806 continue;
807 }
a2bfc45b 808 enumerator = create_enumerator(lib->crypto);
f10e7234 809 while (enumerator->enumerate(enumerator, current_alg, &plugin_name))
536dbc00 810 {
b886dad4 811 if (current.encr && current.encr != suites[i].encr)
536dbc00 812 {
b886dad4
MW		 813 if (suites[i].encr != ENCR_NULL)
814 { /* skip, ENCR does not match nor is NULL */
815 continue;
816 }
536dbc00 817 }
b886dad4
MW		 818 if (current.mac && current.mac != suites[i].mac)
819 {
820 if (suites[i].mac != AUTH_UNDEFINED)
821 { /* skip, MAC does not match nor is it undefined */
822 continue;
823 }
824 }
825 if (current.prf && current.prf != suites[i].prf)
436571b2
TB		 826 {
827 if (suites[i].prf != PRF_UNDEFINED)
828 {
829 /* skip, PRF does not match nor is it undefined */
830 continue;
831 }
b886dad4
MW		 832 }
833 if (current.hash && current.hash != suites[i].hash)
834 { /* skip, hash does not match */
835 continue;
836 }
837 if (current.dh && current.dh != suites[i].dh)
838 {
311405c3
TB		 839 if (suites[i].dh != MODP_NONE &&
840 !(diffie_hellman_group_is_ec(current.dh) &&
841 diffie_hellman_group_is_ec(suites[i].dh)))
842 { /* skip DH group, does not match nor NONE nor both ECDH */
b886dad4
MW		 843 continue;
844 }
845 }
846 /* suite supported, apply */
847 suites[remaining] = suites[i];
848 remaining++;
849 break;
536dbc00 850 }
a2bfc45b 851 enumerator->destroy(enumerator);
536dbc00 852 }
a2bfc45b
MW		 853 *count = remaining;
854}
855
96b2fbcc
MW		 856/**
857 * Purge NULL encryption cipher suites from list
858 */
ac5717c9 859static void filter_null_suites(suite_algs_t suites[], int *count)
96b2fbcc
MW		 860{
861 int i, remaining = 0;
862
863 for (i = 0; i < *count; i++)
864 {
865 if (suites[i].encr != ENCR_NULL)
866 {
867 suites[remaining] = suites[i];
868 remaining++;
869 }
870 }
871 *count = remaining;
872}
873
4254257f
MW		 874/**
875 * Purge suites using a given key type
876 */
877static void filter_key_suites(private_tls_crypto_t *this,
878 suite_algs_t suites[], int *count, key_type_t key)
879{
880 int i, remaining = 0;
881
882 DBG2(DBG_TLS, "disabling %N suites, no backend found", key_type_names, key);
883 for (i = 0; i < *count; i++)
884 {
885 if (suites[i].key != key)
886 {
887 suites[remaining] = suites[i];
888 remaining++;
889 }
890 }
891 *count = remaining;
892}
893
24a5b935
MW		 894/**
895 * Filter suites by key exchange user config
896 */
897static void filter_key_exchange_config_suites(private_tls_crypto_t *this,
898 suite_algs_t suites[], int *count)
899{
900 enumerator_t *enumerator;
901 int i, remaining = 0;
902 char *token, *config;
903
409adef4
TB		 904 config = lib->settings->get_str(lib->settings, "%s.tls.key_exchange", NULL,
905 lib->ns);
24a5b935
MW		 906 if (config)
907 {
908 for (i = 0; i < *count; i++)
909 {
910 enumerator = enumerator_create_token(config, ",", " ");
911 while (enumerator->enumerate(enumerator, &token))
912 {
913 if (strcaseeq(token, "ecdhe-ecdsa") &&
914 diffie_hellman_group_is_ec(suites[i].dh) &&
915 suites[i].key == KEY_ECDSA)
916 {
917 suites[remaining++] = suites[i];
918 break;
919 }
920 if (strcaseeq(token, "ecdhe-rsa") &&
921 diffie_hellman_group_is_ec(suites[i].dh) &&
922 suites[i].key == KEY_RSA)
923 {
924 suites[remaining++] = suites[i];
925 break;
926 }
927 if (strcaseeq(token, "dhe-rsa") &&
928 !diffie_hellman_group_is_ec(suites[i].dh) &&
929 suites[i].dh != MODP_NONE &&
930 suites[i].key == KEY_RSA)
931 {
932 suites[remaining++] = suites[i];
933 break;
934 }
935 if (strcaseeq(token, "rsa") &&
936 suites[i].dh == MODP_NONE &&
937 suites[i].key == KEY_RSA)
938 {
939 suites[remaining++] = suites[i];
940 break;
941 }
942 }
943 enumerator->destroy(enumerator);
944 }
945 *count = remaining;
946 }
947}
948
949/**
950 * Filter suites by cipher user config
951 */
952static void filter_cipher_config_suites(private_tls_crypto_t *this,
953 suite_algs_t suites[], int *count)
954{
955 enumerator_t *enumerator;
956 int i, remaining = 0;
957 char *token, *config;
958
409adef4
TB		 959 config = lib->settings->get_str(lib->settings, "%s.tls.cipher", NULL,
960 lib->ns);
24a5b935
MW		 961 if (config)
962 {
963 for (i = 0; i < *count; i++)
964 {
965 enumerator = enumerator_create_token(config, ",", " ");
966 while (enumerator->enumerate(enumerator, &token))
967 {
74b9ba7c
TB		 968 const proposal_token_t *tok;
969
970 tok = lib->proposal->get_token(lib->proposal, token);
971 if (tok != NULL && tok->type == ENCRYPTION_ALGORITHM &&
972 suites[i].encr == tok->algorithm &&
973 (!tok->keysize || suites[i].encr_size == tok->keysize / 8))
24a5b935
MW		 974 {
975 suites[remaining++] = suites[i];
976 break;
977 }
978 }
979 enumerator->destroy(enumerator);
980 }
981 *count = remaining;
982 }
983}
984
985/**
986 * Filter suites by mac user config
987 */
988static void filter_mac_config_suites(private_tls_crypto_t *this,
989 suite_algs_t suites[], int *count)
990{
991 enumerator_t *enumerator;
992 int i, remaining = 0;
993 char *token, *config;
994
409adef4
TB		 995 config = lib->settings->get_str(lib->settings, "%s.tls.mac", NULL,
996 lib->ns);
24a5b935
MW		 997 if (config)
998 {
999 for (i = 0; i < *count; i++)
1000 {
1001 enumerator = enumerator_create_token(config, ",", " ");
1002 while (enumerator->enumerate(enumerator, &token))
1003 {
24a5b935 1004 if (strcaseeq(token, "sha1") &&
1dabf5bf 1005 suites[i].mac == AUTH_HMAC_SHA1_160)
24a5b935
MW		 1006 {
1007 suites[remaining++] = suites[i];
1008 break;
1009 }
1010 if (strcaseeq(token, "sha256") &&
1dabf5bf 1011 suites[i].mac == AUTH_HMAC_SHA2_256_256)
24a5b935
MW		 1012 {
1013 suites[remaining++] = suites[i];
1014 break;
1015 }
1016 if (strcaseeq(token, "sha384") &&
1dabf5bf 1017 suites[i].mac == AUTH_HMAC_SHA2_384_384)
24a5b935
MW		 1018 {
1019 suites[remaining++] = suites[i];
1020 break;
1021 }
1022 }
1023 enumerator->destroy(enumerator);
1024 }
1025 *count = remaining;
1026 }
1027}
1028
adb913ad
MW		 1029/**
1030 * Filter for specific suites specified in strongswan.conf
1031 */
1032static void filter_specific_config_suites(private_tls_crypto_t *this,
1033 suite_algs_t suites[], int *count)
1034{
1035 enumerator_t *enumerator;
1036 int i, remaining = 0, suite;
1037 char *token, *config;
1038
409adef4
TB		 1039 config = lib->settings->get_str(lib->settings, "%s.tls.suites", NULL,
1040 lib->ns);
adb913ad
MW		 1041 if (config)
1042 {
1043 for (i = 0; i < *count; i++)
1044 {
1045 enumerator = enumerator_create_token(config, ",", " ");
1046 while (enumerator->enumerate(enumerator, &token))
1047 {
064fe9c9
MW		 1048 if (enum_from_name(tls_cipher_suite_names, token, &suite) &&
1049 suite == suites[i].suite)
adb913ad
MW		 1050 {
1051 suites[remaining++] = suites[i];
1052 break;
1053 }
1054 }
1055 enumerator->destroy(enumerator);
1056 }
1057 *count = remaining;
1058 }
1059}
1060
e53bee9d
PK		 1061/**
1062 * Filter key exchange curves by curve user config
1063 */
1064static bool filter_curve_config(tls_named_group_t curve)
1065{
1066 enumerator_t *enumerator;
1067 char *token, *config;
1068
e5b65657
PK		 1069 config = lib->settings->get_str(lib->settings, "%s.tls.ke_group", NULL,
1070 lib->ns);
e53bee9d
PK		 1071 if (config)
1072 {
1073 enumerator = enumerator_create_token(config, ",", " ");
1074 while (enumerator->enumerate(enumerator, &token))
1075 {
1076 const proposal_token_t *tok;
1077
1078 tok = lib->proposal->get_token(lib->proposal, token);
1079 if (tok != NULL && tok->type == DIFFIE_HELLMAN_GROUP &&
1080 curve == tls_ec_group_to_curve(tok->algorithm))
1081 {
1082 enumerator->destroy(enumerator);
1083 return TRUE;
1084 }
1085 }
1086 enumerator->destroy(enumerator);
1087 }
1088 return !config;
1089}
1090
ac5717c9
MW		 1091/**
1092 * Filter out unsupported suites on given suite array
1093 */
1094static void filter_unsupported_suites(suite_algs_t suites[], int *count)
1095{
1096 /* filter suite list by each algorithm */
436571b2
TB		 1097 filter_suite(suites, count, offsetof(suite_algs_t, encr),
1098 lib->crypto->create_aead_enumerator);
1099 filter_suite(suites, count, offsetof(suite_algs_t, prf),
1100 lib->crypto->create_prf_enumerator);
ac5717c9
MW		 1101 filter_suite(suites, count, offsetof(suite_algs_t, encr),
1102 lib->crypto->create_crypter_enumerator);
ac5717c9
MW		 1103 filter_suite(suites, count, offsetof(suite_algs_t, mac),
1104 lib->crypto->create_signer_enumerator);
ac5717c9
MW		 1105 filter_suite(suites, count, offsetof(suite_algs_t, hash),
1106 lib->crypto->create_hasher_enumerator);
1107 filter_suite(suites, count, offsetof(suite_algs_t, dh),
1108 lib->crypto->create_dh_enumerator);
1109}
1110
a2bfc45b
MW		 1111/**
1112 * Initialize the cipher suite list
1113 */
43c8f950 1114static void build_cipher_suite_list(private_tls_crypto_t *this)
a2bfc45b 1115{
a6a0fa98 1116 suite_algs_t suites[countof(suite_algs)] = {};
8a6edc08 1117 tls_version_t min_version, max_version, new_min_version, new_max_version;
11a46879 1118 bool require_encryption = TRUE;
281766c5 1119 int count = 0, i;
536dbc00 1120
43c8f950
TB		 1121 switch (this->tls->get_purpose(this->tls))
1122 {
1123 case TLS_PURPOSE_EAP_TLS:
43c8f950
TB		 1124 require_encryption = FALSE;
1125 break;
43c8f950 1126 case TLS_PURPOSE_GENERIC:
11a46879
TB		 1127 if (this->tls->get_flags(this->tls) & TLS_FLAG_ENCRYPTION_OPTIONAL)
1128 {
1129 require_encryption = FALSE;
1130 }
43c8f950
TB		 1131 break;
1132 default:
11a46879 1133 break;
43c8f950
TB		 1134 }
1135
281766c5
TB		 1136 min_version = this->tls->get_version_min(this->tls);
1137 max_version = this->tls->get_version_max(this->tls);
1138
1139 /* copy all suites appropriate for the current min/max versions */
1140 for (i = 0; i < countof(suite_algs); i++)
536dbc00 1141 {
281766c5
TB		 1142 if (suite_algs[i].min_version <= max_version &&
1143 suite_algs[i].max_version >= min_version)
1144 {
1145 suites[count++] = suite_algs[i];
1146 }
18010de2 1147 }
ac5717c9 1148
96b2fbcc
MW		 1149 if (require_encryption)
1150 {
ac5717c9 1151 filter_null_suites(suites, &count);
96b2fbcc 1152 }
4254257f
MW		 1153 if (!this->rsa)
1154 {
1155 filter_key_suites(this, suites, &count, KEY_RSA);
1156 }
1157 if (!this->ecdsa)
1158 {
1159 filter_key_suites(this, suites, &count, KEY_ECDSA);
1160 }
1161
ac5717c9 1162 filter_unsupported_suites(suites, &count);
a2bfc45b 1163
24a5b935
MW		 1164 /* filter suites with strongswan.conf options */
1165 filter_key_exchange_config_suites(this, suites, &count);
1166 filter_cipher_config_suites(this, suites, &count);
1167 filter_mac_config_suites(this, suites, &count);
adb913ad 1168 filter_specific_config_suites(this, suites, &count);
24a5b935 1169
56a1167b
AS		 1170 free(this->suites);
1171 this->suite_count = count;
1172 this->suites = malloc(sizeof(tls_cipher_suite_t) * count);
1173
3c19b346 1174 DBG2(DBG_TLS, "%d supported TLS cipher suites:", count);
8a6edc08
PK		 1175 new_min_version = max_version;
1176 new_max_version = min_version;
a2bfc45b
MW		 1177 for (i = 0; i < count; i++)
1178 {
3c19b346 1179 DBG2(DBG_TLS, " %N", tls_cipher_suite_names, suites[i].suite);
56a1167b 1180 this->suites[i] = suites[i].suite;
8a6edc08
PK		 1181
1182 /* set TLS min/max versions appropriate to the final cipher suites */
1183 new_max_version = max(new_max_version, suites[i].max_version);
1184 new_min_version = min(new_min_version, suites[i].min_version);
1185 }
1186 new_max_version = min(new_max_version, max_version);
1187 new_min_version = max(new_min_version, min_version);
1188
8cf3998f
TB		 1189 if ((min_version != new_min_version || max_version != new_max_version) &&
1190 this->tls->set_version(this->tls, new_min_version, new_max_version))
8a6edc08 1191 {
8a6edc08 1192 DBG2(DBG_TLS, "TLS min/max %N/%N according to the cipher suites",
8cf3998f
TB		 1193 tls_numeric_version_names, new_min_version,
1194 tls_numeric_version_names, new_max_version);
a2bfc45b 1195 }
18010de2
MW		 1196}
1197
1198METHOD(tls_crypto_t, get_cipher_suites, int,
1199 private_tls_crypto_t *this, tls_cipher_suite_t **suites)
1200{
43c8f950
TB		 1201 if (!this->suites)
1202 {
1203 build_cipher_suite_list(this);
1204 }
06424efa
TB		 1205 if (suites)
1206 {
1207 *suites = this->suites;
1208 }
18010de2
MW		 1209 return this->suite_count;
1210}
1211
d3204677
MW		 1212/**
1213 * Create NULL encryption transforms
1214 */
1215static bool create_null(private_tls_crypto_t *this, suite_algs_t *algs)
1216{
1217 this->aead_in = tls_aead_create_null(algs->mac);
1218 this->aead_out = tls_aead_create_null(algs->mac);
1219 if (!this->aead_in || !this->aead_out)
1220 {
1221 DBG1(DBG_TLS, "selected TLS MAC %N not supported",
1222 integrity_algorithm_names, algs->mac);
1223 return FALSE;
1224 }
1225 return TRUE;
1226}
1227
1228/**
1229 * Create traditional transforms
1230 */
1231static bool create_traditional(private_tls_crypto_t *this, suite_algs_t *algs)
1232{
7a2b0266 1233 if (this->tls->get_version_max(this->tls) < TLS_1_1)
d3204677
MW		 1234 {
1235 this->aead_in = tls_aead_create_implicit(algs->mac,
1236 algs->encr, algs->encr_size);
1237 this->aead_out = tls_aead_create_implicit(algs->mac,
1238 algs->encr, algs->encr_size);
1239 }
1240 else
1241 {
1242 this->aead_in = tls_aead_create_explicit(algs->mac,
1243 algs->encr, algs->encr_size);
1244 this->aead_out = tls_aead_create_explicit(algs->mac,
1245 algs->encr, algs->encr_size);
1246 }
1247 if (!this->aead_in || !this->aead_out)
1248 {
1249 DBG1(DBG_TLS, "selected TLS transforms %N-%u-%N not supported",
1250 encryption_algorithm_names, algs->encr, algs->encr_size * 8,
1251 integrity_algorithm_names, algs->mac);
1252 return FALSE;
1253 }
1254 return TRUE;
1255}
1256
f0f30117
MW		 1257/**
1258 * Create AEAD transforms
1259 */
1260static bool create_aead(private_tls_crypto_t *this, suite_algs_t *algs)
1261{
7a2b0266 1262 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1263 {
1264 this->aead_in = tls_aead_create_aead(algs->encr, algs->encr_size);
1265 this->aead_out = tls_aead_create_aead(algs->encr, algs->encr_size);
1266 }
1267 else
1268 {
1269 this->aead_in = tls_aead_create_seq(algs->encr, algs->encr_size);
1270 this->aead_out = tls_aead_create_seq(algs->encr, algs->encr_size);
7a2b0266 1271 }
f0f30117
MW		 1272 if (!this->aead_in || !this->aead_out)
1273 {
1274 DBG1(DBG_TLS, "selected TLS transforms %N-%u not supported",
1275 encryption_algorithm_names, algs->encr, algs->encr_size * 8);
1276 return FALSE;
1277 }
1278 return TRUE;
1279}
1280
d3204677
MW		 1281/**
1282 * Clean up and unset AEAD transforms
1283 */
1284static void destroy_aeads(private_tls_crypto_t *this)
1285{
1286 DESTROY_IF(this->aead_in);
1287 DESTROY_IF(this->aead_out);
1288 this->aead_in = this->aead_out = NULL;
1289}
1290
84543e6e
MW		 1291/**
1292 * Create crypto primitives
1293 */
4cdade5a 1294static bool create_ciphers(private_tls_crypto_t *this, suite_algs_t *algs)
84543e6e 1295{
d3204677 1296 destroy_aeads(this);
64e63c68 1297 DESTROY_IF(this->hkdf);
84543e6e 1298 DESTROY_IF(this->prf);
7a2b0266 1299 if (this->tls->get_version_max(this->tls) < TLS_1_3)
84543e6e 1300 {
7a2b0266 1301 if (this->tls->get_version_max(this->tls) < TLS_1_2)
1302 {
1303 this->prf = tls_prf_create_10();
1304 }
1305 else
1306 {
1307 this->prf = tls_prf_create_12(algs->prf);
1308 }
1309 if (!this->prf)
1310 {
1311 DBG1(DBG_TLS, "selected TLS PRF not supported");
1312 return FALSE;
1313 }
84543e6e
MW		 1314 }
1315 else
1316 {
7a2b0266 1317 this->hkdf = tls_hkdf_create(algs->hash, chunk_empty);
1318 if (!this->hkdf)
1319 {
1320 DBG1(DBG_TLS, "TLS HKDF creation unsuccessful");
1321 return FALSE;
1322 }
84543e6e 1323 }
84543e6e
MW		 1324 if (algs->encr == ENCR_NULL)
1325 {
d3204677
MW		 1326 if (create_null(this, algs))
1327 {
1328 return TRUE;
1329 }
84543e6e 1330 }
f0f30117
MW		 1331 else if (encryption_algorithm_is_aead(algs->encr))
1332 {
1333 if (create_aead(this, algs))
1334 {
1335 return TRUE;
1336 }
1337 }
84543e6e
MW		 1338 else
1339 {
d3204677 1340 if (create_traditional(this, algs))
84543e6e 1341 {
d3204677 1342 return TRUE;
84543e6e
MW		 1343 }
1344 }
d3204677
MW		 1345 destroy_aeads(this);
1346 return FALSE;
84543e6e
MW		 1347}
1348
18010de2 1349METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
4cdade5a
MW		 1350 private_tls_crypto_t *this, tls_cipher_suite_t *suites, int count,
1351 key_type_t key)
18010de2 1352{
4cdade5a 1353 suite_algs_t *algs;
18010de2
MW		 1354 int i, j;
1355
1356 for (i = 0; i < this->suite_count; i++)
1357 {
1358 for (j = 0; j < count; j++)
1359 {
1360 if (this->suites[i] == suites[j])
1361 {
4cdade5a
MW		 1362 algs = find_suite(this->suites[i]);
1363 if (algs)
84543e6e 1364 {
34f66ce6
PK		 1365 if (key == KEY_ANY || key == algs->key ||
1366 (algs->key == KEY_ECDSA && key == KEY_ED25519) ||
1367 (algs->key == KEY_ECDSA && key == KEY_ED448))
4cdade5a
MW		 1368 {
1369 if (create_ciphers(this, algs))
1370 {
1371 this->suite = this->suites[i];
1372 return this->suite;
1373 }
1374 }
84543e6e 1375 }
18010de2
MW		 1376 }
1377 }
1378 }
1379 return 0;
1380}
1381
48d6b57c 1382/**
1b593e1d
TB		 1383 * Parameters for RSA/PSS signature schemes
1384 */
1385#define PSS_PARAMS(bits) static rsa_pss_params_t pss_params_sha##bits = { \
1386 .hash = HASH_SHA##bits, \
1387 .mgf1_hash = HASH_SHA##bits, \
1388 .salt_len = HASH_SIZE_SHA##bits, \
1389}
1390
1391PSS_PARAMS(256);
1392PSS_PARAMS(384);
1393PSS_PARAMS(512);
1394
e3757300 1395typedef struct {
1b593e1d
TB		 1396 tls_signature_scheme_t sig;
1397 signature_params_t params;
1398 /* min/max versions for use in CertificateVerify */
1399 tls_version_t min_version;
1400 tls_version_t max_version;
e3757300
PK		 1401} scheme_algs_t;
1402
1403/**
1404 * Map TLS signature schemes, ordered by preference
1405 */
1406static scheme_algs_t schemes[] = {
1b593e1d
TB		 1407 { TLS_SIG_ECDSA_SHA256, { .scheme = SIGN_ECDSA_WITH_SHA256_DER },
1408 TLS_1_0, TLS_1_3 },
1409 { TLS_SIG_ECDSA_SHA384, { .scheme = SIGN_ECDSA_WITH_SHA384_DER },
1410 TLS_1_0, TLS_1_3 },
1411 { TLS_SIG_ECDSA_SHA512, { .scheme = SIGN_ECDSA_WITH_SHA512_DER },
1412 TLS_1_0, TLS_1_3 },
1413 { TLS_SIG_ED25519, { .scheme = SIGN_ED25519 },
34f66ce6 1414 TLS_1_0, TLS_1_3 },
1b593e1d 1415 { TLS_SIG_ED448, { .scheme = SIGN_ED448 },
34f66ce6 1416 TLS_1_0, TLS_1_3 },
1b593e1d
TB		 1417 { TLS_SIG_RSA_PSS_RSAE_SHA256, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha256, },
1418 TLS_1_2, TLS_1_3 },
1419 { TLS_SIG_RSA_PSS_RSAE_SHA384, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha384, },
1420 TLS_1_2, TLS_1_3 },
1421 { TLS_SIG_RSA_PSS_RSAE_SHA512, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha512, },
1422 TLS_1_2, TLS_1_3 },
1423 /* the parameters for the next three should actually be taken from the
1424 * public key, we currently don't have an API for that, so assume defaults */
1425 { TLS_SIG_RSA_PSS_PSS_SHA256, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha256, },
1426 TLS_1_2, TLS_1_3 },
1427 { TLS_SIG_RSA_PSS_PSS_SHA384, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha384, },
1428 TLS_1_2, TLS_1_3 },
1429 { TLS_SIG_RSA_PSS_PSS_SHA512, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha512, },
1430 TLS_1_2, TLS_1_3 },
1431 { TLS_SIG_RSA_PKCS1_SHA256, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_256 },
1432 TLS_1_0, TLS_1_2 },
1433 { TLS_SIG_RSA_PKCS1_SHA384, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_384 },
1434 TLS_1_0, TLS_1_2 },
1435 { TLS_SIG_RSA_PKCS1_SHA512, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_512 },
1436 TLS_1_0, TLS_1_2 },
48d6b57c
MW		 1437};
1438
e3757300
PK		 1439/**
1440 * Filter signature scheme config
1441 */
1442static bool filter_signature_scheme_config(tls_signature_scheme_t signature)
1443{
1444 enumerator_t *enumerator;
1445 char *token, *config;
1446
1447 config = lib->settings->get_str(lib->settings, "%s.tls.signature", NULL,
1448 lib->ns);
1449 if (config)
1450 {
1451 enumerator = enumerator_create_token(config, ",", " ");
1452 while (enumerator->enumerate(enumerator, &token))
1453 {
1454 tls_signature_scheme_t sig;
1455
1456 if (enum_from_name(tls_signature_scheme_names, token, &sig) &&
1457 sig == signature)
1458 {
1459 enumerator->destroy(enumerator);
1460 return TRUE;
1461 }
1462 }
1463 enumerator->destroy(enumerator);
1464 }
1465 return !config;
1466}
1467
d29a82a9 1468METHOD(tls_crypto_t, get_signature_algorithms, void,
1b593e1d 1469 private_tls_crypto_t *this, bio_writer_t *writer, bool cert)
d29a82a9 1470{
7e432eff 1471 bio_writer_t *supported;
1b593e1d 1472 tls_version_t min_version, max_version;
48d6b57c 1473 int i;
d29a82a9 1474
7e432eff 1475 supported = bio_writer_create(32);
1b593e1d
TB		 1476
1477 if (!cert)
1478 {
1479 min_version = this->tls->get_version_min(this->tls);
1480 max_version = this->tls->get_version_max(this->tls);
1481 }
48d6b57c
MW		 1482
1483 for (i = 0; i < countof(schemes); i++)
d29a82a9 1484 {
1b593e1d
TB		 1485 if ((cert || (schemes[i].min_version <= max_version &&
1486 schemes[i].max_version >= min_version)) &&
1487 lib->plugins->has_feature(lib->plugins,
e3757300
PK		 1488 PLUGIN_PROVIDE(PUBKEY_VERIFY, schemes[i].params.scheme)) &&
1489 filter_signature_scheme_config(schemes[i].sig))
d29a82a9 1490 {
1b593e1d 1491 supported->write_uint16(supported, schemes[i].sig);
7a2b0266 1492 }
d29a82a9 1493 }
d29a82a9
MW		 1494
1495 writer->write_data16(writer, supported->get_buf(supported));
1496 supported->destroy(supported);
1497}
1498
48d6b57c 1499/**
1b593e1d 1500 * Get the signature parameters from a TLS signature scheme
48d6b57c 1501 */
06112f3f
PK		 1502static signature_params_t *params_for_scheme(tls_signature_scheme_t sig,
1503 bool sign)
48d6b57c
MW		 1504{
1505 int i;
1506
1b593e1d 1507 for (i = 0; i < countof(schemes); i++)
48d6b57c 1508 {
7fbe2e27 1509 /* strongSwan supports only RSA_PSS_RSAE schemes for signing but can
06112f3f
PK		 1510 * verify public keys in rsaEncryption as well as rsassaPss encoding. */
1511 if (sign && (sig == TLS_SIG_RSA_PSS_PSS_SHA256 ||
1512 sig == TLS_SIG_RSA_PSS_PSS_SHA384 ||
1513 sig == TLS_SIG_RSA_PSS_PSS_SHA512))
7fbe2e27
PK		 1514 {
1515 continue;
1516 }
1b593e1d 1517 if (schemes[i].sig == sig)
48d6b57c 1518 {
1b593e1d 1519 return &schemes[i].params;
48d6b57c
MW		 1520 }
1521 }
1b593e1d 1522 return NULL;
48d6b57c
MW		 1523}
1524
3f7bb88b
MW		 1525/**
1526 * Mapping groups to TLS named curves
1527 */
1528static struct {
1529 diffie_hellman_group_t group;
7a2b0266 1530 tls_named_group_t curve;
3f7bb88b
MW		 1531} curves[] = {
1532 { ECP_256_BIT, TLS_SECP256R1},
1533 { ECP_384_BIT, TLS_SECP384R1},
1534 { ECP_521_BIT, TLS_SECP521R1},
1535 { ECP_224_BIT, TLS_SECP224R1},
1536 { ECP_192_BIT, TLS_SECP192R1},
3101120c
TB		 1537 { CURVE_25519, TLS_CURVE25519},
1538 { CURVE_448, TLS_CURVE448},
3f7bb88b
MW		 1539};
1540
525cc46c
TB		 1541CALLBACK(group_filter, bool,
1542 void *null, enumerator_t *orig, va_list args)
3f7bb88b 1543{
e53bee9d
PK		 1544 diffie_hellman_group_t group, *group_out;
1545 tls_named_group_t curve, *curve_out;
525cc46c 1546 char *plugin;
3f7bb88b 1547
e53bee9d 1548 VA_ARGS_VGET(args, group_out, curve_out);
525cc46c
TB		 1549
1550 while (orig->enumerate(orig, &group, &plugin))
3f7bb88b 1551 {
e53bee9d
PK		 1552 curve = tls_ec_group_to_curve(group);
1553 if (curve)
3f7bb88b 1554 {
e53bee9d 1555 if (group_out)
3f7bb88b 1556 {
e53bee9d
PK		 1557 *group_out = group;
1558 }
1559 if (curve_out)
1560 {
1561 *curve_out = curve;
1562 }
1563 return TRUE;
1564 }
1565 }
1566 return FALSE;
1567}
1568
1569CALLBACK(config_filter, bool,
1570 void *null, enumerator_t *orig, va_list args)
1571{
1572 diffie_hellman_group_t group, *group_out;
1573 tls_named_group_t curve, *curve_out;
1574
1575 VA_ARGS_VGET(args, group_out, curve_out);
1576
1577 while (orig->enumerate(orig, &group, &curve))
1578 {
1579 if (filter_curve_config(curve))
f77ecf07 1580
e53bee9d
PK		 1581 {
1582 if (group_out)
1583 {
1584 *group_out = group;
3f7bb88b 1585 }
e53bee9d
PK		 1586 if (curve_out)
1587 {
1588 *curve_out = curve;
1589 }
1590 return TRUE;
3f7bb88b
MW		 1591 }
1592 }
1593 return FALSE;
1594}
1595
1596METHOD(tls_crypto_t, create_ec_enumerator, enumerator_t*,
1597 private_tls_crypto_t *this)
37a59a8f 1598{
3f7bb88b 1599 return enumerator_create_filter(
e53bee9d
PK		 1600 enumerator_create_filter(
1601 lib->crypto->create_dh_enumerator(lib->crypto),
1602 group_filter, NULL, NULL),
1603 config_filter, NULL, NULL);
37a59a8f
MW		 1604}
1605
f77ecf07
TB		 1606/**
1607 * Check if the given ECDH group is supported or return the first one we
1608 * actually do support.
1609 */
1610static diffie_hellman_group_t supported_ec_group(private_tls_crypto_t *this,
1611 diffie_hellman_group_t orig)
1612{
1613 diffie_hellman_group_t current, first = MODP_NONE;
1614 enumerator_t *enumerator;
1615
1616 enumerator = create_ec_enumerator(this);
1617 while (enumerator->enumerate(enumerator, &current, NULL))
1618 {
1619 if (current == orig)
1620 {
1621 enumerator->destroy(enumerator);
1622 return orig;
1623 }
1624 else if (first == MODP_NONE)
1625 {
1626 first = current;
1627 }
1628 }
1629 enumerator->destroy(enumerator);
1630 return first;
1631}
1632
1633METHOD(tls_crypto_t, get_dh_group, diffie_hellman_group_t,
1634 private_tls_crypto_t *this)
1635{
1636 suite_algs_t *algs;
1637
1638 algs = find_suite(this->suite);
1639 if (algs)
1640 {
1641 if (diffie_hellman_group_is_ec(algs->dh))
1642 {
1643 return supported_ec_group(this, algs->dh);
1644 }
1645 return algs->dh;
1646 }
1647 return MODP_NONE;
1648}
1649
dc9f34be
MW		 1650METHOD(tls_crypto_t, set_protection, void,
1651 private_tls_crypto_t *this, tls_protection_t *protection)
1652{
1653 this->protection = protection;
1654}
1655
84d67ead
MW		 1656METHOD(tls_crypto_t, append_handshake, void,
1657 private_tls_crypto_t *this, tls_handshake_type_t type, chunk_t data)
1658{
b12c53ce 1659 uint32_t header;
84d67ead
MW		 1660
1661 /* reconstruct handshake header */
1662 header = htonl(data.len | (type << 24));
1663 this->handshake = chunk_cat("mcc", this->handshake,
1664 chunk_from_thing(header), data);
1665}
1666
1667/**
d29a82a9 1668 * Create a hash using the suites HASH algorithm
84d67ead 1669 */
d29a82a9 1670static bool hash_data(private_tls_crypto_t *this, chunk_t data, chunk_t *hash)
84d67ead 1671{
7a2b0266 1672 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
84d67ead
MW		 1673 {
1674 hasher_t *hasher;
1675 suite_algs_t *alg;
1676
1677 alg = find_suite(this->suite);
1678 if (!alg)
1679 {
1680 return FALSE;
1681 }
1682 hasher = lib->crypto->create_hasher(lib->crypto, alg->hash);
87dd205b 1683 if (!hasher || !hasher->allocate_hash(hasher, data, hash))
84d67ead 1684 {
3c19b346 1685 DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, alg->hash);
87dd205b 1686 DESTROY_IF(hasher);
84d67ead
MW		 1687 return FALSE;
1688 }
84d67ead
MW		 1689 hasher->destroy(hasher);
1690 }
1691 else
1692 {
1693 hasher_t *md5, *sha1;
1694 char buf[HASH_SIZE_MD5 + HASH_SIZE_SHA1];
1695
1696 md5 = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
8bd6a30a 1697 if (!md5 || !md5->get_hash(md5, data, buf))
84d67ead 1698 {
3c19b346 1699 DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, HASH_MD5);
8bd6a30a 1700 DESTROY_IF(md5);
84d67ead
MW		 1701 return FALSE;
1702 }
84d67ead
MW		 1703 md5->destroy(md5);
1704 sha1 = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
8bd6a30a 1705 if (!sha1 || !sha1->get_hash(sha1, data, buf + HASH_SIZE_MD5))
84d67ead 1706 {
3c19b346 1707 DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, HASH_SHA1);
8bd6a30a 1708 DESTROY_IF(sha1);
84d67ead
MW		 1709 return FALSE;
1710 }
84d67ead
MW		 1711 sha1->destroy(sha1);
1712
1713 *hash = chunk_clone(chunk_from_thing(buf));
1714 }
1715 return TRUE;
1716}
1717
2271d67f
TB		 1718METHOD(tls_crypto_t, hash_handshake, bool,
1719 private_tls_crypto_t *this, chunk_t *out)
1720{
1721 chunk_t hash;
1722
1723 if (!hash_data(this, this->handshake, &hash))
1724 {
1725 return FALSE;
1726 }
1727
1728 chunk_free(&this->handshake);
1729 append_handshake(this, TLS_MESSAGE_HASH, hash);
1730
1731 if (out)
1732 {
1733 *out = hash;
1734 }
1735 else
1736 {
1737 free(hash.ptr);
1738 }
1739 return TRUE;
1740}
1741
de983a3c
TB		 1742/**
1743 * TLS 1.3 static part of the data the server signs (64 spaces followed by the
1744 * context string "TLS 1.3, server CertificateVerify" and a 0 byte).
1745 */
1746static chunk_t tls13_sig_data_server = chunk_from_chars(
1747 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1748 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1749 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1750 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1751 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1752 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1753 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1754 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1755 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e, 0x33, 0x2c,
1756 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20,
1757 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
1758 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66,
1759 0x79, 0x00,
1760);
1761
d2fc9b09
PK		 1762/**
1763 * TLS 1.3 static part of the data the peer signs (64 spaces followed by the
1764 * context string "TLS 1.3, client CertificateVerify" and a 0 byte).
1765 */
1766static chunk_t tls13_sig_data_client = chunk_from_chars(
1767 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1768 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1769 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1770 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1771 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1772 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1773 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1774 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1775 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e, 0x33, 0x2c,
1776 0x20, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x20,
1777 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
1778 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66,
1779 0x79, 0x00,
1780);
1781
d29a82a9 1782METHOD(tls_crypto_t, sign, bool,
7e432eff 1783 private_tls_crypto_t *this, private_key_t *key, bio_writer_t *writer,
d29a82a9 1784 chunk_t data, chunk_t hashsig)
dbb7c030 1785{
7a2b0266 1786 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
84d67ead 1787 {
1b593e1d
TB		 1788 /* fallback to SHA1/RSA and SHA1/ECDSA */
1789 const chunk_t hashsig_def = chunk_from_chars(0x02, 0x01, 0x02, 0x03);
1790 signature_params_t *params;
1791 key_type_t type;
1792 uint16_t scheme;
7e432eff 1793 bio_reader_t *reader;
dbb7c030
MW		 1794 chunk_t sig;
1795 bool done = FALSE;
1796
7fbe2e27
PK		 1797 if (this->tls->get_version_max(this->tls) >= TLS_1_3)
1798 {
1799 chunk_t transcript_hash;
1800
1801 if (!hash_data(this, data, &transcript_hash))
1802 {
1803 DBG1(DBG_TLS, "unable to create transcript hash");
1804 return FALSE;
1805 }
9ef46cfa
PK		 1806 if (this->tls->is_server(this->tls))
1807 {
1808 data = chunk_cata("cm", tls13_sig_data_server, transcript_hash);
1809 }
1810 else
1811 {
1812 data = chunk_cata("cm", tls13_sig_data_client, transcript_hash);
1813 }
7fbe2e27
PK		 1814 }
1815
d29a82a9
MW		 1816 if (!hashsig.len)
1817 { /* fallback if none given */
d5cf2d1f 1818 hashsig = hashsig_def;
d29a82a9 1819 }
1b593e1d 1820 type = key->get_type(key);
7e432eff 1821 reader = bio_reader_create(hashsig);
dbb7c030 1822 while (reader->remaining(reader) >= 2)
400df4ca 1823 {
1b593e1d 1824 if (reader->read_uint16(reader, &scheme))
dbb7c030 1825 {
06112f3f 1826 params = params_for_scheme(scheme, TRUE);
1b593e1d
TB		 1827 if (params &&
1828 type == key_type_from_signature_scheme(params->scheme) &&
1829 key->sign(key, params->scheme, params->params, data, &sig))
dbb7c030
MW		 1830 {
1831 done = TRUE;
1832 break;
1833 }
1834 }
1835 }
1836 reader->destroy(reader);
1837 if (!done)
1838 {
1839 DBG1(DBG_TLS, "none of the proposed hash/sig algorithms supported");
400df4ca
MW		 1840 return FALSE;
1841 }
1b593e1d
TB		 1842 DBG2(DBG_TLS, "created signature with %N", tls_signature_scheme_names,
1843 scheme);
1844 writer->write_uint16(writer, scheme);
400df4ca
MW		 1845 writer->write_data16(writer, sig);
1846 free(sig.ptr);
1847 }
1848 else
1849 {
dbb7c030 1850 chunk_t sig, hash;
d29a82a9 1851 bool done;
dbb7c030
MW		 1852
1853 switch (key->get_type(key))
400df4ca 1854 {
dbb7c030 1855 case KEY_RSA:
d29a82a9 1856 if (!hash_data(this, data, &hash))
dbb7c030
MW		 1857 {
1858 return FALSE;
1859 }
de280c2e
TB		 1860 done = key->sign(key, SIGN_RSA_EMSA_PKCS1_NULL, NULL, hash,
1861 &sig);
d29a82a9
MW		 1862 free(hash.ptr);
1863 if (!done)
dbb7c030 1864 {
dbb7c030
MW		 1865 return FALSE;
1866 }
d29a82a9 1867 DBG2(DBG_TLS, "created signature with MD5+SHA1/RSA");
dbb7c030
MW		 1868 break;
1869 case KEY_ECDSA:
de280c2e 1870 if (!key->sign(key, SIGN_ECDSA_WITH_SHA1_DER, NULL, data, &sig))
dbb7c030
MW		 1871 {
1872 return FALSE;
1873 }
d29a82a9 1874 DBG2(DBG_TLS, "created signature with SHA1/ECDSA");
dbb7c030 1875 break;
34f66ce6
PK		 1876 case KEY_ED25519:
1877 if (!key->sign(key, SIGN_ED25519, NULL, data, &sig))
1878 {
1879 return FALSE;
1880 }
1881 DBG2(DBG_TLS, "created signature with Ed25519");
1882 break;
1883 case KEY_ED448:
1884 if (!key->sign(key, SIGN_ED448, NULL, data, &sig))
1885 {
1886 return FALSE;
1887 }
1888 DBG2(DBG_TLS, "created signature with Ed448");
1889 break;
dbb7c030
MW		 1890 default:
1891 return FALSE;
400df4ca
MW		 1892 }
1893 writer->write_data16(writer, sig);
400df4ca
MW		 1894 free(sig.ptr);
1895 }
1896 return TRUE;
1897}
1898
d29a82a9 1899METHOD(tls_crypto_t, verify, bool,
7e432eff 1900 private_tls_crypto_t *this, public_key_t *key, bio_reader_t *reader,
d29a82a9 1901 chunk_t data)
400df4ca 1902{
de983a3c 1903 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
7a2b0266 1904 {
1b593e1d
TB		 1905 signature_params_t *params;
1906 uint16_t scheme;
de983a3c 1907 chunk_t sig;
7a2b0266 1908
1b593e1d 1909 if (!reader->read_uint16(reader, &scheme) ||
7a2b0266 1910 !reader->read_data16(reader, &sig))
1911 {
1912 DBG1(DBG_TLS, "received invalid signature");
1913 return FALSE;
1914 }
06112f3f 1915 params = params_for_scheme(scheme, FALSE);
1b593e1d 1916 if (!params)
7a2b0266 1917 {
1b593e1d
TB		 1918 DBG1(DBG_TLS, "signature algorithms %N not supported",
1919 tls_signature_scheme_names, scheme);
7a2b0266 1920 return FALSE;
1921 }
9ef46cfa 1922 if (this->tls->get_version_max(this->tls) >= TLS_1_3)
7a2b0266 1923 {
de983a3c 1924 chunk_t transcript_hash;
84d67ead 1925
de983a3c
TB		 1926 if (!hash_data(this, data, &transcript_hash))
1927 {
1928 DBG1(DBG_TLS, "Unable to create transcript hash");
1929 return FALSE;
1930 }
1931
d2fc9b09
PK		 1932 if (this->tls->is_server(this->tls))
1933 {
1934 data = chunk_cata("cm", tls13_sig_data_client, transcript_hash);
1935 }
1936 else
1937 {
1938 data = chunk_cata("cm", tls13_sig_data_server, transcript_hash);
1939 }
84d67ead 1940 }
1b593e1d 1941 if (!key->verify(key, params->scheme, params->params, data, sig))
dbb7c030 1942 {
1b593e1d
TB		 1943 DBG1(DBG_TLS, "signature verification with %N failed",
1944 tls_signature_scheme_names, scheme);
dbb7c030
MW		 1945 return FALSE;
1946 }
1b593e1d
TB		 1947 DBG2(DBG_TLS, "verified signature with %N",
1948 tls_signature_scheme_names, scheme);
84d67ead
MW		 1949 }
1950 else
1951 {
400df4ca 1952 chunk_t sig, hash;
d29a82a9 1953 bool done;
84d67ead 1954
400df4ca
MW		 1955 if (!reader->read_data16(reader, &sig))
1956 {
d29a82a9 1957 DBG1(DBG_TLS, "received invalid signature");
400df4ca
MW		 1958 return FALSE;
1959 }
dbb7c030 1960 switch (key->get_type(key))
84d67ead 1961 {
dbb7c030 1962 case KEY_RSA:
d29a82a9 1963 if (!hash_data(this, data, &hash))
dbb7c030
MW		 1964 {
1965 return FALSE;
1966 }
a413571f
TB		 1967 done = key->verify(key, SIGN_RSA_EMSA_PKCS1_NULL, NULL, hash,
1968 sig);
d29a82a9
MW		 1969 free(hash.ptr);
1970 if (!done)
dbb7c030 1971 {
dbb7c030
MW		 1972 return FALSE;
1973 }
d29a82a9 1974 DBG2(DBG_TLS, "verified signature data with MD5+SHA1/RSA");
dbb7c030
MW		 1975 break;
1976 case KEY_ECDSA:
a413571f
TB		 1977 if (!key->verify(key, SIGN_ECDSA_WITH_SHA1_DER, NULL, data,
1978 sig))
dbb7c030 1979 {
dbb7c030
MW		 1980 return FALSE;
1981 }
d29a82a9 1982 DBG2(DBG_TLS, "verified signature with SHA1/ECDSA");
dbb7c030 1983 break;
34f66ce6
PK		 1984 case KEY_ED25519:
1985 if (!key->verify(key, SIGN_ED25519, NULL, data, sig))
1986 {
1987 return FALSE;
1988 }
1989 DBG2(DBG_TLS, "verified signature with Ed25519");
1990 break;
1991 case KEY_ED448:
1992 if (!key->verify(key, SIGN_ED448, NULL, data, sig))
1993 {
1994 return FALSE;
1995 }
1996 DBG2(DBG_TLS, "verified signature with Ed448");
1997 break;
dbb7c030
MW		 1998 default:
1999 return FALSE;
84d67ead 2000 }
84d67ead
MW		 2001 }
2002 return TRUE;
2003}
2004
d29a82a9 2005METHOD(tls_crypto_t, sign_handshake, bool,
7e432eff 2006 private_tls_crypto_t *this, private_key_t *key, bio_writer_t *writer,
d29a82a9
MW		 2007 chunk_t hashsig)
2008{
2009 return sign(this, key, writer, this->handshake, hashsig);
2010}
2011
2012METHOD(tls_crypto_t, verify_handshake, bool,
7e432eff 2013 private_tls_crypto_t *this, public_key_t *key, bio_reader_t *reader)
d29a82a9
MW		 2014{
2015 return verify(this, key, reader, this->handshake);
2016}
2017
2e1c0a27 2018METHOD(tls_crypto_t, calculate_finished_legacy, bool,
84d67ead
MW		 2019 private_tls_crypto_t *this, char *label, char out[12])
2020{
2021 chunk_t seed;
2022
2023 if (!this->prf)
2024 {
2025 return FALSE;
2026 }
d29a82a9 2027 if (!hash_data(this, this->handshake, &seed))
84d67ead
MW		 2028 {
2029 return FALSE;
2030 }
97b30b93
MW		 2031 if (!this->prf->get_bytes(this->prf, label, seed, 12, out))
2032 {
2033 free(seed.ptr);
2034 return FALSE;
2035 }
84d67ead
MW		 2036 free(seed.ptr);
2037 return TRUE;
2038}
2039
2e1c0a27 2040METHOD(tls_crypto_t, calculate_finished, bool,
328d7af6 2041 private_tls_crypto_t *this, bool server, chunk_t *out)
7a2b0266 2042{
2043 chunk_t finished_key, finished_hash;
7a2b0266 2044
f116a482 2045 if (!this->hkdf)
7a2b0266 2046 {
f116a482 2047 return FALSE;
7a2b0266 2048 }
f116a482 2049 if (!hash_data(this, this->handshake, &finished_hash))
7a2b0266 2050 {
f116a482
TB		 2051 DBG1(DBG_TLS, "creating hash of handshake failed");
2052 return FALSE;
7a2b0266 2053 }
328d7af6 2054 if (!this->hkdf->derive_finished(this->hkdf, server, &finished_key))
7a2b0266 2055 {
f116a482
TB		 2056 DBG1(DBG_TLS, "generating finished key failed");
2057 chunk_clear(&finished_hash);
2058 return FALSE;
7a2b0266 2059 }
f116a482 2060 if (!this->hkdf->allocate_bytes(this->hkdf, finished_key, finished_hash, out))
7a2b0266 2061 {
f116a482 2062 DBG1(DBG_TLS, "generating finished HMAC failed");
7a2b0266 2063 chunk_clear(&finished_key);
2064 chunk_clear(&finished_hash);
7a2b0266 2065 return FALSE;
2066 }
7a2b0266 2067 chunk_clear(&finished_key);
2068 chunk_clear(&finished_hash);
7a2b0266 2069 return TRUE;
2070}
2071
6a5c86b7
MW		 2072/**
2073 * Derive master secret from premaster, optionally save session
2074 */
97b30b93 2075static bool derive_master(private_tls_crypto_t *this, chunk_t premaster,
6a5c86b7
MW		 2076 chunk_t session, identification_t *id,
2077 chunk_t client_random, chunk_t server_random)
18010de2 2078{
84543e6e 2079 char master[48];
6a5c86b7 2080 chunk_t seed;
84543e6e
MW		 2081
2082 /* derive master secret */
2083 seed = chunk_cata("cc", client_random, server_random);
e7d98b8c
MW		 2084
2085 if (!this->prf->set_key(this->prf, premaster) ||
2086 !this->prf->get_bytes(this->prf, "master secret", seed,
2087 sizeof(master), master) ||
2088 !this->prf->set_key(this->prf, chunk_from_thing(master)))
97b30b93
MW		 2089 {
2090 return FALSE;
2091 }
97b30b93 2092
6a5c86b7
MW		 2093 if (this->cache && session.len)
2094 {
2095 this->cache->create(this->cache, session, id, chunk_from_thing(master),
2096 this->suite);
2097 }
2098 memwipe(master, sizeof(master));
97b30b93 2099 return TRUE;
6a5c86b7
MW		 2100}
2101
2102/**
2103 * Expand key material from master secret
2104 */
9020f7d0 2105static bool expand_keys(private_tls_crypto_t *this,
6a5c86b7
MW		 2106 chunk_t client_random, chunk_t server_random)
2107{
d3204677
MW		 2108 chunk_t seed, block;
2109 chunk_t cw_mac, cw, cw_iv;
2110 chunk_t sw_mac, sw, sw_iv;
2111 int mklen, eklen, ivlen;
84543e6e 2112
d3204677 2113 if (!this->aead_in || !this->aead_out)
18010de2 2114 {
d3204677 2115 return FALSE;
84543e6e 2116 }
d3204677
MW		 2117
2118 /* derive key block for key expansion */
2119 mklen = this->aead_in->get_mac_key_size(this->aead_in);
2120 eklen = this->aead_in->get_encr_key_size(this->aead_in);
2121 ivlen = this->aead_in->get_iv_size(this->aead_in);
84543e6e 2122 seed = chunk_cata("cc", server_random, client_random);
d3204677 2123 block = chunk_alloca((mklen + eklen + ivlen) * 2);
97b30b93
MW		 2124 if (!this->prf->get_bytes(this->prf, "key expansion", seed,
2125 block.len, block.ptr))
2126 {
2127 return FALSE;
2128 }
84543e6e 2129
d3204677
MW		 2130 /* client/server write signer keys */
2131 cw_mac = chunk_create(block.ptr, mklen);
2132 block = chunk_skip(block, mklen);
2133 sw_mac = chunk_create(block.ptr, mklen);
2134 block = chunk_skip(block, mklen);
2135
2136 /* client/server write encryption keys */
2137 cw = chunk_create(block.ptr, eklen);
2138 block = chunk_skip(block, eklen);
2139 sw = chunk_create(block.ptr, eklen);
2140 block = chunk_skip(block, eklen);
2141
2142 /* client/server write IV; TLS 1.0 implicit IVs or AEAD salt, if any */
2143 cw_iv = chunk_create(block.ptr, ivlen);
2144 block = chunk_skip(block, ivlen);
2145 sw_iv = chunk_create(block.ptr, ivlen);
2146 block = chunk_skip(block, ivlen);
2147
84543e6e
MW		 2148 if (this->tls->is_server(this->tls))
2149 {
d3204677
MW		 2150 if (!this->aead_in->set_keys(this->aead_in, cw_mac, cw, cw_iv) ||
2151 !this->aead_out->set_keys(this->aead_out, sw_mac, sw, sw_iv))
2d56575d
MW		 2152 {
2153 return FALSE;
2154 }
84543e6e
MW		 2155 }
2156 else
2157 {
d3204677
MW		 2158 if (!this->aead_out->set_keys(this->aead_out, cw_mac, cw, cw_iv) ||
2159 !this->aead_in->set_keys(this->aead_in, sw_mac, sw, sw_iv))
2d56575d
MW		 2160 {
2161 return FALSE;
2162 }
84543e6e
MW		 2163 }
2164
6a5c86b7
MW		 2165 /* EAP-MSK */
2166 if (this->msk_label)
2167 {
06c15036 2168 seed = chunk_cata("cc", client_random, server_random);
6a5c86b7 2169 this->msk = chunk_alloc(64);
97b30b93
MW		 2170 if (!this->prf->get_bytes(this->prf, this->msk_label, seed,
2171 this->msk.len, this->msk.ptr))
2172 {
2173 return FALSE;
2174 }
6a5c86b7 2175 }
9020f7d0 2176 return TRUE;
6a5c86b7
MW		 2177}
2178
9020f7d0 2179METHOD(tls_crypto_t, derive_secrets, bool,
6a5c86b7
MW		 2180 private_tls_crypto_t *this, chunk_t premaster, chunk_t session,
2181 identification_t *id, chunk_t client_random, chunk_t server_random)
2182{
97b30b93
MW		 2183 return derive_master(this, premaster, session, id,
2184 client_random, server_random) &&
2185 expand_keys(this, client_random, server_random);
6a5c86b7
MW		 2186}
2187
2921f437 2188/**
1466d4da 2189 * Derive and configure the client/server key/IV on an AEAD using a given label.
2921f437 2190 */
1466d4da
TB		 2191static bool derive_labeled_key(private_tls_crypto_t *this, bool server,
2192 tls_hkdf_label_t label, tls_aead_t *aead)
7a2b0266 2193{
1466d4da 2194 chunk_t key = chunk_empty, iv = chunk_empty;
2921f437 2195 bool success = FALSE;
7a2b0266 2196
1466d4da 2197 if (!this->hkdf->generate_secret(this->hkdf, label, this->handshake,
2921f437 2198 NULL) ||
1466d4da
TB		 2199 !this->hkdf->derive_key(this->hkdf, server,
2200 aead->get_encr_key_size(aead), &key) ||
2201 !this->hkdf->derive_iv(this->hkdf, server,
2202 aead->get_iv_size(aead), &iv))
2203 {
2204 DBG1(DBG_TLS, "deriving key material failed");
2921f437 2205 goto out;
7a2b0266 2206 }
2207
1466d4da 2208 if (!aead->set_keys(aead, chunk_empty, key, iv))
7a2b0266 2209 {
2921f437
TB		 2210 DBG1(DBG_TLS, "setting AEAD key material failed");
2211 goto out;
7a2b0266 2212 }
2921f437 2213 success = TRUE;
7a2b0266 2214
2921f437 2215out:
1466d4da
TB		 2216 chunk_clear(&key);
2217 chunk_clear(&iv);
2921f437 2218 return success;
7a2b0266 2219}
2220
1466d4da
TB		 2221/**
2222 * Derive and configure the keys/IVs using the given labels.
2223 */
2224static bool derive_labeled_keys(private_tls_crypto_t *this,
2225 tls_hkdf_label_t client_label,
2226 tls_hkdf_label_t server_label)
2227{
6b23543a
PK		 2228 tls_aead_t *aead_c, *aead_s;
2229 suite_algs_t *algs;
1466d4da 2230
6b23543a
PK		 2231 algs = find_suite(this->suite);
2232 destroy_aeads(this);
2233 if (!create_aead(this, algs))
2234 {
2235 return FALSE;
2236 }
2237 aead_c = this->aead_out;
2238 aead_s = this->aead_in;
1466d4da
TB		 2239 if (this->tls->is_server(this->tls))
2240 {
2241 aead_c = this->aead_in;
2242 aead_s = this->aead_out;
2243 }
2244 return derive_labeled_key(this, FALSE, client_label, aead_c) &&
2245 derive_labeled_key(this, TRUE, server_label, aead_s);
2246}
2247
2921f437
TB		 2248METHOD(tls_crypto_t, derive_handshake_keys, bool,
2249 private_tls_crypto_t *this, chunk_t shared_secret)
7a2b0266 2250{
2921f437
TB		 2251 this->hkdf->set_shared_secret(this->hkdf, shared_secret);
2252 return derive_labeled_keys(this, TLS_HKDF_C_HS_TRAFFIC,
2253 TLS_HKDF_S_HS_TRAFFIC);
2254}
7a2b0266 2255
2921f437
TB		 2256METHOD(tls_crypto_t, derive_app_keys, bool,
2257 private_tls_crypto_t *this)
2258{
121ac4b9
TB		 2259 if (!derive_labeled_keys(this, TLS_HKDF_C_AP_TRAFFIC,
2260 TLS_HKDF_S_AP_TRAFFIC))
2261 {
2262 return FALSE;
2263 }
2264
2265 /* EAP-MSK */
2266 if (this->msk_label)
2267 {
2268 /* because the length is encoded when expanding key material, we
2269 * request the same number of bytes as FreeRADIUS (the first 64 for
2270 * the MSK, the next for the EMSK, which we just ignore) */
2271 if (!this->hkdf->export(this->hkdf, this->msk_label, chunk_empty,
2272 this->handshake, 128, &this->msk))
2273 {
2274 return FALSE;
2275 }
2276 this->msk.len = 64;
2277 }
2278 return TRUE;
7a2b0266 2279}
2280
1466d4da
TB		 2281METHOD(tls_crypto_t, update_app_keys, bool,
2282 private_tls_crypto_t *this, bool inbound)
2283{
6b23543a 2284 suite_algs_t *algs;
1466d4da
TB		 2285 tls_hkdf_label_t label = TLS_HKDF_UPD_C_TRAFFIC;
2286
6b23543a
PK		 2287 algs = find_suite(this->suite);
2288 destroy_aeads(this);
2289 if (!create_aead(this, algs))
2290 {
2291 return FALSE;
2292 }
1466d4da
TB		 2293 if (this->tls->is_server(this->tls) != inbound)
2294 {
2295 label = TLS_HKDF_UPD_S_TRAFFIC;
2296 }
2297 return derive_labeled_key(this, label == TLS_HKDF_UPD_S_TRAFFIC, label,
2298 inbound ? this->aead_in : this->aead_out);
2299}
2300
6a5c86b7
MW		 2301METHOD(tls_crypto_t, resume_session, tls_cipher_suite_t,
2302 private_tls_crypto_t *this, chunk_t session, identification_t *id,
2303 chunk_t client_random, chunk_t server_random)
2304{
2305 chunk_t master;
2306
2307 if (this->cache && session.len)
2308 {
2309 this->suite = this->cache->lookup(this->cache, session, id, &master);
2310 if (this->suite)
2311 {
ae10ee6d 2312 this->suite = select_cipher_suite(this, &this->suite, 1, KEY_ANY);
6a5c86b7
MW		 2313 if (this->suite)
2314 {
e7d98b8c
MW		 2315 if (!this->prf->set_key(this->prf, master) ||
2316 !expand_keys(this, client_random, server_random))
9020f7d0
MW		 2317 {
2318 this->suite = 0;
2319 }
6a5c86b7
MW		 2320 }
2321 chunk_clear(&master);
2322 }
ae10ee6d 2323 return this->suite;
6a5c86b7 2324 }
ae10ee6d 2325 return 0;
6a5c86b7
MW		 2326}
2327
2328METHOD(tls_crypto_t, get_session, chunk_t,
2329 private_tls_crypto_t *this, identification_t *server)
2330{
2331 if (this->cache)
2332 {
2333 return this->cache->check(this->cache, server);
2334 }
2335 return chunk_empty;
84543e6e 2336}
18010de2 2337
84543e6e
MW		 2338METHOD(tls_crypto_t, change_cipher, void,
2339 private_tls_crypto_t *this, bool inbound)
2340{
dc9f34be 2341 if (this->protection)
84543e6e 2342 {
dc9f34be
MW		 2343 if (inbound)
2344 {
d3204677 2345 this->protection->set_cipher(this->protection, TRUE, this->aead_in);
6b23543a 2346 this->aead_in = NULL;
dc9f34be
MW		 2347 }
2348 else
2349 {
d3204677 2350 this->protection->set_cipher(this->protection, FALSE, this->aead_out);
6b23543a 2351 this->aead_out = NULL;
dc9f34be 2352 }
18010de2 2353 }
536dbc00
MW		 2354}
2355
51313a39
MW		 2356METHOD(tls_crypto_t, get_eap_msk, chunk_t,
2357 private_tls_crypto_t *this)
2358{
2359 return this->msk;
2360}
2361
536dbc00
MW		 2362METHOD(tls_crypto_t, destroy, void,
2363 private_tls_crypto_t *this)
2364{
d3204677 2365 destroy_aeads(this);
84d67ead 2366 free(this->handshake.ptr);
51313a39 2367 free(this->msk.ptr);
18010de2 2368 DESTROY_IF(this->prf);
7a2b0266 2369 DESTROY_IF(this->hkdf);
84543e6e 2370 free(this->suites);
536dbc00
MW		 2371 free(this);
2372}
2373
2374/**
2375 * See header
2376 */
6a5c86b7 2377tls_crypto_t *tls_crypto_create(tls_t *tls, tls_cache_t *cache)
536dbc00
MW		 2378{
2379 private_tls_crypto_t *this;
4254257f
MW		 2380 enumerator_t *enumerator;
2381 credential_type_t type;
2382 int subtype;
536dbc00
MW		 2383
2384 INIT(this,
2385 .public = {
2386 .get_cipher_suites = _get_cipher_suites,
18010de2 2387 .select_cipher_suite = _select_cipher_suite,
35d9c15d 2388 .get_dh_group = _get_dh_group,
d29a82a9 2389 .get_signature_algorithms = _get_signature_algorithms,
3f7bb88b 2390 .create_ec_enumerator = _create_ec_enumerator,
dc9f34be 2391 .set_protection = _set_protection,
84d67ead 2392 .append_handshake = _append_handshake,
2271d67f 2393 .hash_handshake = _hash_handshake,
d29a82a9
MW		 2394 .sign = _sign,
2395 .verify = _verify,
84d67ead 2396 .sign_handshake = _sign_handshake,
400df4ca 2397 .verify_handshake = _verify_handshake,
2e1c0a27 2398 .calculate_finished_legacy = _calculate_finished_legacy,
84d67ead
MW		 2399 .calculate_finished = _calculate_finished,
2400 .derive_secrets = _derive_secrets,
2921f437
TB		 2401 .derive_handshake_keys = _derive_handshake_keys,
2402 .derive_app_keys = _derive_app_keys,
1466d4da 2403 .update_app_keys = _update_app_keys,
6a5c86b7
MW		 2404 .resume_session = _resume_session,
2405 .get_session = _get_session,
84543e6e 2406 .change_cipher = _change_cipher,
51313a39 2407 .get_eap_msk = _get_eap_msk,
536dbc00
MW		 2408 .destroy = _destroy,
2409 },
18010de2 2410 .tls = tls,
6a5c86b7 2411 .cache = cache,
536dbc00
MW		 2412 );
2413
34f66ce6
PK		 2414 /* FIXME: EDDSA keys are currently treated like ECDSA keys. A cleaner
2415 * separation would be welcome. */
4254257f
MW		 2416 enumerator = lib->creds->create_builder_enumerator(lib->creds);
2417 while (enumerator->enumerate(enumerator, &type, &subtype))
2418 {
2419 if (type == CRED_PUBLIC_KEY)
2420 {
2421 switch (subtype)
2422 {
2423 case KEY_RSA:
2424 this->rsa = TRUE;
2425 break;
2426 case KEY_ECDSA:
34f66ce6
PK		 2427 case KEY_ED25519:
2428 case KEY_ED448:
4254257f
MW		 2429 this->ecdsa = TRUE;
2430 break;
2431 default:
2432 break;
2433 }
2434 }
2435 }
2436 enumerator->destroy(enumerator);
2437
96b2fbcc
MW		 2438 switch (tls->get_purpose(tls))
2439 {
2440 case TLS_PURPOSE_EAP_TLS:
2441 /* MSK PRF ASCII constant label according to EAP-TLS RFC 5216 */
2442 this->msk_label = "client EAP encryption";
1407a002 2443 break;
ab2c989c
MW		 2444 case TLS_PURPOSE_EAP_PEAP:
2445 this->msk_label = "client EAP encryption";
96b2fbcc
MW		 2446 break;
2447 case TLS_PURPOSE_EAP_TTLS:
2448 /* MSK PRF ASCII constant label according to EAP-TTLS RFC 5281 */
2449 this->msk_label = "ttls keying material";
ddf52220 2450 break;
99b0f633
AS		 2451 default:
2452 break;
96b2fbcc 2453 }
536dbc00
MW		 2454 return &this->public;
2455}
ac5717c9
MW		 2456
2457/**
2458 * See header.
2459 */
281766c5
TB		 2460int tls_crypto_get_supported_suites(bool null, tls_version_t version,
2461 tls_cipher_suite_t **out)
ac5717c9 2462{
a6a0fa98 2463 suite_algs_t suites[countof(suite_algs)] = {};
281766c5 2464 int count = 0, i;
ac5717c9
MW		 2465
2466 /* initialize copy of suite list */
281766c5 2467 for (i = 0; i < countof(suite_algs); i++)
ac5717c9 2468 {
281766c5
TB		 2469 if (suite_algs[i].min_version <= version &&
2470 suite_algs[i].max_version >= version)
2471 {
2472 suites[count++] = suite_algs[i];
2473 }
ac5717c9
MW		 2474 }
2475
2476 filter_unsupported_suites(suites, &count);
2477
2478 if (!null)
2479 {
2480 filter_null_suites(suites, &count);
2481 }
2482
2483 if (out)
2484 {
2485 *out = calloc(count, sizeof(tls_cipher_suite_t));
2486 for (i = 0; i < count; i++)
2487 {
2488 (*out)[i] = suites[i].suite;
2489 }
2490 }
2491 return count;
2492}
066ac880 2493
e53bee9d
PK		 2494/**
2495 * See header.
2496 */
2497int tls_crypto_get_supported_groups(diffie_hellman_group_t **out)
2498{
2499 enumerator_t *enumerator;
2500 diffie_hellman_group_t groups[countof(curves)];
2501 diffie_hellman_group_t group;
2502 tls_named_group_t curve;
2503 int count = 0, i;
2504
2505 enumerator = enumerator_create_filter(
2506 lib->crypto->create_dh_enumerator(lib->crypto),
2507 group_filter, NULL, NULL);
2508
2509 while (enumerator->enumerate(enumerator, &group, &curve))
2510 {
2511 groups[count++] = group;
2512 }
2513 enumerator->destroy(enumerator);
2514
2515 if (out)
2516 {
2517 *out = calloc(count, sizeof(diffie_hellman_group_t));
2518 for (i = 0; i < count; i++)
2519 {
2520 (*out)[i] = groups[i];
2521 }
2522 }
2523 return count;
2524}
2525
e3757300
PK		 2526/**
2527 * See header.
2528 */
2529int tls_crypto_get_supported_signatures(tls_version_t version,
2530 tls_signature_scheme_t **out)
2531{
2532 scheme_algs_t sigs[countof(schemes)];
2533 int count = 0, i;
2534
2535 /* initialize copy of signature scheme list */
2536 for (i = 0; i < countof(schemes); i++)
2537 {
2538 /* only RSA_PSS_RSAE schemes supported for signing and verifying */
2539 if (schemes[i].sig == TLS_SIG_RSA_PSS_PSS_SHA256 ||
2540 schemes[i].sig == TLS_SIG_RSA_PSS_PSS_SHA384 ||
2541 schemes[i].sig == TLS_SIG_RSA_PSS_PSS_SHA512)
2542 {
2543 continue;
2544 }
2545 if (schemes[i].min_version <= version &&
2546 schemes[i].max_version >= version &&
2547 lib->plugins->has_feature(lib->plugins,
2548 PLUGIN_PROVIDE(PUBKEY_VERIFY, schemes[i].params.scheme)))
2549 {
2550 sigs[count++] = schemes[i];
2551 }
2552 }
2553
2554 if (out)
2555 {
2556 *out = calloc(count, sizeof(tls_signature_scheme_t));
2557 for (i = 0; i < count; i++)
2558 {
2559 (*out)[i] = sigs[i].sig;
2560 }
2561 }
2562 return count;
2563}
2564
066ac880
PK		 2565/**
2566 * See header.
2567 */
2568tls_named_group_t tls_ec_group_to_curve(diffie_hellman_group_t group)
2569{
2570 int i;
2571
2572 for (i = 0; i < countof(curves); i++)
2573 {
2574 if (curves[i].group == group)
2575 {
2576 return curves[i].curve;
2577 }
2578 }
2579 return 0;
2580}
9803fb82
PK		 2581
2582/**
2583 * See header.
2584 */
2585key_type_t tls_signature_scheme_to_key_type(tls_signature_scheme_t sig)
2586{
2587 int i;
2588
2589 for (i = 0; i < countof(schemes); i++)
2590 {
2591 if (schemes[i].sig == sig)
2592 {
2593 return key_type_from_signature_scheme(schemes[i].params.scheme);
2594 }
2595 }
2596 return 0;
2597}
2598
2599/**
2600 * Hashtable hash function
2601 */
2602static u_int hash_key_type(key_type_t *type)
2603{
2604 return chunk_hash(chunk_from_thing(*type));
2605}
2606
2607/**
2608 * Hashtable equals function
2609 */
2610static bool equals_key_type(key_type_t *key1, key_type_t *key2)
2611{
2612 return *key1 == *key2;
2613}
2614
2615CALLBACK(filter_key_types, bool,
2616 void *data, enumerator_t *orig, va_list args)
2617{
2618 key_type_t *key_type, *out;
2619
2620 VA_ARGS_VGET(args, out);
2621
2622 if (orig->enumerate(orig, NULL, &key_type))
2623 {
2624 *out = *key_type;
2625 return TRUE;
2626 }
2627 return FALSE;
2628}
2629
2630CALLBACK(destroy_key_types, void,
2631 hashtable_t *ht)
2632{
2633 ht->destroy_function(ht, (void*)free);
2634}
2635
d8e42a3d
PK		 2636/**
2637 * Create an enumerator over supported key types within a specific TLS range
9803fb82 2638 */
d8e42a3d 2639static enumerator_t *get_supported_key_types(tls_version_t min_version,
9803fb82
PK		 2640 tls_version_t max_version)
2641{
2642 hashtable_t *ht;
2643 key_type_t *type, lookup;
2644 int i;
2645
2646 ht = hashtable_create((hashtable_hash_t)hash_key_type,
2647 (hashtable_equals_t)equals_key_type, 4);
2648 for (i = 0; i < countof(schemes); i++)
2649 {
2650 if (schemes[i].min_version <= max_version &&
2651 schemes[i].max_version >= min_version)
2652 {
2653 lookup = key_type_from_signature_scheme(schemes[i].params.scheme);
2654 if (!ht->get(ht, &lookup))
2655 {
2656 type = malloc_thing(key_type_t);
2657 *type = lookup;
2658 ht->put(ht, type, type);
2659 }
2660 }
2661 }
2662 return enumerator_create_filter(ht->create_enumerator(ht),
2663 filter_key_types, ht, destroy_key_types);
2664}
d8e42a3d
PK		 2665
2666/**
2667 * Create an array of an intersection of server and peer supported key types
2668 */
2669static array_t *create_common_key_types(enumerator_t *enumerator, chunk_t hashsig)
2670{
2671 array_t *key_types;
2672 key_type_t v, lookup;
2673 uint16_t sig_scheme;
2674
2675 key_types = array_create(sizeof(key_type_t), 8);
2676 while (enumerator->enumerate(enumerator, &v))
2677 {
2678 bio_reader_t *reader;
2679
2680 reader = bio_reader_create(hashsig);
2681 while (reader->remaining(reader) &&
2682 reader->read_uint16(reader, &sig_scheme))
2683 {
2684 lookup = tls_signature_scheme_to_key_type(sig_scheme);
2685 if (v == lookup)
2686 {
2687 array_insert(key_types, ARRAY_TAIL, &lookup);
2688 break;
2689 }
2690 }
2691 reader->destroy(reader);
2692 }
2693 return key_types;
2694}
2695
2696typedef struct {
2697 enumerator_t public;
2698 array_t *key_types;
2699 identification_t *peer;
2700 private_key_t *key;
2701 auth_cfg_t *auth;
2702} private_key_enumerator_t;
2703
2704METHOD(enumerator_t, private_key_enumerate, bool,
2705 private_key_enumerator_t *this, va_list args)
2706{
2707 key_type_t type;
2708 auth_cfg_t **auth_out;
2709 private_key_t **key_out;
2710
2711 VA_ARGS_VGET(args, key_out, auth_out);
2712
2713 DESTROY_IF(this->key);
2714 DESTROY_IF(this->auth);
2715 this->auth = auth_cfg_create();
2716
2717 while (array_remove(this->key_types, ARRAY_HEAD, &type))
2718 {
2719 this->key = lib->credmgr->get_private(lib->credmgr, type, this->peer,
2720 this->auth);
2721 if (this->key)
2722 {
2723 *key_out = this->key;
2724 if (auth_out)
2725 {
2726 *auth_out = this->auth;
2727 }
2728 return TRUE;
2729 }
2730 }
2731 return FALSE;
2732}
2733
2734METHOD(enumerator_t, private_key_destroy, void,
2735 private_key_enumerator_t *this)
2736{
2737 DESTROY_IF(this->key);
2738 DESTROY_IF(this->auth);
2739 array_destroy(this->key_types);
2740 free(this);
2741}
2742
2743/**
2744 * See header.
2745 */
2746enumerator_t *tls_create_private_key_enumerator(tls_version_t min_version,
2747 tls_version_t max_version,
2748 chunk_t hashsig,
2749 identification_t *peer)
2750{
2751 private_key_enumerator_t *enumerator;
2752 enumerator_t *key_types;
2753
2754 key_types = get_supported_key_types(min_version, max_version);
2755
2756 INIT(enumerator,
2757 .public = {
2758 .enumerate = enumerator_enumerate_default,
2759 .venumerate = _private_key_enumerate,
2760 .destroy = _private_key_destroy,
2761 },
2762 .key_types = create_common_key_types(key_types, hashsig),
2763 .peer = peer,
2764 );
2765 key_types->destroy(key_types);
2766
2767 if (!array_count(enumerator->key_types))
2768 {
8384527f 2769 private_key_destroy(enumerator);
d8e42a3d
PK		 2770 return NULL;
2771 }
2772 return &enumerator->public;
2773}
Unnamed repository; edit this file 'description' to name the repository.