src/libtls/tls_crypto.c

   1 /*
   2  * Copyright (C) 2010 Martin Willi
   3  * Copyright (C) 2010 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tls_crypto.h"
  17
  18 #include <debug.h>
  19
  20 ENUM_BEGIN(tls_cipher_suite_names, TLS_NULL_WITH_NULL_NULL,
  21                                                                    TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
  22         "TLS_NULL_WITH_NULL_NULL",
  23         "TLS_RSA_WITH_NULL_MD5",
  24         "TLS_RSA_WITH_NULL_SHA",
  25         "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
  26         "TLS_RSA_WITH_RC4_128_MD5",
  27         "TLS_RSA_WITH_RC4_128_SHA",
  28         "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
  29         "TLS_RSA_WITH_IDEA_CBC_SHA",
  30         "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
  31         "TLS_RSA_WITH_DES_CBC_SHA",
  32         "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
  33         "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
  34         "TLS_DH_DSS_WITH_DES_CBC_SHA",
  35         "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
  36         "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
  37         "TLS_DH_RSA_WITH_DES_CBC_SHA",
  38         "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
  39         "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
  40         "TLS_DHE_DSS_WITH_DES_CBC_SHA",
  41         "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
  42         "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
  43         "TLS_DHE_RSA_WITH_DES_CBC_SHA",
  44         "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
  45         "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
  46         "TLS_DH_anon_WITH_RC4_128_MD5",
  47         "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
  48         "TLS_DH_anon_WITH_DES_CBC_SHA",
  49         "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA");
  50 ENUM_NEXT(tls_cipher_suite_names, TLS_KRB5_WITH_DES_CBC_SHA,
  51                                                                   TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
  52                                                                   TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
  53         "TLS_KRB5_WITH_DES_CBC_SHA",
  54         "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
  55         "TLS_KRB5_WITH_RC4_128_SHA",
  56         "TLS_KRB5_WITH_IDEA_CBC_SHA",
  57         "TLS_KRB5_WITH_DES_CBC_MD5",
  58         "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
  59         "TLS_KRB5_WITH_RC4_128_MD5",
  60         "TLS_KRB5_WITH_IDEA_CBC_MD5",
  61         "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
  62         "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
  63         "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
  64         "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
  65         "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
  66         "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
  67         "TLS_PSK_WITH_NULL_SHA",
  68         "TLS_DHE_PSK_WITH_NULL_SHA",
  69         "TLS_RSA_PSK_WITH_NULL_SHA",
  70         "TLS_RSA_WITH_AES_128_CBC_SHA",
  71         "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
  72         "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
  73         "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
  74         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
  75         "TLS_DH_anon_WITH_AES_128_CBC_SHA",
  76         "TLS_RSA_WITH_AES_256_CBC_SHA",
  77         "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
  78         "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
  79         "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
  80         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
  81         "TLS_DH_anon_WITH_AES_256_CBC_SHA",
  82         "TLS_RSA_WITH_NULL_SHA256",
  83         "TLS_RSA_WITH_AES_128_CBC_SHA256 ",
  84         "TLS_RSA_WITH_AES_256_CBC_SHA256",
  85         "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
  86         "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
  87         "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
  88         "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
  89         "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
  90         "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
  91         "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
  92         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
  93         "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA");
  94 ENUM_NEXT(tls_cipher_suite_names, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
  95                                                                   TLS_DH_anon_WITH_AES_256_CBC_SHA256,
  96                                                                   TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
  97         "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
  98         "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
  99         "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
 100         "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
 101         "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
 102         "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
 103         "TLS_DH_anon_WITH_AES_256_CBC_SHA256");
 104 ENUM_NEXT(tls_cipher_suite_names, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
 105                                                                   TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
 106                                                                   TLS_DH_anon_WITH_AES_256_CBC_SHA256,
 107         "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
 108         "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
 109         "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
 110         "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
 111         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
 112         "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
 113         "TLS_PSK_WITH_RC4_128_SHA",
 114         "TLS_PSK_WITH_3DES_EDE_CBC_SHA2",
 115         "TLS_PSK_WITH_AES_128_CBC_SHA",
 116         "TLS_PSK_WITH_AES_256_CBC_SHA",
 117         "TLS_DHE_PSK_WITH_RC4_128_SHA",
 118         "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
 119         "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
 120         "TLS_DHE_PSK_WITH_AES_256_CBC_SHA2",
 121         "TLS_RSA_PSK_WITH_RC4_128_SHA",
 122         "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
 123         "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
 124         "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
 125         "TLS_RSA_WITH_SEED_CBC_SHA",
 126         "TLS_DH_DSS_WITH_SEED_CBC_SHA",
 127         "TLS_DH_RSA_WITH_SEED_CBC_SHA",
 128         "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
 129         "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
 130         "TLS_DH_anon_WITH_SEED_CBC_SHA",
 131         "TLS_RSA_WITH_AES_128_GCM_SHA256",
 132         "TLS_RSA_WITH_AES_256_GCM_SHA384",
 133         "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
 134         "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
 135         "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
 136         "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
 137         "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
 138         "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
 139         "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
 140         "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
 141         "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
 142         "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
 143         "TLS_PSK_WITH_AES_128_GCM_SHA256",
 144         "TLS_PSK_WITH_AES_256_GCM_SHA384",
 145         "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
 146         "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
 147         "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
 148         "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
 149         "TLS_PSK_WITH_AES_128_CBC_SHA256",
 150         "TLS_PSK_WITH_AES_256_CBC_SHA384",
 151         "TLS_PSK_WITH_NULL_SHA256",
 152         "TLS_PSK_WITH_NULL_SHA384",
 153         "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
 154         "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
 155         "TLS_DHE_PSK_WITH_NULL_SHA256",
 156         "TLS_DHE_PSK_WITH_NULL_SHA384",
 157         "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
 158         "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
 159         "TLS_RSA_PSK_WITH_NULL_SHA256",
 160         "TLS_RSA_PSK_WITH_NULL_SHA384",
 161         "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
 162         "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
 163         "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
 164         "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
 165         "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
 166         "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
 167         "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
 168         "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
 169         "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
 170         "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
 171         "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
 172         "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256");
 173 ENUM_NEXT(tls_cipher_suite_names, TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
 174                                                                   TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
 175                                                                   TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
 176         "TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
 177 ENUM_NEXT(tls_cipher_suite_names, TLS_ECDH_ECDSA_WITH_NULL_SHA,
 178                                                                   TLS_ECDHE_PSK_WITH_NULL_SHA384,
 179                                                                   TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
 180         "TLS_ECDH_ECDSA_WITH_NULL_SHA",
 181         "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
 182         "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
 183         "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
 184         "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
 185         "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
 186         "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
 187         "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
 188         "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
 189         "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
 190         "TLS_ECDH_RSA_WITH_NULL_SHA",
 191         "TLS_ECDH_RSA_WITH_RC4_128_SHA",
 192         "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
 193         "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
 194         "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
 195         "TLS_ECDHE_RSA_WITH_NULL_SHA",
 196         "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
 197         "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
 198         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
 199         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
 200         "TLS_ECDH_anon_WITH_NULL_SHA",
 201         "TLS_ECDH_anon_WITH_RC4_128_SHA",
 202         "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
 203         "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
 204         "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
 205         "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
 206         "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
 207         "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
 208         "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
 209         "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
 210         "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
 211         "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
 212         "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
 213         "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
 214         "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
 215         "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
 216         "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
 217         "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
 218         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
 219         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
 220         "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
 221         "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
 222         "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 223         "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
 224         "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
 225         "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
 226         "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 227         "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
 228         "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
 229         "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
 230         "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
 231         "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
 232         "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
 233         "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
 234         "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
 235         "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
 236         "TLS_ECDHE_PSK_WITH_NULL_SHA",
 237         "TLS_ECDHE_PSK_WITH_NULL_SHA256",
 238         "TLS_ECDHE_PSK_WITH_NULL_SHA384");
 239 ENUM_END(tls_cipher_suite_names, TLS_ECDHE_PSK_WITH_NULL_SHA384);
 240
 241 typedef struct private_tls_crypto_t private_tls_crypto_t;
 242
 243 /**
 244  * Private data of an tls_crypto_t object.
 245  */
 246 struct private_tls_crypto_t {
 247
 248         /**
 249          * Public tls_crypto_t interface.
 250          */
 251         tls_crypto_t public;
 252
 253         /**
 254          * Protection layer
 255          */
 256         tls_protection_t *protection;
 257
 258         /**
 259          * List of supported/acceptable cipher suites
 260          */
 261         tls_cipher_suite_t *suites;
 262
 263         /**
 264          * Number of supported suites
 265          */
 266         int suite_count;
 267
 268         /**
 269          * Selected cipher suite
 270          */
 271         tls_cipher_suite_t suite;
 272
 273         /**
 274          * TLS context
 275          */
 276         tls_t *tls;
 277
 278         /**
 279          * All handshake data concatentated
 280          */
 281         chunk_t handshake;
 282
 283         /**
 284          * Connection state TLS PRF
 285          */
 286         tls_prf_t *prf;
 287
 288         /**
 289          * Signer instance for inbound traffic
 290          */
 291         signer_t *signer_in;
 292
 293         /**
 294          * Signer instance for outbound traffic
 295          */
 296         signer_t *signer_out;
 297
 298         /**
 299          * Crypter instance for inbound traffic
 300          */
 301         crypter_t *crypter_in;
 302
 303         /**
 304          * Crypter instance for outbound traffic
 305          */
 306         crypter_t *crypter_out;
 307
 308         /**
 309          * IV for input decryption, if < TLSv1.2
 310          */
 311         chunk_t iv_in;
 312
 313         /**
 314          * IV for output decryption, if < TLSv1.2
 315          */
 316         chunk_t iv_out;
 317
 318         /**
 319          * EAP-[T]TLS MSK
 320          */
 321         chunk_t msk;
 322
 323         /**
 324          * ASCII string constant used as seed for EAP-[T]TLS MSK PRF
 325          */
 326         char *msk_label;
 327 };
 328
 329 typedef struct {
 330         tls_cipher_suite_t suite;
 331         hash_algorithm_t hash;
 332         pseudo_random_function_t prf;
 333         integrity_algorithm_t mac;
 334         encryption_algorithm_t encr;
 335         size_t encr_size;
 336 } suite_algs_t;
 337
 338 /**
 339  * Mapping suites to a set of algorithms
 340  */
 341 static suite_algs_t suite_algs[] = {
 342         { TLS_RSA_WITH_NULL_MD5,
 343                 HASH_MD5, PRF_HMAC_MD5,
 344                 AUTH_HMAC_MD5_128, ENCR_NULL, 0
 345         },
 346         { TLS_RSA_WITH_NULL_SHA,
 347                 HASH_SHA1, PRF_HMAC_SHA1,
 348                 AUTH_HMAC_SHA1_160, ENCR_NULL, 0
 349         },
 350         { TLS_RSA_WITH_NULL_SHA256,
 351                 HASH_SHA256, PRF_HMAC_SHA2_256,
 352                 AUTH_HMAC_SHA2_256_256, ENCR_NULL, 0
 353         },
 354         { TLS_RSA_WITH_3DES_EDE_CBC_SHA,
 355                 HASH_SHA1, PRF_HMAC_SHA1,
 356                 AUTH_HMAC_SHA1_160, ENCR_3DES, 0
 357         },
 358         { TLS_RSA_WITH_AES_128_CBC_SHA,
 359                 HASH_SHA1, PRF_HMAC_SHA1,
 360                 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16
 361         },
 362         { TLS_RSA_WITH_AES_128_CBC_SHA256,
 363                 HASH_SHA256, PRF_HMAC_SHA2_256,
 364                 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16
 365         },
 366         { TLS_RSA_WITH_AES_256_CBC_SHA,
 367                 HASH_SHA1, PRF_HMAC_SHA1,
 368                 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32
 369         },
 370         { TLS_RSA_WITH_AES_256_CBC_SHA256,
 371                 HASH_SHA256, PRF_HMAC_SHA2_256,
 372                 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32
 373         },
 374         { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
 375                 HASH_SHA1, PRF_HMAC_SHA1,
 376                 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16
 377         },
 378         { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
 379                 HASH_SHA256, PRF_HMAC_SHA2_256,
 380                 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16
 381         },
 382         { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
 383                 HASH_SHA1, PRF_HMAC_SHA1,
 384                 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32
 385         },
 386         { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
 387                 HASH_SHA256, PRF_HMAC_SHA2_256,
 388                 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32
 389         },
 390 };
 391
 392 /**
 393  * Look up algoritms by a suite
 394  */
 395 static suite_algs_t *find_suite(tls_cipher_suite_t suite)
 396 {
 397         int i;
 398
 399         for (i = 0; i < countof(suite_algs); i++)
 400         {
 401                 if (suite_algs[i].suite == suite)
 402                 {
 403                         return &suite_algs[i];
 404                 }
 405         }
 406         return NULL;
 407 }
 408
 409 /**
 410  * Filter a suite list using a transform enumerator
 411  */
 412 static void filter_suite(private_tls_crypto_t *this,
 413                                                  suite_algs_t suites[], int *count, int offset,
 414                                                  enumerator_t*(*create_enumerator)(crypto_factory_t*))
 415 {
 416         suite_algs_t current;
 417         int i, remaining = 0;
 418         enumerator_t *enumerator;
 419
 420         memset(&current, 0, sizeof(current));
 421         for (i = 0; i < *count; i++)
 422         {
 423                 enumerator = create_enumerator(lib->crypto);
 424                 while (enumerator->enumerate(enumerator, ((char*)&current) + offset))
 425                 {
 426                         if ((suites[i].encr == ENCR_NULL ||
 427                                  !current.encr || current.encr == suites[i].encr) &&
 428                                 (!current.mac  || current.mac  == suites[i].mac) &&
 429                                 (!current.prf  || current.prf  == suites[i].prf) &&
 430                                 (!current.hash || current.hash == suites[i].hash))
 431                         {
 432                                 suites[remaining] = suites[i];
 433                                 remaining++;
 434                                 break;
 435                         }
 436                 }
 437                 enumerator->destroy(enumerator);
 438         }
 439         *count = remaining;
 440 }
 441
 442 /**
 443  * Purge NULL encryption cipher suites from list
 444  */
 445 static void filter_null_suites(private_tls_crypto_t *this,
 446                                                            suite_algs_t suites[], int *count)
 447 {
 448         int i, remaining = 0;
 449
 450         for (i = 0; i < *count; i++)
 451         {
 452                 if (suites[i].encr != ENCR_NULL)
 453                 {
 454                         suites[remaining] = suites[i];
 455                         remaining++;
 456                 }
 457         }
 458         *count = remaining;
 459 }
 460
 461 /**
 462  * Initialize the cipher suite list
 463  */
 464 static void build_cipher_suite_list(private_tls_crypto_t *this,
 465                                                                         bool require_encryption)
 466 {
 467         suite_algs_t suites[countof(suite_algs)];
 468         int count = countof(suite_algs), i;
 469
 470         /* copy all suites */
 471         for (i = 0; i < count; i++)
 472         {
 473                 suites[i] = suite_algs[i];
 474         }
 475         if (require_encryption)
 476         {
 477                 filter_null_suites(this, suites, &count);
 478         }
 479         /* filter suite list by each algorithm */
 480         filter_suite(this, suites, &count, offsetof(suite_algs_t, encr),
 481                                  lib->crypto->create_crypter_enumerator);
 482         filter_suite(this, suites, &count, offsetof(suite_algs_t, mac),
 483                                  lib->crypto->create_signer_enumerator);
 484         filter_suite(this, suites, &count, offsetof(suite_algs_t, prf),
 485                                  lib->crypto->create_prf_enumerator);
 486         filter_suite(this, suites, &count, offsetof(suite_algs_t, hash),
 487                                  lib->crypto->create_hasher_enumerator);
 488
 489         free(this->suites);
 490         this->suite_count = count;
 491         this->suites = malloc(sizeof(tls_cipher_suite_t) * count);
 492
 493         DBG2(DBG_TLS, "%d supported TLS cipher suites:", count);
 494         for (i = 0; i < count; i++)
 495         {
 496                 DBG2(DBG_TLS, "  %N", tls_cipher_suite_names, suites[i].suite);
 497                 this->suites[i] = suites[i].suite;
 498         }
 499 }
 500
 501 METHOD(tls_crypto_t, get_cipher_suites, int,
 502         private_tls_crypto_t *this, tls_cipher_suite_t **suites)
 503 {
 504         *suites = this->suites;
 505         return this->suite_count;
 506 }
 507
 508 /**
 509  * Create crypto primitives
 510  */
 511 static bool create_ciphers(private_tls_crypto_t *this, tls_cipher_suite_t suite)
 512 {
 513         suite_algs_t *algs;
 514
 515         algs = find_suite(suite);
 516         if (!algs)
 517         {
 518                 DBG1(DBG_TLS, "selected TLS suite not supported");
 519                 return FALSE;
 520         }
 521
 522         DESTROY_IF(this->prf);
 523         if (this->tls->get_version(this->tls) < TLS_1_2)
 524         {
 525                 this->prf = tls_prf_create_10();
 526         }
 527         else
 528         {
 529                 this->prf = tls_prf_create_12(algs->prf);
 530         }
 531         if (!this->prf)
 532         {
 533                 DBG1(DBG_TLS, "selected TLS PRF not supported");
 534                 return FALSE;
 535         }
 536
 537         DESTROY_IF(this->signer_in);
 538         DESTROY_IF(this->signer_out);
 539         this->signer_in = lib->crypto->create_signer(lib->crypto, algs->mac);
 540         this->signer_out = lib->crypto->create_signer(lib->crypto, algs->mac);
 541         if (!this->signer_in || !this->signer_out)
 542         {
 543                 DBG1(DBG_TLS, "selected TLS MAC %N not supported",
 544                          integrity_algorithm_names, algs->mac);
 545                 return FALSE;
 546         }
 547
 548         DESTROY_IF(this->crypter_in);
 549         DESTROY_IF(this->crypter_out);
 550         if (algs->encr == ENCR_NULL)
 551         {
 552                 this->crypter_in = this->crypter_out = NULL;
 553         }
 554         else
 555         {
 556                 this->crypter_in = lib->crypto->create_crypter(lib->crypto,
 557                                                                                                 algs->encr, algs->encr_size);
 558                 this->crypter_out = lib->crypto->create_crypter(lib->crypto,
 559                                                                                                 algs->encr, algs->encr_size);
 560                 if (!this->crypter_in || !this->crypter_out)
 561                 {
 562                         DBG1(DBG_TLS, "selected TLS crypter %N not supported",
 563                                  encryption_algorithm_names, algs->encr);
 564                         return FALSE;
 565                 }
 566         }
 567         return TRUE;
 568 }
 569
 570 METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
 571         private_tls_crypto_t *this, tls_cipher_suite_t *suites, int count)
 572 {
 573         int i, j;
 574
 575         for (i = 0; i < this->suite_count; i++)
 576         {
 577                 for (j = 0; j < count; j++)
 578                 {
 579                         if (this->suites[i] == suites[j])
 580                         {
 581                                 if (create_ciphers(this, this->suites[i]))
 582                                 {
 583                                         this->suite = this->suites[i];
 584                                         return this->suite;
 585                                 }
 586                         }
 587                 }
 588         }
 589         return 0;
 590 }
 591
 592 METHOD(tls_crypto_t, set_protection, void,
 593         private_tls_crypto_t *this, tls_protection_t *protection)
 594 {
 595         this->protection = protection;
 596 }
 597
 598 METHOD(tls_crypto_t, append_handshake, void,
 599         private_tls_crypto_t *this, tls_handshake_type_t type, chunk_t data)
 600 {
 601         u_int32_t header;
 602
 603         /* reconstruct handshake header */
 604         header = htonl(data.len | (type << 24));
 605         this->handshake = chunk_cat("mcc", this->handshake,
 606                                                                 chunk_from_thing(header), data);
 607 }
 608
 609 /**
 610  * Create a hash of the stored handshake data
 611  */
 612 static bool hash_handshake(private_tls_crypto_t *this, chunk_t *hash)
 613 {
 614         if (this->tls->get_version(this->tls) >= TLS_1_2)
 615         {
 616                 hasher_t *hasher;
 617                 suite_algs_t *alg;
 618
 619                 alg = find_suite(this->suite);
 620                 if (!alg)
 621                 {
 622                         return FALSE;
 623                 }
 624                 hasher = lib->crypto->create_hasher(lib->crypto, alg->hash);
 625                 if (!hasher)
 626                 {
 627                         DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, alg->hash);
 628                         return FALSE;
 629                 }
 630                 hasher->allocate_hash(hasher, this->handshake, hash);
 631                 hasher->destroy(hasher);
 632         }
 633         else
 634         {
 635                 hasher_t *md5, *sha1;
 636                 char buf[HASH_SIZE_MD5 + HASH_SIZE_SHA1];
 637
 638                 md5 = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
 639                 if (!md5)
 640                 {
 641                         DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, HASH_MD5);
 642                         return FALSE;
 643                 }
 644                 md5->get_hash(md5, this->handshake, buf);
 645                 md5->destroy(md5);
 646                 sha1 = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
 647                 if (!sha1)
 648                 {
 649                         DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, HASH_SHA1);
 650                         return FALSE;
 651                 }
 652                 sha1->get_hash(sha1, this->handshake, buf + HASH_SIZE_MD5);
 653                 sha1->destroy(sha1);
 654
 655                 *hash = chunk_clone(chunk_from_thing(buf));
 656         }
 657         return TRUE;
 658 }
 659
 660 METHOD(tls_crypto_t, sign_handshake, bool,
 661         private_tls_crypto_t *this, private_key_t *key, tls_writer_t *writer)
 662 {
 663         chunk_t sig, hash;
 664
 665         if (this->tls->get_version(this->tls) >= TLS_1_2)
 666         {
 667                 /* TODO: use supported algorithms instead of fixed SHA1/RSA */
 668                 if (!key->sign(key, SIGN_RSA_EMSA_PKCS1_SHA1, this->handshake, &sig))
 669                 {
 670                         return FALSE;
 671                 }
 672                 writer->write_uint8(writer, 2);
 673                 writer->write_uint8(writer, 1);
 674                 writer->write_data16(writer, sig);
 675                 free(sig.ptr);
 676         }
 677         else
 678         {
 679                 if (!hash_handshake(this, &hash))
 680                 {
 681                         return FALSE;
 682                 }
 683                 if (!key->sign(key, SIGN_RSA_EMSA_PKCS1_NULL, hash, &sig))
 684                 {
 685                         free(hash.ptr);
 686                         return FALSE;
 687                 }
 688                 writer->write_data16(writer, sig);
 689                 free(hash.ptr);
 690                 free(sig.ptr);
 691         }
 692         return TRUE;
 693 }
 694
 695 METHOD(tls_crypto_t, verify_handshake, bool,
 696         private_tls_crypto_t *this, public_key_t *key, tls_reader_t *reader)
 697 {
 698         if (this->tls->get_version(this->tls) >= TLS_1_2)
 699         {
 700                 u_int8_t hash, alg;
 701                 chunk_t sig;
 702
 703                 if (!reader->read_uint8(reader, &hash) ||
 704                         !reader->read_uint8(reader, &alg) ||
 705                         !reader->read_data16(reader, &sig))
 706                 {
 707                         DBG1(DBG_TLS, "received invalid Certificate Verify");
 708                         return FALSE;
 709                 }
 710                 /* TODO: map received hash/sig alg to signature scheme */
 711                 if (hash != 2 || alg != 1 ||
 712                         !key->verify(key, SIGN_RSA_EMSA_PKCS1_SHA1, this->handshake, sig))
 713                 {
 714                         return FALSE;
 715                 }
 716         }
 717         else
 718         {
 719                 chunk_t sig, hash;
 720
 721                 if (!reader->read_data16(reader, &sig))
 722                 {
 723                         DBG1(DBG_TLS, "received invalid Certificate Verify");
 724                         return FALSE;
 725                 }
 726                 if (!hash_handshake(this, &hash))
 727                 {
 728                         return FALSE;
 729                 }
 730                 if (!key->verify(key, SIGN_RSA_EMSA_PKCS1_NULL, hash, sig))
 731                 {
 732                         free(hash.ptr);
 733                         return FALSE;
 734                 }
 735                 free(hash.ptr);
 736         }
 737         return TRUE;
 738 }
 739
 740 METHOD(tls_crypto_t, calculate_finished, bool,
 741         private_tls_crypto_t *this, char *label, char out[12])
 742 {
 743         chunk_t seed;
 744
 745         if (!this->prf)
 746         {
 747                 return FALSE;
 748         }
 749         if (!hash_handshake(this, &seed))
 750         {
 751                 return FALSE;
 752         }
 753         this->prf->get_bytes(this->prf, label, seed, 12, out);
 754         free(seed.ptr);
 755         return TRUE;
 756 }
 757
 758 METHOD(tls_crypto_t, derive_secrets, void,
 759         private_tls_crypto_t *this, chunk_t premaster,
 760         chunk_t client_random, chunk_t server_random)
 761 {
 762         char master[48];
 763         chunk_t seed, block, client_write, server_write;
 764         int mks, eks = 0, ivs = 0;
 765
 766         /* derive master secret */
 767         seed = chunk_cata("cc", client_random, server_random);
 768         this->prf->set_key(this->prf, premaster);
 769         this->prf->get_bytes(this->prf, "master secret", seed,
 770                                                  sizeof(master), master);
 771
 772         this->prf->set_key(this->prf, chunk_from_thing(master));
 773         memset(master, 0, sizeof(master));
 774
 775         /* derive key block for key expansion */
 776         mks = this->signer_out->get_key_size(this->signer_out);
 777         if (this->crypter_out)
 778         {
 779                 eks = this->crypter_out->get_key_size(this->crypter_out);
 780                 if (this->tls->get_version(this->tls) < TLS_1_1)
 781                 {
 782                         ivs = this->crypter_out->get_iv_size(this->crypter_out);
 783                 }
 784         }
 785         seed = chunk_cata("cc", server_random, client_random);
 786         block = chunk_alloca((mks + eks + ivs) * 2);
 787         this->prf->get_bytes(this->prf, "key expansion", seed, block.len, block.ptr);
 788
 789         /* signer keys */
 790         client_write = chunk_create(block.ptr, mks);
 791         block = chunk_skip(block, mks);
 792         server_write = chunk_create(block.ptr, mks);
 793         block = chunk_skip(block, mks);
 794         if (this->tls->is_server(this->tls))
 795         {
 796                 this->signer_in->set_key(this->signer_in, client_write);
 797                 this->signer_out->set_key(this->signer_out, server_write);
 798         }
 799         else
 800         {
 801                 this->signer_out->set_key(this->signer_out, client_write);
 802                 this->signer_in->set_key(this->signer_in, server_write);
 803         }
 804
 805         /* crypter keys, and IVs if < TLSv1.2 */
 806         if (this->crypter_out && this->crypter_in)
 807         {
 808                 client_write = chunk_create(block.ptr, eks);
 809                 block = chunk_skip(block, eks);
 810                 server_write = chunk_create(block.ptr, eks);
 811                 block = chunk_skip(block, eks);
 812
 813                 if (this->tls->is_server(this->tls))
 814                 {
 815                         this->crypter_in->set_key(this->crypter_in, client_write);
 816                         this->crypter_out->set_key(this->crypter_out, server_write);
 817                 }
 818                 else
 819                 {
 820                         this->crypter_out->set_key(this->crypter_out, client_write);
 821                         this->crypter_in->set_key(this->crypter_in, server_write);
 822                 }
 823                 if (ivs)
 824                 {
 825                         client_write = chunk_create(block.ptr, ivs);
 826                         block = chunk_skip(block, ivs);
 827                         server_write = chunk_create(block.ptr, ivs);
 828                         block = chunk_skip(block, ivs);
 829
 830                         if (this->tls->is_server(this->tls))
 831                         {
 832                                 this->iv_in = chunk_clone(client_write);
 833                                 this->iv_out = chunk_clone(server_write);
 834                         }
 835                         else
 836                         {
 837                                 this->iv_out = chunk_clone(client_write);
 838                                 this->iv_in = chunk_clone(server_write);
 839                         }
 840                 }
 841         }
 842 }
 843
 844 METHOD(tls_crypto_t, change_cipher, void,
 845         private_tls_crypto_t *this, bool inbound)
 846 {
 847         if (this->protection)
 848         {
 849                 if (inbound)
 850                 {
 851                         this->protection->set_cipher(this->protection, TRUE,
 852                                                         this->signer_in, this->crypter_in, this->iv_in);
 853                 }
 854                 else
 855                 {
 856                         this->protection->set_cipher(this->protection, FALSE,
 857                                                         this->signer_out, this->crypter_out, this->iv_out);
 858                 }
 859         }
 860 }
 861
 862 METHOD(tls_crypto_t, derive_eap_msk, void,
 863         private_tls_crypto_t *this, chunk_t client_random, chunk_t server_random)
 864 {
 865         if (this->msk_label)
 866         {
 867                 chunk_t seed;
 868
 869                 seed = chunk_cata("cc", client_random, server_random);
 870                 free(this->msk.ptr);
 871                 this->msk = chunk_alloc(64);
 872                 this->prf->get_bytes(this->prf, this->msk_label, seed,
 873                                                          this->msk.len, this->msk.ptr);
 874         }
 875 }
 876
 877 METHOD(tls_crypto_t, get_eap_msk, chunk_t,
 878         private_tls_crypto_t *this)
 879 {
 880         return this->msk;
 881 }
 882
 883 METHOD(tls_crypto_t, destroy, void,
 884         private_tls_crypto_t *this)
 885 {
 886         DESTROY_IF(this->signer_in);
 887         DESTROY_IF(this->signer_out);
 888         DESTROY_IF(this->crypter_in);
 889         DESTROY_IF(this->crypter_out);
 890         free(this->iv_in.ptr);
 891         free(this->iv_out.ptr);
 892         free(this->handshake.ptr);
 893         free(this->msk.ptr);
 894         DESTROY_IF(this->prf);
 895         free(this->suites);
 896         free(this);
 897 }
 898
 899 /**
 900  * See header
 901  */
 902 tls_crypto_t *tls_crypto_create(tls_t *tls)
 903 {
 904         private_tls_crypto_t *this;
 905
 906         INIT(this,
 907                 .public = {
 908                         .get_cipher_suites = _get_cipher_suites,
 909                         .select_cipher_suite = _select_cipher_suite,
 910                         .set_protection = _set_protection,
 911                         .append_handshake = _append_handshake,
 912                         .sign_handshake = _sign_handshake,
 913                         .verify_handshake = _verify_handshake,
 914                         .calculate_finished = _calculate_finished,
 915                         .derive_secrets = _derive_secrets,
 916                         .change_cipher = _change_cipher,
 917                         .derive_eap_msk = _derive_eap_msk,
 918                         .get_eap_msk = _get_eap_msk,
 919                         .destroy = _destroy,
 920                 },
 921                 .tls = tls,
 922         );
 923
 924         switch (tls->get_purpose(tls))
 925         {
 926                 case TLS_PURPOSE_EAP_TLS:
 927                         /* MSK PRF ASCII constant label according to EAP-TLS RFC 5216 */
 928                         this->msk_label = "client EAP encryption";
 929                         build_cipher_suite_list(this, FALSE);
 930                         break;
 931                 case TLS_PURPOSE_EAP_TTLS:
 932                         /* MSK PRF ASCII constant label according to EAP-TTLS RFC 5281 */
 933                         this->msk_label = "ttls keying material";
 934                         build_cipher_suite_list(this, TRUE);
 935                         break;
 936                 case TLS_PURPOSE_GENERIC:
 937                         build_cipher_suite_list(this, TRUE);
 938                         break;
 939         }
 940         return &this->public;
 941 }