]> git.ipfire.org Git - thirdparty/strongswan.git/blob - src/libtls/tls_crypto.c
projects / thirdparty / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Build TLS cipher suite list in a generic fashion
[thirdparty/strongswan.git] / src / libtls / tls_crypto.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "tls_crypto.h"
17
18 #include <debug.h>
19
20 ENUM_BEGIN(tls_cipher_suite_names, TLS_NULL_WITH_NULL_NULL,
21 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
22 "TLS_NULL_WITH_NULL_NULL",
23 "TLS_RSA_WITH_NULL_MD5",
24 "TLS_RSA_WITH_NULL_SHA",
25 "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
26 "TLS_RSA_WITH_RC4_128_MD5",
27 "TLS_RSA_WITH_RC4_128_SHA",
28 "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
29 "TLS_RSA_WITH_IDEA_CBC_SHA",
30 "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
31 "TLS_RSA_WITH_DES_CBC_SHA",
32 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
33 "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
34 "TLS_DH_DSS_WITH_DES_CBC_SHA",
35 "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
36 "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
37 "TLS_DH_RSA_WITH_DES_CBC_SHA",
38 "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
39 "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
40 "TLS_DHE_DSS_WITH_DES_CBC_SHA",
41 "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
42 "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
43 "TLS_DHE_RSA_WITH_DES_CBC_SHA",
44 "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
45 "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
46 "TLS_DH_anon_WITH_RC4_128_MD5",
47 "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
48 "TLS_DH_anon_WITH_DES_CBC_SHA",
49 "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA");
50 ENUM_NEXT(tls_cipher_suite_names, TLS_KRB5_WITH_DES_CBC_SHA,
51 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
52 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
53 "TLS_KRB5_WITH_DES_CBC_SHA",
54 "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
55 "TLS_KRB5_WITH_RC4_128_SHA",
56 "TLS_KRB5_WITH_IDEA_CBC_SHA",
57 "TLS_KRB5_WITH_DES_CBC_MD5",
58 "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
59 "TLS_KRB5_WITH_RC4_128_MD5",
60 "TLS_KRB5_WITH_IDEA_CBC_MD5",
61 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
62 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
63 "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
64 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
65 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
66 "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
67 "TLS_PSK_WITH_NULL_SHA",
68 "TLS_DHE_PSK_WITH_NULL_SHA",
69 "TLS_RSA_PSK_WITH_NULL_SHA",
70 "TLS_RSA_WITH_AES_128_CBC_SHA",
71 "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
72 "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
73 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
74 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
75 "TLS_DH_anon_WITH_AES_128_CBC_SHA",
76 "TLS_RSA_WITH_AES_256_CBC_SHA",
77 "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
78 "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
79 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
80 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
81 "TLS_DH_anon_WITH_AES_256_CBC_SHA",
82 "TLS_RSA_WITH_NULL_SHA256",
83 "TLS_RSA_WITH_AES_128_CBC_SHA256 ",
84 "TLS_RSA_WITH_AES_256_CBC_SHA256",
85 "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
86 "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
87 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
88 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
89 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
90 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
91 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
92 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
93 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA");
94 ENUM_NEXT(tls_cipher_suite_names, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
95 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
96 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
97 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
98 "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
99 "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
100 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
101 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
102 "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
103 "TLS_DH_anon_WITH_AES_256_CBC_SHA256");
104 ENUM_NEXT(tls_cipher_suite_names, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
105 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
106 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
107 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
108 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
109 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
110 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
111 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
112 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
113 "TLS_PSK_WITH_RC4_128_SHA",
114 "TLS_PSK_WITH_3DES_EDE_CBC_SHA2",
115 "TLS_PSK_WITH_AES_128_CBC_SHA",
116 "TLS_PSK_WITH_AES_256_CBC_SHA",
117 "TLS_DHE_PSK_WITH_RC4_128_SHA",
118 "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
119 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
120 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA2",
121 "TLS_RSA_PSK_WITH_RC4_128_SHA",
122 "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
123 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
124 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
125 "TLS_RSA_WITH_SEED_CBC_SHA",
126 "TLS_DH_DSS_WITH_SEED_CBC_SHA",
127 "TLS_DH_RSA_WITH_SEED_CBC_SHA",
128 "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
129 "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
130 "TLS_DH_anon_WITH_SEED_CBC_SHA",
131 "TLS_RSA_WITH_AES_128_GCM_SHA256",
132 "TLS_RSA_WITH_AES_256_GCM_SHA384",
133 "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
134 "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
135 "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
136 "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
137 "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
138 "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
139 "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
140 "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
141 "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
142 "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
143 "TLS_PSK_WITH_AES_128_GCM_SHA256",
144 "TLS_PSK_WITH_AES_256_GCM_SHA384",
145 "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
146 "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
147 "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
148 "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
149 "TLS_PSK_WITH_AES_128_CBC_SHA256",
150 "TLS_PSK_WITH_AES_256_CBC_SHA384",
151 "TLS_PSK_WITH_NULL_SHA256",
152 "TLS_PSK_WITH_NULL_SHA384",
153 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
154 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
155 "TLS_DHE_PSK_WITH_NULL_SHA256",
156 "TLS_DHE_PSK_WITH_NULL_SHA384",
157 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
158 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
159 "TLS_RSA_PSK_WITH_NULL_SHA256",
160 "TLS_RSA_PSK_WITH_NULL_SHA384",
161 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
162 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
163 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
164 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
165 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
166 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
167 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
168 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
169 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
170 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
171 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
172 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256");
173 ENUM_NEXT(tls_cipher_suite_names, TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
174 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
175 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
176 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
177 ENUM_NEXT(tls_cipher_suite_names, TLS_ECDH_ECDSA_WITH_NULL_SHA,
178 TLS_ECDHE_PSK_WITH_NULL_SHA384,
179 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
180 "TLS_ECDH_ECDSA_WITH_NULL_SHA",
181 "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
182 "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
183 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
184 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
185 "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
186 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
187 "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
188 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
189 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
190 "TLS_ECDH_RSA_WITH_NULL_SHA",
191 "TLS_ECDH_RSA_WITH_RC4_128_SHA",
192 "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
193 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
194 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
195 "TLS_ECDHE_RSA_WITH_NULL_SHA",
196 "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
197 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
198 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
199 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
200 "TLS_ECDH_anon_WITH_NULL_SHA",
201 "TLS_ECDH_anon_WITH_RC4_128_SHA",
202 "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
203 "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
204 "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
205 "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
206 "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
207 "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
208 "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
209 "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
210 "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
211 "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
212 "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
213 "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
214 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
215 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
216 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
217 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
218 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
219 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
220 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
221 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
222 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
223 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
224 "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
225 "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
226 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
227 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
228 "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
229 "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
230 "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
231 "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
232 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
233 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
234 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
235 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
236 "TLS_ECDHE_PSK_WITH_NULL_SHA",
237 "TLS_ECDHE_PSK_WITH_NULL_SHA256",
238 "TLS_ECDHE_PSK_WITH_NULL_SHA384");
239 ENUM_END(tls_cipher_suite_names, TLS_ECDHE_PSK_WITH_NULL_SHA384);
240
241 typedef struct private_tls_crypto_t private_tls_crypto_t;
242
243 /**
244 * Private data of an tls_crypto_t object.
245 */
246 struct private_tls_crypto_t {
247
248 /**
249 * Public tls_crypto_t interface.
250 */
251 tls_crypto_t public;
252
253 /**
254 * Protection layer
255 */
256 tls_protection_t *protection;
257
258 /**
259 * List of supported/acceptable cipher suites
260 */
261 tls_cipher_suite_t *suites;
262
263 /**
264 * Number of supported suites
265 */
266 int suite_count;
267
268 /**
269 * Selected cipher suite
270 */
271 tls_cipher_suite_t suite;
272
273 /**
274 * TLS context
275 */
276 tls_t *tls;
277
278 /**
279 * All handshake data concatentated
280 */
281 chunk_t handshake;
282
283 /**
284 * Connection state TLS PRF
285 */
286 tls_prf_t *prf;
287
288 /**
289 * Signer instance for inbound traffic
290 */
291 signer_t *signer_in;
292
293 /**
294 * Signer instance for outbound traffic
295 */
296 signer_t *signer_out;
297
298 /**
299 * Crypter instance for inbound traffic
300 */
301 crypter_t *crypter_in;
302
303 /**
304 * Crypter instance for outbound traffic
305 */
306 crypter_t *crypter_out;
307
308 /**
309 * IV for input decryption, if < TLSv1.2
310 */
311 chunk_t iv_in;
312
313 /**
314 * IV for output decryption, if < TLSv1.2
315 */
316 chunk_t iv_out;
317
318 /**
319 * EAP-[T]TLS MSK
320 */
321 chunk_t msk;
322
323 /**
324 * ASCII string constant used as seed for EAP-[T]TLS MSK PRF
325 */
326 char *msk_label;
327 };
328
329 typedef struct {
330 tls_cipher_suite_t suite;
331 hash_algorithm_t hash;
332 pseudo_random_function_t prf;
333 integrity_algorithm_t mac;
334 encryption_algorithm_t encr;
335 size_t encr_size;
336 } suite_algs_t;
337
338 /**
339 * Mapping suites to a set of algorithms
340 */
341 static suite_algs_t suite_algs[] = {
342 { TLS_RSA_WITH_NULL_MD5,
343 HASH_MD5,
344 PRF_HMAC_MD5,
345 AUTH_HMAC_MD5_128,
346 ENCR_NULL, 0
347 },
348 { TLS_RSA_WITH_NULL_SHA,
349 HASH_SHA1,
350 PRF_HMAC_SHA1,
351 AUTH_HMAC_SHA1_160,
352 ENCR_NULL, 0
353 },
354 { TLS_RSA_WITH_NULL_SHA256,
355 HASH_SHA256,
356 PRF_HMAC_SHA2_256,
357 AUTH_HMAC_SHA2_256_256,
358 ENCR_NULL, 0
359 },
360 { TLS_RSA_WITH_AES_128_CBC_SHA,
361 HASH_SHA1,
362 PRF_HMAC_SHA1,
363 AUTH_HMAC_SHA1_160,
364 ENCR_AES_CBC, 16
365 },
366 { TLS_RSA_WITH_AES_256_CBC_SHA,
367 HASH_SHA1,
368 PRF_HMAC_SHA1,
369 AUTH_HMAC_SHA1_160,
370 ENCR_AES_CBC, 32
371 },
372 { TLS_RSA_WITH_3DES_EDE_CBC_SHA,
373 HASH_SHA1,
374 PRF_HMAC_SHA1,
375 AUTH_HMAC_SHA1_160,
376 ENCR_3DES, 0
377 },
378 { TLS_RSA_WITH_AES_128_CBC_SHA256,
379 HASH_SHA256,
380 PRF_HMAC_SHA2_256,
381 AUTH_HMAC_SHA2_256_256,
382 ENCR_AES_CBC, 16
383 },
384 };
385
386 /**
387 * Look up algoritms by a suite
388 */
389 static suite_algs_t *find_suite(tls_cipher_suite_t suite)
390 {
391 int i;
392
393 for (i = 0; i < countof(suite_algs); i++)
394 {
395 if (suite_algs[i].suite == suite)
396 {
397 return &suite_algs[i];
398 }
399 }
400 return NULL;
401 }
402
403 /**
404 * Filter a suite list using a transform enumerator
405 */
406 static void filter_suite(private_tls_crypto_t *this,
407 suite_algs_t suites[], int *count, int offset,
408 enumerator_t*(*create_enumerator)(crypto_factory_t*))
409 {
410 suite_algs_t current;
411 int i, remaining = 0;
412 enumerator_t *enumerator;
413
414 memset(&current, 0, sizeof(current));
415 for (i = 0; i < *count; i++)
416 {
417 enumerator = create_enumerator(lib->crypto);
418 while (enumerator->enumerate(enumerator, ((char*)&current) + offset))
419 {
420 if ((suites[i].encr == ENCR_NULL ||
421 !current.encr || current.encr == suites[i].encr) &&
422 (!current.mac || current.mac == suites[i].mac) &&
423 (!current.prf || current.prf == suites[i].prf) &&
424 (!current.hash || current.hash == suites[i].hash))
425 {
426 suites[remaining] = suites[i];
427 remaining++;
428 break;
429 }
430 }
431 enumerator->destroy(enumerator);
432 }
433 *count = remaining;
434 }
435
436 /**
437 * Initialize the cipher suite list
438 */
439 static void build_cipher_suite_list(private_tls_crypto_t *this)
440 {
441 suite_algs_t suites[countof(suite_algs)];
442 int count = countof(suite_algs), i;
443
444 /* copy all suites */
445 for (i = 0; i < count; i++)
446 {
447 suites[i] = suite_algs[i];
448 }
449 /* filter suite list by each algorithm */
450 filter_suite(this, suites, &count, offsetof(suite_algs_t, encr),
451 lib->crypto->create_crypter_enumerator);
452 filter_suite(this, suites, &count, offsetof(suite_algs_t, mac),
453 lib->crypto->create_signer_enumerator);
454 filter_suite(this, suites, &count, offsetof(suite_algs_t, prf),
455 lib->crypto->create_prf_enumerator);
456 filter_suite(this, suites, &count, offsetof(suite_algs_t, hash),
457 lib->crypto->create_hasher_enumerator);
458
459 DBG2(DBG_CFG, "%d supported TLS cipher suites:", count);
460 for (i = 0; i < count; i++)
461 {
462 DBG2(DBG_CFG, " %N", tls_cipher_suite_names, suites[i]);
463 }
464
465 free(this->suites);
466 this->suite_count = count;
467 this->suites = malloc(sizeof(tls_cipher_suite_t) * count);
468 memcpy(this->suites, suites, sizeof(tls_cipher_suite_t) * this->suite_count);
469 }
470
471 METHOD(tls_crypto_t, get_cipher_suites, int,
472 private_tls_crypto_t *this, tls_cipher_suite_t **suites)
473 {
474 *suites = this->suites;
475 return this->suite_count;
476 }
477
478 /**
479 * Create crypto primitives
480 */
481 static bool create_ciphers(private_tls_crypto_t *this, tls_cipher_suite_t suite)
482 {
483 suite_algs_t *algs;
484
485 algs = find_suite(suite);
486 if (!algs)
487 {
488 DBG1(DBG_IKE, "selected TLS suite not supported");
489 return FALSE;
490 }
491
492 DESTROY_IF(this->prf);
493 if (this->tls->get_version(this->tls) < TLS_1_2)
494 {
495 this->prf = tls_prf_create_10();
496 }
497 else
498 {
499 this->prf = tls_prf_create_12(algs->prf);
500 }
501 if (!this->prf)
502 {
503 DBG1(DBG_IKE, "selected TLS PRF not supported");
504 return FALSE;
505 }
506
507 DESTROY_IF(this->signer_in);
508 DESTROY_IF(this->signer_out);
509 this->signer_in = lib->crypto->create_signer(lib->crypto, algs->mac);
510 this->signer_out = lib->crypto->create_signer(lib->crypto, algs->mac);
511 if (!this->signer_in || !this->signer_out)
512 {
513 DBG1(DBG_IKE, "selected TLS MAC %N not supported",
514 integrity_algorithm_names, algs->mac);
515 return FALSE;
516 }
517
518 DESTROY_IF(this->crypter_in);
519 DESTROY_IF(this->crypter_out);
520 if (algs->encr == ENCR_NULL)
521 {
522 this->crypter_in = this->crypter_out = NULL;
523 }
524 else
525 {
526 this->crypter_in = lib->crypto->create_crypter(lib->crypto,
527 algs->encr, algs->encr_size);
528 this->crypter_out = lib->crypto->create_crypter(lib->crypto,
529 algs->encr, algs->encr_size);
530 if (!this->crypter_in || !this->crypter_out)
531 {
532 DBG1(DBG_IKE, "selected TLS crypter %N not supported",
533 encryption_algorithm_names, algs->encr);
534 return FALSE;
535 }
536 }
537 return TRUE;
538 }
539
540 METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
541 private_tls_crypto_t *this, tls_cipher_suite_t *suites, int count)
542 {
543 int i, j;
544
545 for (i = 0; i < this->suite_count; i++)
546 {
547 for (j = 0; j < count; j++)
548 {
549 if (this->suites[i] == suites[j])
550 {
551 if (create_ciphers(this, this->suites[i]))
552 {
553 this->suite = this->suites[i];
554 return this->suite;
555 }
556 }
557 }
558 }
559 return 0;
560 }
561
562 METHOD(tls_crypto_t, set_protection, void,
563 private_tls_crypto_t *this, tls_protection_t *protection)
564 {
565 this->protection = protection;
566 }
567
568 METHOD(tls_crypto_t, append_handshake, void,
569 private_tls_crypto_t *this, tls_handshake_type_t type, chunk_t data)
570 {
571 u_int32_t header;
572
573 /* reconstruct handshake header */
574 header = htonl(data.len | (type << 24));
575 this->handshake = chunk_cat("mcc", this->handshake,
576 chunk_from_thing(header), data);
577 }
578
579 /**
580 * Create a hash of the stored handshake data
581 */
582 static bool hash_handshake(private_tls_crypto_t *this, chunk_t *hash)
583 {
584 if (this->tls->get_version(this->tls) >= TLS_1_2)
585 {
586 hasher_t *hasher;
587 suite_algs_t *alg;
588
589 alg = find_suite(this->suite);
590 if (!alg)
591 {
592 return FALSE;
593 }
594 hasher = lib->crypto->create_hasher(lib->crypto, alg->hash);
595 if (!hasher)
596 {
597 DBG1(DBG_IKE, "%N not supported", hash_algorithm_names, alg->hash);
598 return FALSE;
599 }
600 hasher->allocate_hash(hasher, this->handshake, hash);
601 hasher->destroy(hasher);
602 }
603 else
604 {
605 hasher_t *md5, *sha1;
606 char buf[HASH_SIZE_MD5 + HASH_SIZE_SHA1];
607
608 md5 = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
609 if (!md5)
610 {
611 DBG1(DBG_IKE, "%N not supported", hash_algorithm_names, HASH_MD5);
612 return FALSE;
613 }
614 md5->get_hash(md5, this->handshake, buf);
615 md5->destroy(md5);
616 sha1 = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
617 if (!sha1)
618 {
619 DBG1(DBG_IKE, "%N not supported", hash_algorithm_names, HASH_SHA1);
620 return FALSE;
621 }
622 sha1->get_hash(sha1, this->handshake, buf + HASH_SIZE_MD5);
623 sha1->destroy(sha1);
624
625 *hash = chunk_clone(chunk_from_thing(buf));
626 }
627 return TRUE;
628 }
629
630 METHOD(tls_crypto_t, sign_handshake, bool,
631 private_tls_crypto_t *this, private_key_t *key, tls_writer_t *writer)
632 {
633 chunk_t sig, hash;
634
635 if (this->tls->get_version(this->tls) >= TLS_1_2)
636 {
637 /* TODO: use supported algorithms instead of fixed SHA1/RSA */
638 if (!key->sign(key, SIGN_RSA_EMSA_PKCS1_SHA1, this->handshake, &sig))
639 {
640 return FALSE;
641 }
642 writer->write_uint8(writer, 2);
643 writer->write_uint8(writer, 1);
644 writer->write_data16(writer, sig);
645 free(sig.ptr);
646 }
647 else
648 {
649 if (!hash_handshake(this, &hash))
650 {
651 return FALSE;
652 }
653 if (!key->sign(key, SIGN_RSA_EMSA_PKCS1_NULL, hash, &sig))
654 {
655 free(hash.ptr);
656 return FALSE;
657 }
658 writer->write_data16(writer, sig);
659 free(hash.ptr);
660 free(sig.ptr);
661 }
662 return TRUE;
663 }
664
665 METHOD(tls_crypto_t, verify_handshake, bool,
666 private_tls_crypto_t *this, public_key_t *key, tls_reader_t *reader)
667 {
668 if (this->tls->get_version(this->tls) >= TLS_1_2)
669 {
670 u_int8_t hash, alg;
671 chunk_t sig;
672
673 if (!reader->read_uint8(reader, &hash) ||
674 !reader->read_uint8(reader, &alg) ||
675 !reader->read_data16(reader, &sig))
676 {
677 DBG1(DBG_IKE, "received invalid Certificate Verify");
678 return FALSE;
679 }
680 /* TODO: map received hash/sig alg to signature scheme */
681 if (hash != 2 || alg != 1 ||
682 !key->verify(key, SIGN_RSA_EMSA_PKCS1_SHA1, this->handshake, sig))
683 {
684 return FALSE;
685 }
686 }
687 else
688 {
689 chunk_t sig, hash;
690
691 if (!reader->read_data16(reader, &sig))
692 {
693 DBG1(DBG_IKE, "received invalid Certificate Verify");
694 return FALSE;
695 }
696 if (!hash_handshake(this, &hash))
697 {
698 return FALSE;
699 }
700 if (!key->verify(key, SIGN_RSA_EMSA_PKCS1_NULL, hash, sig))
701 {
702 free(hash.ptr);
703 return FALSE;
704 }
705 free(hash.ptr);
706 }
707 return TRUE;
708 }
709
710 METHOD(tls_crypto_t, calculate_finished, bool,
711 private_tls_crypto_t *this, char *label, char out[12])
712 {
713 chunk_t seed;
714
715 if (!this->prf)
716 {
717 return FALSE;
718 }
719 if (!hash_handshake(this, &seed))
720 {
721 return FALSE;
722 }
723 this->prf->get_bytes(this->prf, label, seed, 12, out);
724 free(seed.ptr);
725 return TRUE;
726 }
727
728 METHOD(tls_crypto_t, derive_secrets, void,
729 private_tls_crypto_t *this, chunk_t premaster,
730 chunk_t client_random, chunk_t server_random)
731 {
732 char master[48];
733 chunk_t seed, block, client_write, server_write;
734 int mks, eks = 0, ivs = 0;
735
736 /* derive master secret */
737 seed = chunk_cata("cc", client_random, server_random);
738 this->prf->set_key(this->prf, premaster);
739 this->prf->get_bytes(this->prf, "master secret", seed,
740 sizeof(master), master);
741
742 this->prf->set_key(this->prf, chunk_from_thing(master));
743 memset(master, 0, sizeof(master));
744
745 /* derive key block for key expansion */
746 mks = this->signer_out->get_key_size(this->signer_out);
747 if (this->crypter_out)
748 {
749 eks = this->crypter_out->get_key_size(this->crypter_out);
750 if (this->tls->get_version(this->tls) < TLS_1_1)
751 {
752 ivs = this->crypter_out->get_iv_size(this->crypter_out);
753 }
754 }
755 seed = chunk_cata("cc", server_random, client_random);
756 block = chunk_alloca((mks + eks + ivs) * 2);
757 this->prf->get_bytes(this->prf, "key expansion", seed, block.len, block.ptr);
758
759 /* signer keys */
760 client_write = chunk_create(block.ptr, mks);
761 block = chunk_skip(block, mks);
762 server_write = chunk_create(block.ptr, mks);
763 block = chunk_skip(block, mks);
764 if (this->tls->is_server(this->tls))
765 {
766 this->signer_in->set_key(this->signer_in, client_write);
767 this->signer_out->set_key(this->signer_out, server_write);
768 }
769 else
770 {
771 this->signer_out->set_key(this->signer_out, client_write);
772 this->signer_in->set_key(this->signer_in, server_write);
773 }
774
775 /* crypter keys, and IVs if < TLSv1.2 */
776 if (this->crypter_out && this->crypter_in)
777 {
778 client_write = chunk_create(block.ptr, eks);
779 block = chunk_skip(block, eks);
780 server_write = chunk_create(block.ptr, eks);
781 block = chunk_skip(block, eks);
782
783 if (this->tls->is_server(this->tls))
784 {
785 this->crypter_in->set_key(this->crypter_in, client_write);
786 this->crypter_out->set_key(this->crypter_out, server_write);
787 }
788 else
789 {
790 this->crypter_out->set_key(this->crypter_out, client_write);
791 this->crypter_in->set_key(this->crypter_in, server_write);
792 }
793 if (ivs)
794 {
795 client_write = chunk_create(block.ptr, ivs);
796 block = chunk_skip(block, ivs);
797 server_write = chunk_create(block.ptr, ivs);
798 block = chunk_skip(block, ivs);
799
800 if (this->tls->is_server(this->tls))
801 {
802 this->iv_in = chunk_clone(client_write);
803 this->iv_out = chunk_clone(server_write);
804 }
805 else
806 {
807 this->iv_out = chunk_clone(client_write);
808 this->iv_in = chunk_clone(server_write);
809 }
810 }
811 }
812 }
813
814 METHOD(tls_crypto_t, change_cipher, void,
815 private_tls_crypto_t *this, bool inbound)
816 {
817 if (this->protection)
818 {
819 if (inbound)
820 {
821 this->protection->set_cipher(this->protection, TRUE,
822 this->signer_in, this->crypter_in, this->iv_in);
823 }
824 else
825 {
826 this->protection->set_cipher(this->protection, FALSE,
827 this->signer_out, this->crypter_out, this->iv_out);
828 }
829 }
830 }
831
832 METHOD(tls_crypto_t, derive_eap_msk, void,
833 private_tls_crypto_t *this, chunk_t client_random, chunk_t server_random)
834 {
835 chunk_t seed;
836
837 seed = chunk_cata("cc", client_random, server_random);
838 free(this->msk.ptr);
839 this->msk = chunk_alloc(64);
840 this->prf->get_bytes(this->prf, this->msk_label, seed,
841 this->msk.len, this->msk.ptr);
842 }
843
844 METHOD(tls_crypto_t, get_eap_msk, chunk_t,
845 private_tls_crypto_t *this)
846 {
847 return this->msk;
848 }
849
850 METHOD(tls_crypto_t, destroy, void,
851 private_tls_crypto_t *this)
852 {
853 DESTROY_IF(this->signer_in);
854 DESTROY_IF(this->signer_out);
855 DESTROY_IF(this->crypter_in);
856 DESTROY_IF(this->crypter_out);
857 free(this->iv_in.ptr);
858 free(this->iv_out.ptr);
859 free(this->handshake.ptr);
860 free(this->msk.ptr);
861 DESTROY_IF(this->prf);
862 free(this->suites);
863 free(this);
864 }
865
866 /**
867 * See header
868 */
869 tls_crypto_t *tls_crypto_create(tls_t *tls, char *msk_label)
870 {
871 private_tls_crypto_t *this;
872
873 INIT(this,
874 .public = {
875 .get_cipher_suites = _get_cipher_suites,
876 .select_cipher_suite = _select_cipher_suite,
877 .set_protection = _set_protection,
878 .append_handshake = _append_handshake,
879 .sign_handshake = _sign_handshake,
880 .verify_handshake = _verify_handshake,
881 .calculate_finished = _calculate_finished,
882 .derive_secrets = _derive_secrets,
883 .change_cipher = _change_cipher,
884 .derive_eap_msk = _derive_eap_msk,
885 .get_eap_msk = _get_eap_msk,
886 .destroy = _destroy,
887 },
888 .tls = tls,
889 .msk_label = msk_label
890 );
891
892 build_cipher_suite_list(this);
893
894 return &this->public;
895 }
Unnamed repository; edit this file 'description' to name the repository.