ssl/tls_srp.c

   1 /*
   2  * Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright (c) 2004, EdelKey Project. All Rights Reserved.
   4  *
   5  * Licensed under the Apache License 2.0 (the "License").  You may not use
   6  * this file except in compliance with the License.  You can obtain a copy
   7  * in the file LICENSE in the source distribution or at
   8  * https://www.openssl.org/source/license.html
   9  *
  10  * Originally written by Christophe Renou and Peter Sylvester,
  11  * for the EdelKey project.
  12  */
  13
  14 #include <openssl/crypto.h>
  15 #include <openssl/rand.h>
  16 #include <openssl/err.h>
  17 #include "ssl_local.h"
  18
  19 #ifndef OPENSSL_NO_SRP
  20 # include <openssl/srp.h>
  21
  22 int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
  23 {
  24     if (ctx == NULL)
  25         return 0;
  26     OPENSSL_free(ctx->srp_ctx.login);
  27     OPENSSL_free(ctx->srp_ctx.info);
  28     BN_free(ctx->srp_ctx.N);
  29     BN_free(ctx->srp_ctx.g);
  30     BN_free(ctx->srp_ctx.s);
  31     BN_free(ctx->srp_ctx.B);
  32     BN_free(ctx->srp_ctx.A);
  33     BN_free(ctx->srp_ctx.a);
  34     BN_free(ctx->srp_ctx.b);
  35     BN_free(ctx->srp_ctx.v);
  36     memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
  37     ctx->srp_ctx.strength = SRP_MINIMAL_N;
  38     return 1;
  39 }
  40
  41 int SSL_SRP_CTX_free(struct ssl_st *s)
  42 {
  43     if (s == NULL)
  44         return 0;
  45     OPENSSL_free(s->srp_ctx.login);
  46     OPENSSL_free(s->srp_ctx.info);
  47     BN_free(s->srp_ctx.N);
  48     BN_free(s->srp_ctx.g);
  49     BN_free(s->srp_ctx.s);
  50     BN_free(s->srp_ctx.B);
  51     BN_free(s->srp_ctx.A);
  52     BN_free(s->srp_ctx.a);
  53     BN_free(s->srp_ctx.b);
  54     BN_free(s->srp_ctx.v);
  55     memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
  56     s->srp_ctx.strength = SRP_MINIMAL_N;
  57     return 1;
  58 }
  59
  60 int SSL_SRP_CTX_init(struct ssl_st *s)
  61 {
  62     SSL_CTX *ctx;
  63
  64     if ((s == NULL) || ((ctx = s->ctx) == NULL))
  65         return 0;
  66
  67     memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
  68
  69     s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg;
  70     /* set client Hello login callback */
  71     s->srp_ctx.TLS_ext_srp_username_callback =
  72         ctx->srp_ctx.TLS_ext_srp_username_callback;
  73     /* set SRP N/g param callback for verification */
  74     s->srp_ctx.SRP_verify_param_callback =
  75         ctx->srp_ctx.SRP_verify_param_callback;
  76     /* set SRP client passwd callback */
  77     s->srp_ctx.SRP_give_srp_client_pwd_callback =
  78         ctx->srp_ctx.SRP_give_srp_client_pwd_callback;
  79
  80     s->srp_ctx.strength = ctx->srp_ctx.strength;
  81
  82     if (((ctx->srp_ctx.N != NULL) &&
  83          ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) ||
  84         ((ctx->srp_ctx.g != NULL) &&
  85          ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) ||
  86         ((ctx->srp_ctx.s != NULL) &&
  87          ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) ||
  88         ((ctx->srp_ctx.B != NULL) &&
  89          ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) ||
  90         ((ctx->srp_ctx.A != NULL) &&
  91          ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) ||
  92         ((ctx->srp_ctx.a != NULL) &&
  93          ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) ||
  94         ((ctx->srp_ctx.v != NULL) &&
  95          ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) ||
  96         ((ctx->srp_ctx.b != NULL) &&
  97          ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
  98         SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
  99         goto err;
 100     }
 101     if ((ctx->srp_ctx.login != NULL) &&
 102         ((s->srp_ctx.login = OPENSSL_strdup(ctx->srp_ctx.login)) == NULL)) {
 103         SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
 104         goto err;
 105     }
 106     if ((ctx->srp_ctx.info != NULL) &&
 107         ((s->srp_ctx.info = OPENSSL_strdup(ctx->srp_ctx.info)) == NULL)) {
 108         SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
 109         goto err;
 110     }
 111     s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;
 112
 113     return 1;
 114  err:
 115     OPENSSL_free(s->srp_ctx.login);
 116     OPENSSL_free(s->srp_ctx.info);
 117     BN_free(s->srp_ctx.N);
 118     BN_free(s->srp_ctx.g);
 119     BN_free(s->srp_ctx.s);
 120     BN_free(s->srp_ctx.B);
 121     BN_free(s->srp_ctx.A);
 122     BN_free(s->srp_ctx.a);
 123     BN_free(s->srp_ctx.b);
 124     BN_free(s->srp_ctx.v);
 125     memset(&s->srp_ctx, 0, sizeof(s->srp_ctx));
 126     return 0;
 127 }
 128
 129 int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
 130 {
 131     if (ctx == NULL)
 132         return 0;
 133
 134     memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx));
 135     ctx->srp_ctx.strength = SRP_MINIMAL_N;
 136
 137     return 1;
 138 }
 139
 140 /* server side */
 141 int SSL_srp_server_param_with_username(SSL *s, int *ad)
 142 {
 143     unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
 144     int al;
 145
 146     *ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
 147     if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) &&
 148         ((al =
 149           s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
 150                                                    s->srp_ctx.SRP_cb_arg)) !=
 151          SSL_ERROR_NONE))
 152         return al;
 153
 154     *ad = SSL_AD_INTERNAL_ERROR;
 155     if ((s->srp_ctx.N == NULL) ||
 156         (s->srp_ctx.g == NULL) ||
 157         (s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL))
 158         return SSL3_AL_FATAL;
 159
 160     if (RAND_priv_bytes_ex(s->ctx->libctx, b, sizeof(b)) <= 0)
 161         return SSL3_AL_FATAL;
 162     s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
 163     OPENSSL_cleanse(b, sizeof(b));
 164
 165     /* Calculate:  B = (kv + g^b) % N  */
 166
 167     return ((s->srp_ctx.B =
 168              SRP_Calc_B_ex(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
 169                            s->srp_ctx.v, s->ctx->libctx, s->ctx->propq)) !=
 170             NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
 171 }
 172
 173 /*
 174  * If the server just has the raw password, make up a verifier entry on the
 175  * fly
 176  */
 177 int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,
 178                                 const char *grp)
 179 {
 180     SRP_gN *GN = SRP_get_default_gN(grp);
 181     if (GN == NULL)
 182         return -1;
 183     s->srp_ctx.N = BN_dup(GN->N);
 184     s->srp_ctx.g = BN_dup(GN->g);
 185     BN_clear_free(s->srp_ctx.v);
 186     s->srp_ctx.v = NULL;
 187     BN_clear_free(s->srp_ctx.s);
 188     s->srp_ctx.s = NULL;
 189     if (!SRP_create_verifier_BN_ex(user, pass, &s->srp_ctx.s, &s->srp_ctx.v,
 190                                    GN->N, GN->g, s->ctx->libctx,
 191                                    s->ctx->propq))
 192         return -1;
 193
 194     return 1;
 195 }
 196
 197 int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
 198                              BIGNUM *sa, BIGNUM *v, char *info)
 199 {
 200     if (N != NULL) {
 201         if (s->srp_ctx.N != NULL) {
 202             if (!BN_copy(s->srp_ctx.N, N)) {
 203                 BN_free(s->srp_ctx.N);
 204                 s->srp_ctx.N = NULL;
 205             }
 206         } else
 207             s->srp_ctx.N = BN_dup(N);
 208     }
 209     if (g != NULL) {
 210         if (s->srp_ctx.g != NULL) {
 211             if (!BN_copy(s->srp_ctx.g, g)) {
 212                 BN_free(s->srp_ctx.g);
 213                 s->srp_ctx.g = NULL;
 214             }
 215         } else
 216             s->srp_ctx.g = BN_dup(g);
 217     }
 218     if (sa != NULL) {
 219         if (s->srp_ctx.s != NULL) {
 220             if (!BN_copy(s->srp_ctx.s, sa)) {
 221                 BN_free(s->srp_ctx.s);
 222                 s->srp_ctx.s = NULL;
 223             }
 224         } else
 225             s->srp_ctx.s = BN_dup(sa);
 226     }
 227     if (v != NULL) {
 228         if (s->srp_ctx.v != NULL) {
 229             if (!BN_copy(s->srp_ctx.v, v)) {
 230                 BN_free(s->srp_ctx.v);
 231                 s->srp_ctx.v = NULL;
 232             }
 233         } else
 234             s->srp_ctx.v = BN_dup(v);
 235     }
 236     if (info != NULL) {
 237         if (s->srp_ctx.info)
 238             OPENSSL_free(s->srp_ctx.info);
 239         if ((s->srp_ctx.info = OPENSSL_strdup(info)) == NULL)
 240             return -1;
 241     }
 242
 243     if (!(s->srp_ctx.N) ||
 244         !(s->srp_ctx.g) || !(s->srp_ctx.s) || !(s->srp_ctx.v))
 245         return -1;
 246
 247     return 1;
 248 }
 249
 250 int srp_generate_server_master_secret(SSL *s)
 251 {
 252     BIGNUM *K = NULL, *u = NULL;
 253     int ret = -1, tmp_len = 0;
 254     unsigned char *tmp = NULL;
 255
 256     if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
 257         goto err;
 258     if ((u = SRP_Calc_u_ex(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N,
 259                            s->ctx->libctx, s->ctx->propq)) == NULL)
 260         goto err;
 261     if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
 262                                  s->srp_ctx.N)) == NULL)
 263         goto err;
 264
 265     tmp_len = BN_num_bytes(K);
 266     if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
 267         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
 268                  SSL_F_SRP_GENERATE_SERVER_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
 269         goto err;
 270     }
 271     BN_bn2bin(K, tmp);
 272     /* Calls SSLfatal() as required */
 273     ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
 274  err:
 275     BN_clear_free(K);
 276     BN_clear_free(u);
 277     return ret;
 278 }
 279
 280 /* client side */
 281 int srp_generate_client_master_secret(SSL *s)
 282 {
 283     BIGNUM *x = NULL, *u = NULL, *K = NULL;
 284     int ret = -1, tmp_len = 0;
 285     char *passwd = NULL;
 286     unsigned char *tmp = NULL;
 287
 288     /*
 289      * Checks if b % n == 0
 290      */
 291     if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0
 292             || (u = SRP_Calc_u_ex(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N,
 293                                   s->ctx->libctx, s->ctx->propq))
 294                == NULL
 295             || s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) {
 296         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
 297                  SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
 298         goto err;
 299     }
 300     if ((passwd = s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
 301                                                       s->srp_ctx.SRP_cb_arg))
 302             == NULL) {
 303         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
 304                  SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET,
 305                  SSL_R_CALLBACK_FAILED);
 306         goto err;
 307     }
 308     if ((x = SRP_Calc_x_ex(s->srp_ctx.s, s->srp_ctx.login, passwd,
 309                            s->ctx->libctx, s->ctx->propq)) == NULL
 310             || (K = SRP_Calc_client_key_ex(s->srp_ctx.N, s->srp_ctx.B,
 311                                            s->srp_ctx.g, x,
 312                                            s->srp_ctx.a, u,
 313                                            s->ctx->libctx,
 314                                            s->ctx->propq)) == NULL) {
 315         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
 316                  SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_INTERNAL_ERROR);
 317         goto err;
 318     }
 319
 320     tmp_len = BN_num_bytes(K);
 321     if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) {
 322         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
 323                  SSL_F_SRP_GENERATE_CLIENT_MASTER_SECRET, ERR_R_MALLOC_FAILURE);
 324         goto err;
 325     }
 326     BN_bn2bin(K, tmp);
 327     /* Calls SSLfatal() as required */
 328     ret = ssl_generate_master_secret(s, tmp, tmp_len, 1);
 329  err:
 330     BN_clear_free(K);
 331     BN_clear_free(x);
 332     if (passwd != NULL)
 333         OPENSSL_clear_free(passwd, strlen(passwd));
 334     BN_clear_free(u);
 335     return ret;
 336 }
 337
 338 int srp_verify_server_param(SSL *s)
 339 {
 340     SRP_CTX *srp = &s->srp_ctx;
 341     /*
 342      * Sanity check parameters: we can quickly check B % N == 0 by checking B
 343      * != 0 since B < N
 344      */
 345     if (BN_ucmp(srp->g, srp->N) >= 0 || BN_ucmp(srp->B, srp->N) >= 0
 346         || BN_is_zero(srp->B)) {
 347         SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SRP_VERIFY_SERVER_PARAM,
 348                  SSL_R_BAD_DATA);
 349         return 0;
 350     }
 351
 352     if (BN_num_bits(srp->N) < srp->strength) {
 353         SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
 354                  SSL_R_INSUFFICIENT_SECURITY);
 355         return 0;
 356     }
 357
 358     if (srp->SRP_verify_param_callback) {
 359         if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) {
 360             SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY,
 361                      SSL_F_SRP_VERIFY_SERVER_PARAM,
 362                      SSL_R_CALLBACK_FAILED);
 363             return 0;
 364         }
 365     } else if (!SRP_check_known_gN_param(srp->g, srp->N)) {
 366         SSLfatal(s, SSL_AD_INSUFFICIENT_SECURITY, SSL_F_SRP_VERIFY_SERVER_PARAM,
 367                  SSL_R_INSUFFICIENT_SECURITY);
 368         return 0;
 369     }
 370
 371     return 1;
 372 }
 373
 374 int SRP_Calc_A_param(SSL *s)
 375 {
 376     unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
 377
 378     if (RAND_priv_bytes_ex(s->ctx->libctx, rnd, sizeof(rnd)) <= 0)
 379         return 0;
 380     s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
 381     OPENSSL_cleanse(rnd, sizeof(rnd));
 382
 383     if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g)))
 384         return 0;
 385
 386     return 1;
 387 }
 388
 389 BIGNUM *SSL_get_srp_g(SSL *s)
 390 {
 391     if (s->srp_ctx.g != NULL)
 392         return s->srp_ctx.g;
 393     return s->ctx->srp_ctx.g;
 394 }
 395
 396 BIGNUM *SSL_get_srp_N(SSL *s)
 397 {
 398     if (s->srp_ctx.N != NULL)
 399         return s->srp_ctx.N;
 400     return s->ctx->srp_ctx.N;
 401 }
 402
 403 char *SSL_get_srp_username(SSL *s)
 404 {
 405     if (s->srp_ctx.login != NULL)
 406         return s->srp_ctx.login;
 407     return s->ctx->srp_ctx.login;
 408 }
 409
 410 char *SSL_get_srp_userinfo(SSL *s)
 411 {
 412     if (s->srp_ctx.info != NULL)
 413         return s->srp_ctx.info;
 414     return s->ctx->srp_ctx.info;
 415 }
 416
 417 # define tls1_ctx_ctrl ssl3_ctx_ctrl
 418 # define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl
 419
 420 int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name)
 421 {
 422     return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
 423 }
 424
 425 int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password)
 426 {
 427     return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
 428 }
 429
 430 int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
 431 {
 432     return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
 433                          NULL);
 434 }
 435
 436 int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,
 437                                           int (*cb) (SSL *, void *))
 438 {
 439     return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
 440                                   (void (*)(void))cb);
 441 }
 442
 443 int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg)
 444 {
 445     return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
 446 }
 447
 448 int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
 449                                       int (*cb) (SSL *, int *, void *))
 450 {
 451     return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
 452                                   (void (*)(void))cb);
 453 }
 454
 455 int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,
 456                                         char *(*cb) (SSL *, void *))
 457 {
 458     return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
 459                                   (void (*)(void))cb);
 460 }
 461
 462 #endif