path: root/lib/kx.c

/*
 * Copyright (C) 2000-2012 Free Software Foundation, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* This file contains functions which are wrappers for the key exchange
 * part of TLS. They are called by the handshake functions (gnutls_handshake)
 */

#include "gnutls_int.h"
#include "handshake.h"
#include "kx.h"
#include "dh.h"
#include "errors.h"
#include "algorithms.h"
#include "debug.h"
#include "locks.h"
#include "mpi.h"
#include <state.h>
#include <datum.h>
#include <mbuffers.h>

/* This file contains important thing for the TLS handshake procedure.
 */

#define MASTER_SECRET "master secret"
#define MASTER_SECRET_SIZE (sizeof(MASTER_SECRET)-1)

#define EXT_MASTER_SECRET "extended master secret"
#define EXT_MASTER_SECRET_SIZE (sizeof(EXT_MASTER_SECRET)-1)

GNUTLS_STATIC_MUTEX(keylog_mutex);
static FILE *keylog;

static int generate_normal_master(gnutls_session_t session,
				  gnutls_datum_t *, int);

int _gnutls_generate_master(gnutls_session_t session, int keep_premaster)
{
	if (!session->internals.resumed)
		return generate_normal_master(session, &session->key.key,
					      keep_premaster);
	else if (session->internals.premaster_set) {
		gnutls_datum_t premaster;
		premaster.size =
		    sizeof(session->internals.resumed_security_parameters.
			   master_secret);
		premaster.data =
		    session->internals.resumed_security_parameters.
		    master_secret;
		return generate_normal_master(session, &premaster, 1);
	}
	return 0;
}

/**
 * gnutls_session_get_keylog_function:
 * @session: is #gnutls_session_t type
 *
 * This function will return the callback function set using
 * gnutls_session_set_keylog_function().
 *
 * Returns: The function set or %NULL otherwise.
 *
 * Since: 3.6.13
 */
gnutls_keylog_func
gnutls_session_get_keylog_function(const gnutls_session_t session)
{
	return session->internals.keylog_func;
}

/**
 * gnutls_session_set_keylog_function:
 * @session: is #gnutls_session_t type
 * @func: is the function to be called
 *
 * This function will set a callback to be called when a new secret is
 * derived and installed during handshake.
 *
 * Since: 3.6.13
 */
void
gnutls_session_set_keylog_function(gnutls_session_t session,
				   gnutls_keylog_func func)
{
	session->internals.keylog_func = func;
}

int
_gnutls_call_keylog_func(gnutls_session_t session,
			 const char *label,
			 const uint8_t *data,
			 unsigned size)
{
	if (session->internals.keylog_func) {
		gnutls_datum_t secret = {(void*)data, size};
		return session->internals.keylog_func(session, label, &secret);
	}
	return 0;
}

int
_gnutls_nss_keylog_func(gnutls_session_t session,
			const char *label,
			const gnutls_datum_t *secret)
{
	/* ignore subsequent traffic secrets that are calculated from
	 * the previous traffic secret
	 */
	if (!session->internals.handshake_in_progress)
		return 0;

	_gnutls_nss_keylog_write(session, label, secret->data, secret->size);
	return 0;
}

/* GCC analyzer doesn't like static FILE pointer */
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wanalyzer-file-leak"

GNUTLS_ONCE(keylog_once);

static void
keylog_once_init(void)
{
	const char *keylogfile;

	keylogfile = secure_getenv("SSLKEYLOGFILE");
	if (keylogfile != NULL && *keylogfile != '\0') {
		keylog = fopen(keylogfile, "ae");
		_gnutls_debug_log("unable to open keylog file %s\n",
				  keylogfile);
	}
}

void _gnutls_nss_keylog_write(gnutls_session_t session,
			      const char *label,
			      const uint8_t *secret, size_t secret_size)
{
	(void)gnutls_once(&keylog_once, keylog_once_init);

	if (keylog) {
		char client_random_hex[2*GNUTLS_RANDOM_SIZE+1];
		char secret_hex[2*MAX_HASH_SIZE+1];

		if (gnutls_static_mutex_lock(&keylog_mutex) < 0) {
			return;
		}
		fprintf(keylog, "%s %s %s\n",
			label,
			_gnutls_bin2hex(session->security_parameters.
					client_random, GNUTLS_RANDOM_SIZE,
					client_random_hex,
					sizeof(client_random_hex), NULL),
			_gnutls_bin2hex(secret, secret_size,
					secret_hex, sizeof(secret_hex), NULL));
		fflush(keylog);
		(void)gnutls_static_mutex_unlock(&keylog_mutex);
	}
}

void _gnutls_nss_keylog_deinit(void)
{
	if (keylog) {
		fclose(keylog);
		keylog = NULL;
	}
}

#pragma GCC diagnostic pop

/* here we generate the TLS Master secret.
 */
static int
generate_normal_master(gnutls_session_t session,
		       gnutls_datum_t * premaster, int keep_premaster)
{
	int ret = 0;
	char buf[512];

	_gnutls_hard_log("INT: PREMASTER SECRET[%d]: %s\n",
			 premaster->size, _gnutls_bin2hex(premaster->data,
							  premaster->size,
							  buf, sizeof(buf),
							  NULL));
	_gnutls_hard_log("INT: CLIENT RANDOM[%d]: %s\n", 32,
			 _gnutls_bin2hex(session->security_parameters.
					 client_random, 32, buf,
					 sizeof(buf), NULL));
	_gnutls_hard_log("INT: SERVER RANDOM[%d]: %s\n", 32,
			 _gnutls_bin2hex(session->security_parameters.
					 server_random, 32, buf,
					 sizeof(buf), NULL));

	if (session->security_parameters.ext_master_secret == 0) {
		uint8_t rnd[2 * GNUTLS_RANDOM_SIZE + 1];
		memcpy(rnd, session->security_parameters.client_random,
		       GNUTLS_RANDOM_SIZE);
		memcpy(&rnd[GNUTLS_RANDOM_SIZE],
		       session->security_parameters.server_random,
		       GNUTLS_RANDOM_SIZE);

		_gnutls_memory_mark_defined(session->security_parameters.master_secret,
					    GNUTLS_MASTER_SIZE);
#ifdef ENABLE_SSL3
		if (get_num_version(session) == GNUTLS_SSL3) {
			ret =
			    _gnutls_ssl3_generate_random(premaster->data,
							 premaster->size, rnd,
							 2 * GNUTLS_RANDOM_SIZE,
							 GNUTLS_MASTER_SIZE,
							 session->security_parameters.
							 master_secret);
		} else
#endif
			ret =
			    _gnutls_PRF(session, premaster->data, premaster->size,
					MASTER_SECRET, MASTER_SECRET_SIZE,
					rnd, 2 * GNUTLS_RANDOM_SIZE,
					GNUTLS_MASTER_SIZE,
					session->security_parameters.
					master_secret);
		if (ret < 0)
			_gnutls_memory_mark_undefined(session->security_parameters.master_secret,
						      GNUTLS_MASTER_SIZE);
	} else {
		gnutls_datum_t shash = {NULL, 0};

		/* draft-ietf-tls-session-hash-02 */
		ret = _gnutls_handshake_get_session_hash(session, &shash);
		if (ret < 0)
			return gnutls_assert_val(ret);
#ifdef ENABLE_SSL3
		if (get_num_version(session) == GNUTLS_SSL3)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
#endif

		_gnutls_memory_mark_defined(session->security_parameters.master_secret,
					    GNUTLS_MASTER_SIZE);
		ret =
		    _gnutls_PRF(session, premaster->data, premaster->size,
				EXT_MASTER_SECRET, EXT_MASTER_SECRET_SIZE,
				shash.data, shash.size,
				GNUTLS_MASTER_SIZE,
				session->security_parameters.
				master_secret);
		if (ret < 0)
			_gnutls_memory_mark_undefined(session->security_parameters.master_secret,
						      GNUTLS_MASTER_SIZE);

		gnutls_free(shash.data);
	}

	if (!keep_premaster)
		_gnutls_free_temp_key_datum(premaster);

	if (ret < 0)
		return ret;

	ret = _gnutls_call_keylog_func(session, "CLIENT_RANDOM",
				       session->security_parameters.master_secret,
				       GNUTLS_MASTER_SIZE);
	if (ret < 0)
		return gnutls_assert_val(ret);

	_gnutls_hard_log("INT: MASTER SECRET[%d]: %s\n",
			 GNUTLS_MASTER_SIZE,
			 _gnutls_bin2hex(session->security_parameters.
					 master_secret, GNUTLS_MASTER_SIZE,
					 buf, sizeof(buf), NULL));

	return ret;
}

/* This is called when we want to receive the key exchange message of the
 * server. It does nothing if this type of message is not required
 * by the selected ciphersuite. 
 */
int _gnutls_send_server_kx_message(gnutls_session_t session, int again)
{
	gnutls_buffer_st buf;
	int ret = 0;
	mbuffer_st *bufel = NULL;

	if (session->internals.auth_struct->gnutls_generate_server_kx ==
	    NULL)
		return 0;


	if (again == 0) {
		ret = _gnutls_buffer_init_handshake_mbuffer(&buf);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret =
		    session->internals.auth_struct->
		    gnutls_generate_server_kx(session, &buf);

		if (ret == GNUTLS_E_INT_RET_0) {
			gnutls_assert();
			ret = 0;
			goto cleanup;
		}

		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}

		bufel = _gnutls_buffer_to_mbuffer(&buf);
	}

	return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE);

 cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}

/* This function sends a certificate request message to the
 * client.
 */
int _gnutls_send_server_crt_request(gnutls_session_t session, int again)
{
	gnutls_buffer_st buf;
	int ret = 0;
	mbuffer_st *bufel = NULL;

	if (session->internals.auth_struct->
	    gnutls_generate_server_crt_request == NULL)
		return 0;

	if (session->internals.send_cert_req <= 0)
		return 0;


	if (again == 0) {
		ret = _gnutls_buffer_init_handshake_mbuffer(&buf);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret =
		    session->internals.auth_struct->
		    gnutls_generate_server_crt_request(session, &buf);

		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}

		bufel = _gnutls_buffer_to_mbuffer(&buf);
	}

	return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST);

 cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}


/* This is the function for the client to send the key
 * exchange message 
 */
int _gnutls_send_client_kx_message(gnutls_session_t session, int again)
{
	gnutls_buffer_st buf;
	int ret = 0;
	mbuffer_st *bufel = NULL;

	if (session->internals.auth_struct->gnutls_generate_client_kx ==
	    NULL)
		return 0;

	if (again == 0) {
		ret = _gnutls_buffer_init_handshake_mbuffer(&buf);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret =
		    session->internals.auth_struct->
		    gnutls_generate_client_kx(session, &buf);
		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}

		bufel = _gnutls_buffer_to_mbuffer(&buf);
	}

	return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE);

 cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}


/* This is the function for the client to send the certificate
 * verify message
 */
int
_gnutls_send_client_certificate_verify(gnutls_session_t session, int again)
{
	gnutls_buffer_st buf;
	int ret = 0;
	mbuffer_st *bufel = NULL;

	/* This is a packet that is only sent by the client
	 */
	if (session->security_parameters.entity == GNUTLS_SERVER)
		return 0;

	/* if certificate verify is not needed just exit 
	 */
	if (!(session->internals.hsk_flags & HSK_CRT_ASKED))
		return 0;


	if (session->internals.auth_struct->
	    gnutls_generate_client_crt_vrfy == NULL) {
		gnutls_assert();
		return 0;	/* this algorithm does not support cli_crt_vrfy 
				 */
	}

	if (again == 0) {
		ret = _gnutls_buffer_init_handshake_mbuffer(&buf);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret =
		    session->internals.auth_struct->
		    gnutls_generate_client_crt_vrfy(session, &buf);
		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}

		if (ret == 0)
			goto cleanup;


		bufel = _gnutls_buffer_to_mbuffer(&buf);
	}

	return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY);

 cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}

/* This is called when we want send our certificate
 */
int _gnutls_send_client_certificate(gnutls_session_t session, int again)
{
	gnutls_buffer_st buf;
	int ret = 0;
	mbuffer_st *bufel = NULL;

	if (!(session->internals.hsk_flags & HSK_CRT_ASKED))
		return 0;

	if (session->internals.auth_struct->
	    gnutls_generate_client_certificate == NULL)
		return 0;

	if (again == 0) {
		ret = _gnutls_buffer_init_handshake_mbuffer(&buf);
		if (ret < 0)
			return gnutls_assert_val(ret);

#ifdef ENABLE_SSL3
		if (get_num_version(session) != GNUTLS_SSL3 ||
		    session->internals.selected_cert_list_length > 0)
#endif
		{
			/* TLS 1.x or SSL 3.0 with a valid certificate 
			 */
			ret =
			    session->internals.auth_struct->
			    gnutls_generate_client_certificate(session,
							       &buf);

			if (ret < 0) {
				gnutls_assert();
				goto cleanup;
			}
		}

		bufel = _gnutls_buffer_to_mbuffer(&buf);
	}

#ifdef ENABLE_SSL3
	/* In the SSL 3.0 protocol we need to send a
	 * no certificate alert instead of an
	 * empty certificate.
	 */
	if (get_num_version(session) == GNUTLS_SSL3 &&
	    session->internals.selected_cert_list_length == 0) {
		_mbuffer_xfree(&bufel);
		return
		    gnutls_alert_send(session, GNUTLS_AL_WARNING,
				      GNUTLS_A_SSL3_NO_CERTIFICATE);

	} else		/* TLS 1.0 or SSL 3.0 with a valid certificate 
			 */
#endif
		return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_CERTIFICATE_PKT);

 cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}


/* This is called when we want send our certificate
 */
int _gnutls_send_server_certificate(gnutls_session_t session, int again)
{
	gnutls_buffer_st buf;
	int ret = 0;
	mbuffer_st *bufel = NULL;

	if (session->internals.auth_struct->
	    gnutls_generate_server_certificate == NULL)
		return 0;

	if (again == 0) {
		ret = _gnutls_buffer_init_handshake_mbuffer(&buf);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret =
		    session->internals.auth_struct->
		    gnutls_generate_server_certificate(session, &buf);

		if (ret < 0) {
			gnutls_assert();
			goto cleanup;
		}

		bufel = _gnutls_buffer_to_mbuffer(&buf);
	}

	return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_CERTIFICATE_PKT);

 cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}


int _gnutls_recv_server_kx_message(gnutls_session_t session)
{
	gnutls_buffer_st buf;
	int ret = 0;
	unsigned int optflag = 0;

	if (session->internals.auth_struct->gnutls_process_server_kx !=
	    NULL) {
		/* Server key exchange packet is optional for PSK. */
		if (_gnutls_session_is_psk(session))
			optflag = 1;

		ret =
		    _gnutls_recv_handshake(session,
					   GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE,
					   optflag, &buf);
		if (ret < 0) {
			gnutls_assert();
			return ret;
		}

		ret =
		    session->internals.auth_struct->
		    gnutls_process_server_kx(session, buf.data,
					     buf.length);
		_gnutls_buffer_clear(&buf);

		if (ret < 0) {
			gnutls_assert();
			return ret;
		}

	}
	return ret;
}

int _gnutls_recv_server_crt_request(gnutls_session_t session)
{
	gnutls_buffer_st buf;
	int ret = 0;

	if (session->internals.auth_struct->
	    gnutls_process_server_crt_request != NULL) {

		ret =
		    _gnutls_recv_handshake(session,
					   GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST,
					   1, &buf);
		if (ret < 0)
			return ret;

		if (ret == 0 && buf.length == 0) {
			_gnutls_buffer_clear(&buf);
			return 0;	/* ignored */
		}

		ret =
		    session->internals.auth_struct->
		    gnutls_process_server_crt_request(session, buf.data,
						      buf.length);
		_gnutls_buffer_clear(&buf);
		if (ret < 0)
			return ret;

	}
	return ret;
}

int _gnutls_recv_client_kx_message(gnutls_session_t session)
{
	gnutls_buffer_st buf;
	int ret = 0;


	/* Do key exchange only if the algorithm permits it */
	if (session->internals.auth_struct->gnutls_process_client_kx !=
	    NULL) {

		ret =
		    _gnutls_recv_handshake(session,
					   GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE,
					   0, &buf);
		if (ret < 0)
			return ret;

		ret =
		    session->internals.auth_struct->
		    gnutls_process_client_kx(session, buf.data,
					     buf.length);
		_gnutls_buffer_clear(&buf);
		if (ret < 0)
			return ret;

	}

	return ret;
}


int _gnutls_recv_client_certificate(gnutls_session_t session)
{
	gnutls_buffer_st buf;
	int ret = 0;
	int optional;

	if (session->internals.auth_struct->
	    gnutls_process_client_certificate == NULL)
		return 0;

	/* if we have not requested a certificate then just return
	 */
	if (session->internals.send_cert_req == 0) {
		return 0;
	}

	if (session->internals.send_cert_req == GNUTLS_CERT_REQUIRE)
		optional = 0;
	else
		optional = 1;

	ret =
	    _gnutls_recv_handshake(session,
				   GNUTLS_HANDSHAKE_CERTIFICATE_PKT,
				   optional, &buf);

	if (ret < 0) {
		/* Handle the case of old SSL3 clients who send
		 * a warning alert instead of an empty certificate to indicate
		 * no certificate.
		 */
#ifdef ENABLE_SSL3
		if (optional != 0 &&
		    ret == GNUTLS_E_WARNING_ALERT_RECEIVED &&
		    get_num_version(session) == GNUTLS_SSL3 &&
		    gnutls_alert_get(session) ==
		    GNUTLS_A_SSL3_NO_CERTIFICATE) {

			/* SSL3 does not send an empty certificate,
			 * but this alert. So we just ignore it.
			 */
			gnutls_assert();
			return 0;
		}
#endif

		/* certificate was required 
		 */
		if ((ret == GNUTLS_E_WARNING_ALERT_RECEIVED
		     || ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
		    && optional == 0) {
			gnutls_assert();
			return GNUTLS_E_NO_CERTIFICATE_FOUND;
		}

		return ret;
	}

	if (ret == 0 && buf.length == 0 && optional != 0) {
		/* Client has not sent the certificate message.
		 * well I'm not sure we should accept this
		 * behaviour.
		 */
		gnutls_assert();
		ret = 0;
		goto cleanup;
	}
	ret =
	    session->internals.auth_struct->
	    gnutls_process_client_certificate(session, buf.data,
					      buf.length);

	if (ret < 0 && ret != GNUTLS_E_NO_CERTIFICATE_FOUND) {
		gnutls_assert();
		goto cleanup;
	}

	/* ok we should expect a certificate verify message now 
	 */
	if (ret == GNUTLS_E_NO_CERTIFICATE_FOUND && optional != 0)
		ret = 0;
	else
		session->internals.hsk_flags |= HSK_CRT_VRFY_EXPECTED;

      cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}

int _gnutls_recv_server_certificate(gnutls_session_t session)
{
	gnutls_buffer_st buf;
	int ret = 0;

	if (session->internals.auth_struct->
	    gnutls_process_server_certificate != NULL) {

		ret =
		    _gnutls_recv_handshake(session,
					   GNUTLS_HANDSHAKE_CERTIFICATE_PKT,
					   0, &buf);
		if (ret < 0) {
			gnutls_assert();
			return ret;
		}

		ret =
		    session->internals.auth_struct->
		    gnutls_process_server_certificate(session, buf.data,
						      buf.length);
		_gnutls_buffer_clear(&buf);
		if (ret < 0) {
			gnutls_assert();
			return ret;
		}
	}

	return ret;
}


/* Recv the client certificate verify. This packet may not
 * arrive if the peer did not send us a certificate.
 */
int
_gnutls_recv_client_certificate_verify_message(gnutls_session_t session)
{
	gnutls_buffer_st buf;
	int ret = 0;


	if (session->internals.auth_struct->
	    gnutls_process_client_crt_vrfy == NULL)
		return 0;

	if (session->internals.send_cert_req == 0 ||
	    (!(session->internals.hsk_flags & HSK_CRT_VRFY_EXPECTED))) {
		return 0;
	}

	ret =
	    _gnutls_recv_handshake(session,
				   GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY,
				   1, &buf);
	if (ret < 0)
		return ret;

	if (ret == 0 && buf.length == 0
	    && session->internals.send_cert_req == GNUTLS_CERT_REQUIRE) {
		/* certificate was required */
		gnutls_assert();
		ret = GNUTLS_E_NO_CERTIFICATE_FOUND;
		goto cleanup;
	}

	ret =
	    session->internals.auth_struct->
	    gnutls_process_client_crt_vrfy(session, buf.data, buf.length);

      cleanup:
	_gnutls_buffer_clear(&buf);
	return ret;
}