/* * Copyright (C) 2007 Michael Brown . * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or any later version. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ FILE_LICENCE ( GPL2_OR_LATER ); /** * @file * * Transport Layer Security Protocol */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static int tls_send_plaintext ( struct tls_session *tls, unsigned int type, const void *data, size_t len ); static void tls_clear_cipher ( struct tls_session *tls, struct tls_cipherspec *cipherspec ); /****************************************************************************** * * Utility functions * ****************************************************************************** */ /** * Extract 24-bit field value * * @v field24 24-bit field * @ret value Field value * * TLS uses 24-bit integers in several places, which are awkward to * parse in C. */ static unsigned long tls_uint24 ( uint8_t field24[3] ) { return ( ( field24[0] << 16 ) + ( field24[1] << 8 ) + field24[2] ); } /****************************************************************************** * * Cleanup functions * ****************************************************************************** */ /** * Free TLS session * * @v refcnt Reference counter */ static void free_tls ( struct refcnt *refcnt ) { struct tls_session *tls = container_of ( refcnt, struct tls_session, refcnt ); /* Free dynamically-allocated resources */ tls_clear_cipher ( tls, &tls->tx_cipherspec ); tls_clear_cipher ( tls, &tls->tx_cipherspec_pending ); tls_clear_cipher ( tls, &tls->rx_cipherspec ); tls_clear_cipher ( tls, &tls->rx_cipherspec_pending ); x509_free_rsa_public_key ( &tls->rsa ); free ( tls->rx_data ); /* Free TLS structure itself */ free ( tls ); } /** * Finish with TLS session * * @v tls TLS session * @v rc Status code */ static void tls_close ( struct tls_session *tls, int rc ) { /* Remove process */ process_del ( &tls->process ); /* Close ciphertext and plaintext streams */ xfer_nullify ( &tls->cipherstream.xfer ); xfer_close ( &tls->cipherstream.xfer, rc ); xfer_nullify ( &tls->plainstream.xfer ); xfer_close ( &tls->plainstream.xfer, rc ); } /****************************************************************************** * * Random number generation * ****************************************************************************** */ /** * Generate random data * * @v data Buffer to fill * @v len Length of buffer */ static void tls_generate_random ( void *data, size_t len ) { /* FIXME: Some real random data source would be nice... */ memset ( data, 0x01, len ); } /** * Update HMAC with a list of ( data, len ) pairs * * @v digest Hash function to use * @v digest_ctx Digest context * @v args ( data, len ) pairs of data, terminated by NULL */ static void tls_hmac_update_va ( struct digest_algorithm *digest, void *digest_ctx, va_list args ) { void *data; size_t len; while ( ( data = va_arg ( args, void * ) ) ) { len = va_arg ( args, size_t ); hmac_update ( digest, digest_ctx, data, len ); } } /** * Generate secure pseudo-random data using a single hash function * * @v tls TLS session * @v digest Hash function to use * @v secret Secret * @v secret_len Length of secret * @v out Output buffer * @v out_len Length of output buffer * @v seeds ( data, len ) pairs of seed data, terminated by NULL */ static void tls_p_hash_va ( struct tls_session *tls, struct digest_algorithm *digest, void *secret, size_t secret_len, void *out, size_t out_len, va_list seeds ) { uint8_t secret_copy[secret_len]; uint8_t digest_ctx[digest->ctxsize]; uint8_t digest_ctx_partial[digest->ctxsize]; uint8_t a[digest->digestsize]; uint8_t out_tmp[digest->digestsize]; size_t frag_len = digest->digestsize; va_list tmp; /* Copy the secret, in case HMAC modifies it */ memcpy ( secret_copy, secret, secret_len ); secret = secret_copy; DBGC2 ( tls, "TLS %p %s secret:\n", tls, digest->name ); DBGC2_HD ( tls, secret, secret_len ); /* Calculate A(1) */ hmac_init ( digest, digest_ctx, secret, &secret_len ); va_copy ( tmp, seeds ); tls_hmac_update_va ( digest, digest_ctx, tmp ); va_end ( tmp ); hmac_final ( digest, digest_ctx, secret, &secret_len, a ); DBGC2 ( tls, "TLS %p %s A(1):\n", tls, digest->name ); DBGC2_HD ( tls, &a, sizeof ( a ) ); /* Generate as much data as required */ while ( out_len ) { /* Calculate output portion */ hmac_init ( digest, digest_ctx, secret, &secret_len ); hmac_update ( digest, digest_ctx, a, sizeof ( a ) ); memcpy ( digest_ctx_partial, digest_ctx, digest->ctxsize ); va_copy ( tmp, seeds ); tls_hmac_update_va ( digest, digest_ctx, tmp ); va_end ( tmp ); hmac_final ( digest, digest_ctx, secret, &secret_len, out_tmp ); /* Copy output */ if ( frag_len > out_len ) frag_len = out_len; memcpy ( out, out_tmp, frag_len ); DBGC2 ( tls, "TLS %p %s output:\n", tls, digest->name ); DBGC2_HD ( tls, out, frag_len ); /* Calculate A(i) */ hmac_final ( digest, digest_ctx_partial, secret, &secret_len, a ); DBGC2 ( tls, "TLS %p %s A(n):\n", tls, digest->name ); DBGC2_HD ( tls, &a, sizeof ( a ) ); out += frag_len; out_len -= frag_len; } } /** * Generate secure pseudo-random data * * @v tls TLS session * @v secret Secret * @v secret_len Length of secret * @v out Output buffer * @v out_len Length of output buffer * @v ... ( data, len ) pairs of seed data, terminated by NULL */ static void tls_prf ( struct tls_session *tls, void *secret, size_t secret_len, void *out, size_t out_len, ... ) { va_list seeds; va_list tmp; size_t subsecret_len; void *md5_secret; void *sha1_secret; uint8_t out_md5[out_len]; uint8_t out_sha1[out_len]; unsigned int i; va_start ( seeds, out_len ); /* Split secret into two, with an overlap of up to one byte */ subsecret_len = ( ( secret_len + 1 ) / 2 ); md5_secret = secret; sha1_secret = ( secret + secret_len - subsecret_len ); /* Calculate MD5 portion */ va_copy ( tmp, seeds ); tls_p_hash_va ( tls, &md5_algorithm, md5_secret, subsecret_len, out_md5, out_len, seeds ); va_end ( tmp ); /* Calculate SHA1 portion */ va_copy ( tmp, seeds ); tls_p_hash_va ( tls, &sha1_algorithm, sha1_secret, subsecret_len, out_sha1, out_len, seeds ); va_end ( tmp ); /* XOR the two portions together into the final output buffer */ for ( i = 0 ; i < out_len ; i++ ) { *( ( uint8_t * ) out + i ) = ( out_md5[i] ^ out_sha1[i] ); } va_end ( seeds ); } /** * Generate secure pseudo-random data * * @v secret Secret * @v secret_len Length of secret * @v out Output buffer * @v out_len Length of output buffer * @v label String literal label * @v ... ( data, len ) pairs of seed data */ #define tls_prf_label( tls, secret, secret_len, out, out_len, label, ... ) \ tls_prf ( (tls), (secret), (secret_len), (out), (out_len), \ label, ( sizeof ( label ) - 1 ), __VA_ARGS__, NULL ) /****************************************************************************** * * Secret management * ****************************************************************************** */ /** * Generate master secret * * @v tls TLS session * * The pre-master secret and the client and server random values must * already be known. */ static void tls_generate_master_secret ( struct tls_session *tls ) { DBGC ( tls, "TLS %p pre-master-secret:\n", tls ); DBGC_HD ( tls, &tls->pre_master_secret, sizeof ( tls->pre_master_secret ) ); DBGC ( tls, "TLS %p client random bytes:\n", tls ); DBGC_HD ( tls, &tls->client_random, sizeof ( tls->client_random ) ); DBGC ( tls, "TLS %p server random bytes:\n", tls ); DBGC_HD ( tls, &tls->server_random, sizeof ( tls->server_random ) ); tls_prf_label ( tls, &tls->pre_master_secret, sizeof ( tls->pre_master_secret ), &tls->master_secret, sizeof ( tls->master_secret ), "master secret", &tls->client_random, sizeof ( tls->client_random ), &tls->server_random, sizeof ( tls->server_random ) ); DBGC ( tls, "TLS %p generated master secret:\n", tls ); DBGC_HD ( tls, &tls->master_secret, sizeof ( tls->master_secret ) ); } /** * Generate key material * * @v tls TLS session * * The master secret must already be known. */ static int tls_generate_keys ( struct tls_session *tls ) { struct tls_cipherspec *tx_cipherspec = &tls->tx_cipherspec_pending; struct tls_cipherspec *rx_cipherspec = &tls->rx_cipherspec_pending; size_t hash_size = tx_cipherspec->digest->digestsize; size_t key_size = tx_cipherspec->key_len; size_t iv_size = tx_cipherspec->cipher->blocksize; size_t total = ( 2 * ( hash_size + key_size + iv_size ) ); uint8_t key_block[total]; uint8_t *key; int rc; /* Generate key block */ tls_prf_label ( tls, &tls->master_secret, sizeof ( tls->master_secret ), key_block, sizeof ( key_block ), "key expansion", &tls->server_random, sizeof ( tls->server_random ), &tls->client_random, sizeof ( tls->client_random ) ); /* Split key block into portions */ key = key_block; /* TX MAC secret */ memcpy ( tx_cipherspec->mac_secret, key, hash_size ); DBGC ( tls, "TLS %p TX MAC secret:\n", tls ); DBGC_HD ( tls, key, hash_size ); key += hash_size; /* RX MAC secret */ memcpy ( rx_cipherspec->mac_secret, key, hash_size ); DBGC ( tls, "TLS %p RX MAC secret:\n", tls ); DBGC_HD ( tls, key, hash_size ); key += hash_size; /* TX key */ if ( ( rc = cipher_setkey ( tx_cipherspec->cipher, tx_cipherspec->cipher_ctx, key, key_size ) ) != 0 ) { DBGC ( tls, "TLS %p could not set TX key: %s\n", tls, strerror ( rc ) ); return rc; } DBGC ( tls, "TLS %p TX key:\n", tls ); DBGC_HD ( tls, key, key_size ); key += key_size; /* RX key */ if ( ( rc = cipher_setkey ( rx_cipherspec->cipher, rx_cipherspec->cipher_ctx, key, key_size ) ) != 0 ) { DBGC ( tls, "TLS %p could not set TX key: %s\n", tls, strerror ( rc ) ); return rc; } DBGC ( tls, "TLS %p RX key:\n", tls ); DBGC_HD ( tls, key, key_size ); key += key_size; /* TX initialisation vector */ cipher_setiv ( tx_cipherspec->cipher, tx_cipherspec->cipher_ctx, key ); DBGC ( tls, "TLS %p TX IV:\n", tls ); DBGC_HD ( tls, key, iv_size ); key += iv_size; /* RX initialisation vector */ cipher_setiv ( rx_cipherspec->cipher, rx_cipherspec->cipher_ctx, key ); DBGC ( tls, "TLS %p RX IV:\n", tls ); DBGC_HD ( tls, key, iv_size ); key += iv_size; assert ( ( key_block + total ) == key ); return 0; } /****************************************************************************** * * Cipher suite management * ****************************************************************************** */ /** * Clear cipher suite * * @v cipherspec TLS cipher specification */ static void tls_clear_cipher ( struct tls_session *tls __unused, struct tls_cipherspec *cipherspec ) { free ( cipherspec->dynamic ); memset ( cipherspec, 0, sizeof ( cipherspec ) ); cipherspec->pubkey = &pubkey_null; cipherspec->cipher = &cipher_null; cipherspec->digest = &digest_null; } /** * Set cipher suite * * @v tls TLS session * @v cipherspec TLS cipher specification * @v pubkey Public-key encryption elgorithm * @v cipher Bulk encryption cipher algorithm * @v digest MAC digest algorithm * @v key_len Key length * @ret rc Return status code */ static int tls_set_cipher ( struct tls_session *tls, struct tls_cipherspec *cipherspec, struct pubkey_algorithm *pubkey, struct cipher_algorithm *cipher, struct digest_algorithm *digest, size_t key_len ) { size_t total; void *dynamic; /* Clear out old cipher contents, if any */ tls_clear_cipher ( tls, cipherspec ); /* Allocate dynamic storage */ total = ( pubkey->ctxsize + 2 * cipher->ctxsize + digest->digestsize ); dynamic = malloc ( total ); if ( ! dynamic ) { DBGC ( tls, "TLS %p could not allocate %zd bytes for crypto " "context\n", tls, total ); return -ENOMEM; } memset ( dynamic, 0, total ); /* Assign storage */ cipherspec->dynamic = dynamic; cipherspec->pubkey_ctx = dynamic; dynamic += pubkey->ctxsize; cipherspec->cipher_ctx = dynamic; dynamic += cipher->ctxsize; cipherspec->cipher_next_ctx = dynamic; dynamic += cipher->ctxsize; cipherspec->mac_secret = dynamic; dynamic += digest->digestsize; assert ( ( cipherspec->dynamic + total ) == dynamic ); /* Store parameters */ cipherspec->pubkey = pubkey; cipherspec->cipher = cipher; cipherspec->digest = digest; cipherspec->key_len = key_len; return 0; } /** * Select next cipher suite * * @v tls TLS session * @v cipher_suite Cipher suite specification * @ret rc Return status code */ static int tls_select_cipher ( struct tls_session *tls, unsigned int cipher_suite ) { struct pubkey_algorithm *pubkey = &pubkey_null; struct cipher_algorithm *cipher = &cipher_null; struct digest_algorithm *digest = &digest_null; unsigned int key_len = 0; int rc; switch ( cipher_suite ) { case htons ( TLS_RSA_WITH_AES_128_CBC_SHA ): key_len = ( 128 / 8 ); cipher = &aes_cbc_algorithm; digest = &sha1_algorithm; break; case htons ( TLS_RSA_WITH_AES_256_CBC_SHA ): key_len = ( 256 / 8 ); cipher = &aes_cbc_algorithm; digest = &sha1_algorithm; break; default: DBGC ( tls, "TLS %p does not support cipher %04x\n", tls, ntohs ( cipher_suite ) ); return -ENOTSUP; } /* Set ciphers */ if ( ( rc = tls_set_cipher ( tls, &tls->tx_cipherspec_pending, pubkey, cipher, digest, key_len ) ) != 0 ) return rc; if ( ( rc = tls_set_cipher ( tls, &tls->rx_cipherspec_pending, pubkey, cipher, digest, key_len ) ) != 0 ) return rc; DBGC ( tls, "TLS %p selected %s-%s-%d-%s\n", tls, pubkey->name, cipher->name, ( key_len * 8 ), digest->name ); return 0; } /** * Activate next cipher suite * * @v tls TLS session * @v pending Pending cipher specification * @v active Active cipher specification to replace * @ret rc Return status code */ static int tls_change_cipher ( struct tls_session *tls, struct tls_cipherspec *pending, struct tls_cipherspec *active ) { /* Sanity check */ if ( /* FIXME (when pubkey is not hard-coded to RSA): * ( pending->pubkey == &pubkey_null ) || */ ( pending->cipher == &cipher_null ) || ( pending->digest == &digest_null ) ) { DBGC ( tls, "TLS %p refusing to use null cipher\n", tls ); return -ENOTSUP; } tls_clear_cipher ( tls, active ); memswap ( active, pending, sizeof ( *active ) ); return 0; } /****************************************************************************** * * Handshake verification * ****************************************************************************** */ /** * Add handshake record to verification hash * * @v tls TLS session * @v data Handshake record * @v len Length of handshake record */ static void tls_add_handshake ( struct tls_session *tls, const void *data, size_t len ) { digest_update ( &md5_algorithm, tls->handshake_md5_ctx, data, len ); digest_update ( &sha1_algorithm, tls->handshake_sha1_ctx, data, len ); } /** * Calculate handshake verification hash * * @v tls TLS session * @v out Output buffer * * Calculates the MD5+SHA1 digest over all handshake messages seen so * far. */ static void tls_verify_handshake ( struct tls_session *tls, void *out ) { struct digest_algorithm *md5 = &md5_algorithm; struct digest_algorithm *sha1 = &sha1_algorithm; uint8_t md5_ctx[md5->ctxsize]; uint8_t sha1_ctx[sha1->ctxsize]; void *md5_digest = out; void *sha1_digest = ( out + md5->digestsize ); memcpy ( md5_ctx, tls->handshake_md5_ctx, sizeof ( md5_ctx ) ); memcpy ( sha1_ctx, tls->handshake_sha1_ctx, sizeof ( sha1_ctx ) ); digest_final ( md5, md5_ctx, md5_digest ); digest_final ( sha1, sha1_ctx, sha1_digest ); } /****************************************************************************** * * Record handling * ****************************************************************************** */ /** * Transmit Handshake record * * @v tls TLS session * @v data Plaintext record * @v len Length of plaintext record * @ret rc Return status code */ static int tls_send_handshake ( struct tls_session *tls, void *data, size_t len ) { /* Add to handshake digest */ tls_add_handshake ( tls, data, len ); /* Send record */ return tls_send_plaintext ( tls, TLS_TYPE_HANDSHAKE, data, len ); } /** * Transmit Client Hello record * * @v tls TLS session * @ret rc Return status code */ static int tls_send_client_hello ( struct tls_session *tls ) { struct { uint32_t type_length; uint16_t version; uint8_t random[32]; uint8_t session_id_len; uint16_t cipher_suite_len; uint16_t cipher_suites[2]; uint8_t compression_methods_len; uint8_t compression_methods[1]; } __attribute__ (( packed )) hello; memset ( &hello, 0, sizeof ( hello ) ); hello.type_length = ( cpu_to_le32 ( TLS_CLIENT_HELLO ) | htonl ( sizeof ( hello ) - sizeof ( hello.type_length ) ) ); hello.version = htons ( TLS_VERSION_TLS_1_0 ); memcpy ( &hello.random, &tls->client_random, sizeof ( hello.random ) ); hello.cipher_suite_len = htons ( sizeof ( hello.cipher_suites ) ); hello.cipher_suites[0] = htons ( TLS_RSA_WITH_AES_128_CBC_SHA ); hello.cipher_suites[1] = htons ( TLS_RSA_WITH_AES_256_CBC_SHA ); hello.compression_methods_len = sizeof ( hello.compression_methods ); return tls_send_handshake ( tls, &hello, sizeof ( hello ) ); } /** * Transmit Client Key Exchange record * * @v tls TLS session * @ret rc Return status code */ static int tls_send_client_key_exchange ( struct tls_session *tls ) { /* FIXME: Hack alert */ RSA_CTX *rsa_ctx; RSA_pub_key_new ( &rsa_ctx, tls->rsa.modulus, tls->rsa.modulus_len, tls->rsa.exponent, tls->rsa.exponent_len ); struct { uint32_t type_length; uint16_t encrypted_pre_master_secret_len; uint8_t encrypted_pre_master_secret[rsa_ctx->num_octets]; } __attribute__ (( packed )) key_xchg; memset ( &key_xchg, 0, sizeof ( key_xchg ) ); key_xchg.type_length = ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) | htonl ( sizeof ( key_xchg ) - sizeof ( key_xchg.type_length ) ) ); key_xchg.encrypted_pre_master_secret_len = htons ( sizeof ( key_xchg.encrypted_pre_master_secret ) ); /* FIXME: Hack alert */ DBGC ( tls, "RSA encrypting plaintext, modulus, exponent:\n" ); DBGC_HD ( tls, &tls->pre_master_secret, sizeof ( tls->pre_master_secret ) ); DBGC_HD ( tls, tls->rsa.modulus, tls->rsa.modulus_len ); DBGC_HD ( tls, tls->rsa.exponent, tls->rsa.exponent_len ); RSA_encrypt ( rsa_ctx, ( const uint8_t * ) &tls->pre_master_secret, sizeof ( tls->pre_master_secret ), key_xchg.encrypted_pre_master_secret, 0 ); DBGC ( tls, "RSA encrypt done. Ciphertext:\n" ); DBGC_HD ( tls, &key_xchg.encrypted_pre_master_secret, sizeof ( key_xchg.encrypted_pre_master_secret ) ); RSA_free ( rsa_ctx ); return tls_send_handshake ( tls, &key_xchg, sizeof ( key_xchg ) ); } /** * Transmit Change Cipher record * * @v tls TLS session * @ret rc Return status code */ static int tls_send_change_cipher ( struct tls_session *tls ) { static const uint8_t change_cipher[1] = { 1 }; return tls_send_plaintext ( tls, TLS_TYPE_CHANGE_CIPHER, change_cipher, sizeof ( change_cipher ) ); } /** * Transmit Finished record * * @v tls TLS session * @ret rc Return status code */ static int tls_send_finished ( struct tls_session *tls ) { struct { uint32_t type_length; uint8_t verify_data[12]; } __attribute__ (( packed )) finished; uint8_t digest[MD5_DIGEST_SIZE + SHA1_DIGEST_SIZE]; memset ( &finished, 0, sizeof ( finished ) ); finished.type_length = ( cpu_to_le32 ( TLS_FINISHED ) | htonl ( sizeof ( finished ) - sizeof ( finished.type_length ) ) ); tls_verify_handshake ( tls, digest ); tls_prf_label ( tls, &tls->master_secret, sizeof ( tls->master_secret ), finished.verify_data, sizeof ( finished.verify_data ), "client finished", digest, sizeof ( digest ) ); return tls_send_handshake ( tls, &finished, sizeof ( finished ) ); } /** * Receive new Change Cipher record * * @v tls TLS session * @v data Plaintext record * @v len Length of plaintext record * @ret rc Return status code */ static int tls_new_change_cipher ( struct tls_session *tls, void *data, size_t len ) { int rc; if ( ( len != 1 ) || ( *( ( uint8_t * ) data ) != 1 ) ) { DBGC ( tls, "TLS %p received invalid Change Cipher\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } if ( ( rc = tls_change_cipher ( tls, &tls->rx_cipherspec_pending, &tls->rx_cipherspec ) ) != 0 ) { DBGC ( tls, "TLS %p could not activate RX cipher: %s\n", tls, strerror ( rc ) ); return rc; } tls->rx_seq = ~( ( uint64_t ) 0 ); return 0; } /** * Receive new Alert record * * @v tls TLS session * @v data Plaintext record * @v len Length of plaintext record * @ret rc Return status code */ static int tls_new_alert ( struct tls_session *tls, void *data, size_t len ) { struct { uint8_t level; uint8_t description; char next[0]; } __attribute__ (( packed )) *alert = data; void *end = alert->next; /* Sanity check */ if ( end != ( data + len ) ) { DBGC ( tls, "TLS %p received overlength Alert\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } switch ( alert->level ) { case TLS_ALERT_WARNING: DBGC ( tls, "TLS %p received warning alert %d\n", tls, alert->description ); return 0; case TLS_ALERT_FATAL: DBGC ( tls, "TLS %p received fatal alert %d\n", tls, alert->description ); return -EPERM; default: DBGC ( tls, "TLS %p received unknown alert level %d" "(alert %d)\n", tls, alert->level, alert->description ); return -EIO; } } /** * Receive new Server Hello handshake record * * @v tls TLS session * @v data Plaintext handshake record * @v len Length of plaintext handshake record * @ret rc Return status code */ static int tls_new_server_hello ( struct tls_session *tls, void *data, size_t len ) { struct { uint16_t version; uint8_t random[32]; uint8_t session_id_len; char next[0]; } __attribute__ (( packed )) *hello_a = data; struct { uint8_t session_id[hello_a->session_id_len]; uint16_t cipher_suite; uint8_t compression_method; char next[0]; } __attribute__ (( packed )) *hello_b = ( void * ) &hello_a->next; void *end = hello_b->next; int rc; /* Sanity check */ if ( end != ( data + len ) ) { DBGC ( tls, "TLS %p received overlength Server Hello\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } /* Check protocol version */ if ( ntohs ( hello_a->version ) < TLS_VERSION_TLS_1_0 ) { DBGC ( tls, "TLS %p does not support protocol version %d.%d\n", tls, ( ntohs ( hello_a->version ) >> 8 ), ( ntohs ( hello_a->version ) & 0xff ) ); return -ENOTSUP; } /* Copy out server random bytes */ memcpy ( &tls->server_random, &hello_a->random, sizeof ( tls->server_random ) ); /* Select cipher suite */ if ( ( rc = tls_select_cipher ( tls, hello_b->cipher_suite ) ) != 0 ) return rc; /* Generate secrets */ tls_generate_master_secret ( tls ); if ( ( rc = tls_generate_keys ( tls ) ) != 0 ) return rc; return 0; } /** * Receive new Certificate handshake record * * @v tls TLS session * @v data Plaintext handshake record * @v len Length of plaintext handshake record * @ret rc Return status code */ static int tls_new_certificate ( struct tls_session *tls, void *data, size_t len ) { struct { uint8_t length[3]; uint8_t certificates[0]; } __attribute__ (( packed )) *certificate = data; struct { uint8_t length[3]; uint8_t certificate[0]; } __attribute__ (( packed )) *element = ( ( void * ) certificate->certificates ); size_t elements_len = tls_uint24 ( certificate->length ); void *end = ( certificate->certificates + elements_len ); struct asn1_cursor cursor; int rc; /* Sanity check */ if ( end != ( data + len ) ) { DBGC ( tls, "TLS %p received overlength Server Certificate\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } /* Traverse certificate chain */ do { cursor.data = element->certificate; cursor.len = tls_uint24 ( element->length ); if ( ( cursor.data + cursor.len ) > end ) { DBGC ( tls, "TLS %p received corrupt Server " "Certificate\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } // HACK if ( ( rc = x509_rsa_public_key ( &cursor, &tls->rsa ) ) != 0 ) { DBGC ( tls, "TLS %p cannot determine RSA public key: " "%s\n", tls, strerror ( rc ) ); return rc; } return 0; element = ( cursor.data + cursor.len ); } while ( element != end ); return -EINVAL; } /** * Receive new Server Hello Done handshake record * * @v tls TLS session * @v data Plaintext handshake record * @v len Length of plaintext handshake record * @ret rc Return status code */ static int tls_new_server_hello_done ( struct tls_session *tls, void *data, size_t len ) { struct { char next[0]; } __attribute__ (( packed )) *hello_done = data; void *end = hello_done->next; /* Sanity check */ if ( end != ( data + len ) ) { DBGC ( tls, "TLS %p received overlength Server Hello Done\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } /* Check that we are ready to send the Client Key Exchange */ if ( tls->tx_state != TLS_TX_NONE ) { DBGC ( tls, "TLS %p received Server Hello Done while in " "TX state %d\n", tls, tls->tx_state ); return -EIO; } /* Start sending the Client Key Exchange */ tls->tx_state = TLS_TX_CLIENT_KEY_EXCHANGE; return 0; } /** * Receive new Finished handshake record * * @v tls TLS session * @v data Plaintext handshake record * @v len Length of plaintext handshake record * @ret rc Return status code */ static int tls_new_finished ( struct tls_session *tls, void *data, size_t len ) { /* FIXME: Handle this properly */ tls->tx_state = TLS_TX_DATA; ( void ) data; ( void ) len; return 0; } /** * Receive new Handshake record * * @v tls TLS session * @v data Plaintext record * @v len Length of plaintext record * @ret rc Return status code */ static int tls_new_handshake ( struct tls_session *tls, void *data, size_t len ) { struct { uint8_t type; uint8_t length[3]; uint8_t payload[0]; } __attribute__ (( packed )) *handshake = data; void *payload = &handshake->payload; size_t payload_len = tls_uint24 ( handshake->length ); void *end = ( payload + payload_len ); int rc; /* Sanity check */ if ( end != ( data + len ) ) { DBGC ( tls, "TLS %p received overlength Handshake\n", tls ); DBGC_HD ( tls, data, len ); return -EINVAL; } switch ( handshake->type ) { case TLS_SERVER_HELLO: rc = tls_new_server_hello ( tls, payload, payload_len ); break; case TLS_CERTIFICATE: rc = tls_new_certificate ( tls, payload, payload_len ); break; case TLS_SERVER_HELLO_DONE: rc = tls_new_server_hello_done ( tls, payload, payload_len ); break; case TLS_FINISHED: rc = tls_new_finished ( tls, payload, payload_len ); break; default: DBGC ( tls, "TLS %p ignoring handshake type %d\n", tls, handshake->type ); rc = 0; break; } /* Add to handshake digest (except for Hello Requests, which * are explicitly excluded). */ if ( handshake->type != TLS_HELLO_REQUEST ) tls_add_handshake ( tls, data, len ); return rc; } /** * Receive new record * * @v tls TLS session * @v type Record type * @v data Plaintext record * @v len Length of plaintext record * @ret rc Return status code */ static int tls_new_record ( struct tls_session *tls, unsigned int type, void *data, size_t len ) { switch ( type ) { case TLS_TYPE_CHANGE_CIPHER: return tls_new_change_cipher ( tls, data, len ); case TLS_TYPE_ALERT: return tls_new_alert ( tls, data, len ); case TLS_TYPE_HANDSHAKE: return tls_new_handshake ( tls, data, len ); case TLS_TYPE_DATA: return xfer_deliver_raw ( &tls->plainstream.xfer, data, len ); default: /* RFC4346 says that we should just ignore unknown * record types. */ DBGC ( tls, "TLS %p ignoring record type %d\n", tls, type ); return 0; } } /****************************************************************************** * * Record encryption/decryption * ****************************************************************************** */ /** * Calculate HMAC * * @v tls TLS session * @v cipherspec Cipher specification * @v seq Sequence number * @v tlshdr TLS header * @v data Data * @v len Length of data * @v mac HMAC to fill in */ static void tls_hmac ( struct tls_session *tls __unused, struct tls_cipherspec *cipherspec, uint64_t seq, struct tls_header *tlshdr, const void *data, size_t len, void *hmac ) { struct digest_algorithm *digest = cipherspec->digest; uint8_t digest_ctx[digest->ctxsize]; hmac_init ( digest, digest_ctx, cipherspec->mac_secret, &digest->digestsize ); seq = cpu_to_be64 ( seq ); hmac_update ( digest, digest_ctx, &seq, sizeof ( seq ) ); hmac_update ( digest, digest_ctx, tlshdr, sizeof ( *tlshdr ) ); hmac_update ( digest, digest_ctx, data, len ); hmac_final ( digest, digest_ctx, cipherspec->mac_secret, &digest->digestsize, hmac ); } /** * Allocate and assemble stream-ciphered record from data and MAC portions * * @v tls TLS session * @ret data Data * @ret len Length of data * @ret digest MAC digest * @ret plaintext_len Length of plaintext record * @ret plaintext Allocated plaintext record */ static void * __malloc tls_assemble_stream ( struct tls_session *tls, const void *data, size_t len, void *digest, size_t *plaintext_len ) { size_t mac_len = tls->tx_cipherspec.digest->digestsize; void *plaintext; void *content; void *mac; /* Calculate stream-ciphered struct length */ *plaintext_len = ( len + mac_len ); /* Allocate stream-ciphered struct */ plaintext = malloc ( *plaintext_len ); if ( ! plaintext ) return NULL; content = plaintext; mac = ( content + len ); /* Fill in stream-ciphered struct */ memcpy ( content, data, len ); memcpy ( mac, digest, mac_len ); return plaintext; } /** * Allocate and assemble block-ciphered record from data and MAC portions * * @v tls TLS session * @ret data Data * @ret len Length of data * @ret digest MAC digest * @ret plaintext_len Length of plaintext record * @ret plaintext Allocated plaintext record */ static void * tls_assemble_block ( struct tls_session *tls, const void *data, size_t len, void *digest, size_t *plaintext_len ) { size_t blocksize = tls->tx_cipherspec.cipher->blocksize; size_t iv_len = blocksize; size_t mac_len = tls->tx_cipherspec.digest->digestsize; size_t padding_len; void *plaintext; void *iv; void *content; void *mac; void *padding; /* FIXME: TLSv1.1 has an explicit IV */ iv_len = 0; /* Calculate block-ciphered struct length */ padding_len = ( ( blocksize - 1 ) & -( iv_len + len + mac_len + 1 ) ); *plaintext_len = ( iv_len + len + mac_len + padding_len + 1 ); /* Allocate block-ciphered struct */ plaintext = malloc ( *plaintext_len ); if ( ! plaintext ) return NULL; iv = plaintext; content = ( iv + iv_len ); mac = ( content + len ); padding = ( mac + mac_len ); /* Fill in block-ciphered struct */ memset ( iv, 0, iv_len ); memcpy ( content, data, len ); memcpy ( mac, digest, mac_len ); memset ( padding, padding_len, ( padding_len + 1 ) ); return plaintext; } /** * Send plaintext record * * @v tls TLS session * @v type Record type * @v data Plaintext record * @v len Length of plaintext record * @ret rc Return status code */ static int tls_send_plaintext ( struct tls_session *tls, unsigned int type, const void *data, size_t len ) { struct tls_header plaintext_tlshdr; struct tls_header *tlshdr; struct tls_cipherspec *cipherspec = &tls->tx_cipherspec; void *plaintext = NULL; size_t plaintext_len; struct io_buffer *ciphertext = NULL; size_t ciphertext_len; size_t mac_len = cipherspec->digest->digestsize; uint8_t mac[mac_len]; int rc; /* Construct header */ plaintext_tlshdr.type = type; plaintext_tlshdr.version = htons ( TLS_VERSION_TLS_1_0 ); plaintext_tlshdr.length = htons ( len ); /* Calculate MAC */ tls_hmac ( tls, cipherspec, tls->tx_seq, &plaintext_tlshdr, data, len, mac ); /* Allocate and assemble plaintext struct */ if ( is_stream_cipher ( cipherspec->cipher ) ) { plaintext = tls_assemble_stream ( tls, data, len, mac, &plaintext_len ); } else { plaintext = tls_assemble_block ( tls, data, len, mac, &plaintext_len ); } if ( ! plaintext ) { DBGC ( tls, "TLS %p could not allocate %zd bytes for " "plaintext\n", tls, plaintext_len ); rc = -ENOMEM; goto done; } DBGC2 ( tls, "Sending plaintext data:\n" ); DBGC2_HD ( tls, plaintext, plaintext_len ); /* Allocate ciphertext */ ciphertext_len = ( sizeof ( *tlshdr ) + plaintext_len ); ciphertext = xfer_alloc_iob ( &tls->cipherstream.xfer, ciphertext_len ); if ( ! ciphertext ) { DBGC ( tls, "TLS %p could not allocate %zd bytes for " "ciphertext\n", tls, ciphertext_len ); rc = -ENOMEM; goto done; } /* Assemble ciphertext */ tlshdr = iob_put ( ciphertext, sizeof ( *tlshdr ) ); tlshdr->type = type; tlshdr->version = htons ( TLS_VERSION_TLS_1_0 ); tlshdr->length = htons ( plaintext_len ); memcpy ( cipherspec->cipher_next_ctx, cipherspec->cipher_ctx, cipherspec->cipher->ctxsize ); cipher_encrypt ( cipherspec->cipher, cipherspec->cipher_next_ctx, plaintext, iob_put ( ciphertext, plaintext_len ), plaintext_len ); /* Free plaintext as soon as possible to conserve memory */ free ( plaintext ); plaintext = NULL; /* Send ciphertext */ rc = xfer_deliver_iob ( &tls->cipherstream.xfer, ciphertext ); ciphertext = NULL; if ( rc != 0 ) { DBGC ( tls, "TLS %p could not deliver ciphertext: %s\n", tls, strerror ( rc ) ); goto done; } /* Update TX state machine to next record */ tls->tx_seq += 1; memcpy ( tls->tx_cipherspec.cipher_ctx, tls->tx_cipherspec.cipher_next_ctx, tls->tx_cipherspec.cipher->ctxsize ); done: free ( plaintext ); free_iob ( ciphertext ); return rc; } /** * Split stream-ciphered record into data and MAC portions * * @v tls TLS session * @v plaintext Plaintext record * @v plaintext_len Length of record * @ret data Data * @ret len Length of data * @ret digest MAC digest * @ret rc Return status code */ static int tls_split_stream ( struct tls_session *tls, void *plaintext, size_t plaintext_len, void **data, size_t *len, void **digest ) { void *content; size_t content_len; void *mac; size_t mac_len; /* Decompose stream-ciphered data */ mac_len = tls->rx_cipherspec.digest->digestsize; if ( plaintext_len < mac_len ) { DBGC ( tls, "TLS %p received underlength record\n", tls ); DBGC_HD ( tls, plaintext, plaintext_len ); return -EINVAL; } content_len = ( plaintext_len - mac_len ); content = plaintext; mac = ( content + content_len ); /* Fill in return values */ *data = content; *len = content_len; *digest = mac; return 0; } /** * Split block-ciphered record into data and MAC portions * * @v tls TLS session * @v plaintext Plaintext record * @v plaintext_len Length of record * @ret data Data * @ret len Length of data * @ret digest MAC digest * @ret rc Return status code */ static int tls_split_block ( struct tls_session *tls, void *plaintext, size_t plaintext_len, void **data, size_t *len, void **digest ) { void *iv; size_t iv_len; void *content; size_t content_len; void *mac; size_t mac_len; void *padding; size_t padding_len; unsigned int i; /* Decompose block-ciphered data */ if ( plaintext_len < 1 ) { DBGC ( tls, "TLS %p received underlength record\n", tls ); DBGC_HD ( tls, plaintext, plaintext_len ); return -EINVAL; } iv_len = tls->rx_cipherspec.cipher->blocksize; /* FIXME: TLSv1.1 uses an explicit IV */ iv_len = 0; mac_len = tls->rx_cipherspec.digest->digestsize; padding_len = *( ( uint8_t * ) ( plaintext + plaintext_len - 1 ) ); if ( plaintext_len < ( iv_len + mac_len + padding_len + 1 ) ) { DBGC ( tls, "TLS %p received underlength record\n", tls ); DBGC_HD ( tls, plaintext, plaintext_len ); return -EINVAL; } content_len = ( plaintext_len - iv_len - mac_len - padding_len - 1 ); iv = plaintext; content = ( iv + iv_len ); mac = ( content + content_len ); padding = ( mac + mac_len ); /* Verify padding bytes */ for ( i = 0 ; i < padding_len ; i++ ) { if ( *( ( uint8_t * ) ( padding + i ) ) != padding_len ) { DBGC ( tls, "TLS %p received bad padding\n", tls ); DBGC_HD ( tls, plaintext, plaintext_len ); return -EINVAL; } } /* Fill in return values */ *data = content; *len = content_len; *digest = mac; return 0; } /** * Receive new ciphertext record * * @v tls TLS session * @v tlshdr Record header * @v ciphertext Ciphertext record * @ret rc Return status code */ static int tls_new_ciphertext ( struct tls_session *tls, struct tls_header *tlshdr, void *ciphertext ) { struct tls_header plaintext_tlshdr; struct tls_cipherspec *cipherspec = &tls->rx_cipherspec; size_t record_len = ntohs ( tlshdr->length ); void *plaintext = NULL; void *data; size_t len; void *mac; size_t mac_len = cipherspec->digest->digestsize; uint8_t verify_mac[mac_len]; int rc; /* Allocate buffer for plaintext */ plaintext = malloc ( record_len ); if ( ! plaintext ) { DBGC ( tls, "TLS %p could not allocate %zd bytes for " "decryption buffer\n", tls, record_len ); rc = -ENOMEM; goto done; } /* Decrypt the record */ cipher_decrypt ( cipherspec->cipher, cipherspec->cipher_ctx, ciphertext, plaintext, record_len ); /* Split record into content and MAC */ if ( is_stream_cipher ( cipherspec->cipher ) ) { if ( ( rc = tls_split_stream ( tls, plaintext, record_len, &data, &len, &mac ) ) != 0 ) goto done; } else { if ( ( rc = tls_split_block ( tls, plaintext, record_len, &data, &len, &mac ) ) != 0 ) goto done; } /* Verify MAC */ plaintext_tlshdr.type = tlshdr->type; plaintext_tlshdr.version = tlshdr->version; plaintext_tlshdr.length = htons ( len ); tls_hmac ( tls, cipherspec, tls->rx_seq, &plaintext_tlshdr, data, len, verify_mac); if ( memcmp ( mac, verify_mac, mac_len ) != 0 ) { DBGC ( tls, "TLS %p failed MAC verification\n", tls ); DBGC_HD ( tls, plaintext, record_len ); goto done; } DBGC2 ( tls, "Received plaintext data:\n" ); DBGC2_HD ( tls, data, len ); /* Process plaintext record */ if ( ( rc = tls_new_record ( tls, tlshdr->type, data, len ) ) != 0 ) goto done; rc = 0; done: free ( plaintext ); return rc; } /****************************************************************************** * * Plaintext stream operations * ****************************************************************************** */ /** * Close interface * * @v xfer Plainstream data transfer interface * @v rc Reason for close */ static void tls_plainstream_close ( struct xfer_interface *xfer, int rc ) { struct tls_session *tls = container_of ( xfer, struct tls_session, plainstream.xfer ); tls_close ( tls, rc ); } /** * Check flow control window * * @v xfer Plainstream data transfer interface * @ret len Length of window */ static size_t tls_plainstream_window ( struct xfer_interface *xfer ) { struct tls_session *tls = container_of ( xfer, struct tls_session, plainstream.xfer ); /* Block window unless we are ready to accept data */ if ( tls->tx_state != TLS_TX_DATA ) return 0; return filter_window ( xfer ); } /** * Deliver datagram as raw data * * @v xfer Plainstream data transfer interface * @v data Data buffer * @v len Length of data buffer * @ret rc Return status code */ static int tls_plainstream_deliver_raw ( struct xfer_interface *xfer, const void *data, size_t len ) { struct tls_session *tls = container_of ( xfer, struct tls_session, plainstream.xfer ); /* Refuse unless we are ready to accept data */ if ( tls->tx_state != TLS_TX_DATA ) return -ENOTCONN; return tls_send_plaintext ( tls, TLS_TYPE_DATA, data, len ); } /** TLS plaintext stream operations */ static struct xfer_interface_operations tls_plainstream_operations = { .close = tls_plainstream_close, .vredirect = ignore_xfer_vredirect, .window = tls_plainstream_window, .alloc_iob = default_xfer_alloc_iob, .deliver_iob = xfer_deliver_as_raw, .deliver_raw = tls_plainstream_deliver_raw, }; /****************************************************************************** * * Ciphertext stream operations * ****************************************************************************** */ /** * Close interface * * @v xfer Plainstream data transfer interface * @v rc Reason for close */ static void tls_cipherstream_close ( struct xfer_interface *xfer, int rc ) { struct tls_session *tls = container_of ( xfer, struct tls_session, cipherstream.xfer ); tls_close ( tls, rc ); } /** * Handle received TLS header * * @v tls TLS session * @ret rc Returned status code */ static int tls_newdata_process_header ( struct tls_session *tls ) { size_t data_len = ntohs ( tls->rx_header.length ); /* Allocate data buffer now that we know the length */ assert ( tls->rx_data == NULL ); tls->rx_data = malloc ( data_len ); if ( ! tls->rx_data ) { DBGC ( tls, "TLS %p could not allocate %zd bytes " "for receive buffer\n", tls, data_len ); return -ENOMEM; } /* Move to data state */ tls->rx_state = TLS_RX_DATA; return 0; } /** * Handle received TLS data payload * * @v tls TLS session * @ret rc Returned status code */ static int tls_newdata_process_data ( struct tls_session *tls ) { int rc; /* Process record */ if ( ( rc = tls_new_ciphertext ( tls, &tls->rx_header, tls->rx_data ) ) != 0 ) return rc; /* Increment RX sequence number */ tls->rx_seq += 1; /* Free data buffer */ free ( tls->rx_data ); tls->rx_data = NULL; /* Return to header state */ tls->rx_state = TLS_RX_HEADER; return 0; } /** * Receive new ciphertext * * @v app Stream application * @v data Data received * @v len Length of received data * @ret rc Return status code */ static int tls_cipherstream_deliver_raw ( struct xfer_interface *xfer, const void *data, size_t len ) { struct tls_session *tls = container_of ( xfer, struct tls_session, cipherstream.xfer ); size_t frag_len; void *buf; size_t buf_len; int ( * process ) ( struct tls_session *tls ); int rc; while ( len ) { /* Select buffer according to current state */ switch ( tls->rx_state ) { case TLS_RX_HEADER: buf = &tls->rx_header; buf_len = sizeof ( tls->rx_header ); process = tls_newdata_process_header; break; case TLS_RX_DATA: buf = tls->rx_data; buf_len = ntohs ( tls->rx_header.length ); process = tls_newdata_process_data; break; default: assert ( 0 ); return -EINVAL; } /* Copy data portion to buffer */ frag_len = ( buf_len - tls->rx_rcvd ); if ( frag_len > len ) frag_len = len; memcpy ( ( buf + tls->rx_rcvd ), data, frag_len ); tls->rx_rcvd += frag_len; data += frag_len; len -= frag_len; /* Process data if buffer is now full */ if ( tls->rx_rcvd == buf_len ) { if ( ( rc = process ( tls ) ) != 0 ) { tls_close ( tls, rc ); return rc; } tls->rx_rcvd = 0; } } return 0; } /** TLS ciphertext stream operations */ static struct xfer_interface_operations tls_cipherstream_operations = { .close = tls_cipherstream_close, .vredirect = xfer_vreopen, .window = filter_window, .alloc_iob = default_xfer_alloc_iob, .deliver_iob = xfer_deliver_as_raw, .deliver_raw = tls_cipherstream_deliver_raw, }; /****************************************************************************** * * Controlling process * ****************************************************************************** */ /** * TLS TX state machine * * @v process TLS process */ static void tls_step ( struct process *process ) { struct tls_session *tls = container_of ( process, struct tls_session, process ); int rc; /* Wait for cipherstream to become ready */ if ( ! xfer_window ( &tls->cipherstream.xfer ) ) return; switch ( tls->tx_state ) { case TLS_TX_NONE: /* Nothing to do */ break; case TLS_TX_CLIENT_HELLO: /* Send Client Hello */ if ( ( rc = tls_send_client_hello ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Client Hello: %s\n", tls, strerror ( rc ) ); goto err; } tls->tx_state = TLS_TX_NONE; break; case TLS_TX_CLIENT_KEY_EXCHANGE: /* Send Client Key Exchange */ if ( ( rc = tls_send_client_key_exchange ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could send Client Key Exchange: " "%s\n", tls, strerror ( rc ) ); goto err; } tls->tx_state = TLS_TX_CHANGE_CIPHER; break; case TLS_TX_CHANGE_CIPHER: /* Send Change Cipher, and then change the cipher in use */ if ( ( rc = tls_send_change_cipher ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Change Cipher: " "%s\n", tls, strerror ( rc ) ); goto err; } if ( ( rc = tls_change_cipher ( tls, &tls->tx_cipherspec_pending, &tls->tx_cipherspec )) != 0 ){ DBGC ( tls, "TLS %p could not activate TX cipher: " "%s\n", tls, strerror ( rc ) ); goto err; } tls->tx_seq = 0; tls->tx_state = TLS_TX_FINISHED; break; case TLS_TX_FINISHED: /* Send Finished */ if ( ( rc = tls_send_finished ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Finished: %s\n", tls, strerror ( rc ) ); goto err; } tls->tx_state = TLS_TX_NONE; break; case TLS_TX_DATA: /* Nothing to do */ break; default: assert ( 0 ); } return; err: tls_close ( tls, rc ); } /****************************************************************************** * * Instantiator * ****************************************************************************** */ int add_tls ( struct xfer_interface *xfer, struct xfer_interface **next ) { struct tls_session *tls; /* Allocate and initialise TLS structure */ tls = malloc ( sizeof ( *tls ) ); if ( ! tls ) return -ENOMEM; memset ( tls, 0, sizeof ( *tls ) ); tls->refcnt.free = free_tls; filter_init ( &tls->plainstream, &tls_plainstream_operations, &tls->cipherstream, &tls_cipherstream_operations, &tls->refcnt ); tls_clear_cipher ( tls, &tls->tx_cipherspec ); tls_clear_cipher ( tls, &tls->tx_cipherspec_pending ); tls_clear_cipher ( tls, &tls->rx_cipherspec ); tls_clear_cipher ( tls, &tls->rx_cipherspec_pending ); tls->client_random.gmt_unix_time = 0; tls_generate_random ( &tls->client_random.random, ( sizeof ( tls->client_random.random ) ) ); tls->pre_master_secret.version = htons ( TLS_VERSION_TLS_1_0 ); tls_generate_random ( &tls->pre_master_secret.random, ( sizeof ( tls->pre_master_secret.random ) ) ); digest_init ( &md5_algorithm, tls->handshake_md5_ctx ); digest_init ( &sha1_algorithm, tls->handshake_sha1_ctx ); tls->tx_state = TLS_TX_CLIENT_HELLO; process_init ( &tls->process, tls_step, &tls->refcnt ); /* Attach to parent interface, mortalise self, and return */ xfer_plug_plug ( &tls->plainstream.xfer, xfer ); *next = &tls->cipherstream.xfer; ref_put ( &tls->refcnt ); return 0; }