1 \ Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 \ Permission is hereby granted, free of charge, to any person obtaining
4 \ a copy of this software and associated documentation files (the
5 \ "Software"), to deal in the Software without restriction, including
6 \ without limitation the rights to use, copy, modify, merge, publish,
7 \ distribute, sublicense, and/or sell copies of the Software, and to
8 \ permit persons to whom the Software is furnished to do so, subject to
9 \ the following conditions:
11 \ The above copyright notice and this permission notice shall be
12 \ included in all copies or substantial portions of the Software.
14 \ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
15 \ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16 \ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
17 \ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
18 \ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
19 \ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
20 \ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 \ ----------------------------------------------------------------------
24 \ Handshake processing code, for the client.
25 \ The common T0 code (ssl_hs_common.t0) shall be read first.
30 * This macro evaluates to a pointer to the client context, under that
31 * specific name. It must be noted that since the engine context is the
32 * first field of the br_ssl_client_context structure ('eng'), then
33 * pointers values of both types are interchangeable, modulo an
34 * appropriate cast. This also means that "adresses" computed as offsets
35 * within the structure work for both kinds of context.
37 #define CTX ((br_ssl_client_context *)ENG)
40 * Generate the pre-master secret for RSA key exchange, and encrypt it
41 * with the server's public key. Returned value is either the encrypted
42 * data length (in bytes), or -x on error, with 'x' being an error code.
44 * This code assumes that the public key has been already verified (it
45 * was properly obtained by the X.509 engine, and it has the right type,
46 * i.e. it is of type RSA and suitable for encryption).
49 make_pms_rsa(br_ssl_client_context *ctx, int prf_id)
51 const br_x509_class **xc;
52 const br_x509_pkey *pk;
53 const unsigned char *n;
57 xc = ctx->eng.x509ctx;
58 pk = (*xc)->get_pkey(xc, NULL);
61 * Compute actual RSA key length, in case there are leading zeros.
64 nlen = pk->key.rsa.nlen;
65 while (nlen > 0 && *n == 0) {
71 * We need at least 59 bytes (48 bytes for pre-master secret, and
72 * 11 bytes for the PKCS#1 type 2 padding). Note that the X.509
73 * minimal engine normally blocks RSA keys shorter than 128 bytes,
74 * so this is mostly for public keys provided explicitly by the
78 return -BR_ERR_X509_WEAK_PUBLIC_KEY;
80 if (nlen > sizeof ctx->eng.pad) {
81 return -BR_ERR_LIMIT_EXCEEDED;
87 pms = ctx->eng.pad + nlen - 48;
88 br_enc16be(pms, ctx->eng.version_max);
89 br_hmac_drbg_generate(&ctx->eng.rng, pms + 2, 46);
90 br_ssl_engine_compute_master(&ctx->eng, prf_id, pms, 48);
93 * Apply PKCS#1 type 2 padding.
95 ctx->eng.pad[0] = 0x00;
96 ctx->eng.pad[1] = 0x02;
97 ctx->eng.pad[nlen - 49] = 0x00;
98 br_hmac_drbg_generate(&ctx->eng.rng, ctx->eng.pad + 2, nlen - 51);
99 for (u = 2; u < nlen - 49; u ++) {
100 while (ctx->eng.pad[u] == 0) {
101 br_hmac_drbg_generate(&ctx->eng.rng,
102 &ctx->eng.pad[u], 1);
107 * Compute RSA encryption.
109 if (!ctx->irsapub(ctx->eng.pad, nlen, &pk->key.rsa)) {
110 return -BR_ERR_LIMIT_EXCEEDED;
116 * OID for hash functions in RSA signatures.
118 static const unsigned char HASH_OID_SHA1[] = {
119 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A
122 static const unsigned char HASH_OID_SHA224[] = {
123 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
126 static const unsigned char HASH_OID_SHA256[] = {
127 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
130 static const unsigned char HASH_OID_SHA384[] = {
131 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
134 static const unsigned char HASH_OID_SHA512[] = {
135 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
138 static const unsigned char *HASH_OID[] = {
147 * Check the RSA signature on the ServerKeyExchange message.
149 * hash hash function ID (2 to 6), or 0 for MD5+SHA-1 (with RSA only)
150 * use_rsa non-zero for RSA signature, zero for ECDSA
151 * sig_len signature length (in bytes); signature value is in the pad
153 * Returned value is 0 on success, or an error code.
156 verify_SKE_sig(br_ssl_client_context *ctx,
157 int hash, int use_rsa, size_t sig_len)
159 const br_x509_class **xc;
160 const br_x509_pkey *pk;
161 br_multihash_context mhc;
162 unsigned char hv[64], head[4];
165 xc = ctx->eng.x509ctx;
166 pk = (*xc)->get_pkey(xc, NULL);
167 br_multihash_zero(&mhc);
168 br_multihash_copyimpl(&mhc, &ctx->eng.mhash);
169 br_multihash_init(&mhc);
170 br_multihash_update(&mhc,
171 ctx->eng.client_random, sizeof ctx->eng.client_random);
172 br_multihash_update(&mhc,
173 ctx->eng.server_random, sizeof ctx->eng.server_random);
176 head[2] = ctx->eng.ecdhe_curve;
177 head[3] = ctx->eng.ecdhe_point_len;
178 br_multihash_update(&mhc, head, sizeof head);
179 br_multihash_update(&mhc,
180 ctx->eng.ecdhe_point, ctx->eng.ecdhe_point_len);
182 hv_len = br_multihash_out(&mhc, hash, hv);
184 return BR_ERR_INVALID_ALGORITHM;
187 if (!br_multihash_out(&mhc, br_md5_ID, hv)
188 || !br_multihash_out(&mhc, br_sha1_ID, hv + 16))
190 return BR_ERR_INVALID_ALGORITHM;
195 unsigned char tmp[64];
196 const unsigned char *hash_oid;
199 hash_oid = HASH_OID[hash - 2];
203 if (!ctx->eng.irsavrfy(ctx->eng.pad, sig_len,
204 hash_oid, hv_len, &pk->key.rsa, tmp)
205 || memcmp(tmp, hv, hv_len) != 0)
207 return BR_ERR_BAD_SIGNATURE;
210 if (!ctx->eng.iecdsa(ctx->eng.iec, hv, hv_len, &pk->key.ec,
211 ctx->eng.pad, sig_len))
213 return BR_ERR_BAD_SIGNATURE;
220 * Perform client-side ECDH (or ECDHE). The point that should be sent to
221 * the server is written in the pad; returned value is either the point
222 * length (in bytes), or -x on error, with 'x' being an error code.
224 * The point _from_ the server is taken from ecdhe_point[] if 'ecdhe'
225 * is non-zero, or from the X.509 engine context if 'ecdhe' is zero
229 make_pms_ecdh(br_ssl_client_context *ctx, unsigned ecdhe, int prf_id)
232 unsigned char key[66], point[133];
233 const unsigned char *generator, *order, *point_src;
234 size_t glen, olen, point_len;
238 curve = ctx->eng.ecdhe_curve;
239 point_src = ctx->eng.ecdhe_point;
240 point_len = ctx->eng.ecdhe_point_len;
242 const br_x509_class **xc;
243 const br_x509_pkey *pk;
245 xc = ctx->eng.x509ctx;
246 pk = (*xc)->get_pkey(xc, NULL);
247 curve = pk->key.ec.curve;
248 point_src = pk->key.ec.q;
249 point_len = pk->key.ec.qlen;
251 if ((ctx->eng.iec->supported_curves & ((uint32_t)1 << curve)) == 0) {
252 return -BR_ERR_INVALID_ALGORITHM;
256 * We need to generate our key, as a non-zero random value which
257 * is lower than the curve order, in a "large enough" range. We
258 * force top bit to 0 and bottom bit to 1, which guarantees that
259 * the value is in the proper range.
261 order = ctx->eng.iec->order(curve, &olen);
263 while (mask >= order[0]) {
266 br_hmac_drbg_generate(&ctx->eng.rng, key, olen);
268 key[olen - 1] |= 0x01;
271 * Compute the common ECDH point, whose X coordinate is the
274 generator = ctx->eng.iec->generator(curve, &glen);
275 if (glen != point_len) {
276 return -BR_ERR_INVALID_ALGORITHM;
279 memcpy(point, point_src, glen);
280 if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
281 return -BR_ERR_INVALID_ALGORITHM;
285 * The pre-master secret is the X coordinate.
287 br_ssl_engine_compute_master(&ctx->eng, prf_id, point + 1, glen >> 1);
289 memcpy(point, generator, glen);
290 if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
291 return -BR_ERR_INVALID_ALGORITHM;
293 memcpy(ctx->eng.pad, point, glen);
298 * Perform full static ECDH. This occurs only in the context of client
299 * authentication with certificates: the server uses an EC public key,
300 * the cipher suite is of type ECDH (not ECDHE), the server requested a
301 * client certificate and accepts static ECDH, the client has a
302 * certificate with an EC public key in the same curve, and accepts
303 * static ECDH as well.
305 * Returned value is 0 on success, -1 on error.
308 make_pms_static_ecdh(br_ssl_client_context *ctx, int prf_id)
310 unsigned char point[133];
312 const br_x509_class **xc;
313 const br_x509_pkey *pk;
315 xc = ctx->eng.x509ctx;
316 pk = (*xc)->get_pkey(xc, NULL);
317 point_len = pk->key.ec.qlen;
318 if (point_len > sizeof point) {
321 memcpy(point, pk->key.ec.q, point_len);
322 if (!(*ctx->client_auth_vtable)->do_keyx(
323 ctx->client_auth_vtable, point, point_len))
327 br_ssl_engine_compute_master(&ctx->eng,
328 prf_id, point + 1, point_len >> 1);
333 * Compute the client-side signature. This is invoked only when a
334 * signature-based client authentication was selected. The computed
335 * signature is in the pad; its length (in bytes) is returned. On
336 * error, 0 is returned.
339 make_client_sign(br_ssl_client_context *ctx)
344 * Compute hash of handshake messages so far. This "cannot" fail
345 * because the list of supported hash functions provided to the
346 * client certificate handler was trimmed to include only the
347 * hash functions that the multi-hasher supports.
350 hv_len = br_multihash_out(&ctx->eng.mhash,
351 ctx->hash_id, ctx->eng.pad);
353 br_multihash_out(&ctx->eng.mhash,
354 br_md5_ID, ctx->eng.pad);
355 br_multihash_out(&ctx->eng.mhash,
356 br_sha1_ID, ctx->eng.pad + 16);
359 return (*ctx->client_auth_vtable)->do_sign(
360 ctx->client_auth_vtable, ctx->hash_id, hv_len,
361 ctx->eng.pad, sizeof ctx->eng.pad);
366 \ =======================================================================
370 "addr-" field + 0 1 define-word
371 0 8191 "offsetof(br_ssl_client_context, " field + ")" + make-CX
372 postpone literal postpone ; ;
374 addr-ctx: min_clienthello_len
379 \ Length of the Secure Renegotiation extension. This is 5 for the
380 \ first handshake, 17 for a renegotiation (if the server supports the
381 \ extension), or 0 if we know that the server does not support the
383 : ext-reneg-length ( -- n )
384 addr-reneg get8 dup if 1 - 17 * else drop 5 then ;
386 \ Length of SNI extension.
387 : ext-sni-length ( -- len )
388 addr-server_name strlen dup if 9 + then ;
390 \ Length of Maximum Fragment Length extension.
391 : ext-frag-length ( -- len )
392 addr-log_max_frag_len get8 14 = if 0 else 5 then ;
394 \ Length of Signatures extension.
395 : ext-signatures-length ( -- len )
396 supported-hash-functions { x } drop
398 supports-rsa-sign? if x + then
399 supports-ecdsa? if x + then
400 dup if 1 << 6 + then ;
402 \ Write supported hash functions ( sign -- )
405 supported-hash-functions drop
406 \ We advertise hash functions in the following preference order:
407 \ SHA-256 SHA-224 SHA-384 SHA-512 SHA-1
409 \ -- SHA-256 and SHA-224 are more efficient on 32-bit architectures
410 \ -- SHA-1 is less than ideally collision-resistant
411 dup 0x10 and if 4 write8 sign write8 then
412 dup 0x08 and if 3 write8 sign write8 then
413 dup 0x20 and if 5 write8 sign write8 then
414 dup 0x40 and if 6 write8 sign write8 then
415 0x04 and if 2 write8 sign write8 then ;
417 \ Length of Supported Curves extension.
418 : ext-supported-curves-length ( -- len )
419 supported-curves dup if
428 \ Length of Supported Point Formats extension.
429 : ext-point-format-length ( -- len )
430 supported-curves if 6 else 0 then ;
432 \ Length of ALPN extension.
433 cc: ext-ALPN-length ( -- len ) {
436 if (ENG->protocol_names_num == 0) {
441 for (u = 0; u < ENG->protocol_names_num; u ++) {
442 len += 1 + strlen(ENG->protocol_names[u]);
447 \ Write handshake message: ClientHello
448 : write-ClientHello ( -- )
449 { ; total-ext-length }
451 \ Compute length for extensions (without the general two-byte header).
452 \ This does not take padding extension into account.
453 ext-reneg-length ext-sni-length + ext-frag-length +
454 ext-signatures-length +
455 ext-supported-curves-length + ext-point-format-length +
462 \ Compute and write length
463 39 addr-session_id_len get8 + addr-suites_num get8 1 << +
464 total-ext-length if 2+ total-ext-length + then
465 \ Compute padding (if requested).
466 addr-min_clienthello_len get16 over - dup 0> if
467 \ We well add a Pad ClientHello extension, which has its
468 \ own header (4 bytes) and might be the only extension
469 \ (2 extra bytes for the extension list header).
470 total-ext-length ifnot swap 2+ swap 2- then
471 \ Account for the extension header.
472 4 - dup 0< if drop 0 then
473 \ Adjust total extension length.
474 dup 4 + total-ext-length + >total-ext-length
475 \ Adjust ClientHello length.
481 { ext-padding-amount }
485 addr-version_max get16 write16
488 addr-client_random 4 bzero
489 addr-client_random 4 + 28 mkrand
490 addr-client_random 32 write-blob
493 addr-session_id addr-session_id_len get8 write-blob-head8
495 \ Supported cipher suites. We also check here that we indeed
496 \ support all these suites.
497 addr-suites_num get8 dup 1 << write16
502 dup suite-supported? ifnot ERR_BAD_CIPHER_SUITE fail then
508 \ Compression methods (only "null" compression)
513 total-ext-length write16
515 0xFF01 write16 \ extension type (0xFF01)
517 ext-reneg-length 4 - dup write16 \ extension length
518 1- write-blob-head8 \ verify data
521 0x0000 write16 \ extension type (0)
523 ext-sni-length 4 - dup write16 \ extension length
524 2 - dup write16 \ ServerNameList length
525 0 write8 \ name type: host_name
526 3 - write-blob-head16 \ the name itself
529 0x0001 write16 \ extension type (1)
530 0x0001 write16 \ extension length
531 addr-log_max_frag_len get8 8 - write8
533 ext-signatures-length if
534 0x000D write16 \ extension type (13)
535 ext-signatures-length 4 - dup write16 \ extension length
536 2 - write16 \ list length
537 supports-ecdsa? if 3 write-hashes then
538 supports-rsa-sign? if 1 write-hashes then
540 \ TODO: add an API to specify preference order for curves.
541 \ Right now we use increasing id order, which makes P-256
542 \ the preferred curve.
543 ext-supported-curves-length dup if
544 0x000A write16 \ extension type (10)
545 4 - dup write16 \ extension length
546 2- write16 \ list length
549 dup2 >> 1 and if dup write16 then
556 ext-point-format-length if
557 0x000B write16 \ extension type (11)
558 0x0002 write16 \ extension length
559 0x0100 write16 \ value: 1 format: uncompressed
561 ext-ALPN-length dup if
562 0x0010 write16 \ extension type (16)
563 4 - dup write16 \ extension length
564 2- write16 \ list length
565 addr-protocol_names_num get16 0
568 dup copy-protocol-name
569 dup write8 addr-pad swap write-blob
576 ext-padding-amount 0< ifnot
577 0x0015 write16 \ extension value (21)
579 dup write16 \ extension length
581 1- 0 write8 repeat \ value (only zeros)
587 \ =======================================================================
589 \ Parse server SNI extension. If present, then it should be empty.
590 : read-server-sni ( lim -- lim )
591 read16 if ERR_BAD_SNI fail then ;
593 \ Parse server Max Fragment Length extension. If present, then it should
594 \ advertise the same length as the client. Note that whether the server
595 \ sends it or not changes nothing for us: we won't send any record larger
596 \ than the advertised value anyway, and we will accept incoming records
597 \ up to our input buffer length.
598 : read-server-frag ( lim -- lim )
599 read16 1 = ifnot ERR_BAD_FRAGLEN fail then
600 read8 8 + addr-log_max_frag_len get8 = ifnot ERR_BAD_FRAGLEN fail then ;
602 \ Parse server Secure Renegotiation extension. This is called only if
603 \ the client sent that extension, so we only have two cases to
604 \ distinguish: first handshake, and renegotiation; in the latter case,
605 \ we know that the server supports the extension, otherwise the client
606 \ would not have sent it.
607 : read-server-reneg ( lim -- lim )
609 addr-reneg get8 ifnot
610 \ "reneg" is 0, so this is a first handshake. The server's
611 \ extension MUST be empty. We also learn that the server
612 \ supports the extension.
613 1 = ifnot ERR_BAD_SECRENEG fail then
614 read8 0 = ifnot ERR_BAD_SECRENEG fail then
617 \ "reneg" is non-zero, and we sent an extension, so it must
618 \ be 2 and this is a renegotiation. We must verify that
619 \ the extension contents have length exactly 24 bytes and
620 \ match the saved client and server "Finished".
621 25 = ifnot ERR_BAD_SECRENEG fail then
622 read8 24 = ifnot ERR_BAD_SECRENEG fail then
623 addr-pad 24 read-blob
624 addr-saved_finished addr-pad 24 memcmp ifnot
625 ERR_BAD_SECRENEG fail
629 \ Read the ALPN extension from the server. It must contain a single name,
630 \ and that name must match one of our names.
631 : read-ALPN-from-server ( lim -- lim )
632 \ Extension contents length.
634 \ Length of list of names.
636 \ There should be a single name.
637 read8 addr-pad swap dup { len } read-blob
640 len test-protocol-name dup 0< if
641 3 flag? if ERR_UNEXPECTED fail then
644 1+ addr-selected_protocol set16
647 \ Save a value in a 16-bit field, or check it in case of session resumption.
648 : check-resume ( val addr resume -- )
649 if get16 = ifnot ERR_RESUME_MISMATCH fail then else set16 then ;
651 cc: DEBUG-BLOB ( addr len -- ) {
652 extern int printf(const char *fmt, ...);
654 size_t len = T0_POP();
655 unsigned char *buf = (unsigned char *)CTX + T0_POP();
659 for (u = 0; u < len; u ++) {
663 printf(" %02x", buf[u]);
668 \ Parse incoming ServerHello. Returned value is true (-1) on session
670 : read-ServerHello ( -- bool )
671 \ Get header, and check message type.
672 read-handshake-header 2 = ifnot ERR_UNEXPECTED fail then
674 \ Get protocol version.
676 version addr-version_min get16 < version addr-version_max get16 > or if
677 ERR_UNSUPPORTED_VERSION fail
680 \ Enforce chosen version for subsequent records in both directions.
681 version addr-version_in get16 <> if ERR_BAD_VERSION fail then
682 version addr-version_out set16
685 addr-server_random 32 read-blob
687 \ The "session resumption" flag.
692 idlen 32 > if ERR_OVERSIZED_ID fail then
693 addr-pad idlen read-blob
694 idlen addr-session_id_len get8 = idlen 0 > and if
695 addr-session_id addr-pad idlen memcmp if
696 \ Server session ID is non-empty and matches what
697 \ we sent, so this is a session resumption.
701 addr-session_id addr-pad idlen memcpy
702 idlen addr-session_id_len set8
705 version addr-version resume check-resume
707 \ Cipher suite. We check that it is part of the list of cipher
708 \ suites that we advertised.
709 \ read16 { suite ; found }
711 \ addr-suites_buf dup addr-suites_num get8 1 << +
714 \ suite = found or >found
716 \ 2drop found ifnot ERR_BAD_CIPHER_SUITE fail then
718 dup scan-suite 0< if ERR_BAD_CIPHER_SUITE fail then
719 addr-cipher_suite resume check-resume
721 \ Compression method. Should be 0 (no compression).
722 read8 if ERR_BAD_COMPRESSION fail then
724 \ Parse extensions (if any). If there is no extension, then the
725 \ read limit (on the TOS) should be 0 at that point.
727 \ Length of extension list.
731 \ Enumerate extensions. For each of them, check that we
732 \ sent an extension of that type, and did not see it
733 \ yet; and then process it.
734 ext-sni-length { ok-sni }
735 ext-reneg-length { ok-reneg }
736 ext-frag-length { ok-frag }
737 ext-signatures-length { ok-signatures }
738 ext-supported-curves-length { ok-curves }
739 ext-point-format-length { ok-points }
740 ext-ALPN-length { ok-ALPN }
744 \ Server Name Indication. The server may
745 \ send such an extension if it uses the SNI
746 \ from the client, but that "response
747 \ extension" is supposed to be empty.
750 ERR_EXTRA_EXTENSION fail
756 \ Max Frag Length. The contents shall be
757 \ a single byte whose value matches the one
758 \ sent by the client.
761 ERR_EXTRA_EXTENSION fail
767 \ Secure Renegotiation.
770 ERR_EXTRA_EXTENSION fail
776 \ Signature Algorithms.
777 \ Normally, the server should never send this
778 \ extension (so says RFC 5246 #7.4.1.4.1),
779 \ but some existing servers do.
782 ERR_EXTRA_EXTENSION fail
791 ERR_EXTRA_EXTENSION fail
797 \ Supported Point Formats.
800 ERR_EXTRA_EXTENSION fail
809 ERR_EXTRA_EXTENSION fail
812 read-ALPN-from-server
815 ERR_EXTRA_EXTENSION fail
819 \ If we sent a secure renegotiation extension but did not
820 \ receive a response, then the server does not support
821 \ secure renegotiation. This is a hard failure if this
822 \ is a renegotiation.
824 ok-reneg 5 > if ERR_BAD_SECRENEG fail then
833 cc: set-server-curve ( -- ) {
834 const br_x509_class *xc;
835 const br_x509_pkey *pk;
837 xc = *(ENG->x509ctx);
838 pk = xc->get_pkey(ENG->x509ctx, NULL);
840 (pk->key_type == BR_KEYTYPE_EC) ? pk->key.ec.curve : 0;
843 \ Read Certificate message from server.
844 : read-Certificate-from-server ( -- )
845 addr-cipher_suite get16 expected-key-type
847 dup 0< if neg fail then
848 dup ifnot ERR_UNEXPECTED fail then
849 over and <> if ERR_WRONG_KEY_USAGE fail then
851 \ Set server curve (used for static ECDH).
854 \ Verify signature on ECDHE point sent by the server.
855 \ 'hash' is the hash function to use (1 to 6, or 0 for RSA with MD5+SHA-1)
856 \ 'use-rsa' is 0 for ECDSA, -1 for for RSA
857 \ 'sig-len' is the signature length (in bytes)
858 \ The signature itself is in the pad.
859 cc: verify-SKE-sig ( hash use-rsa sig-len -- err ) {
860 size_t sig_len = T0_POP();
861 int use_rsa = T0_POPi();
862 int hash = T0_POPi();
864 T0_PUSH(verify_SKE_sig(CTX, hash, use_rsa, sig_len));
867 \ Parse ServerKeyExchange
868 : read-ServerKeyExchange ( -- )
869 \ Get header, and check message type.
870 read-handshake-header 12 = ifnot ERR_UNEXPECTED fail then
872 \ We expect a named curve, and we must support it.
873 read8 3 = ifnot ERR_INVALID_ALGORITHM fail then
874 read16 dup addr-ecdhe_curve set8
875 dup 32 >= if ERR_INVALID_ALGORITHM fail then
876 supported-curves swap >> 1 and ifnot ERR_INVALID_ALGORITHM fail then
878 \ Read the server point.
880 dup 133 > if ERR_INVALID_ALGORITHM fail then
881 dup addr-ecdhe_point_len set8
882 addr-ecdhe_point swap read-blob
884 \ If using TLS-1.2+, then the hash function and signature algorithm
885 \ are explicitly provided; the signature algorithm must match what
886 \ the cipher suite specifies. With TLS-1.0 and 1.1, the signature
887 \ algorithm is inferred from the cipher suite, and the hash is
888 \ either MD5+SHA-1 (for RSA signatures) or SHA-1 (for ECDSA).
889 addr-version get16 0x0303 >= { tls1.2+ }
890 addr-cipher_suite get16 use-rsa-ecdhe? { use-rsa }
893 \ Read hash function; accept only the SHA-* identifiers
894 \ (from SHA-1 to SHA-512, no MD5 here).
896 dup dup 2 < swap 6 > or if ERR_INVALID_ALGORITHM fail then
899 \ Get expected signature algorithm and compare with what
900 \ the server just sent. Expected value is 1 for RSA, 3
901 \ for ECDSA. Note that 'use-rsa' evaluates to -1 for RSA,
903 use-rsa 1 << 3 + = ifnot ERR_INVALID_ALGORITHM fail then
905 \ For MD5+SHA-1, we set 'hash' to 0.
906 use-rsa if 0 >hash then
909 \ Read signature into the pad.
910 read16 dup { sig-len }
912 dup 512 > if ERR_LIMIT_EXCEEDED fail then
913 addr-pad swap read-blob
916 hash use-rsa sig-len verify-SKE-sig
917 dup if fail then drop
921 \ Client certificate: start processing of anchor names.
922 cc: anchor-dn-start-name-list ( -- ) {
923 if (CTX->client_auth_vtable != NULL) {
924 (*CTX->client_auth_vtable)->start_name_list(
925 CTX->client_auth_vtable);
929 \ Client certificate: start a new anchor DN (length is 16-bit).
930 cc: anchor-dn-start-name ( length -- ) {
934 if (CTX->client_auth_vtable != NULL) {
935 (*CTX->client_auth_vtable)->start_name(
936 CTX->client_auth_vtable, len);
940 \ Client certificate: push some data for current anchor DN.
941 cc: anchor-dn-append-name ( length -- ) {
945 if (CTX->client_auth_vtable != NULL) {
946 (*CTX->client_auth_vtable)->append_name(
947 CTX->client_auth_vtable, ENG->pad, len);
951 \ Client certificate: end current anchor DN.
952 cc: anchor-dn-end-name ( -- ) {
953 if (CTX->client_auth_vtable != NULL) {
954 (*CTX->client_auth_vtable)->end_name(
955 CTX->client_auth_vtable);
959 \ Client certificate: end list of anchor DN.
960 cc: anchor-dn-end-name-list ( -- ) {
961 if (CTX->client_auth_vtable != NULL) {
962 (*CTX->client_auth_vtable)->end_name_list(
963 CTX->client_auth_vtable);
967 \ Client certificate: obtain the client certificate chain.
968 cc: get-client-chain ( auth_types -- ) {
971 auth_types = T0_POP();
972 if (CTX->client_auth_vtable != NULL) {
973 br_ssl_client_certificate ux;
975 (*CTX->client_auth_vtable)->choose(CTX->client_auth_vtable,
976 CTX, auth_types, &ux);
977 CTX->auth_type = (unsigned char)ux.auth_type;
978 CTX->hash_id = (unsigned char)ux.hash_id;
979 ENG->chain = ux.chain;
980 ENG->chain_len = ux.chain_len;
987 \ Parse CertificateRequest. Header has already been read.
988 : read-contents-CertificateRequest ( lim -- )
989 \ Read supported client authentification types. We keep only
990 \ RSA, ECDSA, and ECDH.
1001 auth_types or >auth_types
1005 \ Full static ECDH is allowed only if the cipher suite is ECDH
1006 \ (not ECDHE). It would be theoretically feasible to use static
1007 \ ECDH on the client side with an ephemeral key pair from the
1008 \ server, but RFC 4492 (section 3) forbids it because ECDHE suites
1009 \ are supposed to provide forward secrecy, and static ECDH would
1010 \ negate that property.
1011 addr-cipher_suite get16 use-ecdh? ifnot
1012 auth_types 0xFFFF and >auth_types
1015 \ Note: if the cipher suite is ECDH, then the X.509 validation
1016 \ engine was invoked with the BR_KEYTYPE_EC | BR_KEYTYPE_KEYX
1017 \ combination, so the server's public key has already been
1018 \ checked to be fit for a key exchange.
1021 \ - rsa_fixed_ecdh and ecdsa_fixed_ecdh are synoymous.
1022 \ - There is an explicit list of supported sign+hash.
1024 addr-version get16 0x0303 >= if
1026 \ - There is an explicit list of supported sign+hash.
1027 \ - The ECDH flags must be adjusted for RSA/ECDSA
1029 read-list-sign-algos dup addr-hashes set16
1031 \ Trim down the list depending on what hash functions
1032 \ we support (since the hashing itself is done by the SSL
1033 \ engine, not by the certificate handler).
1034 supported-hash-functions drop dup 8 << or 0x030000 or and
1037 auth_types 0x030000 and if
1038 dup 0x0000FF and if 0x010000 or then
1039 dup 0x00FF00 and if 0x020000 or then
1043 \ TLS 1.0 or 1.1. The hash function is fixed for signatures
1044 \ (MD5+SHA-1 for RSA, SHA-1 for ECDSA).
1045 auth_types 0x030401 and >auth_types
1048 \ Parse list of anchor DN.
1049 anchor-dn-start-name-list
1053 dup anchor-dn-start-name
1055 \ We read the DN by chunks through the pad, so
1056 \ as to use the existing reading function (read-blob)
1057 \ that also ensures proper hashing.
1060 dup 256 > if 256 else dup then { len }
1061 addr-pad len read-blob
1062 len anchor-dn-append-name
1068 anchor-dn-end-name-list
1070 \ We should have reached the message end.
1073 \ Obtain the client chain.
1074 auth_types get-client-chain
1078 \ Write an empty Certificate message.
1079 \ : write-empty-Certificate ( -- )
1080 \ 11 write8 3 write24 0 write24 ;
1082 cc: do-rsa-encrypt ( prf_id -- nlen ) {
1085 x = make_pms_rsa(CTX, T0_POP());
1087 br_ssl_engine_fail(ENG, -x);
1094 cc: do-ecdh ( echde prf_id -- ulen ) {
1095 unsigned prf_id = T0_POP();
1096 unsigned ecdhe = T0_POP();
1099 x = make_pms_ecdh(CTX, ecdhe, prf_id);
1101 br_ssl_engine_fail(ENG, -x);
1108 cc: do-static-ecdh ( prf-id -- ) {
1109 unsigned prf_id = T0_POP();
1111 if (make_pms_static_ecdh(CTX, prf_id) < 0) {
1112 br_ssl_engine_fail(ENG, BR_ERR_INVALID_ALGORITHM);
1117 cc: do-client-sign ( -- sig_len ) {
1120 sig_len = make_client_sign(CTX);
1122 br_ssl_engine_fail(ENG, BR_ERR_INVALID_ALGORITHM);
1128 \ Write ClientKeyExchange.
1129 : write-ClientKeyExchange ( -- )
1131 addr-cipher_suite get16
1132 dup use-rsa-keyx? if
1133 prf-id do-rsa-encrypt
1136 addr-pad swap write-blob
1138 dup use-ecdhe? swap prf-id do-ecdh
1141 addr-pad swap write-blob
1144 \ Write CertificateVerify. This is invoked only if a client certificate
1145 \ was requested and sent, and the authentication is not full static ECDH.
1146 : write-CertificateVerify ( -- )
1149 addr-version get16 0x0303 >= if
1151 addr-hash_id get8 write8
1152 addr-auth_type get8 write8
1156 dup write16 addr-pad swap write-blob ;
1158 \ =======================================================================
1160 \ Perform a handshake.
1161 : do-handshake ( -- )
1162 0 addr-application_data set8
1163 22 addr-record_type_out set8
1164 0 addr-selected_protocol set16
1172 \ Session resumption.
1173 -1 read-CCS-Finished
1174 -1 write-CCS-Finished
1178 \ Not a session resumption.
1180 \ Read certificate; then check key type and usages against
1182 read-Certificate-from-server
1184 \ Depending on cipher suite, we may now expect a
1185 \ ServerKeyExchange.
1186 addr-cipher_suite get16 expected-key-type
1187 CX 0 63 { BR_KEYTYPE_SIGN } and if
1188 read-ServerKeyExchange
1192 read-handshake-header
1194 \ If this is a CertificateRequest, parse it, then read
1197 drop read-contents-CertificateRequest
1198 read-handshake-header
1205 \ At that point, we should have a ServerHelloDone,
1206 \ whose length must be 0.
1207 14 = ifnot ERR_UNEXPECTED fail then
1208 if ERR_BAD_HELLO_DONE fail then
1210 \ There should not be more bytes in the record at that point.
1211 more-incoming-bytes? if ERR_UNEXPECTED fail then
1214 \ If the server requested a client certificate, then
1215 \ we must write a Certificate message (it may be
1219 \ If using static ECDH, then the ClientKeyExchange
1220 \ is empty, and there is no CertificateVerify.
1221 \ Otherwise, there is a ClientKeyExchange; there
1222 \ will then be a CertificateVerify if a client chain
1224 addr-hash_id get8 0xFF = if
1227 addr-cipher_suite get16 prf-id do-static-ecdh
1229 write-ClientKeyExchange
1230 if write-CertificateVerify then
1233 write-ClientKeyExchange
1236 -1 write-CCS-Finished
1237 -1 read-CCS-Finished
1240 \ Now we should be invoked only in case of renegotiation.
1241 1 addr-application_data set8
1242 23 addr-record_type_out set8 ;
1244 \ Read a HelloRequest message.
1245 : read-HelloRequest ( -- )
1246 \ A HelloRequest has length 0 and type 0.
1247 read-handshake-header-core
1248 if ERR_UNEXPECTED fail then
1249 if ERR_BAD_HANDSHAKE fail then ;
1253 \ Perform initial handshake.
1257 \ Wait for further invocation. At that point, we should
1258 \ get either an explicit call for renegotiation, or
1259 \ an incoming HelloRequest handshake message.
1269 0 addr-application_data set8
1271 \ Reject renegotiations if the peer does not
1272 \ support secure renegotiation, or if the
1273 \ "no renegotiation" flag is set.
1274 addr-reneg get8 1 = 1 flag? or if
1276 begin can-output? not while