/src/botan/src/lib/tls/tls_channel.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * TLS Channels |
3 | | * (C) 2011,2012,2014,2015,2016 Jack Lloyd |
4 | | * 2016 Matthias Gierlings |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/tls_channel.h> |
10 | | #include <botan/tls_policy.h> |
11 | | #include <botan/tls_messages.h> |
12 | | #include <botan/kdf.h> |
13 | | #include <botan/internal/tls_handshake_state.h> |
14 | | #include <botan/internal/tls_record.h> |
15 | | #include <botan/internal/tls_seq_numbers.h> |
16 | | #include <botan/internal/rounding.h> |
17 | | #include <botan/internal/stl_util.h> |
18 | | #include <botan/loadstor.h> |
19 | | |
20 | | namespace Botan { |
21 | | |
22 | | namespace TLS { |
23 | | |
24 | | size_t TLS::Channel::IO_BUF_DEFAULT_SIZE = 10*1024; |
25 | | |
26 | | Channel::Channel(Callbacks& callbacks, |
27 | | Session_Manager& session_manager, |
28 | | RandomNumberGenerator& rng, |
29 | | const Policy& policy, |
30 | | bool is_server, |
31 | | bool is_datagram, |
32 | | size_t reserved_io_buffer_size) : |
33 | | m_is_server(is_server), |
34 | | m_is_datagram(is_datagram), |
35 | | m_callbacks(callbacks), |
36 | | m_session_manager(session_manager), |
37 | | m_policy(policy), |
38 | | m_rng(rng), |
39 | | m_has_been_closed(false) |
40 | 11.1k | { |
41 | 11.1k | init(reserved_io_buffer_size); |
42 | 11.1k | } |
43 | | |
44 | | Channel::Channel(output_fn out, |
45 | | data_cb app_data_cb, |
46 | | alert_cb recv_alert_cb, |
47 | | handshake_cb hs_cb, |
48 | | handshake_msg_cb hs_msg_cb, |
49 | | Session_Manager& session_manager, |
50 | | RandomNumberGenerator& rng, |
51 | | const Policy& policy, |
52 | | bool is_server, |
53 | | bool is_datagram, |
54 | | size_t io_buf_sz) : |
55 | | m_is_server(is_server), |
56 | | m_is_datagram(is_datagram), |
57 | | m_compat_callbacks(new Compat_Callbacks( |
58 | | /* |
59 | | this Channel constructor is also deprecated so its ok that it |
60 | | relies on a deprecated API |
61 | | */ |
62 | | Compat_Callbacks::SILENCE_DEPRECATION_WARNING::PLEASE, |
63 | | out, app_data_cb, recv_alert_cb, hs_cb, hs_msg_cb)), |
64 | | m_callbacks(*m_compat_callbacks.get()), |
65 | | m_session_manager(session_manager), |
66 | | m_policy(policy), |
67 | | m_rng(rng), |
68 | | m_has_been_closed(false) |
69 | 0 | { |
70 | 0 | init(io_buf_sz); |
71 | 0 | } |
72 | | |
73 | | void Channel::init(size_t io_buf_sz) |
74 | 11.1k | { |
75 | 11.1k | /* epoch 0 is plaintext, thus null cipher state */ |
76 | 11.1k | m_write_cipher_states[0] = nullptr; |
77 | 11.1k | m_read_cipher_states[0] = nullptr; |
78 | 11.1k | |
79 | 11.1k | m_writebuf.reserve(io_buf_sz); |
80 | 11.1k | m_readbuf.reserve(io_buf_sz); |
81 | 11.1k | } |
82 | | |
83 | | void Channel::reset_state() |
84 | 7.90k | { |
85 | 7.90k | m_active_state.reset(); |
86 | 7.90k | m_pending_state.reset(); |
87 | 7.90k | m_readbuf.clear(); |
88 | 7.90k | m_write_cipher_states.clear(); |
89 | 7.90k | m_read_cipher_states.clear(); |
90 | 7.90k | } |
91 | | |
92 | | void Channel::reset_active_association_state() |
93 | 0 | { |
94 | 0 | // This operation only makes sense for DTLS |
95 | 0 | BOTAN_ASSERT_NOMSG(m_is_datagram); |
96 | 0 | m_active_state.reset(); |
97 | 0 | m_read_cipher_states.clear(); |
98 | 0 | m_write_cipher_states.clear(); |
99 | 0 |
|
100 | 0 | m_write_cipher_states[0] = nullptr; |
101 | 0 | m_read_cipher_states[0] = nullptr; |
102 | 0 |
|
103 | 0 | if(m_sequence_numbers) |
104 | 0 | m_sequence_numbers->reset(); |
105 | 0 | } |
106 | | |
107 | | Channel::~Channel() |
108 | 11.1k | { |
109 | 11.1k | // So unique_ptr destructors run correctly |
110 | 11.1k | } |
111 | | |
112 | | Connection_Sequence_Numbers& Channel::sequence_numbers() const |
113 | 201k | { |
114 | 201k | BOTAN_ASSERT(m_sequence_numbers, "Have a sequence numbers object"); |
115 | 201k | return *m_sequence_numbers; |
116 | 201k | } |
117 | | |
118 | | std::shared_ptr<Connection_Cipher_State> Channel::read_cipher_state_epoch(uint16_t epoch) const |
119 | 1.01k | { |
120 | 1.01k | auto i = m_read_cipher_states.find(epoch); |
121 | 1.01k | if(i == m_read_cipher_states.end()) |
122 | 71 | throw Internal_Error("TLS::Channel No read cipherstate for epoch " + std::to_string(epoch)); |
123 | 948 | return i->second; |
124 | 948 | } |
125 | | |
126 | | std::shared_ptr<Connection_Cipher_State> Channel::write_cipher_state_epoch(uint16_t epoch) const |
127 | 97.3k | { |
128 | 97.3k | auto i = m_write_cipher_states.find(epoch); |
129 | 97.3k | if(i == m_write_cipher_states.end()) |
130 | 0 | throw Internal_Error("TLS::Channel No write cipherstate for epoch " + std::to_string(epoch)); |
131 | 97.3k | return i->second; |
132 | 97.3k | } |
133 | | |
134 | | std::vector<X509_Certificate> Channel::peer_cert_chain() const |
135 | 0 | { |
136 | 0 | if(auto active = active_state()) |
137 | 0 | return get_peer_cert_chain(*active); |
138 | 0 | return std::vector<X509_Certificate>(); |
139 | 0 | } |
140 | | |
141 | | bool Channel::save_session(const Session& session) |
142 | 516 | { |
143 | 516 | return callbacks().tls_session_established(session); |
144 | 516 | } |
145 | | |
146 | | Handshake_State& Channel::create_handshake_state(Protocol_Version version) |
147 | 47.5k | { |
148 | 47.5k | if(pending_state()) |
149 | 0 | throw Internal_Error("create_handshake_state called during handshake"); |
150 | 47.5k | |
151 | 47.5k | if(auto active = active_state()) |
152 | 0 | { |
153 | 0 | Protocol_Version active_version = active->version(); |
154 | 0 |
|
155 | 0 | if(active_version.is_datagram_protocol() != version.is_datagram_protocol()) |
156 | 0 | { |
157 | 0 | throw TLS_Exception(Alert::PROTOCOL_VERSION, |
158 | 0 | "Active state using version " + active_version.to_string() + |
159 | 0 | " cannot change to " + version.to_string() + " in pending"); |
160 | 0 | } |
161 | 47.5k | } |
162 | 47.5k | |
163 | 47.5k | if(!m_sequence_numbers) |
164 | 10.9k | { |
165 | 10.9k | if(version.is_datagram_protocol()) |
166 | 611 | m_sequence_numbers.reset(new Datagram_Sequence_Numbers); |
167 | 10.3k | else |
168 | 10.3k | m_sequence_numbers.reset(new Stream_Sequence_Numbers); |
169 | 10.9k | } |
170 | 47.5k | |
171 | 47.5k | using namespace std::placeholders; |
172 | 47.5k | |
173 | 47.5k | std::unique_ptr<Handshake_IO> io; |
174 | 47.5k | if(version.is_datagram_protocol()) |
175 | 611 | { |
176 | 611 | io.reset(new Datagram_Handshake_IO( |
177 | 611 | std::bind(&Channel::send_record_under_epoch, this, _1, _2, _3), |
178 | 611 | sequence_numbers(), |
179 | 611 | static_cast<uint16_t>(m_policy.dtls_default_mtu()), |
180 | 611 | m_policy.dtls_initial_timeout(), |
181 | 611 | m_policy.dtls_maximum_timeout())); |
182 | 611 | } |
183 | 46.9k | else |
184 | 46.9k | { |
185 | 46.9k | io.reset(new Stream_Handshake_IO(std::bind(&Channel::send_record, this, _1, _2))); |
186 | 46.9k | } |
187 | 47.5k | |
188 | 47.5k | m_pending_state.reset(new_handshake_state(io.release())); |
189 | 47.5k | |
190 | 47.5k | if(auto active = active_state()) |
191 | 0 | m_pending_state->set_version(active->version()); |
192 | 47.5k | |
193 | 47.5k | return *m_pending_state.get(); |
194 | 47.5k | } |
195 | | |
196 | | bool Channel::timeout_check() |
197 | 0 | { |
198 | 0 | if(m_pending_state) |
199 | 0 | return m_pending_state->handshake_io().timeout_check(); |
200 | 0 | |
201 | 0 | //FIXME: scan cipher suites and remove epochs older than 2*MSL |
202 | 0 | return false; |
203 | 0 | } |
204 | | |
205 | | void Channel::renegotiate(bool force_full_renegotiation) |
206 | 0 | { |
207 | 0 | if(pending_state()) // currently in handshake? |
208 | 0 | return; |
209 | 0 | |
210 | 0 | if(auto active = active_state()) |
211 | 0 | { |
212 | 0 | if(force_full_renegotiation == false) |
213 | 0 | force_full_renegotiation = !policy().allow_resumption_for_renegotiation(); |
214 | 0 |
|
215 | 0 | initiate_handshake(create_handshake_state(active->version()), |
216 | 0 | force_full_renegotiation); |
217 | 0 | } |
218 | 0 | else |
219 | 0 | throw Invalid_State("Cannot renegotiate on inactive connection"); |
220 | 0 | } |
221 | | |
222 | | void Channel::change_cipher_spec_reader(Connection_Side side) |
223 | 1.36k | { |
224 | 1.36k | auto pending = pending_state(); |
225 | 1.36k | |
226 | 1.36k | BOTAN_ASSERT(pending && pending->server_hello(), |
227 | 1.36k | "Have received server hello"); |
228 | 1.36k | |
229 | 1.36k | if(pending->server_hello()->compression_method() != 0) |
230 | 0 | throw Internal_Error("Negotiated unknown compression algorithm"); |
231 | 1.36k | |
232 | 1.36k | sequence_numbers().new_read_cipher_state(); |
233 | 1.36k | |
234 | 1.36k | const uint16_t epoch = sequence_numbers().current_read_epoch(); |
235 | 1.36k | |
236 | 1.36k | BOTAN_ASSERT(m_read_cipher_states.count(epoch) == 0, |
237 | 1.36k | "No read cipher state currently set for next epoch"); |
238 | 1.36k | |
239 | 1.36k | // flip side as we are reading |
240 | 1.36k | std::shared_ptr<Connection_Cipher_State> read_state( |
241 | 1.36k | new Connection_Cipher_State(pending->version(), |
242 | 1.36k | (side == CLIENT) ? SERVER : CLIENT, |
243 | 1.36k | false, |
244 | 1.36k | pending->ciphersuite(), |
245 | 1.36k | pending->session_keys(), |
246 | 1.36k | pending->server_hello()->supports_encrypt_then_mac())); |
247 | 1.36k | |
248 | 1.36k | m_read_cipher_states[epoch] = read_state; |
249 | 1.36k | } |
250 | | |
251 | | void Channel::change_cipher_spec_writer(Connection_Side side) |
252 | 1.31k | { |
253 | 1.31k | auto pending = pending_state(); |
254 | 1.31k | |
255 | 1.31k | BOTAN_ASSERT(pending && pending->server_hello(), |
256 | 1.31k | "Have received server hello"); |
257 | 1.31k | |
258 | 1.31k | if(pending->server_hello()->compression_method() != 0) |
259 | 0 | throw Internal_Error("Negotiated unknown compression algorithm"); |
260 | 1.31k | |
261 | 1.31k | sequence_numbers().new_write_cipher_state(); |
262 | 1.31k | |
263 | 1.31k | const uint16_t epoch = sequence_numbers().current_write_epoch(); |
264 | 1.31k | |
265 | 1.31k | BOTAN_ASSERT(m_write_cipher_states.count(epoch) == 0, |
266 | 1.31k | "No write cipher state currently set for next epoch"); |
267 | 1.31k | |
268 | 1.31k | std::shared_ptr<Connection_Cipher_State> write_state( |
269 | 1.31k | new Connection_Cipher_State(pending->version(), |
270 | 1.31k | side, |
271 | 1.31k | true, |
272 | 1.31k | pending->ciphersuite(), |
273 | 1.31k | pending->session_keys(), |
274 | 1.31k | pending->server_hello()->supports_encrypt_then_mac())); |
275 | 1.31k | |
276 | 1.31k | m_write_cipher_states[epoch] = write_state; |
277 | 1.31k | } |
278 | | |
279 | | bool Channel::is_active() const |
280 | 0 | { |
281 | 0 | if(is_closed()) |
282 | 0 | return false; |
283 | 0 | return (active_state() != nullptr); |
284 | 0 | } |
285 | | |
286 | | bool Channel::is_closed() const |
287 | 9.89k | { |
288 | 9.89k | return m_has_been_closed; |
289 | 9.89k | } |
290 | | |
291 | | void Channel::activate_session() |
292 | 516 | { |
293 | 516 | std::swap(m_active_state, m_pending_state); |
294 | 516 | m_pending_state.reset(); |
295 | 516 | |
296 | 516 | if(!m_active_state->version().is_datagram_protocol()) |
297 | 516 | { |
298 | 516 | // TLS is easy just remove all but the current state |
299 | 516 | const uint16_t current_epoch = sequence_numbers().current_write_epoch(); |
300 | 516 | |
301 | 516 | const auto not_current_epoch = |
302 | 2.06k | [current_epoch](uint16_t epoch) { return (epoch != current_epoch); }; |
303 | 516 | |
304 | 516 | map_remove_if(not_current_epoch, m_write_cipher_states); |
305 | 516 | map_remove_if(not_current_epoch, m_read_cipher_states); |
306 | 516 | } |
307 | 516 | |
308 | 516 | callbacks().tls_session_activated(); |
309 | 516 | } |
310 | | |
311 | | size_t Channel::received_data(const std::vector<uint8_t>& buf) |
312 | 0 | { |
313 | 0 | return this->received_data(buf.data(), buf.size()); |
314 | 0 | } |
315 | | |
316 | | size_t Channel::received_data(const uint8_t input[], size_t input_size) |
317 | 11.1k | { |
318 | 11.1k | const bool allow_epoch0_restart = m_is_datagram && m_is_server && policy().allow_dtls_epoch0_restart(); |
319 | 11.1k | |
320 | 11.1k | try |
321 | 11.1k | { |
322 | 156k | while(input_size) |
323 | 147k | { |
324 | 147k | size_t consumed = 0; |
325 | 147k | |
326 | 147k | auto get_epoch = [this](uint16_t epoch) { return read_cipher_state_epoch(epoch); }; |
327 | 147k | |
328 | 147k | const Record_Header record = |
329 | 147k | read_record(m_is_datagram, |
330 | 147k | m_readbuf, |
331 | 147k | input, |
332 | 147k | input_size, |
333 | 147k | consumed, |
334 | 147k | m_record_buf, |
335 | 147k | m_sequence_numbers.get(), |
336 | 147k | get_epoch, |
337 | 147k | allow_epoch0_restart); |
338 | 147k | |
339 | 147k | const size_t needed = record.needed(); |
340 | 147k | |
341 | 147k | BOTAN_ASSERT(consumed > 0, "Got to eat something"); |
342 | 147k | |
343 | 147k | BOTAN_ASSERT(consumed <= input_size, |
344 | 147k | "Record reader consumed sane amount"); |
345 | 147k | |
346 | 147k | input += consumed; |
347 | 147k | input_size -= consumed; |
348 | 147k | |
349 | 147k | BOTAN_ASSERT(input_size == 0 || needed == 0, |
350 | 147k | "Got a full record or consumed all input"); |
351 | 147k | |
352 | 147k | if(input_size == 0 && needed != 0) |
353 | 1.18k | return needed; // need more data to complete record |
354 | 146k | |
355 | 146k | // Ignore invalid records in DTLS |
356 | 146k | if(m_is_datagram && record.type() == NO_RECORD) |
357 | 188 | { |
358 | 188 | return 0; |
359 | 188 | } |
360 | 145k | |
361 | 145k | if(m_record_buf.size() > MAX_PLAINTEXT_SIZE) |
362 | 0 | throw TLS_Exception(Alert::RECORD_OVERFLOW, |
363 | 0 | "TLS plaintext record is larger than allowed maximum"); |
364 | 145k | |
365 | 145k | |
366 | 145k | const bool epoch0_restart = m_is_datagram && record.epoch() == 0 && active_state(); |
367 | 145k | BOTAN_ASSERT_IMPLICATION(epoch0_restart, allow_epoch0_restart, "Allowed state"); |
368 | 145k | |
369 | 145k | const bool initial_record = epoch0_restart || (!pending_state() && !active_state()); |
370 | 145k | |
371 | 145k | if(record.type() != ALERT) |
372 | 82.0k | { |
373 | 82.0k | if(initial_record) |
374 | 41.8k | { |
375 | 41.8k | // For initial records just check for basic sanity |
376 | 41.8k | if(record.version().major_version() != 3 && |
377 | 41.8k | record.version().major_version() != 0xFE) |
378 | 35 | { |
379 | 35 | throw TLS_Exception(Alert::PROTOCOL_VERSION, |
380 | 35 | "Received unexpected record version in initial record"); |
381 | 35 | } |
382 | 40.1k | } |
383 | 40.1k | else if(auto pending = pending_state()) |
384 | 40.1k | { |
385 | 40.1k | if(pending->server_hello() != nullptr && record.version() != pending->version()) |
386 | 88 | { |
387 | 88 | if(record.version() != pending->version()) |
388 | 88 | { |
389 | 88 | throw TLS_Exception(Alert::PROTOCOL_VERSION, |
390 | 88 | "Received unexpected record version"); |
391 | 88 | } |
392 | 0 | } |
393 | 0 | } |
394 | 0 | else if(auto active = active_state()) |
395 | 0 | { |
396 | 0 | if(record.version() != active->version()) |
397 | 0 | { |
398 | 0 | throw TLS_Exception(Alert::PROTOCOL_VERSION, |
399 | 0 | "Received unexpected record version"); |
400 | 0 | } |
401 | 145k | } |
402 | 82.0k | } |
403 | 145k | |
404 | 145k | if(record.type() == HANDSHAKE || record.type() == CHANGE_CIPHER_SPEC) |
405 | 81.7k | { |
406 | 81.7k | if(m_has_been_closed) |
407 | 4 | throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received handshake data after connection closure"); |
408 | 81.7k | process_handshake_ccs(m_record_buf, record.sequence(), record.type(), record.version(), epoch0_restart); |
409 | 81.7k | } |
410 | 64.0k | else if(record.type() == APPLICATION_DATA) |
411 | 17 | { |
412 | 17 | if(m_has_been_closed) |
413 | 3 | throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received application data after connection closure"); |
414 | 14 | if(pending_state() != nullptr) |
415 | 12 | throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Can't interleave application and handshake data"); |
416 | 2 | process_application_data(record.sequence(), m_record_buf); |
417 | 2 | } |
418 | 64.0k | else if(record.type() == ALERT) |
419 | 62.4k | { |
420 | 62.4k | process_alert(m_record_buf); |
421 | 62.4k | } |
422 | 1.54k | else if(record.type() != NO_RECORD) |
423 | 103 | throw Unexpected_Message("Unexpected record type " + |
424 | 103 | std::to_string(record.type()) + |
425 | 103 | " from counterparty"); |
426 | 145k | } |
427 | 11.1k | |
428 | 11.1k | return 0; // on a record boundary |
429 | 3.02k | } |
430 | 3.02k | catch(TLS_Exception& e) |
431 | 3.02k | { |
432 | 3.02k | send_fatal_alert(e.type()); |
433 | 3.02k | throw; |
434 | 3.02k | } |
435 | 591 | catch(Invalid_Authentication_Tag&) |
436 | 591 | { |
437 | 591 | send_fatal_alert(Alert::BAD_RECORD_MAC); |
438 | 591 | throw; |
439 | 591 | } |
440 | 3.88k | catch(Decoding_Error&) |
441 | 3.88k | { |
442 | 3.88k | send_fatal_alert(Alert::DECODE_ERROR); |
443 | 3.88k | throw; |
444 | 3.88k | } |
445 | 410 | catch(...) |
446 | 410 | { |
447 | 410 | send_fatal_alert(Alert::INTERNAL_ERROR); |
448 | 410 | throw; |
449 | 410 | } |
450 | 11.1k | } |
451 | | |
452 | | void Channel::process_handshake_ccs(const secure_vector<uint8_t>& record, |
453 | | uint64_t record_sequence, |
454 | | Record_Type record_type, |
455 | | Protocol_Version record_version, |
456 | | bool epoch0_restart) |
457 | 81.7k | { |
458 | 81.7k | if(!m_pending_state) |
459 | 41.8k | { |
460 | 41.8k | // No pending handshake, possibly new: |
461 | 41.8k | if(record_version.is_datagram_protocol() && !epoch0_restart) |
462 | 611 | { |
463 | 611 | if(m_sequence_numbers) |
464 | 0 | { |
465 | 0 | /* |
466 | 0 | * Might be a peer retransmit under epoch - 1 in which |
467 | 0 | * case we must retransmit last flight |
468 | 0 | */ |
469 | 0 | sequence_numbers().read_accept(record_sequence); |
470 | 0 |
|
471 | 0 | const uint16_t epoch = record_sequence >> 48; |
472 | 0 |
|
473 | 0 | if(epoch == sequence_numbers().current_read_epoch()) |
474 | 0 | { |
475 | 0 | create_handshake_state(record_version); |
476 | 0 | } |
477 | 0 | else if(epoch == sequence_numbers().current_read_epoch() - 1) |
478 | 0 | { |
479 | 0 | BOTAN_ASSERT(m_active_state, "Have active state here"); |
480 | 0 | m_active_state->handshake_io().add_record(record.data(), |
481 | 0 | record.size(), |
482 | 0 | record_type, |
483 | 0 | record_sequence); |
484 | 0 | } |
485 | 0 | } |
486 | 611 | else |
487 | 611 | { |
488 | 611 | create_handshake_state(record_version); |
489 | 611 | } |
490 | 611 | } |
491 | 41.1k | else |
492 | 41.1k | { |
493 | 41.1k | create_handshake_state(record_version); |
494 | 41.1k | } |
495 | 41.8k | } |
496 | 81.7k | |
497 | 81.7k | // May have been created in above conditional |
498 | 81.7k | if(m_pending_state) |
499 | 81.7k | { |
500 | 81.7k | m_pending_state->handshake_io().add_record(record.data(), |
501 | 81.7k | record.size(), |
502 | 81.7k | record_type, |
503 | 81.7k | record_sequence); |
504 | 81.7k | |
505 | 140k | while(auto pending = m_pending_state.get()) |
506 | 134k | { |
507 | 134k | auto msg = pending->get_next_handshake_msg(); |
508 | 134k | |
509 | 134k | if(msg.first == HANDSHAKE_NONE) // no full handshake yet |
510 | 75.1k | break; |
511 | 59.2k | |
512 | 59.2k | process_handshake_msg(active_state(), *pending, |
513 | 59.2k | msg.first, msg.second, epoch0_restart); |
514 | 59.2k | |
515 | 59.2k | if(!m_pending_state) |
516 | 516 | break; |
517 | 59.2k | } |
518 | 81.7k | } |
519 | 81.7k | } |
520 | | |
521 | | void Channel::process_application_data(uint64_t seq_no, const secure_vector<uint8_t>& record) |
522 | 2 | { |
523 | 2 | if(!active_state()) |
524 | 2 | throw Unexpected_Message("Application data before handshake done"); |
525 | 0 | |
526 | 0 | callbacks().tls_record_received(seq_no, record.data(), record.size()); |
527 | 0 | } |
528 | | |
529 | | void Channel::process_alert(const secure_vector<uint8_t>& record) |
530 | 62.4k | { |
531 | 62.4k | Alert alert_msg(record); |
532 | 62.4k | |
533 | 62.4k | if(alert_msg.type() == Alert::NO_RENEGOTIATION) |
534 | 41.3k | m_pending_state.reset(); |
535 | 62.4k | |
536 | 62.4k | callbacks().tls_alert(alert_msg); |
537 | 62.4k | |
538 | 62.4k | if(alert_msg.is_fatal()) |
539 | 1.73k | { |
540 | 1.73k | if(auto active = active_state()) |
541 | 0 | m_session_manager.remove_entry(active->server_hello()->session_id()); |
542 | 1.73k | } |
543 | 62.4k | |
544 | 62.4k | if(alert_msg.type() == Alert::CLOSE_NOTIFY) |
545 | 1.98k | send_warning_alert(Alert::CLOSE_NOTIFY); // reply in kind |
546 | 62.4k | |
547 | 62.4k | if(alert_msg.type() == Alert::CLOSE_NOTIFY || alert_msg.is_fatal()) |
548 | 2.37k | { |
549 | 2.37k | m_has_been_closed = true; |
550 | 2.37k | } |
551 | 62.4k | } |
552 | | |
553 | | void Channel::write_record(Connection_Cipher_State* cipher_state, uint16_t epoch, |
554 | | uint8_t record_type, const uint8_t input[], size_t length) |
555 | 97.3k | { |
556 | 97.3k | BOTAN_ASSERT(m_pending_state || m_active_state, "Some connection state exists"); |
557 | 97.3k | |
558 | 97.3k | const Protocol_Version record_version = |
559 | 97.2k | (m_pending_state) ? (m_pending_state->version()) : (m_active_state->version()); |
560 | 97.2k | |
561 | 97.2k | const uint64_t next_seq = sequence_numbers().next_write_sequence(epoch); |
562 | 97.2k | |
563 | 97.2k | if(cipher_state == nullptr) |
564 | 95.0k | { |
565 | 95.0k | TLS::write_unencrypted_record(m_writebuf, record_type, record_version, next_seq, |
566 | 95.0k | input, length); |
567 | 95.0k | } |
568 | 2.20k | else |
569 | 2.20k | { |
570 | 2.20k | TLS::write_record(m_writebuf, record_type, record_version, next_seq, |
571 | 2.20k | input, length, *cipher_state, m_rng); |
572 | 2.20k | } |
573 | 97.2k | |
574 | 97.2k | callbacks().tls_emit_data(m_writebuf.data(), m_writebuf.size()); |
575 | 97.2k | } |
576 | | |
577 | | void Channel::send_record_array(uint16_t epoch, uint8_t type, const uint8_t input[], size_t length) |
578 | 97.3k | { |
579 | 97.3k | if(length == 0) |
580 | 0 | return; |
581 | 97.3k | |
582 | 97.3k | /* |
583 | 97.3k | * In versions without an explicit IV field (only TLS v1.0 now that |
584 | 97.3k | * SSLv3 has been removed) send a single byte record first to randomize |
585 | 97.3k | * the following (implicit) IV of the following record. |
586 | 97.3k | * |
587 | 97.3k | * This isn't needed in TLS v1.1 or higher. |
588 | 97.3k | * |
589 | 97.3k | * An empty record also works but apparently some implementations do |
590 | 97.3k | * not like this (https://bugzilla.mozilla.org/show_bug.cgi?id=665814) |
591 | 97.3k | * |
592 | 97.3k | * See https://www.openssl.org/~bodo/tls-cbc.txt for background. |
593 | 97.3k | */ |
594 | 97.3k | |
595 | 97.3k | auto cipher_state = write_cipher_state_epoch(epoch); |
596 | 97.3k | |
597 | 97.3k | if(type == APPLICATION_DATA && m_active_state->version().supports_explicit_cbc_ivs() == false) |
598 | 0 | { |
599 | 0 | while(length) |
600 | 0 | { |
601 | 0 | write_record(cipher_state.get(), epoch, type, input, 1); |
602 | 0 | input += 1; |
603 | 0 | length -= 1; |
604 | 0 |
|
605 | 0 | const size_t sending = std::min<size_t>(length, MAX_PLAINTEXT_SIZE); |
606 | 0 | write_record(cipher_state.get(), epoch, type, input, sending); |
607 | 0 |
|
608 | 0 | input += sending; |
609 | 0 | length -= sending; |
610 | 0 | } |
611 | 0 | } |
612 | 97.3k | else |
613 | 97.3k | { |
614 | 194k | while(length) |
615 | 97.3k | { |
616 | 97.3k | const size_t sending = std::min<size_t>(length, MAX_PLAINTEXT_SIZE); |
617 | 97.3k | write_record(cipher_state.get(), epoch, type, input, sending); |
618 | 97.3k | |
619 | 97.3k | input += sending; |
620 | 97.3k | length -= sending; |
621 | 97.3k | } |
622 | 97.3k | } |
623 | 97.3k | } |
624 | | |
625 | | void Channel::send_record(uint8_t record_type, const std::vector<uint8_t>& record) |
626 | 97.4k | { |
627 | 97.4k | send_record_array(sequence_numbers().current_write_epoch(), |
628 | 97.4k | record_type, record.data(), record.size()); |
629 | 97.4k | } |
630 | | |
631 | | void Channel::send_record_under_epoch(uint16_t epoch, uint8_t record_type, |
632 | | const std::vector<uint8_t>& record) |
633 | 0 | { |
634 | 0 | send_record_array(epoch, record_type, record.data(), record.size()); |
635 | 0 | } |
636 | | |
637 | | void Channel::send(const uint8_t buf[], size_t buf_size) |
638 | 0 | { |
639 | 0 | if(!is_active()) |
640 | 0 | throw Invalid_State("Data cannot be sent on inactive TLS connection"); |
641 | 0 | |
642 | 0 | send_record_array(sequence_numbers().current_write_epoch(), |
643 | 0 | APPLICATION_DATA, buf, buf_size); |
644 | 0 | } |
645 | | |
646 | | void Channel::send(const std::string& string) |
647 | 0 | { |
648 | 0 | this->send(cast_char_ptr_to_uint8(string.data()), string.size()); |
649 | 0 | } |
650 | | |
651 | | void Channel::send_alert(const Alert& alert) |
652 | 9.89k | { |
653 | 9.89k | if(alert.is_valid() && !is_closed()) |
654 | 7.93k | { |
655 | 7.93k | try |
656 | 7.93k | { |
657 | 7.93k | send_record(ALERT, alert.serialize()); |
658 | 7.93k | } |
659 | 7.93k | catch(...) { /* swallow it */ } |
660 | 7.93k | } |
661 | 9.89k | |
662 | 9.89k | if(alert.type() == Alert::NO_RENEGOTIATION) |
663 | 0 | m_pending_state.reset(); |
664 | 9.89k | |
665 | 9.89k | if(alert.is_fatal()) |
666 | 7.90k | { |
667 | 7.90k | if(auto active = active_state()) |
668 | 293 | { |
669 | 293 | m_session_manager.remove_entry(active->server_hello()->session_id()); |
670 | 293 | } |
671 | 7.90k | reset_state(); |
672 | 7.90k | } |
673 | 9.89k | |
674 | 9.89k | if(alert.type() == Alert::CLOSE_NOTIFY || alert.is_fatal()) |
675 | 9.89k | { |
676 | 9.89k | m_has_been_closed = true; |
677 | 9.89k | } |
678 | 9.89k | } |
679 | | |
680 | | void Channel::secure_renegotiation_check(const Client_Hello* client_hello) |
681 | 30.4k | { |
682 | 30.4k | const bool secure_renegotiation = client_hello->secure_renegotiation(); |
683 | 30.4k | |
684 | 30.4k | if(auto active = active_state()) |
685 | 0 | { |
686 | 0 | const bool active_sr = active->client_hello()->secure_renegotiation(); |
687 | 0 |
|
688 | 0 | if(active_sr != secure_renegotiation) |
689 | 0 | throw TLS_Exception(Alert::HANDSHAKE_FAILURE, |
690 | 0 | "Client changed its mind about secure renegotiation"); |
691 | 30.4k | } |
692 | 30.4k | |
693 | 30.4k | if(secure_renegotiation) |
694 | 11.4k | { |
695 | 11.4k | const std::vector<uint8_t>& data = client_hello->renegotiation_info(); |
696 | 11.4k | |
697 | 11.4k | if(data != secure_renegotiation_data_for_client_hello()) |
698 | 1 | throw TLS_Exception(Alert::HANDSHAKE_FAILURE, |
699 | 1 | "Client sent bad values for secure renegotiation"); |
700 | 11.4k | } |
701 | 30.4k | } |
702 | | |
703 | | void Channel::secure_renegotiation_check(const Server_Hello* server_hello) |
704 | 28.8k | { |
705 | 28.8k | const bool secure_renegotiation = server_hello->secure_renegotiation(); |
706 | 28.8k | |
707 | 28.8k | if(auto active = active_state()) |
708 | 0 | { |
709 | 0 | const bool active_sr = active->server_hello()->secure_renegotiation(); |
710 | 0 |
|
711 | 0 | if(active_sr != secure_renegotiation) |
712 | 0 | throw TLS_Exception(Alert::HANDSHAKE_FAILURE, |
713 | 0 | "Server changed its mind about secure renegotiation"); |
714 | 28.8k | } |
715 | 28.8k | |
716 | 28.8k | if(secure_renegotiation) |
717 | 8.83k | { |
718 | 8.83k | const std::vector<uint8_t>& data = server_hello->renegotiation_info(); |
719 | 8.83k | |
720 | 8.83k | if(data != secure_renegotiation_data_for_server_hello()) |
721 | 1 | throw TLS_Exception(Alert::HANDSHAKE_FAILURE, |
722 | 1 | "Server sent bad values for secure renegotiation"); |
723 | 8.83k | } |
724 | 28.8k | } |
725 | | |
726 | | std::vector<uint8_t> Channel::secure_renegotiation_data_for_client_hello() const |
727 | 17.1k | { |
728 | 17.1k | if(auto active = active_state()) |
729 | 0 | return active->client_finished()->verify_data(); |
730 | 17.1k | return std::vector<uint8_t>(); |
731 | 17.1k | } |
732 | | |
733 | | std::vector<uint8_t> Channel::secure_renegotiation_data_for_server_hello() const |
734 | 33.3k | { |
735 | 33.3k | if(auto active = active_state()) |
736 | 0 | { |
737 | 0 | std::vector<uint8_t> buf = active->client_finished()->verify_data(); |
738 | 0 | buf += active->server_finished()->verify_data(); |
739 | 0 | return buf; |
740 | 0 | } |
741 | 33.3k | |
742 | 33.3k | return std::vector<uint8_t>(); |
743 | 33.3k | } |
744 | | |
745 | | bool Channel::secure_renegotiation_supported() const |
746 | 0 | { |
747 | 0 | if(auto active = active_state()) |
748 | 0 | return active->server_hello()->secure_renegotiation(); |
749 | 0 | |
750 | 0 | if(auto pending = pending_state()) |
751 | 0 | if(auto hello = pending->server_hello()) |
752 | 0 | return hello->secure_renegotiation(); |
753 | 0 | |
754 | 0 | return false; |
755 | 0 | } |
756 | | |
757 | | SymmetricKey Channel::key_material_export(const std::string& label, |
758 | | const std::string& context, |
759 | | size_t length) const |
760 | 0 | { |
761 | 0 | if(auto active = active_state()) |
762 | 0 | { |
763 | 0 | if(pending_state() != nullptr) |
764 | 0 | throw Invalid_State("Channel::key_material_export cannot export during renegotiation"); |
765 | 0 | |
766 | 0 | std::unique_ptr<KDF> prf(active->protocol_specific_prf()); |
767 | 0 |
|
768 | 0 | const secure_vector<uint8_t>& master_secret = |
769 | 0 | active->session_keys().master_secret(); |
770 | 0 |
|
771 | 0 | std::vector<uint8_t> salt; |
772 | 0 | salt += active->client_hello()->random(); |
773 | 0 | salt += active->server_hello()->random(); |
774 | 0 |
|
775 | 0 | if(context != "") |
776 | 0 | { |
777 | 0 | size_t context_size = context.length(); |
778 | 0 | if(context_size > 0xFFFF) |
779 | 0 | throw Invalid_Argument("key_material_export context is too long"); |
780 | 0 | salt.push_back(get_byte(0, static_cast<uint16_t>(context_size))); |
781 | 0 | salt.push_back(get_byte(1, static_cast<uint16_t>(context_size))); |
782 | 0 | salt += to_byte_vector(context); |
783 | 0 | } |
784 | 0 |
|
785 | 0 | return prf->derive_key(length, master_secret, salt, to_byte_vector(label)); |
786 | 0 | } |
787 | 0 | else |
788 | 0 | { |
789 | 0 | throw Invalid_State("Channel::key_material_export connection not active"); |
790 | 0 | } |
791 | 0 | } |
792 | | |
793 | | } |
794 | | |
795 | | } |