/src/openssl/ssl/tls_srp.c

Source (jump to first uncovered line)
/* ssl/tls_srp.c */
/*
 * Written by Christophe Renou (christophe.renou@edelweb.fr) with the
 * precious help of Peter Sylvester (peter.sylvester@edelweb.fr) for the
 * EdelKey project and contributed to the OpenSSL project 2004.
 */
/* ====================================================================
 * Copyright (c) 2004-2011 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
#include "ssl_locl.h"
#ifndef OPENSSL_NO_SRP

# include <openssl/rand.h>
# include <openssl/srp.h>
# include <openssl/err.h>

int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
{
    if (ctx == NULL)
        return 0;
    OPENSSL_free(ctx->srp_ctx.login);
    BN_free(ctx->srp_ctx.N);
    BN_free(ctx->srp_ctx.g);
    BN_free(ctx->srp_ctx.s);
    BN_free(ctx->srp_ctx.B);
    BN_free(ctx->srp_ctx.A);
    BN_free(ctx->srp_ctx.a);
    BN_free(ctx->srp_ctx.b);
    BN_free(ctx->srp_ctx.v);
    ctx->srp_ctx.TLS_ext_srp_username_callback = NULL;
    ctx->srp_ctx.SRP_cb_arg = NULL;
    ctx->srp_ctx.SRP_verify_param_callback = NULL;
    ctx->srp_ctx.SRP_give_srp_client_pwd_callback = NULL;
    ctx->srp_ctx.N = NULL;
    ctx->srp_ctx.g = NULL;
    ctx->srp_ctx.s = NULL;
    ctx->srp_ctx.B = NULL;
    ctx->srp_ctx.A = NULL;
    ctx->srp_ctx.a = NULL;
    ctx->srp_ctx.b = NULL;
    ctx->srp_ctx.v = NULL;
    ctx->srp_ctx.login = NULL;
    ctx->srp_ctx.info = NULL;
    ctx->srp_ctx.strength = SRP_MINIMAL_N;
    ctx->srp_ctx.srp_Mask = 0;
    return (1);
}

int SSL_SRP_CTX_free(struct ssl_st *s)
{
    if (s == NULL)
        return 0;
    OPENSSL_free(s->srp_ctx.login);
    BN_free(s->srp_ctx.N);
    BN_free(s->srp_ctx.g);
    BN_free(s->srp_ctx.s);
    BN_free(s->srp_ctx.B);
    BN_free(s->srp_ctx.A);
    BN_free(s->srp_ctx.a);
    BN_free(s->srp_ctx.b);
    BN_free(s->srp_ctx.v);
    s->srp_ctx.TLS_ext_srp_username_callback = NULL;
    s->srp_ctx.SRP_cb_arg = NULL;
    s->srp_ctx.SRP_verify_param_callback = NULL;
    s->srp_ctx.SRP_give_srp_client_pwd_callback = NULL;
    s->srp_ctx.N = NULL;
    s->srp_ctx.g = NULL;
    s->srp_ctx.s = NULL;
    s->srp_ctx.B = NULL;
    s->srp_ctx.A = NULL;
    s->srp_ctx.a = NULL;
    s->srp_ctx.b = NULL;
    s->srp_ctx.v = NULL;
    s->srp_ctx.login = NULL;
    s->srp_ctx.info = NULL;
    s->srp_ctx.strength = SRP_MINIMAL_N;
    s->srp_ctx.srp_Mask = 0;
    return (1);
}

int SSL_SRP_CTX_init(struct ssl_st *s)
{
    SSL_CTX *ctx;

    if ((s == NULL) || ((ctx = s->ctx) == NULL))
        return 0;
    s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg;
    /* set client Hello login callback */
    s->srp_ctx.TLS_ext_srp_username_callback =
        ctx->srp_ctx.TLS_ext_srp_username_callback;
    /* set SRP N/g param callback for verification */
    s->srp_ctx.SRP_verify_param_callback =
        ctx->srp_ctx.SRP_verify_param_callback;
    /* set SRP client passwd callback */
    s->srp_ctx.SRP_give_srp_client_pwd_callback =
        ctx->srp_ctx.SRP_give_srp_client_pwd_callback;

    s->srp_ctx.N = NULL;
    s->srp_ctx.g = NULL;
    s->srp_ctx.s = NULL;
    s->srp_ctx.B = NULL;
    s->srp_ctx.A = NULL;
    s->srp_ctx.a = NULL;
    s->srp_ctx.b = NULL;
    s->srp_ctx.v = NULL;
    s->srp_ctx.login = NULL;
    s->srp_ctx.info = ctx->srp_ctx.info;
    s->srp_ctx.strength = ctx->srp_ctx.strength;

    if (((ctx->srp_ctx.N != NULL) &&
         ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) ||
        ((ctx->srp_ctx.g != NULL) &&
         ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) ||
        ((ctx->srp_ctx.s != NULL) &&
         ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) ||
        ((ctx->srp_ctx.B != NULL) &&
         ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) ||
        ((ctx->srp_ctx.A != NULL) &&
         ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) ||
        ((ctx->srp_ctx.a != NULL) &&
         ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) ||
        ((ctx->srp_ctx.v != NULL) &&
         ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) ||
        ((ctx->srp_ctx.b != NULL) &&
         ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
        SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
        goto err;
    }
    if ((ctx->srp_ctx.login != NULL) &&
        ((s->srp_ctx.login = BUF_strdup(ctx->srp_ctx.login)) == NULL)) {
        SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
        goto err;
    }
    s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;

    return (1);
 err:
    OPENSSL_free(s->srp_ctx.login);
    BN_free(s->srp_ctx.N);
    BN_free(s->srp_ctx.g);
    BN_free(s->srp_ctx.s);
    BN_free(s->srp_ctx.B);
    BN_free(s->srp_ctx.A);
    BN_free(s->srp_ctx.a);
    BN_free(s->srp_ctx.b);
    BN_free(s->srp_ctx.v);
    return (0);
}

int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
{
    if (ctx == NULL)
        return 0;

    ctx->srp_ctx.SRP_cb_arg = NULL;
    /* set client Hello login callback */
    ctx->srp_ctx.TLS_ext_srp_username_callback = NULL;
    /* set SRP N/g param callback for verification */
    ctx->srp_ctx.SRP_verify_param_callback = NULL;
    /* set SRP client passwd callback */
    ctx->srp_ctx.SRP_give_srp_client_pwd_callback = NULL;

    ctx->srp_ctx.N = NULL;
    ctx->srp_ctx.g = NULL;
    ctx->srp_ctx.s = NULL;
    ctx->srp_ctx.B = NULL;
    ctx->srp_ctx.A = NULL;
    ctx->srp_ctx.a = NULL;
    ctx->srp_ctx.b = NULL;
    ctx->srp_ctx.v = NULL;
    ctx->srp_ctx.login = NULL;
    ctx->srp_ctx.srp_Mask = 0;
    ctx->srp_ctx.info = NULL;
    ctx->srp_ctx.strength = SRP_MINIMAL_N;

    return (1);
}

/* server side */
int SSL_srp_server_param_with_username(SSL *s, int *ad)
{
    unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
    int al;

    *ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
    if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) &&
        ((al =
          s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
                                                   s->srp_ctx.SRP_cb_arg)) !=
         SSL_ERROR_NONE))
        return al;

    *ad = SSL_AD_INTERNAL_ERROR;
    if ((s->srp_ctx.N == NULL) ||
        (s->srp_ctx.g == NULL) ||
        (s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL))
        return SSL3_AL_FATAL;

    if (RAND_bytes(b, sizeof(b)) <= 0)
        return SSL3_AL_FATAL;
    s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
    OPENSSL_cleanse(b, sizeof(b));

    /* Calculate:  B = (kv + g^b) % N  */

    return ((s->srp_ctx.B =
             SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
                        s->srp_ctx.v)) !=
            NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
}

/*
 * If the server just has the raw password, make up a verifier entry on the
 * fly
 */
int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass,
                                const char *grp)
{
    SRP_gN *GN = SRP_get_default_gN(grp);
    if (GN == NULL)
        return -1;
    s->srp_ctx.N = BN_dup(GN->N);
    s->srp_ctx.g = BN_dup(GN->g);
    if (s->srp_ctx.v != NULL) {
        BN_clear_free(s->srp_ctx.v);
        s->srp_ctx.v = NULL;
    }
    if (s->srp_ctx.s != NULL) {
        BN_clear_free(s->srp_ctx.s);
        s->srp_ctx.s = NULL;
    }
    if (!SRP_create_verifier_BN
        (user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g))
        return -1;

    return 1;
}

int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
                             BIGNUM *sa, BIGNUM *v, char *info)
{
    if (N != NULL) {
        if (s->srp_ctx.N != NULL) {
            if (!BN_copy(s->srp_ctx.N, N)) {
                BN_free(s->srp_ctx.N);
                s->srp_ctx.N = NULL;
            }
        } else
            s->srp_ctx.N = BN_dup(N);
    }
    if (g != NULL) {
        if (s->srp_ctx.g != NULL) {
            if (!BN_copy(s->srp_ctx.g, g)) {
                BN_free(s->srp_ctx.g);
                s->srp_ctx.g = NULL;
            }
        } else
            s->srp_ctx.g = BN_dup(g);
    }
    if (sa != NULL) {
        if (s->srp_ctx.s != NULL) {
            if (!BN_copy(s->srp_ctx.s, sa)) {
                BN_free(s->srp_ctx.s);
                s->srp_ctx.s = NULL;
            }
        } else
            s->srp_ctx.s = BN_dup(sa);
    }
    if (v != NULL) {
        if (s->srp_ctx.v != NULL) {
            if (!BN_copy(s->srp_ctx.v, v)) {
                BN_free(s->srp_ctx.v);
                s->srp_ctx.v = NULL;
            }
        } else
            s->srp_ctx.v = BN_dup(v);
    }
    s->srp_ctx.info = info;

    if (!(s->srp_ctx.N) ||
        !(s->srp_ctx.g) || !(s->srp_ctx.s) || !(s->srp_ctx.v))
        return -1;

    return 1;
}

int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
{
    BIGNUM *K = NULL, *u = NULL;
    int ret = -1, tmp_len;
    unsigned char *tmp = NULL;

    if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
        goto err;
    if (!(u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)))
        goto err;
    if (!
        (K =
         SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
                             s->srp_ctx.N)))
        goto err;

    tmp_len = BN_num_bytes(K);
    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
        goto err;
    BN_bn2bin(K, tmp);
    ret =
        s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
                                                    tmp_len);
 err:
    if (tmp) {
        OPENSSL_cleanse(tmp, tmp_len);
        OPENSSL_free(tmp);
    }
    BN_clear_free(K);
    BN_clear_free(u);
    return ret;
}

/* client side */
int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key)
{
    BIGNUM *x = NULL, *u = NULL, *K = NULL;
    int ret = -1, tmp_len;
    char *passwd = NULL;
    unsigned char *tmp = NULL;

    /*
     * Checks if b % n == 0
     */
    if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)
        goto err;
    if (!(u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)))
        goto err;
    if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL)
        goto err;
    if (!
        (passwd =
         s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
                                                     s->srp_ctx.SRP_cb_arg)))
        goto err;
    if (!(x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)))
        goto err;
    if (!
        (K =
         SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x,
                             s->srp_ctx.a, u)))
        goto err;

    tmp_len = BN_num_bytes(K);
    if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
        goto err;
    BN_bn2bin(K, tmp);
    ret =
        s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
                                                    tmp_len);
 err:
    if (tmp) {
        OPENSSL_cleanse(tmp, tmp_len);
        OPENSSL_free(tmp);
    }
    BN_clear_free(K);
    BN_clear_free(x);
    if (passwd) {
        OPENSSL_cleanse(passwd, strlen(passwd));
        OPENSSL_free(passwd);
    }
    BN_clear_free(u);
    return ret;
}

int srp_verify_server_param(SSL *s, int *al)
{
    SRP_CTX *srp = &s->srp_ctx;
    /*
     * Sanity check parameters: we can quickly check B % N == 0 by checking B
     * != 0 since B < N
     */
    if (BN_ucmp(srp->g, srp->N) >= 0 || BN_ucmp(srp->B, srp->N) >= 0
        || BN_is_zero(srp->B)) {
        *al = SSL3_AD_ILLEGAL_PARAMETER;
        return 0;
    }

    if (BN_num_bits(srp->N) < srp->strength) {
        *al = TLS1_AD_INSUFFICIENT_SECURITY;
        return 0;
    }

    if (srp->SRP_verify_param_callback) {
        if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) {
            *al = TLS1_AD_INSUFFICIENT_SECURITY;
            return 0;
        }
    } else if (!SRP_check_known_gN_param(srp->g, srp->N)) {
        *al = TLS1_AD_INSUFFICIENT_SECURITY;
        return 0;
    }

    return 1;
}

int SRP_Calc_A_param(SSL *s)
{
    unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];

    if (RAND_bytes(rnd, sizeof(rnd)) <= 0)
        return -1;
    s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
    OPENSSL_cleanse(rnd, sizeof(rnd));

    if (!
        (s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g)))
        return -1;

    return 1;
}

BIGNUM *SSL_get_srp_g(SSL *s)
{
    if (s->srp_ctx.g != NULL)
        return s->srp_ctx.g;
    return s->ctx->srp_ctx.g;
}

BIGNUM *SSL_get_srp_N(SSL *s)
{
    if (s->srp_ctx.N != NULL)
        return s->srp_ctx.N;
    return s->ctx->srp_ctx.N;
}

char *SSL_get_srp_username(SSL *s)
{
    if (s->srp_ctx.login != NULL)
        return s->srp_ctx.login;
    return s->ctx->srp_ctx.login;
}

char *SSL_get_srp_userinfo(SSL *s)
{
    if (s->srp_ctx.info != NULL)
        return s->srp_ctx.info;
    return s->ctx->srp_ctx.info;
}

# define tls1_ctx_ctrl ssl3_ctx_ctrl
# define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl

int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
}

int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
}

int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
                         NULL);
}

int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,
                                          int (*cb) (SSL *, void *))
{
    return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
                                  (void (*)(void))cb);
}

int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg)
{
    return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
}

int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
                                      int (*cb) (SSL *, int *, void *))
{
    return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
                                  (void (*)(void))cb);
}

int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,
                                        char *(*cb) (SSL *, void *))
{
    return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
                                  (void (*)(void))cb);
}

#endif

Coverage Report

Created: 2022-11-30 06:20

Line	Count	Source (jump to first uncovered line)
1		/* ssl/tls_srp.c */
2		/*
3		* Written by Christophe Renou (christophe.renou@edelweb.fr) with the
4		* precious help of Peter Sylvester (peter.sylvester@edelweb.fr) for the
5		* EdelKey project and contributed to the OpenSSL project 2004.
6		*/
7		/* ====================================================================
8		* Copyright (c) 2004-2011 The OpenSSL Project. All rights reserved.
9		*
10		* Redistribution and use in source and binary forms, with or without
11		* modification, are permitted provided that the following conditions
12		* are met:
13		*
14		* 1. Redistributions of source code must retain the above copyright
15		* notice, this list of conditions and the following disclaimer.
16		*
17		* 2. Redistributions in binary form must reproduce the above copyright
18		* notice, this list of conditions and the following disclaimer in
19		* the documentation and/or other materials provided with the
20		* distribution.
21		*
22		* 3. All advertising materials mentioning features or use of this
23		* software must display the following acknowledgment:
24		* "This product includes software developed by the OpenSSL Project
25		* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
26		*
27		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
28		* endorse or promote products derived from this software without
29		* prior written permission. For written permission, please contact
30		* licensing@OpenSSL.org.
31		*
32		* 5. Products derived from this software may not be called "OpenSSL"
33		* nor may "OpenSSL" appear in their names without prior written
34		* permission of the OpenSSL Project.
35		*
36		* 6. Redistributions of any form whatsoever must retain the following
37		* acknowledgment:
38		* "This product includes software developed by the OpenSSL Project
39		* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
40		*
41		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
42		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
44		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
45		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
46		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
47		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
48		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
49		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
50		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
51		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
52		* OF THE POSSIBILITY OF SUCH DAMAGE.
53		* ====================================================================
54		*
55		* This product includes cryptographic software written by Eric Young
56		* (eay@cryptsoft.com). This product includes software written by Tim
57		* Hudson (tjh@cryptsoft.com).
58		*
59		*/
60		#include "ssl_locl.h"
61		#ifndef OPENSSL_NO_SRP
62
63		# include <openssl/rand.h>
64		# include <openssl/srp.h>
65		# include <openssl/err.h>
66
67		int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx)
68	1.24k	{
69	1.24k	if (ctx == NULL)
70	0	return 0;
71	1.24k	OPENSSL_free(ctx->srp_ctx.login);
72	1.24k	BN_free(ctx->srp_ctx.N);
73	1.24k	BN_free(ctx->srp_ctx.g);
74	1.24k	BN_free(ctx->srp_ctx.s);
75	1.24k	BN_free(ctx->srp_ctx.B);
76	1.24k	BN_free(ctx->srp_ctx.A);
77	1.24k	BN_free(ctx->srp_ctx.a);
78	1.24k	BN_free(ctx->srp_ctx.b);
79	1.24k	BN_free(ctx->srp_ctx.v);
80	1.24k	ctx->srp_ctx.TLS_ext_srp_username_callback = NULL;
81	1.24k	ctx->srp_ctx.SRP_cb_arg = NULL;
82	1.24k	ctx->srp_ctx.SRP_verify_param_callback = NULL;
83	1.24k	ctx->srp_ctx.SRP_give_srp_client_pwd_callback = NULL;
84	1.24k	ctx->srp_ctx.N = NULL;
85	1.24k	ctx->srp_ctx.g = NULL;
86	1.24k	ctx->srp_ctx.s = NULL;
87	1.24k	ctx->srp_ctx.B = NULL;
88	1.24k	ctx->srp_ctx.A = NULL;
89	1.24k	ctx->srp_ctx.a = NULL;
90	1.24k	ctx->srp_ctx.b = NULL;
91	1.24k	ctx->srp_ctx.v = NULL;
92	1.24k	ctx->srp_ctx.login = NULL;
93	1.24k	ctx->srp_ctx.info = NULL;
94	1.24k	ctx->srp_ctx.strength = SRP_MINIMAL_N;
95	1.24k	ctx->srp_ctx.srp_Mask = 0;
96	1.24k	return (1);
97	1.24k	}
98
99		int SSL_SRP_CTX_free(struct ssl_st *s)
100	0	{
101	0	if (s == NULL)
102	0	return 0;
103	0	OPENSSL_free(s->srp_ctx.login);
104	0	BN_free(s->srp_ctx.N);
105	0	BN_free(s->srp_ctx.g);
106	0	BN_free(s->srp_ctx.s);
107	0	BN_free(s->srp_ctx.B);
108	0	BN_free(s->srp_ctx.A);
109	0	BN_free(s->srp_ctx.a);
110	0	BN_free(s->srp_ctx.b);
111	0	BN_free(s->srp_ctx.v);
112	0	s->srp_ctx.TLS_ext_srp_username_callback = NULL;
113	0	s->srp_ctx.SRP_cb_arg = NULL;
114	0	s->srp_ctx.SRP_verify_param_callback = NULL;
115	0	s->srp_ctx.SRP_give_srp_client_pwd_callback = NULL;
116	0	s->srp_ctx.N = NULL;
117	0	s->srp_ctx.g = NULL;
118	0	s->srp_ctx.s = NULL;
119	0	s->srp_ctx.B = NULL;
120	0	s->srp_ctx.A = NULL;
121	0	s->srp_ctx.a = NULL;
122	0	s->srp_ctx.b = NULL;
123	0	s->srp_ctx.v = NULL;
124	0	s->srp_ctx.login = NULL;
125	0	s->srp_ctx.info = NULL;
126	0	s->srp_ctx.strength = SRP_MINIMAL_N;
127	0	s->srp_ctx.srp_Mask = 0;
128	0	return (1);
129	0	}
130
131		int SSL_SRP_CTX_init(struct ssl_st *s)
132	0	{
133	0	SSL_CTX *ctx;
134
135	0	if ((s == NULL) \|\| ((ctx = s->ctx) == NULL))
136	0	return 0;
137	0	s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg;
138		/* set client Hello login callback */
139	0	s->srp_ctx.TLS_ext_srp_username_callback =
140	0	ctx->srp_ctx.TLS_ext_srp_username_callback;
141		/* set SRP N/g param callback for verification */
142	0	s->srp_ctx.SRP_verify_param_callback =
143	0	ctx->srp_ctx.SRP_verify_param_callback;
144		/* set SRP client passwd callback */
145	0	s->srp_ctx.SRP_give_srp_client_pwd_callback =
146	0	ctx->srp_ctx.SRP_give_srp_client_pwd_callback;
147
148	0	s->srp_ctx.N = NULL;
149	0	s->srp_ctx.g = NULL;
150	0	s->srp_ctx.s = NULL;
151	0	s->srp_ctx.B = NULL;
152	0	s->srp_ctx.A = NULL;
153	0	s->srp_ctx.a = NULL;
154	0	s->srp_ctx.b = NULL;
155	0	s->srp_ctx.v = NULL;
156	0	s->srp_ctx.login = NULL;
157	0	s->srp_ctx.info = ctx->srp_ctx.info;
158	0	s->srp_ctx.strength = ctx->srp_ctx.strength;
159
160	0	if (((ctx->srp_ctx.N != NULL) &&
161	0	((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) \|\|
162	0	((ctx->srp_ctx.g != NULL) &&
163	0	((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) \|\|
164	0	((ctx->srp_ctx.s != NULL) &&
165	0	((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) \|\|
166	0	((ctx->srp_ctx.B != NULL) &&
167	0	((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) \|\|
168	0	((ctx->srp_ctx.A != NULL) &&
169	0	((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) \|\|
170	0	((ctx->srp_ctx.a != NULL) &&
171	0	((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) \|\|
172	0	((ctx->srp_ctx.v != NULL) &&
173	0	((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) \|\|
174	0	((ctx->srp_ctx.b != NULL) &&
175	0	((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) {
176	0	SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB);
177	0	goto err;
178	0	}
179	0	if ((ctx->srp_ctx.login != NULL) &&
180	0	((s->srp_ctx.login = BUF_strdup(ctx->srp_ctx.login)) == NULL)) {
181	0	SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR);
182	0	goto err;
183	0	}
184	0	s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask;
185
186	0	return (1);
187	0	err:
188	0	OPENSSL_free(s->srp_ctx.login);
189	0	BN_free(s->srp_ctx.N);
190	0	BN_free(s->srp_ctx.g);
191	0	BN_free(s->srp_ctx.s);
192	0	BN_free(s->srp_ctx.B);
193	0	BN_free(s->srp_ctx.A);
194	0	BN_free(s->srp_ctx.a);
195	0	BN_free(s->srp_ctx.b);
196	0	BN_free(s->srp_ctx.v);
197	0	return (0);
198	0	}
199
200		int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx)
201	1.24k	{
202	1.24k	if (ctx == NULL)
203	0	return 0;
204
205	1.24k	ctx->srp_ctx.SRP_cb_arg = NULL;
206		/* set client Hello login callback */
207	1.24k	ctx->srp_ctx.TLS_ext_srp_username_callback = NULL;
208		/* set SRP N/g param callback for verification */
209	1.24k	ctx->srp_ctx.SRP_verify_param_callback = NULL;
210		/* set SRP client passwd callback */
211	1.24k	ctx->srp_ctx.SRP_give_srp_client_pwd_callback = NULL;
212
213	1.24k	ctx->srp_ctx.N = NULL;
214	1.24k	ctx->srp_ctx.g = NULL;
215	1.24k	ctx->srp_ctx.s = NULL;
216	1.24k	ctx->srp_ctx.B = NULL;
217	1.24k	ctx->srp_ctx.A = NULL;
218	1.24k	ctx->srp_ctx.a = NULL;
219	1.24k	ctx->srp_ctx.b = NULL;
220	1.24k	ctx->srp_ctx.v = NULL;
221	1.24k	ctx->srp_ctx.login = NULL;
222	1.24k	ctx->srp_ctx.srp_Mask = 0;
223	1.24k	ctx->srp_ctx.info = NULL;
224	1.24k	ctx->srp_ctx.strength = SRP_MINIMAL_N;
225
226	1.24k	return (1);
227	1.24k	}
228
229		/* server side */
230		int SSL_srp_server_param_with_username(SSL s, int ad)
231	0	{
232	0	unsigned char b[SSL_MAX_MASTER_KEY_LENGTH];
233	0	int al;
234
235	0	*ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
236	0	if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) &&
237	0	((al =
238	0	s->srp_ctx.TLS_ext_srp_username_callback(s, ad,
239	0	s->srp_ctx.SRP_cb_arg)) !=
240	0	SSL_ERROR_NONE))
241	0	return al;
242
243	0	*ad = SSL_AD_INTERNAL_ERROR;
244	0	if ((s->srp_ctx.N == NULL) \|\|
245	0	(s->srp_ctx.g == NULL) \|\|
246	0	(s->srp_ctx.s == NULL) \|\| (s->srp_ctx.v == NULL))
247	0	return SSL3_AL_FATAL;
248
249	0	if (RAND_bytes(b, sizeof(b)) <= 0)
250	0	return SSL3_AL_FATAL;
251	0	s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);
252	0	OPENSSL_cleanse(b, sizeof(b));
253
254		/* Calculate: B = (kv + g^b) % N */
255
256	0	return ((s->srp_ctx.B =
257	0	SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g,
258	0	s->srp_ctx.v)) !=
259	0	NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL;
260	0	}
261
262		/*
263		* If the server just has the raw password, make up a verifier entry on the
264		* fly
265		*/
266		int SSL_set_srp_server_param_pw(SSL s, const char user, const char *pass,
267		const char *grp)
268	0	{
269	0	SRP_gN *GN = SRP_get_default_gN(grp);
270	0	if (GN == NULL)
271	0	return -1;
272	0	s->srp_ctx.N = BN_dup(GN->N);
273	0	s->srp_ctx.g = BN_dup(GN->g);
274	0	if (s->srp_ctx.v != NULL) {
275	0	BN_clear_free(s->srp_ctx.v);
276	0	s->srp_ctx.v = NULL;
277	0	}
278	0	if (s->srp_ctx.s != NULL) {
279	0	BN_clear_free(s->srp_ctx.s);
280	0	s->srp_ctx.s = NULL;
281	0	}
282	0	if (!SRP_create_verifier_BN
283	0	(user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g))
284	0	return -1;
285
286	0	return 1;
287	0	}
288
289		int SSL_set_srp_server_param(SSL s, const BIGNUM N, const BIGNUM *g,
290		BIGNUM sa, BIGNUM v, char *info)
291	0	{
292	0	if (N != NULL) {
293	0	if (s->srp_ctx.N != NULL) {
294	0	if (!BN_copy(s->srp_ctx.N, N)) {
295	0	BN_free(s->srp_ctx.N);
296	0	s->srp_ctx.N = NULL;
297	0	}
298	0	} else
299	0	s->srp_ctx.N = BN_dup(N);
300	0	}
301	0	if (g != NULL) {
302	0	if (s->srp_ctx.g != NULL) {
303	0	if (!BN_copy(s->srp_ctx.g, g)) {
304	0	BN_free(s->srp_ctx.g);
305	0	s->srp_ctx.g = NULL;
306	0	}
307	0	} else
308	0	s->srp_ctx.g = BN_dup(g);
309	0	}
310	0	if (sa != NULL) {
311	0	if (s->srp_ctx.s != NULL) {
312	0	if (!BN_copy(s->srp_ctx.s, sa)) {
313	0	BN_free(s->srp_ctx.s);
314	0	s->srp_ctx.s = NULL;
315	0	}
316	0	} else
317	0	s->srp_ctx.s = BN_dup(sa);
318	0	}
319	0	if (v != NULL) {
320	0	if (s->srp_ctx.v != NULL) {
321	0	if (!BN_copy(s->srp_ctx.v, v)) {
322	0	BN_free(s->srp_ctx.v);
323	0	s->srp_ctx.v = NULL;
324	0	}
325	0	} else
326	0	s->srp_ctx.v = BN_dup(v);
327	0	}
328	0	s->srp_ctx.info = info;
329
330	0	if (!(s->srp_ctx.N) \|\|
331	0	!(s->srp_ctx.g) \|\| !(s->srp_ctx.s) \|\| !(s->srp_ctx.v))
332	0	return -1;
333
334	0	return 1;
335	0	}
336
337		int SRP_generate_server_master_secret(SSL s, unsigned char master_key)
338	0	{
339	0	BIGNUM K = NULL, u = NULL;
340	0	int ret = -1, tmp_len;
341	0	unsigned char *tmp = NULL;
342
343	0	if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
344	0	goto err;
345	0	if (!(u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)))
346	0	goto err;
347	0	if (!
348	0	(K =
349	0	SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b,
350	0	s->srp_ctx.N)))
351	0	goto err;
352
353	0	tmp_len = BN_num_bytes(K);
354	0	if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
355	0	goto err;
356	0	BN_bn2bin(K, tmp);
357	0	ret =
358	0	s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
359	0	tmp_len);
360	0	err:
361	0	if (tmp) {
362	0	OPENSSL_cleanse(tmp, tmp_len);
363	0	OPENSSL_free(tmp);
364	0	}
365	0	BN_clear_free(K);
366	0	BN_clear_free(u);
367	0	return ret;
368	0	}
369
370		/* client side */
371		int SRP_generate_client_master_secret(SSL s, unsigned char master_key)
372	0	{
373	0	BIGNUM x = NULL, u = NULL, *K = NULL;
374	0	int ret = -1, tmp_len;
375	0	char *passwd = NULL;
376	0	unsigned char *tmp = NULL;
377
378		/*
379		* Checks if b % n == 0
380		*/
381	0	if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0)
382	0	goto err;
383	0	if (!(u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)))
384	0	goto err;
385	0	if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL)
386	0	goto err;
387	0	if (!
388	0	(passwd =
389	0	s->srp_ctx.SRP_give_srp_client_pwd_callback(s,
390	0	s->srp_ctx.SRP_cb_arg)))
391	0	goto err;
392	0	if (!(x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)))
393	0	goto err;
394	0	if (!
395	0	(K =
396	0	SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x,
397	0	s->srp_ctx.a, u)))
398	0	goto err;
399
400	0	tmp_len = BN_num_bytes(K);
401	0	if ((tmp = OPENSSL_malloc(tmp_len)) == NULL)
402	0	goto err;
403	0	BN_bn2bin(K, tmp);
404	0	ret =
405	0	s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
406	0	tmp_len);
407	0	err:
408	0	if (tmp) {
409	0	OPENSSL_cleanse(tmp, tmp_len);
410	0	OPENSSL_free(tmp);
411	0	}
412	0	BN_clear_free(K);
413	0	BN_clear_free(x);
414	0	if (passwd) {
415	0	OPENSSL_cleanse(passwd, strlen(passwd));
416	0	OPENSSL_free(passwd);
417	0	}
418	0	BN_clear_free(u);
419	0	return ret;
420	0	}
421
422		int srp_verify_server_param(SSL s, int al)
423	0	{
424	0	SRP_CTX *srp = &s->srp_ctx;
425		/*
426		* Sanity check parameters: we can quickly check B % N == 0 by checking B
427		* != 0 since B < N
428		*/
429	0	if (BN_ucmp(srp->g, srp->N) >= 0 \|\| BN_ucmp(srp->B, srp->N) >= 0
430	0	\|\| BN_is_zero(srp->B)) {
431	0	*al = SSL3_AD_ILLEGAL_PARAMETER;
432	0	return 0;
433	0	}
434
435	0	if (BN_num_bits(srp->N) < srp->strength) {
436	0	*al = TLS1_AD_INSUFFICIENT_SECURITY;
437	0	return 0;
438	0	}
439
440	0	if (srp->SRP_verify_param_callback) {
441	0	if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) {
442	0	*al = TLS1_AD_INSUFFICIENT_SECURITY;
443	0	return 0;
444	0	}
445	0	} else if (!SRP_check_known_gN_param(srp->g, srp->N)) {
446	0	*al = TLS1_AD_INSUFFICIENT_SECURITY;
447	0	return 0;
448	0	}
449
450	0	return 1;
451	0	}
452
453		int SRP_Calc_A_param(SSL *s)
454	0	{
455	0	unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
456
457	0	if (RAND_bytes(rnd, sizeof(rnd)) <= 0)
458	0	return -1;
459	0	s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
460	0	OPENSSL_cleanse(rnd, sizeof(rnd));
461
462	0	if (!
463	0	(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g)))
464	0	return -1;
465
466	0	return 1;
467	0	}
468
469		BIGNUM SSL_get_srp_g(SSL s)
470	0	{
471	0	if (s->srp_ctx.g != NULL)
472	0	return s->srp_ctx.g;
473	0	return s->ctx->srp_ctx.g;
474	0	}
475
476		BIGNUM SSL_get_srp_N(SSL s)
477	0	{
478	0	if (s->srp_ctx.N != NULL)
479	0	return s->srp_ctx.N;
480	0	return s->ctx->srp_ctx.N;
481	0	}
482
483		char SSL_get_srp_username(SSL s)
484	0	{
485	0	if (s->srp_ctx.login != NULL)
486	0	return s->srp_ctx.login;
487	0	return s->ctx->srp_ctx.login;
488	0	}
489
490		char SSL_get_srp_userinfo(SSL s)
491	0	{
492	0	if (s->srp_ctx.info != NULL)
493	0	return s->srp_ctx.info;
494	0	return s->ctx->srp_ctx.info;
495	0	}
496
497	0	# define tls1_ctx_ctrl ssl3_ctx_ctrl
498	0	# define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl
499
500		int SSL_CTX_set_srp_username(SSL_CTX ctx, char name)
501	0	{
502	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name);
503	0	}
504
505		int SSL_CTX_set_srp_password(SSL_CTX ctx, char password)
506	0	{
507	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password);
508	0	}
509
510		int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength)
511	0	{
512	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength,
513	0	NULL);
514	0	}
515
516		int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx,
517		int (cb) (SSL , void *))
518	0	{
519	0	return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB,
520	0	(void (*)(void))cb);
521	0	}
522
523		int SSL_CTX_set_srp_cb_arg(SSL_CTX ctx, void arg)
524	0	{
525	0	return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg);
526	0	}
527
528		int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx,
529		int (cb) (SSL , int , void ))
530	0	{
531	0	return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB,
532	0	(void (*)(void))cb);
533	0	}
534
535		int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx,
536		char (cb) (SSL , void ))
537	0	{
538	0	return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB,
539	0	(void (*)(void))cb);
540	0	}
541
542		#endif