/src/gnutls/lib/ext/key_share.c

Source (jump to first uncovered line)
/*
 * Copyright (C) 2017 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* This file contains the code the Key Share TLS 1.3 extension.
 */

#include "gnutls_int.h"
#include "errors.h"
#include "num.h"
#include "ext/supported_groups.h"
#include "state.h"
#include "num.h"
#include "algorithms.h"
#include "auth/psk.h"
#include "auth/cert.h"
#include "handshake.h"
#include "../ecc.h"
#include "../algorithms.h"
#include "pk.h"

static int key_share_recv_params(gnutls_session_t session, const uint8_t *data,
         size_t data_size);
static int key_share_send_params(gnutls_session_t session,
         gnutls_buffer_st *extdata);

const hello_ext_entry_st ext_mod_key_share = {
  .name = "Key Share",
  .tls_id = 51,
  .gid = GNUTLS_EXTENSION_KEY_SHARE,
  .client_parse_point = _GNUTLS_EXT_TLS_POST_CS,
  .server_parse_point = _GNUTLS_EXT_TLS_POST_CS,
  .validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_CLIENT_HELLO |
        GNUTLS_EXT_FLAG_TLS13_SERVER_HELLO | GNUTLS_EXT_FLAG_HRR,
  .recv_func = key_share_recv_params,
  .send_func = key_share_send_params,
  .pack_func = NULL,
  .unpack_func = NULL,
  .deinit_func = NULL,
  .cannot_be_overriden = 1
};

/*
 * Generates key exchange parameters, and stores them in
 * session->key.kshare_*_params.
 *
 * struct {
 *     NamedGroup group;
 *     opaque key_exchange<1..2^16-1>;
 * } KeyShareEntry;
 *
 */
static int client_gen_key_share(gnutls_session_t session,
        const gnutls_group_entry_st *group,
        gnutls_buffer_st *extdata)
{
  gnutls_datum_t tmp = { NULL, 0 };
  int ret;

  if (group->pk != GNUTLS_PK_EC && group->pk != GNUTLS_PK_ECDH_X25519 &&
      group->pk != GNUTLS_PK_ECDH_X448 && group->pk != GNUTLS_PK_DH) {
    _gnutls_debug_log("Cannot send key share for group %s!\n",
          group->name);
    return GNUTLS_E_INT_RET_0;
  }

  _gnutls_handshake_log("EXT[%p]: sending key share for %s\n", session,
            group->name);

  ret = _gnutls_buffer_append_prefix(extdata, 16, group->tls_id);
  if (ret < 0)
    return gnutls_assert_val(ret);

  if (group->pk == GNUTLS_PK_EC) {
    gnutls_pk_params_release(&session->key.kshare.ecdh_params);
    gnutls_pk_params_init(&session->key.kshare.ecdh_params);

    ret = _gnutls_pk_generate_keys(group->pk, group->curve,
                 &session->key.kshare.ecdh_params,
                 1);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_ecc_ansi_x962_export(
      group->curve,
      session->key.kshare.ecdh_params.params[ECC_X],
      session->key.kshare.ecdh_params.params[ECC_Y], &tmp);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_data_prefix(extdata, 16, tmp.data,
              tmp.size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    session->key.kshare.ecdh_params.algo = group->pk;
    session->key.kshare.ecdh_params.curve = group->curve;

    ret = 0;

  } else if (group->pk == GNUTLS_PK_ECDH_X25519 ||
       group->pk == GNUTLS_PK_ECDH_X448) {
    unsigned int length_pos;

    gnutls_pk_params_release(&session->key.kshare.ecdhx_params);
    gnutls_pk_params_init(&session->key.kshare.ecdhx_params);

    ret = _gnutls_pk_generate_keys(
      group->pk, group->curve,
      &session->key.kshare.ecdhx_params, 1);
    if (ret < 0)
      return gnutls_assert_val(ret);

    length_pos = extdata->length;

    ret = _gnutls_buffer_append_data_prefix(
      extdata, 16,
      session->key.kshare.ecdhx_params.raw_pub.data,
      session->key.kshare.ecdhx_params.raw_pub.size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    session->key.kshare.ecdhx_params.algo = group->pk;
    session->key.kshare.ecdhx_params.curve = group->curve;

    if (group->pk2 != GNUTLS_PK_UNKNOWN) {
      gnutls_pk_params_release(
        &session->key.kshare.kem_params);
      gnutls_pk_params_init(&session->key.kshare.kem_params);

      ret = _gnutls_pk_generate_keys(
        group->pk2, 0, &session->key.kshare.kem_params,
        1);
      if (ret < 0) {
        gnutls_assert();
        goto cleanup;
      }

      ret = _gnutls_buffer_append_data(
        extdata,
        session->key.kshare.kem_params.raw_pub.data,
        session->key.kshare.kem_params.raw_pub.size);
      if (ret < 0) {
        gnutls_assert();
        goto cleanup;
      }

      /* copy actual length */
      _gnutls_write_uint16(extdata->length - length_pos - 2,
               &extdata->data[length_pos]);
    }

    ret = 0;

  } else if (group->pk == GNUTLS_PK_DH) {
    /* we need to initialize the group parameters first */
    gnutls_pk_params_release(&session->key.kshare.dh_params);
    gnutls_pk_params_init(&session->key.kshare.dh_params);

    ret = _gnutls_mpi_init_scan_nz(
      &session->key.kshare.dh_params.params[DH_G],
      group->generator->data, group->generator->size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_mpi_init_scan_nz(
      &session->key.kshare.dh_params.params[DH_P],
      group->prime->data, group->prime->size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_mpi_init_scan_nz(
      &session->key.kshare.dh_params.params[DH_Q],
      group->q->data, group->q->size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    session->key.kshare.dh_params.algo = group->pk;
    session->key.kshare.dh_params.dh_group =
      group->id; /* no curve in FFDH, we write the group */
    session->key.kshare.dh_params.qbits = *group->q_bits;
    session->key.kshare.dh_params.params_nr = 3;

    ret = _gnutls_pk_generate_keys(
      group->pk, 0, &session->key.kshare.dh_params, 1);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_prefix(extdata, 16,
               group->prime->size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_fixed_mpi(
      extdata, session->key.kshare.dh_params.params[DH_Y],
      group->prime->size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = 0;
  }

cleanup:
  gnutls_free(tmp.data);
  return ret;
}

/*
 * Sends server key exchange parameters
 *
 */
static int server_gen_key_share(gnutls_session_t session,
        const gnutls_group_entry_st *group,
        gnutls_buffer_st *extdata)
{
  gnutls_datum_t tmp = { NULL, 0 };
  int ret;

  if (group->pk != GNUTLS_PK_EC && group->pk != GNUTLS_PK_ECDH_X25519 &&
      group->pk != GNUTLS_PK_ECDH_X448 && group->pk != GNUTLS_PK_DH) {
    _gnutls_debug_log("Cannot send key share for group %s!\n",
          group->name);
    return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
  }

  _gnutls_handshake_log("EXT[%p]: sending key share for %s\n", session,
            group->name);

  ret = _gnutls_buffer_append_prefix(extdata, 16, group->tls_id);
  if (ret < 0)
    return gnutls_assert_val(ret);

  if (group->pk == GNUTLS_PK_EC) {
    ret = _gnutls_ecc_ansi_x962_export(
      group->curve,
      session->key.kshare.ecdh_params.params[ECC_X],
      session->key.kshare.ecdh_params.params[ECC_Y], &tmp);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_data_prefix(extdata, 16, tmp.data,
              tmp.size);
    if (ret < 0) {
      gnutls_assert();
      goto cleanup;
    }

    ret = 0;

  } else if (group->pk == GNUTLS_PK_ECDH_X25519 ||
       group->pk == GNUTLS_PK_ECDH_X448) {
    unsigned int length_pos;

    length_pos = extdata->length;

    ret = _gnutls_buffer_append_data_prefix(
      extdata, 16,
      session->key.kshare.ecdhx_params.raw_pub.data,
      session->key.kshare.ecdhx_params.raw_pub.size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    if (group->pk2 != GNUTLS_PK_UNKNOWN) {
      ret = _gnutls_buffer_append_data(
        extdata,
        session->key.kshare.kem_params.raw_pub.data,
        session->key.kshare.kem_params.raw_pub.size);
      if (ret < 0) {
        gnutls_assert();
        goto cleanup;
      }

      /* copy actual length */
      _gnutls_write_uint16(extdata->length - length_pos - 2,
               &extdata->data[length_pos]);
    }

    ret = 0;
  } else if (group->pk == GNUTLS_PK_DH) {
    ret = _gnutls_buffer_append_prefix(extdata, 16,
               group->prime->size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_append_fixed_mpi(
      extdata, session->key.kshare.dh_params.params[DH_Y],
      group->prime->size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = 0;
  }

cleanup:
  gnutls_free(tmp.data);
  return ret;
}

/* Generates shared key and stores it in session->key.key
 */
static int server_use_key_share(gnutls_session_t session,
        const gnutls_group_entry_st *group,
        const uint8_t *data, size_t data_size)
{
  const gnutls_ecc_curve_entry_st *curve;
  int ret;

  if (group->pk == GNUTLS_PK_EC) {
    gnutls_pk_params_st pub;

    gnutls_pk_params_release(&session->key.kshare.ecdh_params);
    gnutls_pk_params_init(&session->key.kshare.ecdh_params);

    curve = _gnutls_ecc_curve_get_params(group->curve);

    gnutls_pk_params_init(&pub);

    if (curve->size * 2 + 1 != data_size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    /* generate our key */
    ret = _gnutls_pk_generate_keys(curve->pk, curve->id,
                 &session->key.kshare.ecdh_params,
                 1);
    if (ret < 0)
      return gnutls_assert_val(ret);

    /* read the public key */
    ret = _gnutls_ecc_ansi_x962_import(data, data_size,
               &pub.params[ECC_X],
               &pub.params[ECC_Y]);
    if (ret < 0)
      return gnutls_assert_val(ret);

    pub.algo = group->pk;
    pub.curve = curve->id;
    pub.params_nr = 2;

    /* generate shared */
    ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key,
                &session->key.kshare.ecdh_params,
                &pub);
    gnutls_pk_params_release(&pub);
    if (ret < 0) {
      return gnutls_assert_val(ret);
    }

    ret = 0;

  } else if (group->pk == GNUTLS_PK_ECDH_X25519 ||
       group->pk == GNUTLS_PK_ECDH_X448) {
    gnutls_pk_params_st pub;

    gnutls_pk_params_release(&session->key.kshare.ecdhx_params);
    gnutls_pk_params_init(&session->key.kshare.ecdhx_params);

    curve = _gnutls_ecc_curve_get_params(group->curve);

    if (group->pk2 != GNUTLS_PK_UNKNOWN) {
      if (curve->size > data_size)
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
    } else {
      if (curve->size != data_size)
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
    }

    /* generate our key */
    ret = _gnutls_pk_generate_keys(
      curve->pk, curve->id, &session->key.kshare.ecdhx_params,
      1);
    if (ret < 0)
      return gnutls_assert_val(ret);

    /* read the public key and generate shared */
    gnutls_pk_params_init(&pub);

    pub.algo = group->pk;
    pub.curve = curve->id;

    pub.raw_pub.data = (void *)data;
    pub.raw_pub.size = curve->size;

    /* We don't mask the MSB in the final byte as required
     * by RFC7748. This will be done internally by nettle 3.3 or later.
     */
    ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key,
                &session->key.kshare.ecdhx_params,
                &pub);
    if (ret < 0) {
      return gnutls_assert_val(ret);
    }

    if (group->pk2 != GNUTLS_PK_UNKNOWN) {
      gnutls_datum_t key;
      gnutls_datum_t peer_pub;

      gnutls_pk_params_release(
        &session->key.kshare.kem_params);
      gnutls_pk_params_init(&session->key.kshare.kem_params);

      /* generate our key */
      ret = _gnutls_pk_generate_keys(
        group->pk2, 0, &session->key.kshare.kem_params,
        1);
      if (ret < 0)
        return gnutls_assert_val(ret);

      /* server's public key is unused, but the raw_pub field
       * is used to store ciphertext */
      gnutls_free(
        session->key.kshare.kem_params.raw_pub.data);

      peer_pub.data = (uint8_t *)data + curve->size;
      peer_pub.size = data_size - curve->size;

      ret = _gnutls_pk_encaps(
        group->pk2,
        &session->key.kshare.kem_params.raw_pub, &key,
        &peer_pub);
      if (ret < 0)
        return gnutls_assert_val(ret);

      session->key.key.data = gnutls_realloc_fast(
        session->key.key.data,
        session->key.key.size + key.size);
      if (!session->key.key.data) {
        _gnutls_free_datum(&key);
        return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
      }

      memcpy(session->key.key.data + session->key.key.size,
             key.data, key.size);
      session->key.key.size += key.size;
      _gnutls_free_datum(&key);
    }

    ret = 0;

  } else if (group->pk == GNUTLS_PK_DH) {
    gnutls_pk_params_st pub;

    /* we need to initialize the group parameters first */
    gnutls_pk_params_release(&session->key.kshare.dh_params);
    gnutls_pk_params_init(&session->key.kshare.dh_params);

    if (data_size != group->prime->size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    /* set group params */
    ret = _gnutls_mpi_init_scan_nz(
      &session->key.kshare.dh_params.params[DH_G],
      group->generator->data, group->generator->size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_mpi_init_scan_nz(
      &session->key.kshare.dh_params.params[DH_P],
      group->prime->data, group->prime->size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    ret = _gnutls_mpi_init_scan_nz(
      &session->key.kshare.dh_params.params[DH_Q],
      group->q->data, group->q->size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    session->key.kshare.dh_params.algo = GNUTLS_PK_DH;
    session->key.kshare.dh_params.qbits = *group->q_bits;
    session->key.kshare.dh_params.params_nr = 3;

    /* generate our keys */
    ret = _gnutls_pk_generate_keys(
      group->pk, 0, &session->key.kshare.dh_params, 1);
    if (ret < 0)
      return gnutls_assert_val(ret);

    /* read the public key and generate shared */
    gnutls_pk_params_init(&pub);

    ret = _gnutls_mpi_init_scan_nz(&pub.params[DH_Y], data,
                 data_size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    pub.algo = group->pk;

    /* generate shared key */
    ret = _gnutls_pk_derive_tls13(GNUTLS_PK_DH, &session->key.key,
                &session->key.kshare.dh_params,
                &pub);
    _gnutls_mpi_release(&pub.params[DH_Y]);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = 0;
  } else {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  _gnutls_debug_log("EXT[%p]: server generated %s shared key\n", session,
        group->name);

  return ret;
}

/* Generates shared key and stores it in session->key.key
 */
static int client_use_key_share(gnutls_session_t session,
        const gnutls_group_entry_st *group,
        const uint8_t *data, size_t data_size)
{
  const gnutls_ecc_curve_entry_st *curve;
  int ret;

  if (group->pk == GNUTLS_PK_EC) {
    gnutls_pk_params_st pub;

    curve = _gnutls_ecc_curve_get_params(group->curve);

    gnutls_pk_params_init(&pub);

    if (session->key.kshare.ecdh_params.algo != group->pk ||
        session->key.kshare.ecdh_params.curve != curve->id)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    if (curve->size * 2 + 1 != data_size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    /* read the server's public key */
    ret = _gnutls_ecc_ansi_x962_import(data, data_size,
               &pub.params[ECC_X],
               &pub.params[ECC_Y]);
    if (ret < 0)
      return gnutls_assert_val(ret);

    pub.algo = group->pk;
    pub.curve = curve->id;
    pub.params_nr = 2;

    /* generate shared key */
    ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key,
                &session->key.kshare.ecdh_params,
                &pub);
    gnutls_pk_params_release(&pub);
    if (ret < 0) {
      return gnutls_assert_val(ret);
    }

    ret = 0;

  } else if (group->pk == GNUTLS_PK_ECDH_X25519 ||
       group->pk == GNUTLS_PK_ECDH_X448) {
    gnutls_pk_params_st pub;

    curve = _gnutls_ecc_curve_get_params(group->curve);

    if (session->key.kshare.ecdhx_params.algo != group->pk ||
        session->key.kshare.ecdhx_params.curve != curve->id)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    if (group->pk2 != GNUTLS_PK_UNKNOWN) {
      if (curve->size > data_size)
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
    } else {
      if (curve->size != data_size)
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
    }

    /* read the public key and generate shared */
    gnutls_pk_params_init(&pub);

    pub.algo = group->pk;
    pub.curve = curve->id;

    pub.raw_pub.data = (void *)data;
    pub.raw_pub.size = data_size;

    /* We don't mask the MSB in the final byte as required
     * by RFC7748. This will be done internally by nettle 3.3 or later.
     */
    ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key,
                &session->key.kshare.ecdhx_params,
                &pub);
    if (ret < 0) {
      return gnutls_assert_val(ret);
    }

    if (group->pk2 != GNUTLS_PK_UNKNOWN) {
      gnutls_datum_t key;
      gnutls_datum_t ciphertext;

      ciphertext.data = (uint8_t *)data + curve->size;
      ciphertext.size = data_size - curve->size;

      ret = _gnutls_pk_decaps(
        group->pk2, &key, &ciphertext,
        &session->key.kshare.kem_params.raw_priv);
      if (ret < 0)
        return gnutls_assert_val(ret);

      session->key.key.data = gnutls_realloc_fast(
        session->key.key.data,
        session->key.key.size + key.size);
      if (!session->key.key.data) {
        _gnutls_free_datum(&key);
        return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
      }

      memcpy(session->key.key.data + session->key.key.size,
             key.data, key.size);
      session->key.key.size += key.size;
      _gnutls_free_datum(&key);
    }

    ret = 0;

  } else if (group->pk == GNUTLS_PK_DH) {
    gnutls_pk_params_st pub;

    if (session->key.kshare.dh_params.algo != group->pk ||
        session->key.kshare.dh_params.dh_group != group->id)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    if (data_size != group->prime->size)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    /* read the public key and generate shared */
    gnutls_pk_params_init(&pub);

    ret = _gnutls_mpi_init_scan_nz(&pub.params[DH_Y], data,
                 data_size);
    if (ret < 0)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    pub.algo = group->pk;

    /* generate shared key */
    ret = _gnutls_pk_derive_tls13(GNUTLS_PK_DH, &session->key.key,
                &session->key.kshare.dh_params,
                &pub);
    _gnutls_mpi_release(&pub.params[DH_Y]);
    if (ret < 0)
      return gnutls_assert_val(ret);

    ret = 0;
  } else {
    return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
  }

  _gnutls_debug_log("EXT[%p]: client generated %s shared key\n", session,
        group->name);

  return ret;
}

static int key_share_recv_params(gnutls_session_t session, const uint8_t *data,
         size_t data_size)
{
  int ret;
  size_t size;
  unsigned gid;
  const version_entry_st *ver;
  const gnutls_group_entry_st *group;
  unsigned used_share = 0;

  if (session->security_parameters.entity == GNUTLS_SERVER) {
    ver = get_version(session);
    if (ver == NULL || ver->key_shares == 0)
      return gnutls_assert_val(0);

    DECR_LEN(data_size, 2);
    size = _gnutls_read_uint16(data);
    data += 2;

    if (data_size != size)
      return gnutls_assert_val(
        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    /* if we do PSK without DH ignore that share */
    if ((session->internals.hsk_flags & HSK_PSK_SELECTED) &&
        (session->internals.hsk_flags & HSK_PSK_KE_MODE_PSK)) {
      reset_cand_groups(session);
      return 0;
    }

    while (data_size > 0) {
      DECR_LEN(data_size, 2);
      gid = _gnutls_read_uint16(data);
      data += 2;

      DECR_LEN(data_size, 2);
      size = _gnutls_read_uint16(data);
      data += 2;

      DECR_LEN(data_size, size);

      /* at this point we have already negotiated a group;
       * find the group's share. */
      group = _gnutls_tls_id_to_group(gid);

      if (group != NULL)
        _gnutls_handshake_log(
          "EXT[%p]: Received key share for %s\n",
          session, group->name);

      if (group != NULL &&
          group == session->internals.cand_group) {
        _gnutls_session_group_set(session, group);

        ret = server_use_key_share(session, group, data,
                 size);
        if (ret < 0)
          return gnutls_assert_val(ret);

        used_share = 1;
        break;
      }

      data += size;
      continue;
    }

    /* we utilize GNUTLS_E_NO_COMMON_KEY_SHARE for:
     * 1. signal for hello-retry-request in the handshake
     *    layer during first client hello parsing (server side - here).
     *    This does not result to error code being
     *    propagated to app layer.
     * 2. Propagate to application error code that no
     *    common key share was found after an HRR was
     *    received (client side)
     * 3. Propagate to application error code that no
     *    common key share was found after an HRR was
     *    sent (server side).
     * In cases (2,3) the error is translated to illegal
     * parameter alert.
     */
    if (used_share == 0) {
      return gnutls_assert_val(GNUTLS_E_NO_COMMON_KEY_SHARE);
    }

    session->internals.hsk_flags |= HSK_KEY_SHARE_RECEIVED;
  } else { /* Client */
    ver = get_version(session);
    if (unlikely(ver == NULL || ver->key_shares == 0))
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    if (_gnutls_ext_get_msg(session) == GNUTLS_EXT_FLAG_HRR) {
      if (unlikely(!(session->internals.hsk_flags &
               HSK_HRR_RECEIVED)))
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

      DECR_LEN(data_size, 2);
      gid = _gnutls_read_uint16(data);

      group = _gnutls_tls_id_to_group(gid);
      if (group == NULL)
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

      _gnutls_handshake_log(
        "EXT[%p]: HRR key share with %s\n", session,
        group->name);

      /* check if we support it */
      ret = _gnutls_session_supports_group(session,
                   group->id);
      if (ret < 0) {
        _gnutls_handshake_log(
          "EXT[%p]: received share for %s which is disabled\n",
          session, group->name);
        return gnutls_assert_val(ret);
      }

      _gnutls_session_group_set(session, group);

      return 0;
    }
    /* else */

    DECR_LEN(data_size, 2);
    gid = _gnutls_read_uint16(data);
    data += 2;

    DECR_LEN(data_size, 2);
    size = _gnutls_read_uint16(data);
    data += 2;

    if (data_size != size)
      return gnutls_assert_val(
        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    group = _gnutls_tls_id_to_group(gid);
    if (group == NULL)
      return gnutls_assert_val(
        GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    /* check if we support it */
    ret = _gnutls_session_supports_group(session, group->id);
    if (ret < 0) {
      _gnutls_handshake_log(
        "EXT[%p]: received share for %s which is disabled\n",
        session, group->name);
      return gnutls_assert_val(ret);
    }

    _gnutls_session_group_set(session, group);
    session->internals.hsk_flags |= HSK_KEY_SHARE_RECEIVED;

    ret = client_use_key_share(session, group, data, size);
    if (ret < 0)
      return gnutls_assert_val(ret);
  }

  return 0;
}

static inline bool pk_type_is_ecdhx(gnutls_pk_algorithm_t pk)
{
  return pk == GNUTLS_PK_ECDH_X25519 || pk == GNUTLS_PK_ECDH_X448;
}

static inline bool pk_type_equal(gnutls_pk_algorithm_t a,
         gnutls_pk_algorithm_t b)
{
  return a == b || (pk_type_is_ecdhx(a) && pk_type_is_ecdhx(b));
}

/* returns data_size or a negative number on failure
 */
static int key_share_send_params(gnutls_session_t session,
         gnutls_buffer_st *extdata)
{
  unsigned i;
  int ret;
  unsigned int generated = 0;
  const gnutls_group_entry_st *group;
  const version_entry_st *ver;

  /* this extension is only being sent on client side */
  if (session->security_parameters.entity == GNUTLS_CLIENT) {
    unsigned int length_pos;

    ver = _gnutls_version_max(session);
    if (unlikely(ver == NULL || ver->key_shares == 0))
      return 0;

    if (!have_creds_for_tls13(session))
      return 0;

    length_pos = extdata->length;

    ret = _gnutls_buffer_append_prefix(extdata, 16, 0);
    if (ret < 0)
      return gnutls_assert_val(ret);

    if (session->internals.hsk_flags &
        HSK_HRR_RECEIVED) { /* we know the group */
      group = get_group(session);
      if (unlikely(group == NULL))
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

      ret = client_gen_key_share(session, group, extdata);
      if (ret == GNUTLS_E_INT_RET_0)
        return gnutls_assert_val(
          GNUTLS_E_NO_COMMON_KEY_SHARE);
      if (ret < 0)
        return gnutls_assert_val(ret);
    } else {
      gnutls_pk_algorithm_t selected_groups[3];
      unsigned max_groups = 2; /* GNUTLS_KEY_SHARE_TOP2 */

      if (session->internals.flags & GNUTLS_KEY_SHARE_TOP)
        max_groups = 1;
      else if (session->internals.flags &
         GNUTLS_KEY_SHARE_TOP3)
        max_groups = 3;

      assert(max_groups <=
             sizeof(selected_groups) /
               sizeof(selected_groups[0]));

      /* generate key shares for out top-(max_groups) groups
       * if they are of different PK type. */
      for (i = 0;
           i < session->internals.priorities->groups.size;
           i++) {
        unsigned int j;

        group = session->internals.priorities->groups
            .entry[i];

        for (j = 0; j < generated; j++) {
          if (pk_type_equal(group->pk,
                selected_groups[j])) {
            break;
          }
        }
        if (j < generated) {
          continue;
        }

        selected_groups[generated] = group->pk;

        ret = client_gen_key_share(session, group,
                 extdata);
        if (ret == GNUTLS_E_INT_RET_0)
          continue; /* no key share for this algorithm */
        if (ret < 0)
          return gnutls_assert_val(ret);

        generated++;

        if (generated >= max_groups)
          break;
      }
    }

    /* copy actual length */
    _gnutls_write_uint16(extdata->length - length_pos - 2,
             &extdata->data[length_pos]);

  } else { /* server */
    ver = get_version(session);
    if (unlikely(ver == NULL || ver->key_shares == 0))
      return gnutls_assert_val(0);

    if (_gnutls_ext_get_msg(session) == GNUTLS_EXT_FLAG_HRR) {
      group = session->internals.cand_group;

      if (group == NULL)
        return gnutls_assert_val(
          GNUTLS_E_NO_COMMON_KEY_SHARE);

      _gnutls_session_group_set(session, group);

      _gnutls_handshake_log(
        "EXT[%p]: requesting retry with group %s\n",
        session, group->name);
      ret = _gnutls_buffer_append_prefix(extdata, 16,
                 group->tls_id);
      if (ret < 0)
        return gnutls_assert_val(ret);
    } else {
      /* if we are negotiating PSK without DH, do not send a key share */
      if ((session->internals.hsk_flags & HSK_PSK_SELECTED) &&
          (session->internals.hsk_flags &
           HSK_PSK_KE_MODE_PSK))
        return gnutls_assert_val(0);

      group = get_group(session);
      if (unlikely(group == NULL))
        return gnutls_assert_val(
          GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

      ret = server_gen_key_share(session, group, extdata);
      if (ret < 0)
        return gnutls_assert_val(ret);
    }

    session->internals.hsk_flags |= HSK_KEY_SHARE_SENT;
  }

  return 0;
}

Coverage Report

Created: 2024-07-23 07:36