/*

 * Copyright (C) 2002-2016 Free Software Foundation, Inc.

 * Copyright (C) 2015-2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* This file contains the code for the Signature Algorithms TLS extension.

 * This extension is currently gnutls specific.

 */

#include "gnutls_int.h"

#include "errors.h"

#include "num.h"

#include <gnutls/gnutls.h>

#include "ext/signature.h"

#include "state.h"

#include "num.h"

#include "algorithms.h"

#include "abstract_int.h"

/*

 * Some (all SChannel) clients fail to send proper SigAlgs due to Micro$oft crazyness.

 * Patch the extension for them.

 */

#ifdef ENABLE_GOST

#define GOST_SIG_FIXUP_SCHANNEL

#endif

static int _gnutls_signature_algorithm_recv_params(gnutls_session_t session,

               const uint8_t *data,

               size_t data_size);

static int _gnutls_signature_algorithm_send_params(gnutls_session_t session,

               gnutls_buffer_st *extdata);

static void signature_algorithms_deinit_data(gnutls_ext_priv_data_t priv);

static int signature_algorithms_pack(gnutls_ext_priv_data_t epriv,

             gnutls_buffer_st *ps);

static int signature_algorithms_unpack(gnutls_buffer_st *ps,

               gnutls_ext_priv_data_t *_priv);

const hello_ext_entry_st ext_mod_sig = {

  .name = "Signature Algorithms",

  .tls_id = 13,

  .gid = GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS,

  .validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS |

        GNUTLS_EXT_FLAG_CLIENT_HELLO,

  .client_parse_point = GNUTLS_EXT_TLS,

  .server_parse_point = GNUTLS_EXT_TLS,

  .recv_func = _gnutls_signature_algorithm_recv_params,

  .send_func = _gnutls_signature_algorithm_send_params,

  .pack_func = signature_algorithms_pack,

  .unpack_func = signature_algorithms_unpack,

  .deinit_func = signature_algorithms_deinit_data,

  .cannot_be_overriden = 1

};

typedef struct {

  /* TLS 1.2 signature algorithms */

  gnutls_sign_algorithm_t sign_algorithms[MAX_ALGOS];

  uint16_t sign_algorithms_size;

} sig_ext_st;

/* generates a SignatureAndHashAlgorithm structure with length as prefix

 * by using the setup priorities.

 */

int _gnutls_sign_algorithm_write_params(gnutls_session_t session,

          gnutls_buffer_st *extdata)

{

  uint8_t *p;

  unsigned int len, i;

  const sign_algorithm_st *aid, *prev = NULL;

  uint8_t buffer[MAX_ALGOS * 2];

  p = buffer;

  len = 0;

  /* This generates a list of TLS signature algorithms. It has

   * limited duplicate detection, and does not add twice the same

   * AID */

  for (i = 0; i < session->internals.priorities->sigalg.size; i++) {

    aid = &session->internals.priorities->sigalg.entry[i]->aid;

    if (HAVE_UNKNOWN_SIGAID(aid))

      continue;

    if (prev && prev->id[0] == aid->id[0] &&

        prev->id[1] == aid->id[1])

      continue;

    /* Ignore non-GOST sign types for CertReq */

    if (session->security_parameters.cs &&

        _gnutls_kx_is_vko_gost(

          session->security_parameters.cs->kx_algorithm) &&

        !_sign_is_gost(

          session->internals.priorities->sigalg.entry[i]))

      continue;

    _gnutls_handshake_log(

      "EXT[%p]: sent signature algo (%d.%d) %s\n", session,

      (int)aid->id[0], (int)aid->id[1],

      session->internals.priorities->sigalg.entry[i]->name);

    len += 2;

    if (unlikely(len >= sizeof(buffer))) {

      len -= 2;

      break;

    }

    *p = aid->id[0];

    p++;

    *p = aid->id[1];

    p++;

    prev = aid;

  }

  return _gnutls_buffer_append_data_prefix(extdata, 16, buffer, len);

}

/* Parses the Signature Algorithm structure and stores data into

 * session->security_parameters.extensions.

 */

int _gnutls_sign_algorithm_parse_data(gnutls_session_t session,

              const uint8_t *data, size_t data_size)

{

  unsigned int sig, i;

  sig_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  const version_entry_st *ver = get_version(session);

  if (data_size == 0 || data_size % 2 != 0)

    return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

  if (ver == NULL) { /* assume TLS 1.2 semantics */

    ver = version_to_entry(GNUTLS_TLS1_2);

    if (unlikely(ver == NULL)) {

      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

    }

  }

  priv = gnutls_calloc(1, sizeof(*priv));

  if (priv == NULL) {

    gnutls_assert();

    return GNUTLS_E_MEMORY_ERROR;

  }

  for (i = 0; i < data_size; i += 2) {

    uint8_t id[2];

    id[0] = data[i];

    id[1] = data[i + 1];

    sig = _gnutls_tls_aid_to_sign(id[0], id[1], ver);

    _gnutls_handshake_log(

      "EXT[%p]: rcvd signature algo (%d.%d) %s\n", session,

      (int)id[0], (int)id[1], gnutls_sign_get_name(sig));

    if (sig != GNUTLS_SIGN_UNKNOWN) {

      if (priv->sign_algorithms_size == MAX_ALGOS)

        break;

      priv->sign_algorithms[priv->sign_algorithms_size++] =

        sig;

    }

  }

  epriv = priv;

  _gnutls_hello_ext_set_priv(

    session, GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS, epriv);

  return 0;

}

/*

 * In case of a server: if a SIGNATURE_ALGORITHMS extension type is

 * received then it stores into the session security parameters the

 * new value.

 *

 * In case of a client: If a signature_algorithms have been specified

 * then it is an error;

 */

static int _gnutls_signature_algorithm_recv_params(gnutls_session_t session,

               const uint8_t *data,

               size_t data_size)

{

  int ret;

  if (session->security_parameters.entity == GNUTLS_CLIENT) {

    /* nothing for now */

    gnutls_assert();

    /* Although TLS 1.2 mandates that we must not accept reply

     * to this message, there are good reasons to just ignore it. Check

     * https://www.ietf.org/mail-archive/web/tls/current/msg03880.html

     */

    /* return GNUTLS_E_UNEXPECTED_PACKET; */

  } else {

    /* SERVER SIDE

     */

    if (data_size >= 2) {

      uint16_t len;

      DECR_LEN(data_size, 2);

      len = _gnutls_read_uint16(data);

      DECR_LEN(data_size, len);

      if (data_size > 0)

        return gnutls_assert_val(

          GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

      ret = _gnutls_sign_algorithm_parse_data(session,

                data + 2, len);

      if (ret < 0) {

        gnutls_assert();

        return ret;

      }

    } else {

      return gnutls_assert_val(

        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    }

  }

  return 0;

}

/* returns data_size or a negative number on failure

 */

static int _gnutls_signature_algorithm_send_params(gnutls_session_t session,

               gnutls_buffer_st *extdata)

{

  int ret;

  size_t init_length = extdata->length;

  const version_entry_st *ver = get_version(session);

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  /* this function sends the client extension data */

  if (session->security_parameters.entity == GNUTLS_CLIENT &&

      _gnutls_version_has_selectable_sighash(ver)) {

    if (session->internals.priorities->sigalg.size > 0) {

      ret = _gnutls_sign_algorithm_write_params(session,

                  extdata);

      if (ret < 0)

        return gnutls_assert_val(ret);

      return extdata->length - init_length;

    }

  }

  /* if we are here it means we don't send the extension */

  return 0;

}

#ifdef GOST_SIG_FIXUP_SCHANNEL

static bool is_gost_sig_present(sig_ext_st *priv)

{

  unsigned i;

  const gnutls_sign_entry_st *se;

  for (i = 0; i < priv->sign_algorithms_size; i++) {

    se = _gnutls_sign_to_entry(priv->sign_algorithms[i]);

    if (se != NULL && _sign_is_gost(se))

      return true;

  }

  return false;

}

#endif

/* Returns a requested by the peer signature algorithm that

 * matches the given certificate's public key algorithm.

 *

 * When the @client_cert flag is not set, then this function will

 * also check whether the signature algorithm is allowed to be

 * used in that session. Otherwise GNUTLS_SIGN_UNKNOWN is

 * returned.

 */

gnutls_sign_algorithm_t

_gnutls_session_get_sign_algo(gnutls_session_t session, gnutls_pcert_st *cert,

            gnutls_privkey_t privkey, unsigned client_cert,

            gnutls_kx_algorithm_t kx_algorithm)

{

  unsigned i;

  int ret;

  const version_entry_st *ver = get_version(session);

  sig_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  unsigned int cert_algo;

  const gnutls_sign_entry_st *se;

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_SIGN_UNKNOWN);

  cert_algo = gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL);

  ret = _gnutls_hello_ext_get_priv(

    session, GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS, &epriv);

  if (ret < 0)

    priv = NULL;

  else

    priv = epriv;

#ifdef GOST_SIG_FIXUP_SCHANNEL

  /*

   * Some (all SChannel) clients fail to send proper SigAlgs due to Micro$oft crazyness.

   * If we are negotiating GOST KX (because we have received GOST

   * ciphersuites) and if we have received no GOST SignatureAlgorithms,

   * assume that the client could not send them and continue negotiation

   * as if correct algorithm was sent.

   */

  if (_gnutls_kx_is_vko_gost(kx_algorithm) &&

      (!priv || !is_gost_sig_present(priv) ||

       !_gnutls_version_has_selectable_sighash(ver))) {

    gnutls_digest_algorithm_t dig;

    _gnutls_handshake_log(

      "EXT[%p]: GOST KX, but no GOST SigAlgs received, patching up.",

      session);

    if (cert_algo == GNUTLS_PK_GOST_01)

      dig = GNUTLS_DIG_GOSTR_94;

    else if (cert_algo == GNUTLS_PK_GOST_12_256)

      dig = GNUTLS_DIG_STREEBOG_256;

    else if (cert_algo == GNUTLS_PK_GOST_12_512)

      dig = GNUTLS_DIG_STREEBOG_512;

    else

      dig = GNUTLS_DIG_SHA1;

    ret = gnutls_pk_to_sign(cert_algo, dig);

    if (!client_cert &&

        _gnutls_session_sign_algo_enabled(session, ret) < 0)

      goto fail;

    return ret;

  }

#endif

  if (!priv || !_gnutls_version_has_selectable_sighash(ver)) {

    /* none set, allow SHA-1 only */

    ret = gnutls_pk_to_sign(cert_algo, GNUTLS_DIG_SHA1);

    if (!client_cert &&

        _gnutls_session_sign_algo_enabled(session, ret) < 0)

      goto fail;

    return ret;

  }

  for (i = 0; i < priv->sign_algorithms_size; i++) {

    se = _gnutls_sign_to_entry(priv->sign_algorithms[i]);

    if (se == NULL)

      continue;

    _gnutls_handshake_log("checking cert compat with %s\n",

              se->name);

    if (_gnutls_privkey_compatible_with_sig(

          privkey, priv->sign_algorithms[i]) == 0)

      continue;

    if (sign_supports_cert_pk_algorithm(se, cert_algo) != 0) {

      if (_gnutls_pubkey_compatible_with_sig(

            session, cert->pubkey, ver, se->id) < 0)

        continue;

      if (_gnutls_session_sign_algo_enabled(session, se->id) <

          0)

        continue;

      return se->id;

    }

  }

  /* When having a legacy client certificate which can only be signed

   * using algorithms we don't always enable by default (e.g., DSA-SHA1),

   * continue and sign with it. */

  if (client_cert) {

    _gnutls_audit_log(

      session,

      "No shared signature schemes with peer for client certificate (%s). Is the certificate a legacy one?\n",

      gnutls_pk_get_name(cert_algo));

  }

fail:

  return GNUTLS_SIGN_UNKNOWN;

}

/* Check if the given signature algorithm is supported.

 * This means that it is enabled by the priority functions,

 * and in case of a server a matching certificate exists.

 */

int _gnutls_session_sign_algo_enabled(gnutls_session_t session,

              gnutls_sign_algorithm_t sig)

{

  unsigned i;

  const version_entry_st *ver = get_version(session);

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  if (!_gnutls_version_has_selectable_sighash(ver)) {

    return 0;

  }

  if (ver->tls13_sem) {

    /* disallow RSA, DSA, and SHA1 */

    const gnutls_sign_entry_st *se;

    se = _gnutls_sign_to_entry(sig);

    if (se == NULL ||

        (se->flags & GNUTLS_SIGN_FLAG_TLS13_OK) == 0) {

      gnutls_assert();

      goto disallowed;

    }

  }

  for (i = 0; i < session->internals.priorities->sigalg.size; i++) {

    if (session->internals.priorities->sigalg.entry[i]->id == sig) {

      return 0; /* ok */

    }

  }

disallowed:

  _gnutls_handshake_log("Signature algorithm %s is not enabled\n",

            gnutls_sign_algorithm_get_name(sig));

  return GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM;

}

static void signature_algorithms_deinit_data(gnutls_ext_priv_data_t priv)

{

  gnutls_free(priv);

}

static int signature_algorithms_pack(gnutls_ext_priv_data_t epriv,

             gnutls_buffer_st *ps)

{

  sig_ext_st *priv = epriv;

  int ret, i;

  BUFFER_APPEND_NUM(ps, priv->sign_algorithms_size);

  for (i = 0; i < priv->sign_algorithms_size; i++) {

    BUFFER_APPEND_NUM(ps, priv->sign_algorithms[i]);

  }

  return 0;

}

static int signature_algorithms_unpack(gnutls_buffer_st *ps,

               gnutls_ext_priv_data_t *_priv)

{

  sig_ext_st *priv;

  int i, ret;

  gnutls_ext_priv_data_t epriv;

  priv = gnutls_calloc(1, sizeof(*priv));

  if (priv == NULL) {

    gnutls_assert();

    return GNUTLS_E_MEMORY_ERROR;

  }

  BUFFER_POP_NUM(ps, priv->sign_algorithms_size);

  for (i = 0; i < priv->sign_algorithms_size; i++) {

    BUFFER_POP_NUM(ps, priv->sign_algorithms[i]);

  }

  epriv = priv;

  *_priv = epriv;

  return 0;

error:

  gnutls_free(priv);

  return ret;

}

/**

 * gnutls_sign_algorithm_get_requested:

 * @session: is a #gnutls_session_t type.

 * @indx: is an index of the signature algorithm to return

 * @algo: the returned certificate type will be stored there

 *

 * Returns the signature algorithm specified by index that was

 * requested by the peer. If the specified index has no data available

 * this function returns %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE.  If

 * the negotiated TLS version does not support signature algorithms

 * then %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned even

 * for the first index.  The first index is 0.

 *

 * This function is useful in the certificate callback functions

 * to assist in selecting the correct certificate.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise

 *   an error code is returned.

 *

 * Since: 2.10.0

 **/

int gnutls_sign_algorithm_get_requested(gnutls_session_t session, size_t indx,

          gnutls_sign_algorithm_t *algo)

{

  const version_entry_st *ver = get_version(session);

  sig_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  int ret;

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  ret = _gnutls_hello_ext_get_priv(

    session, GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS, &epriv);

  if (ret < 0) {

    gnutls_assert();

    return ret;

  }

  priv = epriv;

  if (!_gnutls_version_has_selectable_sighash(ver) ||

      priv->sign_algorithms_size == 0) {

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

  }

  if (indx < priv->sign_algorithms_size) {

    *algo = priv->sign_algorithms[indx];

    return 0;

  } else

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

}

/**

 * gnutls_sign_algorithm_get:

 * @session: is a #gnutls_session_t type.

 *

 * Returns the signature algorithm that is (or will be) used in this

 * session by the server to sign data. This function should be

 * used only with TLS 1.2 or later.

 *

 * Returns: The sign algorithm or %GNUTLS_SIGN_UNKNOWN.

 *

 * Since: 3.1.1

 **/

int gnutls_sign_algorithm_get(gnutls_session_t session)

{

  return session->security_parameters.server_sign_algo;

}

/**

 * gnutls_sign_algorithm_get_client:

 * @session: is a #gnutls_session_t type.

 *

 * Returns the signature algorithm that is (or will be) used in this

 * session by the client to sign data. This function should be

 * used only with TLS 1.2 or later.

 *

 * Returns: The sign algorithm or %GNUTLS_SIGN_UNKNOWN.

 *

 * Since: 3.1.11

 **/

int gnutls_sign_algorithm_get_client(gnutls_session_t session)

{

  return session->security_parameters.client_sign_algo;

}