/* This function over-rides the s2n internal copy of the same function */
int nist_fake_urandom_data(struct s2n_blob *blob)
{
/* At first, we use entropy data provided by the NIST test vectors */
GUARD(s2n_stuffer_read(&nist_reference_entropy, blob));
return 0;
}
int s2n_x509_trust_store_add_pem(struct s2n_x509_trust_store *store, const char *pem)
{
notnull_check(store);
notnull_check(pem);
if (!store->trust_store) {
store->trust_store = X509_STORE_new();
}
DEFER_CLEANUP(struct s2n_stuffer pem_in_stuffer = {{0}}, s2n_stuffer_free);
DEFER_CLEANUP(struct s2n_stuffer der_out_stuffer = {{0}}, s2n_stuffer_free);
GUARD(s2n_stuffer_alloc_ro_from_string(&pem_in_stuffer, pem));
GUARD(s2n_stuffer_growable_alloc(&der_out_stuffer, 2048));
do {
DEFER_CLEANUP(struct s2n_blob next_cert = {0}, s2n_free);
GUARD(s2n_stuffer_certificate_from_pem(&pem_in_stuffer, &der_out_stuffer));
GUARD(s2n_alloc(&next_cert, s2n_stuffer_data_available(&der_out_stuffer)));
GUARD(s2n_stuffer_read(&der_out_stuffer, &next_cert));
const uint8_t *data = next_cert.data;
DEFER_CLEANUP(X509 *ca_cert = d2i_X509(NULL, &data, next_cert.size), X509_free_pointer);
S2N_ERROR_IF(ca_cert == NULL, S2N_ERR_DECODE_CERTIFICATE);
GUARD_OSSL(X509_STORE_add_cert(store->trust_store, ca_cert), S2N_ERR_DECODE_CERTIFICATE);
} while (s2n_stuffer_data_available(&pem_in_stuffer));
return 0;
}
/* See http://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html 2.5 */
int s2n_sslv2_client_hello_recv(struct s2n_connection *conn)
{
struct s2n_stuffer *in = &conn->handshake.io;
uint16_t session_id_length;
uint16_t cipher_suites_length;
uint16_t challenge_length;
uint8_t *cipher_suites;
if (conn->client_protocol_version < conn->config->cipher_preferences->minimum_protocol_version || conn->client_protocol_version > conn->server_protocol_version) {
GUARD(s2n_queue_reader_unsupported_protocol_version_alert(conn));
S2N_ERROR(S2N_ERR_BAD_MESSAGE);
}
conn->actual_protocol_version = MIN(conn->client_protocol_version, conn->server_protocol_version);
conn->client_hello_version = S2N_SSLv2;
/* We start 5 bytes into the record */
GUARD(s2n_stuffer_read_uint16(in, &cipher_suites_length));
if (cipher_suites_length % S2N_SSLv2_CIPHER_SUITE_LEN) {
S2N_ERROR(S2N_ERR_BAD_MESSAGE);
}
GUARD(s2n_stuffer_read_uint16(in, &session_id_length));
GUARD(s2n_stuffer_read_uint16(in, &challenge_length));
if (challenge_length > S2N_TLS_RANDOM_DATA_LEN) {
S2N_ERROR(S2N_ERR_BAD_MESSAGE);
}
cipher_suites = s2n_stuffer_raw_read(in, cipher_suites_length);
notnull_check(cipher_suites);
GUARD(s2n_set_cipher_as_sslv2_server(conn, cipher_suites, cipher_suites_length / S2N_SSLv2_CIPHER_SUITE_LEN));
if (session_id_length > s2n_stuffer_data_available(in)) {
S2N_ERROR(S2N_ERR_BAD_MESSAGE);
}
if (session_id_length > 0 && session_id_length <= S2N_TLS_SESSION_ID_MAX_LEN) {
GUARD(s2n_stuffer_read_bytes(in, conn->session_id, session_id_length));
conn->session_id_len = (uint8_t) session_id_length;
} else {
GUARD(s2n_stuffer_skip_read(in, session_id_length));
}
struct s2n_blob b;
b.data = conn->secure.client_random;
b.size = S2N_TLS_RANDOM_DATA_LEN;
b.data += S2N_TLS_RANDOM_DATA_LEN - challenge_length;
b.size -= S2N_TLS_RANDOM_DATA_LEN - challenge_length;
GUARD(s2n_stuffer_read(in, &b));
conn->server->chosen_cert_chain = conn->config->cert_and_key_pairs;
GUARD(s2n_conn_set_handshake_type(conn));
return 0;
}
/**
* Helper function: read n bits of hex data.
*/
static int s2n_stuffer_read_n_bits_hex(struct s2n_stuffer *stuffer, uint8_t n, uint64_t *u)
{
uint8_t hex_data[16];
struct s2n_blob b = { .data = hex_data, .size = n / 4 };
GUARD(s2n_stuffer_read(stuffer, &b));
/* Start with u = 0 */
*u = 0;
for (int i = 0; i < b.size; i++) {
*u <<= 4;
if (b.data[i] >= '0' && b.data[i] <= '9') {
*u |= b.data[i] - '0';
} else if (b.data[i] >= 'a' && b.data[i] <= 'f') {
*u |= b.data[i] - 'a' + 10;
} else if (b.data[i] >= 'A' && b.data[i] <= 'F') {
*u |= b.data[i] - 'A' + 10;
} else {
S2N_ERROR(S2N_ERR_BAD_MESSAGE);
}
}
return 0;
}
int s2n_stuffer_read_hex(struct s2n_stuffer *stuffer, struct s2n_stuffer *out, uint32_t n)
{
gte_check(s2n_stuffer_space_remaining(out), n);
for (int i = 0; i < n; i++) {
uint8_t c;
GUARD(s2n_stuffer_read_uint8_hex(stuffer, &c));
GUARD(s2n_stuffer_write_uint8(out, c));
}
return 0;
}
int main(int argc, char **argv)
{
uint8_t data[256] = { 0 };
struct s2n_drbg drbg = {{ 0 }};
struct s2n_blob blob = {.data = data, .size = 64 };
struct s2n_timer timer;
uint64_t drbg_nanoseconds;
uint64_t urandom_nanoseconds;
struct s2n_stuffer nist_reference_personalization_strings;
struct s2n_stuffer nist_reference_returned_bits;
struct s2n_stuffer nist_reference_values;
struct s2n_config *config;
BEGIN_TEST();
EXPECT_NOT_NULL(config = s2n_config_new())
/* Open /dev/urandom */
EXPECT_TRUE(entropy_fd = open("/dev/urandom", O_RDONLY));
/* Convert the hex entropy data into binary */
EXPECT_SUCCESS(s2n_stuffer_alloc_ro_from_hex_string(&nist_reference_entropy, nist_reference_entropy_hex));
EXPECT_SUCCESS(s2n_stuffer_alloc_ro_from_hex_string(&nist_reference_personalization_strings, nist_reference_personalization_strings_hex));
EXPECT_SUCCESS(s2n_stuffer_alloc_ro_from_hex_string(&nist_reference_returned_bits, nist_reference_returned_bits_hex));
EXPECT_SUCCESS(s2n_stuffer_alloc_ro_from_hex_string(&nist_reference_values, nist_reference_values_hex));
/* Check everything against the NIST vectors */
for (int i = 0; i < 14; i++) {
uint8_t ps[32];
struct s2n_drbg nist_drbg = { .entropy_generator = nist_fake_urandom_data };
struct s2n_blob personalization_string = {.data = ps, .size = 32};
/* Read the next personalization string */
EXPECT_SUCCESS(s2n_stuffer_read(&nist_reference_personalization_strings, &personalization_string));
/* Instantiate the DRBG */
EXPECT_SUCCESS(s2n_drbg_instantiate(&nist_drbg, &personalization_string));
uint8_t nist_v[16];
GUARD(s2n_stuffer_read_bytes(&nist_reference_values, nist_v, sizeof(nist_v)));
EXPECT_TRUE(memcmp(nist_v, nist_drbg.v, sizeof(nist_drbg.v)) == 0);
/* Generate 512 bits (FIRST CALL) */
uint8_t out[64];
struct s2n_blob generated = {.data = out, .size = 64 };
EXPECT_SUCCESS(s2n_drbg_generate(&nist_drbg, &generated));
GUARD(s2n_stuffer_read_bytes(&nist_reference_values, nist_v, sizeof(nist_v)));
EXPECT_TRUE(memcmp(nist_v, nist_drbg.v, sizeof(nist_drbg.v)) == 0);
/* Generate another 512 bits (SECOND CALL) */
EXPECT_SUCCESS(s2n_drbg_generate(&nist_drbg, &generated));
GUARD(s2n_stuffer_read_bytes(&nist_reference_values, nist_v, sizeof(nist_v)));
EXPECT_TRUE(memcmp(nist_v, nist_drbg.v, sizeof(nist_drbg.v)) == 0);
uint8_t nist_returned_bits[64];
GUARD(s2n_stuffer_read_bytes(&nist_reference_returned_bits, nist_returned_bits, sizeof(nist_returned_bits)));
EXPECT_TRUE(memcmp(nist_returned_bits, out, sizeof(nist_returned_bits)) == 0);
EXPECT_SUCCESS(s2n_drbg_wipe(&nist_drbg));
}
EXPECT_SUCCESS(s2n_drbg_instantiate(&drbg, &blob));
/* Use the DRBG for 32MB of data */
EXPECT_SUCCESS(s2n_timer_start(config, &timer));
for (int i = 0; i < 500000; i++) {
EXPECT_SUCCESS(s2n_drbg_generate(&drbg, &blob));
}
EXPECT_SUCCESS(s2n_timer_reset(config, &timer, &drbg_nanoseconds));
/* Use urandom for 32MB of data */
EXPECT_SUCCESS(s2n_timer_start(config, &timer));
for (int i = 0; i < 500000; i++) {
EXPECT_SUCCESS(s2n_get_urandom_data(&blob));
}
EXPECT_SUCCESS(s2n_timer_reset(config, &timer, &urandom_nanoseconds));
/* Confirm that the DRBG is faster than urandom */
EXPECT_TRUE(drbg_nanoseconds < urandom_nanoseconds);
/* NOTE: s2n_random_test also includes monobit tests for this DRBG */
/* the DRBG state is 128 bytes, test that we can get more than that */
blob.size = 129;
for (int i = 0; i < 10; i++) {
EXPECT_SUCCESS(s2n_drbg_generate(&drbg, &blob));
}
EXPECT_SUCCESS(s2n_drbg_wipe(&drbg));
EXPECT_SUCCESS(s2n_stuffer_free(&nist_reference_entropy));
EXPECT_SUCCESS(s2n_stuffer_free(&nist_reference_personalization_strings));
EXPECT_SUCCESS(s2n_stuffer_free(&nist_reference_returned_bits));
EXPECT_SUCCESS(s2n_stuffer_free(&nist_reference_values));
END_TEST();
}
int s2n_config_free_cert_chain_and_key(struct s2n_config *config)
{
struct s2n_blob b = {
.data = (uint8_t *) config->cert_and_key_pairs,
.size = sizeof(struct s2n_cert_chain_and_key)
};
/* If there were cert and key pairs set, walk the chain and free the certs */
if (config->cert_and_key_pairs) {
struct s2n_cert_chain *node = config->cert_and_key_pairs->head;
while (node) {
struct s2n_blob n = {
.data = (uint8_t *)node,
.size = sizeof(struct s2n_cert_chain)
};
/* Free the cert */
GUARD(s2n_free(&node->cert));
/* Advance to next */
node = node->next;
/* Free the node */
GUARD(s2n_free(&n));
}
GUARD(s2n_rsa_private_key_free(&config->cert_and_key_pairs->private_key));
GUARD(s2n_free(&config->cert_and_key_pairs->ocsp_status));
}
GUARD(s2n_free(&b));
return 0;
}
int s2n_config_free_dhparams(struct s2n_config *config)
{
struct s2n_blob b = {
.data = (uint8_t *) config->dhparams,
.size = sizeof(struct s2n_dh_params)
};
if (config->dhparams) {
GUARD(s2n_dh_params_free(config->dhparams));
}
GUARD(s2n_free(&b));
return 0;
}
int s2n_config_free(struct s2n_config *config)
{
struct s2n_blob b = {.data = (uint8_t *) config,.size = sizeof(struct s2n_config) };
GUARD(s2n_config_free_cert_chain_and_key(config));
GUARD(s2n_config_free_dhparams(config));
GUARD(s2n_free(&config->application_protocols));
GUARD(s2n_free(&b));
return 0;
}
int s2n_config_set_cipher_preferences(struct s2n_config *config, const char *version)
{
for (int i = 0; selection[i].version != NULL; i++) {
if (!strcasecmp(version, selection[i].version)) {
config->cipher_preferences = selection[i].preferences;
return 0;
}
}
s2n_errno = S2N_ERR_INVALID_CIPHER_PREFERENCES;
return -1;
}
int s2n_config_set_protocol_preferences(struct s2n_config *config, const char * const *protocols, int protocol_count)
{
struct s2n_stuffer protocol_stuffer;
GUARD(s2n_free(&config->application_protocols));
if (protocols == NULL || protocol_count == 0) {
/* NULL value indicates no prference, so nothing to do */
return 0;
}
GUARD(s2n_stuffer_growable_alloc(&protocol_stuffer, 256));
for (int i = 0; i < protocol_count; i++) {
size_t length = strlen(protocols[i]);
uint8_t protocol[255];
if (length > 255 || (s2n_stuffer_data_available(&protocol_stuffer) + length + 1) > 65535) {
return S2N_ERR_APPLICATION_PROTOCOL_TOO_LONG;
}
memcpy_check(protocol, protocols[i], length);
GUARD(s2n_stuffer_write_uint8(&protocol_stuffer, length));
GUARD(s2n_stuffer_write_bytes(&protocol_stuffer, protocol, length));
}
uint32_t size = s2n_stuffer_data_available(&protocol_stuffer);
/* config->application_protocols blob now owns this data */
config->application_protocols.size = size;
config->application_protocols.data = s2n_stuffer_raw_read(&protocol_stuffer, size);
notnull_check(config->application_protocols.data);
return 0;
}
int s2n_config_set_status_request_type(struct s2n_config *config, s2n_status_request_type type)
{
config->status_request_type = type;
return 0;
}
int s2n_config_add_cert_chain_and_key_with_status(struct s2n_config *config,
char *cert_chain_pem, char *private_key_pem, const uint8_t *status, uint32_t length)
{
struct s2n_stuffer chain_in_stuffer, cert_out_stuffer, key_in_stuffer, key_out_stuffer;
struct s2n_blob key_blob;
struct s2n_blob mem;
/* Allocate the memory for the chain and key struct */
GUARD(s2n_alloc(&mem, sizeof(struct s2n_cert_chain_and_key)));
config->cert_and_key_pairs = (struct s2n_cert_chain_and_key *)(void *)mem.data;
config->cert_and_key_pairs->ocsp_status.data = NULL;
config->cert_and_key_pairs->ocsp_status.size = 0;
/* Put the private key pem in a stuffer */
GUARD(s2n_stuffer_alloc_ro_from_string(&key_in_stuffer, private_key_pem));
GUARD(s2n_stuffer_growable_alloc(&key_out_stuffer, strlen(private_key_pem)));
/* Convert pem to asn1 and asn1 to the private key */
GUARD(s2n_stuffer_rsa_private_key_from_pem(&key_in_stuffer, &key_out_stuffer));
GUARD(s2n_stuffer_free(&key_in_stuffer));
key_blob.size = s2n_stuffer_data_available(&key_out_stuffer);
key_blob.data = s2n_stuffer_raw_read(&key_out_stuffer, key_blob.size);
notnull_check(key_blob.data);
GUARD(s2n_asn1der_to_rsa_private_key(&config->cert_and_key_pairs->private_key, &key_blob));
GUARD(s2n_stuffer_free(&key_out_stuffer));
/* Turn the chain into a stuffer */
GUARD(s2n_stuffer_alloc_ro_from_string(&chain_in_stuffer, cert_chain_pem));
GUARD(s2n_stuffer_growable_alloc(&cert_out_stuffer, 2048));
struct s2n_cert_chain **insert = &config->cert_and_key_pairs->head;
uint32_t chain_size = 0;
do {
struct s2n_cert_chain *new_node;
if (s2n_stuffer_certificate_from_pem(&chain_in_stuffer, &cert_out_stuffer) < 0) {
if (chain_size == 0) {
S2N_ERROR(S2N_ERR_NO_CERTIFICATE_IN_PEM);
}
break;
}
GUARD(s2n_alloc(&mem, sizeof(struct s2n_cert_chain)));
new_node = (struct s2n_cert_chain *)(void *)mem.data;
GUARD(s2n_alloc(&new_node->cert, s2n_stuffer_data_available(&cert_out_stuffer)));
GUARD(s2n_stuffer_read(&cert_out_stuffer, &new_node->cert));
/* Additional 3 bytes for the length field in the protocol */
chain_size += new_node->cert.size + 3;
new_node->next = NULL;
*insert = new_node;
insert = &new_node->next;
} while (s2n_stuffer_data_available(&chain_in_stuffer));
GUARD(s2n_stuffer_free(&chain_in_stuffer));
GUARD(s2n_stuffer_free(&cert_out_stuffer));
config->cert_and_key_pairs->chain_size = chain_size;
if (status && length > 0) {
GUARD(s2n_alloc(&config->cert_and_key_pairs->ocsp_status, length));
memcpy_check(config->cert_and_key_pairs->ocsp_status.data, status, length);
}
return 0;
}
int s2n_config_add_cert_chain_and_key(struct s2n_config *config, char *cert_chain_pem, char *private_key_pem)
{
GUARD(s2n_config_add_cert_chain_and_key_with_status(config, cert_chain_pem, private_key_pem, NULL, 0));
return 0;
}
int s2n_config_add_dhparams(struct s2n_config *config, char *dhparams_pem)
{
struct s2n_stuffer dhparams_in_stuffer, dhparams_out_stuffer;
struct s2n_blob dhparams_blob;
struct s2n_blob mem;
/* Allocate the memory for the chain and key struct */
GUARD(s2n_alloc(&mem, sizeof(struct s2n_dh_params)));
config->dhparams = (struct s2n_dh_params *)(void *)mem.data;
GUARD(s2n_stuffer_alloc_ro_from_string(&dhparams_in_stuffer, dhparams_pem));
GUARD(s2n_stuffer_growable_alloc(&dhparams_out_stuffer, strlen(dhparams_pem)));
/* Convert pem to asn1 and asn1 to the private key */
GUARD(s2n_stuffer_dhparams_from_pem(&dhparams_in_stuffer, &dhparams_out_stuffer));
GUARD(s2n_stuffer_free(&dhparams_in_stuffer));
dhparams_blob.size = s2n_stuffer_data_available(&dhparams_out_stuffer);
dhparams_blob.data = s2n_stuffer_raw_read(&dhparams_out_stuffer, dhparams_blob.size);
notnull_check(dhparams_blob.data);
GUARD(s2n_pkcs3_to_dh_params(config->dhparams, &dhparams_blob));
GUARD(s2n_free(&dhparams_blob));
return 0;
}
int s2n_config_set_nanoseconds_since_epoch_callback(struct s2n_config *config, int (*nanoseconds_since_epoch)(void *, uint64_t *), void * data)
{
notnull_check(nanoseconds_since_epoch);
config->nanoseconds_since_epoch = nanoseconds_since_epoch;
config->data_for_nanoseconds_since_epoch = data;
return 0;
}
static int s2n_prf(struct s2n_connection *conn, struct s2n_blob *secret, struct s2n_blob *label, struct s2n_blob *seed_a,
struct s2n_blob *seed_b, struct s2n_blob *seed_c, struct s2n_blob *out)
{
/* seed_a is always required, seed_b is optional, if seed_c is provided seed_b must also be provided */
S2N_ERROR_IF(seed_a == NULL, S2N_ERR_PRF_INVALID_SEED);
S2N_ERROR_IF(seed_b == NULL && seed_c != NULL, S2N_ERR_PRF_INVALID_SEED);
if (conn->actual_protocol_version == S2N_SSLv3) {
return s2n_sslv3_prf(&conn->prf_space, secret, seed_a, seed_b, seed_c, out);
}
/* We zero the out blob because p_hash works by XOR'ing with the existing
* buffer. This is a little convoluted but means we can avoid dynamic memory
* allocation. When we call p_hash once (in the TLS1.2 case) it will produce
* the right values. When we call it twice in the regular case, the two
* outputs will be XORd just ass the TLS 1.0 and 1.1 RFCs require.
*/
GUARD(s2n_blob_zero(out));
/* Ensure that p_hash_hmac_impl is set, as it may have been reset for prf_space on s2n_connection_wipe.
* When in FIPS mode, the EVP API's must be used for the p_hash HMAC.
*/
conn->prf_space.tls.p_hash_hmac_impl = s2n_is_in_fips_mode() ? &s2n_evp_hmac : &s2n_hmac;
if (conn->actual_protocol_version == S2N_TLS12) {
return s2n_p_hash(&conn->prf_space, conn->secure.cipher_suite->tls12_prf_alg, secret, label, seed_a, seed_b,
seed_c, out);
}
struct s2n_blob half_secret = {.data = secret->data,.size = (secret->size + 1) / 2 };
GUARD(s2n_p_hash(&conn->prf_space, S2N_HMAC_MD5, &half_secret, label, seed_a, seed_b, seed_c, out));
half_secret.data += secret->size - half_secret.size;
GUARD(s2n_p_hash(&conn->prf_space, S2N_HMAC_SHA1, &half_secret, label, seed_a, seed_b, seed_c, out));
return 0;
}
int s2n_tls_prf_master_secret(struct s2n_connection *conn, struct s2n_blob *premaster_secret)
{
struct s2n_blob client_random = {.size = sizeof(conn->secure.client_random), .data = conn->secure.client_random};
struct s2n_blob server_random = {.size = sizeof(conn->secure.server_random), .data = conn->secure.server_random};
struct s2n_blob master_secret = {.size = sizeof(conn->secure.master_secret), .data = conn->secure.master_secret};
uint8_t master_secret_label[] = "master secret";
struct s2n_blob label = {.size = sizeof(master_secret_label) - 1, .data = master_secret_label};
return s2n_prf(conn, premaster_secret, &label, &client_random, &server_random, NULL, &master_secret);
}
int s2n_hybrid_prf_master_secret(struct s2n_connection *conn, struct s2n_blob *premaster_secret)
{
struct s2n_blob client_random = {.size = sizeof(conn->secure.client_random), .data = conn->secure.client_random};
struct s2n_blob server_random = {.size = sizeof(conn->secure.server_random), .data = conn->secure.server_random};
struct s2n_blob master_secret = {.size = sizeof(conn->secure.master_secret), .data = conn->secure.master_secret};
uint8_t master_secret_label[] = "hybrid master secret";
struct s2n_blob label = {.size = sizeof(master_secret_label) - 1, .data = master_secret_label};
return s2n_prf(conn, premaster_secret, &label, &client_random, &server_random, &conn->secure.client_key_exchange_message, &master_secret);
}
static int s2n_sslv3_finished(struct s2n_connection *conn, uint8_t prefix[4], struct s2n_hash_state *md5, struct s2n_hash_state *sha1, uint8_t * out)
{
uint8_t xorpad1[48] =
{ 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
};
uint8_t xorpad2[48] =
{ 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
};
uint8_t *md5_digest = out;
uint8_t *sha_digest = out + MD5_DIGEST_LENGTH;
lte_check(MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, sizeof(conn->handshake.client_finished));
GUARD(s2n_hash_update(md5, prefix, 4));
GUARD(s2n_hash_update(md5, conn->secure.master_secret, sizeof(conn->secure.master_secret)));
GUARD(s2n_hash_update(md5, xorpad1, 48));
GUARD(s2n_hash_digest(md5, md5_digest, MD5_DIGEST_LENGTH));
GUARD(s2n_hash_reset(md5));
GUARD(s2n_hash_update(md5, conn->secure.master_secret, sizeof(conn->secure.master_secret)));
GUARD(s2n_hash_update(md5, xorpad2, 48));
GUARD(s2n_hash_update(md5, md5_digest, MD5_DIGEST_LENGTH));
GUARD(s2n_hash_digest(md5, md5_digest, MD5_DIGEST_LENGTH));
GUARD(s2n_hash_reset(md5));
GUARD(s2n_hash_update(sha1, prefix, 4));
GUARD(s2n_hash_update(sha1, conn->secure.master_secret, sizeof(conn->secure.master_secret)));
GUARD(s2n_hash_update(sha1, xorpad1, 40));
GUARD(s2n_hash_digest(sha1, sha_digest, SHA_DIGEST_LENGTH));
GUARD(s2n_hash_reset(sha1));
GUARD(s2n_hash_update(sha1, conn->secure.master_secret, sizeof(conn->secure.master_secret)));
GUARD(s2n_hash_update(sha1, xorpad2, 40));
GUARD(s2n_hash_update(sha1, sha_digest, SHA_DIGEST_LENGTH));
GUARD(s2n_hash_digest(sha1, sha_digest, SHA_DIGEST_LENGTH));
GUARD(s2n_hash_reset(sha1));
return 0;
}
static int s2n_sslv3_client_finished(struct s2n_connection *conn)
{
uint8_t prefix[4] = { 0x43, 0x4c, 0x4e, 0x54 };
lte_check(MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, sizeof(conn->handshake.client_finished));
GUARD(s2n_hash_copy(&conn->handshake.prf_md5_hash_copy, &conn->handshake.md5));
GUARD(s2n_hash_copy(&conn->handshake.prf_sha1_hash_copy, &conn->handshake.sha1));
return s2n_sslv3_finished(conn, prefix, &conn->handshake.prf_md5_hash_copy, &conn->handshake.prf_sha1_hash_copy, conn->handshake.client_finished);
}
static int s2n_sslv3_server_finished(struct s2n_connection *conn)
{
uint8_t prefix[4] = { 0x53, 0x52, 0x56, 0x52 };
lte_check(MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, sizeof(conn->handshake.server_finished));
GUARD(s2n_hash_copy(&conn->handshake.prf_md5_hash_copy, &conn->handshake.md5));
GUARD(s2n_hash_copy(&conn->handshake.prf_sha1_hash_copy, &conn->handshake.sha1));
return s2n_sslv3_finished(conn, prefix, &conn->handshake.prf_md5_hash_copy, &conn->handshake.prf_sha1_hash_copy, conn->handshake.server_finished);
}
int s2n_prf_client_finished(struct s2n_connection *conn)
{
struct s2n_blob master_secret, md5, sha;
uint8_t md5_digest[MD5_DIGEST_LENGTH];
uint8_t sha_digest[SHA384_DIGEST_LENGTH];
uint8_t client_finished_label[] = "client finished";
struct s2n_blob client_finished = {0};
struct s2n_blob label = {0};
if (conn->actual_protocol_version == S2N_SSLv3) {
return s2n_sslv3_client_finished(conn);
}
client_finished.data = conn->handshake.client_finished;
client_finished.size = S2N_TLS_FINISHED_LEN;
label.data = client_finished_label;
label.size = sizeof(client_finished_label) - 1;
master_secret.data = conn->secure.master_secret;
master_secret.size = sizeof(conn->secure.master_secret);
if (conn->actual_protocol_version == S2N_TLS12) {
switch (conn->secure.cipher_suite->tls12_prf_alg) {
case S2N_HMAC_SHA256:
GUARD(s2n_hash_copy(&conn->handshake.prf_tls12_hash_copy, &conn->handshake.sha256));
GUARD(s2n_hash_digest(&conn->handshake.prf_tls12_hash_copy, sha_digest, SHA256_DIGEST_LENGTH));
sha.size = SHA256_DIGEST_LENGTH;
break;
case S2N_HMAC_SHA384:
GUARD(s2n_hash_copy(&conn->handshake.prf_tls12_hash_copy, &conn->handshake.sha384));
GUARD(s2n_hash_digest(&conn->handshake.prf_tls12_hash_copy, sha_digest, SHA384_DIGEST_LENGTH));
sha.size = SHA384_DIGEST_LENGTH;
break;
default:
S2N_ERROR(S2N_ERR_PRF_INVALID_ALGORITHM);
}
sha.data = sha_digest;
return s2n_prf(conn, &master_secret, &label, &sha, NULL, NULL, &client_finished);
}
GUARD(s2n_hash_copy(&conn->handshake.prf_md5_hash_copy, &conn->handshake.md5));
GUARD(s2n_hash_copy(&conn->handshake.prf_sha1_hash_copy, &conn->handshake.sha1));
GUARD(s2n_hash_digest(&conn->handshake.prf_md5_hash_copy, md5_digest, MD5_DIGEST_LENGTH));
GUARD(s2n_hash_digest(&conn->handshake.prf_sha1_hash_copy, sha_digest, SHA_DIGEST_LENGTH));
md5.data = md5_digest;
md5.size = MD5_DIGEST_LENGTH;
sha.data = sha_digest;
sha.size = SHA_DIGEST_LENGTH;
return s2n_prf(conn, &master_secret, &label, &md5, &sha, NULL, &client_finished);
}
int s2n_prf_server_finished(struct s2n_connection *conn)
{
struct s2n_blob master_secret, md5, sha;
uint8_t md5_digest[MD5_DIGEST_LENGTH];
uint8_t sha_digest[SHA384_DIGEST_LENGTH];
uint8_t server_finished_label[] = "server finished";
struct s2n_blob server_finished = {0};
struct s2n_blob label = {0};
if (conn->actual_protocol_version == S2N_SSLv3) {
return s2n_sslv3_server_finished(conn);
}
server_finished.data = conn->handshake.server_finished;
server_finished.size = S2N_TLS_FINISHED_LEN;
label.data = server_finished_label;
label.size = sizeof(server_finished_label) - 1;
master_secret.data = conn->secure.master_secret;
master_secret.size = sizeof(conn->secure.master_secret);
if (conn->actual_protocol_version == S2N_TLS12) {
switch (conn->secure.cipher_suite->tls12_prf_alg) {
case S2N_HMAC_SHA256:
GUARD(s2n_hash_copy(&conn->handshake.prf_tls12_hash_copy, &conn->handshake.sha256));
GUARD(s2n_hash_digest(&conn->handshake.prf_tls12_hash_copy, sha_digest, SHA256_DIGEST_LENGTH));
sha.size = SHA256_DIGEST_LENGTH;
break;
case S2N_HMAC_SHA384:
GUARD(s2n_hash_copy(&conn->handshake.prf_tls12_hash_copy, &conn->handshake.sha384));
GUARD(s2n_hash_digest(&conn->handshake.prf_tls12_hash_copy, sha_digest, SHA384_DIGEST_LENGTH));
sha.size = SHA384_DIGEST_LENGTH;
break;
default:
S2N_ERROR(S2N_ERR_PRF_INVALID_ALGORITHM);
}
sha.data = sha_digest;
return s2n_prf(conn, &master_secret, &label, &sha, NULL, NULL, &server_finished);
}
GUARD(s2n_hash_copy(&conn->handshake.prf_md5_hash_copy, &conn->handshake.md5));
GUARD(s2n_hash_copy(&conn->handshake.prf_sha1_hash_copy, &conn->handshake.sha1));
GUARD(s2n_hash_digest(&conn->handshake.prf_md5_hash_copy, md5_digest, MD5_DIGEST_LENGTH));
GUARD(s2n_hash_digest(&conn->handshake.prf_sha1_hash_copy, sha_digest, SHA_DIGEST_LENGTH));
md5.data = md5_digest;
md5.size = MD5_DIGEST_LENGTH;
sha.data = sha_digest;
sha.size = SHA_DIGEST_LENGTH;
return s2n_prf(conn, &master_secret, &label, &md5, &sha, NULL, &server_finished);
}
static int s2n_prf_make_client_key(struct s2n_connection *conn, struct s2n_stuffer *key_material)
{
struct s2n_blob client_key = {0};
client_key.size = conn->secure.cipher_suite->record_alg->cipher->key_material_size;
client_key.data = s2n_stuffer_raw_read(key_material, client_key.size);
notnull_check(client_key.data);
if (conn->mode == S2N_CLIENT) {
GUARD(conn->secure.cipher_suite->record_alg->cipher->set_encryption_key(&conn->secure.client_key, &client_key));
} else {
GUARD(conn->secure.cipher_suite->record_alg->cipher->set_decryption_key(&conn->secure.client_key, &client_key));
}
return 0;
}
static int s2n_prf_make_server_key(struct s2n_connection *conn, struct s2n_stuffer *key_material)
{
struct s2n_blob server_key = {0};
server_key.size = conn->secure.cipher_suite->record_alg->cipher->key_material_size;
server_key.data = s2n_stuffer_raw_read(key_material, server_key.size);
notnull_check(server_key.data);
if (conn->mode == S2N_SERVER) {
GUARD(conn->secure.cipher_suite->record_alg->cipher->set_encryption_key(&conn->secure.server_key, &server_key));
} else {
GUARD(conn->secure.cipher_suite->record_alg->cipher->set_decryption_key(&conn->secure.server_key, &server_key));
}
return 0;
}
int s2n_prf_key_expansion(struct s2n_connection *conn)
{
struct s2n_blob client_random = {.data = conn->secure.client_random,.size = sizeof(conn->secure.client_random) };
struct s2n_blob server_random = {.data = conn->secure.server_random,.size = sizeof(conn->secure.server_random) };
struct s2n_blob master_secret = {.data = conn->secure.master_secret,.size = sizeof(conn->secure.master_secret) };
struct s2n_blob label, out;
uint8_t key_expansion_label[] = "key expansion";
uint8_t key_block[S2N_MAX_KEY_BLOCK_LEN];
label.data = key_expansion_label;
label.size = sizeof(key_expansion_label) - 1;
out.data = key_block;
out.size = sizeof(key_block);
struct s2n_stuffer key_material = {{0}};
GUARD(s2n_prf(conn, &master_secret, &label, &server_random, &client_random, NULL, &out));
GUARD(s2n_stuffer_init(&key_material, &out));
GUARD(s2n_stuffer_write(&key_material, &out));
GUARD(conn->secure.cipher_suite->record_alg->cipher->init(&conn->secure.client_key));
GUARD(conn->secure.cipher_suite->record_alg->cipher->init(&conn->secure.server_key));
/* Check that we have a valid MAC and key size */
uint8_t mac_size;
if (conn->secure.cipher_suite->record_alg->cipher->type == S2N_COMPOSITE) {
mac_size = conn->secure.cipher_suite->record_alg->cipher->io.comp.mac_key_size;
} else {
GUARD(s2n_hmac_digest_size(conn->secure.cipher_suite->record_alg->hmac_alg, &mac_size));
}
/* Seed the client MAC */
uint8_t *client_mac_write_key = s2n_stuffer_raw_read(&key_material, mac_size);
notnull_check(client_mac_write_key);
GUARD(s2n_hmac_reset(&conn->secure.client_record_mac));
GUARD(s2n_hmac_init(&conn->secure.client_record_mac, conn->secure.cipher_suite->record_alg->hmac_alg, client_mac_write_key, mac_size));
/* Seed the server MAC */
uint8_t *server_mac_write_key = s2n_stuffer_raw_read(&key_material, mac_size);
notnull_check(server_mac_write_key);
GUARD(s2n_hmac_reset(&conn->secure.server_record_mac));
GUARD(s2n_hmac_init(&conn->secure.server_record_mac, conn->secure.cipher_suite->record_alg->hmac_alg, server_mac_write_key, mac_size));
/* Make the client key */
GUARD(s2n_prf_make_client_key(conn, &key_material));
/* Make the server key */
GUARD(s2n_prf_make_server_key(conn, &key_material));
/* Composite CBC does MAC inside the cipher, pass it the MAC key.
* Must happen after setting encryption/decryption keys.
*/
if (conn->secure.cipher_suite->record_alg->cipher->type == S2N_COMPOSITE) {
GUARD(conn->secure.cipher_suite->record_alg->cipher->io.comp.set_mac_write_key(&conn->secure.server_key, server_mac_write_key, mac_size));
GUARD(conn->secure.cipher_suite->record_alg->cipher->io.comp.set_mac_write_key(&conn->secure.client_key, client_mac_write_key, mac_size));
}
/* TLS >= 1.1 has no implicit IVs for non AEAD ciphers */
if (conn->actual_protocol_version > S2N_TLS10 && conn->secure.cipher_suite->record_alg->cipher->type != S2N_AEAD) {
return 0;
}
uint32_t implicit_iv_size = 0;
switch (conn->secure.cipher_suite->record_alg->cipher->type) {
case S2N_AEAD:
implicit_iv_size = conn->secure.cipher_suite->record_alg->cipher->io.aead.fixed_iv_size;
break;
case S2N_CBC:
implicit_iv_size = conn->secure.cipher_suite->record_alg->cipher->io.cbc.block_size;
break;
case S2N_COMPOSITE:
implicit_iv_size = conn->secure.cipher_suite->record_alg->cipher->io.comp.block_size;
break;
/* No-op for stream ciphers */
default:
break;
}
struct s2n_blob client_implicit_iv = {.data = conn->secure.client_implicit_iv,.size = implicit_iv_size };
struct s2n_blob server_implicit_iv = {.data = conn->secure.server_implicit_iv,.size = implicit_iv_size };
GUARD(s2n_stuffer_read(&key_material, &client_implicit_iv));
GUARD(s2n_stuffer_read(&key_material, &server_implicit_iv));
return 0;
}
int s2n_prf_key_expansion(struct s2n_connection *conn)
{
struct s2n_blob client_random = {.data = conn->secure.client_random,.size = sizeof(conn->secure.client_random) };
struct s2n_blob server_random = {.data = conn->secure.server_random,.size = sizeof(conn->secure.server_random) };
struct s2n_blob master_secret = {.data = conn->secure.master_secret,.size = sizeof(conn->secure.master_secret) };
struct s2n_blob label, out;
uint8_t key_expansion_label[] = "key expansion";
uint8_t key_block[S2N_MAX_KEY_BLOCK_LEN];
label.data = key_expansion_label;
label.size = sizeof(key_expansion_label) - 1;
out.data = key_block;
out.size = sizeof(key_block);
struct s2n_stuffer key_material;
GUARD(s2n_prf(conn, &master_secret, &label, &server_random, &client_random, &out));
GUARD(s2n_stuffer_init(&key_material, &out));
GUARD(s2n_stuffer_write(&key_material, &out));
GUARD(conn->secure.cipher_suite->cipher->init(&conn->secure.client_key));
GUARD(conn->secure.cipher_suite->cipher->init(&conn->secure.server_key));
/* What's our hmac algorithm? */
s2n_hmac_algorithm hmac_alg = conn->secure.cipher_suite->hmac_alg;
if (conn->actual_protocol_version == S2N_SSLv3) {
if (hmac_alg == S2N_HMAC_SHA1) {
hmac_alg = S2N_HMAC_SSLv3_SHA1;
} else if (hmac_alg == S2N_HMAC_MD5) {
hmac_alg = S2N_HMAC_SSLv3_MD5;
} else {
S2N_ERROR(S2N_ERR_HMAC_INVALID_ALGORITHM);
}
}
/* Check that we have a valid MAC and key size */
int mac_size;
GUARD((mac_size = s2n_hmac_digest_size(hmac_alg)));
/* Seed the client MAC */
uint8_t *client_write_mac_key = s2n_stuffer_raw_read(&key_material, mac_size);
notnull_check(client_write_mac_key);
GUARD(s2n_hmac_init(&conn->secure.client_record_mac, hmac_alg, client_write_mac_key, mac_size));
/* Seed the server MAC */
uint8_t *server_write_mac_key = s2n_stuffer_raw_read(&key_material, mac_size);
notnull_check(server_write_mac_key);
GUARD(s2n_hmac_init(&conn->secure.server_record_mac, hmac_alg, server_write_mac_key, mac_size));
/* Make the client key */
struct s2n_blob client_key;
client_key.size = conn->secure.cipher_suite->cipher->key_material_size;
client_key.data = s2n_stuffer_raw_read(&key_material, client_key.size);
notnull_check(client_key.data);
if (conn->mode == S2N_CLIENT) {
GUARD(conn->secure.cipher_suite->cipher->get_encryption_key(&conn->secure.client_key, &client_key));
} else {
GUARD(conn->secure.cipher_suite->cipher->get_decryption_key(&conn->secure.client_key, &client_key));
}
/* Make the server key */
struct s2n_blob server_key;
server_key.size = conn->secure.cipher_suite->cipher->key_material_size;
server_key.data = s2n_stuffer_raw_read(&key_material, server_key.size);
notnull_check(server_key.data);
if (conn->mode == S2N_SERVER) {
GUARD(conn->secure.cipher_suite->cipher->get_encryption_key(&conn->secure.server_key, &server_key));
} else {
GUARD(conn->secure.cipher_suite->cipher->get_decryption_key(&conn->secure.server_key, &server_key));
}
/* TLS >= 1.1 has no implicit IVs for non AEAD ciphers */
if (conn->actual_protocol_version > S2N_TLS10 &&
conn->secure.cipher_suite->cipher->type != S2N_AEAD) {
return 0;
}
uint32_t implicit_iv_size = 0;
switch(conn->secure.cipher_suite->cipher->type) {
case S2N_AEAD:
implicit_iv_size = conn->secure.cipher_suite->cipher->io.aead.fixed_iv_size;
break;
case S2N_CBC:
implicit_iv_size = conn->secure.cipher_suite->cipher->io.cbc.block_size;
break;
/* No-op for stream ciphers */
default:
break;
}
struct s2n_blob client_implicit_iv = { .data = conn->secure.client_implicit_iv, .size = implicit_iv_size };
struct s2n_blob server_implicit_iv = { .data = conn->secure.server_implicit_iv, .size = implicit_iv_size };
GUARD(s2n_stuffer_read(&key_material, &client_implicit_iv));
GUARD(s2n_stuffer_read(&key_material, &server_implicit_iv));
return 0;
}