--- .gitignore | 1 + Makefile.am | 5 +- unit/test-tls.c | 182 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 187 insertions(+), 1 deletion(-) create mode 100644 unit/test-tls.c diff --git a/.gitignore b/.gitignore index b122511..c50d7e7 100644 --- a/.gitignore +++ b/.gitignore @@ -46,6 +46,7 @@ unit/test-cipher unit/test-random unit/test-util unit/test-uintset +unit/test-tls unit/test-cert unit/*.log unit/*.trs diff --git a/Makefile.am b/Makefile.am index da1f4f1..29bf54e 100644 --- a/Makefile.am +++ b/Makefile.am @@ -129,7 +129,8 @@ unit_tests = unit/test-unit \ unit/test-random \ unit/test-util \ unit/test-uintset \ - unit/test-cert + unit/test-cert \ + unit/test-tls if MAINTAINER_MODE noinst_PROGRAMS += $(unit_tests) @@ -193,6 +194,8 @@ unit_test_uintset_LDADD = ell/libell-private.la unit_test_cert_LDADD = ell/libell-private.la +unit_test_tls_LDADD = ell/libell-private.la + if MAINTAINER_MODE noinst_LTLIBRARIES += unit/example-plugin.la endif diff --git a/unit/test-tls.c b/unit/test-tls.c new file mode 100644 index 0000000..49d754f --- /dev/null +++ b/unit/test-tls.c @@ -0,0 +1,182 @@ +/* + * + * Embedded Linux library + * + * Copyright (C) 2011-2014 Intel Corporation. All rights reserved. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + * + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <assert.h> + +#include <ell/ell.h> + +#include "ell/cipher.h" +#include "ell/checksum.h" +#include "ell/tls-private.h" + +/* https://www.ietf.org/mail-archive/web/tls/current/msg03416.html */ +static struct tls12_prf_test { + enum l_checksum_type hash; + size_t hash_len; + const uint8_t *secret; + size_t secret_len; + const char *label; + const uint8_t *seed; + size_t seed_len; + const uint8_t *expected; + size_t out_len; +} tls12_prf_sha256_0 = { + .hash = L_CHECKSUM_SHA256, + .hash_len = 32, + .secret_len = 16, + .secret = (const uint8_t []) { + 0x9b, 0xbe, 0x43, 0x6b, 0xa9, 0x40, 0xf0, 0x17, + 0xb1, 0x76, 0x52, 0x84, 0x9a, 0x71, 0xdb, 0x35, + }, + .seed_len = 16, + .seed = (const uint8_t []) { + 0xa0, 0xba, 0x9f, 0x93, 0x6c, 0xda, 0x31, 0x18, + 0x27, 0xa6, 0xf7, 0x96, 0xff, 0xd5, 0x19, 0x8c, + }, + .label = "test label", + .out_len = 100, + .expected = (const uint8_t []) { + 0xe3, 0xf2, 0x29, 0xba, 0x72, 0x7b, 0xe1, 0x7b, + 0x8d, 0x12, 0x26, 0x20, 0x55, 0x7c, 0xd4, 0x53, + 0xc2, 0xaa, 0xb2, 0x1d, 0x07, 0xc3, 0xd4, 0x95, + 0x32, 0x9b, 0x52, 0xd4, 0xe6, 0x1e, 0xdb, 0x5a, + 0x6b, 0x30, 0x17, 0x91, 0xe9, 0x0d, 0x35, 0xc9, + 0xc9, 0xa4, 0x6b, 0x4e, 0x14, 0xba, 0xf9, 0xaf, + 0x0f, 0xa0, 0x22, 0xf7, 0x07, 0x7d, 0xef, 0x17, + 0xab, 0xfd, 0x37, 0x97, 0xc0, 0x56, 0x4b, 0xab, + 0x4f, 0xbc, 0x91, 0x66, 0x6e, 0x9d, 0xef, 0x9b, + 0x97, 0xfc, 0xe3, 0x4f, 0x79, 0x67, 0x89, 0xba, + 0xa4, 0x80, 0x82, 0xd1, 0x22, 0xee, 0x42, 0xc5, + 0xa7, 0x2e, 0x5a, 0x51, 0x10, 0xff, 0xf7, 0x01, + 0x87, 0x34, 0x7b, 0x66, + }, +}, tls12_prf_sha384_0 = { + .hash = L_CHECKSUM_SHA384, + .hash_len = 48, + .secret_len = 16, + .secret = (const uint8_t []) { + 0xb8, 0x0b, 0x73, 0x3d, 0x6c, 0xee, 0xfc, 0xdc, + 0x71, 0x56, 0x6e, 0xa4, 0x8e, 0x55, 0x67, 0xdf, + }, + .seed_len = 16, + .seed = (const uint8_t []) { + 0xcd, 0x66, 0x5c, 0xf6, 0xa8, 0x44, 0x7d, 0xd6, + 0xff, 0x8b, 0x27, 0x55, 0x5e, 0xdb, 0x74, 0x65, + }, + .label = "test label", + .out_len = 148, + .expected = (const uint8_t []) { + 0x7b, 0x0c, 0x18, 0xe9, 0xce, 0xd4, 0x10, 0xed, + 0x18, 0x04, 0xf2, 0xcf, 0xa3, 0x4a, 0x33, 0x6a, + 0x1c, 0x14, 0xdf, 0xfb, 0x49, 0x00, 0xbb, 0x5f, + 0xd7, 0x94, 0x21, 0x07, 0xe8, 0x1c, 0x83, 0xcd, + 0xe9, 0xca, 0x0f, 0xaa, 0x60, 0xbe, 0x9f, 0xe3, + 0x4f, 0x82, 0xb1, 0x23, 0x3c, 0x91, 0x46, 0xa0, + 0xe5, 0x34, 0xcb, 0x40, 0x0f, 0xed, 0x27, 0x00, + 0x88, 0x4f, 0x9d, 0xc2, 0x36, 0xf8, 0x0e, 0xdd, + 0x8b, 0xfa, 0x96, 0x11, 0x44, 0xc9, 0xe8, 0xd7, + 0x92, 0xec, 0xa7, 0x22, 0xa7, 0xb3, 0x2f, 0xc3, + 0xd4, 0x16, 0xd4, 0x73, 0xeb, 0xc2, 0xc5, 0xfd, + 0x4a, 0xbf, 0xda, 0xd0, 0x5d, 0x91, 0x84, 0x25, + 0x9b, 0x5b, 0xf8, 0xcd, 0x4d, 0x90, 0xfa, 0x0d, + 0x31, 0xe2, 0xde, 0xc4, 0x79, 0xe4, 0xf1, 0xa2, + 0x60, 0x66, 0xf2, 0xee, 0xa9, 0xa6, 0x92, 0x36, + 0xa3, 0xe5, 0x26, 0x55, 0xc9, 0xe9, 0xae, 0xe6, + 0x91, 0xc8, 0xf3, 0xa2, 0x68, 0x54, 0x30, 0x8d, + 0x5e, 0xaa, 0x3b, 0xe8, 0x5e, 0x09, 0x90, 0x70, + 0x3d, 0x73, 0xe5, 0x6f, + }, +}, tls12_prf_sha512_0 = { + .hash = L_CHECKSUM_SHA512, + .hash_len = 64, + .secret_len = 16, + .secret = (const uint8_t []) { + 0xb0, 0x32, 0x35, 0x23, 0xc1, 0x85, 0x35, 0x99, + 0x58, 0x4d, 0x88, 0x56, 0x8b, 0xbb, 0x05, 0xeb, + }, + .seed_len = 16, + .seed = (const uint8_t []) { + 0xd4, 0x64, 0x0e, 0x12, 0xe4, 0xbc, 0xdb, 0xfb, + 0x43, 0x7f, 0x03, 0xe6, 0xae, 0x41, 0x8e, 0xe5, + }, + .label = "test label", + .out_len = 196, + .expected = (const uint8_t []) { + 0x12, 0x61, 0xf5, 0x88, 0xc7, 0x98, 0xc5, 0xc2, + 0x01, 0xff, 0x03, 0x6e, 0x7a, 0x9c, 0xb5, 0xed, + 0xcd, 0x7f, 0xe3, 0xf9, 0x4c, 0x66, 0x9a, 0x12, + 0x2a, 0x46, 0x38, 0xd7, 0xd5, 0x08, 0xb2, 0x83, + 0x04, 0x2d, 0xf6, 0x78, 0x98, 0x75, 0xc7, 0x14, + 0x7e, 0x90, 0x6d, 0x86, 0x8b, 0xc7, 0x5c, 0x45, + 0xe2, 0x0e, 0xb4, 0x0c, 0x1c, 0xf4, 0xa1, 0x71, + 0x3b, 0x27, 0x37, 0x1f, 0x68, 0x43, 0x25, 0x92, + 0xf7, 0xdc, 0x8e, 0xa8, 0xef, 0x22, 0x3e, 0x12, + 0xea, 0x85, 0x07, 0x84, 0x13, 0x11, 0xbf, 0x68, + 0x65, 0x3d, 0x0c, 0xfc, 0x40, 0x56, 0xd8, 0x11, + 0xf0, 0x25, 0xc4, 0x5d, 0xdf, 0xa6, 0xe6, 0xfe, + 0xc7, 0x02, 0xf0, 0x54, 0xb4, 0x09, 0xd6, 0xf2, + 0x8d, 0xd0, 0xa3, 0x23, 0x3e, 0x49, 0x8d, 0xa4, + 0x1a, 0x3e, 0x75, 0xc5, 0x63, 0x0e, 0xed, 0xbe, + 0x22, 0xfe, 0x25, 0x4e, 0x33, 0xa1, 0xb0, 0xe9, + 0xf6, 0xb9, 0x82, 0x66, 0x75, 0xbe, 0xc7, 0xd0, + 0x1a, 0x84, 0x56, 0x58, 0xdc, 0x9c, 0x39, 0x75, + 0x45, 0x40, 0x1d, 0x40, 0xb9, 0xf4, 0x6c, 0x7a, + 0x40, 0x0e, 0xe1, 0xb8, 0xf8, 0x1c, 0xa0, 0xa6, + 0x0d, 0x1a, 0x39, 0x7a, 0x10, 0x28, 0xbf, 0xf5, + 0xd2, 0xef, 0x50, 0x66, 0x12, 0x68, 0x42, 0xfb, + 0x8d, 0xa4, 0x19, 0x76, 0x32, 0xbd, 0xb5, 0x4f, + 0xf6, 0x63, 0x3f, 0x86, 0xbb, 0xc8, 0x36, 0xe6, + 0x40, 0xd4, 0xd8, 0x98, + }, +}; + +static void test_tls12_prf(const void *data) +{ + const struct tls12_prf_test *test = data; + uint8_t out_buf[test->out_len]; + + tls12_prf(test->hash, test->hash_len, test->secret, test->secret_len, + test->label, test->seed, test->seed_len, + out_buf, test->out_len); + + assert(!memcmp(out_buf, test->expected, test->out_len)); +} + +int main(int argc, char *argv[]) +{ + l_test_init(&argc, &argv); + + l_test_add("TLS 1.2 PRF with SHA256", test_tls12_prf, + &tls12_prf_sha256_0); + + l_test_add("TLS 1.2 PRF with SHA384", test_tls12_prf, + &tls12_prf_sha384_0); + + l_test_add("TLS 1.2 PRF with SHA512", test_tls12_prf, + &tls12_prf_sha512_0); + + return l_test_run(); +} -- 2.1.4

The Handshake Protocol (RFC5246 section 7) runs on top of the Record protocol and carries out the cryptographic negotiation. Only version 1.2 is implemented here. It distinguishes server and client roles. I have tested both the client and server roles against OpenSSL as server and client and ell against ell. I've also now tested the server against Firefox as https client and the client against a few popular https websites. --- ell/tls.c | 1078 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 1078 insertions(+) diff --git a/ell/tls.c b/ell/tls.c index 312a42b..8d88ea4 100644 --- a/ell/tls.c +++ b/ell/tls.c @@ -76,6 +76,13 @@ void tls12_prf(enum l_checksum_type type, size_t hash_len, l_checksum_free(hmac); } +static void tls_write_random(uint8_t *buf) +{ + l_put_be32(time(NULL), buf); + + l_getrandom(buf + 4, 28); +} + static void tls_reset_handshake(struct l_tls *tls) { memset(tls->pending.master_secret, 0, 48); @@ -249,6 +256,283 @@ static struct tls_compression_method *tls_find_compression_method( return NULL; } +static uint8_t tls_cert_type_pref[] = { +}; + +struct tls_signature_hash_algorithms { + uint8_t hash_id; + uint8_t signature_id; +}; + +static struct tls_signature_hash_algorithms tls_signature_hash_pref[] = { +}; + +enum tls_handshake_type { + TLS_HELLO_REQUEST = 0, + TLS_CLIENT_HELLO = 1, + TLS_SERVER_HELLO = 2, + TLS_CERTIFICATE = 11, + TLS_SERVER_KEY_EXCHANGE = 12, + TLS_CERTIFICATE_REQUEST = 13, + TLS_SERVER_HELLO_DONE = 14, + TLS_CERTIFICATE_VERIFY = 15, + TLS_CLIENT_KEY_EXCHANGE = 16, + TLS_FINISHED = 20, +}; + +#define TLS_HANDSHAKE_HEADER_SIZE 4 + +static void tls_tx_handshake(struct l_tls *tls, int type, uint8_t *buf, + size_t length) +{ + /* Fill in the handshake header */ + + buf[0] = type; + buf[1] = (length - TLS_HANDSHAKE_HEADER_SIZE) >> 16; + buf[2] = (length - TLS_HANDSHAKE_HEADER_SIZE) >> 8; + buf[3] = (length - TLS_HANDSHAKE_HEADER_SIZE) >> 0; + + l_checksum_update(tls->handshake_hash, buf, length); + + tls_tx_record(tls, TLS_CT_HANDSHAKE, buf, length); +} + +static void tls_send_client_hello(struct l_tls *tls) +{ + uint8_t buf[128 + L_ARRAY_SIZE(tls_compression_pref) + + 2 * L_ARRAY_SIZE(tls_cipher_suite_pref)]; + uint8_t *ptr = buf + TLS_HANDSHAKE_HEADER_SIZE; + int i; + + /* Fill in the Client Hello body */ + + *ptr++ = (uint8_t) (TLS_VERSION >> 8); + *ptr++ = (uint8_t) (TLS_VERSION >> 0); + + tls_write_random(tls->pending.client_random); + memcpy(ptr, tls->pending.client_random, 32); + ptr += 32; + + *ptr++ = 0; /* No SessionID */ + + /* + * We can list all supported key exchange mechanisms regardless of the + * certificate type we are actually presenting (if any). + * + * TODO: perhaps scan /proc/crypto for supported ciphers so we don't + * include ones that will cause an internal error later in the + * handshake. We can add camellia whan this is done. + */ + l_put_be16(L_ARRAY_SIZE(tls_cipher_suite_pref) * 2, ptr); + ptr += 2; + for (i = 0; i < (int) L_ARRAY_SIZE(tls_cipher_suite_pref); i++) { + *ptr++ = tls_cipher_suite_pref[i].id[0]; + *ptr++ = tls_cipher_suite_pref[i].id[1]; + } + + *ptr++ = L_ARRAY_SIZE(tls_compression_pref); + for (i = 0; i < (int) L_ARRAY_SIZE(tls_compression_pref); i++) + *ptr++ = tls_compression_pref[i].id; + + tls_tx_handshake(tls, TLS_CLIENT_HELLO, buf, ptr - buf); +} + +static void tls_send_server_hello(struct l_tls *tls) +{ + uint8_t buf[128]; + uint8_t *ptr = buf + TLS_HANDSHAKE_HEADER_SIZE; + + /* Fill in the Server Hello body */ + + *ptr++ = tls->negotiated_version >> 8; + *ptr++ = tls->negotiated_version >> 0; + + tls_write_random(tls->pending.server_random); + memcpy(ptr, tls->pending.server_random, 32); + ptr += 32; + + *ptr++ = 0; /* Sessions are not cached */ + + *ptr++ = tls->pending.cipher_suite->id[0]; + *ptr++ = tls->pending.cipher_suite->id[1]; + + *ptr++ = tls->pending.compression_method->id; + + tls_tx_handshake(tls, TLS_SERVER_HELLO, buf, ptr - buf); +} + +static bool tls_send_certificate(struct l_tls *tls) +{ + uint8_t *buf, *ptr; + struct l_cert *cert, *i; + size_t total; + + if (tls->cert_path) { + cert = l_cert_load_file(tls->cert_path); + + if (tls->server && !cert) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + TLS_ALERT_BAD_CERT); + + return false; + } + } else + cert = NULL; + + if (cert && !l_cert_find_certchain(cert, tls->ca_cert_path)) { + if (tls->server) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + TLS_ALERT_UNKNOWN_CA); + + return false; + } else + cert = NULL; + } + + /* TODO: might want check this earlier and exclude the cipher suite */ + if (cert && !tls->pending.cipher_suite->key_xchg-> + validate_cert_key_type(cert)) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + TLS_ALERT_CERT_UNKNOWN); + + return false; + } + + /* + * TODO: check that the certificate is compatible with hash and + * signature algorithms lists supplied to us in the Client Hello + * extensions (if we're a server) or in the Certificate Request + * (if we act as a 1.2+ client). + * + * - for the hash and signature_algorithms list, check all + * certs in the cert chain. + * + * - also if !cipher_suite->key_xchg->key_exchange_msg, check that the + * end entity certificate's key type matches and is usable with some + * hash/signature pair. + * + * - on client check if any of the supplied DNs (if any) match + * anything in our cert chain. + */ + + total = 0; + for (i = cert; i; i = i->issuer) + total += 3 + i->size; + + buf = l_malloc(128 + total); + ptr = buf + TLS_HANDSHAKE_HEADER_SIZE; + + /* Fill in the Certificate body */ + + *ptr++ = total >> 16; + *ptr++ = total >> 8; + *ptr++ = total >> 0; + + for (i = cert; i; i = i->issuer) { + *ptr++ = i->size >> 16; + *ptr++ = i->size >> 8; + *ptr++ = i->size >> 0; + + memcpy(ptr, i->asn1, i->size); + ptr += i->size; + } + + tls_tx_handshake(tls, TLS_CERTIFICATE, buf, ptr - buf); + + l_free(buf); + + if (cert) + tls->cert_sent = true; + + return true; +} + +static bool tls_send_certificate_request(struct l_tls *tls) +{ + uint8_t *buf, *ptr, *dn_ptr; + int i; + struct l_cert *ca_cert; + uint8_t *ca_name; + int ca_name_len; + + /* TODO: support multiple CAs if directory path given */ + ca_cert = l_cert_load_file(tls->ca_cert_path); + if (!ca_cert) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + TLS_ALERT_BAD_CERT); + + return false; + } + + ca_name = l_cert_find_dn(ca_cert, false, &ca_name_len); + if (!ca_name) { + l_free(ca_cert); + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + TLS_ALERT_BAD_CERT); + + return false; + } + + buf = l_malloc(128 + L_ARRAY_SIZE(tls_cert_type_pref) + + 2 * L_ARRAY_SIZE(tls_signature_hash_pref) + + strlen((char *) ca_name)); + ptr = buf + TLS_HANDSHAKE_HEADER_SIZE; + + /* Fill in the Certificate Request body */ + + *ptr++ = L_ARRAY_SIZE(tls_cert_type_pref); + for (i = 0; i < (int) L_ARRAY_SIZE(tls_cert_type_pref); i++) + *ptr++ = tls_cert_type_pref[i]; + + /* + * This only makes sense as a variable-length field, assume there's + * a typo in RFC5246 7.4.4 here. + * + * TODO: we support the full list of hash algorithms when used + * in the client certificate chain but we can only verify the + * Certificate Verify signature when the hash algorithm matches + * HANDSHAKE_HASH_TYPE_TLS. The values we include here will + * affect both of these steps so revisit which set we're passing + * here. + * + * TODO: not present in TLS 1.0 + */ + l_put_be16(L_ARRAY_SIZE(tls_signature_hash_pref) * 2, ptr); + ptr += 2; + for (i = 0; i < (int) L_ARRAY_SIZE(tls_signature_hash_pref); i++) { + *ptr++ = tls_signature_hash_pref[i].hash_id; + *ptr++ = tls_signature_hash_pref[i].signature_id; + } + + dn_ptr = ptr; + ptr += 4; /* Leave space for sizes */ + *ptr++ = ASN1_ID_SEQUENCE; /* DER outer SEQUENCE tag */ + write_asn1_definite_length(&ptr, ca_name_len); /* length */ + memcpy(ptr, ca_name, ca_name_len); /* value */ + ptr += ca_name_len; + + ca_name_len = ptr - dn_ptr - 4; + l_put_be16(ca_name_len + 2, dn_ptr); /* DistinguishedNames size */ + l_put_be16(ca_name_len, dn_ptr + 2); /* DistinguishedName[0] size */ + + tls_tx_handshake(tls, TLS_CERTIFICATE_REQUEST, buf, ptr - buf); + + l_free(ca_cert); + l_free(buf); + + return true; +} + +static void tls_send_server_hello_done(struct l_tls *tls) +{ + uint8_t buf[32]; + + /* No body */ + + tls_tx_handshake(tls, TLS_SERVER_HELLO_DONE, buf, + TLS_HANDSHAKE_HEADER_SIZE); +} + static void tls_generate_master_secret(struct l_tls *tls, const uint8_t *pre_master_secret, int pre_master_secret_len) @@ -295,6 +579,710 @@ static void tls_get_handshake_hash(struct l_tls *tls, uint8_t *out) l_checksum_free(hash); } +static bool tls_send_certificate_verify(struct l_tls *tls) +{ + uint8_t buf[2048]; + uint8_t *ptr = buf + TLS_HANDSHAKE_HEADER_SIZE; + uint8_t hash[HANDSHAKE_HASH_SIZE]; + + /* Fill in the Certificate Verify body */ + + tls_get_handshake_hash(tls, hash); + + if (!tls->pending.cipher_suite->key_xchg->sign(tls, &ptr, hash)) + return false; + + tls_tx_handshake(tls, TLS_CERTIFICATE_VERIFY, buf, ptr - buf); + + return true; +} + +static void tls_send_change_cipher_spec(struct l_tls *tls) +{ + uint8_t buf = 1; + + tls_tx_record(tls, TLS_CT_CHANGE_CIPHER_SPEC, &buf, 1); +} + +static void tls_send_finished(struct l_tls *tls) +{ + uint8_t buf[512]; + uint8_t *ptr = buf + TLS_HANDSHAKE_HEADER_SIZE; + uint8_t seed[HANDSHAKE_HASH_SIZE]; + + /* + * Same hash type as that used for the PRF, i.e. SHA256 unless an + * exotic cipher suite was negotiated that dictates a different + * hash for the PRF and for the Finished hash. We don't support + * any such ciphers so it's always SHA256. + */ + tls_get_handshake_hash(tls, seed); + + tls12_prf(L_CHECKSUM_SHA256, 32, tls->pending.master_secret, 48, + tls->server ? "server finished" : "client finished", + seed, sizeof(seed), + ptr, tls->cipher_suite[1]->verify_data_length); + ptr += tls->cipher_suite[1]->verify_data_length; + + tls_tx_handshake(tls, TLS_FINISHED, buf, ptr - buf); +} + +static bool tls_verify_finished(struct l_tls *tls, const uint8_t *received, + size_t len) +{ + uint8_t expected[tls->cipher_suite[0]->verify_data_length]; + + if (len != (size_t) tls->cipher_suite[0]->verify_data_length) { + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); + + return false; + } + + tls12_prf(L_CHECKSUM_SHA256, 32, tls->pending.master_secret, 48, + tls->server ? "client finished" : "server finished", + tls->prev_digest, HANDSHAKE_HASH_SIZE, + expected, tls->cipher_suite[0]->verify_data_length); + + if (memcmp(received, expected, len)) { + tls_disconnect(tls, TLS_ALERT_DECRYPT_ERROR, 0); + + return false; + } + + return true; +} + +static void tls_handle_client_hello(struct l_tls *tls, + const uint8_t *buf, size_t len) +{ + uint16_t cipher_suites_size; + uint8_t session_id_size, compression_methods_size; + const uint8_t *cipher_suites; + const uint8_t *compression_methods; + + /* Length checks */ + + if (len < 2 + 32 + 1) + goto decode_error; + memcpy(tls->pending.client_random, buf + 2, 32); + session_id_size = buf[34]; + len -= 35; + + if (len < (size_t) session_id_size + 4) + goto decode_error; + len -= session_id_size + 2; + + cipher_suites_size = l_get_be16(buf + 35 + session_id_size); + cipher_suites = buf + 37 + session_id_size; + if (len < (size_t) cipher_suites_size + 2 || + (cipher_suites_size & 1) || cipher_suites_size == 0) + goto decode_error; + len -= cipher_suites_size + 1; + + compression_methods_size = cipher_suites[cipher_suites_size]; + compression_methods = cipher_suites + cipher_suites_size + 1; + if (len < (size_t) compression_methods_size || + compression_methods == 0) + goto decode_error; + len -= compression_methods_size; + + if (len) { + uint16_t extensions_size; + + if (len < 2 || len > 2 + 65535) + goto decode_error; + + extensions_size = l_get_be16(compression_methods + + compression_methods_size); + len -= 2; + + if (len != extensions_size) + goto decode_error; + + /* TODO: validate each extension in the vector, 7.4.1.4 */ + /* TODO: check for duplicates? */ + } + + /* + * Note: if the client is supplying a SessionID we know it is false + * because our server implementation never generates any SessionIDs + * yet so either the client is attempting something strange or was + * trying to connect somewhere else. We might want to throw an error. + */ + + /* + * TODO: Obligatory in 1.2: check for signature_algorithms extension, + * store the list of algorithms for later checking in + * tls_send_certificate on both server and client sides. If not + * present assume only SHA1+RSA (7.4.1.4.1). + */ + + /* Save client_version for Premaster Secret verification */ + tls->client_version = l_get_be16(buf); + + if (tls->client_version < TLS_MIN_VERSION) { + tls_disconnect(tls, TLS_ALERT_PROTOCOL_VERSION, 0); + return; + } + tls->negotiated_version = TLS_VERSION < tls->client_version ? + TLS_VERSION : tls->client_version; + + /* Select a cipher suite according to client's preference list */ + + while (cipher_suites_size) { + /* + * TODO: filter supported cipher suites by the certificate/key + * type that was submitted by tls_set_auth_data() if any. + * Perhaps just call cipher_suite->verify_cert_type() on each + * cipher suite passing a pre-parsed certificate ASN.1 struct. + */ + tls->pending.cipher_suite = + tls_find_cipher_suite(cipher_suites); + if (tls->pending.cipher_suite) + break; + + cipher_suites += 2; + cipher_suites_size -= 2; + } + if (!cipher_suites_size) { + tls_disconnect(tls, TLS_ALERT_HANDSHAKE_FAIL, 0); + return; + } + + /* Select a compression method */ + + /* CompressionMethod.null must be present in the vector */ + if (!memchr(compression_methods, 0, compression_methods_size)) + goto decode_error; + + while (compression_methods_size) { + tls->pending.compression_method = + tls_find_compression_method(*compression_methods); + if (tls->pending.compression_method) + break; + + compression_methods++; + compression_methods_size--; + } + + tls_send_server_hello(tls); + + if (tls->pending.cipher_suite->key_xchg->certificate_check && + tls->cert_path) + if (!tls_send_certificate(tls)) + return; + + if (tls->pending.cipher_suite->key_xchg->key_exchange_msg) + if (!tls->pending.cipher_suite->key_xchg-> + send_server_key_exchange(tls)) + return; + + /* TODO: don't bother if configured to not authenticate client */ + if (tls->pending.cipher_suite->key_xchg->certificate_check && + tls->ca_cert_path) + if (!tls_send_certificate_request(tls)) + return; + + tls_send_server_hello_done(tls); + + if (tls->pending.cipher_suite->key_xchg->certificate_check && + tls->ca_cert_path) + tls->state = TLS_HANDSHAKE_WAIT_CERTIFICATE; + else + tls->state = TLS_HANDSHAKE_WAIT_KEY_EXCHANGE; + + return; + +decode_error: + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); +} + +static void tls_handle_server_hello(struct l_tls *tls, + const uint8_t *buf, size_t len) +{ + uint8_t session_id_size, cipher_suite_id[2], compression_method_id; + + /* Length checks */ + + if (len < 2 + 32 + 1) + goto decode_error; + memcpy(tls->pending.server_random, buf + 2, 32); + session_id_size = buf[34]; + len -= 35; + + if (len < (size_t) session_id_size + 2 + 1) + goto decode_error; + cipher_suite_id[0] = buf[35 + session_id_size + 0]; + cipher_suite_id[1] = buf[35 + session_id_size + 1]; + compression_method_id = buf[35 + session_id_size + 2]; + len -= session_id_size + 2 + 1; + + if (len != 0) { /* We know we haven't solicited any extensions */ + tls_disconnect(tls, TLS_ALERT_UNSUPPORTED_EXTENSION, 0); + return; + } + + tls->negotiated_version = l_get_be16(buf); + + if (tls->negotiated_version < TLS_MIN_VERSION || + tls->negotiated_version > TLS_VERSION) { + tls_disconnect(tls, tls->negotiated_version < TLS_MIN_VERSION ? + TLS_ALERT_PROTOCOL_VERSION : + TLS_ALERT_ILLEGAL_PARAM, 0); + return; + } + + /* Set the new cipher suite and compression method structs */ + + tls->pending.cipher_suite = tls_find_cipher_suite(cipher_suite_id); + if (!tls->pending.cipher_suite) { + tls_disconnect(tls, TLS_ALERT_HANDSHAKE_FAIL, 0); + return; + } + + tls->pending.compression_method = + tls_find_compression_method(compression_method_id); + if (!tls->pending.compression_method) { + tls_disconnect(tls, TLS_ALERT_HANDSHAKE_FAIL, 0); + return; + } + + if (tls->pending.cipher_suite->key_xchg->certificate_check) + tls->state = TLS_HANDSHAKE_WAIT_CERTIFICATE; + else + tls->state = TLS_HANDSHAKE_WAIT_KEY_EXCHANGE; + + return; + +decode_error: + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); +} + +static void tls_handle_certificate(struct l_tls *tls, + const uint8_t *buf, size_t len) +{ + int total, cert_len, pubkey_len; + struct l_cert *certchain = NULL, **tail = &certchain; + struct l_cert *ca_cert = NULL; + uint8_t *pubkey; + + /* Length checks */ + + total = *buf++ << 16; + total |= *buf++ << 8; + total |= *buf++ << 0; + if ((size_t) total + 3 != len) + goto decode_error; + + while (total) { + cert_len = *buf++ << 16; + cert_len |= *buf++ << 8; + cert_len |= *buf++ << 0; + + if (cert_len + 3 > total) + goto decode_error; + + *tail = l_cert_decode(buf, cert_len); + if (!*tail) + goto decode_error; + + tail = &(*tail)->issuer; + + buf += cert_len; + total -= cert_len + 3; + } + + /* + * "Note that a client MAY send no certificates if it does not have any + * appropriate certificate to send in response to the server's + * authentication request." -- for now we unconditionally accept + * an empty certificate chain from the client. Later on we need to + * make this configurable, if we don't want to authenticate the + * client then also don't bother sending a Certificate Request. + */ + if (!certchain) { + if (!tls->server) { + tls_disconnect(tls, TLS_ALERT_HANDSHAKE_FAIL, 0); + + goto done; + } + + tls->state = TLS_HANDSHAKE_WAIT_KEY_EXCHANGE; + + goto done; + } + + /* + * Validate the certificate chain's consistency and validate it + * against our CA if we have any. + */ + + if (ca_cert) { + ca_cert = l_cert_load_file(tls->ca_cert_path); + if (!ca_cert) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + TLS_ALERT_BAD_CERT); + + goto done; + } + } + + if (!l_cert_verify_certchain(certchain, ca_cert)) { + tls_disconnect(tls, TLS_ALERT_BAD_CERT, 0); + + goto done; + } + + /* + * RFC5246 7.4.2: + * "The end entity certificate's public key (and associated + * restrictions) MUST be compatible with the selected key exchange + * algorithm." + */ + if (!tls->pending.cipher_suite->key_xchg-> + validate_cert_key_type(certchain)) { + tls_disconnect(tls, TLS_ALERT_UNSUPPORTED_CERT, 0); + + goto done; + } + + /* + * Save the public key from the certificate for use in premaster + * secret encryption. + */ + pubkey = l_cert_find_pubkey(certchain, &pubkey_len); + if (!pubkey && !tls->pending.cipher_suite->key_xchg->key_exchange_msg) { + tls_disconnect(tls, TLS_ALERT_UNSUPPORTED_CERT, 0); + + goto done; + } + + if (pubkey) { + /* Save the end-entity cert and free the rest of the chain */ + tls->peer_cert = certchain; + l_cert_free_certchain(certchain->issuer); + certchain->issuer = NULL; + certchain = NULL; + + tls->peer_pubkey = pubkey; + tls->peer_pubkey_length = pubkey_len; + } + + if (tls->server) + tls->state = TLS_HANDSHAKE_WAIT_KEY_EXCHANGE; + else { + if (tls->pending.cipher_suite->key_xchg->key_exchange_msg) + tls->state = TLS_HANDSHAKE_WAIT_KEY_EXCHANGE; + else + tls->state = TLS_HANDSHAKE_WAIT_HELLO_DONE; + } + + goto done; + +decode_error: + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); + +done: + if (ca_cert) + l_free(ca_cert); + + l_cert_free_certchain(certchain); +} + +static void tls_handle_certificate_request(struct l_tls *tls, + const uint8_t *buf, size_t len) +{ + tls->cert_requested = 1; + + /* + * TODO: parse and save key type, signature algorithms and DNs list + * for use in tls_send_certificate. + */ +} + +static void tls_handle_server_hello_done(struct l_tls *tls, + const uint8_t *buf, size_t len) +{ + if (len) { + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); + + return; + } + + if (tls->cert_requested) + if (!tls_send_certificate(tls)) + return; + if (!tls->pending.cipher_suite->key_xchg->send_client_key_exchange(tls)) + return; + if (tls->cert_sent) + if (!tls_send_certificate_verify(tls)) + return; + tls_send_change_cipher_spec(tls); + if (!tls_change_cipher_spec(tls, 1)) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, 0); + return; + } + tls_send_finished(tls); + + tls->state = TLS_HANDSHAKE_WAIT_CHANGE_CIPHER_SPEC; +} + +static void tls_handle_certificate_verify(struct l_tls *tls, + const uint8_t *buf, size_t len) +{ + if (!tls->pending.cipher_suite->key_xchg->verify(tls, buf, len, + tls->prev_digest)) + return; + + /* + * The client's certificate is now verified based on the following + * logic: + * - If we received an (expected) Certificate Verify, we must have + * sent a Certificate Request. + * - If we sent a Certificate Request that's because + * tls->ca_cert_path is non-NULL. + * - If tls->ca_cert_path is non-NULL then tls_handle_certificate + * will have checked the whole certificate chain to be valid and + * additionally trusted by our CA if known. + * - Additionally cipher_suite->key_xchg->verify has just confirmed + * that the peer owns the end-entity certificate because it was + * able to sign the contents of the handshake messages and that + * signature could be verified with the public key from that + * certificate. + */ + tls->peer_authenticated = true; + + tls->state = TLS_HANDSHAKE_WAIT_CHANGE_CIPHER_SPEC; +} + +static void tls_finished(struct l_tls *tls) +{ + uint8_t *subject_name = NULL; + int subject_name_len; + uint8_t *printable_name = NULL; + int printable_name_len; + char *peer_identity = NULL; + + if (tls->peer_authenticated && tls->peer_cert) + subject_name = l_cert_find_dn(tls->peer_cert, false, + &subject_name_len); + if (subject_name) + printable_name = l_cert_dn_find_printable_name(subject_name, + subject_name_len, + &printable_name_len); + if (printable_name) + peer_identity = l_strndup((char *) printable_name, + printable_name_len); + + /* Free up the resources used in the handshake */ + tls_reset_handshake(tls); + + tls->state = TLS_HANDSHAKE_DONE; + tls->ready = true; + + tls->ready_handle(tls->user_data, peer_identity); + + if (peer_identity) + l_free(peer_identity); +} + +static void tls_handle_handshake(struct l_tls *tls, int type, + const uint8_t *buf, size_t len) +{ + switch (type) { + case TLS_HELLO_REQUEST: + if (tls->server) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (len != 0) { + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); + break; + } + + /* + * May be sent by the server at any time but "SHOULD be ignored + * by the client if it arrives in the middle of a handshake" + * and "MAY be ignored by the client if it does not wish to + * renegotiate a session". + */ + + break; + + case TLS_CLIENT_HELLO: + if (!tls->server) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (tls->state != TLS_HANDSHAKE_WAIT_HELLO && + tls->state != TLS_HANDSHAKE_DONE) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls_handle_client_hello(tls, buf, len); + + break; + + case TLS_SERVER_HELLO: + if (tls->server) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (tls->state != TLS_HANDSHAKE_WAIT_HELLO) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls_handle_server_hello(tls, buf, len); + + break; + + case TLS_CERTIFICATE: + if (tls->state != TLS_HANDSHAKE_WAIT_CERTIFICATE) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls_handle_certificate(tls, buf, len); + + break; + + case TLS_SERVER_KEY_EXCHANGE: + if (tls->server) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (tls->state != TLS_HANDSHAKE_WAIT_KEY_EXCHANGE) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (!tls->pending.cipher_suite->key_xchg-> + handle_server_key_exchange(tls, buf, len)) + break; + + tls->state = TLS_HANDSHAKE_WAIT_HELLO_DONE; + + break; + + case TLS_CERTIFICATE_REQUEST: + /* + * Server sends this optionally so in the WAIT_HELLO_DONE + * state we accept either this or a Server Hello Done (below). + */ + if (tls->state != TLS_HANDSHAKE_WAIT_HELLO_DONE || + tls->cert_requested || + !tls->pending.cipher_suite->key_xchg-> + certificate_check) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls_handle_certificate_request(tls, buf, len); + + break; + + case TLS_SERVER_HELLO_DONE: + if (tls->state != TLS_HANDSHAKE_WAIT_HELLO_DONE) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls_handle_server_hello_done(tls, buf, len); + + break; + + case TLS_CERTIFICATE_VERIFY: + if (tls->state != TLS_HANDSHAKE_WAIT_CERTIFICATE_VERIFY) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls_handle_certificate_verify(tls, buf, len); + + break; + + case TLS_CLIENT_KEY_EXCHANGE: + if (!tls->server) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (tls->state != TLS_HANDSHAKE_WAIT_KEY_EXCHANGE) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + tls->pending.cipher_suite->key_xchg->handle_client_key_exchange( + tls, buf, len); + + /* + * If we accepted a client Certificate message with a + * certificate that has signing capability (TODO: check + * usage bitmask), Certiifcate Verify is received next. It + * sounds as if this is mandatory for the client although + * this isn't 100% clear. + */ + if (tls->peer_pubkey) + tls->state = TLS_HANDSHAKE_WAIT_CERTIFICATE_VERIFY; + else + tls->state = TLS_HANDSHAKE_WAIT_CHANGE_CIPHER_SPEC; + + break; + + case TLS_FINISHED: + if (tls->state != TLS_HANDSHAKE_WAIT_FINISHED) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + break; + } + + if (!tls_verify_finished(tls, buf, len)) + break; + + if (tls->server) { + tls_send_change_cipher_spec(tls); + if (!tls_change_cipher_spec(tls, 1)) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, + 0); + break; + } + tls_send_finished(tls); + } + + /* + * On the client, the server's certificate is only now + * verified, based on the following logic: + * - tls->ca_cert_path is non-NULL so tls_handle_certificate + * (always called on the client) must have veritifed the + * server's certificate chain to be valid and additionally + * trusted by our CA. + * - the correct receival of this Finished message confirms + * that the peer owns the end-entity certificate because + * it was able to decrypt the master secret which we had + * encrypted with the public key from that certificate, and + * the posession of the master secret in turn is verified + * by both the successful decryption and the MAC of this + * message (either should be enough). + */ + if (!tls->server && tls->cipher_suite[0]->key_xchg-> + certificate_check && + tls->ca_cert_path) + tls->peer_authenticated = true; + + tls_finished(tls); + + break; + + default: + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + } +} + LIB_EXPORT struct l_tls *l_tls_new(bool server, l_tls_write_cb_t app_data_handler, l_tls_write_cb_t tx_handler, @@ -362,6 +1350,96 @@ LIB_EXPORT void l_tls_write(struct l_tls *tls, const uint8_t *data, size_t len) tls_tx_record(tls, TLS_CT_APPLICATION_DATA, data, len); } +bool tls_handle_message(struct l_tls *tls, const uint8_t *message, + int len, uint8_t type, uint16_t version) +{ + switch (type) { + case TLS_CT_CHANGE_CIPHER_SPEC: + if (len != 1 || message[0] != 0x01) { + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); + + return false; + } + + if (tls->state != TLS_HANDSHAKE_WAIT_CHANGE_CIPHER_SPEC) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + + return false; + } + + if (!tls_change_cipher_spec(tls, 0)) { + tls_disconnect(tls, TLS_ALERT_INTERNAL_ERROR, 0); + + return false; + } + + tls->state = TLS_HANDSHAKE_WAIT_FINISHED; + + break; + + case TLS_CT_ALERT: + /* Verify AlertLevel */ + if (message[0] != 0x01 && message[0] != 0x02) { + tls_disconnect(tls, TLS_ALERT_DECODE_ERROR, 0); + + return false; + } + + /* + * On a fatal alert we are obligated to respond with a + * fatal alert and disconnect but also not complain if + * the connection has been torn down by the peer before + * we were able to send our alert. However on a non-fatal + * alert (warning) we're also allowed to panic and send + * a fatal alert, then disconnect, so we do that + * regardless of the alert level. + */ + tls_disconnect(tls, TLS_ALERT_CLOSE_NOTIFY, message[1]); + + return false; + + case TLS_CT_HANDSHAKE: + /* + * Corner case: When handling a Certificate Verify or a + * Finished message we need access to the messages hash from + * before this message was transmitted on the Tx side so we + * can verify it matches the hash the sender included in the + * message. We save it here for that purpose. Everywhere + * else we need to update the hash before handling the new + * message because 1. we may need the new hash to build our + * own Certificate Verify or Finished messages, and 2. we + * update the message hash with newly transmitted messages + * inside tls_tx_handshake which may be called as part of + * handling incoming message, and if we didn't call + * l_checksum_update before, the calls would end up being + * out of order. + */ + if (message[0] == TLS_CERTIFICATE_VERIFY || + message[0] == TLS_FINISHED) + tls_get_handshake_hash(tls, tls->prev_digest); + l_checksum_update(tls->handshake_hash, message, len); + + tls_handle_handshake(tls, message[0], + message + TLS_HANDSHAKE_HEADER_SIZE, + len - TLS_HANDSHAKE_HEADER_SIZE); + + break; + + case TLS_CT_APPLICATION_DATA: + if (!tls->ready) { + tls_disconnect(tls, TLS_ALERT_UNEXPECTED_MESSAGE, 0); + + return false; + } + + tls->rx(tls->user_data, message, len); + + break; + } + + return true; +} + LIB_EXPORT void l_tls_close(struct l_tls *tls) { tls_disconnect(tls, TLS_ALERT_CLOSE_NOTIFY, 0); -- 2.1.4

--- .gitignore | 2 + Makefile.am | 4 +- examples/https-client-test.c | 181 +++++++++++++++++++++++++++++++++++++++++++ examples/https-server-test.c | 169 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 355 insertions(+), 1 deletion(-) create mode 100644 examples/https-client-test.c create mode 100644 examples/https-server-test.c diff --git a/.gitignore b/.gitignore index c50d7e7..4f964de 100644 --- a/.gitignore +++ b/.gitignore @@ -51,4 +51,6 @@ unit/test-cert unit/*.log unit/*.trs examples/dbus-service +examples/https-server-test +examples/https-client-test test-suite.log diff --git a/Makefile.am b/Makefile.am index 0896100..1708341 100644 --- a/Makefile.am +++ b/Makefile.am @@ -206,13 +206,15 @@ unit_example_plugin_la_LDFLAGS = -no-undefined -module -avoid-version \ unit_test_data_files = unit/settings.test unit/cert-ca.pem unit/cert-client.pem unit/cert-server.pem unit/cert-client-key.pem unit/cert-server-key.pem -examples = examples/dbus-service +examples = examples/dbus-service examples/https-client-test examples/https-server-test if MAINTAINER_MODE noinst_PROGRAMS += $(examples) endif examples_dbus_service_LDADD = ell/libell-private.la +examples_https_client_test_LDADD = ell/libell-private.la +examples_https_server_test_LDADD = ell/libell-private.la EXTRA_DIST = $(unit_test_data_files) diff --git a/examples/https-client-test.c b/examples/https-client-test.c new file mode 100644 index 0000000..9b12039 --- /dev/null +++ b/examples/https-client-test.c @@ -0,0 +1,181 @@ +/* + * Embedded Linux library + * + * Copyright (C) 2011-2014 Intel Corporation. All rights reserved. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <sys/socket.h> +#include <sys/types.h> +#include <netinet/in.h> +#include <netdb.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <unistd.h> +#include <errno.h> +#include <arpa/inet.h> + +#include <ell/ell.h> + +static struct l_io *io; +static struct l_tls *tls; +static const char *hostname; + +static void https_io_disconnect(struct l_io *io, void *user_data) +{ + l_main_quit(); +} + +static bool https_io_read(struct l_io *io, void *user_data) +{ + uint8_t buf[2048]; + int l; + + l = read(l_io_get_fd(io), buf, sizeof(buf)); + if (l == 0) + l_main_quit(); + else if (l > 0) + l_tls_handle_rx(tls, buf, l); + + return true; +} + +static void https_tls_disconnected(void *user_data, + enum l_tls_alert_desc reason, + bool remote) +{ + if (reason) + printf("TLS error: %s\n", l_tls_alert_to_str(reason)); + l_main_quit(); +} + +static void https_new_data(void *user_data, const uint8_t *data, size_t len) +{ + int r; + + while (len) { + r = write(1, data, len); + if (r < 0) { + l_main_quit(); + break; + } + len -= r; + data += r; + } +} + +static void https_tls_write(void *user_data, const uint8_t *data, size_t len) +{ + int r; + + while (len) { + r = write(l_io_get_fd(io), data, len); + if (r < 0) { + l_main_quit(); + break; + } + len -= r; + data += r; + } +} + +static void https_tls_ready(void *user_data, const char *peer_identity) +{ + uint8_t buf[2048]; + int l; + + if (peer_identity) + printf("Server authenticated as %s\n", peer_identity); + else + printf("Server not authenticated\n"); + + l = snprintf((char *) buf, sizeof(buf), + "HEAD / HTTP/1.1\r\n" + "Connection: close\r\n" + "Host: %s\r\n\r\n", hostname); + l_tls_write(tls, buf, l); +} + +int main(int argc, char *argv[]) +{ + struct hostent *he; + struct in_addr **addr_list; + struct sockaddr_in addr; + int fd; + + if (argc != 2 && argc != 3 && argc != 6) { + printf("Usage: %s <https-host-name> [<ca-cert-path> " + "[<client-cert-path> <client-key-path> " + "<client-key-passphrase>]]\n" + "Note: The passphrase will be ignored if the " + "key is not encrypted.\n", + argv[0]); + return -1; + } + + l_log_set_stderr(); + + hostname = argv[1]; + he = gethostbyname(hostname); + if (!he) { + printf("gethostbyname: %s\n", strerror(errno)); + return -1; + } + + addr_list = (struct in_addr **) he->h_addr_list; + if (!addr_list) { + printf("No host addresses found\n"); + return -1; + } + + fd = socket(AF_INET, SOCK_STREAM, 0); + if (fd < 0) { + printf("socket: %s\n", strerror(errno)); + return -1; + } + + addr.sin_family = AF_INET; + addr.sin_port = htons(443); + memcpy(&addr.sin_addr, addr_list[0], sizeof(addr.sin_addr)); + if (connect(fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) { + printf("connect: %s\n", strerror(errno)); + return -1; + } + + io = l_io_new(fd); + l_io_set_close_on_destroy(io, true); + l_io_set_read_handler(io, https_io_read, tls, NULL); + l_io_set_disconnect_handler(io, https_io_disconnect, tls, NULL); + + tls = l_tls_new(false, https_new_data, https_tls_write, + https_tls_ready, https_tls_disconnected, NULL); + if (argc > 2) + l_tls_set_cacert(tls, argv[2]); + if (argc > 5) + l_tls_set_auth_data(tls, argv[3], argv[4], argv[5]); + + l_main_run(); + + l_io_destroy(io); + l_tls_free(tls); + + return 0; +} diff --git a/examples/https-server-test.c b/examples/https-server-test.c new file mode 100644 index 0000000..a666a00 --- /dev/null +++ b/examples/https-server-test.c @@ -0,0 +1,169 @@ +/* + * Embedded Linux library + * + * Copyright (C) 2011-2014 Intel Corporation. All rights reserved. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <sys/socket.h> +#include <sys/types.h> +#include <netinet/in.h> +#include <netdb.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <unistd.h> +#include <errno.h> +#include <arpa/inet.h> + +#include <ell/ell.h> + +static struct l_io *io; +static struct l_tls *tls; +bool served; + +static void https_io_disconnect(struct l_io *io, void *user_data) +{ + if (!served) + printf("Disconnected before serving a page\n"); + l_main_quit(); +} + +static bool https_io_read(struct l_io *io, void *user_data) +{ + uint8_t buf[2048]; + int l; + + l = read(l_io_get_fd(io), buf, sizeof(buf)); + if (l == 0) + l_main_quit(); + else if (l > 0) + l_tls_handle_rx(tls, buf, l); + + return true; +} + +static void https_tls_disconnected(void *user_data, + enum l_tls_alert_desc reason, + bool remote) +{ + if (reason) + printf("TLS error: %s\n", l_tls_alert_to_str(reason)); + l_main_quit(); +} + +static void https_new_data(void *user_data, const uint8_t *data, size_t len) +{ + char *reply = "HTTP/1.1 200 OK\r\n" + "Content-Type: text/plain\r\n" + "Connection: close\r\n" + "\r\n" + "Hello, world!\n"; + + if (len >= 4 && !memcmp(data + len - 4, "\r\n\r\n", 4)) { + l_tls_write(tls, (void *) reply, strlen(reply)); + l_tls_close(tls); + served = true; + printf("Hello world page served\n"); + } +} + +static void https_tls_write(void *user_data, const uint8_t *data, size_t len) +{ + int r; + + while (len) { + r = write(l_io_get_fd(io), data, len); + if (r < 0) { + l_main_quit(); + break; + } + len -= r; + data += r; + } +} + +static void https_tls_ready(void *user_data, const char *peer_identity) +{ + if (peer_identity) + printf("Client authenticated as %s\n", peer_identity); + else + printf("Client not authenticated\n"); +} + +int main(int argc, char *argv[]) +{ + struct sockaddr_in addr; + int fd, listenfd; + + if (argc != 4 && argc != 5) { + printf("Usage: %s <server-cert-path> <server-key-path> " + "<server-key-passphrase> [<ca-cert-path>]\n" + "Note: The passphrase will be ignored if the " + "key is not encrypted.\n", + argv[0]); + + return -1; + } + + l_log_set_stderr(); + + listenfd = socket(AF_INET, SOCK_STREAM, 0); + setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &(int) { 1 }, + sizeof(int)); + addr.sin_family = AF_INET; + addr.sin_addr.s_addr = htonl(INADDR_ANY); + addr.sin_port = htons(1234); + + if (bind(listenfd, (struct sockaddr *) &addr, sizeof(addr)) == -1) { + printf("bind: %s\n", strerror(errno)); + return -1; + } + if (listen(listenfd, 1) == -1) { + printf("listen: %s\n", strerror(errno)); + return -1; + } + + printf("Try https://localhost:1234/ now\n"); + + fd = accept(listenfd, NULL, NULL); + close(listenfd); + if (fd == -1) { + printf("accept: %s\n", strerror(errno)); + return -1; + } + + io = l_io_new(fd); + l_io_set_close_on_destroy(io, true); + l_io_set_read_handler(io, https_io_read, tls, NULL); + l_io_set_disconnect_handler(io, https_io_disconnect, tls, NULL); + + tls = l_tls_new(true, https_new_data, https_tls_write, + https_tls_ready, https_tls_disconnected, NULL); + l_tls_set_auth_data(tls, argv[1], argv[2], argv[3]); + l_tls_set_cacert(tls, argc > 4 ? argv[4] : NULL); + + l_main_run(); + + l_io_destroy(io); + l_tls_free(tls); + + return 0; +} -- 2.1.4