devtls.c 43 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114
  1. /*
  2. * devtls - record layer for transport layer security 1.0 and secure sockets layer 3.0
  3. */
  4. #include "u.h"
  5. #include "../port/lib.h"
  6. #include "mem.h"
  7. #include "dat.h"
  8. #include "fns.h"
  9. #include "../port/error.h"
  10. #include <libsec.h>
  11. typedef struct OneWay OneWay;
  12. typedef struct Secret Secret;
  13. typedef struct TlsRec TlsRec;
  14. typedef struct TlsErrs TlsErrs;
  15. enum {
  16. Statlen= 1024, /* max. length of status or stats message */
  17. /* buffer limits */
  18. MaxRecLen = 1<<14, /* max payload length of a record layer message */
  19. MaxCipherRecLen = MaxRecLen + 2048,
  20. RecHdrLen = 5,
  21. MaxMacLen = SHA1dlen,
  22. /* protocol versions we can accept */
  23. TLSVersion = 0x0301,
  24. SSL3Version = 0x0300,
  25. ProtocolVersion = 0x0301, /* maximum version we speak */
  26. MinProtoVersion = 0x0300, /* limits on version we accept */
  27. MaxProtoVersion = 0x03ff,
  28. /* connection states */
  29. SHandshake = 1 << 0, /* doing handshake */
  30. SOpen = 1 << 1, /* application data can be sent */
  31. SRClose = 1 << 2, /* remote side has closed down */
  32. SLClose = 1 << 3, /* sent a close notify alert */
  33. SAlert = 1 << 5, /* sending or sent a fatal alert */
  34. SError = 1 << 6, /* some sort of error has occured */
  35. SClosed = 1 << 7, /* it is all over */
  36. /* record types */
  37. RChangeCipherSpec = 20,
  38. RAlert,
  39. RHandshake,
  40. RApplication,
  41. SSL2ClientHello = 1,
  42. HSSL2ClientHello = 9, /* local convention; see tlshand.c */
  43. /* alerts */
  44. ECloseNotify = 0,
  45. EUnexpectedMessage = 10,
  46. EBadRecordMac = 20,
  47. EDecryptionFailed = 21,
  48. ERecordOverflow = 22,
  49. EDecompressionFailure = 30,
  50. EHandshakeFailure = 40,
  51. ENoCertificate = 41,
  52. EBadCertificate = 42,
  53. EUnsupportedCertificate = 43,
  54. ECertificateRevoked = 44,
  55. ECertificateExpired = 45,
  56. ECertificateUnknown = 46,
  57. EIllegalParameter = 47,
  58. EUnknownCa = 48,
  59. EAccessDenied = 49,
  60. EDecodeError = 50,
  61. EDecryptError = 51,
  62. EExportRestriction = 60,
  63. EProtocolVersion = 70,
  64. EInsufficientSecurity = 71,
  65. EInternalError = 80,
  66. EUserCanceled = 90,
  67. ENoRenegotiation = 100,
  68. EMAX = 256
  69. };
  70. struct Secret
  71. {
  72. char *encalg; /* name of encryption alg */
  73. char *hashalg; /* name of hash alg */
  74. int (*enc)(Secret*, uchar*, int);
  75. int (*dec)(Secret*, uchar*, int);
  76. int (*unpad)(uchar*, int, int);
  77. DigestState *(*mac)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
  78. int block; /* encryption block len, 0 if none */
  79. int maclen;
  80. void *enckey;
  81. uchar mackey[MaxMacLen];
  82. };
  83. struct OneWay
  84. {
  85. QLock io; /* locks io access */
  86. QLock seclock; /* locks secret paramaters */
  87. ulong seq;
  88. Secret *sec; /* cipher in use */
  89. Secret *new; /* cipher waiting for enable */
  90. };
  91. struct TlsRec
  92. {
  93. Chan *c; /* io channel */
  94. int ref; /* serialized by tdlock for atomic destroy */
  95. int version; /* version of the protocol we are speaking */
  96. char verset; /* version has been set */
  97. char opened; /* opened command every issued? */
  98. char err[ERRMAX]; /* error message to return to handshake requests */
  99. vlong handin; /* bytes communicated by the record layer */
  100. vlong handout;
  101. vlong datain;
  102. vlong dataout;
  103. Lock statelk;
  104. int state;
  105. /* record layer mac functions for different protocol versions */
  106. void (*packMac)(Secret*, uchar*, uchar*, uchar*, uchar*, int, uchar*);
  107. /* input side -- protected by in.io */
  108. OneWay in;
  109. Block *processed; /* next bunch of application data */
  110. Block *unprocessed; /* data read from c but not parsed into records */
  111. /* handshake queue */
  112. Lock hqlock; /* protects hqref, alloc & free of handq, hprocessed */
  113. int hqref;
  114. Queue *handq; /* queue of handshake messages */
  115. Block *hprocessed; /* remainder of last block read from handq */
  116. QLock hqread; /* protects reads for hprocessed, handq */
  117. /* output side */
  118. OneWay out;
  119. /* protections */
  120. char *user;
  121. int perm;
  122. };
  123. struct TlsErrs{
  124. int err;
  125. int sslerr;
  126. int tlserr;
  127. int fatal;
  128. char *msg;
  129. };
  130. static TlsErrs tlserrs[] = {
  131. {ECloseNotify, ECloseNotify, ECloseNotify, 0, "close notify"},
  132. {EUnexpectedMessage, EUnexpectedMessage, EUnexpectedMessage, 1, "unexpected message"},
  133. {EBadRecordMac, EBadRecordMac, EBadRecordMac, 1, "bad record mac"},
  134. {EDecryptionFailed, EIllegalParameter, EDecryptionFailed, 1, "decryption failed"},
  135. {ERecordOverflow, EIllegalParameter, ERecordOverflow, 1, "record too long"},
  136. {EDecompressionFailure, EDecompressionFailure, EDecompressionFailure, 1, "decompression failed"},
  137. {EHandshakeFailure, EHandshakeFailure, EHandshakeFailure, 1, "could not negotiate acceptable security paramters"},
  138. {ENoCertificate, ENoCertificate, ECertificateUnknown, 1, "no appropriate certificate available"},
  139. {EBadCertificate, EBadCertificate, EBadCertificate, 1, "corrupted or invalid certificate"},
  140. {EUnsupportedCertificate, EUnsupportedCertificate, EUnsupportedCertificate, 1, "unsupported certificate type"},
  141. {ECertificateRevoked, ECertificateRevoked, ECertificateRevoked, 1, "revoked certificate"},
  142. {ECertificateExpired, ECertificateExpired, ECertificateExpired, 1, "expired certificate"},
  143. {ECertificateUnknown, ECertificateUnknown, ECertificateUnknown, 1, "unacceptable certificate"},
  144. {EIllegalParameter, EIllegalParameter, EIllegalParameter, 1, "illegal parameter"},
  145. {EUnknownCa, EHandshakeFailure, EUnknownCa, 1, "unknown certificate authority"},
  146. {EAccessDenied, EHandshakeFailure, EAccessDenied, 1, "access denied"},
  147. {EDecodeError, EIllegalParameter, EDecodeError, 1, "error decoding message"},
  148. {EDecryptError, EIllegalParameter, EDecryptError, 1, "error decrypting message"},
  149. {EExportRestriction, EHandshakeFailure, EExportRestriction, 1, "export restriction violated"},
  150. {EProtocolVersion, EIllegalParameter, EProtocolVersion, 1, "protocol version not supported"},
  151. {EInsufficientSecurity, EHandshakeFailure, EInsufficientSecurity, 1, "stronger security routines required"},
  152. {EInternalError, EHandshakeFailure, EInternalError, 1, "internal error"},
  153. {EUserCanceled, ECloseNotify, EUserCanceled, 0, "handshake canceled by user"},
  154. {ENoRenegotiation, EUnexpectedMessage, ENoRenegotiation, 0, "no renegotiation"},
  155. };
  156. enum
  157. {
  158. /* max. open tls connections */
  159. MaxTlsDevs = 1024
  160. };
  161. static Lock tdlock;
  162. static int tdhiwat;
  163. static int maxtlsdevs = 128;
  164. static TlsRec **tlsdevs;
  165. static char **trnames;
  166. static char *encalgs;
  167. static char *hashalgs;
  168. enum{
  169. Qtopdir = 1, /* top level directory */
  170. Qprotodir,
  171. Qclonus,
  172. Qencalgs,
  173. Qhashalgs,
  174. Qconvdir, /* directory for a conversation */
  175. Qdata,
  176. Qctl,
  177. Qhand,
  178. Qstatus,
  179. Qstats,
  180. };
  181. #define TYPE(x) ((x).path & 0xf)
  182. #define CONV(x) (((x).path >> 5)&(MaxTlsDevs-1))
  183. #define QID(c, y) (((c)<<5) | (y))
  184. static void checkstate(TlsRec *, int, int);
  185. static void ensure(TlsRec*, Block**, int);
  186. static void consume(Block**, uchar*, int);
  187. static Chan* buftochan(char*);
  188. static void tlshangup(TlsRec*);
  189. static void tlsError(TlsRec*, char *);
  190. static void alertHand(TlsRec*, char *);
  191. static TlsRec *newtls(Chan *c);
  192. static TlsRec *mktlsrec(void);
  193. static DigestState*sslmac_md5(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
  194. static DigestState*sslmac_sha1(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
  195. static DigestState*nomac(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
  196. static void sslPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac);
  197. static void tlsPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac);
  198. static void put64(uchar *p, vlong x);
  199. static void put32(uchar *p, u32int);
  200. static void put24(uchar *p, int);
  201. static void put16(uchar *p, int);
  202. static u32int get32(uchar *p);
  203. static int get16(uchar *p);
  204. static void tlsSetState(TlsRec *tr, int new, int old);
  205. static void rcvAlert(TlsRec *tr, int err);
  206. static void sendAlert(TlsRec *tr, int err);
  207. static void rcvError(TlsRec *tr, int err, char *msg, ...);
  208. static int rc4enc(Secret *sec, uchar *buf, int n);
  209. static int des3enc(Secret *sec, uchar *buf, int n);
  210. static int des3dec(Secret *sec, uchar *buf, int n);
  211. static int noenc(Secret *sec, uchar *buf, int n);
  212. static int sslunpad(uchar *buf, int n, int block);
  213. static int tlsunpad(uchar *buf, int n, int block);
  214. static void freeSec(Secret *sec);
  215. static char *tlsstate(int s);
  216. #pragma varargck argpos rcvError 3
  217. static char *tlsnames[] = {
  218. [Qclonus] "clone",
  219. [Qencalgs] "encalgs",
  220. [Qhashalgs] "hashalgs",
  221. [Qdata] "data",
  222. [Qctl] "ctl",
  223. [Qhand] "hand",
  224. [Qstatus] "status",
  225. [Qstats] "stats",
  226. };
  227. static int convdir[] = { Qctl, Qdata, Qhand, Qstatus, Qstats };
  228. static int
  229. tlsgen(Chan *c, char*, Dirtab *, int, int s, Dir *dp)
  230. {
  231. Qid q;
  232. TlsRec *tr;
  233. char *name, *nm;
  234. int perm, t;
  235. q.vers = 0;
  236. q.type = QTFILE;
  237. t = TYPE(c->qid);
  238. switch(t) {
  239. case Qtopdir:
  240. if(s == DEVDOTDOT){
  241. q.path = QID(0, Qtopdir);
  242. q.type = QTDIR;
  243. devdir(c, q, "#a", 0, eve, 0555, dp);
  244. return 1;
  245. }
  246. if(s > 0)
  247. return -1;
  248. q.path = QID(0, Qprotodir);
  249. q.type = QTDIR;
  250. devdir(c, q, "tls", 0, eve, 0555, dp);
  251. return 1;
  252. case Qprotodir:
  253. if(s == DEVDOTDOT){
  254. q.path = QID(0, Qtopdir);
  255. q.type = QTDIR;
  256. devdir(c, q, ".", 0, eve, 0555, dp);
  257. return 1;
  258. }
  259. if(s < 3){
  260. switch(s) {
  261. default:
  262. return -1;
  263. case 0:
  264. q.path = QID(0, Qclonus);
  265. break;
  266. case 1:
  267. q.path = QID(0, Qencalgs);
  268. break;
  269. case 2:
  270. q.path = QID(0, Qhashalgs);
  271. break;
  272. }
  273. perm = 0444;
  274. if(TYPE(q) == Qclonus)
  275. perm = 0555;
  276. devdir(c, q, tlsnames[TYPE(q)], 0, eve, perm, dp);
  277. return 1;
  278. }
  279. s -= 3;
  280. if(s >= tdhiwat)
  281. return -1;
  282. q.path = QID(s, Qconvdir);
  283. q.type = QTDIR;
  284. lock(&tdlock);
  285. tr = tlsdevs[s];
  286. if(tr != nil)
  287. nm = tr->user;
  288. else
  289. nm = eve;
  290. if ((name = trnames[s]) == nil) {
  291. name = trnames[s] = smalloc(16);
  292. sprint(name, "%d", s);
  293. }
  294. devdir(c, q, name, 0, nm, 0555, dp);
  295. unlock(&tdlock);
  296. return 1;
  297. case Qconvdir:
  298. if(s == DEVDOTDOT){
  299. q.path = QID(0, Qprotodir);
  300. q.type = QTDIR;
  301. devdir(c, q, "tls", 0, eve, 0555, dp);
  302. return 1;
  303. }
  304. if(s < 0 || s >= nelem(convdir))
  305. return -1;
  306. lock(&tdlock);
  307. tr = tlsdevs[CONV(c->qid)];
  308. if(tr != nil){
  309. nm = tr->user;
  310. perm = tr->perm;
  311. }else{
  312. perm = 0;
  313. nm = eve;
  314. }
  315. t = convdir[s];
  316. if(t == Qstatus || t == Qstats)
  317. perm &= 0444;
  318. q.path = QID(CONV(c->qid), t);
  319. devdir(c, q, tlsnames[t], 0, nm, perm, dp);
  320. unlock(&tdlock);
  321. return 1;
  322. case Qclonus:
  323. case Qencalgs:
  324. case Qhashalgs:
  325. perm = 0444;
  326. if(t == Qclonus)
  327. perm = 0555;
  328. devdir(c, c->qid, tlsnames[t], 0, eve, perm, dp);
  329. return 1;
  330. default:
  331. lock(&tdlock);
  332. tr = tlsdevs[CONV(c->qid)];
  333. if(tr != nil){
  334. nm = tr->user;
  335. perm = tr->perm;
  336. }else{
  337. perm = 0;
  338. nm = eve;
  339. }
  340. if(t == Qstatus || t == Qstats)
  341. perm &= 0444;
  342. devdir(c, c->qid, tlsnames[t], 0, nm, perm, dp);
  343. unlock(&tdlock);
  344. return 1;
  345. }
  346. return -1;
  347. }
  348. static Chan*
  349. tlsattach(char *spec)
  350. {
  351. Chan *c;
  352. c = devattach('a', spec);
  353. c->qid.path = QID(0, Qtopdir);
  354. c->qid.type = QTDIR;
  355. c->qid.vers = 0;
  356. return c;
  357. }
  358. static Walkqid*
  359. tlswalk(Chan *c, Chan *nc, char **name, int nname)
  360. {
  361. return devwalk(c, nc, name, nname, nil, 0, tlsgen);
  362. }
  363. static int
  364. tlsstat(Chan *c, uchar *db, int n)
  365. {
  366. return devstat(c, db, n, nil, 0, tlsgen);
  367. }
  368. static Chan*
  369. tlsopen(Chan *c, int omode)
  370. {
  371. TlsRec *tr, **pp;
  372. int t, perm;
  373. perm = 0;
  374. omode &= 3;
  375. switch(omode) {
  376. case OREAD:
  377. perm = 4;
  378. break;
  379. case OWRITE:
  380. perm = 2;
  381. break;
  382. case ORDWR:
  383. perm = 6;
  384. break;
  385. }
  386. t = TYPE(c->qid);
  387. switch(t) {
  388. default:
  389. panic("tlsopen");
  390. case Qtopdir:
  391. case Qprotodir:
  392. case Qconvdir:
  393. if(omode != OREAD)
  394. error(Eperm);
  395. break;
  396. case Qclonus:
  397. tr = newtls(c);
  398. if(tr == nil)
  399. error(Enodev);
  400. break;
  401. case Qctl:
  402. case Qdata:
  403. case Qhand:
  404. case Qstatus:
  405. case Qstats:
  406. if((t == Qstatus || t == Qstats) && omode != OREAD)
  407. error(Eperm);
  408. if(waserror()) {
  409. unlock(&tdlock);
  410. nexterror();
  411. }
  412. lock(&tdlock);
  413. pp = &tlsdevs[CONV(c->qid)];
  414. tr = *pp;
  415. if(tr == nil)
  416. error("must open connection using clone");
  417. if((perm & (tr->perm>>6)) != perm
  418. && (strcmp(up->user, tr->user) != 0
  419. || (perm & tr->perm) != perm))
  420. error(Eperm);
  421. if(t == Qhand){
  422. if(waserror()){
  423. unlock(&tr->hqlock);
  424. nexterror();
  425. }
  426. lock(&tr->hqlock);
  427. if(tr->handq != nil)
  428. error(Einuse);
  429. tr->handq = qopen(2 * MaxCipherRecLen, 0, nil, nil);
  430. if(tr->handq == nil)
  431. error("can't allocate handshake queue");
  432. tr->hqref = 1;
  433. unlock(&tr->hqlock);
  434. poperror();
  435. }
  436. tr->ref++;
  437. unlock(&tdlock);
  438. poperror();
  439. break;
  440. case Qencalgs:
  441. case Qhashalgs:
  442. if(omode != OREAD)
  443. error(Eperm);
  444. break;
  445. }
  446. c->mode = openmode(omode);
  447. c->flag |= COPEN;
  448. c->offset = 0;
  449. c->iounit = qiomaxatomic;
  450. return c;
  451. }
  452. static int
  453. tlswstat(Chan *c, uchar *dp, int n)
  454. {
  455. Dir *d;
  456. TlsRec *tr;
  457. int rv;
  458. d = nil;
  459. if(waserror()){
  460. free(d);
  461. unlock(&tdlock);
  462. nexterror();
  463. }
  464. lock(&tdlock);
  465. tr = tlsdevs[CONV(c->qid)];
  466. if(tr == nil)
  467. error(Ebadusefd);
  468. if(strcmp(tr->user, up->user) != 0)
  469. error(Eperm);
  470. d = smalloc(n + sizeof *d);
  471. rv = convM2D(dp, n, &d[0], (char*) &d[1]);
  472. if(rv == 0)
  473. error(Eshortstat);
  474. if(!emptystr(d->uid))
  475. kstrdup(&tr->user, d->uid);
  476. if(d->mode != ~0UL)
  477. tr->perm = d->mode;
  478. free(d);
  479. poperror();
  480. unlock(&tdlock);
  481. return rv;
  482. }
  483. static void
  484. dechandq(TlsRec *tr)
  485. {
  486. lock(&tr->hqlock);
  487. if(--tr->hqref == 0){
  488. if(tr->handq != nil){
  489. qfree(tr->handq);
  490. tr->handq = nil;
  491. }
  492. if(tr->hprocessed != nil){
  493. freeb(tr->hprocessed);
  494. tr->hprocessed = nil;
  495. }
  496. }
  497. unlock(&tr->hqlock);
  498. }
  499. static void
  500. tlsclose(Chan *c)
  501. {
  502. TlsRec *tr;
  503. int t;
  504. t = TYPE(c->qid);
  505. switch(t) {
  506. case Qctl:
  507. case Qdata:
  508. case Qhand:
  509. case Qstatus:
  510. case Qstats:
  511. if((c->flag & COPEN) == 0)
  512. break;
  513. tr = tlsdevs[CONV(c->qid)];
  514. if(tr == nil)
  515. break;
  516. if(t == Qhand)
  517. dechandq(tr);
  518. lock(&tdlock);
  519. if(--tr->ref > 0) {
  520. unlock(&tdlock);
  521. return;
  522. }
  523. tlsdevs[CONV(c->qid)] = nil;
  524. unlock(&tdlock);
  525. if(tr->c != nil && !waserror()){
  526. checkstate(tr, 0, SOpen|SHandshake|SRClose);
  527. sendAlert(tr, ECloseNotify);
  528. poperror();
  529. }
  530. tlshangup(tr);
  531. if(tr->c != nil)
  532. cclose(tr->c);
  533. freeSec(tr->in.sec);
  534. freeSec(tr->in.new);
  535. freeSec(tr->out.sec);
  536. freeSec(tr->out.new);
  537. free(tr->user);
  538. free(tr);
  539. break;
  540. }
  541. }
  542. /*
  543. * make sure we have at least 'n' bytes in list 'l'
  544. */
  545. static void
  546. ensure(TlsRec *s, Block **l, int n)
  547. {
  548. int sofar, i;
  549. Block *b, *bl;
  550. sofar = 0;
  551. for(b = *l; b; b = b->next){
  552. sofar += BLEN(b);
  553. if(sofar >= n)
  554. return;
  555. l = &b->next;
  556. }
  557. while(sofar < n){
  558. bl = devtab[s->c->type]->bread(s->c, MaxCipherRecLen + RecHdrLen, 0);
  559. if(bl == 0)
  560. error(Ehungup);
  561. *l = bl;
  562. i = 0;
  563. for(b = bl; b; b = b->next){
  564. i += BLEN(b);
  565. l = &b->next;
  566. }
  567. if(i == 0)
  568. error(Ehungup);
  569. sofar += i;
  570. }
  571. }
  572. /*
  573. * copy 'n' bytes from 'l' into 'p' and free
  574. * the bytes in 'l'
  575. */
  576. static void
  577. consume(Block **l, uchar *p, int n)
  578. {
  579. Block *b;
  580. int i;
  581. for(; *l && n > 0; n -= i){
  582. b = *l;
  583. i = BLEN(b);
  584. if(i > n)
  585. i = n;
  586. memmove(p, b->rp, i);
  587. b->rp += i;
  588. p += i;
  589. if(BLEN(b) < 0)
  590. panic("consume");
  591. if(BLEN(b))
  592. break;
  593. *l = b->next;
  594. freeb(b);
  595. }
  596. }
  597. /*
  598. * give back n bytes
  599. */
  600. static void
  601. regurgitate(TlsRec *s, uchar *p, int n)
  602. {
  603. Block *b;
  604. if(n <= 0)
  605. return;
  606. b = s->unprocessed;
  607. if(s->unprocessed == nil || b->rp - b->base < n) {
  608. b = allocb(n);
  609. memmove(b->wp, p, n);
  610. b->wp += n;
  611. b->next = s->unprocessed;
  612. s->unprocessed = b;
  613. } else {
  614. b->rp -= n;
  615. memmove(b->rp, p, n);
  616. }
  617. }
  618. /*
  619. * remove at most n bytes from the queue
  620. */
  621. static Block*
  622. qgrab(Block **l, int n)
  623. {
  624. Block *bb, *b;
  625. int i;
  626. b = *l;
  627. if(BLEN(b) == n){
  628. *l = b->next;
  629. b->next = nil;
  630. return b;
  631. }
  632. i = 0;
  633. for(bb = b; bb != nil && i < n; bb = bb->next)
  634. i += BLEN(bb);
  635. if(i > n)
  636. i = n;
  637. bb = allocb(i);
  638. consume(l, bb->wp, i);
  639. bb->wp += i;
  640. return bb;
  641. }
  642. static void
  643. tlsclosed(TlsRec *tr, int new)
  644. {
  645. lock(&tr->statelk);
  646. if(tr->state == SOpen || tr->state == SHandshake)
  647. tr->state = new;
  648. else if((new | tr->state) == (SRClose|SLClose))
  649. tr->state = SClosed;
  650. unlock(&tr->statelk);
  651. alertHand(tr, "close notify");
  652. }
  653. /*
  654. * read and process one tls record layer message
  655. * must be called with tr->in.io held
  656. * We can't let Eintrs lose data, since doing so will get
  657. * us out of sync with the sender and break the reliablity
  658. * of the channel. Eintr only happens during the reads in
  659. * consume. Therefore we put back any bytes consumed before
  660. * the last call to ensure.
  661. */
  662. static void
  663. tlsrecread(TlsRec *tr)
  664. {
  665. OneWay *volatile in;
  666. Block *volatile b;
  667. uchar *p, seq[8], header[RecHdrLen], hmac[MD5dlen];
  668. int volatile nconsumed;
  669. int len, type, ver;
  670. nconsumed = 0;
  671. if(waserror()){
  672. if(strcmp(up->errstr, Eintr) == 0 && !waserror()){
  673. regurgitate(tr, header, nconsumed);
  674. poperror();
  675. }else
  676. tlsError(tr, "channel error");
  677. nexterror();
  678. }
  679. ensure(tr, &tr->unprocessed, RecHdrLen);
  680. consume(&tr->unprocessed, header, RecHdrLen);
  681. nconsumed = RecHdrLen;
  682. if((tr->handin == 0) && (header[0] & 0x80)){
  683. /* Cope with an SSL3 ClientHello expressed in SSL2 record format.
  684. This is sent by some clients that we must interoperate
  685. with, such as Java's JSSE and Microsoft's Internet Explorer. */
  686. len = (get16(header) & ~0x8000) - 3;
  687. type = header[2];
  688. ver = get16(header + 3);
  689. if(type != SSL2ClientHello || len < 22)
  690. rcvError(tr, EProtocolVersion, "invalid initial SSL2-like message");
  691. }else{ /* normal SSL3 record format */
  692. type = header[0];
  693. ver = get16(header+1);
  694. len = get16(header+3);
  695. }
  696. if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion))
  697. rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'",
  698. tr->version, tr->verset?"/set":"", len, type, ver, (char*)header);
  699. if(len > MaxCipherRecLen || len < 0)
  700. rcvError(tr, ERecordOverflow, "record message too long %d", len);
  701. ensure(tr, &tr->unprocessed, len);
  702. nconsumed = 0;
  703. poperror();
  704. /*
  705. * If an Eintr happens after this, we'll get out of sync.
  706. * Make sure nothing we call can sleep.
  707. * Errors are ok, as they kill the connection.
  708. * Luckily, allocb won't sleep, it'll just error out.
  709. */
  710. b = nil;
  711. if(waserror()){
  712. if(b != nil)
  713. freeb(b);
  714. tlsError(tr, "channel error");
  715. nexterror();
  716. }
  717. b = qgrab(&tr->unprocessed, len);
  718. in = &tr->in;
  719. if(waserror()){
  720. qunlock(&in->seclock);
  721. nexterror();
  722. }
  723. qlock(&in->seclock);
  724. p = b->rp;
  725. if(in->sec != nil) {
  726. len = (*in->sec->dec)(in->sec, p, len);
  727. if(len < 0)
  728. rcvError(tr, EDecodeError, "incorrectly encrypted message");
  729. if(len <= in->sec->maclen)
  730. rcvError(tr, EDecodeError, "record message too short for mac");
  731. len -= in->sec->maclen;
  732. /* update length */
  733. put16(header+3, len);
  734. put64(seq, in->seq);
  735. in->seq++;
  736. (*tr->packMac)(in->sec, in->sec->mackey, seq, header, p, len, hmac);
  737. if(memcmp(hmac, p+len, in->sec->maclen) != 0)
  738. rcvError(tr, EBadRecordMac, "record mac mismatch");
  739. b->wp = b->rp + len;
  740. }
  741. qunlock(&in->seclock);
  742. poperror();
  743. if(len <= 0)
  744. rcvError(tr, EDecodeError, "runt record message");
  745. switch(type) {
  746. default:
  747. rcvError(tr, EIllegalParameter, "invalid record message 0x%x", type);
  748. break;
  749. case RChangeCipherSpec:
  750. if(len != 1 || p[0] != 1)
  751. rcvError(tr, EDecodeError, "invalid change cipher spec");
  752. qlock(&in->seclock);
  753. if(in->new == nil){
  754. qunlock(&in->seclock);
  755. rcvError(tr, EUnexpectedMessage, "unexpected change cipher spec");
  756. }
  757. freeSec(in->sec);
  758. in->sec = in->new;
  759. in->new = nil;
  760. in->seq = 0;
  761. qunlock(&in->seclock);
  762. break;
  763. case RAlert:
  764. if(len != 2)
  765. rcvError(tr, EDecodeError, "invalid alert");
  766. if(p[0] == 2)
  767. rcvAlert(tr, p[1]);
  768. if(p[0] != 1)
  769. rcvError(tr, EIllegalParameter, "invalid alert fatal code");
  770. /*
  771. * propate non-fatal alerts to handshaker
  772. */
  773. if(p[1] == ECloseNotify) {
  774. tlsclosed(tr, SRClose);
  775. if(tr->opened)
  776. error("tls hungup");
  777. error("close notify");
  778. }
  779. if(p[1] == ENoRenegotiation)
  780. alertHand(tr, "no renegotiation");
  781. else if(p[1] == EUserCanceled)
  782. alertHand(tr, "handshake canceled by user");
  783. else
  784. rcvError(tr, EIllegalParameter, "invalid alert code");
  785. break;
  786. case RHandshake:
  787. /*
  788. * don't worry about dropping the block
  789. * qbwrite always queues even if flow controlled and interrupted.
  790. *
  791. * if there isn't any handshaker, ignore the request,
  792. * but notify the other side we are doing so.
  793. */
  794. lock(&tr->hqlock);
  795. if(tr->handq != nil){
  796. tr->hqref++;
  797. unlock(&tr->hqlock);
  798. if(waserror()){
  799. dechandq(tr);
  800. nexterror();
  801. }
  802. b = padblock(b, 1);
  803. *b->rp = RHandshake;
  804. qbwrite(tr->handq, b);
  805. b = nil;
  806. poperror();
  807. dechandq(tr);
  808. }else{
  809. unlock(&tr->hqlock);
  810. if(tr->verset && tr->version != SSL3Version && !waserror()){
  811. sendAlert(tr, ENoRenegotiation);
  812. poperror();
  813. }
  814. }
  815. break;
  816. case SSL2ClientHello:
  817. lock(&tr->hqlock);
  818. if(tr->handq != nil){
  819. tr->hqref++;
  820. unlock(&tr->hqlock);
  821. if(waserror()){
  822. dechandq(tr);
  823. nexterror();
  824. }
  825. /* Pass the SSL2 format data, so that the handshake code can compute
  826. the correct checksums. HSSL2ClientHello = HandshakeType 9 is
  827. unused in RFC2246. */
  828. b = padblock(b, 8);
  829. b->rp[0] = RHandshake;
  830. b->rp[1] = HSSL2ClientHello;
  831. put24(&b->rp[2], len+3);
  832. b->rp[5] = SSL2ClientHello;
  833. put16(&b->rp[6], ver);
  834. qbwrite(tr->handq, b);
  835. b = nil;
  836. poperror();
  837. dechandq(tr);
  838. }else{
  839. unlock(&tr->hqlock);
  840. if(tr->verset && tr->version != SSL3Version && !waserror()){
  841. sendAlert(tr, ENoRenegotiation);
  842. poperror();
  843. }
  844. }
  845. break;
  846. case RApplication:
  847. if(!tr->opened)
  848. rcvError(tr, EUnexpectedMessage, "application message received before handshake completed");
  849. tr->processed = b;
  850. b = nil;
  851. break;
  852. }
  853. if(b != nil)
  854. freeb(b);
  855. poperror();
  856. }
  857. /*
  858. * got a fatal alert message
  859. */
  860. static void
  861. rcvAlert(TlsRec *tr, int err)
  862. {
  863. char *s;
  864. int i;
  865. s = "unknown error";
  866. for(i=0; i < nelem(tlserrs); i++){
  867. if(tlserrs[i].err == err){
  868. s = tlserrs[i].msg;
  869. break;
  870. }
  871. }
  872. tlsError(tr, s);
  873. if(!tr->opened)
  874. error(s);
  875. error("tls error");
  876. }
  877. /*
  878. * found an error while decoding the input stream
  879. */
  880. static void
  881. rcvError(TlsRec *tr, int err, char *fmt, ...)
  882. {
  883. char msg[ERRMAX];
  884. va_list arg;
  885. va_start(arg, fmt);
  886. vseprint(msg, msg+sizeof(msg), fmt, arg);
  887. va_end(arg);
  888. sendAlert(tr, err);
  889. if(!tr->opened)
  890. error(msg);
  891. error("tls error");
  892. }
  893. /*
  894. * make sure the next hand operation returns with a 'msg' error
  895. */
  896. static void
  897. alertHand(TlsRec *tr, char *msg)
  898. {
  899. Block *b;
  900. int n;
  901. lock(&tr->hqlock);
  902. if(tr->handq == nil){
  903. unlock(&tr->hqlock);
  904. return;
  905. }
  906. tr->hqref++;
  907. unlock(&tr->hqlock);
  908. n = strlen(msg);
  909. if(waserror()){
  910. dechandq(tr);
  911. nexterror();
  912. }
  913. b = allocb(n + 2);
  914. *b->wp++ = RAlert;
  915. memmove(b->wp, msg, n + 1);
  916. b->wp += n + 1;
  917. qbwrite(tr->handq, b);
  918. poperror();
  919. dechandq(tr);
  920. }
  921. static void
  922. checkstate(TlsRec *tr, int ishand, int ok)
  923. {
  924. int state;
  925. lock(&tr->statelk);
  926. state = tr->state;
  927. unlock(&tr->statelk);
  928. if(state & ok)
  929. return;
  930. switch(state){
  931. case SHandshake:
  932. case SOpen:
  933. break;
  934. case SError:
  935. case SAlert:
  936. if(ishand)
  937. error(tr->err);
  938. error("tls error");
  939. case SRClose:
  940. case SLClose:
  941. case SClosed:
  942. error("tls hungup");
  943. }
  944. error("tls improperly configured");
  945. }
  946. static Block*
  947. tlsbread(Chan *c, long n, ulong offset)
  948. {
  949. int ty;
  950. Block *b;
  951. TlsRec *volatile tr;
  952. ty = TYPE(c->qid);
  953. switch(ty) {
  954. default:
  955. return devbread(c, n, offset);
  956. case Qhand:
  957. case Qdata:
  958. break;
  959. }
  960. tr = tlsdevs[CONV(c->qid)];
  961. if(tr == nil)
  962. panic("tlsbread");
  963. if(waserror()){
  964. qunlock(&tr->in.io);
  965. nexterror();
  966. }
  967. qlock(&tr->in.io);
  968. if(ty == Qdata){
  969. checkstate(tr, 0, SOpen);
  970. while(tr->processed == nil)
  971. tlsrecread(tr);
  972. /* return at most what was asked for */
  973. b = qgrab(&tr->processed, n);
  974. qunlock(&tr->in.io);
  975. poperror();
  976. tr->datain += BLEN(b);
  977. }else{
  978. checkstate(tr, 1, SOpen|SHandshake|SLClose);
  979. /*
  980. * it's ok to look at state without the lock
  981. * since it only protects reading records,
  982. * and we have that tr->in.io held.
  983. */
  984. while(!tr->opened && tr->hprocessed == nil && !qcanread(tr->handq))
  985. tlsrecread(tr);
  986. qunlock(&tr->in.io);
  987. poperror();
  988. if(waserror()){
  989. qunlock(&tr->hqread);
  990. nexterror();
  991. }
  992. qlock(&tr->hqread);
  993. if(tr->hprocessed == nil){
  994. b = qbread(tr->handq, MaxRecLen + 1);
  995. if(*b->rp++ == RAlert){
  996. strecpy(up->errstr, up->errstr+ERRMAX, (char*)b->rp);
  997. freeb(b);
  998. nexterror();
  999. }
  1000. tr->hprocessed = b;
  1001. }
  1002. b = qgrab(&tr->hprocessed, n);
  1003. poperror();
  1004. qunlock(&tr->hqread);
  1005. tr->handin += BLEN(b);
  1006. }
  1007. return b;
  1008. }
  1009. static long
  1010. tlsread(Chan *c, void *a, long n, vlong off)
  1011. {
  1012. Block *volatile b;
  1013. Block *nb;
  1014. uchar *va;
  1015. int i, ty;
  1016. char *buf, *s, *e;
  1017. ulong offset = off;
  1018. TlsRec * tr;
  1019. if(c->qid.type & QTDIR)
  1020. return devdirread(c, a, n, 0, 0, tlsgen);
  1021. tr = tlsdevs[CONV(c->qid)];
  1022. ty = TYPE(c->qid);
  1023. switch(ty) {
  1024. default:
  1025. error(Ebadusefd);
  1026. case Qstatus:
  1027. buf = smalloc(Statlen);
  1028. qlock(&tr->in.seclock);
  1029. qlock(&tr->out.seclock);
  1030. s = buf;
  1031. e = buf + Statlen;
  1032. s = seprint(s, e, "State: %s\n", tlsstate(tr->state));
  1033. s = seprint(s, e, "Version: 0x%x\n", tr->version);
  1034. if(tr->in.sec != nil)
  1035. s = seprint(s, e, "EncIn: %s\nHashIn: %s\n", tr->in.sec->encalg, tr->in.sec->hashalg);
  1036. if(tr->in.new != nil)
  1037. s = seprint(s, e, "NewEncIn: %s\nNewHashIn: %s\n", tr->in.new->encalg, tr->in.new->hashalg);
  1038. if(tr->out.sec != nil)
  1039. s = seprint(s, e, "EncOut: %s\nHashOut: %s\n", tr->out.sec->encalg, tr->out.sec->hashalg);
  1040. if(tr->out.new != nil)
  1041. seprint(s, e, "NewEncOut: %s\nNewHashOut: %s\n", tr->out.new->encalg, tr->out.new->hashalg);
  1042. qunlock(&tr->in.seclock);
  1043. qunlock(&tr->out.seclock);
  1044. n = readstr(offset, a, n, buf);
  1045. free(buf);
  1046. return n;
  1047. case Qstats:
  1048. buf = smalloc(Statlen);
  1049. s = buf;
  1050. e = buf + Statlen;
  1051. s = seprint(s, e, "DataIn: %lld\n", tr->datain);
  1052. s = seprint(s, e, "DataOut: %lld\n", tr->dataout);
  1053. s = seprint(s, e, "HandIn: %lld\n", tr->handin);
  1054. seprint(s, e, "HandOut: %lld\n", tr->handout);
  1055. n = readstr(offset, a, n, buf);
  1056. free(buf);
  1057. return n;
  1058. case Qctl:
  1059. buf = smalloc(Statlen);
  1060. snprint(buf, Statlen, "%llud", CONV(c->qid));
  1061. n = readstr(offset, a, n, buf);
  1062. free(buf);
  1063. return n;
  1064. case Qdata:
  1065. case Qhand:
  1066. b = tlsbread(c, n, offset);
  1067. break;
  1068. case Qencalgs:
  1069. return readstr(offset, a, n, encalgs);
  1070. case Qhashalgs:
  1071. return readstr(offset, a, n, hashalgs);
  1072. }
  1073. if(waserror()){
  1074. freeblist(b);
  1075. nexterror();
  1076. }
  1077. n = 0;
  1078. va = a;
  1079. for(nb = b; nb; nb = nb->next){
  1080. i = BLEN(nb);
  1081. memmove(va+n, nb->rp, i);
  1082. n += i;
  1083. }
  1084. freeblist(b);
  1085. poperror();
  1086. return n;
  1087. }
  1088. /*
  1089. * write a block in tls records
  1090. */
  1091. static void
  1092. tlsrecwrite(TlsRec *tr, int type, Block *b)
  1093. {
  1094. Block *volatile bb;
  1095. Block *nb;
  1096. uchar *p, seq[8];
  1097. OneWay *volatile out;
  1098. int n, maclen, pad, ok;
  1099. out = &tr->out;
  1100. bb = b;
  1101. if(waserror()){
  1102. qunlock(&out->io);
  1103. if(bb != nil)
  1104. freeb(bb);
  1105. nexterror();
  1106. }
  1107. qlock(&out->io);
  1108. ok = SHandshake|SOpen|SRClose;
  1109. if(type == RAlert)
  1110. ok |= SAlert;
  1111. while(bb != nil){
  1112. checkstate(tr, type != RApplication, ok);
  1113. /*
  1114. * get at most one maximal record's input,
  1115. * with padding on the front for header and
  1116. * back for mac and maximal block padding.
  1117. */
  1118. if(waserror()){
  1119. qunlock(&out->seclock);
  1120. nexterror();
  1121. }
  1122. qlock(&out->seclock);
  1123. maclen = 0;
  1124. pad = 0;
  1125. if(out->sec != nil){
  1126. maclen = out->sec->maclen;
  1127. pad = maclen + out->sec->block;
  1128. }
  1129. n = BLEN(bb);
  1130. if(n > MaxRecLen){
  1131. n = MaxRecLen;
  1132. nb = allocb(n + pad + RecHdrLen);
  1133. memmove(nb->wp + RecHdrLen, bb->rp, n);
  1134. bb->rp += n;
  1135. }else{
  1136. /*
  1137. * carefully reuse bb so it will get freed if we're out of memory
  1138. */
  1139. bb = padblock(bb, RecHdrLen);
  1140. if(pad)
  1141. nb = padblock(bb, -pad);
  1142. else
  1143. nb = bb;
  1144. bb = nil;
  1145. }
  1146. p = nb->rp;
  1147. p[0] = type;
  1148. put16(p+1, tr->version);
  1149. put16(p+3, n);
  1150. if(out->sec != nil){
  1151. put64(seq, out->seq);
  1152. out->seq++;
  1153. (*tr->packMac)(out->sec, out->sec->mackey, seq, p, p + RecHdrLen, n, p + RecHdrLen + n);
  1154. n += maclen;
  1155. /* encrypt */
  1156. n = (*out->sec->enc)(out->sec, p + RecHdrLen, n);
  1157. nb->wp = p + RecHdrLen + n;
  1158. /* update length */
  1159. put16(p+3, n);
  1160. }
  1161. if(type == RChangeCipherSpec){
  1162. if(out->new == nil)
  1163. error("change cipher without a new cipher");
  1164. freeSec(out->sec);
  1165. out->sec = out->new;
  1166. out->new = nil;
  1167. out->seq = 0;
  1168. }
  1169. qunlock(&out->seclock);
  1170. poperror();
  1171. /*
  1172. * if bwrite error's, we assume the block is queued.
  1173. * if not, we're out of sync with the receiver and will not recover.
  1174. */
  1175. if(waserror()){
  1176. if(strcmp(up->errstr, "interrupted") != 0)
  1177. tlsError(tr, "channel error");
  1178. nexterror();
  1179. }
  1180. devtab[tr->c->type]->bwrite(tr->c, nb, 0);
  1181. poperror();
  1182. }
  1183. qunlock(&out->io);
  1184. poperror();
  1185. }
  1186. static long
  1187. tlsbwrite(Chan *c, Block *b, ulong offset)
  1188. {
  1189. int ty;
  1190. ulong n;
  1191. TlsRec *tr;
  1192. n = BLEN(b);
  1193. tr = tlsdevs[CONV(c->qid)];
  1194. if(tr == nil)
  1195. panic("tlsbread");
  1196. ty = TYPE(c->qid);
  1197. switch(ty) {
  1198. default:
  1199. return devbwrite(c, b, offset);
  1200. case Qhand:
  1201. tlsrecwrite(tr, RHandshake, b);
  1202. tr->handout += n;
  1203. break;
  1204. case Qdata:
  1205. checkstate(tr, 0, SOpen);
  1206. tlsrecwrite(tr, RApplication, b);
  1207. tr->dataout += n;
  1208. break;
  1209. }
  1210. return n;
  1211. }
  1212. typedef struct Hashalg Hashalg;
  1213. struct Hashalg
  1214. {
  1215. char *name;
  1216. int maclen;
  1217. void (*initkey)(Hashalg *, int, Secret *, uchar*);
  1218. };
  1219. static void
  1220. initmd5key(Hashalg *ha, int version, Secret *s, uchar *p)
  1221. {
  1222. s->maclen = ha->maclen;
  1223. if(version == SSL3Version)
  1224. s->mac = sslmac_md5;
  1225. else
  1226. s->mac = hmac_md5;
  1227. memmove(s->mackey, p, ha->maclen);
  1228. }
  1229. static void
  1230. initclearmac(Hashalg *, int, Secret *s, uchar *)
  1231. {
  1232. s->maclen = 0;
  1233. s->mac = nomac;
  1234. }
  1235. static void
  1236. initsha1key(Hashalg *ha, int version, Secret *s, uchar *p)
  1237. {
  1238. s->maclen = ha->maclen;
  1239. if(version == SSL3Version)
  1240. s->mac = sslmac_sha1;
  1241. else
  1242. s->mac = hmac_sha1;
  1243. memmove(s->mackey, p, ha->maclen);
  1244. }
  1245. static Hashalg hashtab[] =
  1246. {
  1247. { "clear", 0, initclearmac, },
  1248. { "md5", MD5dlen, initmd5key, },
  1249. { "sha1", SHA1dlen, initsha1key, },
  1250. { 0 }
  1251. };
  1252. static Hashalg*
  1253. parsehashalg(char *p)
  1254. {
  1255. Hashalg *ha;
  1256. for(ha = hashtab; ha->name; ha++)
  1257. if(strcmp(p, ha->name) == 0)
  1258. return ha;
  1259. error("unsupported hash algorithm");
  1260. return nil;
  1261. }
  1262. typedef struct Encalg Encalg;
  1263. struct Encalg
  1264. {
  1265. char *name;
  1266. int keylen;
  1267. int ivlen;
  1268. void (*initkey)(Encalg *ea, Secret *, uchar*, uchar*);
  1269. };
  1270. static void
  1271. initRC4key(Encalg *ea, Secret *s, uchar *p, uchar *)
  1272. {
  1273. s->enckey = smalloc(sizeof(RC4state));
  1274. s->enc = rc4enc;
  1275. s->dec = rc4enc;
  1276. s->block = 0;
  1277. setupRC4state(s->enckey, p, ea->keylen);
  1278. }
  1279. static void
  1280. initDES3key(Encalg *, Secret *s, uchar *p, uchar *iv)
  1281. {
  1282. s->enckey = smalloc(sizeof(DES3state));
  1283. s->enc = des3enc;
  1284. s->dec = des3dec;
  1285. s->block = 8;
  1286. setupDES3state(s->enckey, (uchar(*)[8])p, iv);
  1287. }
  1288. static void
  1289. initclearenc(Encalg *, Secret *s, uchar *, uchar *)
  1290. {
  1291. s->enc = noenc;
  1292. s->dec = noenc;
  1293. s->block = 0;
  1294. }
  1295. static Encalg encrypttab[] =
  1296. {
  1297. { "clear", 0, 0, initclearenc },
  1298. { "rc4_128", 128/8, 0, initRC4key },
  1299. { "3des_ede_cbc", 3 * 8, 8, initDES3key },
  1300. { 0 }
  1301. };
  1302. static Encalg*
  1303. parseencalg(char *p)
  1304. {
  1305. Encalg *ea;
  1306. for(ea = encrypttab; ea->name; ea++)
  1307. if(strcmp(p, ea->name) == 0)
  1308. return ea;
  1309. error("unsupported encryption algorithm");
  1310. return nil;
  1311. }
  1312. static long
  1313. tlswrite(Chan *c, void *a, long n, vlong off)
  1314. {
  1315. Encalg *ea;
  1316. Hashalg *ha;
  1317. TlsRec *volatile tr;
  1318. Secret *volatile tos, *volatile toc;
  1319. Block *volatile b;
  1320. Cmdbuf *volatile cb;
  1321. int m, ty;
  1322. char *p, *e;
  1323. uchar *volatile x;
  1324. ulong offset = off;
  1325. tr = tlsdevs[CONV(c->qid)];
  1326. if(tr == nil)
  1327. panic("tlswrite");
  1328. ty = TYPE(c->qid);
  1329. switch(ty){
  1330. case Qdata:
  1331. case Qhand:
  1332. p = a;
  1333. e = p + n;
  1334. do{
  1335. m = e - p;
  1336. if(m > MaxRecLen)
  1337. m = MaxRecLen;
  1338. b = allocb(m);
  1339. if(waserror()){
  1340. freeb(b);
  1341. nexterror();
  1342. }
  1343. memmove(b->wp, p, m);
  1344. poperror();
  1345. b->wp += m;
  1346. tlsbwrite(c, b, offset);
  1347. p += m;
  1348. }while(p < e);
  1349. return n;
  1350. case Qctl:
  1351. break;
  1352. default:
  1353. error(Ebadusefd);
  1354. return -1;
  1355. }
  1356. cb = parsecmd(a, n);
  1357. if(waserror()){
  1358. free(cb);
  1359. nexterror();
  1360. }
  1361. if(cb->nf < 1)
  1362. error("short control request");
  1363. /* mutex with operations using what we're about to change */
  1364. if(waserror()){
  1365. qunlock(&tr->in.seclock);
  1366. qunlock(&tr->out.seclock);
  1367. nexterror();
  1368. }
  1369. qlock(&tr->in.seclock);
  1370. qlock(&tr->out.seclock);
  1371. if(strcmp(cb->f[0], "fd") == 0){
  1372. if(cb->nf != 3)
  1373. error("usage: fd open-fd version");
  1374. if(tr->c != nil)
  1375. error(Einuse);
  1376. m = strtol(cb->f[2], nil, 0);
  1377. if(m < MinProtoVersion || m > MaxProtoVersion)
  1378. error("unsupported version");
  1379. tr->c = buftochan(cb->f[1]);
  1380. tr->version = m;
  1381. tlsSetState(tr, SHandshake, SClosed);
  1382. }else if(strcmp(cb->f[0], "version") == 0){
  1383. if(cb->nf != 2)
  1384. error("usage: version vers");
  1385. if(tr->c == nil)
  1386. error("must set fd before version");
  1387. if(tr->verset)
  1388. error("version already set");
  1389. m = strtol(cb->f[1], nil, 0);
  1390. if(m == SSL3Version)
  1391. tr->packMac = sslPackMac;
  1392. else if(m == TLSVersion)
  1393. tr->packMac = tlsPackMac;
  1394. else
  1395. error("unsupported version");
  1396. tr->verset = 1;
  1397. tr->version = m;
  1398. }else if(strcmp(cb->f[0], "secret") == 0){
  1399. if(cb->nf != 5)
  1400. error("usage: secret hashalg encalg isclient secretdata");
  1401. if(tr->c == nil || !tr->verset)
  1402. error("must set fd and version before secrets");
  1403. if(tr->in.new != nil){
  1404. freeSec(tr->in.new);
  1405. tr->in.new = nil;
  1406. }
  1407. if(tr->out.new != nil){
  1408. freeSec(tr->out.new);
  1409. tr->out.new = nil;
  1410. }
  1411. ha = parsehashalg(cb->f[1]);
  1412. ea = parseencalg(cb->f[2]);
  1413. p = cb->f[4];
  1414. m = (strlen(p)*3)/2;
  1415. x = smalloc(m);
  1416. tos = nil;
  1417. toc = nil;
  1418. if(waserror()){
  1419. freeSec(tos);
  1420. freeSec(toc);
  1421. free(x);
  1422. nexterror();
  1423. }
  1424. m = dec64(x, m, p, strlen(p));
  1425. if(m < 2 * ha->maclen + 2 * ea->keylen + 2 * ea->ivlen)
  1426. error("not enough secret data provided");
  1427. tos = smalloc(sizeof(Secret));
  1428. toc = smalloc(sizeof(Secret));
  1429. if(!ha->initkey || !ea->initkey)
  1430. error("misimplemented secret algorithm");
  1431. (*ha->initkey)(ha, tr->version, tos, &x[0]);
  1432. (*ha->initkey)(ha, tr->version, toc, &x[ha->maclen]);
  1433. (*ea->initkey)(ea, tos, &x[2 * ha->maclen], &x[2 * ha->maclen + 2 * ea->keylen]);
  1434. (*ea->initkey)(ea, toc, &x[2 * ha->maclen + ea->keylen], &x[2 * ha->maclen + 2 * ea->keylen + ea->ivlen]);
  1435. if(!tos->mac || !tos->enc || !tos->dec
  1436. || !toc->mac || !toc->enc || !toc->dec)
  1437. error("missing algorithm implementations");
  1438. if(strtol(cb->f[3], nil, 0) == 0){
  1439. tr->in.new = tos;
  1440. tr->out.new = toc;
  1441. }else{
  1442. tr->in.new = toc;
  1443. tr->out.new = tos;
  1444. }
  1445. if(tr->version == SSL3Version){
  1446. toc->unpad = sslunpad;
  1447. tos->unpad = sslunpad;
  1448. }else{
  1449. toc->unpad = tlsunpad;
  1450. tos->unpad = tlsunpad;
  1451. }
  1452. toc->encalg = ea->name;
  1453. toc->hashalg = ha->name;
  1454. tos->encalg = ea->name;
  1455. tos->hashalg = ha->name;
  1456. free(x);
  1457. poperror();
  1458. }else if(strcmp(cb->f[0], "changecipher") == 0){
  1459. if(cb->nf != 1)
  1460. error("usage: changecipher");
  1461. if(tr->out.new == nil)
  1462. error("can't change cipher spec without setting secret");
  1463. qunlock(&tr->in.seclock);
  1464. qunlock(&tr->out.seclock);
  1465. poperror();
  1466. free(cb);
  1467. poperror();
  1468. /*
  1469. * the real work is done as the message is written
  1470. * so the stream is encrypted in sync.
  1471. */
  1472. b = allocb(1);
  1473. *b->wp++ = 1;
  1474. tlsrecwrite(tr, RChangeCipherSpec, b);
  1475. return n;
  1476. }else if(strcmp(cb->f[0], "opened") == 0){
  1477. if(cb->nf != 1)
  1478. error("usage: opened");
  1479. if(tr->in.sec == nil || tr->out.sec == nil)
  1480. error("cipher must be configured before enabling data messages");
  1481. lock(&tr->statelk);
  1482. if(tr->state != SHandshake && tr->state != SOpen){
  1483. unlock(&tr->statelk);
  1484. error("can't enable data messages");
  1485. }
  1486. tr->state = SOpen;
  1487. unlock(&tr->statelk);
  1488. tr->opened = 1;
  1489. }else if(strcmp(cb->f[0], "alert") == 0){
  1490. if(cb->nf != 2)
  1491. error("usage: alert n");
  1492. if(tr->c == nil)
  1493. error("must set fd before sending alerts");
  1494. m = strtol(cb->f[1], nil, 0);
  1495. qunlock(&tr->in.seclock);
  1496. qunlock(&tr->out.seclock);
  1497. poperror();
  1498. free(cb);
  1499. poperror();
  1500. sendAlert(tr, m);
  1501. if(m == ECloseNotify)
  1502. tlsclosed(tr, SLClose);
  1503. return n;
  1504. } else
  1505. error(Ebadarg);
  1506. qunlock(&tr->in.seclock);
  1507. qunlock(&tr->out.seclock);
  1508. poperror();
  1509. free(cb);
  1510. poperror();
  1511. return n;
  1512. }
  1513. static void
  1514. tlsinit(void)
  1515. {
  1516. struct Encalg *e;
  1517. struct Hashalg *h;
  1518. int n;
  1519. char *cp;
  1520. tlsdevs = smalloc(sizeof(TlsRec*) * maxtlsdevs);
  1521. trnames = smalloc((sizeof *trnames) * maxtlsdevs);
  1522. n = 1;
  1523. for(e = encrypttab; e->name != nil; e++)
  1524. n += strlen(e->name) + 1;
  1525. cp = encalgs = smalloc(n);
  1526. for(e = encrypttab;;){
  1527. strcpy(cp, e->name);
  1528. cp += strlen(e->name);
  1529. e++;
  1530. if(e->name == nil)
  1531. break;
  1532. *cp++ = ' ';
  1533. }
  1534. *cp = 0;
  1535. n = 1;
  1536. for(h = hashtab; h->name != nil; h++)
  1537. n += strlen(h->name) + 1;
  1538. cp = hashalgs = smalloc(n);
  1539. for(h = hashtab;;){
  1540. strcpy(cp, h->name);
  1541. cp += strlen(h->name);
  1542. h++;
  1543. if(h->name == nil)
  1544. break;
  1545. *cp++ = ' ';
  1546. }
  1547. *cp = 0;
  1548. }
  1549. Dev tlsdevtab = {
  1550. 'a',
  1551. "tls",
  1552. devreset,
  1553. tlsinit,
  1554. devshutdown,
  1555. tlsattach,
  1556. tlswalk,
  1557. tlsstat,
  1558. tlsopen,
  1559. devcreate,
  1560. tlsclose,
  1561. tlsread,
  1562. tlsbread,
  1563. tlswrite,
  1564. tlsbwrite,
  1565. devremove,
  1566. tlswstat,
  1567. };
  1568. /* get channel associated with an fd */
  1569. static Chan*
  1570. buftochan(char *p)
  1571. {
  1572. Chan *c;
  1573. int fd;
  1574. if(p == 0)
  1575. error(Ebadarg);
  1576. fd = strtoul(p, 0, 0);
  1577. if(fd < 0)
  1578. error(Ebadarg);
  1579. c = fdtochan(fd, -1, 0, 1); /* error check and inc ref */
  1580. return c;
  1581. }
  1582. static void
  1583. sendAlert(TlsRec *tr, int err)
  1584. {
  1585. Block *b;
  1586. int i, fatal;
  1587. char *msg;
  1588. fatal = 1;
  1589. msg = "tls unknown alert";
  1590. for(i=0; i < nelem(tlserrs); i++) {
  1591. if(tlserrs[i].err == err) {
  1592. msg = tlserrs[i].msg;
  1593. if(tr->version == SSL3Version)
  1594. err = tlserrs[i].sslerr;
  1595. else
  1596. err = tlserrs[i].tlserr;
  1597. fatal = tlserrs[i].fatal;
  1598. break;
  1599. }
  1600. }
  1601. if(!waserror()){
  1602. b = allocb(2);
  1603. *b->wp++ = fatal + 1;
  1604. *b->wp++ = err;
  1605. if(fatal)
  1606. tlsSetState(tr, SAlert, SOpen|SHandshake|SRClose);
  1607. tlsrecwrite(tr, RAlert, b);
  1608. poperror();
  1609. }
  1610. if(fatal)
  1611. tlsError(tr, msg);
  1612. }
  1613. static void
  1614. tlsError(TlsRec *tr, char *msg)
  1615. {
  1616. int s;
  1617. lock(&tr->statelk);
  1618. s = tr->state;
  1619. tr->state = SError;
  1620. if(s != SError){
  1621. strncpy(tr->err, msg, ERRMAX - 1);
  1622. tr->err[ERRMAX - 1] = '\0';
  1623. }
  1624. unlock(&tr->statelk);
  1625. if(s != SError)
  1626. alertHand(tr, msg);
  1627. }
  1628. static void
  1629. tlsSetState(TlsRec *tr, int new, int old)
  1630. {
  1631. lock(&tr->statelk);
  1632. if(tr->state & old)
  1633. tr->state = new;
  1634. unlock(&tr->statelk);
  1635. }
  1636. /* hand up a digest connection */
  1637. static void
  1638. tlshangup(TlsRec *tr)
  1639. {
  1640. Block *b;
  1641. qlock(&tr->in.io);
  1642. for(b = tr->processed; b; b = tr->processed){
  1643. tr->processed = b->next;
  1644. freeb(b);
  1645. }
  1646. if(tr->unprocessed != nil){
  1647. freeb(tr->unprocessed);
  1648. tr->unprocessed = nil;
  1649. }
  1650. qunlock(&tr->in.io);
  1651. tlsSetState(tr, SClosed, ~0);
  1652. }
  1653. static TlsRec*
  1654. newtls(Chan *ch)
  1655. {
  1656. TlsRec **pp, **ep, **np;
  1657. char **nmp;
  1658. int t, newmax;
  1659. if(waserror()) {
  1660. unlock(&tdlock);
  1661. nexterror();
  1662. }
  1663. lock(&tdlock);
  1664. ep = &tlsdevs[maxtlsdevs];
  1665. for(pp = tlsdevs; pp < ep; pp++)
  1666. if(*pp == nil)
  1667. break;
  1668. if(pp >= ep) {
  1669. if(maxtlsdevs >= MaxTlsDevs) {
  1670. unlock(&tdlock);
  1671. poperror();
  1672. return nil;
  1673. }
  1674. newmax = 2 * maxtlsdevs;
  1675. if(newmax > MaxTlsDevs)
  1676. newmax = MaxTlsDevs;
  1677. np = smalloc(sizeof(TlsRec*) * newmax);
  1678. memmove(np, tlsdevs, sizeof(TlsRec*) * maxtlsdevs);
  1679. tlsdevs = np;
  1680. pp = &tlsdevs[maxtlsdevs];
  1681. memset(pp, 0, sizeof(TlsRec*)*(newmax - maxtlsdevs));
  1682. nmp = smalloc(sizeof *nmp * newmax);
  1683. memmove(nmp, trnames, sizeof *nmp * maxtlsdevs);
  1684. trnames = nmp;
  1685. maxtlsdevs = newmax;
  1686. }
  1687. *pp = mktlsrec();
  1688. if(pp - tlsdevs >= tdhiwat)
  1689. tdhiwat++;
  1690. t = TYPE(ch->qid);
  1691. if(t == Qclonus)
  1692. t = Qctl;
  1693. ch->qid.path = QID(pp - tlsdevs, t);
  1694. ch->qid.vers = 0;
  1695. unlock(&tdlock);
  1696. poperror();
  1697. return *pp;
  1698. }
  1699. static TlsRec *
  1700. mktlsrec(void)
  1701. {
  1702. TlsRec *tr;
  1703. tr = mallocz(sizeof(*tr), 1);
  1704. if(tr == nil)
  1705. error(Enomem);
  1706. tr->state = SClosed;
  1707. tr->ref = 1;
  1708. kstrdup(&tr->user, up->user);
  1709. tr->perm = 0660;
  1710. return tr;
  1711. }
  1712. static char*
  1713. tlsstate(int s)
  1714. {
  1715. switch(s){
  1716. case SHandshake:
  1717. return "Handshaking";
  1718. case SOpen:
  1719. return "Established";
  1720. case SRClose:
  1721. return "RemoteClosed";
  1722. case SLClose:
  1723. return "LocalClosed";
  1724. case SAlert:
  1725. return "Alerting";
  1726. case SError:
  1727. return "Errored";
  1728. case SClosed:
  1729. return "Closed";
  1730. }
  1731. return "Unknown";
  1732. }
  1733. static void
  1734. freeSec(Secret *s)
  1735. {
  1736. if(s != nil){
  1737. free(s->enckey);
  1738. free(s);
  1739. }
  1740. }
  1741. static int
  1742. noenc(Secret *, uchar *, int n)
  1743. {
  1744. return n;
  1745. }
  1746. static int
  1747. rc4enc(Secret *sec, uchar *buf, int n)
  1748. {
  1749. rc4(sec->enckey, buf, n);
  1750. return n;
  1751. }
  1752. static int
  1753. tlsunpad(uchar *buf, int n, int block)
  1754. {
  1755. int pad, nn;
  1756. pad = buf[n - 1];
  1757. nn = n - 1 - pad;
  1758. if(nn <= 0 || n % block)
  1759. return -1;
  1760. while(--n > nn)
  1761. if(pad != buf[n - 1])
  1762. return -1;
  1763. return nn;
  1764. }
  1765. static int
  1766. sslunpad(uchar *buf, int n, int block)
  1767. {
  1768. int pad, nn;
  1769. pad = buf[n - 1];
  1770. nn = n - 1 - pad;
  1771. if(nn <= 0 || n % block)
  1772. return -1;
  1773. return nn;
  1774. }
  1775. static int
  1776. blockpad(uchar *buf, int n, int block)
  1777. {
  1778. int pad, nn;
  1779. nn = n + block;
  1780. nn -= nn % block;
  1781. pad = nn - (n + 1);
  1782. while(n < nn)
  1783. buf[n++] = pad;
  1784. return nn;
  1785. }
  1786. static int
  1787. des3enc(Secret *sec, uchar *buf, int n)
  1788. {
  1789. n = blockpad(buf, n, 8);
  1790. des3CBCencrypt(buf, n, sec->enckey);
  1791. return n;
  1792. }
  1793. static int
  1794. des3dec(Secret *sec, uchar *buf, int n)
  1795. {
  1796. des3CBCdecrypt(buf, n, sec->enckey);
  1797. return (*sec->unpad)(buf, n, 8);
  1798. }
  1799. static DigestState*
  1800. nomac(uchar *, ulong, uchar *, ulong, uchar *, DigestState *)
  1801. {
  1802. return nil;
  1803. }
  1804. /*
  1805. * sslmac: mac calculations for ssl 3.0 only; tls 1.0 uses the standard hmac.
  1806. */
  1807. static DigestState*
  1808. sslmac_x(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s,
  1809. DigestState*(*x)(uchar*, ulong, uchar*, DigestState*), int xlen, int padlen)
  1810. {
  1811. int i;
  1812. uchar pad[48], innerdigest[20];
  1813. if(xlen > sizeof(innerdigest)
  1814. || padlen > sizeof(pad))
  1815. return nil;
  1816. if(klen>64)
  1817. return nil;
  1818. /* first time through */
  1819. if(s == nil){
  1820. for(i=0; i<padlen; i++)
  1821. pad[i] = 0x36;
  1822. s = (*x)(key, klen, nil, nil);
  1823. s = (*x)(pad, padlen, nil, s);
  1824. if(s == nil)
  1825. return nil;
  1826. }
  1827. s = (*x)(p, len, nil, s);
  1828. if(digest == nil)
  1829. return s;
  1830. /* last time through */
  1831. for(i=0; i<padlen; i++)
  1832. pad[i] = 0x5c;
  1833. (*x)(nil, 0, innerdigest, s);
  1834. s = (*x)(key, klen, nil, nil);
  1835. s = (*x)(pad, padlen, nil, s);
  1836. (*x)(innerdigest, xlen, digest, s);
  1837. return nil;
  1838. }
  1839. static DigestState*
  1840. sslmac_sha1(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s)
  1841. {
  1842. return sslmac_x(p, len, key, klen, digest, s, sha1, SHA1dlen, 40);
  1843. }
  1844. static DigestState*
  1845. sslmac_md5(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s)
  1846. {
  1847. return sslmac_x(p, len, key, klen, digest, s, md5, MD5dlen, 48);
  1848. }
  1849. static void
  1850. sslPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac)
  1851. {
  1852. DigestState *s;
  1853. uchar buf[11];
  1854. memmove(buf, seq, 8);
  1855. buf[8] = header[0];
  1856. buf[9] = header[3];
  1857. buf[10] = header[4];
  1858. s = (*sec->mac)(buf, 11, mackey, sec->maclen, 0, 0);
  1859. (*sec->mac)(body, len, mackey, sec->maclen, mac, s);
  1860. }
  1861. static void
  1862. tlsPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac)
  1863. {
  1864. DigestState *s;
  1865. uchar buf[13];
  1866. memmove(buf, seq, 8);
  1867. memmove(&buf[8], header, 5);
  1868. s = (*sec->mac)(buf, 13, mackey, sec->maclen, 0, 0);
  1869. (*sec->mac)(body, len, mackey, sec->maclen, mac, s);
  1870. }
  1871. static void
  1872. put32(uchar *p, u32int x)
  1873. {
  1874. p[0] = x>>24;
  1875. p[1] = x>>16;
  1876. p[2] = x>>8;
  1877. p[3] = x;
  1878. }
  1879. static void
  1880. put64(uchar *p, vlong x)
  1881. {
  1882. put32(p, (u32int)(x >> 32));
  1883. put32(p+4, (u32int)x);
  1884. }
  1885. static void
  1886. put24(uchar *p, int x)
  1887. {
  1888. p[0] = x>>16;
  1889. p[1] = x>>8;
  1890. p[2] = x;
  1891. }
  1892. static void
  1893. put16(uchar *p, int x)
  1894. {
  1895. p[0] = x>>8;
  1896. p[1] = x;
  1897. }
  1898. static u32int
  1899. get32(uchar *p)
  1900. {
  1901. return (p[0]<<24)|(p[1]<<16)|(p[2]<<8)|p[3];
  1902. }
  1903. static int
  1904. get16(uchar *p)
  1905. {
  1906. return (p[0]<<8)|p[1];
  1907. }