devtls.c 44 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180
  1. /*
  2. * devtls - record layer for transport layer security 1.0 and secure sockets layer 3.0
  3. */
  4. #include "u.h"
  5. #include "../port/lib.h"
  6. #include "mem.h"
  7. #include "dat.h"
  8. #include "fns.h"
  9. #include "../port/error.h"
  10. #include <libsec.h>
  11. typedef struct OneWay OneWay;
  12. typedef struct Secret Secret;
  13. typedef struct TlsRec TlsRec;
  14. typedef struct TlsErrs TlsErrs;
  15. enum {
  16. Statlen= 1024, /* max. length of status or stats message */
  17. /* buffer limits */
  18. MaxRecLen = 1<<14, /* max payload length of a record layer message */
  19. MaxCipherRecLen = MaxRecLen + 2048,
  20. RecHdrLen = 5,
  21. MaxMacLen = SHA1dlen,
  22. /* protocol versions we can accept */
  23. TLSVersion = 0x0301,
  24. SSL3Version = 0x0300,
  25. ProtocolVersion = 0x0301, /* maximum version we speak */
  26. MinProtoVersion = 0x0300, /* limits on version we accept */
  27. MaxProtoVersion = 0x03ff,
  28. /* connection states */
  29. SHandshake = 1 << 0, /* doing handshake */
  30. SOpen = 1 << 1, /* application data can be sent */
  31. SRClose = 1 << 2, /* remote side has closed down */
  32. SLClose = 1 << 3, /* sent a close notify alert */
  33. SAlert = 1 << 5, /* sending or sent a fatal alert */
  34. SError = 1 << 6, /* some sort of error has occured */
  35. SClosed = 1 << 7, /* it is all over */
  36. /* record types */
  37. RChangeCipherSpec = 20,
  38. RAlert,
  39. RHandshake,
  40. RApplication,
  41. SSL2ClientHello = 1,
  42. HSSL2ClientHello = 9, /* local convention; see tlshand.c */
  43. /* alerts */
  44. ECloseNotify = 0,
  45. EUnexpectedMessage = 10,
  46. EBadRecordMac = 20,
  47. EDecryptionFailed = 21,
  48. ERecordOverflow = 22,
  49. EDecompressionFailure = 30,
  50. EHandshakeFailure = 40,
  51. ENoCertificate = 41,
  52. EBadCertificate = 42,
  53. EUnsupportedCertificate = 43,
  54. ECertificateRevoked = 44,
  55. ECertificateExpired = 45,
  56. ECertificateUnknown = 46,
  57. EIllegalParameter = 47,
  58. EUnknownCa = 48,
  59. EAccessDenied = 49,
  60. EDecodeError = 50,
  61. EDecryptError = 51,
  62. EExportRestriction = 60,
  63. EProtocolVersion = 70,
  64. EInsufficientSecurity = 71,
  65. EInternalError = 80,
  66. EUserCanceled = 90,
  67. ENoRenegotiation = 100,
  68. EMAX = 256
  69. };
  70. struct Secret
  71. {
  72. char *encalg; /* name of encryption alg */
  73. char *hashalg; /* name of hash alg */
  74. int (*enc)(Secret*, uchar*, int);
  75. int (*dec)(Secret*, uchar*, int);
  76. int (*unpad)(uchar*, int, int);
  77. DigestState *(*mac)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
  78. int block; /* encryption block len, 0 if none */
  79. int maclen;
  80. void *enckey;
  81. uchar mackey[MaxMacLen];
  82. };
  83. struct OneWay
  84. {
  85. QLock io; /* locks io access */
  86. QLock seclock; /* locks secret paramaters */
  87. ulong seq;
  88. Secret *sec; /* cipher in use */
  89. Secret *new; /* cipher waiting for enable */
  90. };
  91. struct TlsRec
  92. {
  93. Chan *c; /* io channel */
  94. int ref; /* serialized by tdlock for atomic destroy */
  95. int version; /* version of the protocol we are speaking */
  96. char verset; /* version has been set */
  97. char opened; /* opened command every issued? */
  98. char err[ERRMAX]; /* error message to return to handshake requests */
  99. vlong handin; /* bytes communicated by the record layer */
  100. vlong handout;
  101. vlong datain;
  102. vlong dataout;
  103. Lock statelk;
  104. int state;
  105. int debug;
  106. /* record layer mac functions for different protocol versions */
  107. void (*packMac)(Secret*, uchar*, uchar*, uchar*, uchar*, int, uchar*);
  108. /* input side -- protected by in.io */
  109. OneWay in;
  110. Block *processed; /* next bunch of application data */
  111. Block *unprocessed; /* data read from c but not parsed into records */
  112. /* handshake queue */
  113. Lock hqlock; /* protects hqref, alloc & free of handq, hprocessed */
  114. int hqref;
  115. Queue *handq; /* queue of handshake messages */
  116. Block *hprocessed; /* remainder of last block read from handq */
  117. QLock hqread; /* protects reads for hprocessed, handq */
  118. /* output side */
  119. OneWay out;
  120. /* protections */
  121. char *user;
  122. int perm;
  123. };
  124. struct TlsErrs{
  125. int err;
  126. int sslerr;
  127. int tlserr;
  128. int fatal;
  129. char *msg;
  130. };
  131. static TlsErrs tlserrs[] = {
  132. {ECloseNotify, ECloseNotify, ECloseNotify, 0, "close notify"},
  133. {EUnexpectedMessage, EUnexpectedMessage, EUnexpectedMessage, 1, "unexpected message"},
  134. {EBadRecordMac, EBadRecordMac, EBadRecordMac, 1, "bad record mac"},
  135. {EDecryptionFailed, EIllegalParameter, EDecryptionFailed, 1, "decryption failed"},
  136. {ERecordOverflow, EIllegalParameter, ERecordOverflow, 1, "record too long"},
  137. {EDecompressionFailure, EDecompressionFailure, EDecompressionFailure, 1, "decompression failed"},
  138. {EHandshakeFailure, EHandshakeFailure, EHandshakeFailure, 1, "could not negotiate acceptable security parameters"},
  139. {ENoCertificate, ENoCertificate, ECertificateUnknown, 1, "no appropriate certificate available"},
  140. {EBadCertificate, EBadCertificate, EBadCertificate, 1, "corrupted or invalid certificate"},
  141. {EUnsupportedCertificate, EUnsupportedCertificate, EUnsupportedCertificate, 1, "unsupported certificate type"},
  142. {ECertificateRevoked, ECertificateRevoked, ECertificateRevoked, 1, "revoked certificate"},
  143. {ECertificateExpired, ECertificateExpired, ECertificateExpired, 1, "expired certificate"},
  144. {ECertificateUnknown, ECertificateUnknown, ECertificateUnknown, 1, "unacceptable certificate"},
  145. {EIllegalParameter, EIllegalParameter, EIllegalParameter, 1, "illegal parameter"},
  146. {EUnknownCa, EHandshakeFailure, EUnknownCa, 1, "unknown certificate authority"},
  147. {EAccessDenied, EHandshakeFailure, EAccessDenied, 1, "access denied"},
  148. {EDecodeError, EIllegalParameter, EDecodeError, 1, "error decoding message"},
  149. {EDecryptError, EIllegalParameter, EDecryptError, 1, "error decrypting message"},
  150. {EExportRestriction, EHandshakeFailure, EExportRestriction, 1, "export restriction violated"},
  151. {EProtocolVersion, EIllegalParameter, EProtocolVersion, 1, "protocol version not supported"},
  152. {EInsufficientSecurity, EHandshakeFailure, EInsufficientSecurity, 1, "stronger security routines required"},
  153. {EInternalError, EHandshakeFailure, EInternalError, 1, "internal error"},
  154. {EUserCanceled, ECloseNotify, EUserCanceled, 0, "handshake canceled by user"},
  155. {ENoRenegotiation, EUnexpectedMessage, ENoRenegotiation, 0, "no renegotiation"},
  156. };
  157. enum
  158. {
  159. /* max. open tls connections */
  160. MaxTlsDevs = 1024
  161. };
  162. static Lock tdlock;
  163. static int tdhiwat;
  164. static int maxtlsdevs = 128;
  165. static TlsRec **tlsdevs;
  166. static char **trnames;
  167. static char *encalgs;
  168. static char *hashalgs;
  169. enum{
  170. Qtopdir = 1, /* top level directory */
  171. Qprotodir,
  172. Qclonus,
  173. Qencalgs,
  174. Qhashalgs,
  175. Qconvdir, /* directory for a conversation */
  176. Qdata,
  177. Qctl,
  178. Qhand,
  179. Qstatus,
  180. Qstats,
  181. };
  182. #define TYPE(x) ((x).path & 0xf)
  183. #define CONV(x) (((x).path >> 5)&(MaxTlsDevs-1))
  184. #define QID(c, y) (((c)<<5) | (y))
  185. static void checkstate(TlsRec *, int, int);
  186. static void ensure(TlsRec*, Block**, int);
  187. static void consume(Block**, uchar*, int);
  188. static Chan* buftochan(char*);
  189. static void tlshangup(TlsRec*);
  190. static void tlsError(TlsRec*, char *);
  191. static void alertHand(TlsRec*, char *);
  192. static TlsRec *newtls(Chan *c);
  193. static TlsRec *mktlsrec(void);
  194. static DigestState*sslmac_md5(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
  195. static DigestState*sslmac_sha1(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
  196. static DigestState*nomac(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
  197. static void sslPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac);
  198. static void tlsPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac);
  199. static void put64(uchar *p, vlong x);
  200. static void put32(uchar *p, u32int);
  201. static void put24(uchar *p, int);
  202. static void put16(uchar *p, int);
  203. static u32int get32(uchar *p);
  204. static int get16(uchar *p);
  205. static void tlsSetState(TlsRec *tr, int new, int old);
  206. static void rcvAlert(TlsRec *tr, int err);
  207. static void sendAlert(TlsRec *tr, int err);
  208. static void rcvError(TlsRec *tr, int err, char *msg, ...);
  209. static int rc4enc(Secret *sec, uchar *buf, int n);
  210. static int des3enc(Secret *sec, uchar *buf, int n);
  211. static int des3dec(Secret *sec, uchar *buf, int n);
  212. static int noenc(Secret *sec, uchar *buf, int n);
  213. static int sslunpad(uchar *buf, int n, int block);
  214. static int tlsunpad(uchar *buf, int n, int block);
  215. static void freeSec(Secret *sec);
  216. static char *tlsstate(int s);
  217. static void pdump(int, void*, char*);
  218. #pragma varargck argpos rcvError 3
  219. static char *tlsnames[] = {
  220. [Qclonus] "clone",
  221. [Qencalgs] "encalgs",
  222. [Qhashalgs] "hashalgs",
  223. [Qdata] "data",
  224. [Qctl] "ctl",
  225. [Qhand] "hand",
  226. [Qstatus] "status",
  227. [Qstats] "stats",
  228. };
  229. static int convdir[] = { Qctl, Qdata, Qhand, Qstatus, Qstats };
  230. static int
  231. tlsgen(Chan *c, char*, Dirtab *, int, int s, Dir *dp)
  232. {
  233. Qid q;
  234. TlsRec *tr;
  235. char *name, *nm;
  236. int perm, t;
  237. q.vers = 0;
  238. q.type = QTFILE;
  239. t = TYPE(c->qid);
  240. switch(t) {
  241. case Qtopdir:
  242. if(s == DEVDOTDOT){
  243. q.path = QID(0, Qtopdir);
  244. q.type = QTDIR;
  245. devdir(c, q, "#a", 0, eve, 0555, dp);
  246. return 1;
  247. }
  248. if(s > 0)
  249. return -1;
  250. q.path = QID(0, Qprotodir);
  251. q.type = QTDIR;
  252. devdir(c, q, "tls", 0, eve, 0555, dp);
  253. return 1;
  254. case Qprotodir:
  255. if(s == DEVDOTDOT){
  256. q.path = QID(0, Qtopdir);
  257. q.type = QTDIR;
  258. devdir(c, q, ".", 0, eve, 0555, dp);
  259. return 1;
  260. }
  261. if(s < 3){
  262. switch(s) {
  263. default:
  264. return -1;
  265. case 0:
  266. q.path = QID(0, Qclonus);
  267. break;
  268. case 1:
  269. q.path = QID(0, Qencalgs);
  270. break;
  271. case 2:
  272. q.path = QID(0, Qhashalgs);
  273. break;
  274. }
  275. perm = 0444;
  276. if(TYPE(q) == Qclonus)
  277. perm = 0555;
  278. devdir(c, q, tlsnames[TYPE(q)], 0, eve, perm, dp);
  279. return 1;
  280. }
  281. s -= 3;
  282. if(s >= tdhiwat)
  283. return -1;
  284. q.path = QID(s, Qconvdir);
  285. q.type = QTDIR;
  286. lock(&tdlock);
  287. tr = tlsdevs[s];
  288. if(tr != nil)
  289. nm = tr->user;
  290. else
  291. nm = eve;
  292. if((name = trnames[s]) == nil){
  293. name = trnames[s] = smalloc(16);
  294. sprint(name, "%d", s);
  295. }
  296. devdir(c, q, name, 0, nm, 0555, dp);
  297. unlock(&tdlock);
  298. return 1;
  299. case Qconvdir:
  300. if(s == DEVDOTDOT){
  301. q.path = QID(0, Qprotodir);
  302. q.type = QTDIR;
  303. devdir(c, q, "tls", 0, eve, 0555, dp);
  304. return 1;
  305. }
  306. if(s < 0 || s >= nelem(convdir))
  307. return -1;
  308. lock(&tdlock);
  309. tr = tlsdevs[CONV(c->qid)];
  310. if(tr != nil){
  311. nm = tr->user;
  312. perm = tr->perm;
  313. }else{
  314. perm = 0;
  315. nm = eve;
  316. }
  317. t = convdir[s];
  318. if(t == Qstatus || t == Qstats)
  319. perm &= 0444;
  320. q.path = QID(CONV(c->qid), t);
  321. devdir(c, q, tlsnames[t], 0, nm, perm, dp);
  322. unlock(&tdlock);
  323. return 1;
  324. case Qclonus:
  325. case Qencalgs:
  326. case Qhashalgs:
  327. perm = 0444;
  328. if(t == Qclonus)
  329. perm = 0555;
  330. devdir(c, c->qid, tlsnames[t], 0, eve, perm, dp);
  331. return 1;
  332. default:
  333. lock(&tdlock);
  334. tr = tlsdevs[CONV(c->qid)];
  335. if(tr != nil){
  336. nm = tr->user;
  337. perm = tr->perm;
  338. }else{
  339. perm = 0;
  340. nm = eve;
  341. }
  342. if(t == Qstatus || t == Qstats)
  343. perm &= 0444;
  344. devdir(c, c->qid, tlsnames[t], 0, nm, perm, dp);
  345. unlock(&tdlock);
  346. return 1;
  347. }
  348. }
  349. static Chan*
  350. tlsattach(char *spec)
  351. {
  352. Chan *c;
  353. c = devattach('a', spec);
  354. c->qid.path = QID(0, Qtopdir);
  355. c->qid.type = QTDIR;
  356. c->qid.vers = 0;
  357. return c;
  358. }
  359. static Walkqid*
  360. tlswalk(Chan *c, Chan *nc, char **name, int nname)
  361. {
  362. return devwalk(c, nc, name, nname, nil, 0, tlsgen);
  363. }
  364. static int
  365. tlsstat(Chan *c, uchar *db, int n)
  366. {
  367. return devstat(c, db, n, nil, 0, tlsgen);
  368. }
  369. static Chan*
  370. tlsopen(Chan *c, int omode)
  371. {
  372. TlsRec *tr, **pp;
  373. int t, perm;
  374. perm = 0;
  375. omode &= 3;
  376. switch(omode) {
  377. case OREAD:
  378. perm = 4;
  379. break;
  380. case OWRITE:
  381. perm = 2;
  382. break;
  383. case ORDWR:
  384. perm = 6;
  385. break;
  386. }
  387. t = TYPE(c->qid);
  388. switch(t) {
  389. default:
  390. panic("tlsopen");
  391. case Qtopdir:
  392. case Qprotodir:
  393. case Qconvdir:
  394. if(omode != OREAD)
  395. error(Eperm);
  396. break;
  397. case Qclonus:
  398. tr = newtls(c);
  399. if(tr == nil)
  400. error(Enodev);
  401. break;
  402. case Qctl:
  403. case Qdata:
  404. case Qhand:
  405. case Qstatus:
  406. case Qstats:
  407. if((t == Qstatus || t == Qstats) && omode != OREAD)
  408. error(Eperm);
  409. if(waserror()) {
  410. unlock(&tdlock);
  411. nexterror();
  412. }
  413. lock(&tdlock);
  414. pp = &tlsdevs[CONV(c->qid)];
  415. tr = *pp;
  416. if(tr == nil)
  417. error("must open connection using clone");
  418. if((perm & (tr->perm>>6)) != perm
  419. && (strcmp(up->user, tr->user) != 0
  420. || (perm & tr->perm) != perm))
  421. error(Eperm);
  422. if(t == Qhand){
  423. if(waserror()){
  424. unlock(&tr->hqlock);
  425. nexterror();
  426. }
  427. lock(&tr->hqlock);
  428. if(tr->handq != nil)
  429. error(Einuse);
  430. tr->handq = qopen(2 * MaxCipherRecLen, 0, nil, nil);
  431. if(tr->handq == nil)
  432. error("cannot allocate handshake queue");
  433. tr->hqref = 1;
  434. unlock(&tr->hqlock);
  435. poperror();
  436. }
  437. tr->ref++;
  438. unlock(&tdlock);
  439. poperror();
  440. break;
  441. case Qencalgs:
  442. case Qhashalgs:
  443. if(omode != OREAD)
  444. error(Eperm);
  445. break;
  446. }
  447. c->mode = openmode(omode);
  448. c->flag |= COPEN;
  449. c->offset = 0;
  450. c->iounit = qiomaxatomic;
  451. return c;
  452. }
  453. static int
  454. tlswstat(Chan *c, uchar *dp, int n)
  455. {
  456. Dir *d;
  457. TlsRec *tr;
  458. int rv;
  459. d = nil;
  460. if(waserror()){
  461. free(d);
  462. unlock(&tdlock);
  463. nexterror();
  464. }
  465. lock(&tdlock);
  466. tr = tlsdevs[CONV(c->qid)];
  467. if(tr == nil)
  468. error(Ebadusefd);
  469. if(strcmp(tr->user, up->user) != 0)
  470. error(Eperm);
  471. d = smalloc(n + sizeof *d);
  472. rv = convM2D(dp, n, &d[0], (char*) &d[1]);
  473. if(rv == 0)
  474. error(Eshortstat);
  475. if(!emptystr(d->uid))
  476. kstrdup(&tr->user, d->uid);
  477. if(d->mode != ~0UL)
  478. tr->perm = d->mode;
  479. free(d);
  480. poperror();
  481. unlock(&tdlock);
  482. return rv;
  483. }
  484. static void
  485. dechandq(TlsRec *tr)
  486. {
  487. lock(&tr->hqlock);
  488. if(--tr->hqref == 0){
  489. if(tr->handq != nil){
  490. qfree(tr->handq);
  491. tr->handq = nil;
  492. }
  493. if(tr->hprocessed != nil){
  494. freeb(tr->hprocessed);
  495. tr->hprocessed = nil;
  496. }
  497. }
  498. unlock(&tr->hqlock);
  499. }
  500. static void
  501. tlsclose(Chan *c)
  502. {
  503. TlsRec *tr;
  504. int t;
  505. t = TYPE(c->qid);
  506. switch(t) {
  507. case Qctl:
  508. case Qdata:
  509. case Qhand:
  510. case Qstatus:
  511. case Qstats:
  512. if((c->flag & COPEN) == 0)
  513. break;
  514. tr = tlsdevs[CONV(c->qid)];
  515. if(tr == nil)
  516. break;
  517. if(t == Qhand)
  518. dechandq(tr);
  519. lock(&tdlock);
  520. if(--tr->ref > 0) {
  521. unlock(&tdlock);
  522. return;
  523. }
  524. tlsdevs[CONV(c->qid)] = nil;
  525. unlock(&tdlock);
  526. if(tr->c != nil && !waserror()){
  527. checkstate(tr, 0, SOpen|SHandshake|SRClose);
  528. sendAlert(tr, ECloseNotify);
  529. poperror();
  530. }
  531. tlshangup(tr);
  532. if(tr->c != nil)
  533. cclose(tr->c);
  534. freeSec(tr->in.sec);
  535. freeSec(tr->in.new);
  536. freeSec(tr->out.sec);
  537. freeSec(tr->out.new);
  538. free(tr->user);
  539. free(tr);
  540. break;
  541. }
  542. }
  543. /*
  544. * make sure we have at least 'n' bytes in list 'l'
  545. */
  546. static void
  547. ensure(TlsRec *s, Block **l, int n)
  548. {
  549. int sofar, i;
  550. Block *b, *bl;
  551. sofar = 0;
  552. for(b = *l; b; b = b->next){
  553. sofar += BLEN(b);
  554. if(sofar >= n)
  555. return;
  556. l = &b->next;
  557. }
  558. while(sofar < n){
  559. bl = devtab[s->c->type]->bread(s->c, MaxCipherRecLen + RecHdrLen, 0);
  560. if(bl == 0)
  561. error(Ehungup);
  562. *l = bl;
  563. i = 0;
  564. for(b = bl; b; b = b->next){
  565. i += BLEN(b);
  566. l = &b->next;
  567. }
  568. if(i == 0)
  569. error(Ehungup);
  570. sofar += i;
  571. }
  572. if(s->debug) pprint("ensure read %d\n", sofar);
  573. }
  574. /*
  575. * copy 'n' bytes from 'l' into 'p' and free
  576. * the bytes in 'l'
  577. */
  578. static void
  579. consume(Block **l, uchar *p, int n)
  580. {
  581. Block *b;
  582. int i;
  583. for(; *l && n > 0; n -= i){
  584. b = *l;
  585. i = BLEN(b);
  586. if(i > n)
  587. i = n;
  588. memmove(p, b->rp, i);
  589. b->rp += i;
  590. p += i;
  591. if(BLEN(b) < 0)
  592. panic("consume");
  593. if(BLEN(b))
  594. break;
  595. *l = b->next;
  596. freeb(b);
  597. }
  598. }
  599. /*
  600. * give back n bytes
  601. */
  602. static void
  603. regurgitate(TlsRec *s, uchar *p, int n)
  604. {
  605. Block *b;
  606. if(n <= 0)
  607. return;
  608. b = s->unprocessed;
  609. if(s->unprocessed == nil || b->rp - b->base < n) {
  610. b = allocb(n);
  611. memmove(b->wp, p, n);
  612. b->wp += n;
  613. b->next = s->unprocessed;
  614. s->unprocessed = b;
  615. } else {
  616. b->rp -= n;
  617. memmove(b->rp, p, n);
  618. }
  619. }
  620. /*
  621. * remove at most n bytes from the queue
  622. */
  623. static Block*
  624. qgrab(Block **l, int n)
  625. {
  626. Block *bb, *b;
  627. int i;
  628. b = *l;
  629. if(BLEN(b) == n){
  630. *l = b->next;
  631. b->next = nil;
  632. return b;
  633. }
  634. i = 0;
  635. for(bb = b; bb != nil && i < n; bb = bb->next)
  636. i += BLEN(bb);
  637. if(i > n)
  638. i = n;
  639. bb = allocb(i);
  640. consume(l, bb->wp, i);
  641. bb->wp += i;
  642. return bb;
  643. }
  644. static void
  645. tlsclosed(TlsRec *tr, int new)
  646. {
  647. lock(&tr->statelk);
  648. if(tr->state == SOpen || tr->state == SHandshake)
  649. tr->state = new;
  650. else if((new | tr->state) == (SRClose|SLClose))
  651. tr->state = SClosed;
  652. unlock(&tr->statelk);
  653. alertHand(tr, "close notify");
  654. }
  655. /*
  656. * read and process one tls record layer message
  657. * must be called with tr->in.io held
  658. * We can't let Eintrs lose data, since doing so will get
  659. * us out of sync with the sender and break the reliablity
  660. * of the channel. Eintr only happens during the reads in
  661. * consume. Therefore we put back any bytes consumed before
  662. * the last call to ensure.
  663. */
  664. static void
  665. tlsrecread(TlsRec *tr)
  666. {
  667. OneWay *volatile in;
  668. Block *volatile b;
  669. uchar *p, seq[8], header[RecHdrLen], hmac[MD5dlen];
  670. int volatile nconsumed;
  671. int len, type, ver, unpad_len;
  672. nconsumed = 0;
  673. if(waserror()){
  674. if(strcmp(up->errstr, Eintr) == 0 && !waserror()){
  675. regurgitate(tr, header, nconsumed);
  676. poperror();
  677. }else
  678. tlsError(tr, "channel error");
  679. nexterror();
  680. }
  681. ensure(tr, &tr->unprocessed, RecHdrLen);
  682. consume(&tr->unprocessed, header, RecHdrLen);
  683. if(tr->debug)pprint("consumed %d header\n", RecHdrLen);
  684. nconsumed = RecHdrLen;
  685. if((tr->handin == 0) && (header[0] & 0x80)){
  686. /* Cope with an SSL3 ClientHello expressed in SSL2 record format.
  687. This is sent by some clients that we must interoperate
  688. with, such as Java's JSSE and Microsoft's Internet Explorer. */
  689. len = (get16(header) & ~0x8000) - 3;
  690. type = header[2];
  691. ver = get16(header + 3);
  692. if(type != SSL2ClientHello || len < 22)
  693. rcvError(tr, EProtocolVersion, "invalid initial SSL2-like message");
  694. }else{ /* normal SSL3 record format */
  695. type = header[0];
  696. ver = get16(header+1);
  697. len = get16(header+3);
  698. }
  699. if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion))
  700. rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'",
  701. tr->version, tr->verset?"/set":"", len, type, ver, (char*)header);
  702. if(len > MaxCipherRecLen || len < 0)
  703. rcvError(tr, ERecordOverflow, "record message too long %d", len);
  704. ensure(tr, &tr->unprocessed, len);
  705. nconsumed = 0;
  706. poperror();
  707. /*
  708. * If an Eintr happens after this, we'll get out of sync.
  709. * Make sure nothing we call can sleep.
  710. * Errors are ok, as they kill the connection.
  711. * Luckily, allocb won't sleep, it'll just error out.
  712. */
  713. b = nil;
  714. if(waserror()){
  715. if(b != nil)
  716. freeb(b);
  717. tlsError(tr, "channel error");
  718. nexterror();
  719. }
  720. b = qgrab(&tr->unprocessed, len);
  721. if(tr->debug) pprint("consumed unprocessed %d\n", len);
  722. in = &tr->in;
  723. if(waserror()){
  724. qunlock(&in->seclock);
  725. nexterror();
  726. }
  727. qlock(&in->seclock);
  728. p = b->rp;
  729. if(in->sec != nil) {
  730. /* to avoid Canvel-Hiltgen-Vaudenay-Vuagnoux attack, all errors here
  731. should look alike, including timing of the response. */
  732. unpad_len = (*in->sec->dec)(in->sec, p, len);
  733. if(unpad_len >= in->sec->maclen)
  734. len = unpad_len - in->sec->maclen;
  735. if(tr->debug) pprint("decrypted %d\n", unpad_len);
  736. if(tr->debug) pdump(unpad_len, p, "decrypted:");
  737. /* update length */
  738. put16(header+3, len);
  739. put64(seq, in->seq);
  740. in->seq++;
  741. (*tr->packMac)(in->sec, in->sec->mackey, seq, header, p, len, hmac);
  742. if(unpad_len < in->sec->maclen)
  743. rcvError(tr, EBadRecordMac, "short record mac");
  744. if(memcmp(hmac, p+len, in->sec->maclen) != 0)
  745. rcvError(tr, EBadRecordMac, "record mac mismatch");
  746. b->wp = b->rp + len;
  747. }
  748. qunlock(&in->seclock);
  749. poperror();
  750. if(len < 0)
  751. rcvError(tr, EDecodeError, "runt record message");
  752. switch(type) {
  753. default:
  754. rcvError(tr, EIllegalParameter, "invalid record message 0x%x", type);
  755. break;
  756. case RChangeCipherSpec:
  757. if(len != 1 || p[0] != 1)
  758. rcvError(tr, EDecodeError, "invalid change cipher spec");
  759. qlock(&in->seclock);
  760. if(in->new == nil){
  761. qunlock(&in->seclock);
  762. rcvError(tr, EUnexpectedMessage, "unexpected change cipher spec");
  763. }
  764. freeSec(in->sec);
  765. in->sec = in->new;
  766. in->new = nil;
  767. in->seq = 0;
  768. qunlock(&in->seclock);
  769. break;
  770. case RAlert:
  771. if(len != 2)
  772. rcvError(tr, EDecodeError, "invalid alert");
  773. if(p[0] == 2)
  774. rcvAlert(tr, p[1]);
  775. if(p[0] != 1)
  776. rcvError(tr, EIllegalParameter, "invalid alert fatal code");
  777. /*
  778. * propate non-fatal alerts to handshaker
  779. */
  780. if(p[1] == ECloseNotify) {
  781. tlsclosed(tr, SRClose);
  782. if(tr->opened)
  783. error("tls hungup");
  784. error("close notify");
  785. }
  786. if(p[1] == ENoRenegotiation)
  787. alertHand(tr, "no renegotiation");
  788. else if(p[1] == EUserCanceled)
  789. alertHand(tr, "handshake canceled by user");
  790. else
  791. rcvError(tr, EIllegalParameter, "invalid alert code");
  792. break;
  793. case RHandshake:
  794. /*
  795. * don't worry about dropping the block
  796. * qbwrite always queues even if flow controlled and interrupted.
  797. *
  798. * if there isn't any handshaker, ignore the request,
  799. * but notify the other side we are doing so.
  800. */
  801. lock(&tr->hqlock);
  802. if(tr->handq != nil){
  803. tr->hqref++;
  804. unlock(&tr->hqlock);
  805. if(waserror()){
  806. dechandq(tr);
  807. nexterror();
  808. }
  809. b = padblock(b, 1);
  810. *b->rp = RHandshake;
  811. qbwrite(tr->handq, b);
  812. b = nil;
  813. poperror();
  814. dechandq(tr);
  815. }else{
  816. unlock(&tr->hqlock);
  817. if(tr->verset && tr->version != SSL3Version && !waserror()){
  818. sendAlert(tr, ENoRenegotiation);
  819. poperror();
  820. }
  821. }
  822. break;
  823. case SSL2ClientHello:
  824. lock(&tr->hqlock);
  825. if(tr->handq != nil){
  826. tr->hqref++;
  827. unlock(&tr->hqlock);
  828. if(waserror()){
  829. dechandq(tr);
  830. nexterror();
  831. }
  832. /* Pass the SSL2 format data, so that the handshake code can compute
  833. the correct checksums. HSSL2ClientHello = HandshakeType 9 is
  834. unused in RFC2246. */
  835. b = padblock(b, 8);
  836. b->rp[0] = RHandshake;
  837. b->rp[1] = HSSL2ClientHello;
  838. put24(&b->rp[2], len+3);
  839. b->rp[5] = SSL2ClientHello;
  840. put16(&b->rp[6], ver);
  841. qbwrite(tr->handq, b);
  842. b = nil;
  843. poperror();
  844. dechandq(tr);
  845. }else{
  846. unlock(&tr->hqlock);
  847. if(tr->verset && tr->version != SSL3Version && !waserror()){
  848. sendAlert(tr, ENoRenegotiation);
  849. poperror();
  850. }
  851. }
  852. break;
  853. case RApplication:
  854. if(!tr->opened)
  855. rcvError(tr, EUnexpectedMessage, "application message received before handshake completed");
  856. if(BLEN(b) > 0){
  857. tr->processed = b;
  858. b = nil;
  859. }
  860. break;
  861. }
  862. if(b != nil)
  863. freeb(b);
  864. poperror();
  865. }
  866. /*
  867. * got a fatal alert message
  868. */
  869. static void
  870. rcvAlert(TlsRec *tr, int err)
  871. {
  872. char *s;
  873. int i;
  874. s = "unknown error";
  875. for(i=0; i < nelem(tlserrs); i++){
  876. if(tlserrs[i].err == err){
  877. s = tlserrs[i].msg;
  878. break;
  879. }
  880. }
  881. if(tr->debug) pprint("rcvAlert: %s\n", s);
  882. tlsError(tr, s);
  883. if(!tr->opened)
  884. error(s);
  885. error("tls error");
  886. }
  887. /*
  888. * found an error while decoding the input stream
  889. */
  890. static void
  891. rcvError(TlsRec *tr, int err, char *fmt, ...)
  892. {
  893. char msg[ERRMAX];
  894. va_list arg;
  895. va_start(arg, fmt);
  896. vseprint(msg, msg+sizeof(msg), fmt, arg);
  897. va_end(arg);
  898. if(tr->debug) pprint("rcvError: %s\n", msg);
  899. sendAlert(tr, err);
  900. if(!tr->opened)
  901. error(msg);
  902. error("tls error");
  903. }
  904. /*
  905. * make sure the next hand operation returns with a 'msg' error
  906. */
  907. static void
  908. alertHand(TlsRec *tr, char *msg)
  909. {
  910. Block *b;
  911. int n;
  912. lock(&tr->hqlock);
  913. if(tr->handq == nil){
  914. unlock(&tr->hqlock);
  915. return;
  916. }
  917. tr->hqref++;
  918. unlock(&tr->hqlock);
  919. n = strlen(msg);
  920. if(waserror()){
  921. dechandq(tr);
  922. nexterror();
  923. }
  924. b = allocb(n + 2);
  925. *b->wp++ = RAlert;
  926. memmove(b->wp, msg, n + 1);
  927. b->wp += n + 1;
  928. qbwrite(tr->handq, b);
  929. poperror();
  930. dechandq(tr);
  931. }
  932. static void
  933. checkstate(TlsRec *tr, int ishand, int ok)
  934. {
  935. int state;
  936. lock(&tr->statelk);
  937. state = tr->state;
  938. unlock(&tr->statelk);
  939. if(state & ok)
  940. return;
  941. switch(state){
  942. case SHandshake:
  943. case SOpen:
  944. break;
  945. case SError:
  946. case SAlert:
  947. if(ishand)
  948. error(tr->err);
  949. error("tls error");
  950. case SRClose:
  951. case SLClose:
  952. case SClosed:
  953. error("tls hungup");
  954. }
  955. error("tls improperly configured");
  956. }
  957. static Block*
  958. tlsbread(Chan *c, long n, ulong offset)
  959. {
  960. int ty;
  961. Block *b;
  962. TlsRec *volatile tr;
  963. ty = TYPE(c->qid);
  964. switch(ty) {
  965. default:
  966. return devbread(c, n, offset);
  967. case Qhand:
  968. case Qdata:
  969. break;
  970. }
  971. tr = tlsdevs[CONV(c->qid)];
  972. if(tr == nil)
  973. panic("tlsbread");
  974. if(waserror()){
  975. qunlock(&tr->in.io);
  976. nexterror();
  977. }
  978. qlock(&tr->in.io);
  979. if(ty == Qdata){
  980. checkstate(tr, 0, SOpen);
  981. while(tr->processed == nil)
  982. tlsrecread(tr);
  983. /* return at most what was asked for */
  984. b = qgrab(&tr->processed, n);
  985. if(tr->debug) pprint("consumed processed %d\n", BLEN(b));
  986. if(tr->debug) pdump(BLEN(b), b->rp, "consumed:");
  987. qunlock(&tr->in.io);
  988. poperror();
  989. tr->datain += BLEN(b);
  990. }else{
  991. checkstate(tr, 1, SOpen|SHandshake|SLClose);
  992. /*
  993. * it's ok to look at state without the lock
  994. * since it only protects reading records,
  995. * and we have that tr->in.io held.
  996. */
  997. while(!tr->opened && tr->hprocessed == nil && !qcanread(tr->handq))
  998. tlsrecread(tr);
  999. qunlock(&tr->in.io);
  1000. poperror();
  1001. if(waserror()){
  1002. qunlock(&tr->hqread);
  1003. nexterror();
  1004. }
  1005. qlock(&tr->hqread);
  1006. if(tr->hprocessed == nil){
  1007. b = qbread(tr->handq, MaxRecLen + 1);
  1008. if(*b->rp++ == RAlert){
  1009. kstrcpy(up->errstr, (char*)b->rp, ERRMAX);
  1010. freeb(b);
  1011. nexterror();
  1012. }
  1013. tr->hprocessed = b;
  1014. }
  1015. b = qgrab(&tr->hprocessed, n);
  1016. poperror();
  1017. qunlock(&tr->hqread);
  1018. tr->handin += BLEN(b);
  1019. }
  1020. return b;
  1021. }
  1022. static long
  1023. tlsread(Chan *c, void *a, long n, vlong off)
  1024. {
  1025. Block *volatile b;
  1026. Block *nb;
  1027. uchar *va;
  1028. int i, ty;
  1029. char *buf, *s, *e;
  1030. ulong offset = off;
  1031. TlsRec * tr;
  1032. if(c->qid.type & QTDIR)
  1033. return devdirread(c, a, n, 0, 0, tlsgen);
  1034. tr = tlsdevs[CONV(c->qid)];
  1035. ty = TYPE(c->qid);
  1036. switch(ty) {
  1037. default:
  1038. error(Ebadusefd);
  1039. case Qstatus:
  1040. buf = smalloc(Statlen);
  1041. qlock(&tr->in.seclock);
  1042. qlock(&tr->out.seclock);
  1043. s = buf;
  1044. e = buf + Statlen;
  1045. s = seprint(s, e, "State: %s\n", tlsstate(tr->state));
  1046. s = seprint(s, e, "Version: 0x%x\n", tr->version);
  1047. if(tr->in.sec != nil)
  1048. s = seprint(s, e, "EncIn: %s\nHashIn: %s\n", tr->in.sec->encalg, tr->in.sec->hashalg);
  1049. if(tr->in.new != nil)
  1050. s = seprint(s, e, "NewEncIn: %s\nNewHashIn: %s\n", tr->in.new->encalg, tr->in.new->hashalg);
  1051. if(tr->out.sec != nil)
  1052. s = seprint(s, e, "EncOut: %s\nHashOut: %s\n", tr->out.sec->encalg, tr->out.sec->hashalg);
  1053. if(tr->out.new != nil)
  1054. seprint(s, e, "NewEncOut: %s\nNewHashOut: %s\n", tr->out.new->encalg, tr->out.new->hashalg);
  1055. qunlock(&tr->in.seclock);
  1056. qunlock(&tr->out.seclock);
  1057. n = readstr(offset, a, n, buf);
  1058. free(buf);
  1059. return n;
  1060. case Qstats:
  1061. buf = smalloc(Statlen);
  1062. s = buf;
  1063. e = buf + Statlen;
  1064. s = seprint(s, e, "DataIn: %lld\n", tr->datain);
  1065. s = seprint(s, e, "DataOut: %lld\n", tr->dataout);
  1066. s = seprint(s, e, "HandIn: %lld\n", tr->handin);
  1067. seprint(s, e, "HandOut: %lld\n", tr->handout);
  1068. n = readstr(offset, a, n, buf);
  1069. free(buf);
  1070. return n;
  1071. case Qctl:
  1072. buf = smalloc(Statlen);
  1073. snprint(buf, Statlen, "%llud", CONV(c->qid));
  1074. n = readstr(offset, a, n, buf);
  1075. free(buf);
  1076. return n;
  1077. case Qdata:
  1078. case Qhand:
  1079. b = tlsbread(c, n, offset);
  1080. break;
  1081. case Qencalgs:
  1082. return readstr(offset, a, n, encalgs);
  1083. case Qhashalgs:
  1084. return readstr(offset, a, n, hashalgs);
  1085. }
  1086. if(waserror()){
  1087. freeblist(b);
  1088. nexterror();
  1089. }
  1090. n = 0;
  1091. va = a;
  1092. for(nb = b; nb; nb = nb->next){
  1093. i = BLEN(nb);
  1094. memmove(va+n, nb->rp, i);
  1095. n += i;
  1096. }
  1097. freeblist(b);
  1098. poperror();
  1099. return n;
  1100. }
  1101. /*
  1102. * write a block in tls records
  1103. */
  1104. static void
  1105. tlsrecwrite(TlsRec *tr, int type, Block *b)
  1106. {
  1107. Block *volatile bb;
  1108. Block *nb;
  1109. uchar *p, seq[8];
  1110. OneWay *volatile out;
  1111. int n, maclen, pad, ok;
  1112. out = &tr->out;
  1113. bb = b;
  1114. if(waserror()){
  1115. qunlock(&out->io);
  1116. if(bb != nil)
  1117. freeb(bb);
  1118. nexterror();
  1119. }
  1120. qlock(&out->io);
  1121. if(tr->debug)pprint("send %d\n", BLEN(b));
  1122. if(tr->debug)pdump(BLEN(b), b->rp, "sent:");
  1123. ok = SHandshake|SOpen|SRClose;
  1124. if(type == RAlert)
  1125. ok |= SAlert;
  1126. while(bb != nil){
  1127. checkstate(tr, type != RApplication, ok);
  1128. /*
  1129. * get at most one maximal record's input,
  1130. * with padding on the front for header and
  1131. * back for mac and maximal block padding.
  1132. */
  1133. if(waserror()){
  1134. qunlock(&out->seclock);
  1135. nexterror();
  1136. }
  1137. qlock(&out->seclock);
  1138. maclen = 0;
  1139. pad = 0;
  1140. if(out->sec != nil){
  1141. maclen = out->sec->maclen;
  1142. pad = maclen + out->sec->block;
  1143. }
  1144. n = BLEN(bb);
  1145. if(n > MaxRecLen){
  1146. n = MaxRecLen;
  1147. nb = allocb(n + pad + RecHdrLen);
  1148. memmove(nb->wp + RecHdrLen, bb->rp, n);
  1149. bb->rp += n;
  1150. }else{
  1151. /*
  1152. * carefully reuse bb so it will get freed if we're out of memory
  1153. */
  1154. bb = padblock(bb, RecHdrLen);
  1155. if(pad)
  1156. nb = padblock(bb, -pad);
  1157. else
  1158. nb = bb;
  1159. bb = nil;
  1160. }
  1161. p = nb->rp;
  1162. p[0] = type;
  1163. put16(p+1, tr->version);
  1164. put16(p+3, n);
  1165. if(out->sec != nil){
  1166. put64(seq, out->seq);
  1167. out->seq++;
  1168. (*tr->packMac)(out->sec, out->sec->mackey, seq, p, p + RecHdrLen, n, p + RecHdrLen + n);
  1169. n += maclen;
  1170. /* encrypt */
  1171. n = (*out->sec->enc)(out->sec, p + RecHdrLen, n);
  1172. nb->wp = p + RecHdrLen + n;
  1173. /* update length */
  1174. put16(p+3, n);
  1175. }
  1176. if(type == RChangeCipherSpec){
  1177. if(out->new == nil)
  1178. error("change cipher without a new cipher");
  1179. freeSec(out->sec);
  1180. out->sec = out->new;
  1181. out->new = nil;
  1182. out->seq = 0;
  1183. }
  1184. qunlock(&out->seclock);
  1185. poperror();
  1186. /*
  1187. * if bwrite error's, we assume the block is queued.
  1188. * if not, we're out of sync with the receiver and will not recover.
  1189. */
  1190. if(waserror()){
  1191. if(strcmp(up->errstr, "interrupted") != 0)
  1192. tlsError(tr, "channel error");
  1193. nexterror();
  1194. }
  1195. devtab[tr->c->type]->bwrite(tr->c, nb, 0);
  1196. poperror();
  1197. }
  1198. qunlock(&out->io);
  1199. poperror();
  1200. }
  1201. static long
  1202. tlsbwrite(Chan *c, Block *b, ulong offset)
  1203. {
  1204. int ty;
  1205. ulong n;
  1206. TlsRec *tr;
  1207. n = BLEN(b);
  1208. tr = tlsdevs[CONV(c->qid)];
  1209. if(tr == nil)
  1210. panic("tlsbread");
  1211. ty = TYPE(c->qid);
  1212. switch(ty) {
  1213. default:
  1214. return devbwrite(c, b, offset);
  1215. case Qhand:
  1216. tlsrecwrite(tr, RHandshake, b);
  1217. tr->handout += n;
  1218. break;
  1219. case Qdata:
  1220. checkstate(tr, 0, SOpen);
  1221. tlsrecwrite(tr, RApplication, b);
  1222. tr->dataout += n;
  1223. break;
  1224. }
  1225. return n;
  1226. }
  1227. typedef struct Hashalg Hashalg;
  1228. struct Hashalg
  1229. {
  1230. char *name;
  1231. int maclen;
  1232. void (*initkey)(Hashalg *, int, Secret *, uchar*);
  1233. };
  1234. static void
  1235. initmd5key(Hashalg *ha, int version, Secret *s, uchar *p)
  1236. {
  1237. s->maclen = ha->maclen;
  1238. if(version == SSL3Version)
  1239. s->mac = sslmac_md5;
  1240. else
  1241. s->mac = hmac_md5;
  1242. memmove(s->mackey, p, ha->maclen);
  1243. }
  1244. static void
  1245. initclearmac(Hashalg *, int, Secret *s, uchar *)
  1246. {
  1247. s->maclen = 0;
  1248. s->mac = nomac;
  1249. }
  1250. static void
  1251. initsha1key(Hashalg *ha, int version, Secret *s, uchar *p)
  1252. {
  1253. s->maclen = ha->maclen;
  1254. if(version == SSL3Version)
  1255. s->mac = sslmac_sha1;
  1256. else
  1257. s->mac = hmac_sha1;
  1258. memmove(s->mackey, p, ha->maclen);
  1259. }
  1260. static Hashalg hashtab[] =
  1261. {
  1262. { "clear", 0, initclearmac, },
  1263. { "md5", MD5dlen, initmd5key, },
  1264. { "sha1", SHA1dlen, initsha1key, },
  1265. { 0 }
  1266. };
  1267. static Hashalg*
  1268. parsehashalg(char *p)
  1269. {
  1270. Hashalg *ha;
  1271. for(ha = hashtab; ha->name; ha++)
  1272. if(strcmp(p, ha->name) == 0)
  1273. return ha;
  1274. error("unsupported hash algorithm");
  1275. return nil;
  1276. }
  1277. typedef struct Encalg Encalg;
  1278. struct Encalg
  1279. {
  1280. char *name;
  1281. int keylen;
  1282. int ivlen;
  1283. void (*initkey)(Encalg *ea, Secret *, uchar*, uchar*);
  1284. };
  1285. static void
  1286. initRC4key(Encalg *ea, Secret *s, uchar *p, uchar *)
  1287. {
  1288. s->enckey = smalloc(sizeof(RC4state));
  1289. s->enc = rc4enc;
  1290. s->dec = rc4enc;
  1291. s->block = 0;
  1292. setupRC4state(s->enckey, p, ea->keylen);
  1293. }
  1294. static void
  1295. initDES3key(Encalg *, Secret *s, uchar *p, uchar *iv)
  1296. {
  1297. s->enckey = smalloc(sizeof(DES3state));
  1298. s->enc = des3enc;
  1299. s->dec = des3dec;
  1300. s->block = 8;
  1301. setupDES3state(s->enckey, (uchar(*)[8])p, iv);
  1302. }
  1303. static void
  1304. initclearenc(Encalg *, Secret *s, uchar *, uchar *)
  1305. {
  1306. s->enc = noenc;
  1307. s->dec = noenc;
  1308. s->block = 0;
  1309. }
  1310. static Encalg encrypttab[] =
  1311. {
  1312. { "clear", 0, 0, initclearenc },
  1313. { "rc4_128", 128/8, 0, initRC4key },
  1314. { "3des_ede_cbc", 3 * 8, 8, initDES3key },
  1315. { 0 }
  1316. };
  1317. static Encalg*
  1318. parseencalg(char *p)
  1319. {
  1320. Encalg *ea;
  1321. for(ea = encrypttab; ea->name; ea++)
  1322. if(strcmp(p, ea->name) == 0)
  1323. return ea;
  1324. error("unsupported encryption algorithm");
  1325. return nil;
  1326. }
  1327. static long
  1328. tlswrite(Chan *c, void *a, long n, vlong off)
  1329. {
  1330. Encalg *ea;
  1331. Hashalg *ha;
  1332. TlsRec *volatile tr;
  1333. Secret *volatile tos, *volatile toc;
  1334. Block *volatile b;
  1335. Cmdbuf *volatile cb;
  1336. int m, ty;
  1337. char *p, *e;
  1338. uchar *volatile x;
  1339. ulong offset = off;
  1340. tr = tlsdevs[CONV(c->qid)];
  1341. if(tr == nil)
  1342. panic("tlswrite");
  1343. ty = TYPE(c->qid);
  1344. switch(ty){
  1345. case Qdata:
  1346. case Qhand:
  1347. p = a;
  1348. e = p + n;
  1349. do{
  1350. m = e - p;
  1351. if(m > MaxRecLen)
  1352. m = MaxRecLen;
  1353. b = allocb(m);
  1354. if(waserror()){
  1355. freeb(b);
  1356. nexterror();
  1357. }
  1358. memmove(b->wp, p, m);
  1359. poperror();
  1360. b->wp += m;
  1361. tlsbwrite(c, b, offset);
  1362. p += m;
  1363. }while(p < e);
  1364. return n;
  1365. case Qctl:
  1366. break;
  1367. default:
  1368. error(Ebadusefd);
  1369. return -1;
  1370. }
  1371. cb = parsecmd(a, n);
  1372. if(waserror()){
  1373. free(cb);
  1374. nexterror();
  1375. }
  1376. if(cb->nf < 1)
  1377. error("short control request");
  1378. /* mutex with operations using what we're about to change */
  1379. if(waserror()){
  1380. qunlock(&tr->in.seclock);
  1381. qunlock(&tr->out.seclock);
  1382. nexterror();
  1383. }
  1384. qlock(&tr->in.seclock);
  1385. qlock(&tr->out.seclock);
  1386. if(strcmp(cb->f[0], "fd") == 0){
  1387. if(cb->nf != 3)
  1388. error("usage: fd open-fd version");
  1389. if(tr->c != nil)
  1390. error(Einuse);
  1391. m = strtol(cb->f[2], nil, 0);
  1392. if(m < MinProtoVersion || m > MaxProtoVersion)
  1393. error("unsupported version");
  1394. tr->c = buftochan(cb->f[1]);
  1395. tr->version = m;
  1396. tlsSetState(tr, SHandshake, SClosed);
  1397. }else if(strcmp(cb->f[0], "version") == 0){
  1398. if(cb->nf != 2)
  1399. error("usage: version vers");
  1400. if(tr->c == nil)
  1401. error("must set fd before version");
  1402. if(tr->verset)
  1403. error("version already set");
  1404. m = strtol(cb->f[1], nil, 0);
  1405. if(m == SSL3Version)
  1406. tr->packMac = sslPackMac;
  1407. else if(m == TLSVersion)
  1408. tr->packMac = tlsPackMac;
  1409. else
  1410. error("unsupported version");
  1411. tr->verset = 1;
  1412. tr->version = m;
  1413. }else if(strcmp(cb->f[0], "secret") == 0){
  1414. if(cb->nf != 5)
  1415. error("usage: secret hashalg encalg isclient secretdata");
  1416. if(tr->c == nil || !tr->verset)
  1417. error("must set fd and version before secrets");
  1418. if(tr->in.new != nil){
  1419. freeSec(tr->in.new);
  1420. tr->in.new = nil;
  1421. }
  1422. if(tr->out.new != nil){
  1423. freeSec(tr->out.new);
  1424. tr->out.new = nil;
  1425. }
  1426. ha = parsehashalg(cb->f[1]);
  1427. ea = parseencalg(cb->f[2]);
  1428. p = cb->f[4];
  1429. m = (strlen(p)*3)/2;
  1430. x = smalloc(m);
  1431. tos = nil;
  1432. toc = nil;
  1433. if(waserror()){
  1434. freeSec(tos);
  1435. freeSec(toc);
  1436. free(x);
  1437. nexterror();
  1438. }
  1439. m = dec64(x, m, p, strlen(p));
  1440. if(m < 2 * ha->maclen + 2 * ea->keylen + 2 * ea->ivlen)
  1441. error("not enough secret data provided");
  1442. tos = smalloc(sizeof(Secret));
  1443. toc = smalloc(sizeof(Secret));
  1444. if(!ha->initkey || !ea->initkey)
  1445. error("misimplemented secret algorithm");
  1446. (*ha->initkey)(ha, tr->version, tos, &x[0]);
  1447. (*ha->initkey)(ha, tr->version, toc, &x[ha->maclen]);
  1448. (*ea->initkey)(ea, tos, &x[2 * ha->maclen], &x[2 * ha->maclen + 2 * ea->keylen]);
  1449. (*ea->initkey)(ea, toc, &x[2 * ha->maclen + ea->keylen], &x[2 * ha->maclen + 2 * ea->keylen + ea->ivlen]);
  1450. if(!tos->mac || !tos->enc || !tos->dec
  1451. || !toc->mac || !toc->enc || !toc->dec)
  1452. error("missing algorithm implementations");
  1453. if(strtol(cb->f[3], nil, 0) == 0){
  1454. tr->in.new = tos;
  1455. tr->out.new = toc;
  1456. }else{
  1457. tr->in.new = toc;
  1458. tr->out.new = tos;
  1459. }
  1460. if(tr->version == SSL3Version){
  1461. toc->unpad = sslunpad;
  1462. tos->unpad = sslunpad;
  1463. }else{
  1464. toc->unpad = tlsunpad;
  1465. tos->unpad = tlsunpad;
  1466. }
  1467. toc->encalg = ea->name;
  1468. toc->hashalg = ha->name;
  1469. tos->encalg = ea->name;
  1470. tos->hashalg = ha->name;
  1471. free(x);
  1472. poperror();
  1473. }else if(strcmp(cb->f[0], "changecipher") == 0){
  1474. if(cb->nf != 1)
  1475. error("usage: changecipher");
  1476. if(tr->out.new == nil)
  1477. error("cannot change cipher spec without setting secret");
  1478. qunlock(&tr->in.seclock);
  1479. qunlock(&tr->out.seclock);
  1480. poperror();
  1481. free(cb);
  1482. poperror();
  1483. /*
  1484. * the real work is done as the message is written
  1485. * so the stream is encrypted in sync.
  1486. */
  1487. b = allocb(1);
  1488. *b->wp++ = 1;
  1489. tlsrecwrite(tr, RChangeCipherSpec, b);
  1490. return n;
  1491. }else if(strcmp(cb->f[0], "opened") == 0){
  1492. if(cb->nf != 1)
  1493. error("usage: opened");
  1494. if(tr->in.sec == nil || tr->out.sec == nil)
  1495. error("cipher must be configured before enabling data messages");
  1496. lock(&tr->statelk);
  1497. if(tr->state != SHandshake && tr->state != SOpen){
  1498. unlock(&tr->statelk);
  1499. error("cannot enable data messages");
  1500. }
  1501. tr->state = SOpen;
  1502. unlock(&tr->statelk);
  1503. tr->opened = 1;
  1504. }else if(strcmp(cb->f[0], "alert") == 0){
  1505. if(cb->nf != 2)
  1506. error("usage: alert n");
  1507. if(tr->c == nil)
  1508. error("must set fd before sending alerts");
  1509. m = strtol(cb->f[1], nil, 0);
  1510. qunlock(&tr->in.seclock);
  1511. qunlock(&tr->out.seclock);
  1512. poperror();
  1513. free(cb);
  1514. poperror();
  1515. sendAlert(tr, m);
  1516. if(m == ECloseNotify)
  1517. tlsclosed(tr, SLClose);
  1518. return n;
  1519. } else if(strcmp(cb->f[0], "debug") == 0){
  1520. if(cb->nf == 2){
  1521. if(strcmp(cb->f[1], "on") == 0)
  1522. tr->debug = 1;
  1523. else
  1524. tr->debug = 0;
  1525. } else
  1526. tr->debug = 1;
  1527. } else
  1528. error(Ebadarg);
  1529. qunlock(&tr->in.seclock);
  1530. qunlock(&tr->out.seclock);
  1531. poperror();
  1532. free(cb);
  1533. poperror();
  1534. return n;
  1535. }
  1536. static void
  1537. tlsinit(void)
  1538. {
  1539. struct Encalg *e;
  1540. struct Hashalg *h;
  1541. int n;
  1542. char *cp;
  1543. static int already;
  1544. if(!already){
  1545. fmtinstall('H', encodefmt);
  1546. already = 1;
  1547. }
  1548. tlsdevs = smalloc(sizeof(TlsRec*) * maxtlsdevs);
  1549. trnames = smalloc((sizeof *trnames) * maxtlsdevs);
  1550. n = 1;
  1551. for(e = encrypttab; e->name != nil; e++)
  1552. n += strlen(e->name) + 1;
  1553. cp = encalgs = smalloc(n);
  1554. for(e = encrypttab;;){
  1555. strcpy(cp, e->name);
  1556. cp += strlen(e->name);
  1557. e++;
  1558. if(e->name == nil)
  1559. break;
  1560. *cp++ = ' ';
  1561. }
  1562. *cp = 0;
  1563. n = 1;
  1564. for(h = hashtab; h->name != nil; h++)
  1565. n += strlen(h->name) + 1;
  1566. cp = hashalgs = smalloc(n);
  1567. for(h = hashtab;;){
  1568. strcpy(cp, h->name);
  1569. cp += strlen(h->name);
  1570. h++;
  1571. if(h->name == nil)
  1572. break;
  1573. *cp++ = ' ';
  1574. }
  1575. *cp = 0;
  1576. }
  1577. Dev tlsdevtab = {
  1578. 'a',
  1579. "tls",
  1580. devreset,
  1581. tlsinit,
  1582. devshutdown,
  1583. tlsattach,
  1584. tlswalk,
  1585. tlsstat,
  1586. tlsopen,
  1587. devcreate,
  1588. tlsclose,
  1589. tlsread,
  1590. tlsbread,
  1591. tlswrite,
  1592. tlsbwrite,
  1593. devremove,
  1594. tlswstat,
  1595. };
  1596. /* get channel associated with an fd */
  1597. static Chan*
  1598. buftochan(char *p)
  1599. {
  1600. Chan *c;
  1601. int fd;
  1602. if(p == 0)
  1603. error(Ebadarg);
  1604. fd = strtoul(p, 0, 0);
  1605. if(fd < 0)
  1606. error(Ebadarg);
  1607. c = fdtochan(fd, -1, 0, 1); /* error check and inc ref */
  1608. return c;
  1609. }
  1610. static void
  1611. sendAlert(TlsRec *tr, int err)
  1612. {
  1613. Block *b;
  1614. int i, fatal;
  1615. char *msg;
  1616. if(tr->debug)pprint("sendAlert %d\n", err);
  1617. fatal = 1;
  1618. msg = "tls unknown alert";
  1619. for(i=0; i < nelem(tlserrs); i++) {
  1620. if(tlserrs[i].err == err) {
  1621. msg = tlserrs[i].msg;
  1622. if(tr->version == SSL3Version)
  1623. err = tlserrs[i].sslerr;
  1624. else
  1625. err = tlserrs[i].tlserr;
  1626. fatal = tlserrs[i].fatal;
  1627. break;
  1628. }
  1629. }
  1630. if(!waserror()){
  1631. b = allocb(2);
  1632. *b->wp++ = fatal + 1;
  1633. *b->wp++ = err;
  1634. if(fatal)
  1635. tlsSetState(tr, SAlert, SOpen|SHandshake|SRClose);
  1636. tlsrecwrite(tr, RAlert, b);
  1637. poperror();
  1638. }
  1639. if(fatal)
  1640. tlsError(tr, msg);
  1641. }
  1642. static void
  1643. tlsError(TlsRec *tr, char *msg)
  1644. {
  1645. int s;
  1646. if(tr->debug)pprint("tleError %s\n", msg);
  1647. lock(&tr->statelk);
  1648. s = tr->state;
  1649. tr->state = SError;
  1650. if(s != SError){
  1651. strncpy(tr->err, msg, ERRMAX - 1);
  1652. tr->err[ERRMAX - 1] = '\0';
  1653. }
  1654. unlock(&tr->statelk);
  1655. if(s != SError)
  1656. alertHand(tr, msg);
  1657. }
  1658. static void
  1659. tlsSetState(TlsRec *tr, int new, int old)
  1660. {
  1661. lock(&tr->statelk);
  1662. if(tr->state & old)
  1663. tr->state = new;
  1664. unlock(&tr->statelk);
  1665. }
  1666. /* hand up a digest connection */
  1667. static void
  1668. tlshangup(TlsRec *tr)
  1669. {
  1670. Block *b;
  1671. qlock(&tr->in.io);
  1672. for(b = tr->processed; b; b = tr->processed){
  1673. tr->processed = b->next;
  1674. freeb(b);
  1675. }
  1676. if(tr->unprocessed != nil){
  1677. freeb(tr->unprocessed);
  1678. tr->unprocessed = nil;
  1679. }
  1680. qunlock(&tr->in.io);
  1681. tlsSetState(tr, SClosed, ~0);
  1682. }
  1683. static TlsRec*
  1684. newtls(Chan *ch)
  1685. {
  1686. TlsRec **pp, **ep, **np;
  1687. char **nmp;
  1688. int t, newmax;
  1689. if(waserror()) {
  1690. unlock(&tdlock);
  1691. nexterror();
  1692. }
  1693. lock(&tdlock);
  1694. ep = &tlsdevs[maxtlsdevs];
  1695. for(pp = tlsdevs; pp < ep; pp++)
  1696. if(*pp == nil)
  1697. break;
  1698. if(pp >= ep) {
  1699. if(maxtlsdevs >= MaxTlsDevs) {
  1700. unlock(&tdlock);
  1701. poperror();
  1702. return nil;
  1703. }
  1704. newmax = 2 * maxtlsdevs;
  1705. if(newmax > MaxTlsDevs)
  1706. newmax = MaxTlsDevs;
  1707. np = smalloc(sizeof(TlsRec*) * newmax);
  1708. memmove(np, tlsdevs, sizeof(TlsRec*) * maxtlsdevs);
  1709. tlsdevs = np;
  1710. pp = &tlsdevs[maxtlsdevs];
  1711. memset(pp, 0, sizeof(TlsRec*)*(newmax - maxtlsdevs));
  1712. nmp = smalloc(sizeof *nmp * newmax);
  1713. memmove(nmp, trnames, sizeof *nmp * maxtlsdevs);
  1714. trnames = nmp;
  1715. maxtlsdevs = newmax;
  1716. }
  1717. *pp = mktlsrec();
  1718. if(pp - tlsdevs >= tdhiwat)
  1719. tdhiwat++;
  1720. t = TYPE(ch->qid);
  1721. if(t == Qclonus)
  1722. t = Qctl;
  1723. ch->qid.path = QID(pp - tlsdevs, t);
  1724. ch->qid.vers = 0;
  1725. unlock(&tdlock);
  1726. poperror();
  1727. return *pp;
  1728. }
  1729. static TlsRec *
  1730. mktlsrec(void)
  1731. {
  1732. TlsRec *tr;
  1733. tr = mallocz(sizeof(*tr), 1);
  1734. if(tr == nil)
  1735. error(Enomem);
  1736. tr->state = SClosed;
  1737. tr->ref = 1;
  1738. kstrdup(&tr->user, up->user);
  1739. tr->perm = 0660;
  1740. return tr;
  1741. }
  1742. static char*
  1743. tlsstate(int s)
  1744. {
  1745. switch(s){
  1746. case SHandshake:
  1747. return "Handshaking";
  1748. case SOpen:
  1749. return "Established";
  1750. case SRClose:
  1751. return "RemoteClosed";
  1752. case SLClose:
  1753. return "LocalClosed";
  1754. case SAlert:
  1755. return "Alerting";
  1756. case SError:
  1757. return "Errored";
  1758. case SClosed:
  1759. return "Closed";
  1760. }
  1761. return "Unknown";
  1762. }
  1763. static void
  1764. freeSec(Secret *s)
  1765. {
  1766. if(s != nil){
  1767. free(s->enckey);
  1768. free(s);
  1769. }
  1770. }
  1771. static int
  1772. noenc(Secret *, uchar *, int n)
  1773. {
  1774. return n;
  1775. }
  1776. static int
  1777. rc4enc(Secret *sec, uchar *buf, int n)
  1778. {
  1779. rc4(sec->enckey, buf, n);
  1780. return n;
  1781. }
  1782. static int
  1783. tlsunpad(uchar *buf, int n, int block)
  1784. {
  1785. int pad, nn;
  1786. pad = buf[n - 1];
  1787. nn = n - 1 - pad;
  1788. if(nn <= 0 || n % block)
  1789. return -1;
  1790. while(--n > nn)
  1791. if(pad != buf[n - 1])
  1792. return -1;
  1793. return nn;
  1794. }
  1795. static int
  1796. sslunpad(uchar *buf, int n, int block)
  1797. {
  1798. int pad, nn;
  1799. pad = buf[n - 1];
  1800. nn = n - 1 - pad;
  1801. if(nn <= 0 || n % block)
  1802. return -1;
  1803. return nn;
  1804. }
  1805. static int
  1806. blockpad(uchar *buf, int n, int block)
  1807. {
  1808. int pad, nn;
  1809. nn = n + block;
  1810. nn -= nn % block;
  1811. pad = nn - (n + 1);
  1812. while(n < nn)
  1813. buf[n++] = pad;
  1814. return nn;
  1815. }
  1816. static int
  1817. des3enc(Secret *sec, uchar *buf, int n)
  1818. {
  1819. n = blockpad(buf, n, 8);
  1820. des3CBCencrypt(buf, n, sec->enckey);
  1821. return n;
  1822. }
  1823. static int
  1824. des3dec(Secret *sec, uchar *buf, int n)
  1825. {
  1826. des3CBCdecrypt(buf, n, sec->enckey);
  1827. return (*sec->unpad)(buf, n, 8);
  1828. }
  1829. static DigestState*
  1830. nomac(uchar *, ulong, uchar *, ulong, uchar *, DigestState *)
  1831. {
  1832. return nil;
  1833. }
  1834. /*
  1835. * sslmac: mac calculations for ssl 3.0 only; tls 1.0 uses the standard hmac.
  1836. */
  1837. static DigestState*
  1838. sslmac_x(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s,
  1839. DigestState*(*x)(uchar*, ulong, uchar*, DigestState*), int xlen, int padlen)
  1840. {
  1841. int i;
  1842. uchar pad[48], innerdigest[20];
  1843. if(xlen > sizeof(innerdigest)
  1844. || padlen > sizeof(pad))
  1845. return nil;
  1846. if(klen>64)
  1847. return nil;
  1848. /* first time through */
  1849. if(s == nil){
  1850. for(i=0; i<padlen; i++)
  1851. pad[i] = 0x36;
  1852. s = (*x)(key, klen, nil, nil);
  1853. s = (*x)(pad, padlen, nil, s);
  1854. if(s == nil)
  1855. return nil;
  1856. }
  1857. s = (*x)(p, len, nil, s);
  1858. if(digest == nil)
  1859. return s;
  1860. /* last time through */
  1861. for(i=0; i<padlen; i++)
  1862. pad[i] = 0x5c;
  1863. (*x)(nil, 0, innerdigest, s);
  1864. s = (*x)(key, klen, nil, nil);
  1865. s = (*x)(pad, padlen, nil, s);
  1866. (*x)(innerdigest, xlen, digest, s);
  1867. return nil;
  1868. }
  1869. static DigestState*
  1870. sslmac_sha1(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s)
  1871. {
  1872. return sslmac_x(p, len, key, klen, digest, s, sha1, SHA1dlen, 40);
  1873. }
  1874. static DigestState*
  1875. sslmac_md5(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s)
  1876. {
  1877. return sslmac_x(p, len, key, klen, digest, s, md5, MD5dlen, 48);
  1878. }
  1879. static void
  1880. sslPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac)
  1881. {
  1882. DigestState *s;
  1883. uchar buf[11];
  1884. memmove(buf, seq, 8);
  1885. buf[8] = header[0];
  1886. buf[9] = header[3];
  1887. buf[10] = header[4];
  1888. s = (*sec->mac)(buf, 11, mackey, sec->maclen, 0, 0);
  1889. (*sec->mac)(body, len, mackey, sec->maclen, mac, s);
  1890. }
  1891. static void
  1892. tlsPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac)
  1893. {
  1894. DigestState *s;
  1895. uchar buf[13];
  1896. memmove(buf, seq, 8);
  1897. memmove(&buf[8], header, 5);
  1898. s = (*sec->mac)(buf, 13, mackey, sec->maclen, 0, 0);
  1899. (*sec->mac)(body, len, mackey, sec->maclen, mac, s);
  1900. }
  1901. static void
  1902. put32(uchar *p, u32int x)
  1903. {
  1904. p[0] = x>>24;
  1905. p[1] = x>>16;
  1906. p[2] = x>>8;
  1907. p[3] = x;
  1908. }
  1909. static void
  1910. put64(uchar *p, vlong x)
  1911. {
  1912. put32(p, (u32int)(x >> 32));
  1913. put32(p+4, (u32int)x);
  1914. }
  1915. static void
  1916. put24(uchar *p, int x)
  1917. {
  1918. p[0] = x>>16;
  1919. p[1] = x>>8;
  1920. p[2] = x;
  1921. }
  1922. static void
  1923. put16(uchar *p, int x)
  1924. {
  1925. p[0] = x>>8;
  1926. p[1] = x;
  1927. }
  1928. static u32int
  1929. get32(uchar *p)
  1930. {
  1931. return (p[0]<<24)|(p[1]<<16)|(p[2]<<8)|p[3];
  1932. }
  1933. static int
  1934. get16(uchar *p)
  1935. {
  1936. return (p[0]<<8)|p[1];
  1937. }
  1938. static char *charmap = "0123456789abcdef";
  1939. static void
  1940. pdump(int len, void *a, char *tag)
  1941. {
  1942. uchar *p;
  1943. int i;
  1944. char buf[65+32];
  1945. char *q;
  1946. p = a;
  1947. strcpy(buf, tag);
  1948. while(len > 0){
  1949. q = buf + strlen(tag);
  1950. for(i = 0; len > 0 && i < 32; i++){
  1951. if(*p >= ' ' && *p < 0x7f){
  1952. *q++ = ' ';
  1953. *q++ = *p;
  1954. } else {
  1955. *q++ = charmap[*p>>4];
  1956. *q++ = charmap[*p & 0xf];
  1957. }
  1958. len--;
  1959. p++;
  1960. }
  1961. *q = 0;
  1962. if(len > 0)
  1963. pprint("%s...\n", buf);
  1964. else
  1965. pprint("%s\n", buf);
  1966. }
  1967. }