aboutsummaryrefslogtreecommitdiff
path: root/src/daemon/https/tls/gnutls_constate.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/daemon/https/tls/gnutls_constate.c')
-rw-r--r--src/daemon/https/tls/gnutls_constate.c170
1 files changed, 86 insertions, 84 deletions
diff --git a/src/daemon/https/tls/gnutls_constate.c b/src/daemon/https/tls/gnutls_constate.c
index 41aff98c..11c8beca 100644
--- a/src/daemon/https/tls/gnutls_constate.c
+++ b/src/daemon/https/tls/gnutls_constate.c
@@ -57,7 +57,7 @@ static const int servwrite_length = sizeof (servwrite) - 1;
57 */ 57 */
58int 58int
59MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size, 59MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
60 int key_size, int export_flag) 60 int key_size, int export_flag)
61{ 61{
62 62
63/* FIXME: This function is too long 63/* FIXME: This function is too long
@@ -107,8 +107,9 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
107 else 107 else
108 { /* TLS 1.0 */ 108 { /* TLS 1.0 */
109 ret = 109 ret =
110 MHD_gtls_PRF (session, (const unsigned char*) session->security_parameters.master_secret, 110 MHD_gtls_PRF (session,
111 TLS_MASTER_SIZE, keyexp, keyexp_length, 111 (const unsigned char *) session->security_parameters.
112 master_secret, TLS_MASTER_SIZE, keyexp, keyexp_length,
112 rnd, 2 * TLS_RANDOM_SIZE, block_size, key_block); 113 rnd, 2 * TLS_RANDOM_SIZE, block_size, key_block);
113 } 114 }
114 115
@@ -120,8 +121,8 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
120 } 121 }
121 122
122 MHD__gnutls_hard_log ("INT: KEY BLOCK[%d]: %s\n", block_size, 123 MHD__gnutls_hard_log ("INT: KEY BLOCK[%d]: %s\n", block_size,
123 MHD_gtls_bin2hex (key_block, block_size, buf, 124 MHD_gtls_bin2hex (key_block, block_size, buf,
124 sizeof (buf))); 125 sizeof (buf)));
125 126
126 pos = 0; 127 pos = 0;
127 if (hash_size > 0) 128 if (hash_size > 0)
@@ -187,7 +188,8 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
187 188
188 /* generate the final keys */ 189 /* generate the final keys */
189 190
190 if (session->security_parameters.version == MHD_GNUTLS_PROTOCOL_SSL3) 191 if (session->security_parameters.version ==
192 MHD_GNUTLS_PROTOCOL_SSL3)
191 { /* SSL 3 */ 193 { /* SSL 3 */
192 ret = 194 ret =
193 MHD_gnutls_ssl3_hash_md5 (&key_block[pos], 195 MHD_gnutls_ssl3_hash_md5 (&key_block[pos],
@@ -219,7 +221,8 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
219 client_write_key_size = EXPORT_FINAL_KEY_SIZE; 221 client_write_key_size = EXPORT_FINAL_KEY_SIZE;
220 pos += key_size; 222 pos += key_size;
221 223
222 if (session->security_parameters.version == MHD_GNUTLS_PROTOCOL_SSL3) 224 if (session->security_parameters.version ==
225 MHD_GNUTLS_PROTOCOL_SSL3)
223 { /* SSL 3 */ 226 { /* SSL 3 */
224 ret = 227 ret =
225 MHD_gnutls_ssl3_hash_md5 (&key_block[pos], key_size, 228 MHD_gnutls_ssl3_hash_md5 (&key_block[pos], key_size,
@@ -259,10 +262,10 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
259 return GNUTLS_E_MEMORY_ERROR; 262 return GNUTLS_E_MEMORY_ERROR;
260 } 263 }
261 MHD__gnutls_hard_log ("INT: CLIENT WRITE KEY [%d]: %s\n", 264 MHD__gnutls_hard_log ("INT: CLIENT WRITE KEY [%d]: %s\n",
262 client_write_key_size, 265 client_write_key_size,
263 MHD_gtls_bin2hex (client_write_key, 266 MHD_gtls_bin2hex (client_write_key,
264 client_write_key_size, buf, 267 client_write_key_size, buf,
265 sizeof (buf))); 268 sizeof (buf)));
266 269
267 if (MHD__gnutls_sset_datum 270 if (MHD__gnutls_sset_datum
268 (&session->cipher_specs.server_write_key, 271 (&session->cipher_specs.server_write_key,
@@ -275,10 +278,10 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
275 } 278 }
276 279
277 MHD__gnutls_hard_log ("INT: SERVER WRITE KEY [%d]: %s\n", 280 MHD__gnutls_hard_log ("INT: SERVER WRITE KEY [%d]: %s\n",
278 server_write_key_size, 281 server_write_key_size,
279 MHD_gtls_bin2hex (server_write_key, 282 MHD_gtls_bin2hex (server_write_key,
280 server_write_key_size, buf, 283 server_write_key_size, buf,
281 sizeof (buf))); 284 sizeof (buf)));
282 285
283 if (free_keys != 0) 286 if (free_keys != 0)
284 { 287 {
@@ -342,7 +345,7 @@ MHD__gnutls_set_keys (MHD_gtls_session_t session, int hash_size, int IV_size,
342 } 345 }
343 else 346 else
344 { /* TLS 1.0 */ 347 { /* TLS 1.0 */
345 ret = MHD_gtls_PRF (session, (const unsigned char*) "", 0, 348 ret = MHD_gtls_PRF (session, (const unsigned char *) "", 0,
346 ivblock, ivblock_length, rrnd, 349 ivblock, ivblock_length, rrnd,
347 2 * TLS_RANDOM_SIZE, IV_size * 2, iv_block); 350 2 * TLS_RANDOM_SIZE, IV_size * 2, iv_block);
348 } 351 }
@@ -400,7 +403,7 @@ MHD__gnutls_set_read_keys (MHD_gtls_session_t session)
400 export_flag = MHD_gtls_cipher_get_export_flag (algo); 403 export_flag = MHD_gtls_cipher_get_export_flag (algo);
401 404
402 return MHD__gnutls_set_keys (session, hash_size, IV_size, key_size, 405 return MHD__gnutls_set_keys (session, hash_size, IV_size, key_size,
403 export_flag); 406 export_flag);
404} 407}
405 408
406int 409int
@@ -421,7 +424,7 @@ MHD__gnutls_set_write_keys (MHD_gtls_session_t session)
421 export_flag = MHD_gtls_cipher_get_export_flag (algo); 424 export_flag = MHD_gtls_cipher_get_export_flag (algo);
422 425
423 return MHD__gnutls_set_keys (session, hash_size, IV_size, key_size, 426 return MHD__gnutls_set_keys (session, hash_size, IV_size, key_size,
424 export_flag); 427 export_flag);
425} 428}
426 429
427#define CPY_COMMON dst->entity = src->entity; \ 430#define CPY_COMMON dst->entity = src->entity; \
@@ -442,7 +445,8 @@ MHD__gnutls_set_write_keys (MHD_gtls_session_t session)
442 445
443static void 446static void
444MHD__gnutls_cpy_read_security_parameters (MHD_gtls_security_param_st * 447MHD__gnutls_cpy_read_security_parameters (MHD_gtls_security_param_st *
445 dst, MHD_gtls_security_param_st * src) 448 dst,
449 MHD_gtls_security_param_st * src)
446{ 450{
447 CPY_COMMON; 451 CPY_COMMON;
448 452
@@ -453,7 +457,8 @@ MHD__gnutls_cpy_read_security_parameters (MHD_gtls_security_param_st *
453 457
454static void 458static void
455MHD__gnutls_cpy_write_security_parameters (MHD_gtls_security_param_st * 459MHD__gnutls_cpy_write_security_parameters (MHD_gtls_security_param_st *
456 dst, MHD_gtls_security_param_st * src) 460 dst,
461 MHD_gtls_security_param_st * src)
457{ 462{
458 CPY_COMMON; 463 CPY_COMMON;
459 464
@@ -504,35 +509,35 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
504 { 509 {
505 rc = MHD_gtls_set_read_cipher (session, 510 rc = MHD_gtls_set_read_cipher (session,
506 MHD_gtls_cipher_suite_get_cipher_algo 511 MHD_gtls_cipher_suite_get_cipher_algo
507 (&session->security_parameters. 512 (&session->
508 current_cipher_suite)); 513 security_parameters.current_cipher_suite));
509 if (rc < 0) 514 if (rc < 0)
510 return rc; 515 return rc;
511 rc = MHD_gtls_set_read_mac (session, 516 rc = MHD_gtls_set_read_mac (session,
512 MHD_gtls_cipher_suite_get_mac_algo 517 MHD_gtls_cipher_suite_get_mac_algo
513 (&session->security_parameters. 518 (&session->
514 current_cipher_suite)); 519 security_parameters.current_cipher_suite));
515 if (rc < 0) 520 if (rc < 0)
516 return rc; 521 return rc;
517 522
518 rc = MHD_gtls_set_kx (session, 523 rc = MHD_gtls_set_kx (session,
519 MHD_gtls_cipher_suite_get_kx_algo 524 MHD_gtls_cipher_suite_get_kx_algo
520 (&session->security_parameters. 525 (&session->
521 current_cipher_suite)); 526 security_parameters.current_cipher_suite));
522 if (rc < 0) 527 if (rc < 0)
523 return rc; 528 return rc;
524 529
525 rc = MHD_gtls_set_read_compression (session, 530 rc = MHD_gtls_set_read_compression (session,
526 session->internals. 531 session->
527 compression_method); 532 internals.compression_method);
528 if (rc < 0) 533 if (rc < 0)
529 return rc; 534 return rc;
530 } 535 }
531 else 536 else
532 { /* RESUME_TRUE */ 537 { /* RESUME_TRUE */
533 MHD__gnutls_cpy_read_security_parameters (&session->security_parameters, 538 MHD__gnutls_cpy_read_security_parameters (&session->security_parameters,
534 &session->internals. 539 &session->
535 resumed_security_parameters); 540 internals.resumed_security_parameters);
536 } 541 }
537 542
538 543
@@ -541,10 +546,10 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
541 return rc; 546 return rc;
542 547
543 MHD__gnutls_handshake_log ("HSK[%x]: Cipher Suite: %s\n", 548 MHD__gnutls_handshake_log ("HSK[%x]: Cipher Suite: %s\n",
544 session, 549 session,
545 MHD_gtls_cipher_suite_get_name 550 MHD_gtls_cipher_suite_get_name
546 (&session->security_parameters. 551 (&session->
547 current_cipher_suite)); 552 security_parameters.current_cipher_suite));
548 553
549 if (MHD_gtls_compression_is_ok 554 if (MHD_gtls_compression_is_ok
550 (session->security_parameters.read_compression_algorithm) != 0) 555 (session->security_parameters.read_compression_algorithm) != 0)
@@ -574,8 +579,8 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
574 579
575 580
576 mac_size = 581 mac_size =
577 MHD_gnutls_hash_get_algo_len (session->security_parameters. 582 MHD_gnutls_hash_get_algo_len (session->
578 read_mac_algorithm); 583 security_parameters.read_mac_algorithm);
579 584
580 MHD__gnutls_handshake_log 585 MHD__gnutls_handshake_log
581 ("HSK[%x]: Initializing internal [read] cipher sessions\n", session); 586 ("HSK[%x]: Initializing internal [read] cipher sessions\n", session);
@@ -586,8 +591,8 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
586 /* initialize cipher session 591 /* initialize cipher session
587 */ 592 */
588 session->connection_state.read_cipher_state = 593 session->connection_state.read_cipher_state =
589 MHD_gtls_cipher_init (session->security_parameters. 594 MHD_gtls_cipher_init (session->
590 read_bulk_cipher_algorithm, 595 security_parameters.read_bulk_cipher_algorithm,
591 &session->cipher_specs.client_write_key, 596 &session->cipher_specs.client_write_key,
592 &session->cipher_specs.client_write_IV); 597 &session->cipher_specs.client_write_IV);
593 if (session->connection_state.read_cipher_state == GNUTLS_CIPHER_FAILED 598 if (session->connection_state.read_cipher_state == GNUTLS_CIPHER_FAILED
@@ -603,11 +608,10 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
603 */ 608 */
604 if (mac_size > 0) 609 if (mac_size > 0)
605 { 610 {
606 if (MHD__gnutls_sset_datum (&session->connection_state.read_mac_secret, 611 if (MHD__gnutls_sset_datum
607 session->cipher_specs. 612 (&session->connection_state.read_mac_secret,
608 client_write_mac_secret.data, 613 session->cipher_specs.client_write_mac_secret.data,
609 session->cipher_specs. 614 session->cipher_specs.client_write_mac_secret.size) < 0)
610 client_write_mac_secret.size) < 0)
611 { 615 {
612 MHD_gnutls_assert (); 616 MHD_gnutls_assert ();
613 return GNUTLS_E_MEMORY_ERROR; 617 return GNUTLS_E_MEMORY_ERROR;
@@ -619,8 +623,8 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
619#if MHD_DEBUG_TLS 623#if MHD_DEBUG_TLS
620 case GNUTLS_CLIENT: 624 case GNUTLS_CLIENT:
621 session->connection_state.read_cipher_state = 625 session->connection_state.read_cipher_state =
622 MHD_gtls_cipher_init (session->security_parameters. 626 MHD_gtls_cipher_init (session->
623 read_bulk_cipher_algorithm, 627 security_parameters.read_bulk_cipher_algorithm,
624 &session->cipher_specs.server_write_key, 628 &session->cipher_specs.server_write_key,
625 &session->cipher_specs.server_write_IV); 629 &session->cipher_specs.server_write_IV);
626 630
@@ -638,11 +642,10 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
638 */ 642 */
639 if (mac_size > 0) 643 if (mac_size > 0)
640 { 644 {
641 if (MHD__gnutls_sset_datum (&session->connection_state.read_mac_secret, 645 if (MHD__gnutls_sset_datum
642 session->cipher_specs. 646 (&session->connection_state.read_mac_secret,
643 server_write_mac_secret.data, 647 session->cipher_specs.server_write_mac_secret.data,
644 session->cipher_specs. 648 session->cipher_specs.server_write_mac_secret.size) < 0)
645 server_write_mac_secret.size) < 0)
646 { 649 {
647 MHD_gnutls_assert (); 650 MHD_gnutls_assert ();
648 return GNUTLS_E_MEMORY_ERROR; 651 return GNUTLS_E_MEMORY_ERROR;
@@ -657,8 +660,8 @@ MHD_gtls_read_connection_state_init (MHD_gtls_session_t session)
657 } 660 }
658 661
659 session->connection_state.read_compression_state = 662 session->connection_state.read_compression_state =
660 MHD_gtls_comp_init (session->security_parameters. 663 MHD_gtls_comp_init (session->
661 read_compression_algorithm, 1); 664 security_parameters.read_compression_algorithm, 1);
662 665
663 if (session->connection_state.read_compression_state == GNUTLS_COMP_FAILED) 666 if (session->connection_state.read_compression_state == GNUTLS_COMP_FAILED)
664 { 667 {
@@ -689,35 +692,36 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
689 { 692 {
690 rc = MHD_gtls_set_write_cipher (session, 693 rc = MHD_gtls_set_write_cipher (session,
691 MHD_gtls_cipher_suite_get_cipher_algo 694 MHD_gtls_cipher_suite_get_cipher_algo
692 (&session->security_parameters. 695 (&session->
693 current_cipher_suite)); 696 security_parameters.current_cipher_suite));
694 if (rc < 0) 697 if (rc < 0)
695 return rc; 698 return rc;
696 rc = MHD_gtls_set_write_mac (session, 699 rc = MHD_gtls_set_write_mac (session,
697 MHD_gtls_cipher_suite_get_mac_algo 700 MHD_gtls_cipher_suite_get_mac_algo
698 (&session->security_parameters. 701 (&session->
699 current_cipher_suite)); 702 security_parameters.current_cipher_suite));
700 if (rc < 0) 703 if (rc < 0)
701 return rc; 704 return rc;
702 705
703 rc = MHD_gtls_set_kx (session, 706 rc = MHD_gtls_set_kx (session,
704 MHD_gtls_cipher_suite_get_kx_algo 707 MHD_gtls_cipher_suite_get_kx_algo
705 (&session->security_parameters. 708 (&session->
706 current_cipher_suite)); 709 security_parameters.current_cipher_suite));
707 if (rc < 0) 710 if (rc < 0)
708 return rc; 711 return rc;
709 712
710 rc = MHD_gtls_set_write_compression (session, 713 rc = MHD_gtls_set_write_compression (session,
711 session->internals. 714 session->
712 compression_method); 715 internals.compression_method);
713 if (rc < 0) 716 if (rc < 0)
714 return rc; 717 return rc;
715 } 718 }
716 else 719 else
717 { /* RESUME_TRUE */ 720 { /* RESUME_TRUE */
718 MHD__gnutls_cpy_write_security_parameters (&session->security_parameters, 721 MHD__gnutls_cpy_write_security_parameters (&session->
719 &session->internals. 722 security_parameters,
720 resumed_security_parameters); 723 &session->
724 internals.resumed_security_parameters);
721 } 725 }
722 726
723 rc = MHD__gnutls_set_write_keys (session); 727 rc = MHD__gnutls_set_write_keys (session);
@@ -725,9 +729,9 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
725 return rc; 729 return rc;
726 730
727 MHD__gnutls_handshake_log ("HSK[%x]: Cipher Suite: %s\n", session, 731 MHD__gnutls_handshake_log ("HSK[%x]: Cipher Suite: %s\n", session,
728 MHD_gtls_cipher_suite_get_name 732 MHD_gtls_cipher_suite_get_name
729 (&session->security_parameters. 733 (&session->
730 current_cipher_suite)); 734 security_parameters.current_cipher_suite));
731 735
732 if (MHD_gtls_compression_is_ok 736 if (MHD_gtls_compression_is_ok
733 (session->security_parameters.write_compression_algorithm) != 0) 737 (session->security_parameters.write_compression_algorithm) != 0)
@@ -758,8 +762,8 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
758 0); 762 0);
759 763
760 mac_size = 764 mac_size =
761 MHD_gnutls_hash_get_algo_len (session->security_parameters. 765 MHD_gnutls_hash_get_algo_len (session->
762 write_mac_algorithm); 766 security_parameters.write_mac_algorithm);
763 767
764 MHD__gnutls_handshake_log 768 MHD__gnutls_handshake_log
765 ("HSK[%x]: Initializing internal [write] cipher sessions\n", session); 769 ("HSK[%x]: Initializing internal [write] cipher sessions\n", session);
@@ -770,8 +774,8 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
770 /* initialize cipher session 774 /* initialize cipher session
771 */ 775 */
772 session->connection_state.write_cipher_state = 776 session->connection_state.write_cipher_state =
773 MHD_gtls_cipher_init (session->security_parameters. 777 MHD_gtls_cipher_init (session->
774 write_bulk_cipher_algorithm, 778 security_parameters.write_bulk_cipher_algorithm,
775 &session->cipher_specs.server_write_key, 779 &session->cipher_specs.server_write_key,
776 &session->cipher_specs.server_write_IV); 780 &session->cipher_specs.server_write_IV);
777 781
@@ -790,11 +794,10 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
790 */ 794 */
791 if (mac_size > 0) 795 if (mac_size > 0)
792 { 796 {
793 if (MHD__gnutls_sset_datum (&session->connection_state.write_mac_secret, 797 if (MHD__gnutls_sset_datum
794 session->cipher_specs. 798 (&session->connection_state.write_mac_secret,
795 server_write_mac_secret.data, 799 session->cipher_specs.server_write_mac_secret.data,
796 session->cipher_specs. 800 session->cipher_specs.server_write_mac_secret.size) < 0)
797 server_write_mac_secret.size) < 0)
798 { 801 {
799 MHD_gnutls_assert (); 802 MHD_gnutls_assert ();
800 return GNUTLS_E_MEMORY_ERROR; 803 return GNUTLS_E_MEMORY_ERROR;
@@ -807,8 +810,8 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
807#if MHD_DEBUG_TLS 810#if MHD_DEBUG_TLS
808 case GNUTLS_CLIENT: 811 case GNUTLS_CLIENT:
809 session->connection_state.write_cipher_state = 812 session->connection_state.write_cipher_state =
810 MHD_gtls_cipher_init (session->security_parameters. 813 MHD_gtls_cipher_init (session->
811 write_bulk_cipher_algorithm, 814 security_parameters.write_bulk_cipher_algorithm,
812 &session->cipher_specs.client_write_key, 815 &session->cipher_specs.client_write_key,
813 &session->cipher_specs.client_write_IV); 816 &session->cipher_specs.client_write_IV);
814 817
@@ -825,11 +828,10 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
825 */ 828 */
826 if (mac_size > 0) 829 if (mac_size > 0)
827 { 830 {
828 if (MHD__gnutls_sset_datum (&session->connection_state.write_mac_secret, 831 if (MHD__gnutls_sset_datum
829 session->cipher_specs. 832 (&session->connection_state.write_mac_secret,
830 client_write_mac_secret.data, 833 session->cipher_specs.client_write_mac_secret.data,
831 session->cipher_specs. 834 session->cipher_specs.client_write_mac_secret.size) < 0)
832 client_write_mac_secret.size) < 0)
833 { 835 {
834 MHD_gnutls_assert (); 836 MHD_gnutls_assert ();
835 return GNUTLS_E_MEMORY_ERROR; 837 return GNUTLS_E_MEMORY_ERROR;
@@ -845,8 +847,8 @@ MHD_gtls_write_connection_state_init (MHD_gtls_session_t session)
845 847
846 848
847 session->connection_state.write_compression_state = 849 session->connection_state.write_compression_state =
848 MHD_gtls_comp_init (session->security_parameters. 850 MHD_gtls_comp_init (session->
849 write_compression_algorithm, 0); 851 security_parameters.write_compression_algorithm, 0);
850 852
851 if (session->connection_state.write_compression_state == GNUTLS_COMP_FAILED) 853 if (session->connection_state.write_compression_state == GNUTLS_COMP_FAILED)
852 { 854 {
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-15 17:28:26 +0000