|
Packit Service |
4684c1 |
/*
|
|
Packit Service |
4684c1 |
* Copyright (C) 2001-2012 Free Software Foundation, Inc.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Author: Nikos Mavrogiannopoulos
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This file is part of GnuTLS.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* The GnuTLS is free software; you can redistribute it and/or
|
|
Packit Service |
4684c1 |
* modify it under the terms of the GNU Lesser General Public License
|
|
Packit Service |
4684c1 |
* as published by the Free Software Foundation; either version 2.1 of
|
|
Packit Service |
4684c1 |
* the License, or (at your option) any later version.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This library is distributed in the hope that it will be useful, but
|
|
Packit Service |
4684c1 |
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit Service |
4684c1 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit Service |
4684c1 |
* Lesser General Public License for more details.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* You should have received a copy of the GNU Lesser General Public License
|
|
Packit Service |
4684c1 |
* along with this program. If not, see <https://www.gnu.org/licenses/>
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include "gnutls_int.h"
|
|
Packit Service |
4684c1 |
#include <ext/srp.h>
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#ifdef ENABLE_SRP
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include "auth.h"
|
|
Packit Service |
4684c1 |
#include <auth/srp_kx.h>
|
|
Packit Service |
4684c1 |
#include "errors.h"
|
|
Packit Service |
4684c1 |
#include "algorithms.h"
|
|
Packit Service |
4684c1 |
#include <num.h>
|
|
Packit Service |
4684c1 |
#include <hello_ext.h>
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int _gnutls_srp_unpack(gnutls_buffer_st * ps,
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t * _priv);
|
|
Packit Service |
4684c1 |
static int _gnutls_srp_pack(gnutls_ext_priv_data_t epriv,
|
|
Packit Service |
4684c1 |
gnutls_buffer_st * ps);
|
|
Packit Service |
4684c1 |
static void _gnutls_srp_deinit_data(gnutls_ext_priv_data_t epriv);
|
|
Packit Service |
4684c1 |
static int _gnutls_srp_recv_params(gnutls_session_t state,
|
|
Packit Service |
4684c1 |
const uint8_t * data, size_t data_size);
|
|
Packit Service |
4684c1 |
static int _gnutls_srp_send_params(gnutls_session_t state,
|
|
Packit Service |
4684c1 |
gnutls_buffer_st * extdata);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
const hello_ext_entry_st ext_mod_srp = {
|
|
Packit Service |
4684c1 |
.name = "SRP",
|
|
Packit Service |
4684c1 |
.tls_id = 12,
|
|
Packit Service |
4684c1 |
.gid = GNUTLS_EXTENSION_SRP,
|
|
Packit Service |
4684c1 |
.client_parse_point = GNUTLS_EXT_TLS,
|
|
Packit Service |
4684c1 |
.server_parse_point = GNUTLS_EXT_TLS,
|
|
Packit Service |
4684c1 |
.validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS | GNUTLS_EXT_FLAG_CLIENT_HELLO,
|
|
Packit Service |
4684c1 |
.recv_func = _gnutls_srp_recv_params,
|
|
Packit Service |
4684c1 |
.send_func = _gnutls_srp_send_params,
|
|
Packit Service |
4684c1 |
.pack_func = _gnutls_srp_pack,
|
|
Packit Service |
4684c1 |
.unpack_func = _gnutls_srp_unpack,
|
|
Packit Service |
4684c1 |
.deinit_func = _gnutls_srp_deinit_data,
|
|
Packit Service |
4684c1 |
.cannot_be_overriden = 1
|
|
Packit Service |
4684c1 |
};
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int
|
|
Packit Service |
4684c1 |
_gnutls_srp_recv_params(gnutls_session_t session, const uint8_t * data,
|
|
Packit Service |
4684c1 |
size_t data_size)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
uint8_t len;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
srp_ext_st *priv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (session->security_parameters.entity == GNUTLS_SERVER) {
|
|
Packit Service |
4684c1 |
if (data_size > 0) {
|
|
Packit Service |
4684c1 |
DECR_LEN(data_size, 1);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
len = data[0];
|
|
Packit Service |
4684c1 |
DECR_LEN(data_size, len);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (MAX_USERNAME_SIZE < len) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
return GNUTLS_E_ILLEGAL_SRP_USERNAME;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv = gnutls_calloc(1, sizeof(*priv));
|
|
Packit Service |
4684c1 |
if (priv == NULL) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
return GNUTLS_E_MEMORY_ERROR;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv->username = gnutls_malloc(len + 1);
|
|
Packit Service |
4684c1 |
if (priv->username) {
|
|
Packit Service |
4684c1 |
memcpy(priv->username, &data[1], len);
|
|
Packit Service |
4684c1 |
/* null terminated */
|
|
Packit Service |
4684c1 |
priv->username[len] = 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
epriv = priv;
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_set_priv(session,
|
|
Packit Service |
4684c1 |
GNUTLS_EXTENSION_SRP,
|
|
Packit Service |
4684c1 |
epriv);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static unsigned have_srp_ciphersuites(gnutls_session_t session)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
unsigned j;
|
|
Packit Service |
4684c1 |
unsigned kx;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (j = 0; j < session->internals.priorities->cs.size; j++) {
|
|
Packit Service |
4684c1 |
kx = session->internals.priorities->cs.entry[j]->kx_algorithm;
|
|
Packit Service |
4684c1 |
if (kx == GNUTLS_KX_SRP || kx == GNUTLS_KX_SRP_RSA || kx == GNUTLS_KX_SRP_DSS)
|
|
Packit Service |
4684c1 |
return 1;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/* returns data_size or a negative number on failure
|
|
Packit Service |
4684c1 |
* data is allocated locally
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
static int
|
|
Packit Service |
4684c1 |
_gnutls_srp_send_params(gnutls_session_t session,
|
|
Packit Service |
4684c1 |
gnutls_buffer_st * extdata)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
unsigned len;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
srp_ext_st *priv = NULL;
|
|
Packit Service |
4684c1 |
char *username = NULL, *password = NULL;
|
|
Packit Service |
4684c1 |
gnutls_srp_client_credentials_t cred =
|
|
Packit Service |
4684c1 |
(gnutls_srp_client_credentials_t)
|
|
Packit Service |
4684c1 |
_gnutls_get_cred(session, GNUTLS_CRD_SRP);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (session->security_parameters.entity != GNUTLS_CLIENT)
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (cred == NULL)
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (!have_srp_ciphersuites(session)) {
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/* this function sends the client extension data (username) */
|
|
Packit Service |
4684c1 |
priv = gnutls_calloc(1, sizeof(*priv));
|
|
Packit Service |
4684c1 |
if (priv == NULL)
|
|
Packit Service |
4684c1 |
return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (cred->username != NULL) { /* send username */
|
|
Packit Service |
4684c1 |
len = MIN(strlen(cred->username), 255);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_buffer_append_data_prefix(extdata, 8,
|
|
Packit Service |
4684c1 |
cred->
|
|
Packit Service |
4684c1 |
username,
|
|
Packit Service |
4684c1 |
len);
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
goto cleanup;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv->username = gnutls_strdup(cred->username);
|
|
Packit Service |
4684c1 |
if (priv->username == NULL) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
goto cleanup;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv->password = gnutls_strdup(cred->password);
|
|
Packit Service |
4684c1 |
if (priv->password == NULL) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
goto cleanup;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
epriv = priv;
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_set_priv(session,
|
|
Packit Service |
4684c1 |
GNUTLS_EXTENSION_SRP,
|
|
Packit Service |
4684c1 |
epriv);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return len + 1;
|
|
Packit Service |
4684c1 |
} else if (cred->get_function != NULL) {
|
|
Packit Service |
4684c1 |
/* Try the callback
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (cred->
|
|
Packit Service |
4684c1 |
get_function(session, &username, &password) < 0
|
|
Packit Service |
4684c1 |
|| username == NULL || password == NULL) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
return GNUTLS_E_ILLEGAL_SRP_USERNAME;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
len = MIN(strlen(username), 255);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv->username = username;
|
|
Packit Service |
4684c1 |
priv->password = password;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret =
|
|
Packit Service |
4684c1 |
_gnutls_buffer_append_data_prefix(extdata, 8,
|
|
Packit Service |
4684c1 |
username,
|
|
Packit Service |
4684c1 |
len);
|
|
Packit Service |
4684c1 |
if (ret < 0) {
|
|
Packit Service |
4684c1 |
ret = gnutls_assert_val(ret);
|
|
Packit Service |
4684c1 |
goto cleanup;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
epriv = priv;
|
|
Packit Service |
4684c1 |
_gnutls_hello_ext_set_priv(session,
|
|
Packit Service |
4684c1 |
GNUTLS_EXTENSION_SRP,
|
|
Packit Service |
4684c1 |
epriv);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return len + 1;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
cleanup:
|
|
Packit Service |
4684c1 |
gnutls_free(username);
|
|
Packit Service |
4684c1 |
gnutls_free(password);
|
|
Packit Service |
4684c1 |
gnutls_free(priv);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return ret;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static void _gnutls_srp_deinit_data(gnutls_ext_priv_data_t epriv)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
srp_ext_st *priv = epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
gnutls_free(priv->username);
|
|
Packit Service |
4684c1 |
gnutls_free(priv->password);
|
|
Packit Service |
4684c1 |
gnutls_free(priv);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int
|
|
Packit Service |
4684c1 |
_gnutls_srp_pack(gnutls_ext_priv_data_t epriv, gnutls_buffer_st * ps)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
srp_ext_st *priv = epriv;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
int password_len = 0, username_len = 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (priv->username)
|
|
Packit Service |
4684c1 |
username_len = strlen(priv->username);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (priv->password)
|
|
Packit Service |
4684c1 |
password_len = strlen(priv->password);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
BUFFER_APPEND_PFX4(ps, priv->username, username_len);
|
|
Packit Service |
4684c1 |
BUFFER_APPEND_PFX4(ps, priv->password, password_len);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static int
|
|
Packit Service |
4684c1 |
_gnutls_srp_unpack(gnutls_buffer_st * ps, gnutls_ext_priv_data_t * _priv)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
srp_ext_st *priv;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
gnutls_ext_priv_data_t epriv;
|
|
Packit Service |
4684c1 |
gnutls_datum_t username = { NULL, 0 };
|
|
Packit Service |
4684c1 |
gnutls_datum_t password = { NULL, 0 };
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv = gnutls_calloc(1, sizeof(*priv));
|
|
Packit Service |
4684c1 |
if (priv == NULL) {
|
|
Packit Service |
4684c1 |
gnutls_assert();
|
|
Packit Service |
4684c1 |
return GNUTLS_E_MEMORY_ERROR;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
BUFFER_POP_DATUM(ps, &username);
|
|
Packit Service |
4684c1 |
BUFFER_POP_DATUM(ps, &password);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
priv->username = (char *) username.data;
|
|
Packit Service |
4684c1 |
priv->password = (char *) password.data;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
epriv = priv;
|
|
Packit Service |
4684c1 |
*_priv = epriv;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
return 0;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
error:
|
|
Packit Service |
4684c1 |
_gnutls_free_datum(&username);
|
|
Packit Service |
4684c1 |
_gnutls_free_datum(&password);
|
|
Packit Service |
4684c1 |
return ret;
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#endif /* ENABLE_SRP */
|