/*
* Copyright (C) 2017 Red Hat, Inc.
*
* Author: Nikos Mavrogiannopoulos
*
* This file is part of GnuTLS.
*
* The GnuTLS is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* as published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>
*
*/
#include "gnutls_int.h"
#include "errors.h"
#include "handshake.h"
#include "tls13/finished.h"
#include "mem.h"
#include "mbuffers.h"
#include "secrets.h"
int _gnutls13_compute_finished(const mac_entry_st *prf,
const uint8_t *base_key,
gnutls_buffer_st *handshake_hash_buffer,
void *out)
{
int ret;
uint8_t fkey[MAX_HASH_SIZE];
uint8_t ts_hash[MAX_HASH_SIZE];
ret = _tls13_expand_secret2(prf,
"finished", 8,
NULL, 0,
base_key,
prf->output_size, fkey);
if (ret < 0)
return gnutls_assert_val(ret);
ret = gnutls_hash_fast(prf->id,
handshake_hash_buffer->data,
handshake_hash_buffer->length,
ts_hash);
if (ret < 0)
return gnutls_assert_val(ret);
ret = gnutls_hmac_fast(prf->id,
fkey, prf->output_size,
ts_hash, prf->output_size,
out);
if (ret < 0)
return gnutls_assert_val(ret);
return 0;
}
int _gnutls13_recv_finished(gnutls_session_t session)
{
int ret;
gnutls_buffer_st buf;
uint8_t verifier[MAX_HASH_SIZE];
const uint8_t *base_key;
unsigned hash_size;
if (unlikely(session->security_parameters.prf == NULL))
return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
hash_size = session->security_parameters.prf->output_size;
if (!session->internals.initial_negotiation_completed) {
if (session->security_parameters.entity == GNUTLS_CLIENT)
base_key = session->key.proto.tls13.hs_skey;
else
base_key = session->key.proto.tls13.hs_ckey;
} else {
if (session->security_parameters.entity == GNUTLS_CLIENT)
base_key = session->key.proto.tls13.ap_skey;
else
base_key = session->key.proto.tls13.ap_ckey;
}
ret = _gnutls13_compute_finished(session->security_parameters.prf,
base_key,
&session->internals.handshake_hash_buffer,
verifier);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
ret = _gnutls_recv_handshake(session, GNUTLS_HANDSHAKE_FINISHED, 0, &buf);
if (ret < 0)
return gnutls_assert_val(ret);
_gnutls_handshake_log("HSK[%p]: parsing finished\n", session);
if (buf.length != hash_size) {
gnutls_assert();
ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
goto cleanup;
}
#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
# warning This is unsafe for production builds
#else
if (safe_memcmp(verifier, buf.data, buf.length) != 0) {
gnutls_assert();
ret = GNUTLS_E_ERROR_IN_FINISHED_PACKET;
goto cleanup;
}
#endif
ret = 0;
cleanup:
_gnutls_buffer_clear(&buf);
return ret;
}
int _gnutls13_send_finished(gnutls_session_t session, unsigned again)
{
int ret;
uint8_t verifier[MAX_HASH_SIZE];
mbuffer_st *bufel = NULL;
const uint8_t *base_key;
unsigned hash_size;
if (again == 0) {
if (unlikely(session->security_parameters.prf == NULL))
return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
hash_size = session->security_parameters.prf->output_size;
if (!session->internals.initial_negotiation_completed) {
if (session->security_parameters.entity == GNUTLS_CLIENT)
base_key = session->key.proto.tls13.hs_ckey;
else
base_key = session->key.proto.tls13.hs_skey;
} else {
if (session->security_parameters.entity == GNUTLS_CLIENT)
base_key = session->key.proto.tls13.ap_ckey;
else
base_key = session->key.proto.tls13.ap_skey;
}
ret = _gnutls13_compute_finished(session->security_parameters.prf,
base_key,
&session->internals.handshake_hash_buffer,
verifier);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
_gnutls_handshake_log("HSK[%p]: sending finished\n", session);
bufel = _gnutls_handshake_alloc(session, hash_size);
if (bufel == NULL)
return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
_mbuffer_set_udata_size(bufel, 0);
ret = _mbuffer_append_data(bufel, verifier, hash_size);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
}
return _gnutls_send_handshake(session, bufel, GNUTLS_HANDSHAKE_FINISHED);
cleanup:
_mbuffer_xfree(&bufel);
return ret;
}