1 /* 2 * TLSv1 Record Protocol 3 * Copyright (c) 2006-2011, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/md5.h" 13 #include "crypto/sha1.h" 14 #include "crypto/sha256.h" 15 #include "tlsv1_common.h" 16 #include "tlsv1_record.h" 17 18 19 /** 20 * tlsv1_record_set_cipher_suite - TLS record layer: Set cipher suite 21 * @rl: Pointer to TLS record layer data 22 * @cipher_suite: New cipher suite 23 * Returns: 0 on success, -1 on failure 24 * 25 * This function is used to prepare TLS record layer for cipher suite change. 26 * tlsv1_record_change_write_cipher() and 27 * tlsv1_record_change_read_cipher() functions can then be used to change the 28 * currently used ciphers. 29 */ 30 int tlsv1_record_set_cipher_suite(struct tlsv1_record_layer *rl, 31 u16 cipher_suite) 32 { 33 const struct tls_cipher_suite *suite; 34 const struct tls_cipher_data *data; 35 36 wpa_printf(MSG_DEBUG, "TLSv1: Selected cipher suite: 0x%04x", 37 cipher_suite); 38 rl->cipher_suite = cipher_suite; 39 40 suite = tls_get_cipher_suite(cipher_suite); 41 if (suite == NULL) 42 return -1; 43 44 if (suite->hash == TLS_HASH_MD5) { 45 rl->hash_alg = CRYPTO_HASH_ALG_HMAC_MD5; 46 rl->hash_size = MD5_MAC_LEN; 47 } else if (suite->hash == TLS_HASH_SHA) { 48 rl->hash_alg = CRYPTO_HASH_ALG_HMAC_SHA1; 49 rl->hash_size = SHA1_MAC_LEN; 50 } else if (suite->hash == TLS_HASH_SHA256) { 51 rl->hash_alg = CRYPTO_HASH_ALG_HMAC_SHA256; 52 rl->hash_size = SHA256_MAC_LEN; 53 } 54 55 data = tls_get_cipher_data(suite->cipher); 56 if (data == NULL) 57 return -1; 58 59 rl->key_material_len = data->key_material; 60 rl->iv_size = data->block_size; 61 rl->cipher_alg = data->alg; 62 63 return 0; 64 } 65 66 67 /** 68 * tlsv1_record_change_write_cipher - TLS record layer: Change write cipher 69 * @rl: Pointer to TLS record layer data 70 * Returns: 0 on success (cipher changed), -1 on failure 71 * 72 * This function changes TLS record layer to use the new cipher suite 73 * configured with tlsv1_record_set_cipher_suite() for writing. 74 */ 75 int tlsv1_record_change_write_cipher(struct tlsv1_record_layer *rl) 76 { 77 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - New write cipher suite " 78 "0x%04x", rl->cipher_suite); 79 rl->write_cipher_suite = rl->cipher_suite; 80 os_memset(rl->write_seq_num, 0, TLS_SEQ_NUM_LEN); 81 82 if (rl->write_cbc) { 83 crypto_cipher_deinit(rl->write_cbc); 84 rl->write_cbc = NULL; 85 } 86 if (rl->cipher_alg != CRYPTO_CIPHER_NULL) { 87 rl->write_cbc = crypto_cipher_init(rl->cipher_alg, 88 rl->write_iv, rl->write_key, 89 rl->key_material_len); 90 if (rl->write_cbc == NULL) { 91 wpa_printf(MSG_DEBUG, "TLSv1: Failed to initialize " 92 "cipher"); 93 return -1; 94 } 95 } 96 97 return 0; 98 } 99 100 101 /** 102 * tlsv1_record_change_read_cipher - TLS record layer: Change read cipher 103 * @rl: Pointer to TLS record layer data 104 * Returns: 0 on success (cipher changed), -1 on failure 105 * 106 * This function changes TLS record layer to use the new cipher suite 107 * configured with tlsv1_record_set_cipher_suite() for reading. 108 */ 109 int tlsv1_record_change_read_cipher(struct tlsv1_record_layer *rl) 110 { 111 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - New read cipher suite " 112 "0x%04x", rl->cipher_suite); 113 rl->read_cipher_suite = rl->cipher_suite; 114 os_memset(rl->read_seq_num, 0, TLS_SEQ_NUM_LEN); 115 116 if (rl->read_cbc) { 117 crypto_cipher_deinit(rl->read_cbc); 118 rl->read_cbc = NULL; 119 } 120 if (rl->cipher_alg != CRYPTO_CIPHER_NULL) { 121 rl->read_cbc = crypto_cipher_init(rl->cipher_alg, 122 rl->read_iv, rl->read_key, 123 rl->key_material_len); 124 if (rl->read_cbc == NULL) { 125 wpa_printf(MSG_DEBUG, "TLSv1: Failed to initialize " 126 "cipher"); 127 return -1; 128 } 129 } 130 131 return 0; 132 } 133 134 135 /** 136 * tlsv1_record_send - TLS record layer: Send a message 137 * @rl: Pointer to TLS record layer data 138 * @content_type: Content type (TLS_CONTENT_TYPE_*) 139 * @buf: Buffer for the generated TLS message (needs to have extra space for 140 * header, IV (TLS v1.1), and HMAC) 141 * @buf_size: Maximum buf size 142 * @payload: Payload to be sent 143 * @payload_len: Length of the payload 144 * @out_len: Buffer for returning the used buf length 145 * Returns: 0 on success, -1 on failure 146 * 147 * This function fills in the TLS record layer header, adds HMAC, and encrypts 148 * the data using the current write cipher. 149 */ 150 int tlsv1_record_send(struct tlsv1_record_layer *rl, u8 content_type, u8 *buf, 151 size_t buf_size, const u8 *payload, size_t payload_len, 152 size_t *out_len) 153 { 154 u8 *pos, *ct_start, *length, *cpayload; 155 struct crypto_hash *hmac; 156 size_t clen; 157 int explicit_iv; 158 159 pos = buf; 160 if (pos + TLS_RECORD_HEADER_LEN > buf + buf_size) 161 return -1; 162 163 /* ContentType type */ 164 ct_start = pos; 165 *pos++ = content_type; 166 /* ProtocolVersion version */ 167 WPA_PUT_BE16(pos, rl->tls_version); 168 pos += 2; 169 /* uint16 length */ 170 length = pos; 171 WPA_PUT_BE16(length, payload_len); 172 pos += 2; 173 174 cpayload = pos; 175 explicit_iv = rl->write_cipher_suite != TLS_NULL_WITH_NULL_NULL && 176 rl->iv_size && rl->tls_version >= TLS_VERSION_1_1; 177 if (explicit_iv) { 178 /* opaque IV[Cipherspec.block_length] */ 179 if (pos + rl->iv_size > buf + buf_size) 180 return -1; 181 182 /* 183 * Use random number R per the RFC 4346, 6.2.3.2 CBC Block 184 * Cipher option 2a. 185 */ 186 187 if (os_get_random(pos, rl->iv_size)) 188 return -1; 189 pos += rl->iv_size; 190 } 191 192 /* 193 * opaque fragment[TLSPlaintext.length] 194 * (opaque content[TLSCompressed.length] in GenericBlockCipher) 195 */ 196 if (pos + payload_len > buf + buf_size) 197 return -1; 198 os_memmove(pos, payload, payload_len); 199 pos += payload_len; 200 201 if (rl->write_cipher_suite != TLS_NULL_WITH_NULL_NULL) { 202 /* 203 * MAC calculated over seq_num + TLSCompressed.type + 204 * TLSCompressed.version + TLSCompressed.length + 205 * TLSCompressed.fragment 206 */ 207 hmac = crypto_hash_init(rl->hash_alg, rl->write_mac_secret, 208 rl->hash_size); 209 if (hmac == NULL) { 210 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - Failed " 211 "to initialize HMAC"); 212 return -1; 213 } 214 crypto_hash_update(hmac, rl->write_seq_num, TLS_SEQ_NUM_LEN); 215 /* type + version + length + fragment */ 216 crypto_hash_update(hmac, ct_start, TLS_RECORD_HEADER_LEN); 217 crypto_hash_update(hmac, payload, payload_len); 218 clen = buf + buf_size - pos; 219 if (clen < rl->hash_size) { 220 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - Not " 221 "enough room for MAC"); 222 crypto_hash_finish(hmac, NULL, NULL); 223 return -1; 224 } 225 226 if (crypto_hash_finish(hmac, pos, &clen) < 0) { 227 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - Failed " 228 "to calculate HMAC"); 229 return -1; 230 } 231 wpa_hexdump(MSG_MSGDUMP, "TLSv1: Record Layer - Write HMAC", 232 pos, clen); 233 pos += clen; 234 if (rl->iv_size) { 235 size_t len = pos - cpayload; 236 size_t pad; 237 pad = (len + 1) % rl->iv_size; 238 if (pad) 239 pad = rl->iv_size - pad; 240 if (pos + pad + 1 > buf + buf_size) { 241 wpa_printf(MSG_DEBUG, "TLSv1: No room for " 242 "block cipher padding"); 243 return -1; 244 } 245 os_memset(pos, pad, pad + 1); 246 pos += pad + 1; 247 } 248 249 if (crypto_cipher_encrypt(rl->write_cbc, cpayload, 250 cpayload, pos - cpayload) < 0) 251 return -1; 252 } 253 254 WPA_PUT_BE16(length, pos - length - 2); 255 inc_byte_array(rl->write_seq_num, TLS_SEQ_NUM_LEN); 256 257 *out_len = pos - buf; 258 259 return 0; 260 } 261 262 263 /** 264 * tlsv1_record_receive - TLS record layer: Process a received message 265 * @rl: Pointer to TLS record layer data 266 * @in_data: Received data 267 * @in_len: Length of the received data 268 * @out_data: Buffer for output data (must be at least as long as in_data) 269 * @out_len: Set to maximum out_data length by caller; used to return the 270 * length of the used data 271 * @alert: Buffer for returning an alert value on failure 272 * Returns: Number of bytes used from in_data on success, 0 if record was not 273 * complete (more data needed), or -1 on failure 274 * 275 * This function decrypts the received message, verifies HMAC and TLS record 276 * layer header. 277 */ 278 int tlsv1_record_receive(struct tlsv1_record_layer *rl, 279 const u8 *in_data, size_t in_len, 280 u8 *out_data, size_t *out_len, u8 *alert) 281 { 282 size_t i, rlen, hlen; 283 u8 padlen; 284 struct crypto_hash *hmac; 285 u8 len[2], hash[100]; 286 int force_mac_error = 0; 287 u8 ct; 288 289 if (in_len < TLS_RECORD_HEADER_LEN) { 290 wpa_printf(MSG_DEBUG, "TLSv1: Too short record (in_len=%lu) - " 291 "need more data", 292 (unsigned long) in_len); 293 wpa_hexdump(MSG_MSGDUMP, "TLSv1: Record Layer - Received", 294 in_data, in_len); 295 return 0; 296 } 297 298 ct = in_data[0]; 299 rlen = WPA_GET_BE16(in_data + 3); 300 wpa_printf(MSG_DEBUG, "TLSv1: Received content type %d version %d.%d " 301 "length %d", ct, in_data[1], in_data[2], (int) rlen); 302 303 /* 304 * TLS v1.0 and v1.1 RFCs were not exactly clear on the use of the 305 * protocol version in record layer. As such, accept any {03,xx} value 306 * to remain compatible with existing implementations. 307 */ 308 if (in_data[1] != 0x03) { 309 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected protocol version " 310 "%u.%u", in_data[1], in_data[2]); 311 *alert = TLS_ALERT_PROTOCOL_VERSION; 312 return -1; 313 } 314 315 /* TLSCiphertext must not be more than 2^14+2048 bytes */ 316 if (TLS_RECORD_HEADER_LEN + rlen > 18432) { 317 wpa_printf(MSG_DEBUG, "TLSv1: Record overflow (len=%lu)", 318 (unsigned long) (TLS_RECORD_HEADER_LEN + rlen)); 319 *alert = TLS_ALERT_RECORD_OVERFLOW; 320 return -1; 321 } 322 323 in_data += TLS_RECORD_HEADER_LEN; 324 in_len -= TLS_RECORD_HEADER_LEN; 325 326 if (rlen > in_len) { 327 wpa_printf(MSG_DEBUG, "TLSv1: Not all record data included " 328 "(rlen=%lu > in_len=%lu)", 329 (unsigned long) rlen, (unsigned long) in_len); 330 return 0; 331 } 332 333 wpa_hexdump(MSG_MSGDUMP, "TLSv1: Record Layer - Received", 334 in_data, rlen); 335 336 if (ct != TLS_CONTENT_TYPE_HANDSHAKE && 337 ct != TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC && 338 ct != TLS_CONTENT_TYPE_ALERT && 339 ct != TLS_CONTENT_TYPE_APPLICATION_DATA) { 340 wpa_printf(MSG_DEBUG, "TLSv1: Ignore record with unknown " 341 "content type 0x%x", ct); 342 *alert = TLS_ALERT_UNEXPECTED_MESSAGE; 343 return -1; 344 } 345 346 in_len = rlen; 347 348 if (*out_len < in_len) { 349 wpa_printf(MSG_DEBUG, "TLSv1: Not enough output buffer for " 350 "processing received record"); 351 *alert = TLS_ALERT_INTERNAL_ERROR; 352 return -1; 353 } 354 355 if (rl->read_cipher_suite != TLS_NULL_WITH_NULL_NULL) { 356 size_t plen; 357 if (crypto_cipher_decrypt(rl->read_cbc, in_data, 358 out_data, in_len) < 0) { 359 *alert = TLS_ALERT_DECRYPTION_FAILED; 360 return -1; 361 } 362 plen = in_len; 363 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: Record Layer - Decrypted " 364 "data", out_data, plen); 365 366 if (rl->iv_size) { 367 /* 368 * TLS v1.0 defines different alert values for various 369 * failures. That may information to aid in attacks, so 370 * use the same bad_record_mac alert regardless of the 371 * issues. 372 * 373 * In addition, instead of returning immediately on 374 * error, run through the MAC check to make timing 375 * attacks more difficult. 376 */ 377 378 if (rl->tls_version >= TLS_VERSION_1_1) { 379 /* Remove opaque IV[Cipherspec.block_length] */ 380 if (plen < rl->iv_size) { 381 wpa_printf(MSG_DEBUG, "TLSv1.1: Not " 382 "enough room for IV"); 383 force_mac_error = 1; 384 goto check_mac; 385 } 386 os_memmove(out_data, out_data + rl->iv_size, 387 plen - rl->iv_size); 388 plen -= rl->iv_size; 389 } 390 391 /* Verify and remove padding */ 392 if (plen == 0) { 393 wpa_printf(MSG_DEBUG, "TLSv1: Too short record" 394 " (no pad)"); 395 force_mac_error = 1; 396 goto check_mac; 397 } 398 padlen = out_data[plen - 1]; 399 if (padlen >= plen) { 400 wpa_printf(MSG_DEBUG, "TLSv1: Incorrect pad " 401 "length (%u, plen=%lu) in " 402 "received record", 403 padlen, (unsigned long) plen); 404 force_mac_error = 1; 405 goto check_mac; 406 } 407 for (i = plen - padlen - 1; i < plen - 1; i++) { 408 if (out_data[i] != padlen) { 409 wpa_hexdump(MSG_DEBUG, 410 "TLSv1: Invalid pad in " 411 "received record", 412 out_data + plen - padlen - 413 1, padlen + 1); 414 force_mac_error = 1; 415 goto check_mac; 416 } 417 } 418 419 plen -= padlen + 1; 420 421 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: Record Layer - " 422 "Decrypted data with IV and padding " 423 "removed", out_data, plen); 424 } 425 426 check_mac: 427 if (plen < rl->hash_size) { 428 wpa_printf(MSG_DEBUG, "TLSv1: Too short record; no " 429 "hash value"); 430 *alert = TLS_ALERT_BAD_RECORD_MAC; 431 return -1; 432 } 433 434 plen -= rl->hash_size; 435 436 hmac = crypto_hash_init(rl->hash_alg, rl->read_mac_secret, 437 rl->hash_size); 438 if (hmac == NULL) { 439 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - Failed " 440 "to initialize HMAC"); 441 *alert = TLS_ALERT_INTERNAL_ERROR; 442 return -1; 443 } 444 445 crypto_hash_update(hmac, rl->read_seq_num, TLS_SEQ_NUM_LEN); 446 /* type + version + length + fragment */ 447 crypto_hash_update(hmac, in_data - TLS_RECORD_HEADER_LEN, 3); 448 WPA_PUT_BE16(len, plen); 449 crypto_hash_update(hmac, len, 2); 450 crypto_hash_update(hmac, out_data, plen); 451 hlen = sizeof(hash); 452 if (crypto_hash_finish(hmac, hash, &hlen) < 0) { 453 wpa_printf(MSG_DEBUG, "TLSv1: Record Layer - Failed " 454 "to calculate HMAC"); 455 *alert = TLS_ALERT_INTERNAL_ERROR; 456 return -1; 457 } 458 if (hlen != rl->hash_size || 459 os_memcmp_const(hash, out_data + plen, hlen) != 0 || 460 force_mac_error) { 461 wpa_printf(MSG_DEBUG, "TLSv1: Invalid HMAC value in " 462 "received message (force_mac_error=%d)", 463 force_mac_error); 464 *alert = TLS_ALERT_BAD_RECORD_MAC; 465 return -1; 466 } 467 468 *out_len = plen; 469 } else { 470 os_memcpy(out_data, in_data, in_len); 471 *out_len = in_len; 472 } 473 474 /* TLSCompressed must not be more than 2^14+1024 bytes */ 475 if (TLS_RECORD_HEADER_LEN + *out_len > 17408) { 476 wpa_printf(MSG_DEBUG, "TLSv1: Record overflow (len=%lu)", 477 (unsigned long) (TLS_RECORD_HEADER_LEN + *out_len)); 478 *alert = TLS_ALERT_RECORD_OVERFLOW; 479 return -1; 480 } 481 482 inc_byte_array(rl->read_seq_num, TLS_SEQ_NUM_LEN); 483 484 return TLS_RECORD_HEADER_LEN + rlen; 485 } 486
