authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-12-27 23:49:15-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-02 16:57:16-07:00
log21ab99174eabc9ae8efa2b19890d9cab51773b35
treedfd789f72b3552a9a83e1f660a74b418141b12a9
parent477864dca560b03bb3c3e8e7e1e50362e7ed681f

std.crypto.tls.Client: use enums more

2 files changed, 23 insertions(+), 21 deletions(-)

lib/std/crypto/tls.zig+3
...@@ -74,6 +74,7 @@ pub const HandshakeType = enum(u8) {...@@ -74,6 +74,7 @@ pub const HandshakeType = enum(u8) {
74 finished = 20,74 finished = 20,
75 key_update = 24,75 key_update = 24,
76 message_hash = 254,76 message_hash = 254,
77 _,
77};78};
7879
79pub const ExtensionType = enum(u16) {80pub const ExtensionType = enum(u16) {
...@@ -121,6 +122,8 @@ pub const ExtensionType = enum(u16) {...@@ -121,6 +122,8 @@ pub const ExtensionType = enum(u16) {
121 signature_algorithms_cert = 50,122 signature_algorithms_cert = 50,
122 /// RFC 8446123 /// RFC 8446
123 key_share = 51,124 key_share = 51,
125
126 _,
124};127};
125128
126pub const AlertLevel = enum(u8) {129pub const AlertLevel = enum(u8) {
lib/std/crypto/tls/Client.zig+20-21
...@@ -9,7 +9,6 @@ const assert = std.debug.assert;...@@ -9,7 +9,6 @@ const assert = std.debug.assert;
9const ApplicationCipher = tls.ApplicationCipher;9const ApplicationCipher = tls.ApplicationCipher;
10const CipherSuite = tls.CipherSuite;10const CipherSuite = tls.CipherSuite;
11const ContentType = tls.ContentType;11const ContentType = tls.ContentType;
12const HandshakeType = tls.HandshakeType;
13const HandshakeCipher = tls.HandshakeCipher;12const HandshakeCipher = tls.HandshakeCipher;
14const max_ciphertext_len = tls.max_ciphertext_len;13const max_ciphertext_len = tls.max_ciphertext_len;
15const hkdfExpandLabel = tls.hkdfExpandLabel;14const hkdfExpandLabel = tls.hkdfExpandLabel;
...@@ -91,7 +90,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -91,7 +90,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
91 extensions_header;90 extensions_header;
9291
93 const out_handshake =92 const out_handshake =
94 [_]u8{@enumToInt(HandshakeType.client_hello)} ++93 [_]u8{@enumToInt(tls.HandshakeType.client_hello)} ++
95 int3(@intCast(u24, client_hello.len + host_len)) ++94 int3(@intCast(u24, client_hello.len + host_len)) ++
96 client_hello;95 client_hello;
9796
...@@ -142,7 +141,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -142,7 +141,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
142 return error.TlsAlert;141 return error.TlsAlert;
143 },142 },
144 .handshake => {143 .handshake => {
145 if (frag[0] != @enumToInt(HandshakeType.server_hello)) {144 if (frag[0] != @enumToInt(tls.HandshakeType.server_hello)) {
146 return error.TlsUnexpectedMessage;145 return error.TlsUnexpectedMessage;
147 }146 }
148 const length = mem.readIntBig(u24, frag[1..4]);147 const length = mem.readIntBig(u24, frag[1..4]);
...@@ -175,27 +174,27 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -175,27 +174,27 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
175 var shared_key: [32]u8 = undefined;174 var shared_key: [32]u8 = undefined;
176 var have_shared_key = false;175 var have_shared_key = false;
177 while (i < frag.len) {176 while (i < frag.len) {
178 const et = mem.readIntBig(u16, frag[i..][0..2]);177 const et = @intToEnum(tls.ExtensionType, mem.readIntBig(u16, frag[i..][0..2]));
179 i += 2;178 i += 2;
180 const ext_size = mem.readIntBig(u16, frag[i..][0..2]);179 const ext_size = mem.readIntBig(u16, frag[i..][0..2]);
181 i += 2;180 i += 2;
182 const next_i = i + ext_size;181 const next_i = i + ext_size;
183 if (next_i > frag.len) return error.TlsBadLength;182 if (next_i > frag.len) return error.TlsBadLength;
184 switch (et) {183 switch (et) {
185 @enumToInt(tls.ExtensionType.supported_versions) => {184 .supported_versions => {
186 if (supported_version != 0) return error.TlsIllegalParameter;185 if (supported_version != 0) return error.TlsIllegalParameter;
187 supported_version = mem.readIntBig(u16, frag[i..][0..2]);186 supported_version = mem.readIntBig(u16, frag[i..][0..2]);
188 },187 },
189 @enumToInt(tls.ExtensionType.key_share) => {188 .key_share => {
190 if (have_shared_key) return error.TlsIllegalParameter;189 if (have_shared_key) return error.TlsIllegalParameter;
191 have_shared_key = true;190 have_shared_key = true;
192 const named_group = mem.readIntBig(u16, frag[i..][0..2]);191 const named_group = @intToEnum(tls.NamedGroup, mem.readIntBig(u16, frag[i..][0..2]));
193 i += 2;192 i += 2;
194 const key_size = mem.readIntBig(u16, frag[i..][0..2]);193 const key_size = mem.readIntBig(u16, frag[i..][0..2]);
195 i += 2;194 i += 2;
196195
197 switch (named_group) {196 switch (named_group) {
198 @enumToInt(tls.NamedGroup.x25519) => {197 .x25519 => {
199 if (key_size != 32) return error.TlsBadLength;198 if (key_size != 32) return error.TlsBadLength;
200 const server_pub_key = frag[i..][0..32];199 const server_pub_key = frag[i..][0..32];
201200
...@@ -204,7 +203,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -204,7 +203,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
204 server_pub_key.*,203 server_pub_key.*,
205 ) catch return error.TlsDecryptFailure;204 ) catch return error.TlsDecryptFailure;
206 },205 },
207 @enumToInt(tls.NamedGroup.secp256r1) => {206 .secp256r1 => {
208 const server_pub_key = frag[i..][0..key_size];207 const server_pub_key = frag[i..][0..key_size];
209208
210 const PublicKey = crypto.sign.ecdsa.EcdsaP256Sha256.PublicKey;209 const PublicKey = crypto.sign.ecdsa.EcdsaP256Sha256.PublicKey;
...@@ -217,7 +216,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -217,7 +216,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
217 shared_key = mul.affineCoordinates().x.toBytes(.Big);216 shared_key = mul.affineCoordinates().x.toBytes(.Big);
218 },217 },
219 else => {218 else => {
220 std.debug.print("named group: {x}\n", .{named_group});219 //std.debug.print("named group: {x}\n", .{named_group});
221 return error.TlsIllegalParameter;220 return error.TlsIllegalParameter;
222 },221 },
223 }222 }
...@@ -380,7 +379,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -380,7 +379,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
380 .handshake => {379 .handshake => {
381 var ct_i: usize = 0;380 var ct_i: usize = 0;
382 while (true) {381 while (true) {
383 const handshake_type = cleartext[ct_i];382 const handshake_type = @intToEnum(tls.HandshakeType, cleartext[ct_i]);
384 ct_i += 1;383 ct_i += 1;
385 const handshake_len = mem.readIntBig(u24, cleartext[ct_i..][0..3]);384 const handshake_len = mem.readIntBig(u24, cleartext[ct_i..][0..3]);
386 ct_i += 3;385 ct_i += 3;
...@@ -390,7 +389,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -390,7 +389,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
390 const wrapped_handshake = cleartext[ct_i - 4 .. next_handshake_i];389 const wrapped_handshake = cleartext[ct_i - 4 .. next_handshake_i];
391 const handshake = cleartext[ct_i..next_handshake_i];390 const handshake = cleartext[ct_i..next_handshake_i];
392 switch (handshake_type) {391 switch (handshake_type) {
393 @enumToInt(HandshakeType.encrypted_extensions) => {392 .encrypted_extensions => {
394 if (handshake_state != .encrypted_extensions) return error.TlsUnexpectedMessage;393 if (handshake_state != .encrypted_extensions) return error.TlsUnexpectedMessage;
395 handshake_state = .certificate;394 handshake_state = .certificate;
396 switch (handshake_cipher) {395 switch (handshake_cipher) {
...@@ -400,13 +399,13 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -400,13 +399,13 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
400 var hs_i: usize = 2;399 var hs_i: usize = 2;
401 const end_ext_i = 2 + total_ext_size;400 const end_ext_i = 2 + total_ext_size;
402 while (hs_i < end_ext_i) {401 while (hs_i < end_ext_i) {
403 const et = mem.readIntBig(u16, handshake[hs_i..][0..2]);402 const et = @intToEnum(tls.ExtensionType, mem.readIntBig(u16, handshake[hs_i..][0..2]));
404 hs_i += 2;403 hs_i += 2;
405 const ext_size = mem.readIntBig(u16, handshake[hs_i..][0..2]);404 const ext_size = mem.readIntBig(u16, handshake[hs_i..][0..2]);
406 hs_i += 2;405 hs_i += 2;
407 const next_ext_i = hs_i + ext_size;406 const next_ext_i = hs_i + ext_size;
408 switch (et) {407 switch (et) {
409 @enumToInt(tls.ExtensionType.server_name) => {},408 .server_name => {},
410 else => {409 else => {
411 std.debug.print("encrypted extension: {any}\n", .{410 std.debug.print("encrypted extension: {any}\n", .{
412 et,411 et,
...@@ -416,7 +415,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -416,7 +415,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
416 hs_i = next_ext_i;415 hs_i = next_ext_i;
417 }416 }
418 },417 },
419 @enumToInt(HandshakeType.certificate) => cert: {418 .certificate => cert: {
420 switch (handshake_cipher) {419 switch (handshake_cipher) {
421 inline else => |*p| p.transcript_hash.update(wrapped_handshake),420 inline else => |*p| p.transcript_hash.update(wrapped_handshake),
422 }421 }
...@@ -488,7 +487,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -488,7 +487,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
488 hs_i += total_ext_size;487 hs_i += total_ext_size;
489 }488 }
490 },489 },
491 @enumToInt(HandshakeType.certificate_verify) => {490 .certificate_verify => {
492 switch (handshake_state) {491 switch (handshake_state) {
493 .trust_chain_established => handshake_state = .finished,492 .trust_chain_established => handshake_state = .finished,
494 .certificate => return error.TlsCertificateNotVerified,493 .certificate => return error.TlsCertificateNotVerified,
...@@ -535,7 +534,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -535,7 +534,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
535 },534 },
536 }535 }
537 },536 },
538 @enumToInt(HandshakeType.finished) => {537 .finished => {
539 if (handshake_state != .finished) return error.TlsUnexpectedMessage;538 if (handshake_state != .finished) return error.TlsUnexpectedMessage;
540 // This message is to trick buggy proxies into behaving correctly.539 // This message is to trick buggy proxies into behaving correctly.
541 const client_change_cipher_spec_msg = [_]u8{540 const client_change_cipher_spec_msg = [_]u8{
...@@ -555,7 +554,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)...@@ -555,7 +554,7 @@ pub fn init(stream: net.Stream, ca_bundle: Certificate.Bundle, host: []const u8)
555 const handshake_hash = p.transcript_hash.finalResult();554 const handshake_hash = p.transcript_hash.finalResult();
556 const verify_data = tls.hmac(P.Hmac, &handshake_hash, p.client_finished_key);555 const verify_data = tls.hmac(P.Hmac, &handshake_hash, p.client_finished_key);
557 const out_cleartext = [_]u8{556 const out_cleartext = [_]u8{
558 @enumToInt(HandshakeType.finished),557 @enumToInt(tls.HandshakeType.finished),
559 0, 0, verify_data.len, // length558 0, 0, verify_data.len, // length
560 } ++ verify_data ++ [1]u8{@enumToInt(ContentType.handshake)};559 } ++ verify_data ++ [1]u8{@enumToInt(ContentType.handshake)};
561560
...@@ -810,7 +809,7 @@ pub fn read(c: *Client, stream: net.Stream, buffer: []u8) !usize {...@@ -810,7 +809,7 @@ pub fn read(c: *Client, stream: net.Stream, buffer: []u8) !usize {
810 .handshake => {809 .handshake => {
811 var ct_i: usize = 0;810 var ct_i: usize = 0;
812 while (true) {811 while (true) {
813 const handshake_type = cleartext[ct_i];812 const handshake_type = @intToEnum(tls.HandshakeType, cleartext[ct_i]);
814 ct_i += 1;813 ct_i += 1;
815 const handshake_len = mem.readIntBig(u24, cleartext[ct_i..][0..3]);814 const handshake_len = mem.readIntBig(u24, cleartext[ct_i..][0..3]);
816 ct_i += 3;815 ct_i += 3;
...@@ -819,10 +818,10 @@ pub fn read(c: *Client, stream: net.Stream, buffer: []u8) !usize {...@@ -819,10 +818,10 @@ pub fn read(c: *Client, stream: net.Stream, buffer: []u8) !usize {
819 return error.TlsBadLength;818 return error.TlsBadLength;
820 const handshake = cleartext[ct_i..next_handshake_i];819 const handshake = cleartext[ct_i..next_handshake_i];
821 switch (handshake_type) {820 switch (handshake_type) {
822 @enumToInt(HandshakeType.new_session_ticket) => {821 .new_session_ticket => {
823 std.debug.print("server sent a new session ticket\n", .{});822 std.debug.print("server sent a new session ticket\n", .{});
824 },823 },
825 @enumToInt(HandshakeType.key_update) => {824 .key_update => {
826 switch (c.application_cipher) {825 switch (c.application_cipher) {
827 inline else => |*p| {826 inline else => |*p| {
828 const P = @TypeOf(p.*);827 const P = @TypeOf(p.*);