authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-12-16 13:16:53-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-02 16:57:15-07:00
log462b3ed69c20ea5dcae1660761012b3d5fa91367
tree4df5933b4b4d6613ad2221d5ceadb0f003bb42f2
parentb97fc43baac9498799f3520ee860e5026e8dcb53

std.crypto.Tls: handshake fixes

* Handle multiple handshakes in one encrypted record * Fix incorrect handshake length sent to server

1 files changed, 114 insertions(+), 99 deletions(-)

lib/std/crypto/Tls.zig+114-99
......@@ -17,6 +17,10 @@ eof: bool,
1717pub const ciphertext_record_header_len = 5;
1818pub const max_ciphertext_len = (1 << 14) + 256;
1919pub const max_ciphertext_record_len = max_ciphertext_len + ciphertext_record_header_len;
20pub const hello_retry_request_sequence = [32]u8{
21 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11, 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
22 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E, 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C,
23};
2024
2125pub const ProtocolVersion = enum(u16) {
2226 tls_1_2 = 0x0303,
......@@ -450,7 +454,9 @@ pub fn init(stream: net.Stream, host: []const u8) !Tls {
450454 const hello = frag[4..];
451455 const legacy_version = mem.readIntBig(u16, hello[0..2]);
452456 const random = hello[2..34].*;
453 _ = random;
457 if (mem.eql(u8, &random, &hello_retry_request_sequence)) {
458 @panic("TODO handle HelloRetryRequest");
459 }
454460 const legacy_session_id_echo_len = hello[34];
455461 if (legacy_session_id_echo_len != 0) return error.TlsIllegalParameter;
456462 const cipher_suite_int = mem.readIntBig(u16, hello[35..37]);
......@@ -551,7 +557,7 @@ pub fn init(stream: net.Stream, host: []const u8) !Tls {
551557 p.server_handshake_key = hkdfExpandLabel(P.Hkdf, server_secret, "key", "", P.AEAD.key_length);
552558 p.client_handshake_iv = hkdfExpandLabel(P.Hkdf, client_secret, "iv", "", P.AEAD.nonce_length);
553559 p.server_handshake_iv = hkdfExpandLabel(P.Hkdf, server_secret, "iv", "", P.AEAD.nonce_length);
554 //std.debug.print("shared_key: {}\nhello_hash: {}\nearly_secret: {}\nempty_hash: {}\nderived_secret: {}\nhandshake_secret: {}\n client_secret: {}\n server_secret: {}\n", .{
560 //std.debug.print("shared_key: {}\nhello_hash: {}\nearly_secret: {}\nempty_hash: {}\nderived_secret: {}\nhandshake_secret: {}\n client_secret: {}\n server_secret: {}\nclient_handshake_iv: {}\nserver_handshake_iv: {}\n", .{
555561 // std.fmt.fmtSliceHexLower(&shared_key),
556562 // std.fmt.fmtSliceHexLower(&hello_hash),
557563 // std.fmt.fmtSliceHexLower(&early_secret),
......@@ -560,6 +566,8 @@ pub fn init(stream: net.Stream, host: []const u8) !Tls {
560566 // std.fmt.fmtSliceHexLower(&p.handshake_secret),
561567 // std.fmt.fmtSliceHexLower(&client_secret),
562568 // std.fmt.fmtSliceHexLower(&server_secret),
569 // std.fmt.fmtSliceHexLower(&p.client_handshake_iv),
570 // std.fmt.fmtSliceHexLower(&p.server_handshake_iv),
563571 //});
564572 },
565573 .TLS_CHACHA20_POLY1305_SHA256 => {
......@@ -643,106 +651,113 @@ pub fn init(stream: net.Stream, host: []const u8) !Tls {
643651 },
644652 };
645653
646 const inner_ct = cleartext[cleartext.len - 1];
647 std.debug.print("inner_ct={any}\n", .{@intToEnum(ContentType, inner_ct)});
654 const inner_ct = @intToEnum(ContentType, cleartext[cleartext.len - 1]);
648655 switch (inner_ct) {
649 @enumToInt(ContentType.handshake) => {
650 const handshake_len = mem.readIntBig(u24, cleartext[1..4]);
651 if (4 + handshake_len > cleartext.len - 1) return error.TlsBadLength;
652 std.debug.print("handshake type: {any} size: {d}\n", .{ @intToEnum(HandshakeType, cleartext[0]), handshake_len });
653 switch (cleartext[0]) {
654 @enumToInt(HandshakeType.encrypted_extensions) => {
655 const ext_size = mem.readIntBig(u16, cleartext[4..6]);
656 std.debug.print("{d} bytes of encrypted extensions\n", .{
657 ext_size,
658 });
659 },
660 @enumToInt(HandshakeType.certificate) => {
661 std.debug.print("cool certificate bro\n", .{});
662 },
663 @enumToInt(HandshakeType.certificate_verify) => {
664 std.debug.print("the certificate came with a fancy signature\n", .{});
665 },
666 @enumToInt(HandshakeType.finished) => {
667 // This message is to trick buggy proxies into behaving correctly.
668 const client_change_cipher_spec_msg = [_]u8{
669 @enumToInt(ContentType.change_cipher_spec),
670 0x03, 0x03, // legacy protocol version
671 0x00, 0x01, // length
672 0x01,
673 };
674 const app_cipher = switch (cipher_params) {
675 inline .TLS_AES_128_GCM_SHA256, .TLS_AES_256_GCM_SHA384 => |*p, tag| c: {
676 const P = @TypeOf(p.*);
677 // TODO verify the server's data
678 const handshake_hash = p.transcript_hash.finalResult();
679 const verify_data = hmac(P.Hmac, &handshake_hash, p.client_finished_key);
680 const out_cleartext = [_]u8{
681 @enumToInt(HandshakeType.finished),
682 0, 0, verify_data.len + 1 + P.AEAD.tag_length, // length
683 } ++ verify_data ++ [1]u8{@enumToInt(ContentType.handshake)};
684
685 const wrapped_len = out_cleartext.len + P.AEAD.tag_length;
686
687 var finished_msg = [_]u8{
688 @enumToInt(ContentType.application_data),
689 0x03, 0x03, // legacy protocol version
690 0, wrapped_len, // byte length of encrypted record
691 } ++ ([1]u8{undefined} ** wrapped_len);
692
693 const ad = finished_msg[0..5];
694 const ciphertext = finished_msg[5..][0..out_cleartext.len];
695 const auth_tag = finished_msg[finished_msg.len - P.AEAD.tag_length ..];
696 const nonce = p.client_handshake_iv;
697 P.AEAD.encrypt(ciphertext, auth_tag, &out_cleartext, ad, nonce, p.client_handshake_key);
698
699 //const both_msgs = client_change_cipher_spec_msg ++ finished_msg;
700 _ = client_change_cipher_spec_msg;
701 const both_msgs = finished_msg;
702 try stream.writeAll(&both_msgs);
703
704 const client_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "c ap traffic", &handshake_hash, P.Hash.digest_length);
705 const server_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "s ap traffic", &handshake_hash, P.Hash.digest_length);
706 //std.debug.print("master_secret={}\nclient_secret={}\nserver_secret={}\n", .{
707 // std.fmt.fmtSliceHexLower(&p.master_secret),
708 // std.fmt.fmtSliceHexLower(&client_secret),
709 // std.fmt.fmtSliceHexLower(&server_secret),
710 //});
711 break :c @unionInit(ApplicationCipher, @tagName(tag), .{
712 .client_key = hkdfExpandLabel(P.Hkdf, client_secret, "key", "", P.AEAD.key_length),
713 .server_key = hkdfExpandLabel(P.Hkdf, server_secret, "key", "", P.AEAD.key_length),
714 .client_iv = hkdfExpandLabel(P.Hkdf, client_secret, "iv", "", P.AEAD.nonce_length),
715 .server_iv = hkdfExpandLabel(P.Hkdf, server_secret, "iv", "", P.AEAD.nonce_length),
716 });
717 },
718 .TLS_CHACHA20_POLY1305_SHA256 => {
719 @panic("TODO");
720 },
721 .TLS_AES_128_CCM_SHA256 => {
722 @panic("TODO");
723 },
724 .TLS_AES_128_CCM_8_SHA256 => {
725 @panic("TODO");
726 },
727 };
728 std.debug.print("remaining bytes: {d}\n", .{len - end});
729 return .{
730 .application_cipher = app_cipher,
731 .read_seq = 0,
732 .write_seq = 0,
733 .partially_read_buffer = undefined,
734 .partially_read_len = 0,
735 .eof = false,
736 };
737 },
738 else => {
739 std.debug.print("handshake type: {d}\n", .{cleartext[0]});
740 return error.TlsUnexpectedMessage;
741 },
656 .handshake => {
657 var ct_i: usize = 0;
658 while (true) {
659 const handshake_type = cleartext[ct_i];
660 ct_i += 1;
661 const handshake_len = mem.readIntBig(u24, cleartext[ct_i..][0..3]);
662 ct_i += 3;
663 const next_handshake_i = ct_i + handshake_len;
664 if (next_handshake_i > cleartext.len - 1)
665 return error.TlsBadLength;
666 switch (handshake_type) {
667 @enumToInt(HandshakeType.encrypted_extensions) => {
668 const ext_size = mem.readIntBig(u16, cleartext[ct_i..][0..2]);
669 ct_i += 2;
670 std.debug.print("{d} bytes of encrypted extensions\n", .{
671 ext_size,
672 });
673 },
674 @enumToInt(HandshakeType.certificate) => {
675 std.debug.print("cool certificate bro\n", .{});
676 },
677 @enumToInt(HandshakeType.certificate_verify) => {
678 std.debug.print("the certificate came with a fancy signature\n", .{});
679 },
680 @enumToInt(HandshakeType.finished) => {
681 // This message is to trick buggy proxies into behaving correctly.
682 const client_change_cipher_spec_msg = [_]u8{
683 @enumToInt(ContentType.change_cipher_spec),
684 0x03, 0x03, // legacy protocol version
685 0x00, 0x01, // length
686 0x01,
687 };
688 const app_cipher = switch (cipher_params) {
689 inline .TLS_AES_128_GCM_SHA256, .TLS_AES_256_GCM_SHA384 => |*p, tag| c: {
690 const P = @TypeOf(p.*);
691 // TODO verify the server's data
692 const handshake_hash = p.transcript_hash.finalResult();
693 const verify_data = hmac(P.Hmac, &handshake_hash, p.client_finished_key);
694 const out_cleartext = [_]u8{
695 @enumToInt(HandshakeType.finished),
696 0, 0, verify_data.len, // length
697 } ++ verify_data ++ [1]u8{@enumToInt(ContentType.handshake)};
698
699 const wrapped_len = out_cleartext.len + P.AEAD.tag_length;
700
701 var finished_msg = [_]u8{
702 @enumToInt(ContentType.application_data),
703 0x03, 0x03, // legacy protocol version
704 0, wrapped_len, // byte length of encrypted record
705 } ++ ([1]u8{undefined} ** wrapped_len);
706
707 const ad = finished_msg[0..5];
708 const ciphertext = finished_msg[5..][0..out_cleartext.len];
709 const auth_tag = finished_msg[finished_msg.len - P.AEAD.tag_length ..];
710 const nonce = p.client_handshake_iv;
711 P.AEAD.encrypt(ciphertext, auth_tag, &out_cleartext, ad, nonce, p.client_handshake_key);
712
713 const both_msgs = client_change_cipher_spec_msg ++ finished_msg;
714 try stream.writeAll(&both_msgs);
715
716 const client_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "c ap traffic", &handshake_hash, P.Hash.digest_length);
717 const server_secret = hkdfExpandLabel(P.Hkdf, p.master_secret, "s ap traffic", &handshake_hash, P.Hash.digest_length);
718 //std.debug.print("master_secret={}\nclient_secret={}\nserver_secret={}\n", .{
719 // std.fmt.fmtSliceHexLower(&p.master_secret),
720 // std.fmt.fmtSliceHexLower(&client_secret),
721 // std.fmt.fmtSliceHexLower(&server_secret),
722 //});
723 break :c @unionInit(ApplicationCipher, @tagName(tag), .{
724 .client_key = hkdfExpandLabel(P.Hkdf, client_secret, "key", "", P.AEAD.key_length),
725 .server_key = hkdfExpandLabel(P.Hkdf, server_secret, "key", "", P.AEAD.key_length),
726 .client_iv = hkdfExpandLabel(P.Hkdf, client_secret, "iv", "", P.AEAD.nonce_length),
727 .server_iv = hkdfExpandLabel(P.Hkdf, server_secret, "iv", "", P.AEAD.nonce_length),
728 });
729 },
730 .TLS_CHACHA20_POLY1305_SHA256 => {
731 @panic("TODO");
732 },
733 .TLS_AES_128_CCM_SHA256 => {
734 @panic("TODO");
735 },
736 .TLS_AES_128_CCM_8_SHA256 => {
737 @panic("TODO");
738 },
739 };
740 std.debug.print("remaining bytes: {d}\n", .{len - end});
741 return .{
742 .application_cipher = app_cipher,
743 .read_seq = 0,
744 .write_seq = 0,
745 .partially_read_buffer = undefined,
746 .partially_read_len = 0,
747 .eof = false,
748 };
749 },
750 else => {
751 std.debug.print("handshake type: {d}\n", .{cleartext[0]});
752 return error.TlsUnexpectedMessage;
753 },
754 }
755 ct_i = next_handshake_i;
756 if (ct_i >= cleartext.len - 1) break;
742757 }
743758 },
744759 else => {
745 std.debug.print("inner content type: {d}\n", .{inner_ct});
760 std.debug.print("inner content type: {any}\n", .{inner_ct});
746761 return error.TlsUnexpectedMessage;
747762 },
748763 }
......@@ -803,7 +818,7 @@ pub fn write(tls: *Tls, stream: net.Stream, bytes: []const u8) !usize {
803818 tls.write_seq += 1;
804819 const nonce: [P.AEAD.nonce_length]u8 = @as(V, p.client_iv) ^ operand;
805820 P.AEAD.encrypt(ciphertext, auth_tag, cleartext, ad, nonce, p.client_key);
806 //std.debug.print("seq: {d} nonce: {} client_key: {} client_iv: {} ad: {} auth_tag: {}\nserver_key: {} server_iv: {}", .{
821 //std.debug.print("seq: {d} nonce: {} client_key: {} client_iv: {} ad: {} auth_tag: {}\nserver_key: {} server_iv: {}\n", .{
807822 // tls.write_seq - 1,
808823 // std.fmt.fmtSliceHexLower(&nonce),
809824 // std.fmt.fmtSliceHexLower(&p.client_key),