From 9c0b15a08a48b72fe63ccd5b046ff9199212d10b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 7 May 2018 11:51:41 +0200 Subject: gnutls_ext_raw_parse: introduced GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO This allows parsing extensions from a DTLS client hello. Signed-off-by: Nikos Mavrogiannopoulos --- doc/cha-gtls-app.texi | 2 +- lib/extv.c | 50 ++++++- lib/includes/gnutls/gnutls.h.in | 3 +- tests/Makefile.am | 2 +- tests/gnutls_ext_raw_parse.c | 4 +- tests/gnutls_ext_raw_parse_dtls.c | 292 ++++++++++++++++++++++++++++++++++++++ 6 files changed, 345 insertions(+), 8 deletions(-) create mode 100644 tests/gnutls_ext_raw_parse_dtls.c diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi index c775f4b2c1..05e1e03a49 100644 --- a/doc/cha-gtls-app.texi +++ b/doc/cha-gtls-app.texi @@ -1604,7 +1604,7 @@ handshake_hook_func(gnutls_session_t session, unsigned int htype, assert(when == GNUTLS_HOOK_PRE); ret = gnutls_ext_raw_parse(NULL, ext_hook_func, msg, - GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO); + GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO); assert(ret >= 0); gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cred); diff --git a/lib/extv.c b/lib/extv.c index 0abfd370fb..88b723ef39 100644 --- a/lib/extv.c +++ b/lib/extv.c @@ -83,13 +83,13 @@ int _gnutls_extv_parse(void *ctx, * @ctx: a pointer to pass to callback function * @cb: callback function to process each extension found * @data: TLS extension data - * @flags: should be zero or %GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO + * @flags: should be zero or %GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO or %GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO * * This function iterates through the TLS extensions as passed in * @data, passing the individual extension data to callback. The * @data must conform to Extension extensions<0..2^16-1> format. * - * If flags is %GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO then this function + * If flags is %GNUTLS_EXT_RAW_TLS_FLAG_CLIENT_HELLO then this function * will parse the extension data from the position, as if the packet in * @data is a client hello (without record or handshake headers) - * as provided by gnutls_handshake_set_hook_function(). @@ -104,7 +104,7 @@ int _gnutls_extv_parse(void *ctx, int gnutls_ext_raw_parse(void *ctx, gnutls_ext_raw_process_func cb, const gnutls_datum_t *data, unsigned int flags) { - if (flags & GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO) { + if (flags & GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO) { ssize_t size = data->size; size_t len; uint8_t *p = data->data; @@ -137,6 +137,50 @@ int gnutls_ext_raw_parse(void *ctx, gnutls_ext_raw_process_func cb, DECR_LEN(size, len); p += len; + if (size <= 0) + return gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE); + + return _gnutls_extv_parse(ctx, cb, p, size); + } else if (flags & GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO) { + ssize_t size = data->size; + size_t len; + uint8_t *p = data->data; + + DECR_LEN(size, HANDSHAKE_SESSION_ID_POS); + + if (p[0] != 254) + return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_VERSION_PACKET); + + p += HANDSHAKE_SESSION_ID_POS; + + /* skip session id */ + DECR_LEN(size, 1); + len = p[0]; + p++; + DECR_LEN(size, len); + p += len; + + /* skip cookie */ + DECR_LEN(size, 1); + len = p[0]; + p++; + DECR_LEN(size, len); + p += len; + + /* CipherSuites */ + DECR_LEN(size, 2); + len = _gnutls_read_uint16(p); + p += 2; + DECR_LEN(size, len); + p += len; + + /* legacy_compression_methods */ + DECR_LEN(size, 1); + len = p[0]; + p++; + DECR_LEN(size, len); + p += len; + if (size <= 0) return gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE); diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in index 139355b0cb..b6473b98b5 100644 --- a/lib/includes/gnutls/gnutls.h.in +++ b/lib/includes/gnutls/gnutls.h.in @@ -2724,7 +2724,8 @@ typedef int (*gnutls_ext_pack_func) (gnutls_ext_priv_data_t data, typedef int (*gnutls_ext_unpack_func) (gnutls_buffer_t packed_data, gnutls_ext_priv_data_t *data); -#define GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO 1 +#define GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO 1 +#define GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO (1<<1) typedef int (*gnutls_ext_raw_process_func)(void *ctx, unsigned tls_id, const unsigned char *data, unsigned data_size); int gnutls_ext_raw_parse(void *ctx, gnutls_ext_raw_process_func cb, const gnutls_datum_t *data, unsigned int flags); diff --git a/tests/Makefile.am b/tests/Makefile.am index 4243c5befe..f29da98724 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -193,7 +193,7 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei x509sign-verify-error rng-op-nonce rng-op-random rng-op-key x509-dn-decode-compat \ ip-check mini-x509-ipaddr trust-store base64-raw random-art dhex509self \ dss-sig-val sign-pk-api tls-session-ext-override mini-record-pad \ - tls13-server-kx-neg + tls13-server-kx-neg gnutls_ext_raw_parse_dtls if HAVE_SECCOMP_TESTS ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp diff --git a/tests/gnutls_ext_raw_parse.c b/tests/gnutls_ext_raw_parse.c index 8f1801fb8a..2ffbb77896 100644 --- a/tests/gnutls_ext_raw_parse.c +++ b/tests/gnutls_ext_raw_parse.c @@ -51,7 +51,7 @@ int main() #include "cert-common.h" #include "tls13/ext-parse.h" -/* This program tests gnutls_ext_raw_parse with GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO +/* This program tests gnutls_ext_raw_parse with GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO * flag. */ @@ -110,7 +110,7 @@ static int handshake_callback(gnutls_session_t session, unsigned int htype, if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO && post) { if (bare_version) { - ret = gnutls_ext_raw_parse(NULL, ext_callback, msg, GNUTLS_EXT_RAW_FLAG_CLIENT_HELLO); + ret = gnutls_ext_raw_parse(NULL, ext_callback, msg, GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO); } else { unsigned pos; gnutls_datum_t mmsg; diff --git a/tests/gnutls_ext_raw_parse_dtls.c b/tests/gnutls_ext_raw_parse_dtls.c new file mode 100644 index 0000000000..6efbb119ba --- /dev/null +++ b/tests/gnutls_ext_raw_parse_dtls.c @@ -0,0 +1,292 @@ +/* + * Copyright (C) 2018 Red Hat, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program. If not, see + */ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#include +#include + +#if defined(_WIN32) + +int main() +{ + exit(77); +} + +#else + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "utils.h" +#include "cert-common.h" +#include "tls13/ext-parse.h" + +/* This program tests gnutls_ext_raw_parse with GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO + * flag. + */ + +#define HOSTNAME "example.com" + +static void server_log_func(int level, const char *str) +{ + fprintf(stderr, "server|<%d>| %s", level, str); +} + +static void client_log_func(int level, const char *str) +{ + fprintf(stderr, "client|<%d>| %s", level, str); +} + +static unsigned found_server_name = 0; +static unsigned found_status_req = 0; + +static int ext_callback(void *ctx, unsigned tls_id, const unsigned char *data, unsigned size) +{ + if (tls_id == 0) { /* server name */ + /* very interesting extension, 4 bytes of sizes + * and 1 byte of type. */ + unsigned esize = (data[0] << 8) | data[1]; + assert(esize == strlen(HOSTNAME)+3); + + size -= 2; + data += 2; + + assert(data[0] == 0); + data++; + size--; + + esize = (data[0] << 8) | data[1]; + + assert(esize == strlen(HOSTNAME)); + data += 2; + size -= 2; + + assert(memcmp(data, HOSTNAME, strlen(HOSTNAME)) == 0); + found_server_name = 1; + } else if (tls_id == 5) { + found_status_req = 1; + } else { + if (debug) + success("found extension: %u\n", tls_id); + } + return 0; +} + +static int handshake_callback(gnutls_session_t session, unsigned int htype, + unsigned post, unsigned int incoming, const gnutls_datum_t *msg) +{ + int ret; + + if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO && post) { + ret = gnutls_ext_raw_parse(NULL, ext_callback, msg, GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLO); + + assert(ret >= 0); + } + return 0; +} + +static void client(int fd) +{ + int ret; + gnutls_certificate_credentials_t x509_cred; + gnutls_session_t session; + + global_init(); + + if (debug) { + gnutls_global_set_log_function(client_log_func); + gnutls_global_set_log_level(7); + } + + gnutls_certificate_allocate_credentials(&x509_cred); + + /* Initialize TLS session + */ + gnutls_init(&session, GNUTLS_CLIENT|GNUTLS_DATAGRAM); + gnutls_handshake_set_timeout(session, 20 * 1000); + + assert(gnutls_priority_set_direct(session, "NORMAL:-VERS-ALL:+VERS-DTLS1.2", NULL)>= 0); + + gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); + + gnutls_transport_set_int(session, fd); + assert(gnutls_server_name_set(session, GNUTLS_NAME_DNS, HOSTNAME, strlen(HOSTNAME))>=0); + + /* Perform the TLS handshake + */ + do { + ret = gnutls_handshake(session); + } + while (ret < 0 && gnutls_error_is_fatal(ret) == 0); + + if (ret == GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM) { + /* success */ + goto end; + } + + if (ret < 0) { + fail("client: Handshake failed: %s\n", gnutls_strerror(ret)); + } else { + if (debug) + success("client: Handshake was completed\n"); + } + + if (debug) + success("client: TLS version is: %s\n", + gnutls_protocol_get_name + (gnutls_protocol_get_version(session))); + + gnutls_bye(session, GNUTLS_SHUT_WR); + + end: + + close(fd); + + gnutls_deinit(session); + + gnutls_certificate_free_credentials(x509_cred); + + gnutls_global_deinit(); +} + + +static void server(int fd) +{ + int ret; + gnutls_session_t session; + gnutls_certificate_credentials_t x509_cred; + + /* this must be called once in the program + */ + global_init(); + + if (debug) { + gnutls_global_set_log_function(server_log_func); + gnutls_global_set_log_level(4711); + } + + gnutls_certificate_allocate_credentials(&x509_cred); + gnutls_certificate_set_x509_key_mem(x509_cred, &server_cert, + &server_key, + GNUTLS_X509_FMT_PEM); + + gnutls_init(&session, GNUTLS_SERVER|GNUTLS_DATAGRAM); + gnutls_handshake_set_timeout(session, 20 * 1000); + + gnutls_handshake_set_hook_function(session, GNUTLS_HANDSHAKE_CLIENT_HELLO, + GNUTLS_HOOK_POST, + handshake_callback); + + assert(gnutls_priority_set_direct(session, "NORMAL:-VERS-ALL:+VERS-DTLS1.2", NULL)>= 0); + + gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); + + gnutls_transport_set_int(session, fd); + + do { + ret = gnutls_handshake(session); + } while (ret < 0 && gnutls_error_is_fatal(ret) == 0); + if (ret < 0) { + /* failure is expected here */ + goto end; + } + + if (debug) + success("server: Handshake was completed\n"); + + if (debug) + success("server: TLS version is: %s\n", + gnutls_protocol_get_name + (gnutls_protocol_get_version(session))); + + assert(found_server_name != 0); + assert(found_status_req != 0); + + gnutls_bye(session, GNUTLS_SHUT_WR); + + end: + close(fd); + gnutls_deinit(session); + + gnutls_certificate_free_credentials(x509_cred); + + gnutls_global_deinit(); + + if (debug) + success("server: finished\n"); +} + +static void ch_handler(int sig) +{ + return; +} + +void doit(void) +{ + int fd[2]; + int ret, status = 0; + pid_t child; + + signal(SIGCHLD, ch_handler); + signal(SIGPIPE, SIG_IGN); + + ret = socketpair(AF_UNIX, SOCK_STREAM, 0, fd); + if (ret < 0) { + perror("socketpair"); + exit(1); + } + + child = fork(); + if (child < 0) { + perror("fork"); + fail("fork"); + exit(1); + } + + if (child) { + /* parent */ + close(fd[1]); + server(fd[0]); + waitpid(child, &status, 0); + check_wait_status(status); + } else { + close(fd[0]); + client(fd[1]); + exit(0); + } + + return; +} + + +#endif /* _WIN32 */ -- cgit v1.2.1