/
githubmirror
/
gnutls
Обзор
Документация
Войти
/
githubmirror
/
gnutls
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
lib/auth/vko_gost.c
306 строк
9 KB
Daiki Ueno
auth: use DECR_LEN without intermediate variable
12 авг 2026, 15:27
12 авг 2026, 15:27
b2ad43c
Код
Авторство
О чём код?
/* * Copyright (C) 2011-2012 Free Software Foundation, Inc. * Copyright (C) 2016 Dmitry Eremin-Solenikov * * This file is part of GnuTLS. * * The GnuTLS is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public License * as published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this program. If not, see <https://www.gnu.org/licenses/> * */ #include "gnutls_int.h" #include "auth.h" #include "errors.h" #include "vko.h" #include "state.h" #include "datum.h" #include "ext/signature.h" #include "ext/supported_groups.h" #include "auth/cert.h" #include "pk.h" #include "abstract_int.h" #if defined(ENABLE_GOST) static int gen_vko_gost_client_kx(gnutls_session_t, gnutls_buffer_st *); static int proc_vko_gost_client_kx(gnutls_session_t session, uint8_t *data, size_t data_size); /* VKO GOST Key Exchange: * see draft-smyshlyaev-tls12-gost-suites-06, Section 4.2.4 * * Client generates ephemeral key pair, uses server's public key (from * certificate), ephemeral private key and additional nonce (UKM) to generate * (VKO) shared point/shared secret. This secret is used to encrypt (key wrap) * random PMS. Then encrypted PMS and client's ephemeral public key are wrappen * in ASN.1 structure and sent in KX message. * * Server uses decodes ASN.1 structure and uses its own private key and * client's ephemeral public key to unwrap PMS. * * Note, this KX is not PFS one, despite using ephemeral key pairs on client * side. */ const mod_auth_st vko_gost_auth_struct = { "VKO_GOST", _gnutls_gen_cert_server_crt, _gnutls_gen_cert_client_crt, NULL, gen_vko_gost_client_kx, _gnutls_gen_cert_client_crt_vrfy, _gnutls_gen_cert_server_cert_req, _gnutls_proc_crt, _gnutls_proc_crt, NULL, proc_vko_gost_client_kx, _gnutls_proc_cert_client_crt_vrfy, _gnutls_proc_cert_cert_req }; #define VKO_GOST_UKM_LEN 8 static int calc_ukm(gnutls_session_t session, uint8_t *ukm) { gnutls_digest_algorithm_t digalg = GNUTLS_DIG_STREEBOG_256; gnutls_hash_hd_t dig; int ret; ret = gnutls_hash_init(&dig, digalg); if (ret < 0) return gnutls_assert_val(ret); gnutls_hash(dig, session->security_parameters.client_random, sizeof(session->security_parameters.client_random)); gnutls_hash(dig, session->security_parameters.server_random, sizeof(session->security_parameters.server_random)); gnutls_hash_deinit(dig, ukm); return gnutls_hash_get_len(digalg); } static int print_priv_key(gnutls_pk_params_st *params) { int ret; uint8_t priv_buf[512 / 8]; char buf[512 / 4 + 1]; size_t bytes = sizeof(priv_buf); /* Check if _gnutls_hard_log will print anything */ if (likely(_gnutls_log_level < 9)) return GNUTLS_E_SUCCESS; ret = _gnutls_mpi_print(params->params[GOST_K], priv_buf, &bytes); if (ret < 0) return gnutls_assert_val(ret); _gnutls_hard_log("INT: VKO PRIVATE KEY[%zd]: %s\n", bytes, _gnutls_bin2hex(priv_buf, bytes, buf, sizeof(buf), NULL)); return 0; } static int vko_prepare_client_keys(gnutls_session_t session, gnutls_pk_params_st *pub, gnutls_pk_params_st *priv) { int ret; gnutls_ecc_curve_t curve; const gnutls_group_entry_st *group; cert_auth_info_t info; gnutls_pcert_st peer_cert; info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE); if (info == NULL || info->ncerts == 0) return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); ret = _gnutls_get_auth_info_pcert( &peer_cert, session->security_parameters.server_ctype, info); if (ret < 0) return gnutls_assert_val(ret); /* Copy public key contents and free the rest */ memcpy(pub, &peer_cert.pubkey->params, sizeof(gnutls_pk_params_st)); gnutls_free(peer_cert.pubkey); peer_cert.pubkey = NULL; gnutls_pcert_deinit(&peer_cert); curve = pub->curve; group = _gnutls_id_to_group(_gnutls_ecc_curve_get_group(curve)); if (group == NULL) { _gnutls_debug_log("received unknown curve %d\n", curve); return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); } else { _gnutls_debug_log("received curve %s\n", group->name); } if (!_gnutls_session_supports_group(session, group)) return gnutls_assert_val(GNUTLS_E_ECC_UNSUPPORTED_CURVE); if (pub->algo == GNUTLS_PK_GOST_12_512) { gnutls_sign_algorithm_set_server(session, GNUTLS_SIGN_GOST_512); } else { gnutls_sign_algorithm_set_server(session, GNUTLS_SIGN_GOST_256); } _gnutls_session_group_set(session, group); ret = _gnutls_pk_generate_keys(pub->algo, curve, priv, 1); if (ret < 0) return gnutls_assert_val(ret); priv->gost_params = pub->gost_params; print_priv_key(priv); session->key.key.size = 32; /* GOST key size */ session->key.key.data = gnutls_malloc(session->key.key.size); if (session->key.key.data == NULL) { gnutls_assert(); session->key.key.size = 0; return GNUTLS_E_MEMORY_ERROR; } /* Generate random */ ret = gnutls_rnd(GNUTLS_RND_RANDOM, session->key.key.data, session->key.key.size); if (ret < 0) { gnutls_assert(); gnutls_free(session->key.key.data); session->key.key.size = 0; return ret; } return 0; } /* KX message is: TLSGostKeyTransportBlob ::= SEQUENCE { keyBlob GostR3410-KeyTransport, proxyKeyBlobs SEQUENCE OF TLSProxyKeyTransportBlob OPTIONAL } draft-smyshlyaev-tls12-gost-suites does not define proxyKeyBlobs, but old CSPs still send additional information after keyBlob. We only need keyBlob and we completely ignore the rest of the structure. _gnutls_gost_keytrans_decrypt will decrypt GostR3410-KeyTransport */ static int proc_vko_gost_client_kx(gnutls_session_t session, uint8_t *data, size_t data_size) { int ret, i = 0; gnutls_privkey_t privkey = session->internals.selected_key; uint8_t ukm_data[MAX_HASH_SIZE]; gnutls_datum_t ukm = { ukm_data, VKO_GOST_UKM_LEN }; gnutls_datum_t cek; int len; if (!privkey || privkey->type != GNUTLS_PRIVKEY_X509) return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); /* Skip TLSGostKeyTransportBlob tag and length */ DECR_LEN(data_size, 1); if (data[0] != (ASN1_TAG_SEQUENCE | ASN1_CLASS_STRUCTURED)) return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); i += 1; ret = asn1_get_length_der(&data[i], data_size, &len); if (ret < 0) return gnutls_assert_val(GNUTLS_E_ASN1_DER_ERROR); DECR_LEN(data_size, (size_t)len); i += len; /* Check that nothing is left after TLSGostKeyTransportBlob */ DECR_LEN_FINAL(data_size, (size_t)ret); /* Point data to GostR3410-KeyTransport */ data_size = ret; data += i; /* Now do the tricky part: determine length of GostR3410-KeyTransport */ DECR_LEN(data_size, 1); /* tag */ ret = asn1_get_length_der(&data[1], data_size, &len); DECR_LEN_FINAL(data_size, (size_t)len + ret); cek.data = data; cek.size = ret + len + 1; ret = calc_ukm(session, ukm_data); if (ret < 0) return gnutls_assert_val(ret); ret = _gnutls_gost_keytrans_decrypt(&privkey->key.x509->params, &cek, &ukm, &session->key.key); if (ret < 0) return gnutls_assert_val(ret); return 0; } static int gen_vko_gost_client_kx(gnutls_session_t session, gnutls_buffer_st *data) { int ret; gnutls_datum_t out = {}; uint8_t ukm_data[MAX_HASH_SIZE]; gnutls_datum_t ukm = { ukm_data, VKO_GOST_UKM_LEN }; gnutls_pk_params_st pub; gnutls_pk_params_st priv; uint8_t tl[1 + ASN1_MAX_LENGTH_SIZE]; int len; ret = calc_ukm(session, ukm_data); if (ret < 0) return gnutls_assert_val(ret); gnutls_pk_params_init(&pub); gnutls_pk_params_init(&priv); ret = vko_prepare_client_keys(session, &pub, &priv); if (ret < 0) return gnutls_assert_val(ret); ret = _gnutls_gost_keytrans_encrypt(&pub, &priv, &session->key.key, &ukm, &out); if (ret < 0) { gnutls_assert(); goto cleanup; } tl[0] = ASN1_TAG_SEQUENCE | ASN1_CLASS_STRUCTURED; asn1_length_der(out.size, tl + 1, &len); ret = gnutls_buffer_append_data(data, tl, len + 1); if (ret < 0) { gnutls_assert(); goto cleanup; } ret = gnutls_buffer_append_data(data, out.data, out.size); if (ret < 0) { gnutls_assert(); goto cleanup; } ret = data->length; cleanup: /* no longer needed */ gnutls_pk_params_release(&priv); gnutls_pk_params_release(&pub); _gnutls_free_datum(&out); return ret; } #endif