lib/ext/safe_renegotiation.c - master - githubmirror/gnutls

lib/ext/safe_renegotiation.c
424 строки11 KB
Daiki Ueno
str: use _gnutls_buffer_append_uint*
10 авг 2026, 04:23
10 авг 2026, 04:23b1f0e6c
/*
 * Copyright (C) 2009-2012 Free Software Foundation, Inc.
 *
 * Author: Steve Dispensa (<dispensa@phonefactor.com>)
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

#include "gnutls_int.h"
#include "ext/safe_renegotiation.h"
#include "errors.h"

static int _gnutls_sr_recv_params(gnutls_session_t state, const uint8_t *data,
				  size_t data_size);
static int _gnutls_sr_send_params(gnutls_session_t state, gnutls_buffer_st *);
static void _gnutls_sr_deinit_data(gnutls_ext_priv_data_t priv);

const hello_ext_entry_st ext_mod_sr = {
	.name = "Safe Renegotiation",
	.tls_id = 65281,
	.gid = GNUTLS_EXTENSION_SAFE_RENEGOTIATION,
	.validity = GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS |
		    GNUTLS_EXT_FLAG_CLIENT_HELLO |
		    GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO,
	.client_parse_point = GNUTLS_EXT_MANDATORY,
	.server_parse_point = GNUTLS_EXT_MANDATORY,
	.recv_func = _gnutls_sr_recv_params,
	.send_func = _gnutls_sr_send_params,
	.pack_func = NULL,
	.unpack_func = NULL,
	.deinit_func = _gnutls_sr_deinit_data,
	.cannot_be_overriden = 1
};

int _gnutls_ext_sr_finished(gnutls_session_t session, void *vdata,
			    size_t vdata_size, int dir)
{
	int ret;
	sr_ext_st *priv;
	gnutls_ext_priv_data_t epriv;

	if (session->internals.priorities->sr == SR_DISABLED ||
	    session->internals.priorities->no_extensions) {
		return 0;
	}

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret < 0) {
		gnutls_assert();
		/* if a client didn't advertise safe renegotiation, we treat
		 * it as disabled. */
		if (session->security_parameters.entity == GNUTLS_SERVER)
			return 0;
		return ret;
	}
	priv = epriv;

	/* Save data for safe renegotiation. 
	 */
	if (vdata_size > MAX_VERIFY_DATA_SIZE) {
		gnutls_assert();
		return GNUTLS_E_INTERNAL_ERROR;
	}

	if ((session->security_parameters.entity == GNUTLS_CLIENT &&
	     dir == 0) ||
	    (session->security_parameters.entity == GNUTLS_SERVER &&
	     dir == 1)) {
		priv->client_verify_data_len = vdata_size;
		memcpy(priv->client_verify_data, vdata, vdata_size);
	} else {
		priv->server_verify_data_len = vdata_size;
		memcpy(priv->server_verify_data, vdata, vdata_size);
	}

	return 0;
}

int _gnutls_ext_sr_verify(gnutls_session_t session)
{
	int ret;
	sr_ext_st *priv = NULL;
	gnutls_ext_priv_data_t epriv;

	if (session->internals.priorities->sr == SR_DISABLED) {
		gnutls_assert();
		return 0;
	}

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret >= 0)
		priv = epriv;

	/* Safe renegotiation */

	if (priv && priv->safe_renegotiation_received) {
		if ((priv->ri_extension_data_len <
		     priv->client_verify_data_len) ||
		    (memcmp(priv->ri_extension_data, priv->client_verify_data,
			    priv->client_verify_data_len))) {
			gnutls_assert();
			_gnutls_handshake_log(
				"HSK[%p]: Safe renegotiation failed [1]\n",
				session);
			return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
		}

		if (session->security_parameters.entity == GNUTLS_CLIENT) {
			if ((priv->ri_extension_data_len !=
			     priv->client_verify_data_len +
				     priv->server_verify_data_len) ||
			    memcmp(priv->ri_extension_data +
					   priv->client_verify_data_len,
				   priv->server_verify_data,
				   priv->server_verify_data_len) != 0) {
				gnutls_assert();
				_gnutls_handshake_log(
					"HSK[%p]: Safe renegotiation failed [2]\n",
					session);
				return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
			}
		} else { /* Make sure there are 0 extra bytes */

			if (priv->ri_extension_data_len !=
			    priv->client_verify_data_len) {
				gnutls_assert();
				_gnutls_handshake_log(
					"HSK[%p]: Safe renegotiation failed [3]\n",
					session);
				return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
			}
		}

		_gnutls_handshake_log("HSK[%p]: Safe renegotiation succeeded\n",
				      session);
	} else { /* safe renegotiation not received... */

		if (priv && priv->connection_using_safe_renegotiation) {
			gnutls_assert();
			_gnutls_handshake_log(
				"HSK[%p]: Peer previously asked for safe renegotiation\n",
				session);
			return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
		}

		/* Clients can't tell if it's an initial negotiation */
		if (session->internals.initial_negotiation_completed) {
			if (session->internals.priorities->sr < SR_PARTIAL) {
				_gnutls_handshake_log(
					"HSK[%p]: Allowing unsafe (re)negotiation\n",
					session);
			} else {
				gnutls_assert();
				_gnutls_handshake_log(
					"HSK[%p]: Denying unsafe (re)negotiation\n",
					session);
				return GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED;
			}
		} else {
			if (session->internals.priorities->sr < SR_SAFE) {
				_gnutls_handshake_log(
					"HSK[%p]: Allowing unsafe initial negotiation\n",
					session);
			} else {
				gnutls_assert();
				_gnutls_handshake_log(
					"HSK[%p]: Denying unsafe initial negotiation\n",
					session);
				return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
			}
		}
	}

	return 0;
}

/* if a server received the special ciphersuite.
 */
int _gnutls_ext_sr_recv_cs(gnutls_session_t session)
{
	int ret, set = 0;
	sr_ext_st *priv;
	gnutls_ext_priv_data_t epriv;

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret < 0) {
		set = 1;
	}

	if (set != 0) {
		priv = gnutls_calloc(1, sizeof(*priv));
		if (priv == NULL) {
			gnutls_assert();
			return GNUTLS_E_MEMORY_ERROR;
		}
		epriv = priv;
	} else
		priv = epriv;

	priv->safe_renegotiation_received = 1;
	priv->connection_using_safe_renegotiation = 1;
	_gnutls_hello_ext_save_sr(session);

	if (set != 0)
		_gnutls_hello_ext_set_priv(
			session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, epriv);

	return 0;
}

int _gnutls_ext_sr_send_cs(gnutls_session_t session)
{
	int ret, set = 0;
	sr_ext_st *priv;
	gnutls_ext_priv_data_t epriv;

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret < 0) {
		set = 1;
	}

	if (set != 0) {
		priv = gnutls_calloc(1, sizeof(*priv));
		if (priv == NULL) {
			gnutls_assert();
			return GNUTLS_E_MEMORY_ERROR;
		}
		epriv = priv;

		_gnutls_hello_ext_set_priv(
			session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, epriv);
	}

	return 0;
}

static int _gnutls_sr_recv_params(gnutls_session_t session, const uint8_t *data,
				  size_t data_size)
{
	unsigned int len;
	sr_ext_st *priv;
	gnutls_ext_priv_data_t epriv;
	int set = 0, ret;

	if (data_size == 0)
		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

	len = data[0];
	DECR_LEN(data_size, len + 1 /* count the first byte and payload */);

	if (session->internals.priorities->sr == SR_DISABLED) {
		gnutls_assert();
		return 0;
	}

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret < 0 && session->security_parameters.entity == GNUTLS_SERVER) {
		set = 1;
	} else if (ret < 0) {
		gnutls_assert();
		return ret;
	}

	if (set != 0) {
		priv = gnutls_calloc(1, sizeof(*priv));
		if (priv == NULL) {
			gnutls_assert();
			return GNUTLS_E_MEMORY_ERROR;
		}
		epriv = priv;

		_gnutls_hello_ext_set_priv(
			session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, epriv);
	} else {
		priv = epriv;
	}

	/* It is not legal to receive this extension on a renegotiation and
	 * not receive it on the initial negotiation.
	 */
	if (session->internals.initial_negotiation_completed != 0 &&
	    priv->connection_using_safe_renegotiation == 0) {
		gnutls_assert();
		return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
	}

	if (len > sizeof(priv->ri_extension_data)) {
		gnutls_assert();
		return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
	}

	if (len > 0)
		memcpy(priv->ri_extension_data, &data[1], len);
	priv->ri_extension_data_len = len;

	/* "safe renegotiation received" means on *this* handshake; "connection using
	 * safe renegotiation" means that the initial hello received on the connection
	 * indicated safe renegotiation.
	 */
	priv->safe_renegotiation_received = 1;
	priv->connection_using_safe_renegotiation = 1;

	return 0;
}

static int _gnutls_sr_send_params(gnutls_session_t session,
				  gnutls_buffer_st *extdata)
{
	/* The format of this extension is a one-byte length of verify data followed
	 * by the verify data itself. Note that the length byte does not include
	 * itself; IOW, empty verify data is represented as a length of 0. That means
	 * the minimum extension is one byte: 0x00.
	 */
	sr_ext_st *priv;
	int ret, set = 0, len;
	gnutls_ext_priv_data_t epriv;
	size_t init_length = extdata->length;

	if (session->internals.priorities->sr == SR_DISABLED) {
		gnutls_assert();
		return 0;
	}

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret < 0) {
		set = 1;
	}

	if (set != 0) {
		priv = gnutls_calloc(1, sizeof(*priv));
		if (priv == NULL) {
			gnutls_assert();
			return GNUTLS_E_MEMORY_ERROR;
		}
		epriv = priv;

		_gnutls_hello_ext_set_priv(
			session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, epriv);
	} else
		priv = epriv;

	/* Always offer the extension if we're a client */
	if (priv->connection_using_safe_renegotiation ||
	    session->security_parameters.entity == GNUTLS_CLIENT) {
		len = priv->client_verify_data_len;
		if (session->security_parameters.entity == GNUTLS_SERVER)
			len += priv->server_verify_data_len;

		ret = _gnutls_buffer_append_uint8(extdata, len);
		if (ret < 0)
			return gnutls_assert_val(ret);

		ret = _gnutls_buffer_append_data(extdata,
						 priv->client_verify_data,
						 priv->client_verify_data_len);
		if (ret < 0)
			return gnutls_assert_val(ret);

		if (session->security_parameters.entity == GNUTLS_SERVER) {
			ret = _gnutls_buffer_append_data(
				extdata, priv->server_verify_data,
				priv->server_verify_data_len);
			if (ret < 0)
				return gnutls_assert_val(ret);
		}
	} else
		return 0;

	return extdata->length - init_length;
}

static void _gnutls_sr_deinit_data(gnutls_ext_priv_data_t priv)
{
	gnutls_free(priv);
}

/**
 * gnutls_safe_renegotiation_status:
 * @session: is a #gnutls_session_t type.
 *
 * Can be used to check whether safe renegotiation is being used
 * in the current session.
 *
 * Returns: 0 when safe renegotiation is not used and non (0) when
 *   safe renegotiation is used.
 *
 * Since: 2.10.0
 **/
unsigned gnutls_safe_renegotiation_status(gnutls_session_t session)
{
	int ret;
	sr_ext_st *priv;
	gnutls_ext_priv_data_t epriv;

	ret = _gnutls_hello_ext_get_priv(
		session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION, &epriv);
	if (ret < 0) {
		gnutls_assert();
		return 0;
	}
	priv = epriv;

	return priv->connection_using_safe_renegotiation;
}