tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
/*
|
|
|
|
* Copyright (C) 2017 Denys Vlasenko
|
|
|
|
*
|
|
|
|
* Licensed under GPLv2, see file LICENSE in this source tree.
|
|
|
|
*/
|
2017-01-18 21:50:27 +05:30
|
|
|
/* Interface glue between bbox code and minimally tweaked matrixssl
|
|
|
|
* code. All C files (matrixssl and bbox (ones which need TLS))
|
|
|
|
* include this file, and guaranteed to see a consistent API,
|
|
|
|
* defines, types, etc.
|
|
|
|
*/
|
tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
#include "libbb.h"
|
|
|
|
|
2017-01-18 21:50:27 +05:30
|
|
|
|
|
|
|
/* Config tweaks */
|
|
|
|
#define HAVE_NATIVE_INT64
|
tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
#undef USE_1024_KEY_SPEED_OPTIMIZATIONS
|
|
|
|
#undef USE_2048_KEY_SPEED_OPTIMIZATIONS
|
2017-01-18 21:50:27 +05:30
|
|
|
#define USE_AES
|
|
|
|
#undef USE_AES_CBC_EXTERNAL
|
|
|
|
#undef USE_AES_CCM
|
|
|
|
#undef USE_AES_GCM
|
|
|
|
#undef USE_3DES
|
|
|
|
#undef USE_ARC4
|
|
|
|
#undef USE_IDEA
|
|
|
|
#undef USE_RC2
|
|
|
|
#undef USE_SEED
|
|
|
|
/* pstm: multiprecision numbers */
|
|
|
|
#undef DISABLE_PSTM
|
2017-07-15 20:43:08 +05:30
|
|
|
#if defined(__GNUC__) && defined(__i386__)
|
2017-01-19 21:02:38 +05:30
|
|
|
/* PSTM_X86 works correctly. +25 bytes. */
|
2017-01-18 21:50:27 +05:30
|
|
|
# define PSTM_32BIT
|
|
|
|
# define PSTM_X86
|
|
|
|
#endif
|
|
|
|
//#if defined(__GNUC__) && defined(__x86_64__)
|
2017-01-19 21:02:38 +05:30
|
|
|
// /* PSTM_X86_64 works correctly, but +782 bytes. */
|
|
|
|
// /* Looks like most of the growth is because of PSTM_64BIT. */
|
2017-01-18 21:50:27 +05:30
|
|
|
//# define PSTM_64BIT
|
|
|
|
//# define PSTM_X86_64
|
|
|
|
//#endif
|
|
|
|
//#if SOME_COND #define PSTM_MIPS, #define PSTM_32BIT
|
|
|
|
//#if SOME_COND #define PSTM_ARM, #define PSTM_32BIT
|
tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
|
|
|
|
|
|
|
|
#define PS_SUCCESS 0
|
|
|
|
#define PS_FAILURE -1
|
|
|
|
#define PS_ARG_FAIL -6 /* Failure due to bad function param */
|
|
|
|
#define PS_PLATFORM_FAIL -7 /* Failure as a result of system call error */
|
|
|
|
#define PS_MEM_FAIL -8 /* Failure to allocate requested memory */
|
|
|
|
#define PS_LIMIT_FAIL -9 /* Failure on sanity/limit tests */
|
|
|
|
|
|
|
|
#define PS_TRUE 1
|
|
|
|
#define PS_FALSE 0
|
|
|
|
|
|
|
|
#if BB_BIG_ENDIAN
|
|
|
|
# define ENDIAN_BIG 1
|
|
|
|
# undef ENDIAN_LITTLE
|
|
|
|
//#???? ENDIAN_32BITWORD
|
|
|
|
// controls only STORE32L, which we don't use
|
|
|
|
#else
|
|
|
|
# define ENDIAN_LITTLE 1
|
|
|
|
# undef ENDIAN_BIG
|
|
|
|
#endif
|
|
|
|
|
|
|
|
typedef uint64_t uint64;
|
|
|
|
typedef int64_t int64;
|
|
|
|
typedef uint32_t uint32;
|
|
|
|
typedef int32_t int32;
|
|
|
|
typedef uint16_t uint16;
|
|
|
|
typedef int16_t int16;
|
|
|
|
|
2017-01-19 20:21:00 +05:30
|
|
|
//typedef char psPool_t;
|
tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
|
|
|
|
//#ifdef PS_PUBKEY_OPTIMIZE_FOR_SMALLER_RAM
|
|
|
|
#define PS_EXPTMOD_WINSIZE 3
|
|
|
|
//#ifdef PS_PUBKEY_OPTIMIZE_FOR_FASTER_SPEED
|
|
|
|
//#define PS_EXPTMOD_WINSIZE 5
|
|
|
|
|
|
|
|
#define PUBKEY_TYPE 0x01
|
|
|
|
#define PRIVKEY_TYPE 0x02
|
|
|
|
|
|
|
|
void tls_get_random(void *buf, unsigned len);
|
|
|
|
|
|
|
|
#define matrixCryptoGetPrngData(buf, len, userPtr) (tls_get_random(buf, len), PS_SUCCESS)
|
|
|
|
|
|
|
|
#define psFree(p, pool) free(p)
|
2017-01-16 08:55:01 +05:30
|
|
|
#define psTraceCrypto(...) bb_error_msg_and_die(__VA_ARGS__)
|
tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
|
|
|
|
/* Secure zerofill */
|
|
|
|
#define memset_s(A,B,C,D) memset((A),(C),(D))
|
|
|
|
/* Constant time memory comparison */
|
|
|
|
#define memcmpct(s1, s2, len) memcmp((s1), (s2), (len))
|
2017-01-18 21:50:27 +05:30
|
|
|
#undef min
|
tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C
Next step: send CHANGE_CIPHER_SPEC... and actually implement it.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 04:42:42 +05:30
|
|
|
#define min(x, y) ((x) < (y) ? (x) : (y))
|
|
|
|
|
|
|
|
|
|
|
|
#include "tls_pstm.h"
|
2017-01-18 21:50:27 +05:30
|
|
|
#include "tls_symmetric.h"
|
|
|
|
#include "tls_aes.h"
|
2018-11-13 06:46:24 +05:30
|
|
|
#include "tls_rsa.h"
|
|
|
|
#include "tls_fe.h"
|