emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
14,494 Commits 1 Branch 0 Tags 33 MiB
a9e1866806
Commit Graph

17 Commits

Author SHA1 Message Date
Denys Vlasenko
a9e1866806 tls: trim comments 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-18 21:00:23 +01:00
Denys Vlasenko
b5dfc3dfd6 tls: teach it to send AES256-encrypted data 
>> CLIENT_HELLO
wrote 50 bytes
insize:0 tail:0
got block len:74
got HANDSHAKE
<< SERVER_HELLO
insize:79 tail:0
got block len:2397
got HANDSHAKE
<< CERTIFICATE
key bytes:271, first:0x00
server_rsa_pub_key.size:256
insize:2402 tail:0
got block len:4
got HANDSHAKE
<< SERVER_HELLO_DONE
>> CLIENT_KEY_EXCHANGE
wrote 267 bytes
master secret:c51df5b1e3b3f57373cdd8ea28e8ce562059636cf9f585d0b89c7f4bacec97e674d7b91f93e7b500cb64637f240c3b78
client_write_MAC_key:3b0b7e2bab241b629c37eb3a3824f09b39fe71a00876b0c8026dda16ef0d2f82
client_write_key:d36e801470ed2f0a8fc886ac25df57ffbe4265d06e3192122c4ef4df1e32fab2
>> CHANGE_CIPHER_SPEC
from secret: c51df5b1e3b3f57373cdd8ea28e8ce562059636cf9f585d0b89c7f4bacec97e674d7b91f93e7b500cb64637f240c3b78
from labelSeed: 636c69656e742066696e6973686564b22e0e6008b8ee218cc02e4a93e4a42b570535f9b57662e262d43b379d125b69
=> digest: a45bfee8ed6507a2a9920d0c
>> FINISHED
before crypt: 5 hdr + 16 data + 32 hash bytes
writing 5 + 16 IV + 64 encrypted bytes, padding_length:0x0f
wrote 85 bytes
insize:9 tail:0
got block len:1
<< CHANGE_CIPHER_SPEC
insize:6 tail:0
got block len:80
< hdr_type:22 ver:3.3 len:80 type:21 len24:9541723 |1591985b...a3da|

The last line is the server's FINISHED response, encrypted.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-18 20:37:24 +01:00
Denys Vlasenko
b7e9ae6e9f tls: added AES code and made it compile. not used yet 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-18 17:20:27 +01:00
Denys Vlasenko
c8ba23bcec tls: massage writing for encryption support; finer-grained debug 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-18 06:45:50 +01:00
Denys Vlasenko
5d1662ea1c tls: address one easy FIXME, tidy up comments 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-17 18:17:27 +01:00
Denys Vlasenko
e69d78c038 tls: process CHANGE_CIPHER_SPEC and FINISHED from server 
Successfully finishes handshake with test servers using NULL-SHA256
cipher.

The "only" thing remaining before there is a chance
this can actually work with real servers is AES encrypt/decrypt.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-17 17:24:11 +01:00
Denys Vlasenko
fe0588df3b tls: rearrange function order, improve comments 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-17 17:04:24 +01:00
Denys Vlasenko
e2cb3b990f tls: make our send_client_finished() pass server check 
sha256 hash should be calculated over incoming handshake packets too!

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-17 16:53:36 +01:00
Denys Vlasenko
9a6897a48a tls: format FINISHED message properly for unencrypted, but sha256 signed mode 
Now it at least looks correct, but unfortunately "openssl s_server"
says my hash is wrong.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-16 23:26:33 +01:00
Denys Vlasenko
936e83e694 tls: add sha256 hmac and prf code 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-16 04:25:01 +01:00
Denys Vlasenko
3f8ecd933a tls: rearrange code, add/improve comments, fix whitespace, no real changes here 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-15 14:16:51 +01:00
Denys Vlasenko
c5540d61f6 tls: send CHANGE_CIPHER_SPEC 
To "actually implement it" will take more work...

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-15 02:17:03 +01:00
Denys Vlasenko
f78ad0938b whitespace fix 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-15 00:18:22 +01:00
Denys Vlasenko
11d0096516 tls: format and send CLIENT_KEY_EXCHANGE 
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C

Next step: send CHANGE_CIPHER_SPEC... and actually implement it.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-15 00:12:42 +01:00
Denys Vlasenko
2a17d1fc9b tls: DER length byte 0x81 is actually valid 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-14 22:38:25 +01:00
Denys Vlasenko
b1003f7019 tls: a bit more work 
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4406
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8f7e723:0x30 len:1452 inner_byte @0x8f7e727:0x30
entered der @0x8f7e727:0x30 len:1172 inner_byte @0x8f7e72b:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8f7e830:0x30 len:418 inner_byte @0x8f7e834:0x30
skipped der 0x30, next byte 0x03
entered der @0x8f7e843:0x03 len:399 inner_byte @0x8f7e847:0x00
copying key bytes:399, first:0x00
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE

Now need to teach it to send ClientKeyExchange...

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-14 13:57:16 +01:00
Denys Vlasenko
ceff6b0ea9 tls: work-in-progress TLS1.2 test applet 
function                                             old     new   delta
tls_main                                               -     733    +733
dump                                                   -     230    +230
xread_tls_block                                        -     180    +180
get_der_len                                            -      76     +76
enter_der_item                                         -      70     +70
skip_der_item                                          -      56     +56
get24be                                                -      24     +24
tls_error_die                                          -      19     +19
packed_usage                                       31010   31027     +17
applet_names                                        2549    2553      +4
applet_main                                         1472    1476      +4
applet_suid                                           92      93      +1
applet_install_loc                                   184     185      +1
------------------------------------------------------------------------------
(add/remove: 9/0 grow/shrink: 5/0 up/down: 1415/0)           Total: 1415 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
 2017-01-14 12:49:32 +01:00