lib/gnutls_constate.c

   1 /*
   2  * Copyright (C) 2001-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 /* Functions that are supposed to run after the handshake procedure is
  24  * finished. These functions activate the established security parameters.
  25  */
  26
  27 #include <gnutls_int.h>
  28 #include <gnutls_constate.h>
  29 #include <gnutls_errors.h>
  30 #include <gnutls_kx.h>
  31 #include <algorithms.h>
  32 #include <gnutls_num.h>
  33 #include <gnutls_datum.h>
  34 #include <gnutls_state.h>
  35 #include <gnutls_extensions.h>
  36 #include <gnutls_buffers.h>
  37
  38 static const char keyexp[] = "key expansion";
  39 static const int keyexp_length = sizeof (keyexp) - 1;
  40
  41 static const char ivblock[] = "IV block";
  42 static const int ivblock_length = sizeof (ivblock) - 1;
  43
  44 static const char cliwrite[] = "client write key";
  45 static const int cliwrite_length = sizeof (cliwrite) - 1;
  46
  47 static const char servwrite[] = "server write key";
  48 static const int servwrite_length = sizeof (servwrite) - 1;
  49
  50 #define EXPORT_FINAL_KEY_SIZE 16
  51
  52 /* This function is to be called after handshake, when master_secret,
  53  *  client_random and server_random have been initialized.
  54  * This function creates the keys and stores them into pending session.
  55  * (session->cipher_specs)
  56  */
  57 static int
  58 _gnutls_set_keys (gnutls_session_t session, record_parameters_st * params,
  59                   int hash_size, int IV_size, int key_size, int export_flag)
  60 {
  61   /* FIXME: This function is too long
  62    */
  63   uint8_t rnd[2 * GNUTLS_RANDOM_SIZE];
  64   uint8_t rrnd[2 * GNUTLS_RANDOM_SIZE];
  65   int pos, ret;
  66   int block_size;
  67   char buf[65];
  68   /* avoid using malloc */
  69   uint8_t key_block[2 * MAX_HASH_SIZE + 2 * MAX_CIPHER_KEY_SIZE +
  70                    2 * MAX_CIPHER_BLOCK_SIZE];
  71   record_state_st *client_write, *server_write;
  72
  73   if (session->security_parameters.entity == GNUTLS_CLIENT)
  74     {
  75       client_write = &params->write;
  76       server_write = &params->read;
  77     }
  78   else
  79     {
  80       client_write = &params->read;
  81       server_write = &params->write;
  82     }
  83
  84   block_size = 2 * hash_size + 2 * key_size;
  85   if (export_flag == 0)
  86     block_size += 2 * IV_size;
  87
  88   memcpy (rnd, session->security_parameters.server_random,
  89           GNUTLS_RANDOM_SIZE);
  90   memcpy (&rnd[GNUTLS_RANDOM_SIZE],
  91           session->security_parameters.client_random, GNUTLS_RANDOM_SIZE);
  92
  93   memcpy (rrnd, session->security_parameters.client_random,
  94           GNUTLS_RANDOM_SIZE);
  95   memcpy (&rrnd[GNUTLS_RANDOM_SIZE],
  96           session->security_parameters.server_random, GNUTLS_RANDOM_SIZE);
  97
  98   if (session->security_parameters.version == GNUTLS_SSL3)
  99     {                           /* SSL 3 */
 100       ret =
 101         _gnutls_ssl3_generate_random
 102         (session->security_parameters.master_secret, GNUTLS_MASTER_SIZE, rnd,
 103          2 * GNUTLS_RANDOM_SIZE, block_size, key_block);
 104     }
 105   else
 106     {                           /* TLS 1.0 */
 107       ret =
 108         _gnutls_PRF (session, session->security_parameters.master_secret,
 109                      GNUTLS_MASTER_SIZE, keyexp, keyexp_length,
 110                      rnd, 2 * GNUTLS_RANDOM_SIZE, block_size, key_block);
 111     }
 112
 113   if (ret < 0)
 114     return gnutls_assert_val (ret);
 115
 116   _gnutls_hard_log ("INT: KEY BLOCK[%d]: %s\n", block_size,
 117                     _gnutls_bin2hex (key_block, block_size, buf,
 118                                      sizeof (buf), NULL));
 119
 120   pos = 0;
 121   if (hash_size > 0)
 122     {
 123
 124       if (_gnutls_set_datum
 125           (&client_write->mac_secret, &key_block[pos], hash_size) < 0)
 126         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 127
 128       pos += hash_size;
 129
 130       if (_gnutls_set_datum
 131           (&server_write->mac_secret, &key_block[pos], hash_size) < 0)
 132         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 133
 134       pos += hash_size;
 135     }
 136
 137   if (key_size > 0)
 138     {
 139       uint8_t key1[EXPORT_FINAL_KEY_SIZE];
 140       uint8_t key2[EXPORT_FINAL_KEY_SIZE];
 141       uint8_t *client_write_key, *server_write_key;
 142       int client_write_key_size, server_write_key_size;
 143
 144       if (export_flag == 0)
 145         {
 146           client_write_key = &key_block[pos];
 147           client_write_key_size = key_size;
 148
 149           pos += key_size;
 150
 151           server_write_key = &key_block[pos];
 152           server_write_key_size = key_size;
 153
 154           pos += key_size;
 155
 156         }
 157       else
 158         {                       /* export */
 159           client_write_key = key1;
 160           server_write_key = key2;
 161
 162           /* generate the final keys */
 163
 164           if (session->security_parameters.version == GNUTLS_SSL3)
 165             {                   /* SSL 3 */
 166               ret =
 167                 _gnutls_ssl3_hash_md5 (&key_block[pos],
 168                                        key_size, rrnd,
 169                                        2 * GNUTLS_RANDOM_SIZE,
 170                                        EXPORT_FINAL_KEY_SIZE,
 171                                        client_write_key);
 172
 173             }
 174           else
 175             {                   /* TLS 1.0 */
 176               ret =
 177                 _gnutls_PRF (session, &key_block[pos], key_size,
 178                              cliwrite, cliwrite_length,
 179                              rrnd,
 180                              2 * GNUTLS_RANDOM_SIZE,
 181                              EXPORT_FINAL_KEY_SIZE, client_write_key);
 182             }
 183
 184           if (ret < 0)
 185             return gnutls_assert_val (ret);
 186
 187           client_write_key_size = EXPORT_FINAL_KEY_SIZE;
 188           pos += key_size;
 189
 190           if (session->security_parameters.version == GNUTLS_SSL3)
 191             {                   /* SSL 3 */
 192               ret =
 193                 _gnutls_ssl3_hash_md5 (&key_block[pos], key_size,
 194                                        rnd, 2 * GNUTLS_RANDOM_SIZE,
 195                                        EXPORT_FINAL_KEY_SIZE,
 196                                        server_write_key);
 197             }
 198           else
 199             {                   /* TLS 1.0 */
 200               ret =
 201                 _gnutls_PRF (session, &key_block[pos], key_size,
 202                              servwrite, servwrite_length,
 203                              rrnd, 2 * GNUTLS_RANDOM_SIZE,
 204                              EXPORT_FINAL_KEY_SIZE, server_write_key);
 205             }
 206
 207           if (ret < 0)
 208             return gnutls_assert_val (ret);
 209
 210           server_write_key_size = EXPORT_FINAL_KEY_SIZE;
 211           pos += key_size;
 212         }
 213
 214       if (_gnutls_set_datum
 215           (&client_write->key, client_write_key, client_write_key_size) < 0)
 216         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 217
 218       _gnutls_hard_log ("INT: CLIENT WRITE KEY [%d]: %s\n",
 219                         client_write_key_size,
 220                         _gnutls_bin2hex (client_write_key,
 221                                          client_write_key_size, buf,
 222                                          sizeof (buf), NULL));
 223
 224       if (_gnutls_set_datum
 225           (&server_write->key, server_write_key, server_write_key_size) < 0)
 226         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 227
 228       _gnutls_hard_log ("INT: SERVER WRITE KEY [%d]: %s\n",
 229                         server_write_key_size,
 230                         _gnutls_bin2hex (server_write_key,
 231                                          server_write_key_size, buf,
 232                                          sizeof (buf), NULL));
 233
 234     }
 235
 236
 237   /* IV generation in export and non export ciphers.
 238    */
 239   if (IV_size > 0 && export_flag == 0)
 240     {
 241       if (_gnutls_set_datum
 242           (&client_write->IV, &key_block[pos], IV_size) < 0)
 243         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 244
 245       pos += IV_size;
 246
 247       if (_gnutls_set_datum
 248           (&server_write->IV, &key_block[pos], IV_size) < 0)
 249         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 250
 251     }
 252   else if (IV_size > 0 && export_flag != 0)
 253     {
 254       uint8_t iv_block[MAX_CIPHER_BLOCK_SIZE * 2];
 255
 256       if (session->security_parameters.version == GNUTLS_SSL3)
 257         {                       /* SSL 3 */
 258           ret = _gnutls_ssl3_hash_md5 ("", 0,
 259                                        rrnd, GNUTLS_RANDOM_SIZE * 2,
 260                                        IV_size, iv_block);
 261
 262           if (ret < 0)
 263             return gnutls_assert_val (ret);
 264
 265
 266           ret = _gnutls_ssl3_hash_md5 ("", 0, rnd,
 267                                        GNUTLS_RANDOM_SIZE * 2,
 268                                        IV_size, &iv_block[IV_size]);
 269
 270         }
 271       else
 272         {                       /* TLS 1.0 */
 273           ret = _gnutls_PRF (session, (uint8_t*)"", 0,
 274                              ivblock, ivblock_length, rrnd,
 275                              2 * GNUTLS_RANDOM_SIZE, IV_size * 2, iv_block);
 276         }
 277
 278       if (ret < 0)
 279         return gnutls_assert_val (ret);
 280
 281       if (_gnutls_set_datum (&client_write->IV, iv_block, IV_size) < 0)
 282         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 283
 284       if (_gnutls_set_datum
 285           (&server_write->IV, &iv_block[IV_size], IV_size) < 0)
 286         return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 287     }
 288
 289   return 0;
 290 }
 291
 292 static int
 293 _gnutls_init_record_state (record_parameters_st * params, gnutls_protocol_t ver, int read,
 294                            record_state_st * state)
 295 {
 296   int ret;
 297   gnutls_datum_t * iv = NULL;
 298
 299   if (!_gnutls_version_has_explicit_iv(ver))
 300     {
 301       iv = &state->IV;
 302     }
 303
 304   ret = _gnutls_auth_cipher_init (&state->cipher_state,
 305     params->cipher_algorithm, &state->key, iv,
 306     params->mac_algorithm, &state->mac_secret, (ver==GNUTLS_SSL3)?1:0, 1-read/*1==encrypt*/);
 307   if (ret < 0 && params->cipher_algorithm != GNUTLS_CIPHER_NULL)
 308     return gnutls_assert_val (ret);
 309
 310   ret =
 311     _gnutls_comp_init (&state->compression_state, params->compression_algorithm, read/*1==decompress*/);
 312
 313   if (ret < 0)
 314     return gnutls_assert_val (ret);
 315
 316   return 0;
 317 }
 318
 319 int
 320 _gnutls_epoch_set_cipher_suite (gnutls_session_t session,
 321                                 int epoch_rel, const uint8_t suite[2])
 322 {
 323   gnutls_cipher_algorithm_t cipher_algo;
 324   gnutls_mac_algorithm_t mac_algo;
 325   record_parameters_st *params;
 326   int ret;
 327
 328   ret = _gnutls_epoch_get (session, epoch_rel, &params);
 329   if (ret < 0)
 330     return gnutls_assert_val (ret);
 331
 332   if (params->initialized
 333       || params->cipher_algorithm != GNUTLS_CIPHER_UNKNOWN
 334       || params->mac_algorithm != GNUTLS_MAC_UNKNOWN)
 335     return gnutls_assert_val (GNUTLS_E_INTERNAL_ERROR);
 336
 337   cipher_algo = _gnutls_cipher_suite_get_cipher_algo (suite);
 338   mac_algo = _gnutls_cipher_suite_get_mac_algo (suite);
 339
 340   if (_gnutls_cipher_is_ok (cipher_algo) != 0
 341       || _gnutls_mac_is_ok (mac_algo) != 0)
 342     return gnutls_assert_val (GNUTLS_E_UNWANTED_ALGORITHM);
 343
 344   params->cipher_algorithm = cipher_algo;
 345   params->mac_algorithm = mac_algo;
 346
 347   return 0;
 348 }
 349
 350 int
 351 _gnutls_epoch_set_compression (gnutls_session_t session,
 352                                int epoch_rel,
 353                                gnutls_compression_method_t comp_algo)
 354 {
 355   record_parameters_st *params;
 356   int ret;
 357
 358   ret = _gnutls_epoch_get (session, epoch_rel, &params);
 359   if (ret < 0)
 360     return gnutls_assert_val (ret);
 361
 362   if (params->initialized
 363       || params->compression_algorithm != GNUTLS_COMP_UNKNOWN)
 364     return gnutls_assert_val (GNUTLS_E_INTERNAL_ERROR);
 365
 366   if (_gnutls_compression_is_ok (comp_algo) != 0)
 367     return gnutls_assert_val (GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM);
 368
 369   params->compression_algorithm = comp_algo;
 370
 371   return 0;
 372 }
 373
 374 void
 375 _gnutls_epoch_set_null_algos (gnutls_session_t session,
 376                               record_parameters_st * params)
 377 {
 378   /* This is only called on startup. We are extra paranoid about this
 379      because it may cause unencrypted application data to go out on
 380      the wire. */
 381   if (params->initialized || params->epoch != 0)
 382     {
 383       gnutls_assert ();
 384       return;
 385     }
 386
 387   params->cipher_algorithm = GNUTLS_CIPHER_NULL;
 388   params->mac_algorithm = GNUTLS_MAC_NULL;
 389   params->compression_algorithm = GNUTLS_COMP_NULL;
 390   params->initialized = 1;
 391 }
 392
 393 int
 394 _gnutls_epoch_set_keys (gnutls_session_t session, uint16_t epoch)
 395 {
 396   int hash_size;
 397   int IV_size;
 398   int key_size, export_flag;
 399   gnutls_cipher_algorithm_t cipher_algo;
 400   gnutls_mac_algorithm_t mac_algo;
 401   gnutls_compression_method_t comp_algo;
 402   record_parameters_st *params;
 403   int ret;
 404   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 405
 406   ret = _gnutls_epoch_get (session, epoch, &params);
 407   if (ret < 0)
 408     return gnutls_assert_val (ret);
 409
 410   if (params->initialized)
 411     return 0;
 412
 413   _gnutls_record_log
 414     ("REC[%p]: Initializing epoch #%u\n", session, params->epoch);
 415
 416   cipher_algo = params->cipher_algorithm;
 417   mac_algo = params->mac_algorithm;
 418   comp_algo = params->compression_algorithm;
 419
 420   if (_gnutls_cipher_is_ok (cipher_algo) != 0
 421       || _gnutls_mac_is_ok (mac_algo) != 0)
 422     return gnutls_assert_val (GNUTLS_E_INTERNAL_ERROR);
 423
 424   if (_gnutls_compression_is_ok (comp_algo) != 0)
 425     return gnutls_assert_val (GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM);
 426
 427   IV_size = _gnutls_cipher_get_iv_size (cipher_algo);
 428   key_size = gnutls_cipher_get_key_size (cipher_algo);
 429   export_flag = _gnutls_cipher_get_export_flag (cipher_algo);
 430   hash_size = _gnutls_hmac_get_algo_len (mac_algo);
 431
 432   ret = _gnutls_set_keys
 433     (session, params, hash_size, IV_size, key_size, export_flag);
 434   if (ret < 0)
 435     return gnutls_assert_val (ret);
 436
 437   ret = _gnutls_init_record_state (params, ver, 1, &params->read);
 438   if (ret < 0)
 439     return gnutls_assert_val (ret);
 440
 441   ret = _gnutls_init_record_state (params, ver, 0, &params->write);
 442   if (ret < 0)
 443     return gnutls_assert_val (ret);
 444
 445   params->record_sw_size = 0;
 446
 447   _gnutls_record_log ("REC[%p]: Epoch #%u ready\n", session, params->epoch);
 448
 449   params->initialized = 1;
 450   return 0;
 451 }
 452
 453
 454 #define CPY_COMMON dst->entity = src->entity; \
 455         dst->kx_algorithm = src->kx_algorithm; \
 456         memcpy( dst->cipher_suite, src->cipher_suite, 2); \
 457         memcpy( dst->master_secret, src->master_secret, GNUTLS_MASTER_SIZE); \
 458         memcpy( dst->client_random, src->client_random, GNUTLS_RANDOM_SIZE); \
 459         memcpy( dst->server_random, src->server_random, GNUTLS_RANDOM_SIZE); \
 460         memcpy( dst->session_id, src->session_id, TLS_MAX_SESSION_ID_SIZE); \
 461         dst->session_id_size = src->session_id_size; \
 462         dst->cert_type = src->cert_type; \
 463         dst->compression_method = src->compression_method; \
 464         dst->timestamp = src->timestamp; \
 465         dst->max_record_recv_size = src->max_record_recv_size; \
 466         dst->max_record_send_size = src->max_record_send_size; \
 467         dst->version = src->version;
 468
 469 static void
 470 _gnutls_set_resumed_parameters (gnutls_session_t session)
 471 {
 472   security_parameters_st *src =
 473     &session->internals.resumed_security_parameters;
 474   security_parameters_st *dst = &session->security_parameters;
 475
 476   CPY_COMMON;
 477 }
 478
 479 /* Sets the current connection session to conform with the
 480  * Security parameters(pending session), and initializes encryption.
 481  * Actually it initializes and starts encryption ( so it needs
 482  * secrets and random numbers to have been negotiated)
 483  * This is to be called after sending the Change Cipher Spec packet.
 484  */
 485 int
 486 _gnutls_connection_state_init (gnutls_session_t session)
 487 {
 488   int ret;
 489
 490 /* Setup the master secret
 491  */
 492   if ((ret = _gnutls_generate_master (session, 0)) < 0)
 493     return gnutls_assert_val (ret);
 494
 495   return 0;
 496 }
 497
 498
 499
 500 static int
 501 _gnutls_check_algos (gnutls_session_t session,
 502                      const uint8_t suite[2],
 503                      gnutls_compression_method_t comp_algo)
 504 {
 505   gnutls_cipher_algorithm_t cipher_algo;
 506   gnutls_mac_algorithm_t mac_algo;
 507
 508   cipher_algo = _gnutls_cipher_suite_get_cipher_algo (suite);
 509   mac_algo = _gnutls_cipher_suite_get_mac_algo (suite);
 510
 511   if (_gnutls_cipher_is_ok (cipher_algo) != 0)
 512     return gnutls_assert_val (GNUTLS_E_INTERNAL_ERROR);
 513
 514   if (_gnutls_cipher_priority (session, cipher_algo) < 0)
 515     return gnutls_assert_val (GNUTLS_E_UNWANTED_ALGORITHM);
 516
 517
 518   if (_gnutls_mac_is_ok (mac_algo) != 0)
 519     return gnutls_assert_val (GNUTLS_E_INTERNAL_ERROR);
 520
 521   if (_gnutls_mac_priority (session, mac_algo) < 0)
 522     return gnutls_assert_val (GNUTLS_E_UNWANTED_ALGORITHM);
 523
 524
 525   if (_gnutls_compression_is_ok (comp_algo) != 0)
 526     return gnutls_assert_val (GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM);
 527
 528   return 0;
 529 }
 530
 531 int _gnutls_epoch_get_compression(gnutls_session_t session, int epoch)
 532 {
 533 record_parameters_st *params;
 534 int ret;
 535
 536   ret = _gnutls_epoch_get (session, epoch, &params);
 537   if (ret < 0)
 538     return GNUTLS_COMP_UNKNOWN;
 539
 540   return params->compression_algorithm;
 541 }
 542
 543 /* Initializes the read connection session
 544  * (read encrypted data)
 545  */
 546 int
 547 _gnutls_read_connection_state_init (gnutls_session_t session)
 548 {
 549   const uint16_t epoch_next = session->security_parameters.epoch_next;
 550   int ret;
 551
 552   /* Update internals from CipherSuite selected.
 553    * If we are resuming just copy the connection session
 554    */
 555   if (session->internals.resumed == RESUME_FALSE)
 556     {
 557
 558       ret = _gnutls_check_algos (session,
 559                                  session->
 560                                  security_parameters.cipher_suite,
 561                                  _gnutls_epoch_get_compression(session, epoch_next));
 562       if (ret < 0)
 563         return ret;
 564
 565       ret = _gnutls_set_kx (session,
 566                             _gnutls_cipher_suite_get_kx_algo
 567                             (session->
 568                              security_parameters.cipher_suite));
 569       if (ret < 0)
 570         return ret;
 571     }
 572   else if (session->security_parameters.entity == GNUTLS_CLIENT)
 573     _gnutls_set_resumed_parameters (session);
 574
 575   ret = _gnutls_epoch_set_keys (session, epoch_next);
 576   if (ret < 0)
 577     return ret;
 578
 579   _gnutls_handshake_log ("HSK[%p]: Cipher Suite: %s\n",
 580                          session,
 581                          _gnutls_cipher_suite_get_name
 582                          (session->
 583                           security_parameters.cipher_suite));
 584
 585   session->security_parameters.epoch_read = epoch_next;
 586
 587   return 0;
 588 }
 589
 590
 591
 592 /* Initializes the write connection session
 593  * (write encrypted data)
 594  */
 595 int
 596 _gnutls_write_connection_state_init (gnutls_session_t session)
 597 {
 598   const uint16_t epoch_next = session->security_parameters.epoch_next;
 599   int ret;
 600
 601 /* Update internals from CipherSuite selected.
 602  * If we are resuming just copy the connection session
 603  */
 604   if (session->internals.resumed == RESUME_FALSE)
 605     {
 606       ret = _gnutls_check_algos (session,
 607                                  session->
 608                                  security_parameters.cipher_suite,
 609                                  _gnutls_epoch_get_compression(session, epoch_next));
 610       if (ret < 0)
 611         return ret;
 612
 613       ret = _gnutls_set_kx (session,
 614                             _gnutls_cipher_suite_get_kx_algo
 615                             (session->
 616                              security_parameters.cipher_suite));
 617       if (ret < 0)
 618         return ret;
 619     }
 620   else if (session->security_parameters.entity == GNUTLS_SERVER)
 621     _gnutls_set_resumed_parameters (session);
 622
 623   ret = _gnutls_epoch_set_keys (session, epoch_next);
 624   if (ret < 0)
 625     return gnutls_assert_val (ret);
 626
 627   _gnutls_handshake_log ("HSK[%p]: Cipher Suite: %s\n", session,
 628                          _gnutls_cipher_suite_get_name
 629                          (session->
 630                           security_parameters.cipher_suite));
 631
 632   _gnutls_handshake_log
 633     ("HSK[%p]: Initializing internal [write] cipher sessions\n", session);
 634
 635   session->security_parameters.epoch_write = epoch_next;
 636
 637   return 0;
 638 }
 639
 640 /* Sets the specified kx algorithm into pending session
 641  */
 642 int
 643 _gnutls_set_kx (gnutls_session_t session, gnutls_kx_algorithm_t algo)
 644 {
 645
 646   if (_gnutls_kx_is_ok (algo) == 0)
 647     {
 648       session->security_parameters.kx_algorithm = algo;
 649     }
 650   else
 651     return gnutls_assert_val (GNUTLS_E_INTERNAL_ERROR);
 652
 653   if (_gnutls_kx_priority (session, algo) < 0)
 654     return gnutls_assert_val (GNUTLS_E_UNWANTED_ALGORITHM);
 655
 656   return 0;
 657 }
 658
 659 static inline int
 660 epoch_resolve (gnutls_session_t session,
 661                unsigned int epoch_rel, uint16_t * epoch_out)
 662 {
 663   switch (epoch_rel)
 664     {
 665     case EPOCH_READ_CURRENT:
 666       *epoch_out = session->security_parameters.epoch_read;
 667       return 0;
 668
 669     case EPOCH_WRITE_CURRENT:
 670       *epoch_out = session->security_parameters.epoch_write;
 671       return 0;
 672
 673     case EPOCH_NEXT:
 674       *epoch_out = session->security_parameters.epoch_next;
 675       return 0;
 676
 677     default:
 678       if (epoch_rel > 0xffffu)
 679         return gnutls_assert_val (GNUTLS_E_INVALID_REQUEST);
 680
 681       *epoch_out = epoch_rel;
 682       return 0;
 683     }
 684 }
 685
 686 static inline record_parameters_st **
 687 epoch_get_slot (gnutls_session_t session, uint16_t epoch)
 688 {
 689   uint16_t epoch_index = epoch - session->security_parameters.epoch_min;
 690
 691   if (epoch_index >= MAX_EPOCH_INDEX)
 692     {
 693       _gnutls_handshake_log("Epoch %d out of range (idx: %d, max: %d)\n", (int)epoch, (int)epoch_index, MAX_EPOCH_INDEX);
 694       gnutls_assert ();
 695       return NULL;
 696     }
 697   /* The slot may still be empty (NULL) */
 698   return &session->record_parameters[epoch_index];
 699 }
 700
 701 int
 702 _gnutls_epoch_get (gnutls_session_t session, unsigned int epoch_rel,
 703                    record_parameters_st ** params_out)
 704 {
 705   uint16_t epoch;
 706   record_parameters_st **params;
 707   int ret;
 708
 709   ret = epoch_resolve (session, epoch_rel, &epoch);
 710   if (ret < 0)
 711     return gnutls_assert_val (ret);
 712
 713   params = epoch_get_slot (session, epoch);
 714   if (params == NULL || *params == NULL)
 715     return gnutls_assert_val (GNUTLS_E_INVALID_REQUEST);
 716
 717   *params_out = *params;
 718
 719   return 0;
 720 }
 721
 722 int
 723 _gnutls_epoch_alloc (gnutls_session_t session, uint16_t epoch,
 724                      record_parameters_st ** out)
 725 {
 726   record_parameters_st **slot;
 727
 728   _gnutls_record_log ("REC[%p]: Allocating epoch #%u\n", session, epoch);
 729
 730   slot = epoch_get_slot (session, epoch);
 731
 732   /* If slot out of range or not empty. */
 733   if (slot == NULL)
 734     return gnutls_assert_val (GNUTLS_E_INVALID_REQUEST);
 735
 736   if (*slot != NULL)
 737     return gnutls_assert_val (GNUTLS_E_INVALID_REQUEST);
 738
 739   *slot = gnutls_calloc (1, sizeof (record_parameters_st));
 740   if (*slot == NULL)
 741     return gnutls_assert_val (GNUTLS_E_MEMORY_ERROR);
 742
 743   (*slot)->epoch = epoch;
 744   (*slot)->cipher_algorithm = GNUTLS_CIPHER_UNKNOWN;
 745   (*slot)->mac_algorithm = GNUTLS_MAC_UNKNOWN;
 746   (*slot)->compression_algorithm = GNUTLS_COMP_UNKNOWN;
 747
 748   if (IS_DTLS (session))
 749     _gnutls_write_uint16 (epoch, UINT64DATA((*slot)->write.sequence_number));
 750
 751   if (out != NULL)
 752     *out = *slot;
 753
 754   return 0;
 755 }
 756
 757 static inline int
 758 epoch_is_active(gnutls_session_t session, record_parameters_st * params)
 759 {
 760   const security_parameters_st *sp = &session->security_parameters;
 761
 762   if (params->epoch == sp->epoch_read)
 763     return 1;
 764
 765   if (params->epoch == sp->epoch_write)
 766     return 1;
 767
 768   if (params->epoch == sp->epoch_next)
 769     return 1;
 770
 771   return 0;
 772 }
 773
 774 static inline int
 775 epoch_alive (gnutls_session_t session, record_parameters_st * params)
 776 {
 777   if (params->usage_cnt > 0)
 778     return 1;
 779
 780   return epoch_is_active(session, params);
 781 }
 782
 783 void
 784 _gnutls_epoch_gc (gnutls_session_t session)
 785 {
 786   int i, j;
 787   unsigned int min_index = 0;
 788
 789   _gnutls_record_log ("REC[%p]: Start of epoch cleanup\n", session);
 790
 791   /* Free all dead cipher state */
 792   for (i = 0; i < MAX_EPOCH_INDEX; i++)
 793     {
 794       if (session->record_parameters[i] != NULL)
 795         {
 796           if (!epoch_is_active(session, session->record_parameters[i]) && session->record_parameters[i]->usage_cnt)
 797             _gnutls_record_log ("REC[%p]: Note inactive epoch %d has %d users\n", session, session->record_parameters[i]->epoch, session->record_parameters[i]->usage_cnt);
 798           if (!epoch_alive (session, session->record_parameters[i]))
 799             {
 800               _gnutls_epoch_free (session, session->record_parameters[i]);
 801               session->record_parameters[i] = NULL;
 802             }
 803         }
 804     }
 805
 806   /* Look for contiguous NULLs at the start of the array */
 807   for (i = 0; i < MAX_EPOCH_INDEX && session->record_parameters[i] == NULL;
 808        i++);
 809   min_index = i;
 810
 811   /* Pick up the slack in the epoch window. */
 812   for (i = 0, j = min_index; j < MAX_EPOCH_INDEX; i++, j++)
 813     session->record_parameters[i] = session->record_parameters[j];
 814
 815   /* Set the new epoch_min */
 816   if (session->record_parameters[0] != NULL)
 817     session->security_parameters.epoch_min =
 818       session->record_parameters[0]->epoch;
 819
 820   _gnutls_record_log ("REC[%p]: End of epoch cleanup\n", session);
 821 }
 822
 823 static inline void
 824 free_record_state (record_state_st * state, int d)
 825 {
 826   _gnutls_free_datum (&state->mac_secret);
 827   _gnutls_free_datum (&state->IV);
 828   _gnutls_free_datum (&state->key);
 829
 830   _gnutls_auth_cipher_deinit (&state->cipher_state);
 831
 832   if (state->compression_state.handle != NULL)
 833     _gnutls_comp_deinit (&state->compression_state, d);
 834 }
 835
 836 void
 837 _gnutls_epoch_free (gnutls_session_t session, record_parameters_st * params)
 838 {
 839   _gnutls_record_log ("REC[%p]: Epoch #%u freed\n", session, params->epoch);
 840
 841   free_record_state (&params->read, 1);
 842   free_record_state (&params->write, 0);
 843
 844   gnutls_free (params);
 845 }