lib/gnutls_auth.c

   1 /*
   2  * Copyright (C) 2001-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 #include "gnutls_int.h"
  24 #include "gnutls_errors.h"
  25 #include "gnutls_auth.h"
  26 #include "gnutls_auth.h"
  27 #include "algorithms.h"
  28 #include <auth/cert.h>
  29 #include <auth/psk.h>
  30 #include <auth/anon.h>
  31 #include <gnutls_datum.h>
  32
  33 /* The functions here are used in order for authentication algorithms
  34  * to be able to retrieve the needed credentials eg public and private
  35  * key etc.
  36  */
  37
  38 /**
  39  * gnutls_credentials_clear:
  40  * @session: is a #gnutls_session_t structure.
  41  *
  42  * Clears all the credentials previously set in this session.
  43  **/
  44 void
  45 gnutls_credentials_clear (gnutls_session_t session)
  46 {
  47   if (session->key.cred)
  48     {                           /* beginning of the list */
  49       auth_cred_st *ccred, *ncred;
  50       ccred = session->key.cred;
  51       while (ccred != NULL)
  52         {
  53           ncred = ccred->next;
  54           gnutls_free (ccred);
  55           ccred = ncred;
  56         }
  57       session->key.cred = NULL;
  58     }
  59 }
  60
  61 /*
  62  * This creates a linked list of the form:
  63  * { algorithm, credentials, pointer to next }
  64  */
  65 /**
  66  * gnutls_credentials_set:
  67  * @session: is a #gnutls_session_t structure.
  68  * @type: is the type of the credentials
  69  * @cred: is a pointer to a structure.
  70  *
  71  * Sets the needed credentials for the specified type.  Eg username,
  72  * password - or public and private keys etc.  The @cred parameter is
  73  * a structure that depends on the specified type and on the current
  74  * session (client or server).
  75  *
  76  * In order to minimize memory usage, and share credentials between
  77  * several threads gnutls keeps a pointer to cred, and not the whole
  78  * cred structure.  Thus you will have to keep the structure allocated
  79  * until you call gnutls_deinit().
  80  *
  81  * For %GNUTLS_CRD_ANON, @cred should be
  82  * #gnutls_anon_client_credentials_t in case of a client.  In case of
  83  * a server it should be #gnutls_anon_server_credentials_t.
  84  *
  85  * For %GNUTLS_CRD_SRP, @cred should be #gnutls_srp_client_credentials_t
  86  * in case of a client, and #gnutls_srp_server_credentials_t, in case
  87  * of a server.
  88  *
  89  * For %GNUTLS_CRD_CERTIFICATE, @cred should be
  90  * #gnutls_certificate_credentials_t.
  91  *
  92  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
  93  *   otherwise a negative error code is returned.
  94  **/
  95 int
  96 gnutls_credentials_set (gnutls_session_t session,
  97                         gnutls_credentials_type_t type, void *cred)
  98 {
  99   auth_cred_st *ccred = NULL, *pcred = NULL;
 100   int exists = 0;
 101
 102   if (session->key.cred == NULL)
 103     {                           /* beginning of the list */
 104
 105       session->key.cred = gnutls_malloc (sizeof (auth_cred_st));
 106       if (session->key.cred == NULL)
 107         return GNUTLS_E_MEMORY_ERROR;
 108
 109       /* copy credentials locally */
 110       session->key.cred->credentials = cred;
 111
 112       session->key.cred->next = NULL;
 113       session->key.cred->algorithm = type;
 114     }
 115   else
 116     {
 117       ccred = session->key.cred;
 118       while (ccred != NULL)
 119         {
 120           if (ccred->algorithm == type)
 121             {
 122               exists = 1;
 123               break;
 124             }
 125           pcred = ccred;
 126           ccred = ccred->next;
 127         }
 128       /* After this, pcred is not null.
 129        */
 130
 131       if (exists == 0)
 132         {                       /* new entry */
 133           pcred->next = gnutls_malloc (sizeof (auth_cred_st));
 134           if (pcred->next == NULL)
 135             return GNUTLS_E_MEMORY_ERROR;
 136
 137           ccred = pcred->next;
 138
 139           /* copy credentials locally */
 140           ccred->credentials = cred;
 141
 142           ccred->next = NULL;
 143           ccred->algorithm = type;
 144         }
 145       else
 146         {                       /* modify existing entry */
 147           ccred->credentials = cred;
 148         }
 149     }
 150
 151   return 0;
 152 }
 153
 154 /**
 155  * gnutls_auth_get_type:
 156  * @session: is a #gnutls_session_t structure.
 157  *
 158  * Returns type of credentials for the current authentication schema.
 159  * The returned information is to be used to distinguish the function used
 160  * to access authentication data.
 161  *
 162  * Eg. for CERTIFICATE ciphersuites (key exchange algorithms:
 163  * %GNUTLS_KX_RSA, %GNUTLS_KX_DHE_RSA), the same function are to be
 164  * used to access the authentication data.
 165  *
 166  * Returns: The type of credentials for the current authentication
 167  *   schema, a #gnutls_credentials_type_t type.
 168  **/
 169 gnutls_credentials_type_t
 170 gnutls_auth_get_type (gnutls_session_t session)
 171 {
 172 /* This is not the credentials we must set, but the authentication data
 173  * we get by the peer, so it should be reversed.
 174  */
 175   int server = session->security_parameters.entity == GNUTLS_SERVER ? 0 : 1;
 176
 177   return
 178     _gnutls_map_kx_get_cred (_gnutls_cipher_suite_get_kx_algo
 179                              (session->
 180                               security_parameters.cipher_suite),
 181                              server);
 182 }
 183
 184 /**
 185  * gnutls_auth_server_get_type:
 186  * @session: is a #gnutls_session_t structure.
 187  *
 188  * Returns the type of credentials that were used for server authentication.
 189  * The returned information is to be used to distinguish the function used
 190  * to access authentication data.
 191  *
 192  * Returns: The type of credentials for the server authentication
 193  *   schema, a #gnutls_credentials_type_t type.
 194  **/
 195 gnutls_credentials_type_t
 196 gnutls_auth_server_get_type (gnutls_session_t session)
 197 {
 198   return
 199     _gnutls_map_kx_get_cred (_gnutls_cipher_suite_get_kx_algo
 200                              (session->
 201                               security_parameters.cipher_suite), 1);
 202 }
 203
 204 /**
 205  * gnutls_auth_client_get_type:
 206  * @session: is a #gnutls_session_t structure.
 207  *
 208  * Returns the type of credentials that were used for client authentication.
 209  * The returned information is to be used to distinguish the function used
 210  * to access authentication data.
 211  *
 212  * Returns: The type of credentials for the client authentication
 213  *   schema, a #gnutls_credentials_type_t type.
 214  **/
 215 gnutls_credentials_type_t
 216 gnutls_auth_client_get_type (gnutls_session_t session)
 217 {
 218   return
 219     _gnutls_map_kx_get_cred (_gnutls_cipher_suite_get_kx_algo
 220                              (session->
 221                               security_parameters.cipher_suite), 0);
 222 }
 223
 224
 225 /*
 226  * This returns a pointer to the linked list. Don't
 227  * free that!!!
 228  */
 229 const void *
 230 _gnutls_get_kx_cred (gnutls_session_t session,
 231                      gnutls_kx_algorithm_t algo, int *err)
 232 {
 233   int server = session->security_parameters.entity == GNUTLS_SERVER ? 1 : 0;
 234
 235   return _gnutls_get_cred (session,
 236                            _gnutls_map_kx_get_cred (algo, server), err);
 237 }
 238
 239 const void *
 240 _gnutls_get_cred (gnutls_session_t session, gnutls_credentials_type_t type, int *err)
 241 {
 242   const void *retval = NULL;
 243   int _err = -1;
 244   auth_cred_st *ccred;
 245   gnutls_key_st * key = &session->key;
 246
 247   ccred = key->cred;
 248   while (ccred != NULL)
 249     {
 250       if (ccred->algorithm == type)
 251         {
 252           break;
 253         }
 254       ccred = ccred->next;
 255     }
 256   if (ccred == NULL)
 257     goto out;
 258
 259   _err = 0;
 260   retval = ccred->credentials;
 261
 262 out:
 263   if (err != NULL)
 264     *err = _err;
 265   return retval;
 266 }
 267
 268 /*-
 269  * _gnutls_get_auth_info - Returns a pointer to authentication information.
 270  * @session: is a #gnutls_session_t structure.
 271  *
 272  * This function must be called after a successful gnutls_handshake().
 273  * Returns a pointer to authentication information. That information
 274  * is data obtained by the handshake protocol, the key exchange algorithm,
 275  * and the TLS extensions messages.
 276  *
 277  * In case of GNUTLS_CRD_ANON returns a type of &anon_(server/client)_auth_info_t;
 278  * In case of GNUTLS_CRD_CERTIFICATE returns a type of &cert_auth_info_t;
 279  * In case of GNUTLS_CRD_SRP returns a type of &srp_(server/client)_auth_info_t;
 280  -*/
 281 void *
 282 _gnutls_get_auth_info (gnutls_session_t session)
 283 {
 284   return session->key.auth_info;
 285 }
 286
 287 /*-
 288  * _gnutls_free_auth_info - Frees the auth info structure
 289  * @session: is a #gnutls_session_t structure.
 290  *
 291  * This function frees the auth info structure and sets it to
 292  * null. It must be called since some structures contain malloced
 293  * elements.
 294  -*/
 295 void
 296 _gnutls_free_auth_info (gnutls_session_t session)
 297 {
 298   dh_info_st *dh_info;
 299   rsa_info_st *rsa_info;
 300
 301   if (session == NULL)
 302     {
 303       gnutls_assert ();
 304       return;
 305     }
 306
 307   switch (session->key.auth_info_type)
 308     {
 309     case GNUTLS_CRD_SRP:
 310       break;
 311     case GNUTLS_CRD_ANON:
 312       {
 313         anon_auth_info_t info = _gnutls_get_auth_info (session);
 314
 315         if (info == NULL)
 316           break;
 317
 318         dh_info = &info->dh;
 319         _gnutls_free_dh_info (dh_info);
 320       }
 321       break;
 322     case GNUTLS_CRD_PSK:
 323       {
 324         psk_auth_info_t info = _gnutls_get_auth_info (session);
 325
 326         if (info == NULL)
 327           break;
 328
 329         dh_info = &info->dh;
 330         _gnutls_free_dh_info (dh_info);
 331       }
 332       break;
 333     case GNUTLS_CRD_CERTIFICATE:
 334       {
 335         unsigned int i;
 336         cert_auth_info_t info = _gnutls_get_auth_info (session);
 337
 338         if (info == NULL)
 339           break;
 340
 341         dh_info = &info->dh;
 342         rsa_info = &info->rsa_export;
 343         for (i = 0; i < info->ncerts; i++)
 344           {
 345             _gnutls_free_datum (&info->raw_certificate_list[i]);
 346           }
 347
 348         gnutls_free (info->raw_certificate_list);
 349         info->raw_certificate_list = NULL;
 350         info->ncerts = 0;
 351
 352         _gnutls_free_dh_info (dh_info);
 353         _gnutls_free_rsa_info (rsa_info);
 354       }
 355
 356
 357       break;
 358     default:
 359       return;
 360
 361     }
 362
 363   gnutls_free (session->key.auth_info);
 364   session->key.auth_info = NULL;
 365   session->key.auth_info_size = 0;
 366   session->key.auth_info_type = 0;
 367
 368 }
 369
 370 /* This function will set the auth info structure in the key
 371  * structure.
 372  * If allow change is !=0 then this will allow changing the auth
 373  * info structure to a different type.
 374  */
 375 int
 376 _gnutls_auth_info_set (gnutls_session_t session,
 377                        gnutls_credentials_type_t type, int size,
 378                        int allow_change)
 379 {
 380   if (session->key.auth_info == NULL)
 381     {
 382       session->key.auth_info = gnutls_calloc (1, size);
 383       if (session->key.auth_info == NULL)
 384         {
 385           gnutls_assert ();
 386           return GNUTLS_E_MEMORY_ERROR;
 387         }
 388       session->key.auth_info_type = type;
 389       session->key.auth_info_size = size;
 390     }
 391   else
 392     {
 393       if (allow_change == 0)
 394         {
 395           /* If the credentials for the current authentication scheme,
 396            * are not the one we want to set, then it's an error.
 397            * This may happen if a rehandshake is performed an the
 398            * ciphersuite which is negotiated has different authentication
 399            * schema.
 400            */
 401           if (gnutls_auth_get_type (session) != session->key.auth_info_type)
 402             {
 403               gnutls_assert ();
 404               return GNUTLS_E_INVALID_REQUEST;
 405             }
 406         }
 407       else
 408         {
 409           /* The new behaviour: Here we reallocate the auth info structure
 410            * in order to be able to negotiate different authentication
 411            * types. Ie. perform an auth_anon and then authenticate again using a
 412            * certificate (in order to prevent revealing the certificate's contents,
 413            * to passive eavesdropers.
 414            */
 415           if (gnutls_auth_get_type (session) != session->key.auth_info_type)
 416             {
 417
 418               _gnutls_free_auth_info (session);
 419
 420               session->key.auth_info = calloc (1, size);
 421               if (session->key.auth_info == NULL)
 422                 {
 423                   gnutls_assert ();
 424                   return GNUTLS_E_MEMORY_ERROR;
 425                 }
 426
 427               session->key.auth_info_type = type;
 428               session->key.auth_info_size = size;
 429             }
 430         }
 431     }
 432   return 0;
 433 }