lib/ext_signature.c

   1 /*
   2  * Copyright (C) 2002,2003,2004,2005,2009,2010,2011 Free Software
   3  * Foundation, Inc.
   4  *
   5  * Author: Nikos Mavrogiannopoulos
   6  *
   7  * This file is part of GnuTLS.
   8  *
   9  * The GnuTLS is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public License
  11  * as published by the Free Software Foundation; either version 2.1 of
  12  * the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  22  * USA
  23  *
  24  */
  25
  26 /* This file contains the code the Certificate Type TLS extension.
  27  * This extension is currently gnutls specific.
  28  */
  29
  30 #include "gnutls_int.h"
  31 #include "gnutls_errors.h"
  32 #include "gnutls_num.h"
  33 #include <ext_signature.h>
  34 #include <gnutls_state.h>
  35 #include <gnutls_num.h>
  36 #include <gnutls_algorithms.h>
  37 #include <x509/common.h> /* dsa_q_to_hash */
  38 #include <gnutls_cert.h>
  39
  40 static int _gnutls_signature_algorithm_recv_params (gnutls_session_t session,
  41                                                     const opaque * data,
  42                                                     size_t data_size);
  43 static int _gnutls_signature_algorithm_send_params (gnutls_session_t session,
  44                                                     opaque * data, size_t);
  45 static void signature_algorithms_deinit_data (extension_priv_data_t priv);
  46 static int signature_algorithms_pack (extension_priv_data_t epriv,
  47                                       gnutls_buffer_st * ps);
  48 static int signature_algorithms_unpack (gnutls_buffer_st * ps,
  49                                         extension_priv_data_t * _priv);
  50
  51 extension_entry_st ext_mod_sig = {
  52   .name = "SIGNATURE ALGORITHMS",
  53   .type = GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS,
  54   .parse_type = GNUTLS_EXT_TLS,
  55
  56   .recv_func = _gnutls_signature_algorithm_recv_params,
  57   .send_func = _gnutls_signature_algorithm_send_params,
  58   .pack_func = signature_algorithms_pack,
  59   .unpack_func = signature_algorithms_unpack,
  60   .deinit_func = signature_algorithms_deinit_data,
  61 };
  62
  63 typedef struct
  64 {
  65   /* TLS 1.2 signature algorithms */
  66   gnutls_sign_algorithm_t sign_algorithms[MAX_SIGNATURE_ALGORITHMS];
  67   uint16_t sign_algorithms_size;
  68 } sig_ext_st;
  69
  70 /* generates a SignatureAndHashAlgorithm structure with length as prefix
  71  * by using the setup priorities.
  72  */
  73 int
  74 _gnutls_sign_algorithm_write_params (gnutls_session_t session, opaque * data,
  75                                      size_t max_data_size)
  76 {
  77   opaque *p = data, *len_p;
  78   int len, i, j, hash;
  79   const sign_algorithm_st *aid;
  80
  81   if (max_data_size < (session->internals.priorities.sign_algo.algorithms*2) + 2)
  82     {
  83       gnutls_assert ();
  84       return GNUTLS_E_SHORT_MEMORY_BUFFER;
  85     }
  86
  87   len = 0;
  88   len_p = p;
  89
  90   p += 2;
  91
  92   for (i = j = 0; j < session->internals.priorities.sign_algo.algorithms; i += 2, j++)
  93     {
  94       /* In gnutls we keep a state of SHA1 and SHA256 and thus cannot
  95        * use anything else.
  96        */
  97       hash = _gnutls_sign_get_hash_algorithm(session->internals.priorities.sign_algo.priority[j]);
  98       if (hash != GNUTLS_DIG_SHA1 && hash != GNUTLS_DIG_SHA256)
  99         continue;
 100
 101       aid =
 102         _gnutls_sign_to_tls_aid (session->internals.priorities.
 103                                  sign_algo.priority[j]);
 104
 105       if (aid == NULL)
 106         continue;
 107
 108        _gnutls_debug_log ("EXT[SIGA]: sent signature algo (%d.%d) %s\n", aid->hash_algorithm,
 109          aid->sign_algorithm, gnutls_sign_get_name(session->internals.priorities.sign_algo.priority[j]));
 110       *p = aid->hash_algorithm;
 111       p++;
 112       *p = aid->sign_algorithm;
 113       p++;
 114       len+=2;
 115     }
 116
 117   _gnutls_write_uint16 (len, len_p);
 118
 119   return len + 2;
 120 }
 121
 122
 123 /* Parses the Signature Algorithm structure and stores data into
 124  * session->security_parameters.extensions.
 125  */
 126 int
 127 _gnutls_sign_algorithm_parse_data (gnutls_session_t session,
 128                                    const opaque * data, size_t data_size)
 129 {
 130   int sig, i;
 131   sig_ext_st *priv;
 132   extension_priv_data_t epriv;
 133
 134   priv = gnutls_calloc (1, sizeof (*priv));
 135   if (priv == NULL)
 136     {
 137       gnutls_assert ();
 138       return GNUTLS_E_MEMORY_ERROR;
 139     }
 140
 141   for (i = 0; i < data_size; i += 2)
 142     {
 143       sign_algorithm_st aid;
 144
 145       aid.hash_algorithm = data[i];
 146       aid.sign_algorithm = data[i + 1];
 147
 148       sig = _gnutls_tls_aid_to_sign (&aid);
 149
 150        _gnutls_debug_log ("EXT[SIGA]: rcvd signature algo (%d.%d) %s\n", aid.hash_algorithm,
 151          aid.sign_algorithm, gnutls_sign_get_name(sig));
 152
 153       if (sig != GNUTLS_SIGN_UNKNOWN)
 154         {
 155           priv->sign_algorithms[priv->sign_algorithms_size++] = sig;
 156           if (priv->sign_algorithms_size == MAX_SIGNATURE_ALGORITHMS)
 157             break;
 158         }
 159     }
 160
 161   epriv.ptr = priv;
 162   _gnutls_ext_set_session_data (session,
 163                                 GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS, epriv);
 164
 165   return 0;
 166 }
 167
 168 /*
 169  * In case of a server: if a SIGNATURE_ALGORITHMS extension type is
 170  * received then it stores into the session security parameters the
 171  * new value.
 172  *
 173  * In case of a client: If a signature_algorithms have been specified
 174  * then it is an error;
 175  */
 176
 177 static int
 178 _gnutls_signature_algorithm_recv_params (gnutls_session_t session,
 179                                          const opaque * data,
 180                                          size_t _data_size)
 181 {
 182   ssize_t data_size = _data_size;
 183   int ret;
 184
 185   if (session->security_parameters.entity == GNUTLS_CLIENT)
 186     {
 187       /* nothing for now */
 188       gnutls_assert ();
 189       /* Although TLS 1.2 mandates that we must not accept reply
 190        * to this message, there are good reasons to just ignore it. Check
 191        * http://www.ietf.org/mail-archive/web/tls/current/msg03880.html
 192        */
 193       /* return GNUTLS_E_UNEXPECTED_PACKET; */
 194     }
 195   else
 196     {
 197       /* SERVER SIDE - we must check if the sent cert type is the right one
 198        */
 199       if (data_size > 2)
 200         {
 201           uint16_t len;
 202
 203           DECR_LEN (data_size, 2);
 204           len = _gnutls_read_uint16 (data);
 205           DECR_LEN (data_size, len);
 206
 207           ret = _gnutls_sign_algorithm_parse_data (session, data + 2, len);
 208           if (ret < 0)
 209             {
 210               gnutls_assert ();
 211               return ret;
 212             }
 213         }
 214     }
 215
 216   return 0;
 217 }
 218
 219 /* returns data_size or a negative number on failure
 220  */
 221 static int
 222 _gnutls_signature_algorithm_send_params (gnutls_session_t session,
 223                                          opaque * data, size_t data_size)
 224 {
 225   int ret;
 226   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 227
 228   /* this function sends the client extension data */
 229   if (session->security_parameters.entity == GNUTLS_CLIENT
 230       && _gnutls_version_has_selectable_sighash (ver))
 231     {
 232       if (session->internals.priorities.sign_algo.algorithms > 0)
 233         {
 234           ret =
 235             _gnutls_sign_algorithm_write_params (session, data, data_size);
 236           if (ret < 0)
 237             {
 238               gnutls_assert ();
 239               return ret;
 240             }
 241           return ret;
 242         }
 243     }
 244
 245   /* if we are here it means we don't send the extension */
 246   return 0;
 247 }
 248
 249 int cert_compatible_with_sig(gnutls_cert* cert, gnutls_protocol_t ver,
 250   gnutls_sign_algorithm_t sign)
 251 {
 252   if (cert->subject_pk_algorithm == GNUTLS_PK_DSA)
 253     { /* override */
 254       int hash_algo = _gnutls_dsa_q_to_hash (cert->params[1]);
 255
 256       /* DSA keys over 1024 bits cannot be used with TLS 1.x, x<2 */
 257       if (!_gnutls_version_has_selectable_sighash (ver))
 258         {
 259           if (hash_algo != GNUTLS_DIG_SHA1)
 260             return gnutls_assert_val(GNUTLS_E_INCOMPAT_DSA_KEY_WITH_TLS_PROTOCOL);
 261         }
 262       else
 263         {
 264           if (_gnutls_sign_get_hash_algorithm(sign) != hash_algo)
 265             return GNUTLS_E_UNWANTED_ALGORITHM;
 266         }
 267
 268     }
 269
 270   return 0;
 271 }
 272
 273 /* Returns a requested by the peer signature algorithm that
 274  * matches the given public key algorithm. Index can be increased
 275  * to return the second choice etc.
 276  */
 277 gnutls_sign_algorithm_t
 278 _gnutls_session_get_sign_algo (gnutls_session_t session, gnutls_cert* cert)
 279 {
 280   unsigned i;
 281   int ret;
 282   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 283   sig_ext_st *priv;
 284   extension_priv_data_t epriv;
 285
 286   ret =
 287     _gnutls_ext_get_session_data (session,
 288                                   GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS,
 289                                   &epriv);
 290   priv = epriv.ptr;
 291
 292   if (ret < 0 || !_gnutls_version_has_selectable_sighash (ver)
 293       || priv->sign_algorithms_size == 0)
 294     /* none set, allow SHA-1 only */
 295     {
 296       return _gnutls_x509_pk_to_sign (cert->subject_pk_algorithm, GNUTLS_DIG_SHA1);
 297     }
 298
 299   for (i = 0; i < priv->sign_algorithms_size; i++)
 300     {
 301       if (_gnutls_sign_get_pk_algorithm (priv->sign_algorithms[i]) == cert->subject_pk_algorithm)
 302         {
 303           if (cert_compatible_with_sig(cert, ver, priv->sign_algorithms[i]) < 0)
 304             continue;
 305
 306           return priv->sign_algorithms[i];
 307         }
 308     }
 309
 310   return GNUTLS_SIGN_UNKNOWN;
 311 }
 312
 313
 314 /* Check if the given signature algorithm is accepted by
 315  * the peer. Returns 0 on success or a negative value
 316  * on error.
 317  */
 318 int
 319 _gnutls_session_sign_algo_requested (gnutls_session_t session,
 320                                      gnutls_sign_algorithm_t sig)
 321 {
 322   unsigned i;
 323   int ret, hash;
 324   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 325   sig_ext_st *priv;
 326   extension_priv_data_t epriv;
 327
 328   if (!_gnutls_version_has_selectable_sighash (ver))
 329     {
 330       return 0;
 331     }
 332
 333   ret =
 334     _gnutls_ext_get_session_data (session,
 335                                   GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS,
 336                                   &epriv);
 337   if (ret < 0)
 338     {
 339       gnutls_assert ();
 340       /* extension not received allow SHA1 and SHA256 */
 341       hash = _gnutls_sign_get_hash_algorithm (sig);
 342       if (hash == GNUTLS_DIG_SHA1 || hash == GNUTLS_DIG_SHA256)
 343         return 0;
 344       else
 345         return ret;
 346     }
 347   priv = epriv.ptr;
 348
 349   if (priv->sign_algorithms_size == 0)
 350     /* none set, allow all */
 351     {
 352       return 0;
 353     }
 354
 355   for (i = 0; i < priv->sign_algorithms_size; i++)
 356     {
 357       if (priv->sign_algorithms[i] == sig)
 358         {
 359           return 0;             /* ok */
 360         }
 361     }
 362
 363   return GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM;
 364 }
 365
 366 /* Check if the given signature algorithm is supported.
 367  * This means that it is enabled by the priority functions,
 368  * and in case of a server a matching certificate exists.
 369  */
 370 int
 371 _gnutls_session_sign_algo_enabled (gnutls_session_t session,
 372                                    gnutls_sign_algorithm_t sig)
 373 {
 374   unsigned i;
 375   int ret;
 376   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 377   sig_ext_st *priv;
 378   extension_priv_data_t epriv;
 379
 380   ret =
 381     _gnutls_ext_get_session_data (session,
 382                                   GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS,
 383                                   &epriv);
 384   if (ret < 0)
 385     {
 386       gnutls_assert ();
 387       return 0;
 388     }
 389   priv = epriv.ptr;
 390
 391   if (!_gnutls_version_has_selectable_sighash (ver)
 392       || priv->sign_algorithms_size == 0)
 393     /* none set, allow all */
 394     {
 395       return 0;
 396     }
 397
 398   for (i = 0; i < session->internals.priorities.sign_algo.algorithms; i++)
 399     {
 400       if (session->internals.priorities.sign_algo.priority[i] == sig)
 401         {
 402           return 0;             /* ok */
 403         }
 404     }
 405
 406   return GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM;
 407 }
 408
 409 static void
 410 signature_algorithms_deinit_data (extension_priv_data_t priv)
 411 {
 412   gnutls_free (priv.ptr);
 413 }
 414
 415 static int
 416 signature_algorithms_pack (extension_priv_data_t epriv, gnutls_buffer_st * ps)
 417 {
 418   sig_ext_st *priv = epriv.ptr;
 419   int ret, i;
 420
 421   BUFFER_APPEND_NUM (ps, priv->sign_algorithms_size);
 422   for (i = 0; i < priv->sign_algorithms_size; i++)
 423     {
 424       BUFFER_APPEND_NUM (ps, priv->sign_algorithms[i]);
 425     }
 426   return 0;
 427 }
 428
 429 static int
 430 signature_algorithms_unpack (gnutls_buffer_st * ps,
 431                              extension_priv_data_t * _priv)
 432 {
 433   sig_ext_st *priv;
 434   int i, ret;
 435   extension_priv_data_t epriv;
 436
 437   priv = gnutls_calloc (1, sizeof (*priv));
 438   if (priv == NULL)
 439     {
 440       gnutls_assert ();
 441       return GNUTLS_E_MEMORY_ERROR;
 442     }
 443
 444   BUFFER_POP_NUM (ps, priv->sign_algorithms_size);
 445   for (i = 0; i < priv->sign_algorithms_size; i++)
 446     {
 447       BUFFER_POP_NUM (ps, priv->sign_algorithms[i]);
 448     }
 449
 450   epriv.ptr = priv;
 451   *_priv = epriv;
 452
 453   return 0;
 454
 455 error:
 456   gnutls_free (priv);
 457   return ret;
 458 }
 459
 460
 461
 462 /**
 463  * gnutls_sign_algorithm_get_requested:
 464  * @session: is a #gnutls_session_t structure.
 465  * @indx: is an index of the signature algorithm to return
 466  * @algo: the returned certificate type will be stored there
 467  *
 468  * Returns the signature algorithm specified by index that was
 469  * requested by the peer. If the specified index has no data available
 470  * this function returns %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE.  If
 471  * the negotiated TLS version does not support signature algorithms
 472  * then %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned even
 473  * for the first index.  The first index is 0.
 474  *
 475  * This function is useful in the certificate callback functions
 476  * to assist in selecting the correct certificate.
 477  *
 478  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 479  *   an error code is returned.
 480  *
 481  * Since: 2.10.0
 482  **/
 483 int
 484 gnutls_sign_algorithm_get_requested (gnutls_session_t session,
 485                                      size_t indx,
 486                                      gnutls_sign_algorithm_t * algo)
 487 {
 488   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 489   sig_ext_st *priv;
 490   extension_priv_data_t epriv;
 491   int ret;
 492
 493   ret =
 494     _gnutls_ext_get_session_data (session,
 495                                   GNUTLS_EXTENSION_SIGNATURE_ALGORITHMS,
 496                                   &epriv);
 497   if (ret < 0)
 498     {
 499       gnutls_assert ();
 500       return ret;
 501     }
 502   priv = epriv.ptr;
 503
 504   if (!_gnutls_version_has_selectable_sighash (ver)
 505       || priv->sign_algorithms_size == 0)
 506     {
 507       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 508     }
 509
 510   if (indx < priv->sign_algorithms_size)
 511     {
 512       *algo = priv->sign_algorithms[indx];
 513       return 0;
 514     }
 515   else
 516     return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 517 }