src/core/sip-sec-tls-dsk.c

   1 /**
   2  * @file sip-sec-tls-dsk.c
   3  *
   4  * pidgin-sipe
   5  *
   6  * Copyright (C) 2011-2015 SIPE Project <http://sipe.sourceforge.net/>
   7  *
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  22  *
  23  *
  24  * Specification references:
  25  *
  26  *   - [MS-SIPAE]:    http://msdn.microsoft.com/en-us/library/cc431510.aspx
  27  *   - [MS-OCAUTHWS]: http://msdn.microsoft.com/en-us/library/ff595592.aspx
  28  *   - MS Tech-Ed Europe 2010 "UNC310: Microsoft Lync 2010 Technology Explained"
  29  *     http://ecn.channel9.msdn.com/o9/te/Europe/2010/pptx/unc310.pptx
  30  */
  31
  32 #ifdef HAVE_CONFIG_H
  33 #include "config.h"
  34 #endif
  35
  36 #include <string.h>
  37
  38 #include <glib.h>
  39
  40 #include "sipe-common.h"
  41 #include "sip-sec.h"
  42 #include "sip-sec-mech.h"
  43 #include "sip-sec-tls-dsk.h"
  44 #include "sipe-backend.h"
  45 #include "sipe-digest.h"
  46 #include "sipe-tls.h"
  47
  48 /* Security context for TLS-DSK */
  49 typedef struct _context_tls_dsk {
  50         struct sip_sec_context common;
  51         struct sipe_tls_state *state;
  52         enum sipe_tls_digest_algorithm algorithm;
  53         guchar *client_key;
  54         guchar *server_key;
  55         gsize key_length;
  56 } *context_tls_dsk;
  57
  58 /* sip-sec-mech.h API implementation for TLS-DSK */
  59
  60 static gboolean
  61 sip_sec_acquire_cred__tls_dsk(SipSecContext context,
  62                               SIPE_UNUSED_PARAMETER const gchar *username,
  63                               const gchar *password)
  64 {
  65         context_tls_dsk ctx = (context_tls_dsk) context;
  66
  67         return((ctx->state = sipe_tls_start((gpointer) password)) != NULL);
  68 }
  69
  70 static gboolean
  71 sip_sec_init_sec_context__tls_dsk(SipSecContext context,
  72                                   SipSecBuffer in_buff,
  73                                   SipSecBuffer *out_buff,
  74                                   SIPE_UNUSED_PARAMETER const gchar *service_name)
  75 {
  76         context_tls_dsk ctx = (context_tls_dsk) context;
  77         struct sipe_tls_state *state = ctx->state;
  78
  79         state->in_buffer = in_buff.value;
  80         state->in_length = in_buff.length;
  81
  82         if (sipe_tls_next(state)) {
  83                 if ((state->algorithm != SIPE_TLS_DIGEST_ALGORITHM_NONE) &&
  84                     state->client_key && state->server_key) {
  85                         /* Authentication is completed */
  86                         context->flags |= SIP_SEC_FLAG_COMMON_READY;
  87
  88                         /* copy key pair */
  89                         ctx->algorithm  = state->algorithm;
  90                         ctx->key_length = state->key_length;
  91                         ctx->client_key = g_memdup(state->client_key,
  92                                                    state->key_length);
  93                         ctx->server_key = g_memdup(state->server_key,
  94                                                    state->key_length);
  95
  96                         /* extract certicate expiration time */
  97                         ctx->common.expires = sipe_tls_expires(state);
  98
  99                         SIPE_DEBUG_INFO("sip_sec_init_sec_context__tls_dsk: handshake completed, algorithm %d, key length %" G_GSIZE_FORMAT ", expires %d",
 100                                         ctx->algorithm, ctx->key_length, ctx->common.expires);
 101
 102                         sipe_tls_free(state);
 103                         ctx->state = NULL;
 104                 } else {
 105                         out_buff->value  = state->out_buffer;
 106                         out_buff->length = state->out_length;
 107                         /* we take ownership of the buffer */
 108                         state->out_buffer = NULL;
 109                 }
 110         } else {
 111                 sipe_tls_free(state);
 112                 ctx->state = NULL;
 113         }
 114
 115         return(((context->flags & SIP_SEC_FLAG_COMMON_READY) ||
 116                 ctx->state));
 117 }
 118
 119 static gboolean
 120 sip_sec_make_signature__tls_dsk(SipSecContext context,
 121                                 const gchar *message,
 122                                 SipSecBuffer *signature)
 123 {
 124         context_tls_dsk ctx = (context_tls_dsk) context;
 125         gboolean result = FALSE;
 126
 127         switch (ctx->algorithm) {
 128         case SIPE_TLS_DIGEST_ALGORITHM_MD5:
 129                 signature->length = SIPE_DIGEST_HMAC_MD5_LENGTH;
 130                 signature->value  = g_malloc0(signature->length);
 131                 sipe_digest_hmac_md5(ctx->client_key, ctx->key_length,
 132                                      (guchar *) message, strlen(message),
 133                                      signature->value);
 134                 result = TRUE;
 135                 break;
 136
 137         case SIPE_TLS_DIGEST_ALGORITHM_SHA1:
 138                 signature->length = SIPE_DIGEST_HMAC_SHA1_LENGTH;
 139                 signature->value  = g_malloc0(signature->length);
 140                 sipe_digest_hmac_sha1(ctx->client_key, ctx->key_length,
 141                                       (guchar *) message, strlen(message),
 142                                       signature->value);
 143                 result = TRUE;
 144                 break;
 145
 146         default:
 147                 /* this should not happen */
 148                 break;
 149         }
 150
 151         return(result);
 152 }
 153
 154 static gboolean
 155 sip_sec_verify_signature__tls_dsk(SipSecContext context,
 156                                   const gchar *message,
 157                                   SipSecBuffer signature)
 158 {
 159         context_tls_dsk ctx = (context_tls_dsk) context;
 160         SipSecBuffer mac    = { 0, NULL };
 161         gboolean result     = FALSE;
 162
 163         switch (ctx->algorithm) {
 164         case SIPE_TLS_DIGEST_ALGORITHM_MD5:
 165                 mac.length = SIPE_DIGEST_HMAC_MD5_LENGTH;
 166                 mac.value  = g_malloc0(mac.length);
 167                 sipe_digest_hmac_md5(ctx->server_key, ctx->key_length,
 168                                      (guchar *) message, strlen(message),
 169                                      mac.value);
 170                 break;
 171
 172         case SIPE_TLS_DIGEST_ALGORITHM_SHA1:
 173                 mac.length = SIPE_DIGEST_HMAC_SHA1_LENGTH;
 174                 mac.value  = g_malloc0(mac.length);
 175                 sipe_digest_hmac_sha1(ctx->server_key, ctx->key_length,
 176                                       (guchar *) message, strlen(message),
 177                                       mac.value);
 178                 break;
 179
 180         default:
 181                 /* this should not happen */
 182                 break;
 183         }
 184
 185         if (mac.value) {
 186                 result = memcmp(signature.value, mac.value, mac.length) == 0;
 187                 g_free(mac.value);
 188         }
 189
 190         return(result);
 191 }
 192
 193 static void
 194 sip_sec_destroy_sec_context__tls_dsk(SipSecContext context)
 195 {
 196         context_tls_dsk ctx = (context_tls_dsk) context;
 197
 198         sipe_tls_free(ctx->state);
 199         g_free(ctx->client_key);
 200         g_free(ctx->server_key);
 201         g_free(ctx);
 202 }
 203
 204 static const gchar *
 205 sip_sec_context_name__tls_dsk(SIPE_UNUSED_PARAMETER SipSecContext context)
 206 {
 207         return("TLS-DSK");
 208 }
 209
 210 SipSecContext
 211 sip_sec_create_context__tls_dsk(SIPE_UNUSED_PARAMETER guint type)
 212 {
 213         context_tls_dsk context = g_malloc0(sizeof(struct _context_tls_dsk));
 214         if (!context) return(NULL);
 215
 216         context->common.acquire_cred_func     = sip_sec_acquire_cred__tls_dsk;
 217         context->common.init_context_func     = sip_sec_init_sec_context__tls_dsk;
 218         context->common.destroy_context_func  = sip_sec_destroy_sec_context__tls_dsk;
 219         context->common.make_signature_func   = sip_sec_make_signature__tls_dsk;
 220         context->common.verify_signature_func = sip_sec_verify_signature__tls_dsk;
 221         context->common.context_name_func     = sip_sec_context_name__tls_dsk;
 222
 223         return((SipSecContext) context);
 224 }
 225
 226 gboolean sip_sec_password__tls_dsk(void)
 227 {
 228 #if defined(HAVE_SSPI) || defined(HAVE_GSSAPI_GSSAPI_H)
 229         /*
 230          * TLS-DSK authenticates with a published client certificate. This
 231          * process uses Web Tickets and therefore goes through HTTP. If we
 232          * have authentication schemes compiled in which allow Single Sign-On
 233          * then we should allow password-less configurations.
 234          */
 235         return(FALSE);
 236 #else
 237         return(TRUE);
 238 #endif
 239 }
 240
 241 /*
 242   Local Variables:
 243   mode: c
 244   c-file-style: "bsd"
 245   indent-tabs-mode: t
 246   tab-width: 8
 247   End:
 248 */