tortls_nss.c 18.5 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
/* Copyright (c) 2003, Roger Dingledine.
 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
 * Copyright (c) 2007-2018, The Tor Project, Inc. */
/* See LICENSE for licensing information */

/**
 * \file tortls_nss.c
 * \brief Wrapper functions to present a consistent interface to
 * TLS and SSL X.509 functions from NSS.
 **/

#include "orconfig.h"

#define TORTLS_PRIVATE
Nick Mathewson's avatar
Nick Mathewson committed
15
#define TOR_X509_PRIVATE
16

17
#ifdef _WIN32
18
19
20
21
22
23
24
25
  #include <winsock2.h>
  #include <ws2tcpip.h>
#endif

#include "lib/crypt_ops/crypto_cipher.h"
#include "lib/crypt_ops/crypto_rand.h"
#include "lib/crypt_ops/crypto_dh.h"
#include "lib/crypt_ops/crypto_util.h"
Nick Mathewson's avatar
Nick Mathewson committed
26
27
28
#include "lib/crypt_ops/crypto_nss_mgt.h"
#include "lib/string/printf.h"

29
#include "lib/tls/x509.h"
Nick Mathewson's avatar
Nick Mathewson committed
30
#include "lib/tls/x509_internal.h"
31
#include "lib/tls/tortls.h"
Nick Mathewson's avatar
Nick Mathewson committed
32
#include "lib/tls/tortls_st.h"
33
34
35
#include "lib/tls/tortls_internal.h"
#include "lib/log/util_bug.h"

36
DISABLE_GCC_WARNING(strict-prototypes)
Nick Mathewson's avatar
Nick Mathewson committed
37
38
39
40
41
42
43
#include <prio.h>
// For access to raw sockets.
#include <private/pprio.h>
#include <ssl.h>
#include <sslt.h>
#include <sslproto.h>
#include <certt.h>
44
ENABLE_GCC_WARNING(strict-prototypes)
Nick Mathewson's avatar
Nick Mathewson committed
45
46
47

static SECStatus always_accept_cert_cb(void *, PRFileDesc *, PRBool, PRBool);

48
49
50
51
52
53
54
55
MOCK_IMPL(void,
try_to_extract_certs_from_tls,(int severity, tor_tls_t *tls,
                               tor_x509_cert_impl_t **cert_out,
                               tor_x509_cert_impl_t **id_cert_out))
{
  tor_assert(tls);
  tor_assert(cert_out);
  tor_assert(id_cert_out);
Nick Mathewson's avatar
Nick Mathewson committed
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
  (void) severity;

  *cert_out = *id_cert_out = NULL;

  CERTCertificate *peer = SSL_PeerCertificate(tls->ssl);
  if (!peer)
    return;
  *cert_out = peer; /* Now owns pointer. */

  CERTCertList *chain = SSL_PeerCertificateChain(tls->ssl);
  CERTCertListNode *c = CERT_LIST_HEAD(chain);
  for (; !CERT_LIST_END(c, chain); c = CERT_LIST_NEXT(c)) {
    if (CERT_CompareCerts(c->cert, peer) == PR_FALSE) {
      *id_cert_out = CERT_DupCertificate(c->cert);
      break;
    }
  }
  CERT_DestroyCertList(chain);
}

static bool
we_like_ssl_cipher(SSLCipherAlgorithm ca)
{
  switch (ca) {
    case ssl_calg_null: return false;
    case ssl_calg_rc4: return false;
    case ssl_calg_rc2: return false;
    case ssl_calg_des: return false;
    case ssl_calg_3des: return false; /* ???? */
    case ssl_calg_idea: return false;
    case ssl_calg_fortezza: return false;
    case ssl_calg_camellia: return false;
    case ssl_calg_seed: return false;

    case ssl_calg_aes: return true;
    case ssl_calg_aes_gcm: return true;
    case ssl_calg_chacha20: return true;
    default: return true;
  }
}
static bool
we_like_ssl_kea(SSLKEAType kt)
{
  switch (kt) {
    case ssl_kea_null: return false;
    case ssl_kea_rsa: return false; /* ??? */
    case ssl_kea_fortezza: return false;
    case ssl_kea_ecdh_psk: return false;
    case ssl_kea_dh_psk: return false;

    case ssl_kea_dh: return true;
    case ssl_kea_ecdh: return true;
    case ssl_kea_tls13_any: return true;

    case ssl_kea_size: return true; /* prevent a warning. */
    default: return true;
  }
}

static bool
we_like_mac_algorithm(SSLMACAlgorithm ma)
{
  switch (ma) {
    case ssl_mac_null: return false;
    case ssl_mac_md5: return false;
    case ssl_hmac_md5: return false;

    case ssl_mac_sha: return true;
    case ssl_hmac_sha: return true;
    case ssl_hmac_sha256: return true;
    case ssl_mac_aead: return true;
    case ssl_hmac_sha384: return true;
    default: return true;
  }
}

static bool
we_like_auth_type(SSLAuthType at)
{
  switch (at) {
    case ssl_auth_null: return false;
    case ssl_auth_rsa_decrypt: return false;
    case ssl_auth_dsa: return false;
    case ssl_auth_kea: return false;

    case ssl_auth_ecdsa: return true;
    case ssl_auth_ecdh_rsa: return true;
    case ssl_auth_ecdh_ecdsa: return true;
    case ssl_auth_rsa_sign: return true;
    case ssl_auth_rsa_pss: return true;
    case ssl_auth_psk: return true;
    case ssl_auth_tls13_any: return true;

    case ssl_auth_size: return true; /* prevent a warning. */
    default: return true;
  }
152
153
154
155
156
157
}

tor_tls_context_t *
tor_tls_context_new(crypto_pk_t *identity,
                    unsigned int key_lifetime, unsigned flags, int is_client)
{
Nick Mathewson's avatar
Nick Mathewson committed
158
  SECStatus s;
159
  tor_assert(identity);
Nick Mathewson's avatar
Nick Mathewson committed
160
161
162
163
164
165
166
167
168
169
170

  tor_tls_context_t *ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  ctx->refcnt = 1;

  if (! is_client) {
    if (tor_tls_context_init_certificates(ctx, identity,
                                          key_lifetime, flags) < 0) {
      goto err;
    }
  }

Nick Mathewson's avatar
Nick Mathewson committed
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
  {
    /* Create the "model" PRFileDesc that we will use to base others on. */
    PRFileDesc *tcp = PR_NewTCPSocket();
    if (!tcp)
      goto err;

    ctx->ctx = SSL_ImportFD(NULL, tcp);
    if (!ctx->ctx) {
      PR_Close(tcp);
      goto err;
    }
  }

  // Configure the certificate.
  if (!is_client) {
    s = SSL_ConfigServerCert(ctx->ctx,
                             ctx->my_link_cert->cert,
                             (SECKEYPrivateKey *)
                               crypto_pk_get_nss_privkey(ctx->link_key),
                             NULL, /* ExtraServerCertData */
                             0 /* DataLen */);
    if (s != SECSuccess)
      goto err;
  }

  // We need a certificate from the other side.
  if (is_client) {
    // XXXX does this do anything?
    s = SSL_OptionSet(ctx->ctx, SSL_REQUIRE_CERTIFICATE, PR_TRUE);
    if (s != SECSuccess)
      goto err;
  }

  // Always accept other side's cert; we'll check it ourselves in goofy
  // tor ways.
  s = SSL_AuthCertificateHook(ctx->ctx, always_accept_cert_cb, NULL);

  // We allow simultaneous read and write.
  s = SSL_OptionSet(ctx->ctx, SSL_ENABLE_FDX, PR_TRUE);
  if (s != SECSuccess)
    goto err;
  // XXXX SSL_ROLLBACK_DETECTION??
  // XXXX SSL_ENABLE_ALPN??

  // Force client-mode or server_mode.
  s = SSL_OptionSet(ctx->ctx,
                is_client ? SSL_HANDSHAKE_AS_CLIENT : SSL_HANDSHAKE_AS_SERVER,
                PR_TRUE);
  if (s != SECSuccess)
    goto err;

  // Disable everything before TLS 1.0; support everything else.
  {
    SSLVersionRange vrange;
    memset(&vrange, 0, sizeof(vrange));
    s = SSL_VersionRangeGetSupported(ssl_variant_stream, &vrange);
    if (s != SECSuccess)
      goto err;
    if (vrange.min < SSL_LIBRARY_VERSION_TLS_1_0)
      vrange.min = SSL_LIBRARY_VERSION_TLS_1_0;
    s = SSL_VersionRangeSet(ctx->ctx, &vrange);
    if (s != SECSuccess)
      goto err;
  }

  // Only support strong ciphers.
  {
    const PRUint16 *ciphers = SSL_GetImplementedCiphers();
    const PRUint16 n_ciphers = SSL_GetNumImplementedCiphers();
    PRUint16 i;
    for (i = 0; i < n_ciphers; ++i) {
      SSLCipherSuiteInfo info;
      memset(&info, 0, sizeof(info));
      s = SSL_GetCipherSuiteInfo(ciphers[i], &info, sizeof(info));
      if (s != SECSuccess)
        goto err;
      if (BUG(info.cipherSuite != ciphers[i]))
        goto err;
      int disable = info.effectiveKeyBits < 128 ||
        info.macBits < 128 ||
        !we_like_ssl_cipher(info.symCipher) ||
        !we_like_ssl_kea(info.keaType) ||
        !we_like_mac_algorithm(info.macAlgorithm) ||
        !we_like_auth_type(info.authType)/* Requires NSS 3.24 */;

      s = SSL_CipherPrefSet(ctx->ctx, ciphers[i],
                            disable ? PR_FALSE : PR_TRUE);
      if (s != SECSuccess)
        goto err;
    }
  }

  // Only use DH and ECDH keys once.
  s = SSL_OptionSet(ctx->ctx, SSL_REUSE_SERVER_ECDHE_KEY, PR_FALSE);
  if (s != SECSuccess)
    goto err;

  // don't cache sessions.
  s = SSL_OptionSet(ctx->ctx, SSL_NO_CACHE, PR_TRUE);
  if (s != SECSuccess)
    goto err;

  // Enable DH.
  s = SSL_OptionSet(ctx->ctx, SSL_ENABLE_SERVER_DHE, PR_TRUE);
  if (s != SECSuccess)
    goto err;

  // Set DH and ECDH groups.
  SSLNamedGroup groups[] = {
      ssl_grp_ec_curve25519,
      ssl_grp_ec_secp256r1,
      ssl_grp_ec_secp224r1,
      ssl_grp_ffdhe_2048,
  };
  s = SSL_NamedGroupConfig(ctx->ctx, groups, ARRAY_LENGTH(groups));
  if (s != SECSuccess)
    goto err;

  // These features are off by default, so we don't need to disable them:
  //   Session tickets
  //   Renegotiation
  //   Compression
Nick Mathewson's avatar
Nick Mathewson committed
293
294
295
296
297
298
299

  goto done;
 err:
  tor_tls_context_decref(ctx);
  ctx = NULL;
 done:
  return ctx;
300
}
Nick Mathewson's avatar
Nick Mathewson committed
301

302
void
303
tor_tls_context_impl_free_(tor_tls_context_impl_t *ctx)
304
{
305
306
  if (!ctx)
    return;
Nick Mathewson's avatar
Nick Mathewson committed
307
  PR_Close(ctx);
308
}
309
310
311
312
313
314
315

void
tor_tls_get_state_description(tor_tls_t *tls, char *buf, size_t sz)
{
  (void)tls;
  (void)buf;
  (void)sz;
Nick Mathewson's avatar
Nick Mathewson committed
316
317
  // AFAICT, NSS doesn't expose its internal state.
  buf[0]=0;
318
319
320
321
322
}

void
tor_tls_init(void)
{
Nick Mathewson's avatar
Nick Mathewson committed
323
  /* We don't have any global setup to do yet, but that will change */
324
}
Nick Mathewson's avatar
Nick Mathewson committed
325

326
327
328
329
void
tls_log_errors(tor_tls_t *tls, int severity, int domain,
               const char *doing)
{
330
331
332
333
  /* This implementation is a little different for NSS than it is for OpenSSL
     -- it logs the last error whether anything actually failed or not. So we
     have to only call it when something has gone wrong and we have a real
     error to report. */
Nick Mathewson's avatar
Nick Mathewson committed
334

335
  (void)tls;
Nick Mathewson's avatar
Nick Mathewson committed
336
337
  PRErrorCode code = PORT_GetError();

338
  const char *addr = tls ? tls->address : NULL;
Nick Mathewson's avatar
Nick Mathewson committed
339
340
341
342
343
344
345
346
347
348
  const char *string = PORT_ErrorToString(code);
  const char *name = PORT_ErrorToName(code);
  char buf[16];
  if (!string)
    string = "<unrecognized>";
  if (!name) {
    tor_snprintf(buf, sizeof(buf), "%d", code);
    name = buf;
  }

349
350
  const char *with = addr ? " with " : "";
  addr = addr ? addr : "";
Nick Mathewson's avatar
Nick Mathewson committed
351
  if (doing) {
352
353
    log_fn(severity, domain, "TLS error %s while %s%s%s: %s",
           name, doing, with, addr, string);
Nick Mathewson's avatar
Nick Mathewson committed
354
  } else {
355
356
    log_fn(severity, domain, "TLS error %s%s%s: %s", name, string,
           with, addr);
Nick Mathewson's avatar
Nick Mathewson committed
357
  }
358
359
360
}

tor_tls_t *
Nick Mathewson's avatar
Nick Mathewson committed
361
tor_tls_new(tor_socket_t sock, int is_server)
362
363
{
  (void)sock;
Nick Mathewson's avatar
Nick Mathewson committed
364
365
  tor_tls_context_t *ctx = tor_tls_context_get(is_server);

366
367
368
369
370
371
372
  PRFileDesc *tcp = NULL;
  if (SOCKET_OK(sock)) {
    tcp = PR_ImportTCPSocket(sock);
  } else {
    tcp = PR_NewTCPSocket();
  }

Nick Mathewson's avatar
Nick Mathewson committed
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
  if (!tcp)
    return NULL;

  PRFileDesc *ssl = SSL_ImportFD(ctx->ctx, tcp);
  if (!ssl) {
    PR_Close(tcp);
    return NULL;
  }

  tor_tls_t *tls = tor_malloc_zero(sizeof(tor_tls_t));
  tls->magic = TOR_TLS_MAGIC;
  tls->context = ctx;
  tor_tls_context_incref(ctx);
  tls->ssl = ssl;
  tls->socket = sock;
  tls->state = TOR_TLS_ST_HANDSHAKE;
  tls->isServer = !!is_server;

  if (!is_server) {
    /* Set a random SNI */
    char *fake_hostname = crypto_random_hostname(4,25, "www.",".com");
    SSL_SetURL(tls->ssl, fake_hostname);
    tor_free(fake_hostname);
  }
  SECStatus s = SSL_ResetHandshake(ssl, is_server ? PR_TRUE : PR_FALSE);
  if (s != SECSuccess) {
399
    tls_log_errors(tls, LOG_WARN, LD_CRYPTO, "resetting handshake state");
Nick Mathewson's avatar
Nick Mathewson committed
400
401
402
  }

  return tls;
403
}
Nick Mathewson's avatar
Nick Mathewson committed
404

405
406
407
408
409
410
411
412
void
tor_tls_set_renegotiate_callback(tor_tls_t *tls,
                                 void (*cb)(tor_tls_t *, void *arg),
                                 void *arg)
{
  tor_assert(tls);
  (void)cb;
  (void)arg;
Nick Mathewson's avatar
Nick Mathewson committed
413
414

  /* We don't support renegotiation-based TLS with NSS. */
415
416
417
}

void
Nick Mathewson's avatar
Nick Mathewson committed
418
tor_tls_impl_free_(tor_tls_impl_t *tls)
419
{
Nick Mathewson's avatar
Nick Mathewson committed
420
421
  // XXXX This will close the underlying fd, which our OpenSSL version does
  // not do!
422
423
  if (!tls)
    return;
Nick Mathewson's avatar
Nick Mathewson committed
424
425

  PR_Close(tls);
426
427
428
429
430
}

int
tor_tls_peer_has_cert(tor_tls_t *tls)
{
Nick Mathewson's avatar
Nick Mathewson committed
431
432
433
434
  CERTCertificate *cert = SSL_PeerCertificate(tls->ssl);
  int result = (cert != NULL);
  CERT_DestroyCertificate(cert);
  return result;
435
}
Nick Mathewson's avatar
Nick Mathewson committed
436

437
438
439
MOCK_IMPL(tor_x509_cert_t *,
tor_tls_get_peer_cert,(tor_tls_t *tls))
{
Nick Mathewson's avatar
Nick Mathewson committed
440
441
442
443
444
  CERTCertificate *cert = SSL_PeerCertificate(tls->ssl);
  if (cert)
    return tor_x509_cert_new(cert);
  else
    return NULL;
445
}
Nick Mathewson's avatar
Nick Mathewson committed
446

447
448
449
450
MOCK_IMPL(tor_x509_cert_t *,
tor_tls_get_own_cert,(tor_tls_t *tls))
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
451
452
453
454
455
  CERTCertificate *cert = SSL_LocalCertificate(tls->ssl);
  if (cert)
    return tor_x509_cert_new(cert);
  else
    return NULL;
456
}
Nick Mathewson's avatar
Nick Mathewson committed
457

458
459
460
461
462
MOCK_IMPL(int,
tor_tls_read, (tor_tls_t *tls, char *cp, size_t len))
{
  tor_assert(tls);
  tor_assert(cp);
Nick Mathewson's avatar
Nick Mathewson committed
463
464
465
466
467
468
469
470
471
472
473
474
475
476
  tor_assert(len < INT_MAX);

  PRInt32 rv = PR_Read(tls->ssl, cp, (int)len);
  // log_debug(LD_NET, "PR_Read(%zu) returned %d", n, (int)rv);
  if (rv > 0) {
    tls->n_read_since_last_check += rv;
    return rv;
  }
  if (rv == 0)
    return TOR_TLS_CLOSE;
  PRErrorCode err = PORT_GetError();
  if (err == PR_WOULD_BLOCK_ERROR) {
    return TOR_TLS_WANTREAD; // XXXX ????
  } else {
477
    tls_log_errors(tls, LOG_NOTICE, LD_CRYPTO, "reading"); // XXXX
Nick Mathewson's avatar
Nick Mathewson committed
478
479
    return TOR_TLS_ERROR_MISC; // ????
  }
480
}
Nick Mathewson's avatar
Nick Mathewson committed
481

482
483
484
485
int
tor_tls_write(tor_tls_t *tls, const char *cp, size_t n)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
  tor_assert(cp || n == 0);
  tor_assert(n < INT_MAX);

  PRInt32 rv = PR_Write(tls->ssl, cp, (int)n);
  // log_debug(LD_NET, "PR_Write(%zu) returned %d", n, (int)rv);
  if (rv > 0) {
    tls->n_written_since_last_check += rv;
    return rv;
  }
  if (rv == 0)
    return TOR_TLS_ERROR_MISC;
  PRErrorCode err = PORT_GetError();

  if (err == PR_WOULD_BLOCK_ERROR) {
    return TOR_TLS_WANTWRITE; // XXXX ????
  } else {
502
    tls_log_errors(tls, LOG_NOTICE, LD_CRYPTO, "writing"); // XXXX
Nick Mathewson's avatar
Nick Mathewson committed
503
504
    return TOR_TLS_ERROR_MISC; // ????
  }
505
}
Nick Mathewson's avatar
Nick Mathewson committed
506

507
508
509
510
int
tor_tls_handshake(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
511
512
513
514
515
516
517
518
519
520
521
522
  tor_assert(tls->state == TOR_TLS_ST_HANDSHAKE);

  SECStatus s = SSL_ForceHandshake(tls->ssl);
  if (s == SECSuccess) {
    tls->state = TOR_TLS_ST_OPEN;
    log_debug(LD_NET, "SSL handshake is supposedly complete.");
    return tor_tls_finish_handshake(tls);
  }
  if (PORT_GetError() == PR_WOULD_BLOCK_ERROR)
    return TOR_TLS_WANTREAD; /* XXXX What about wantwrite? */

  return TOR_TLS_ERROR_MISC; // XXXX
523
}
Nick Mathewson's avatar
Nick Mathewson committed
524

525
526
527
528
int
tor_tls_finish_handshake(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
529
530
531
  // We don't need to do any of the weird handshake nonsense stuff on NSS,
  // since we only support recent handshakes.
  return TOR_TLS_DONE;
532
}
Nick Mathewson's avatar
Nick Mathewson committed
533

534
535
536
537
void
tor_tls_unblock_renegotiation(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
538
  /* We don't support renegotiation with NSS. */
539
}
Nick Mathewson's avatar
Nick Mathewson committed
540

541
542
543
544
void
tor_tls_block_renegotiation(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
545
  /* We don't support renegotiation with NSS. */
546
}
Nick Mathewson's avatar
Nick Mathewson committed
547

548
549
550
551
void
tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
552
  /* We don't support renegotiation with NSS. */
553
}
Nick Mathewson's avatar
Nick Mathewson committed
554

555
556
557
558
int
tor_tls_get_pending_bytes(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
559
560
  int n = SSL_DataPending(tls->ssl);
  if (n < 0) {
561
    tls_log_errors(tls, LOG_WARN, LD_CRYPTO, "looking up pending bytes");
Nick Mathewson's avatar
Nick Mathewson committed
562
563
564
    return 0;
  }
  return (int)n;
565
}
Nick Mathewson's avatar
Nick Mathewson committed
566

567
568
569
570
size_t
tor_tls_get_forced_write_size(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
571
  /* NSS doesn't have the same "forced write" restriction as openssl. */
572
573
  return 0;
}
Nick Mathewson's avatar
Nick Mathewson committed
574

575
576
577
578
579
580
581
void
tor_tls_get_n_raw_bytes(tor_tls_t *tls,
                        size_t *n_read, size_t *n_written)
{
  tor_assert(tls);
  tor_assert(n_read);
  tor_assert(n_written);
Nick Mathewson's avatar
Nick Mathewson committed
582
583
584
585
586
587
588
  /* XXXX We don't curently have a way to measure this information correctly
   * in NSS; we could do that with a PRIO layer, but it'll take a little
   * coding.  For now, we just track the number of bytes sent _in_ the TLS
   * stream.  Doing this will make our rate-limiting slightly inaccurate. */
  *n_read = tls->n_read_since_last_check;
  *n_written = tls->n_written_since_last_check;
  tls->n_read_since_last_check = tls->n_written_since_last_check = 0;
589
590
591
592
593
594
595
596
597
598
599
600
}

int
tor_tls_get_buffer_sizes(tor_tls_t *tls,
                         size_t *rbuf_capacity, size_t *rbuf_bytes,
                         size_t *wbuf_capacity, size_t *wbuf_bytes)
{
  tor_assert(tls);
  tor_assert(rbuf_capacity);
  tor_assert(rbuf_bytes);
  tor_assert(wbuf_capacity);
  tor_assert(wbuf_bytes);
Nick Mathewson's avatar
Nick Mathewson committed
601
602

  /* This is an acceptable way to say "we can't measure this." */
603
604
  return -1;
}
Nick Mathewson's avatar
Nick Mathewson committed
605

606
607
608
MOCK_IMPL(double,
tls_get_write_overhead_ratio, (void))
{
Nick Mathewson's avatar
Nick Mathewson committed
609
610
611
  /* XXX We don't currently have a way to measure this in NSS; we could do that
   * XXX with a PRIO layer, but it'll take a little coding. */
  return 0.95;
612
613
614
615
616
617
}

int
tor_tls_used_v1_handshake(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
618
619
620
  /* We don't support or allow the V1 handshake with NSS.
   */
  return 0;
621
}
Nick Mathewson's avatar
Nick Mathewson committed
622

623
624
625
626
int
tor_tls_server_got_renegotiate(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
627
  return 0; /* We don't support renegotiation with NSS */
628
}
Nick Mathewson's avatar
Nick Mathewson committed
629

630
631
632
633
634
635
MOCK_IMPL(int,
tor_tls_cert_matches_key,(const tor_tls_t *tls,
                          const struct tor_x509_cert_t *cert))
{
  tor_assert(tls);
  tor_assert(cert);
Nick Mathewson's avatar
Nick Mathewson committed
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
  int rv = 0;

  CERTCertificate *peercert = SSL_PeerCertificate(tls->ssl);
  if (!peercert)
    goto done;
  CERTSubjectPublicKeyInfo *peer_info = &peercert->subjectPublicKeyInfo;
  CERTSubjectPublicKeyInfo *cert_info = &cert->cert->subjectPublicKeyInfo;
  rv = SECOID_CompareAlgorithmID(&peer_info->algorithm,
                                 &cert_info->algorithm) == 0 &&
       SECITEM_ItemsAreEqual(&peer_info->subjectPublicKey,
                             &cert_info->subjectPublicKey);

 done:
  if (peercert)
    CERT_DestroyCertificate(peercert);
  return rv;
652
}
Nick Mathewson's avatar
Nick Mathewson committed
653

654
655
656
657
658
MOCK_IMPL(int,
tor_tls_get_tlssecrets,(tor_tls_t *tls, uint8_t *secrets_out))
{
  tor_assert(tls);
  tor_assert(secrets_out);
Nick Mathewson's avatar
Nick Mathewson committed
659
660
661

  /* There's no way to get this information out of NSS. */

662
663
  return -1;
}
Nick Mathewson's avatar
Nick Mathewson committed
664

665
666
667
668
669
670
671
672
673
674
MOCK_IMPL(int,
tor_tls_export_key_material,(tor_tls_t *tls, uint8_t *secrets_out,
                             const uint8_t *context,
                             size_t context_len,
                             const char *label))
{
  tor_assert(tls);
  tor_assert(secrets_out);
  tor_assert(context);
  tor_assert(label);
Nick Mathewson's avatar
Nick Mathewson committed
675
676
  tor_assert(strlen(label) <= UINT_MAX);
  tor_assert(context_len <= UINT_MAX);
677

Nick Mathewson's avatar
Nick Mathewson committed
678
679
680
681
682
683
684
  SECStatus s;
  s = SSL_ExportKeyingMaterial(tls->ssl,
                               label, (unsigned)strlen(label),
                               PR_TRUE, context, (unsigned)context_len,
                               secrets_out, DIGEST256_LEN);

  return (s == SECSuccess) ? 0 : -1;
685
686
687
688
689
690
}

const char *
tor_tls_get_ciphersuite_name(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708

  SSLChannelInfo channel_info;
  SSLCipherSuiteInfo cipher_info;

  memset(&channel_info, 0, sizeof(channel_info));
  memset(&cipher_info, 0, sizeof(cipher_info));

  SECStatus s = SSL_GetChannelInfo(tls->ssl,
                                   &channel_info, sizeof(channel_info));
  if (s != SECSuccess)
    return NULL;

  s = SSL_GetCipherSuiteInfo(channel_info.cipherSuite,
                             &cipher_info, sizeof(cipher_info));
  if (s != SECSuccess)
    return NULL;

  return cipher_info.cipherSuiteName;
709
710
}

Nick Mathewson's avatar
Nick Mathewson committed
711
712
713
/** The group we should use for ecdhe when none was selected. */
#define SEC_OID_TOR_DEFAULT_ECDHE_GROUP SEC_OID_ANSIX962_EC_PRIME256V1

714
715
716
int
evaluate_ecgroup_for_tls(const char *ecgroup)
{
Nick Mathewson's avatar
Nick Mathewson committed
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
  SECOidTag tag;

  if (!ecgroup)
    tag = SEC_OID_TOR_DEFAULT_ECDHE_GROUP;
  else if (!strcasecmp(ecgroup, "P256"))
    tag = SEC_OID_ANSIX962_EC_PRIME256V1;
  else if (!strcasecmp(ecgroup, "P224"))
    tag = SEC_OID_SECG_EC_SECP224R1;
  else
    return 0;

  /* I don't think we need any additional tests here for NSS */
  (void) tag;

  return 1;
}

static SECStatus
always_accept_cert_cb(void *arg, PRFileDesc *ssl, PRBool checkSig,
                      PRBool isServer)
{
  (void)arg;
  (void)ssl;
  (void)checkSig;
  (void)isServer;
  return SECSuccess;
743
}