tortls_nss.c 22.8 KB
Newer Older
1
2
/* Copyright (c) 2003, Roger Dingledine.
 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
3
 * Copyright (c) 2007-2020, The Tor Project, Inc. */
4
5
6
7
8
9
10
11
12
13
14
/* See LICENSE for licensing information */

/**
 * \file tortls_nss.c
 * \brief Wrapper functions to present a consistent interface to
 * TLS and SSL X.509 functions from NSS.
 **/

#include "orconfig.h"

#define TORTLS_PRIVATE
Nick Mathewson's avatar
Nick Mathewson committed
15
#define TOR_X509_PRIVATE
16

17
#ifdef _WIN32
18
19
20
21
22
23
24
25
  #include <winsock2.h>
  #include <ws2tcpip.h>
#endif

#include "lib/crypt_ops/crypto_cipher.h"
#include "lib/crypt_ops/crypto_rand.h"
#include "lib/crypt_ops/crypto_dh.h"
#include "lib/crypt_ops/crypto_util.h"
Nick Mathewson's avatar
Nick Mathewson committed
26
27
28
#include "lib/crypt_ops/crypto_nss_mgt.h"
#include "lib/string/printf.h"

29
#include "lib/tls/x509.h"
Nick Mathewson's avatar
Nick Mathewson committed
30
#include "lib/tls/x509_internal.h"
31
#include "lib/tls/tortls.h"
Nick Mathewson's avatar
Nick Mathewson committed
32
#include "lib/tls/tortls_st.h"
33
#include "lib/tls/tortls_internal.h"
34
#include "lib/tls/nss_countbytes.h"
35
36
#include "lib/log/util_bug.h"

37
DISABLE_GCC_WARNING("-Wstrict-prototypes")
Nick Mathewson's avatar
Nick Mathewson committed
38
#include <prio.h>
39
// For access to rar sockets.
Nick Mathewson's avatar
Nick Mathewson committed
40
41
42
43
44
#include <private/pprio.h>
#include <ssl.h>
#include <sslt.h>
#include <sslproto.h>
#include <certt.h>
45
ENABLE_GCC_WARNING("-Wstrict-prototypes")
Nick Mathewson's avatar
Nick Mathewson committed
46
47
48

static SECStatus always_accept_cert_cb(void *, PRFileDesc *, PRBool, PRBool);

49
50
51
52
53
54
55
56
MOCK_IMPL(void,
try_to_extract_certs_from_tls,(int severity, tor_tls_t *tls,
                               tor_x509_cert_impl_t **cert_out,
                               tor_x509_cert_impl_t **id_cert_out))
{
  tor_assert(tls);
  tor_assert(cert_out);
  tor_assert(id_cert_out);
Nick Mathewson's avatar
Nick Mathewson committed
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
  (void) severity;

  *cert_out = *id_cert_out = NULL;

  CERTCertificate *peer = SSL_PeerCertificate(tls->ssl);
  if (!peer)
    return;
  *cert_out = peer; /* Now owns pointer. */

  CERTCertList *chain = SSL_PeerCertificateChain(tls->ssl);
  CERTCertListNode *c = CERT_LIST_HEAD(chain);
  for (; !CERT_LIST_END(c, chain); c = CERT_LIST_NEXT(c)) {
    if (CERT_CompareCerts(c->cert, peer) == PR_FALSE) {
      *id_cert_out = CERT_DupCertificate(c->cert);
      break;
    }
  }
  CERT_DestroyCertList(chain);
}

static bool
we_like_ssl_cipher(SSLCipherAlgorithm ca)
{
  switch (ca) {
    case ssl_calg_null: return false;
    case ssl_calg_rc4: return false;
    case ssl_calg_rc2: return false;
    case ssl_calg_des: return false;
    case ssl_calg_3des: return false; /* ???? */
    case ssl_calg_idea: return false;
    case ssl_calg_fortezza: return false;
    case ssl_calg_camellia: return false;
    case ssl_calg_seed: return false;

    case ssl_calg_aes: return true;
    case ssl_calg_aes_gcm: return true;
    case ssl_calg_chacha20: return true;
    default: return true;
  }
}
static bool
we_like_ssl_kea(SSLKEAType kt)
{
  switch (kt) {
    case ssl_kea_null: return false;
    case ssl_kea_rsa: return false; /* ??? */
    case ssl_kea_fortezza: return false;
    case ssl_kea_ecdh_psk: return false;
    case ssl_kea_dh_psk: return false;

    case ssl_kea_dh: return true;
    case ssl_kea_ecdh: return true;
    case ssl_kea_tls13_any: return true;

    case ssl_kea_size: return true; /* prevent a warning. */
    default: return true;
  }
}

static bool
we_like_mac_algorithm(SSLMACAlgorithm ma)
{
  switch (ma) {
    case ssl_mac_null: return false;
    case ssl_mac_md5: return false;
    case ssl_hmac_md5: return false;

    case ssl_mac_sha: return true;
    case ssl_hmac_sha: return true;
    case ssl_hmac_sha256: return true;
    case ssl_mac_aead: return true;
    case ssl_hmac_sha384: return true;
    default: return true;
  }
}

static bool
we_like_auth_type(SSLAuthType at)
{
  switch (at) {
    case ssl_auth_null: return false;
    case ssl_auth_rsa_decrypt: return false;
    case ssl_auth_dsa: return false;
    case ssl_auth_kea: return false;

    case ssl_auth_ecdsa: return true;
    case ssl_auth_ecdh_rsa: return true;
    case ssl_auth_ecdh_ecdsa: return true;
    case ssl_auth_rsa_sign: return true;
    case ssl_auth_rsa_pss: return true;
    case ssl_auth_psk: return true;
    case ssl_auth_tls13_any: return true;

    case ssl_auth_size: return true; /* prevent a warning. */
    default: return true;
  }
153
154
}

155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
/**
 * Return true iff this ciphersuite will be hit by a mozilla bug 1312976,
 * which makes TLS key exporters not work with TLS 1.2 non-SHA256
 * ciphersuites.
 **/
static bool
ciphersuite_has_nss_export_bug(const SSLCipherSuiteInfo *info)
{
  /* For more information on the bug, see
     https://bugzilla.mozilla.org/show_bug.cgi?id=1312976 */

  /* This bug only exists in TLS 1.2. */
  if (info->authType == ssl_auth_tls13_any)
    return false;

  /* Sadly, there's no way to get this information from the
   * CipherSuiteInfo object itself other than by looking at the
   * name.  */
  if (strstr(info->cipherSuiteName, "_SHA384") ||
      strstr(info->cipherSuiteName, "_SHA512")) {
    return true;
  }

  return false;
}

181
182
183
184
tor_tls_context_t *
tor_tls_context_new(crypto_pk_t *identity,
                    unsigned int key_lifetime, unsigned flags, int is_client)
{
Nick Mathewson's avatar
Nick Mathewson committed
185
  SECStatus s;
186
  tor_assert(identity);
Nick Mathewson's avatar
Nick Mathewson committed
187

188
189
  tor_tls_init();

Nick Mathewson's avatar
Nick Mathewson committed
190
191
192
193
194
195
196
197
198
199
  tor_tls_context_t *ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
  ctx->refcnt = 1;

  if (! is_client) {
    if (tor_tls_context_init_certificates(ctx, identity,
                                          key_lifetime, flags) < 0) {
      goto err;
    }
  }

Nick Mathewson's avatar
Nick Mathewson committed
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
  {
    /* Create the "model" PRFileDesc that we will use to base others on. */
    PRFileDesc *tcp = PR_NewTCPSocket();
    if (!tcp)
      goto err;

    ctx->ctx = SSL_ImportFD(NULL, tcp);
    if (!ctx->ctx) {
      PR_Close(tcp);
      goto err;
    }
  }

  // Configure the certificate.
  if (!is_client) {
    s = SSL_ConfigServerCert(ctx->ctx,
                             ctx->my_link_cert->cert,
                             (SECKEYPrivateKey *)
                               crypto_pk_get_nss_privkey(ctx->link_key),
                             NULL, /* ExtraServerCertData */
                             0 /* DataLen */);
    if (s != SECSuccess)
      goto err;
  }

  // We need a certificate from the other side.
  if (is_client) {
    // XXXX does this do anything?
    s = SSL_OptionSet(ctx->ctx, SSL_REQUIRE_CERTIFICATE, PR_TRUE);
    if (s != SECSuccess)
      goto err;
  }

  // Always accept other side's cert; we'll check it ourselves in goofy
  // tor ways.
  s = SSL_AuthCertificateHook(ctx->ctx, always_accept_cert_cb, NULL);

  // We allow simultaneous read and write.
  s = SSL_OptionSet(ctx->ctx, SSL_ENABLE_FDX, PR_TRUE);
  if (s != SECSuccess)
    goto err;
  // XXXX SSL_ROLLBACK_DETECTION??
  // XXXX SSL_ENABLE_ALPN??

  // Force client-mode or server_mode.
  s = SSL_OptionSet(ctx->ctx,
                is_client ? SSL_HANDSHAKE_AS_CLIENT : SSL_HANDSHAKE_AS_SERVER,
                PR_TRUE);
  if (s != SECSuccess)
    goto err;

  // Disable everything before TLS 1.0; support everything else.
  {
    SSLVersionRange vrange;
    memset(&vrange, 0, sizeof(vrange));
    s = SSL_VersionRangeGetSupported(ssl_variant_stream, &vrange);
    if (s != SECSuccess)
      goto err;
    if (vrange.min < SSL_LIBRARY_VERSION_TLS_1_0)
      vrange.min = SSL_LIBRARY_VERSION_TLS_1_0;
    s = SSL_VersionRangeSet(ctx->ctx, &vrange);
    if (s != SECSuccess)
      goto err;
  }

  // Only support strong ciphers.
  {
    const PRUint16 *ciphers = SSL_GetImplementedCiphers();
    const PRUint16 n_ciphers = SSL_GetNumImplementedCiphers();
    PRUint16 i;
    for (i = 0; i < n_ciphers; ++i) {
      SSLCipherSuiteInfo info;
      memset(&info, 0, sizeof(info));
      s = SSL_GetCipherSuiteInfo(ciphers[i], &info, sizeof(info));
      if (s != SECSuccess)
        goto err;
      if (BUG(info.cipherSuite != ciphers[i]))
        goto err;
      int disable = info.effectiveKeyBits < 128 ||
        info.macBits < 128 ||
        !we_like_ssl_cipher(info.symCipher) ||
        !we_like_ssl_kea(info.keaType) ||
        !we_like_mac_algorithm(info.macAlgorithm) ||
        !we_like_auth_type(info.authType)/* Requires NSS 3.24 */;

285
286
287
288
289
290
      if (ciphersuite_has_nss_export_bug(&info)) {
        /* SSL_ExportKeyingMaterial will fail; we can't use this cipher.
         */
        disable = 1;
      }

Nick Mathewson's avatar
Nick Mathewson committed
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
      s = SSL_CipherPrefSet(ctx->ctx, ciphers[i],
                            disable ? PR_FALSE : PR_TRUE);
      if (s != SECSuccess)
        goto err;
    }
  }

  // Only use DH and ECDH keys once.
  s = SSL_OptionSet(ctx->ctx, SSL_REUSE_SERVER_ECDHE_KEY, PR_FALSE);
  if (s != SECSuccess)
    goto err;

  // don't cache sessions.
  s = SSL_OptionSet(ctx->ctx, SSL_NO_CACHE, PR_TRUE);
  if (s != SECSuccess)
    goto err;

  // Enable DH.
  s = SSL_OptionSet(ctx->ctx, SSL_ENABLE_SERVER_DHE, PR_TRUE);
  if (s != SECSuccess)
    goto err;

  // Set DH and ECDH groups.
  SSLNamedGroup groups[] = {
      ssl_grp_ec_curve25519,
      ssl_grp_ec_secp256r1,
      ssl_grp_ec_secp224r1,
      ssl_grp_ffdhe_2048,
  };
  s = SSL_NamedGroupConfig(ctx->ctx, groups, ARRAY_LENGTH(groups));
  if (s != SECSuccess)
    goto err;

  // These features are off by default, so we don't need to disable them:
  //   Session tickets
  //   Renegotiation
  //   Compression
Nick Mathewson's avatar
Nick Mathewson committed
328
329
330
331
332
333
334

  goto done;
 err:
  tor_tls_context_decref(ctx);
  ctx = NULL;
 done:
  return ctx;
335
}
Nick Mathewson's avatar
Nick Mathewson committed
336

337
void
338
tor_tls_context_impl_free_(tor_tls_context_impl_t *ctx)
339
{
340
341
  if (!ctx)
    return;
Nick Mathewson's avatar
Nick Mathewson committed
342
  PR_Close(ctx);
343
}
344
345
346
347
348
349
350

void
tor_tls_get_state_description(tor_tls_t *tls, char *buf, size_t sz)
{
  (void)tls;
  (void)buf;
  (void)sz;
Nick Mathewson's avatar
Nick Mathewson committed
351
352
  // AFAICT, NSS doesn't expose its internal state.
  buf[0]=0;
353
354
355
356
357
}

void
tor_tls_init(void)
{
358
  tor_nss_countbytes_init();
359
}
Nick Mathewson's avatar
Nick Mathewson committed
360

361
362
363
364
void
tls_log_errors(tor_tls_t *tls, int severity, int domain,
               const char *doing)
{
365
366
367
368
  /* This implementation is a little different for NSS than it is for OpenSSL
     -- it logs the last error whether anything actually failed or not. So we
     have to only call it when something has gone wrong and we have a real
     error to report. */
Nick Mathewson's avatar
Nick Mathewson committed
369

370
  (void)tls;
Nick Mathewson's avatar
Nick Mathewson committed
371
372
  PRErrorCode code = PORT_GetError();

373
  const char *addr = tls ? tls->address : NULL;
Nick Mathewson's avatar
Nick Mathewson committed
374
375
376
377
378
379
380
381
382
383
  const char *string = PORT_ErrorToString(code);
  const char *name = PORT_ErrorToName(code);
  char buf[16];
  if (!string)
    string = "<unrecognized>";
  if (!name) {
    tor_snprintf(buf, sizeof(buf), "%d", code);
    name = buf;
  }

384
385
  const char *with = addr ? " with " : "";
  addr = addr ? addr : "";
Nick Mathewson's avatar
Nick Mathewson committed
386
  if (doing) {
387
388
    log_fn(severity, domain, "TLS error %s while %s%s%s: %s",
           name, doing, with, addr, string);
Nick Mathewson's avatar
Nick Mathewson committed
389
  } else {
390
391
    log_fn(severity, domain, "TLS error %s%s%s: %s", name, string,
           with, addr);
Nick Mathewson's avatar
Nick Mathewson committed
392
  }
393
394
395
}

tor_tls_t *
Nick Mathewson's avatar
Nick Mathewson committed
396
tor_tls_new(tor_socket_t sock, int is_server)
397
398
{
  (void)sock;
Nick Mathewson's avatar
Nick Mathewson committed
399
400
  tor_tls_context_t *ctx = tor_tls_context_get(is_server);

401
402
403
404
405
406
407
  PRFileDesc *tcp = NULL;
  if (SOCKET_OK(sock)) {
    tcp = PR_ImportTCPSocket(sock);
  } else {
    tcp = PR_NewTCPSocket();
  }

Nick Mathewson's avatar
Nick Mathewson committed
408
409
410
  if (!tcp)
    return NULL;

411
412
413
414
415
  PRFileDesc *count = tor_wrap_prfiledesc_with_byte_counter(tcp);
  if (! count)
    return NULL;

  PRFileDesc *ssl = SSL_ImportFD(ctx->ctx, count);
Nick Mathewson's avatar
Nick Mathewson committed
416
417
418
419
420
  if (!ssl) {
    PR_Close(tcp);
    return NULL;
  }

421
422
423
424
425
426
427
428
429
430
  /* even if though the socket is already nonblocking, we need to tell NSS
   * about the fact, so that it knows what to do when it says EAGAIN. */
  PRSocketOptionData data;
  data.option = PR_SockOpt_Nonblocking;
  data.value.non_blocking = 1;
  if (PR_SetSocketOption(ssl, &data) != PR_SUCCESS) {
    PR_Close(ssl);
    return NULL;
  }

Nick Mathewson's avatar
Nick Mathewson committed
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
  tor_tls_t *tls = tor_malloc_zero(sizeof(tor_tls_t));
  tls->magic = TOR_TLS_MAGIC;
  tls->context = ctx;
  tor_tls_context_incref(ctx);
  tls->ssl = ssl;
  tls->socket = sock;
  tls->state = TOR_TLS_ST_HANDSHAKE;
  tls->isServer = !!is_server;

  if (!is_server) {
    /* Set a random SNI */
    char *fake_hostname = crypto_random_hostname(4,25, "www.",".com");
    SSL_SetURL(tls->ssl, fake_hostname);
    tor_free(fake_hostname);
  }
  SECStatus s = SSL_ResetHandshake(ssl, is_server ? PR_TRUE : PR_FALSE);
  if (s != SECSuccess) {
448
    tls_log_errors(tls, LOG_WARN, LD_CRYPTO, "resetting handshake state");
Nick Mathewson's avatar
Nick Mathewson committed
449
450
451
  }

  return tls;
452
}
Nick Mathewson's avatar
Nick Mathewson committed
453

454
455
456
457
458
459
460
461
void
tor_tls_set_renegotiate_callback(tor_tls_t *tls,
                                 void (*cb)(tor_tls_t *, void *arg),
                                 void *arg)
{
  tor_assert(tls);
  (void)cb;
  (void)arg;
Nick Mathewson's avatar
Nick Mathewson committed
462
463

  /* We don't support renegotiation-based TLS with NSS. */
464
465
}

466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
/**
 * Tell the TLS library that the underlying socket for <b>tls</b> has been
 * closed, and the library should not attempt to free that socket itself.
 */
void
tor_tls_release_socket(tor_tls_t *tls)
{
  if (! tls)
    return;

  /* NSS doesn't have the equivalent of BIO_NO_CLOSE.  If you replace the
   * fd with something that's invalid, it causes a memory leak in PR_Close.
   *
   * If there were a way to put the PRFileDesc into the CLOSED state, that
   * would prevent it from closing its fd -- but there doesn't seem to be a
   * supported way to do that either.
   *
   * So instead: we make a new sacrificial socket, and replace the original
   * socket with that one. This seems to be the best we can do, until we
   * redesign the mainloop code enough to make this function unnecessary.
   */
  tor_socket_t sock =
    tor_open_socket_nonblocking(AF_INET, SOCK_STREAM, IPPROTO_TCP);
489
  if (! SOCKET_OK(sock)) {
490
491
492
493
494
495
496
    log_warn(LD_NET, "Out of sockets when trying to shut down an NSS "
             "connection");
    return;
  }

  PRFileDesc *tcp = PR_GetIdentitiesLayer(tls->ssl, PR_NSPR_IO_LAYER);
  if (BUG(! tcp)) {
497
    tor_close_socket(sock);
498
499
500
501
    return;
  }

  PR_ChangeFileDescNativeHandle(tcp, sock);
502
503
504
  /* Tell our socket accounting layer that we don't own this socket any more:
   * NSS is about to free it for us. */
  tor_release_socket_ownership(sock);
505
506
}

507
void
Nick Mathewson's avatar
Nick Mathewson committed
508
tor_tls_impl_free_(tor_tls_impl_t *tls)
509
{
Nick Mathewson's avatar
Nick Mathewson committed
510
511
  // XXXX This will close the underlying fd, which our OpenSSL version does
  // not do!
512
513
  if (!tls)
    return;
Nick Mathewson's avatar
Nick Mathewson committed
514
515

  PR_Close(tls);
516
517
518
519
520
}

int
tor_tls_peer_has_cert(tor_tls_t *tls)
{
Nick Mathewson's avatar
Nick Mathewson committed
521
522
523
524
  CERTCertificate *cert = SSL_PeerCertificate(tls->ssl);
  int result = (cert != NULL);
  CERT_DestroyCertificate(cert);
  return result;
525
}
Nick Mathewson's avatar
Nick Mathewson committed
526

527
528
529
MOCK_IMPL(tor_x509_cert_t *,
tor_tls_get_peer_cert,(tor_tls_t *tls))
{
Nick Mathewson's avatar
Nick Mathewson committed
530
531
532
533
534
  CERTCertificate *cert = SSL_PeerCertificate(tls->ssl);
  if (cert)
    return tor_x509_cert_new(cert);
  else
    return NULL;
535
}
Nick Mathewson's avatar
Nick Mathewson committed
536

537
538
539
540
MOCK_IMPL(tor_x509_cert_t *,
tor_tls_get_own_cert,(tor_tls_t *tls))
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
541
542
543
544
545
  CERTCertificate *cert = SSL_LocalCertificate(tls->ssl);
  if (cert)
    return tor_x509_cert_new(cert);
  else
    return NULL;
546
}
Nick Mathewson's avatar
Nick Mathewson committed
547

548
549
550
551
552
MOCK_IMPL(int,
tor_tls_read, (tor_tls_t *tls, char *cp, size_t len))
{
  tor_assert(tls);
  tor_assert(cp);
Nick Mathewson's avatar
Nick Mathewson committed
553
554
555
556
557
558
559
560
561
562
563
564
565
  tor_assert(len < INT_MAX);

  PRInt32 rv = PR_Read(tls->ssl, cp, (int)len);
  // log_debug(LD_NET, "PR_Read(%zu) returned %d", n, (int)rv);
  if (rv > 0) {
    return rv;
  }
  if (rv == 0)
    return TOR_TLS_CLOSE;
  PRErrorCode err = PORT_GetError();
  if (err == PR_WOULD_BLOCK_ERROR) {
    return TOR_TLS_WANTREAD; // XXXX ????
  } else {
566
    tls_log_errors(tls, LOG_NOTICE, LD_CRYPTO, "reading"); // XXXX
Nick Mathewson's avatar
Nick Mathewson committed
567
568
    return TOR_TLS_ERROR_MISC; // ????
  }
569
}
Nick Mathewson's avatar
Nick Mathewson committed
570

571
572
573
574
int
tor_tls_write(tor_tls_t *tls, const char *cp, size_t n)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
  tor_assert(cp || n == 0);
  tor_assert(n < INT_MAX);

  PRInt32 rv = PR_Write(tls->ssl, cp, (int)n);
  // log_debug(LD_NET, "PR_Write(%zu) returned %d", n, (int)rv);
  if (rv > 0) {
    return rv;
  }
  if (rv == 0)
    return TOR_TLS_ERROR_MISC;
  PRErrorCode err = PORT_GetError();

  if (err == PR_WOULD_BLOCK_ERROR) {
    return TOR_TLS_WANTWRITE; // XXXX ????
  } else {
590
    tls_log_errors(tls, LOG_NOTICE, LD_CRYPTO, "writing"); // XXXX
Nick Mathewson's avatar
Nick Mathewson committed
591
592
    return TOR_TLS_ERROR_MISC; // ????
  }
593
}
Nick Mathewson's avatar
Nick Mathewson committed
594

595
596
597
598
int
tor_tls_handshake(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
599
600
601
602
603
604
605
606
607
608
609
610
  tor_assert(tls->state == TOR_TLS_ST_HANDSHAKE);

  SECStatus s = SSL_ForceHandshake(tls->ssl);
  if (s == SECSuccess) {
    tls->state = TOR_TLS_ST_OPEN;
    log_debug(LD_NET, "SSL handshake is supposedly complete.");
    return tor_tls_finish_handshake(tls);
  }
  if (PORT_GetError() == PR_WOULD_BLOCK_ERROR)
    return TOR_TLS_WANTREAD; /* XXXX What about wantwrite? */

  return TOR_TLS_ERROR_MISC; // XXXX
611
}
Nick Mathewson's avatar
Nick Mathewson committed
612

613
614
615
616
int
tor_tls_finish_handshake(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
617
618
619
  // We don't need to do any of the weird handshake nonsense stuff on NSS,
  // since we only support recent handshakes.
  return TOR_TLS_DONE;
620
}
Nick Mathewson's avatar
Nick Mathewson committed
621

622
623
624
625
void
tor_tls_unblock_renegotiation(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
626
  /* We don't support renegotiation with NSS. */
627
}
Nick Mathewson's avatar
Nick Mathewson committed
628

629
630
631
632
void
tor_tls_block_renegotiation(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
633
  /* We don't support renegotiation with NSS. */
634
}
Nick Mathewson's avatar
Nick Mathewson committed
635

636
637
638
639
void
tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
640
  /* We don't support renegotiation with NSS. */
641
}
Nick Mathewson's avatar
Nick Mathewson committed
642

643
644
645
646
int
tor_tls_get_pending_bytes(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
647
648
  int n = SSL_DataPending(tls->ssl);
  if (n < 0) {
649
    tls_log_errors(tls, LOG_WARN, LD_CRYPTO, "looking up pending bytes");
Nick Mathewson's avatar
Nick Mathewson committed
650
651
652
    return 0;
  }
  return (int)n;
653
}
Nick Mathewson's avatar
Nick Mathewson committed
654

655
656
657
658
size_t
tor_tls_get_forced_write_size(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
659
  /* NSS doesn't have the same "forced write" restriction as openssl. */
660
661
  return 0;
}
Nick Mathewson's avatar
Nick Mathewson committed
662

663
664
665
666
667
668
669
void
tor_tls_get_n_raw_bytes(tor_tls_t *tls,
                        size_t *n_read, size_t *n_written)
{
  tor_assert(tls);
  tor_assert(n_read);
  tor_assert(n_written);
670
671
672
673
674
675
676
677
678
679
680
  uint64_t r, w;
  if (tor_get_prfiledesc_byte_counts(tls->ssl, &r, &w) < 0) {
    *n_read = *n_written = 0;
    return;
  }

  *n_read = (size_t)(r - tls->last_read_count);
  *n_written = (size_t)(w - tls->last_write_count);

  tls->last_read_count = r;
  tls->last_write_count = w;
681
682
683
684
685
686
687
688
689
690
691
692
}

int
tor_tls_get_buffer_sizes(tor_tls_t *tls,
                         size_t *rbuf_capacity, size_t *rbuf_bytes,
                         size_t *wbuf_capacity, size_t *wbuf_bytes)
{
  tor_assert(tls);
  tor_assert(rbuf_capacity);
  tor_assert(rbuf_bytes);
  tor_assert(wbuf_capacity);
  tor_assert(wbuf_bytes);
Nick Mathewson's avatar
Nick Mathewson committed
693
694

  /* This is an acceptable way to say "we can't measure this." */
695
696
  return -1;
}
Nick Mathewson's avatar
Nick Mathewson committed
697

698
699
700
MOCK_IMPL(double,
tls_get_write_overhead_ratio, (void))
{
Nick Mathewson's avatar
Nick Mathewson committed
701
702
703
  /* XXX We don't currently have a way to measure this in NSS; we could do that
   * XXX with a PRIO layer, but it'll take a little coding. */
  return 0.95;
704
705
706
707
708
709
}

int
tor_tls_used_v1_handshake(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
710
711
712
  /* We don't support or allow the V1 handshake with NSS.
   */
  return 0;
713
}
Nick Mathewson's avatar
Nick Mathewson committed
714

715
716
717
718
int
tor_tls_server_got_renegotiate(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
719
  return 0; /* We don't support renegotiation with NSS */
720
}
Nick Mathewson's avatar
Nick Mathewson committed
721

722
723
724
725
726
MOCK_IMPL(int,
tor_tls_cert_matches_key,(const tor_tls_t *tls,
                          const struct tor_x509_cert_t *cert))
{
  tor_assert(cert);
727
728
  tor_assert(cert->cert);

Nick Mathewson's avatar
Nick Mathewson committed
729
730
  int rv = 0;

731
732
733
  tor_x509_cert_t *peercert = tor_tls_get_peer_cert((tor_tls_t *)tls);

  if (!peercert || !peercert->cert)
Nick Mathewson's avatar
Nick Mathewson committed
734
    goto done;
735
736

  CERTSubjectPublicKeyInfo *peer_info = &peercert->cert->subjectPublicKeyInfo;
Nick Mathewson's avatar
Nick Mathewson committed
737
  CERTSubjectPublicKeyInfo *cert_info = &cert->cert->subjectPublicKeyInfo;
738
739
740
741
742
743
744
745
746
747
748
749
750
751

  /* NSS stores the `len` field in bits, instead of bytes, for the
   * `subjectPublicKey` field in CERTSubjectPublicKeyInfo, but
   * `SECITEM_ItemsAreEqual()` compares the two bitstrings using a length field
   * defined in bytes.
   *
   * We convert the `len` field from bits to bytes, do our comparison with
   * `SECITEM_ItemsAreEqual()`, and reset the length field from bytes to bits
   * again.
   *
   * See also NSS's own implementation of `SECKEY_CopySubjectPublicKeyInfo()`
   * in seckey.c in the NSS source tree. This function also does the conversion
   * between bits and bytes.
   */
752
753
  const unsigned int peer_info_orig_len = peer_info->subjectPublicKey.len;
  const unsigned int cert_info_orig_len = cert_info->subjectPublicKey.len;
754

755
756
757
758
759
760
761
762
763
764
  /* We convert the length from bits to bytes, but instead of using NSS's
   * `DER_ConvertBitString()` macro on both of peer_info->subjectPublicKey and
   * cert_info->subjectPublicKey, we have to do the conversion explicitly since
   * both of the two subjectPublicKey fields are allowed to point to the same
   * memory address. Otherwise, the bits to bytes conversion would potentially
   * be applied twice, which would lead to us comparing too few of the bytes
   * when we call SECITEM_ItemsAreEqual(), which would be catastrophic.
   */
  peer_info->subjectPublicKey.len = ((peer_info_orig_len + 7) >> 3);
  cert_info->subjectPublicKey.len = ((cert_info_orig_len + 7) >> 3);
765

Nick Mathewson's avatar
Nick Mathewson committed
766
767
768
769
770
  rv = SECOID_CompareAlgorithmID(&peer_info->algorithm,
                                 &cert_info->algorithm) == 0 &&
       SECITEM_ItemsAreEqual(&peer_info->subjectPublicKey,
                             &cert_info->subjectPublicKey);

771
  /* Convert from bytes back to bits. */
772
773
774
  peer_info->subjectPublicKey.len = peer_info_orig_len;
  cert_info->subjectPublicKey.len = cert_info_orig_len;

Nick Mathewson's avatar
Nick Mathewson committed
775
 done:
776
777
  tor_x509_cert_free(peercert);

Nick Mathewson's avatar
Nick Mathewson committed
778
  return rv;
779
}
Nick Mathewson's avatar
Nick Mathewson committed
780

781
782
783
784
785
MOCK_IMPL(int,
tor_tls_get_tlssecrets,(tor_tls_t *tls, uint8_t *secrets_out))
{
  tor_assert(tls);
  tor_assert(secrets_out);
Nick Mathewson's avatar
Nick Mathewson committed
786
787
788

  /* There's no way to get this information out of NSS. */

789
790
  return -1;
}
Nick Mathewson's avatar
Nick Mathewson committed
791

792
793
794
795
796
797
798
799
800
801
MOCK_IMPL(int,
tor_tls_export_key_material,(tor_tls_t *tls, uint8_t *secrets_out,
                             const uint8_t *context,
                             size_t context_len,
                             const char *label))
{
  tor_assert(tls);
  tor_assert(secrets_out);
  tor_assert(context);
  tor_assert(label);
Nick Mathewson's avatar
Nick Mathewson committed
802
803
  tor_assert(strlen(label) <= UINT_MAX);
  tor_assert(context_len <= UINT_MAX);
804

Nick Mathewson's avatar
Nick Mathewson committed
805
  SECStatus s;
806
807
808
809
  /* Make sure that the error code is set here, so that we can be sure that
   * any error code set after a failure was in fact caused by
   * SSL_ExportKeyingMaterial. */
  PR_SetError(PR_UNKNOWN_ERROR, 0);
Nick Mathewson's avatar
Nick Mathewson committed
810
811
812
813
  s = SSL_ExportKeyingMaterial(tls->ssl,
                               label, (unsigned)strlen(label),
                               PR_TRUE, context, (unsigned)context_len,
                               secrets_out, DIGEST256_LEN);
814
815
816
817
  if (s != SECSuccess) {
    tls_log_errors(tls, LOG_WARN, LD_CRYPTO,
                   "exporting key material for a TLS handshake");
  }
Nick Mathewson's avatar
Nick Mathewson committed
818
819

  return (s == SECSuccess) ? 0 : -1;
820
821
822
823
824
825
}

const char *
tor_tls_get_ciphersuite_name(tor_tls_t *tls)
{
  tor_assert(tls);
Nick Mathewson's avatar
Nick Mathewson committed
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843

  SSLChannelInfo channel_info;
  SSLCipherSuiteInfo cipher_info;

  memset(&channel_info, 0, sizeof(channel_info));
  memset(&cipher_info, 0, sizeof(cipher_info));

  SECStatus s = SSL_GetChannelInfo(tls->ssl,
                                   &channel_info, sizeof(channel_info));
  if (s != SECSuccess)
    return NULL;

  s = SSL_GetCipherSuiteInfo(channel_info.cipherSuite,
                             &cipher_info, sizeof(cipher_info));
  if (s != SECSuccess)
    return NULL;

  return cipher_info.cipherSuiteName;
844
845
}

Nick Mathewson's avatar
Nick Mathewson committed
846
847
848
/** The group we should use for ecdhe when none was selected. */
#define SEC_OID_TOR_DEFAULT_ECDHE_GROUP SEC_OID_ANSIX962_EC_PRIME256V1

849
850
851
int
evaluate_ecgroup_for_tls(const char *ecgroup)
{
Nick Mathewson's avatar
Nick Mathewson committed
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
  SECOidTag tag;

  if (!ecgroup)
    tag = SEC_OID_TOR_DEFAULT_ECDHE_GROUP;
  else if (!strcasecmp(ecgroup, "P256"))
    tag = SEC_OID_ANSIX962_EC_PRIME256V1;
  else if (!strcasecmp(ecgroup, "P224"))
    tag = SEC_OID_SECG_EC_SECP224R1;
  else
    return 0;

  /* I don't think we need any additional tests here for NSS */
  (void) tag;

  return 1;
}

static SECStatus
always_accept_cert_cb(void *arg, PRFileDesc *ssl, PRBool checkSig,
                      PRBool isServer)
{
  (void)arg;
  (void)ssl;
  (void)checkSig;
  (void)isServer;
  return SECSuccess;
878
}