From d52b964b6eaa7802744653cef01088512ccb2c23 Mon Sep 17 00:00:00 2001 From: Levi Neely <141506390+lneely@users.noreply.github.com> Date: Tue, 2 Jul 2024 12:01:48 +0200 Subject: [PATCH] program compiles with mbedtls 2.x, but remains offline.. why? --- lib/pclsync/pssl.c | 347 ++++++++++++++++++++++------------------- lib/pclsync/pssl.h | 104 ++++++------ lib/pclsync/psynclib.c | 3 +- 3 files changed, 241 insertions(+), 213 deletions(-) diff --git a/lib/pclsync/pssl.c b/lib/pclsync/pssl.c index b3be6b7..0ff60c9 100644 --- a/lib/pclsync/pssl.c +++ b/lib/pclsync/pssl.c @@ -30,11 +30,14 @@ */ #include -#include -#include -#include -#include -#include +#include +#include +#include +#include +#include +#include +#include +#include #include #include @@ -111,35 +114,36 @@ psync_symmetric_key_t psync_ssl_rsa_decrypt_symm_key_lock( #endif static const int psync_mbed_ciphersuite[] = { - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, - TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, - TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, 0}; typedef struct { - ctr_drbg_context rnd; + mbedtls_ctr_drbg_context rnd; pthread_mutex_t mutex; } ctr_drbg_context_locked; typedef struct { - ssl_context ssl; + mbedtls_ssl_context ssl; + mbedtls_ssl_config cfg; psync_socket_t sock; int isbroken; char cachekey[]; } ssl_connection_t; static ctr_drbg_context_locked psync_mbed_rng; -static entropy_context psync_mbed_entropy; -static x509_crt psync_mbed_trusted_certs_x509; +static mbedtls_entropy_context psync_mbed_entropy; +static mbedtls_x509_crt psync_mbed_trusted_certs_x509; PSYNC_THREAD int psync_ssl_errno; @@ -151,7 +155,7 @@ static psync_ssl_debug_callback_t debug_cb = NULL; static void *debug_ctx = NULL; void psync_ssl_set_log_threshold(int threshold) { - debug_set_threshold(threshold); + mbedtls_debug_set_threshold(threshold); } void psync_ssl_set_debug_callback(psync_ssl_debug_callback_t cb, void *ctx) { @@ -165,7 +169,7 @@ int ctr_drbg_random_locked(void *p_rng, unsigned char *output, int ret; rng = (ctr_drbg_context_locked *)p_rng; pthread_mutex_lock(&rng->mutex); - ret = ctr_drbg_random(&rng->rnd, output, output_len); + ret = mbedtls_ctr_drbg_random(&rng->rnd, output, output_len); pthread_mutex_unlock(&rng->mutex); return ret; } @@ -199,6 +203,8 @@ static int psync_ssl_detect_aes_hw() { int psync_ssl_init() { unsigned char seed[PSYNC_LHASH_DIGEST_LEN]; psync_uint_t i; + int result; + #if defined(PSYNC_AES_HW) psync_ssl_hw_aes = psync_ssl_detect_aes_hw(); #else @@ -206,17 +212,21 @@ int psync_ssl_init() { #endif if (pthread_mutex_init(&psync_mbed_rng.mutex, NULL)) return PRINT_RETURN(-1); - entropy_init(&psync_mbed_entropy); + mbedtls_entropy_init(&psync_mbed_entropy); psync_get_random_seed(seed, seed, sizeof(seed), 0); - entropy_update_manual(&psync_mbed_entropy, seed, sizeof(seed)); - if (ctr_drbg_init(&psync_mbed_rng.rnd, entropy_func, &psync_mbed_entropy, - NULL, 0)) + mbedtls_entropy_update_manual(&psync_mbed_entropy, seed, sizeof(seed)); + mbedtls_ctr_drbg_init(&psync_mbed_rng.rnd); + if ((result = mbedtls_ctr_drbg_seed(&psync_mbed_rng.rnd, mbedtls_entropy_func, + &psync_mbed_entropy, NULL, 0))) { + debug(D_ERROR, "mbedtls_ctr_drbg_seed failed with return code %d", result); return PRINT_RETURN(-1); - x509_crt_init(&psync_mbed_trusted_certs_x509); + } + mbedtls_x509_crt_init(&psync_mbed_trusted_certs_x509); for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_certs); i++) - if (x509_crt_parse(&psync_mbed_trusted_certs_x509, - (const unsigned char *)psync_ssl_trusted_certs[i], - strlen(psync_ssl_trusted_certs[i]))) + if (mbedtls_x509_crt_parse( + &psync_mbed_trusted_certs_x509, + (const unsigned char *)psync_ssl_trusted_certs[i], + strlen(psync_ssl_trusted_certs[i]))) debug(D_ERROR, "failed to load certificate %lu", (unsigned long)i); return 0; } @@ -240,16 +250,16 @@ static ssl_connection_t *psync_ssl_alloc_conn(const char *hostname) { } static void psync_set_ssl_error(ssl_connection_t *conn, int err) { - if (err == POLARSSL_ERR_NET_WANT_READ) + if (err == MBEDTLS_ERR_SSL_WANT_READ) psync_ssl_errno = PSYNC_SSL_ERR_WANT_READ; - else if (err == POLARSSL_ERR_NET_WANT_WRITE) + else if (err == MBEDTLS_ERR_SSL_WANT_WRITE) psync_ssl_errno = PSYNC_SSL_ERR_WANT_WRITE; else { psync_ssl_errno = PSYNC_SSL_ERR_UNKNOWN; conn->isbroken = 1; - if (err == POLARSSL_ERR_NET_RECV_FAILED) + if (err == MBEDTLS_ERR_NET_RECV_FAILED) debug(D_NOTICE, "got POLARSSL_ERR_NET_RECV_FAILED"); - else if (err == POLARSSL_ERR_NET_SEND_FAILED) + else if (err == MBEDTLS_ERR_NET_SEND_FAILED) debug(D_NOTICE, "got POLARSSL_ERR_NET_SEND_FAILED"); else debug(D_NOTICE, "got error %d", err); @@ -265,9 +275,9 @@ static int psync_mbed_read(void *ptr, unsigned char *buf, size_t len) { if (ret == -1) { err = psync_sock_err(); if (err == P_WOULDBLOCK || err == P_AGAIN || err == P_INTR) - return POLARSSL_ERR_NET_WANT_READ; + return MBEDTLS_ERR_SSL_WANT_READ; else - return POLARSSL_ERR_NET_RECV_FAILED; + return MBEDTLS_ERR_NET_RECV_FAILED; } else return (int)ret; } @@ -281,25 +291,25 @@ static int psync_mbed_write(void *ptr, const unsigned char *buf, size_t len) { if (ret == -1) { err = psync_sock_err(); if (err == P_WOULDBLOCK || err == P_AGAIN || err == P_INTR) - return POLARSSL_ERR_NET_WANT_WRITE; + return MBEDTLS_ERR_SSL_WANT_WRITE; else - return POLARSSL_ERR_NET_SEND_FAILED; + return MBEDTLS_ERR_NET_SEND_FAILED; } else return (int)ret; } static void psync_ssl_free_session(void *ptr) { - ssl_session_free((ssl_session *)ptr); + mbedtls_ssl_session_free((mbedtls_ssl_session *)ptr); psync_free(ptr); } static void psync_ssl_save_session(ssl_connection_t *conn) { - ssl_session *sess; - sess = psync_new(ssl_session); - // ssl_get_session seems to copy all elements, instead of referencing them, - // therefore it is thread safe to add session upon connect - memset(sess, 0, sizeof(ssl_session)); - if (ssl_get_session(&conn->ssl, sess)) + mbedtls_ssl_session *sess; + sess = psync_new(mbedtls_ssl_session); + // mbedtls_ssl_get_session seems to copy all elements, instead of referencing + // them, therefore it is thread safe to add session upon connect + memset(sess, 0, sizeof(mbedtls_ssl_session)); + if (mbedtls_ssl_get_session(&conn->ssl, sess)) psync_free(sess); else psync_cache_add(conn->cachekey, sess, PSYNC_SSL_SESSION_CACHE_TIMEOUT, @@ -307,25 +317,26 @@ static void psync_ssl_save_session(ssl_connection_t *conn) { } static int psync_ssl_check_peer_public_key(ssl_connection_t *conn) { - const x509_crt *cert; + const mbedtls_x509_crt *cert; unsigned char buff[1024], sigbin[32]; char sighex[66]; int i; - cert = ssl_get_peer_cert(&conn->ssl); + cert = mbedtls_ssl_get_peer_cert(&conn->ssl); if (!cert) { debug(D_WARNING, "ssl_get_peer_cert returned NULL"); return -1; } - if (pk_get_type(&cert->pk) != POLARSSL_PK_RSA) { + if (mbedtls_pk_get_type(&cert->pk) != MBEDTLS_PK_RSA) { debug(D_WARNING, "public key is not RSA"); return -1; } - i = pk_write_pubkey_der((pk_context *)&cert->pk, buff, sizeof(buff)); + i = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)&cert->pk, buff, + sizeof(buff)); if (i <= 0) { debug(D_WARNING, "pk_write_pubkey_der returned error %d", i); return -1; } - sha256(buff + sizeof(buff) - i, i, sigbin, 0); + mbedtls_sha256(buff + sizeof(buff) - i, i, sigbin, 0); psync_binhex(sighex, sigbin, 32); sighex[64] = 0; for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_pk_sha256); i++) @@ -341,30 +352,34 @@ static int psync_ssl_check_peer_public_key(ssl_connection_t *conn) { int psync_ssl_connect(psync_socket_t sock, void **sslconn, const char *hostname) { ssl_connection_t *conn; - ssl_session *sess; + mbedtls_ssl_session *sess; int ret; conn = psync_ssl_alloc_conn(hostname); - if (unlikely(ssl_init(&conn->ssl))) - goto err0; + mbedtls_ssl_init(&conn->ssl); + mbedtls_ssl_config_init(&conn->cfg); conn->sock = sock; - ssl_set_endpoint(&conn->ssl, SSL_IS_CLIENT); - ssl_set_dbg(&conn->ssl, debug_cb, debug_ctx); - ssl_set_authmode(&conn->ssl, SSL_VERIFY_REQUIRED); - ssl_set_min_version(&conn->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); - ssl_set_ca_chain(&conn->ssl, &psync_mbed_trusted_certs_x509, NULL, hostname); - ssl_set_ciphersuites(&conn->ssl, psync_mbed_ciphersuite); - ssl_set_rng(&conn->ssl, ctr_drbg_random_locked, &psync_mbed_rng); - ssl_set_bio(&conn->ssl, psync_mbed_read, conn, psync_mbed_write, conn); - ssl_set_hostname(&conn->ssl, hostname); // we do not need SNI, but should not - // hurt in general to support - if ((sess = (ssl_session *)psync_cache_get(conn->cachekey))) { + mbedtls_ssl_conf_endpoint(&conn->cfg, MBEDTLS_SSL_IS_CLIENT); + mbedtls_ssl_conf_dbg(&conn->cfg, debug_cb, debug_ctx); + mbedtls_ssl_conf_authmode(&conn->cfg, MBEDTLS_SSL_VERIFY_REQUIRED); + mbedtls_ssl_conf_min_version(&conn->cfg, MBEDTLS_SSL_MAJOR_VERSION_3, + MBEDTLS_SSL_MINOR_VERSION_3); + // TODO: hostname removed, does it need to go elsewhere? + // it seems so... + mbedtls_ssl_conf_ca_chain(&conn->cfg, &psync_mbed_trusted_certs_x509, NULL); + mbedtls_ssl_conf_ciphersuites(&conn->cfg, psync_mbed_ciphersuite); + mbedtls_ssl_conf_rng(&conn->cfg, ctr_drbg_random_locked, &psync_mbed_rng); + mbedtls_ssl_set_bio(&conn->ssl, &conn->sock, psync_mbed_write, + psync_mbed_read, NULL); + mbedtls_ssl_set_hostname(&conn->ssl, hostname); + + if ((sess = (mbedtls_ssl_session *)psync_cache_get(conn->cachekey))) { debug(D_NOTICE, "reusing cached session for %s", hostname); - if (ssl_set_session(&conn->ssl, sess)) + if (mbedtls_ssl_set_session(&conn->ssl, sess)) debug(D_WARNING, "ssl_set_session failed"); - ssl_session_free(sess); + mbedtls_ssl_session_free(sess); psync_free(sess); } - ret = ssl_handshake(&conn->ssl); + ret = mbedtls_ssl_handshake(&conn->ssl); if (ret == 0) { if (psync_ssl_check_peer_public_key(conn)) goto err1; @@ -373,13 +388,13 @@ int psync_ssl_connect(psync_socket_t sock, void **sslconn, return PSYNC_SSL_SUCCESS; } psync_set_ssl_error(conn, ret); - if (likely_log(ret == POLARSSL_ERR_NET_WANT_READ || - ret == POLARSSL_ERR_NET_WANT_WRITE)) { + if (likely_log(ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE)) { *sslconn = conn; return PSYNC_SSL_NEED_FINISH; } err1: - ssl_free(&conn->ssl); + mbedtls_ssl_free(&conn->ssl); err0: psync_free(conn); return PRINT_RETURN_CONST(PSYNC_SSL_FAIL); @@ -389,7 +404,7 @@ int psync_ssl_connect_finish(void *sslconn, const char *hostname) { ssl_connection_t *conn; int ret; conn = (ssl_connection_t *)sslconn; - ret = ssl_handshake(&conn->ssl); + ret = mbedtls_ssl_handshake(&conn->ssl); if (ret == 0) { if (psync_ssl_check_peer_public_key(conn)) goto fail; @@ -397,11 +412,11 @@ int psync_ssl_connect_finish(void *sslconn, const char *hostname) { return PSYNC_SSL_SUCCESS; } psync_set_ssl_error(conn, ret); - if (likely_log(ret == POLARSSL_ERR_NET_WANT_READ || - ret == POLARSSL_ERR_NET_WANT_WRITE)) + if (likely_log(ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE)) return PSYNC_SSL_NEED_FINISH; fail: - ssl_free(&conn->ssl); + mbedtls_ssl_free(&conn->ssl); psync_free(conn); return PRINT_RETURN_CONST(PSYNC_SSL_FAIL); } @@ -412,15 +427,15 @@ int psync_ssl_shutdown(void *sslconn) { conn = (ssl_connection_t *)sslconn; if (conn->isbroken) goto noshutdown; - ret = ssl_close_notify(&conn->ssl); + ret = mbedtls_ssl_close_notify(&conn->ssl); if (ret == 0) goto noshutdown; psync_set_ssl_error(conn, ret); - if (likely_log(ret == POLARSSL_ERR_NET_WANT_READ || - ret == POLARSSL_ERR_NET_WANT_WRITE)) + if (likely_log(ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE)) return PSYNC_SSL_NEED_FINISH; noshutdown: - ssl_free(&conn->ssl); + mbedtls_ssl_free(&conn->ssl); psync_free(conn); return PSYNC_SSL_SUCCESS; } @@ -428,19 +443,19 @@ noshutdown: void psync_ssl_free(void *sslconn) { ssl_connection_t *conn; conn = (ssl_connection_t *)sslconn; - ssl_free(&conn->ssl); + mbedtls_ssl_free(&conn->ssl); psync_free(conn); } int psync_ssl_pendingdata(void *sslconn) { - return ssl_get_bytes_avail(&((ssl_connection_t *)sslconn)->ssl); + return mbedtls_ssl_get_bytes_avail(&((ssl_connection_t *)sslconn)->ssl); } int psync_ssl_read(void *sslconn, void *buf, int num) { ssl_connection_t *conn; int res; conn = (ssl_connection_t *)sslconn; - res = ssl_read(&conn->ssl, (unsigned char *)buf, num); + res = mbedtls_ssl_read(&conn->ssl, (unsigned char *)buf, num); if (res >= 0) return res; psync_set_ssl_error(conn, res); @@ -451,7 +466,7 @@ int psync_ssl_write(void *sslconn, const void *buf, int num) { ssl_connection_t *conn; int res; conn = (ssl_connection_t *)sslconn; - res = ssl_write(&conn->ssl, (const unsigned char *)buf, num); + res = mbedtls_ssl_write(&conn->ssl, (const unsigned char *)buf, num); if (res >= 0) return res; psync_set_ssl_error(conn, res); @@ -471,11 +486,12 @@ void psync_ssl_rand_weak(unsigned char *buf, int num) { } psync_rsa_t psync_ssl_gen_rsa(int bits) { - rsa_context *ctx; - ctx = psync_new(rsa_context); - rsa_init(ctx, RSA_PKCS_V21, POLARSSL_MD_SHA1); - if (rsa_gen_key(ctx, ctr_drbg_random_locked, &psync_mbed_rng, bits, 65537)) { - rsa_free(ctx); + mbedtls_rsa_context *ctx; + ctx = psync_new(mbedtls_rsa_context); + mbedtls_rsa_init(ctx, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); + if (mbedtls_rsa_gen_key(ctx, ctr_drbg_random_locked, &psync_mbed_rng, bits, + 65537)) { + mbedtls_rsa_free(ctx); psync_free(ctx); return PSYNC_INVALID_RSA; } else @@ -483,7 +499,7 @@ psync_rsa_t psync_ssl_gen_rsa(int bits) { } void psync_ssl_free_rsa(psync_rsa_t rsa) { - rsa_free(rsa); + mbedtls_rsa_free(rsa); psync_free(rsa); } @@ -503,11 +519,11 @@ void psync_ssl_rsa_free_public(psync_rsa_publickey_t key) { } psync_rsa_privatekey_t psync_ssl_rsa_get_private(psync_rsa_t rsa) { - rsa_context *ctx; - ctx = psync_new(rsa_context); - rsa_init(ctx, RSA_PKCS_V21, POLARSSL_MD_SHA1); - if (unlikely(rsa_copy(ctx, rsa))) { - rsa_free(ctx); + mbedtls_rsa_context *ctx; + ctx = psync_new(mbedtls_rsa_context); + mbedtls_rsa_init(ctx, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); + if (unlikely(mbedtls_rsa_copy(ctx, rsa))) { + mbedtls_rsa_free(ctx); psync_free(ctx); return PSYNC_INVALID_RSA; } else @@ -521,16 +537,16 @@ void psync_ssl_rsa_free_private(psync_rsa_privatekey_t key) { psync_binary_rsa_key_t psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa) { unsigned char buff[4096], *p; - pk_context ctx; + mbedtls_pk_context ctx; psync_binary_rsa_key_t ret; int len; - pk_init(&ctx); - if (pk_init_ctx(&ctx, pk_info_from_type(POLARSSL_PK_RSA)) || - rsa_copy(pk_rsa(ctx), rsa)) + mbedtls_pk_init(&ctx); + if (mbedtls_pk_setup(&ctx, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) || + mbedtls_rsa_copy(mbedtls_pk_rsa(ctx), rsa)) return PSYNC_INVALID_BIN_RSA; p = buff + sizeof(buff); - len = pk_write_pubkey(&p, buff, &ctx); - pk_free(&ctx); + len = mbedtls_pk_write_pubkey(&p, buff, &ctx); + mbedtls_pk_free(&ctx); if (len <= 0) return PSYNC_INVALID_BIN_RSA; ret = @@ -543,15 +559,15 @@ psync_ssl_rsa_public_to_binary(psync_rsa_publickey_t rsa) { psync_binary_rsa_key_t psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa) { unsigned char buff[4096]; - pk_context ctx; + mbedtls_pk_context ctx; psync_binary_rsa_key_t ret; int len; - pk_init(&ctx); - if (pk_init_ctx(&ctx, pk_info_from_type(POLARSSL_PK_RSA)) || - rsa_copy(pk_rsa(ctx), rsa)) + mbedtls_pk_init(&ctx); + if (mbedtls_pk_setup(&ctx, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)) || + mbedtls_rsa_copy(mbedtls_pk_rsa(ctx), rsa)) return PSYNC_INVALID_BIN_RSA; - len = pk_write_key_der(&ctx, buff, sizeof(buff)); - pk_free(&ctx); + len = mbedtls_pk_write_key_der(&ctx, buff, sizeof(buff)); + mbedtls_pk_free(&ctx); if (len <= 0) return PSYNC_INVALID_BIN_RSA; ret = @@ -564,49 +580,49 @@ psync_ssl_rsa_private_to_binary(psync_rsa_privatekey_t rsa) { psync_rsa_publickey_t psync_ssl_rsa_load_public(const unsigned char *keydata, size_t keylen) { - pk_context ctx; - rsa_context *rsa; + mbedtls_pk_context ctx; + mbedtls_rsa_context *rsa; int ret; - pk_init(&ctx); - if (unlikely(ret = pk_parse_public_key(&ctx, keydata, keylen))) { + mbedtls_pk_init(&ctx); + if (unlikely(ret = mbedtls_pk_parse_public_key(&ctx, keydata, keylen))) { debug(D_WARNING, "pk_parse_public_key failed with code %d", ret); return PSYNC_INVALID_RSA; } - rsa = psync_new(rsa_context); - rsa_init(rsa, RSA_PKCS_V21, POLARSSL_MD_SHA1); - ret = rsa_copy(rsa, pk_rsa(ctx)); - pk_free(&ctx); + rsa = psync_new(mbedtls_rsa_context); + mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); + ret = mbedtls_rsa_copy(rsa, mbedtls_pk_rsa(ctx)); + mbedtls_pk_free(&ctx); if (unlikely(ret)) { - rsa_free(rsa); + mbedtls_rsa_free(rsa); psync_free(rsa); return PSYNC_INVALID_RSA; } else { - rsa_set_padding(rsa, RSA_PKCS_V21, POLARSSL_MD_SHA1); + mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); return rsa; } } psync_rsa_privatekey_t psync_ssl_rsa_load_private(const unsigned char *keydata, size_t keylen) { - pk_context ctx; - rsa_context *rsa; + mbedtls_pk_context ctx; + mbedtls_rsa_context *rsa; int ret; - pk_init(&ctx); - if (unlikely(ret = pk_parse_key(&ctx, keydata, keylen, NULL, 0))) { + mbedtls_pk_init(&ctx); + if (unlikely(ret = mbedtls_pk_parse_key(&ctx, keydata, keylen, NULL, 0))) { debug(D_WARNING, "pk_parse_key failed with code %d", ret); return PSYNC_INVALID_RSA; } - rsa = psync_new(rsa_context); - rsa_init(rsa, RSA_PKCS_V21, POLARSSL_MD_SHA1); - ret = rsa_copy(rsa, pk_rsa(ctx)); - pk_free(&ctx); + rsa = psync_new(mbedtls_rsa_context); + mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); + ret = mbedtls_rsa_copy(rsa, mbedtls_pk_rsa(ctx)); + mbedtls_pk_free(&ctx); if (unlikely(ret)) { debug(D_WARNING, "rsa_copy failed with code %d", ret); - rsa_free(rsa); + mbedtls_rsa_free(rsa); psync_free(rsa); return PSYNC_INVALID_RSA; } else { - rsa_set_padding(rsa, RSA_PKCS_V21, POLARSSL_MD_SHA1); + mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA1); return rsa; } } @@ -627,12 +643,13 @@ psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen, size_t iterations) { psync_symmetric_key_t key = (psync_symmetric_key_t)psync_locked_malloc( keylen + offsetof(psync_symmetric_key_struct_t, key)); - md_context_t ctx; - md_init_ctx(&ctx, md_info_from_type(POLARSSL_MD_SHA512)); + mbedtls_md_context_t ctx; + mbedtls_md_init_ctx(&ctx, mbedtls_md_info_from_type(MBEDTLS_MD_SHA512)); key->keylen = keylen; - pkcs5_pbkdf2_hmac(&ctx, (const unsigned char *)password, strlen(password), - salt, saltlen, iterations, keylen, key->key); - md_free_ctx(&ctx); + mbedtls_pkcs5_pbkdf2_hmac(&ctx, (const unsigned char *)password, + strlen(password), salt, saltlen, iterations, keylen, + key->key); + mbedtls_md_free(&ctx); return key; } @@ -640,7 +657,7 @@ char *psync_ssl_derive_password_from_passphrase(const char *username, const char *passphrase) { unsigned char *usercopy; unsigned char usersha512[PSYNC_SHA512_DIGEST_LEN], passwordbin[32]; - md_context_t ctx; + mbedtls_md_context_t ctx; size_t userlen, i; userlen = strlen(username); usercopy = psync_new_cnt(unsigned char, userlen); @@ -651,11 +668,11 @@ char *psync_ssl_derive_password_from_passphrase(const char *username, usercopy[i] = '*'; psync_sha512(usercopy, userlen, usersha512); psync_free(usercopy); - md_init_ctx(&ctx, md_info_from_type(POLARSSL_MD_SHA512)); - pkcs5_pbkdf2_hmac(&ctx, (const unsigned char *)passphrase, strlen(passphrase), - usersha512, PSYNC_SHA512_DIGEST_LEN, 5000, - sizeof(passwordbin), passwordbin); - md_free_ctx(&ctx); + mbedtls_md_init_ctx(&ctx, mbedtls_md_info_from_type(MBEDTLS_MD_SHA512)); + mbedtls_pkcs5_pbkdf2_hmac( + &ctx, (const unsigned char *)passphrase, strlen(passphrase), usersha512, + PSYNC_SHA512_DIGEST_LEN, 5000, sizeof(passwordbin), passwordbin); + mbedtls_md_free(&ctx); usercopy = psync_base64_encode(passwordbin, sizeof(passwordbin), &userlen); return (char *)usercopy; } @@ -667,9 +684,9 @@ psync_ssl_rsa_encrypt_data(psync_rsa_publickey_t rsa, const unsigned char *data, int code; ret = (psync_encrypted_symmetric_key_t)psync_malloc( offsetof(psync_encrypted_data_struct_t, data) + rsa->len); - if ((code = rsa_rsaes_oaep_encrypt(rsa, ctr_drbg_random_locked, - &psync_mbed_rng, RSA_PUBLIC, NULL, 0, - datalen, data, ret->data))) { + if ((code = mbedtls_rsa_rsaes_oaep_encrypt( + rsa, ctr_drbg_random_locked, &psync_mbed_rng, MBEDTLS_RSA_PUBLIC, + NULL, 0, datalen, data, ret->data))) { psync_free(ret); debug( D_WARNING, @@ -688,9 +705,9 @@ psync_symmetric_key_t psync_ssl_rsa_decrypt_data(psync_rsa_privatekey_t rsa, unsigned char buff[2048]; psync_symmetric_key_t ret; size_t len; - if (rsa_rsaes_oaep_decrypt(rsa, ctr_drbg_random_locked, &psync_mbed_rng, - RSA_PRIVATE, NULL, 0, &len, data, buff, - sizeof(buff))) + if (mbedtls_rsa_rsaes_oaep_decrypt(rsa, ctr_drbg_random_locked, + &psync_mbed_rng, MBEDTLS_RSA_PRIVATE, NULL, + 0, &len, data, buff, sizeof(buff))) return PSYNC_INVALID_SYM_KEY; ret = (psync_symmetric_key_t)psync_locked_malloc( offsetof(psync_symmetric_key_struct_t, key) + len); @@ -713,29 +730,29 @@ psync_symmetric_key_t psync_ssl_rsa_decrypt_symmetric_key( psync_aes256_encoder psync_ssl_aes256_create_encoder(psync_symmetric_key_t key) { - aes_context *aes; + mbedtls_aes_context *aes; assert(key->keylen >= PSYNC_AES256_KEY_SIZE); - aes = psync_new(aes_context); - aes_setkey_enc(aes, key->key, 256); + aes = psync_new(mbedtls_aes_context); + mbedtls_aes_setkey_enc(aes, key->key, 256); return aes; } void psync_ssl_aes256_free_encoder(psync_aes256_encoder aes) { - psync_ssl_memclean(aes, sizeof(aes_context)); + psync_ssl_memclean(aes, sizeof(mbedtls_aes_context)); psync_free(aes); } psync_aes256_encoder psync_ssl_aes256_create_decoder(psync_symmetric_key_t key) { - aes_context *aes; + mbedtls_aes_context *aes; assert(key->keylen >= PSYNC_AES256_KEY_SIZE); - aes = psync_new(aes_context); - aes_setkey_dec(aes, key->key, 256); + aes = psync_new(mbedtls_aes_context); + mbedtls_aes_setkey_dec(aes, key->key, 256); return aes; } void psync_ssl_aes256_free_decoder(psync_aes256_encoder aes) { - psync_ssl_memclean(aes, sizeof(aes_context)); + psync_ssl_memclean(aes, sizeof(mbedtls_aes_context)); psync_free(aes); } @@ -751,15 +768,15 @@ psync_ssl_rsa_sign_sha256_hash(psync_rsa_privatekey_t rsa, ret->datalen = rsa->len; padding = rsa->padding; hash_id = rsa->hash_id; - rsa_set_padding(rsa, RSA_PKCS_V21, POLARSSL_MD_SHA256); - if (rsa_rsassa_pss_sign(rsa, ctr_drbg_random_locked, &psync_mbed_rng, - RSA_PRIVATE, POLARSSL_MD_SHA256, - PSYNC_SHA256_DIGEST_LEN, data, ret->data)) { + mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA256); + if (mbedtls_rsa_rsassa_pss_sign(rsa, ctr_drbg_random_locked, &psync_mbed_rng, + MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA256, + PSYNC_SHA256_DIGEST_LEN, data, ret->data)) { free(ret); - rsa_set_padding(rsa, padding, hash_id); + mbedtls_rsa_set_padding(rsa, padding, hash_id); return (psync_rsa_signature_t)(void *)PSYNC_CRYPTO_NOT_STARTED; } - rsa_set_padding(rsa, padding, hash_id); + mbedtls_rsa_set_padding(rsa, padding, hash_id); return ret; } @@ -1063,13 +1080,15 @@ void psync_aes256_decode_4blocks_consec_xor_sw(psync_aes256_decoder enc, unsigned char *dst, unsigned char *bxor) { unsigned long i; - aes_crypt_ecb(enc, AES_DECRYPT, src, dst); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 2, - dst + PSYNC_AES256_BLOCK_SIZE * 2); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 3, - dst + PSYNC_AES256_BLOCK_SIZE * 3); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, + dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, + src + PSYNC_AES256_BLOCK_SIZE * 2, + dst + PSYNC_AES256_BLOCK_SIZE * 2); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, + src + PSYNC_AES256_BLOCK_SIZE * 3, + dst + PSYNC_AES256_BLOCK_SIZE * 3); for (i = 0; i < PSYNC_AES256_BLOCK_SIZE * 4 / sizeof(unsigned long); i++) ((unsigned long *)dst)[i] ^= ((unsigned long *)bxor)[i]; } diff --git a/lib/pclsync/pssl.h b/lib/pclsync/pssl.h index b07f763..321a5ec 100644 --- a/lib/pclsync/pssl.h +++ b/lib/pclsync/pssl.h @@ -35,9 +35,9 @@ - pcompiler.h - - - - - - - - + - + - + - */ #ifndef _PSYNC_SSL_H @@ -52,47 +52,51 @@ #define PSYNC_SHA1_BLOCK_LEN 64 #define PSYNC_SHA1_DIGEST_LEN 20 #define PSYNC_SHA1_DIGEST_HEXLEN 40 -#define psync_sha1_ctx sha1_context -#define psync_sha1(data, datalen, checksum) sha1(data, datalen, checksum) -#define psync_sha1_init(pctx) sha1_starts(pctx) +#define psync_sha1_ctx mbedtls_sha1_context +#define psync_sha1(data, datalen, checksum) \ + mbedtls_sha1(data, datalen, checksum) +#define psync_sha1_init(pctx) mbedtls_sha1_starts(pctx) #define psync_sha1_update(pctx, data, datalen) \ - sha1_update(pctx, (const unsigned char *)data, datalen) -#define psync_sha1_final(checksum, pctx) sha1_finish(pctx, checksum) + mbedtls_sha1_update(pctx, (const unsigned char *)data, datalen) +#define psync_sha1_final(checksum, pctx) mbedtls_sha1_finish(pctx, checksum) #define PSYNC_SHA256_BLOCK_LEN 64 #define PSYNC_SHA256_DIGEST_LEN 32 #define PSYNC_SHA256_DIGEST_HEXLEN 64 -#define psync_sha256_ctx sha256_context -#define psync_sha256(data, datalen, checksum) sha256(data, datalen, checksum, 0) -#define psync_sha256_init(pctx) sha256_starts(pctx, 0) +#define psync_sha256_ctx mbedtls_sha256_context +#define psync_sha256(data, datalen, checksum) \ + mbedtls_sha256(data, datalen, checksum, 0) +#define psync_sha256_init(pctx) mbedtls_sha256_starts(pctx, 0) #define psync_sha256_update(pctx, data, datalen) \ - sha256_update(pctx, (const unsigned char *)data, datalen) -#define psync_sha256_final(checksum, pctx) sha256_finish(pctx, checksum) + mbedtls_sha256_update(pctx, (const unsigned char *)data, datalen) +#define psync_sha256_final(checksum, pctx) mbedtls_sha256_finish(pctx, checksum) #define PSYNC_SHA512_BLOCK_LEN 128 #define PSYNC_SHA512_DIGEST_LEN 64 #define PSYNC_SHA512_DIGEST_HEXLEN 128 -#define psync_sha512_ctx sha512_context -#define psync_sha512(data, datalen, checksum) sha512(data, datalen, checksum, 0) -#define psync_sha512_init(pctx) sha512_starts(pctx, 0) +#define psync_sha512_ctx mbedtls_sha512_context +#define psync_sha512(data, datalen, checksum) \ + mbedtls_sha512(data, datalen, checksum, 0) +#define psync_sha512_init(pctx) mbedtls_sha512_starts(pctx, 0) #define psync_sha512_update(pctx, data, datalen) \ - sha512_update(pctx, (const unsigned char *)data, datalen) -#define psync_sha512_final(checksum, pctx) sha512_finish(pctx, checksum) + mbedtls_sha512_update(pctx, (const unsigned char *)data, datalen) +#define psync_sha512_final(checksum, pctx) mbedtls_sha512_finish(pctx, checksum) -typedef rsa_context *psync_rsa_t; -typedef rsa_context *psync_rsa_publickey_t; -typedef rsa_context *psync_rsa_privatekey_t; +typedef mbedtls_rsa_context *psync_rsa_t; +typedef mbedtls_rsa_context *psync_rsa_publickey_t; +typedef mbedtls_rsa_context *psync_rsa_privatekey_t; typedef struct { size_t keylen; unsigned char key[]; } psync_symmetric_key_struct_t, *psync_symmetric_key_t; -typedef aes_context *psync_aes256_encoder; -typedef aes_context *psync_aes256_decoder; +typedef mbedtls_aes_context *psync_aes256_encoder; +typedef mbedtls_aes_context *psync_aes256_decoder; -typedef void (*psync_ssl_debug_callback_t)(void *ctx, int level, - const char *message); +// ctx, level, message, ???, ??? +typedef void (*psync_ssl_debug_callback_t)(void *, int, const char *, int, + const char *); void psync_ssl_set_log_threshold(int threshold); void psync_ssl_set_debug_callback(psync_ssl_debug_callback_t cb, void *ctx); @@ -133,7 +137,7 @@ static inline void psync_aes256_encode_block(psync_aes256_encoder enc, if (likely(psync_ssl_hw_aes)) psync_aes256_encode_block_hw(enc, src, dst); else - aes_crypt_ecb(enc, AES_ENCRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst); } static inline void psync_aes256_decode_block(psync_aes256_decoder enc, @@ -142,7 +146,7 @@ static inline void psync_aes256_decode_block(psync_aes256_decoder enc, if (likely(psync_ssl_hw_aes)) psync_aes256_decode_block_hw(enc, src, dst); else - aes_crypt_ecb(enc, AES_DECRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); } static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc, @@ -151,9 +155,10 @@ static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc, if (likely(psync_ssl_hw_aes)) psync_aes256_encode_2blocks_consec_hw(enc, src, dst); else { - aes_crypt_ecb(enc, AES_ENCRYPT, src, dst); - aes_crypt_ecb(enc, AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, + src + PSYNC_AES256_BLOCK_SIZE, + dst + PSYNC_AES256_BLOCK_SIZE); } } @@ -163,9 +168,10 @@ static inline void psync_aes256_decode_2blocks_consec(psync_aes256_decoder enc, if (likely(psync_ssl_hw_aes)) psync_aes256_decode_2blocks_consec_hw(enc, src, dst); else { - aes_crypt_ecb(enc, AES_DECRYPT, src, dst); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, + src + PSYNC_AES256_BLOCK_SIZE, + dst + PSYNC_AES256_BLOCK_SIZE); } } @@ -183,42 +189,44 @@ static inline void psync_aes256_decode_4blocks_consec_xor( static inline void psync_aes256_encode_block(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst) { - aes_crypt_ecb(enc, AES_ENCRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst); } static inline void psync_aes256_decode_block(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) { - aes_crypt_ecb(enc, AES_DECRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); } static inline void psync_aes256_encode_2blocks_consec(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) { - aes_crypt_ecb(enc, AES_ENCRYPT, src, dst); - aes_crypt_ecb(enc, AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE, + dst + PSYNC_AES256_BLOCK_SIZE); } static inline void psync_aes256_decode_2blocks_consec(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) { - aes_crypt_ecb(enc, AES_DECRYPT, src, dst); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, + dst + PSYNC_AES256_BLOCK_SIZE); } static inline void psync_aes256_decode_4blocks_consec_xor( psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor) { unsigned long i; - aes_crypt_ecb(enc, AES_DECRYPT, src, dst); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, - dst + PSYNC_AES256_BLOCK_SIZE); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 2, - dst + PSYNC_AES256_BLOCK_SIZE * 2); - aes_crypt_ecb(enc, AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE * 3, - dst + PSYNC_AES256_BLOCK_SIZE * 3); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE, + dst + PSYNC_AES256_BLOCK_SIZE); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, + src + PSYNC_AES256_BLOCK_SIZE * 2, + dst + PSYNC_AES256_BLOCK_SIZE * 2); + mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, + src + PSYNC_AES256_BLOCK_SIZE * 3, + dst + PSYNC_AES256_BLOCK_SIZE * 3); for (i = 0; i < PSYNC_AES256_BLOCK_SIZE * 4 / sizeof(unsigned long); i++) ((unsigned long *)dst)[i] ^= ((unsigned long *)bxor)[i]; } diff --git a/lib/pclsync/psynclib.c b/lib/pclsync/psynclib.c index 2f4f680..c60dbc7 100644 --- a/lib/pclsync/psynclib.c +++ b/lib/pclsync/psynclib.c @@ -208,7 +208,8 @@ static void psync_stop_crypto_on_sleep() { } } -static void ssl_debug_cb(void *ctx, int level, const char *msg) { +static void ssl_debug_cb(void *ctx, int level, const char *msg, int TODO1, + const char *TODO2) { debug(D_NOTICE, "%s", msg); }