c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/types.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/stream.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/strsubr.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/stropts.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/strsun.h>

c28749e97052f09388969427adf7df641cdcdc22kais#define _SUN_TPI_VERSION 2

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/ddi.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/sunddi.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/debug.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/vtrace.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/kmem.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/cpuvar.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/atomic.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/sysmacros.h>

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/errno.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/isa_defs.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/md5.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/sha1.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/random.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <inet/common.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <netinet/in.h>

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/systm.h>

c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/param.h>

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#include "ksslimpl.h"

c28749e97052f09388969427adf7df641cdcdc22kais#include "ksslapi.h"

c28749e97052f09388969427adf7df641cdcdc22kais#include "ksslproto.h"

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic ssl3CipherSuiteDef cipher_suite_defs[] = {

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* 2 X 16 byte keys + 2 x 20 byte MAC secrets, no IVs */

c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, 72},

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* 2 X 16 byte keys + 2 x 16 byte MAC secrets, no IVs */

c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_RC4_128_MD5, cipher_rc4, mac_md5, 64},

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* 2 X 8 byte keys + 2 x 20 byte MAC secrets, 2 x 8 byte IVs */

c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_DES_CBC_SHA, cipher_des, mac_sha, 72},

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* 2 X 24 byte keys + 2 x 20 byte MAC secrets, 2 x 8 byte IVs */

c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, 104},

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* 2 X 16 byte keys + 2 x 20 byte MAC secrets, 2 x 16 byte IVs */

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {TLS_RSA_WITH_AES_128_CBC_SHA, cipher_aes128, mac_sha, 104},

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna /* 2 X 32 byte keys + 2 x 20 byte MAC secrets, 2 x 16 byte IVs */

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna {TLS_RSA_WITH_AES_256_CBC_SHA, cipher_aes256, mac_sha, 136},

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna

c28749e97052f09388969427adf7df641cdcdc22kais {SSL_RSA_WITH_NULL_SHA, cipher_null, mac_sha, 40}

c28749e97052f09388969427adf7df641cdcdc22kais};

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int cipher_suite_defs_nentries =

c28749e97052f09388969427adf7df641cdcdc22kais sizeof (cipher_suite_defs) / sizeof (cipher_suite_defs[0]);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic KSSLMACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */

c28749e97052f09388969427adf7df641cdcdc22kais /* macsz padsz HashInit HashUpdate HashFinal */

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais {MD5_HASH_LEN, SSL3_MD5_PAD_LEN,

c28749e97052f09388969427adf7df641cdcdc22kais (hashinit_func_t)MD5Init, (hashupdate_func_t)MD5Update,

c28749e97052f09388969427adf7df641cdcdc22kais (hashfinal_func_t)MD5Final},

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais {SHA1_HASH_LEN, SSL3_SHA1_PAD_LEN,

c28749e97052f09388969427adf7df641cdcdc22kais (hashinit_func_t)SHA1Init, (hashupdate_func_t)SHA1Update,

c28749e97052f09388969427adf7df641cdcdc22kais (hashfinal_func_t)SHA1Final},

c28749e97052f09388969427adf7df641cdcdc22kais};

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic uchar_t kssl_pad_1[60] = {

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,

c28749e97052f09388969427adf7df641cdcdc22kais 0x36, 0x36, 0x36, 0x36

c28749e97052f09388969427adf7df641cdcdc22kais};

c28749e97052f09388969427adf7df641cdcdc22kaisstatic uchar_t kssl_pad_2[60] = {

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,

c28749e97052f09388969427adf7df641cdcdc22kais 0x5c, 0x5c, 0x5c, 0x5c

c28749e97052f09388969427adf7df641cdcdc22kais};

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic boolean_t kssl_synchronous = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_update_handshake_hashes(ssl_t *, uchar_t *, uint_t);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_compute_handshake_hashes(ssl_t *, SSL3Hashes *, uint32_t);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_handle_client_hello(ssl_t *, mblk_t *, int);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_handle_client_key_exchange(ssl_t *, mblk_t *, int,

c28749e97052f09388969427adf7df641cdcdc22kais kssl_callback_t, void *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_send_server_hello(ssl_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_send_certificate_and_server_hello_done(ssl_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_send_change_cipher_specs(ssl_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_send_finished(ssl_t *, int);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_handle_finished(ssl_t *, mblk_t *, int);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_get_hello_random(uchar_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic uchar_t *kssl_rsa_unwrap(uchar_t *, size_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_cache_sid(sslSessionID *, kssl_entry_t *);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduristatic void kssl_lookup_sid(sslSessionID *, uchar_t *, in6_addr_t *,

c28749e97052f09388969427adf7df641cdcdc22kais kssl_entry_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_generate_tls_ms(ssl_t *, uchar_t *, size_t);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_generate_ssl_ms(ssl_t *, uchar_t *, size_t);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_generate_tls_keyblock(ssl_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_generate_keyblock(ssl_t *);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_ssl3_key_material_derive_step(ssl_t *, uchar_t *, size_t,

c28749e97052f09388969427adf7df641cdcdc22kais int, uchar_t *, int);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_tls_PRF(ssl_t *, uchar_t *, size_t,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *, size_t, uchar_t *, size_t, uchar_t *, size_t);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int kssl_tls_P_hash(crypto_mechanism_t *, crypto_key_t *,

c28749e97052f09388969427adf7df641cdcdc22kais size_t, uchar_t *, size_t, uchar_t *, size_t, uchar_t *, size_t);

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void kssl_cke_done(void *, int);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#define HMAC_INIT(m, k, c) \

c28749e97052f09388969427adf7df641cdcdc22kais rv = crypto_mac_init(m, k, NULL, c, NULL); if (CRYPTO_ERR(rv)) goto end;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#define HMAC_UPDATE(c, d, l) \

c28749e97052f09388969427adf7df641cdcdc22kais dd.cd_raw.iov_base = (char *)d; \

c28749e97052f09388969427adf7df641cdcdc22kais dd.cd_length = dd.cd_raw.iov_len = l; \

c28749e97052f09388969427adf7df641cdcdc22kais rv = crypto_mac_update(c, &dd, NULL); if (CRYPTO_ERR(rv)) goto end;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#define HMAC_FINAL(c, d, l) \

c28749e97052f09388969427adf7df641cdcdc22kais mac.cd_raw.iov_base = (char *)d; \

c28749e97052f09388969427adf7df641cdcdc22kais mac.cd_length = mac.cd_raw.iov_len = l; \

c28749e97052f09388969427adf7df641cdcdc22kais rv = crypto_mac_final(c, &mac, NULL); if (CRYPTO_ERR(rv)) goto end;

c28749e97052f09388969427adf7df641cdcdc22kais

efe05f9ecde56550699213909fd4152ef8ef6438krishnaextern int kcf_md5_threshold;

efe05f9ecde56550699213909fd4152ef8ef6438krishna

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_compute_record_mac(

c28749e97052f09388969427adf7df641cdcdc22kais ssl_t *ssl,

c28749e97052f09388969427adf7df641cdcdc22kais int direction,

c28749e97052f09388969427adf7df641cdcdc22kais uint64_t seq_num,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3ContentType ct,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *versionp,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *buf,

c28749e97052f09388969427adf7df641cdcdc22kais int len,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *digest)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_HASHCTX mac_ctx;

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_HASHCTX *ctx = &mac_ctx;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t temp[16], *p;

c28749e97052f09388969427adf7df641cdcdc22kais KSSLCipherSpec *spec;

efe05f9ecde56550699213909fd4152ef8ef6438krishna boolean_t hash_use_ok = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais int rv = 0;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais spec = &ssl->spec[direction];

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (spec->mac_hashsz == 0) {

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais p = temp;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 56) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 48) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 40) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 32) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 24) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 16) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num >> 8) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (seq_num) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (uchar_t)ct;

c28749e97052f09388969427adf7df641cdcdc22kais if (IS_TLS(ssl)) {

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = versionp[0];

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = versionp[1];

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (len >> 8) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais *p++ = (len) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais

efe05f9ecde56550699213909fd4152ef8ef6438krishna if (IS_TLS(ssl) || (spec->hmac_mech.cm_type != CRYPTO_MECH_INVALID &&

efe05f9ecde56550699213909fd4152ef8ef6438krishna len >= kcf_md5_threshold)) {

c28749e97052f09388969427adf7df641cdcdc22kais crypto_data_t dd, mac;

efe05f9ecde56550699213909fd4152ef8ef6438krishna struct uio uio_pt;

efe05f9ecde56550699213909fd4152ef8ef6438krishna struct iovec iovarray_pt[2];

efe05f9ecde56550699213909fd4152ef8ef6438krishna

efe05f9ecde56550699213909fd4152ef8ef6438krishna /* init the array of iovecs for use in the uio struct */

efe05f9ecde56550699213909fd4152ef8ef6438krishna iovarray_pt[0].iov_base = (char *)temp;

efe05f9ecde56550699213909fd4152ef8ef6438krishna iovarray_pt[0].iov_len = (p - temp);

efe05f9ecde56550699213909fd4152ef8ef6438krishna iovarray_pt[1].iov_base = (char *)buf;

efe05f9ecde56550699213909fd4152ef8ef6438krishna iovarray_pt[1].iov_len = len;

efe05f9ecde56550699213909fd4152ef8ef6438krishna

efe05f9ecde56550699213909fd4152ef8ef6438krishna /* init the uio struct for use in the crypto_data_t struct */

efe05f9ecde56550699213909fd4152ef8ef6438krishna bzero(&uio_pt, sizeof (uio_pt));

efe05f9ecde56550699213909fd4152ef8ef6438krishna uio_pt.uio_iov = iovarray_pt;

efe05f9ecde56550699213909fd4152ef8ef6438krishna uio_pt.uio_iovcnt = 2;

efe05f9ecde56550699213909fd4152ef8ef6438krishna uio_pt.uio_segflg = UIO_SYSSPACE;

efe05f9ecde56550699213909fd4152ef8ef6438krishna

efe05f9ecde56550699213909fd4152ef8ef6438krishna dd.cd_format = CRYPTO_DATA_UIO;

c28749e97052f09388969427adf7df641cdcdc22kais dd.cd_offset = 0;

efe05f9ecde56550699213909fd4152ef8ef6438krishna dd.cd_length = (p - temp) + len;

efe05f9ecde56550699213909fd4152ef8ef6438krishna dd.cd_miscdata = NULL;

efe05f9ecde56550699213909fd4152ef8ef6438krishna dd.cd_uio = &uio_pt;

efe05f9ecde56550699213909fd4152ef8ef6438krishna

c28749e97052f09388969427adf7df641cdcdc22kais mac.cd_format = CRYPTO_DATA_RAW;

c28749e97052f09388969427adf7df641cdcdc22kais mac.cd_offset = 0;

efe05f9ecde56550699213909fd4152ef8ef6438krishna mac.cd_raw.iov_base = (char *)digest;

efe05f9ecde56550699213909fd4152ef8ef6438krishna mac.cd_length = mac.cd_raw.iov_len = spec->mac_hashsz;

efe05f9ecde56550699213909fd4152ef8ef6438krishna

efe05f9ecde56550699213909fd4152ef8ef6438krishna /*

efe05f9ecde56550699213909fd4152ef8ef6438krishna rv = crypto_mac(&spec->hmac_mech, &dd, &spec->hmac_key,

efe05f9ecde56550699213909fd4152ef8ef6438krishna NULL, &mac, NULL);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (CRYPTO_ERR(rv)) {

efe05f9ecde56550699213909fd4152ef8ef6438krishna hash_use_ok = (rv == CRYPTO_MECH_NOT_SUPPORTED &&

efe05f9ecde56550699213909fd4152ef8ef6438krishna !IS_TLS(ssl));

efe05f9ecde56550699213909fd4152ef8ef6438krishna if (!hash_use_ok) {

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE1(kssl_err__crypto_mac_error,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk int, rv);

efe05f9ecde56550699213909fd4152ef8ef6438krishna KSSL_COUNTER(compute_mac_failure, 1);

efe05f9ecde56550699213909fd4152ef8ef6438krishna }

c28749e97052f09388969427adf7df641cdcdc22kais }

efe05f9ecde56550699213909fd4152ef8ef6438krishna } else

efe05f9ecde56550699213909fd4152ef8ef6438krishna hash_use_ok = B_TRUE;

efe05f9ecde56550699213909fd4152ef8ef6438krishna

efe05f9ecde56550699213909fd4152ef8ef6438krishna if (hash_use_ok) {

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(&(ssl->mac_ctx[direction][0]), ctx,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk sizeof (KSSL_HASHCTX));

c28749e97052f09388969427adf7df641cdcdc22kais spec->MAC_HashUpdate((void *)ctx, temp, p - temp);

c28749e97052f09388969427adf7df641cdcdc22kais spec->MAC_HashUpdate((void *)ctx, buf, len);

c28749e97052f09388969427adf7df641cdcdc22kais spec->MAC_HashFinal(digest, (void *)ctx);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(&(ssl->mac_ctx[direction][1]), ctx,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk sizeof (KSSL_HASHCTX));

c28749e97052f09388969427adf7df641cdcdc22kais spec->MAC_HashUpdate((void *)ctx, digest, spec->mac_hashsz);

c28749e97052f09388969427adf7df641cdcdc22kais spec->MAC_HashFinal(digest, (void *)ctx);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais return (rv);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_handle_handshake_message(ssl_t *ssl, mblk_t *mp, int *err,

c28749e97052f09388969427adf7df641cdcdc22kais kssl_callback_t cbfn, void *arg)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais uint32_t msglen;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t msghdr[4];

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(ssl->msg.state == MSG_BODY);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(ssl->msg.msglen_bytes == 3);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(mp->b_wptr >= mp->b_rptr + ssl->msg.msglen);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ssl->sslcnt++;

c28749e97052f09388969427adf7df641cdcdc22kais msglen = ssl->msg.msglen;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->msg.type == client_hello) {

c28749e97052f09388969427adf7df641cdcdc22kais MD5Init(&ssl->hs_md5);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Init(&ssl->hs_sha1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->msg.type == finished && ssl->resumed == B_FALSE) {

c28749e97052f09388969427adf7df641cdcdc22kais if (kssl_compute_handshake_hashes(ssl, &ssl->hs_hashes,

c28749e97052f09388969427adf7df641cdcdc22kais sender_client) != 0) {

c28749e97052f09388969427adf7df641cdcdc22kais *err = SSL_MISS;

c28749e97052f09388969427adf7df641cdcdc22kais return (0);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->msg.type != finished || ssl->resumed == B_FALSE) {

c28749e97052f09388969427adf7df641cdcdc22kais msghdr[0] = (uchar_t)ssl->msg.type;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais msghdr[1] = (uchar_t)(msglen >> 16);

c28749e97052f09388969427adf7df641cdcdc22kais msghdr[2] = (uchar_t)(msglen >> 8);

c28749e97052f09388969427adf7df641cdcdc22kais msghdr[3] = (uchar_t)(msglen);

c28749e97052f09388969427adf7df641cdcdc22kais kssl_update_handshake_hashes(ssl, msghdr, 4);

c28749e97052f09388969427adf7df641cdcdc22kais kssl_update_handshake_hashes(ssl, mp->b_rptr, msglen);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ssl->msg.state = MSG_INIT;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->msg.msglen = 0;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->msg.msglen_bytes = 0;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais switch (ssl->msg.type) {

c28749e97052f09388969427adf7df641cdcdc22kais case client_hello:

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->hs_waitstate != wait_client_hello) {

c28749e97052f09388969427adf7df641cdcdc22kais kssl_send_alert(ssl, alert_fatal,

c28749e97052f09388969427adf7df641cdcdc22kais unexpected_message);

c28749e97052f09388969427adf7df641cdcdc22kais *err = EBADMSG;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais *err = kssl_handle_client_hello(ssl, mp, msglen);

c28749e97052f09388969427adf7df641cdcdc22kais if (*err == SSL_MISS) {

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais return (0);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais case client_key_exchange:

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->hs_waitstate != wait_client_key) {

c28749e97052f09388969427adf7df641cdcdc22kais kssl_send_alert(ssl, alert_fatal,

c28749e97052f09388969427adf7df641cdcdc22kais unexpected_message);

c28749e97052f09388969427adf7df641cdcdc22kais *err = EBADMSG;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais *err = kssl_handle_client_key_exchange(ssl, mp,

c28749e97052f09388969427adf7df641cdcdc22kais msglen, cbfn, arg);

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais case finished:

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->hs_waitstate != wait_finished) {

c28749e97052f09388969427adf7df641cdcdc22kais kssl_send_alert(ssl, alert_fatal,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk unexpected_message);

c28749e97052f09388969427adf7df641cdcdc22kais *err = EBADMSG;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais *err = kssl_handle_finished(ssl, mp, msglen);

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais default:

c28749e97052f09388969427adf7df641cdcdc22kais kssl_send_alert(ssl, alert_fatal, unexpected_message);

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais *err = EBADMSG;

c28749e97052f09388969427adf7df641cdcdc22kais return (1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_update_handshake_hashes(ssl_t *ssl, uchar_t *buf, uint_t len)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(&ssl->hs_md5, buf, len);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(&ssl->hs_sha1, buf, len);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_compute_handshake_hashes(

c28749e97052f09388969427adf7df641cdcdc22kais ssl_t *ssl,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3Hashes *hashes,

c28749e97052f09388969427adf7df641cdcdc22kais uint32_t sender)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais MD5_CTX md5 = ssl->hs_md5; /* clone md5 context */

c28749e97052f09388969427adf7df641cdcdc22kais SHA1_CTX sha1 = ssl->hs_sha1; /* clone sha1 context */

c28749e97052f09388969427adf7df641cdcdc22kais MD5_CTX *md5ctx = &md5;

c28749e97052f09388969427adf7df641cdcdc22kais SHA1_CTX *sha1ctx = &sha1;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (IS_TLS(ssl)) {

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t seed[MD5_HASH_LEN + SHA1_HASH_LEN];

c28749e97052f09388969427adf7df641cdcdc22kais char *label;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /*

c28749e97052f09388969427adf7df641cdcdc22kais MD5Final(hashes->md5, md5ctx);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Final(hashes->sha1, sha1ctx);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(hashes->md5, seed, MD5_HASH_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(hashes->sha1, seed + MD5_HASH_LEN, SHA1_HASH_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (sender == sender_client)

c28749e97052f09388969427adf7df641cdcdc22kais label = TLS_CLIENT_FINISHED_LABEL;

c28749e97052f09388969427adf7df641cdcdc22kais else

c28749e97052f09388969427adf7df641cdcdc22kais label = TLS_SERVER_FINISHED_LABEL;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais return (kssl_tls_PRF(ssl,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk ssl->sid.master_secret,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk (size_t)SSL3_MASTER_SECRET_LEN,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk (uchar_t *)label, strlen(label),

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk seed, (size_t)(MD5_HASH_LEN + SHA1_HASH_LEN),

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk hashes->tlshash, (size_t)TLS_FINISHED_SIZE));

c28749e97052f09388969427adf7df641cdcdc22kais } else {

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t s[4];

c28749e97052f09388969427adf7df641cdcdc22kais s[0] = (sender >> 24) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais s[1] = (sender >> 16) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais s[2] = (sender >> 8) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais s[3] = (sender) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(md5ctx, s, 4);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(md5ctx, ssl->sid.master_secret,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3_MASTER_SECRET_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(md5ctx, kssl_pad_1, SSL3_MD5_PAD_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Final(hashes->md5, md5ctx);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais MD5Init(md5ctx);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(md5ctx, ssl->sid.master_secret,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3_MASTER_SECRET_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(md5ctx, kssl_pad_2, SSL3_MD5_PAD_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Update(md5ctx, hashes->md5, MD5_HASH_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais MD5Final(hashes->md5, md5ctx);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(sha1ctx, s, 4);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(sha1ctx, ssl->sid.master_secret,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3_MASTER_SECRET_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(sha1ctx, kssl_pad_1, SSL3_SHA1_PAD_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Final(hashes->sha1, sha1ctx);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Init(sha1ctx);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(sha1ctx, ssl->sid.master_secret,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3_MASTER_SECRET_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(sha1ctx, kssl_pad_2, SSL3_SHA1_PAD_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Update(sha1ctx, hashes->sha1, SHA1_HASH_LEN);

c28749e97052f09388969427adf7df641cdcdc22kais SHA1Final(hashes->sha1, sha1ctx);

c28749e97052f09388969427adf7df641cdcdc22kais return (0);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#define KSSL_SSL3_CH_MIN_MSGLEN (39)

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_handle_client_hello(ssl_t *ssl, mblk_t *mp, int msglen)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *msgend;

c28749e97052f09388969427adf7df641cdcdc22kais int err;

c28749e97052f09388969427adf7df641cdcdc22kais SSL3AlertDescription desc = illegal_parameter;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri uint_t sidlen, cslen, cmlen;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *suitesp;

c28749e97052f09388969427adf7df641cdcdc22kais uint_t i, j;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t suite, selected_suite;

c28749e97052f09388969427adf7df641cdcdc22kais int ch_msglen = KSSL_SSL3_CH_MIN_MSGLEN;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal boolean_t suite_found = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(mp->b_wptr >= mp->b_rptr + msglen);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(ssl->msg.type == client_hello);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(ssl->hs_waitstate == wait_client_hello);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(ssl->resumed == B_FALSE);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (msglen < ch_msglen) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE2(kssl_err__msglen_less_than_minimum,

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal int, msglen, int, ch_msglen);

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais msgend = mp->b_rptr + msglen;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* Support SSLv3 (version == 3.0) or TLS (version == 3.1) */

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->major_version != 3 || (ssl->major_version == 3 &&

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk ssl->minor_version != 0 && ssl->minor_version != 1)) {

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE2(kssl_err__SSL_version_not_supported,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk uchar_t, ssl->major_version,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk uchar_t, ssl->minor_version);

c28749e97052f09388969427adf7df641cdcdc22kais desc = handshake_failure;

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais mp->b_rptr += 2; /* skip the version bytes */

c28749e97052f09388969427adf7df641cdcdc22kais

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal /* read client random field */

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(mp->b_rptr, ssl->client_random, SSL3_RANDOM_LENGTH);

c28749e97052f09388969427adf7df641cdcdc22kais mp->b_rptr += SSL3_RANDOM_LENGTH;

c28749e97052f09388969427adf7df641cdcdc22kais

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal /* read session ID length */

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(ssl->sid.cached == B_FALSE);

c28749e97052f09388969427adf7df641cdcdc22kais sidlen = *mp->b_rptr++;

c28749e97052f09388969427adf7df641cdcdc22kais ch_msglen += sidlen;

c28749e97052f09388969427adf7df641cdcdc22kais if (msglen < ch_msglen) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE2(kssl_err__invalid_message_length_after_ver,

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal int, msglen, int, ch_msglen);

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais if (sidlen != SSL3_SESSIONID_BYTES) {

c28749e97052f09388969427adf7df641cdcdc22kais mp->b_rptr += sidlen;

c28749e97052f09388969427adf7df641cdcdc22kais } else {

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri kssl_lookup_sid(&ssl->sid, mp->b_rptr, &ssl->faddr,

c28749e97052f09388969427adf7df641cdcdc22kais ssl->kssl_entry);

c28749e97052f09388969427adf7df641cdcdc22kais mp->b_rptr += SSL3_SESSIONID_BYTES;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal /* read cipher suite length */

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri cslen = ((uint_t)mp->b_rptr[0] << 8) + (uint_t)mp->b_rptr[1];

c28749e97052f09388969427adf7df641cdcdc22kais mp->b_rptr += 2;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri ch_msglen += cslen;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri /*

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri if (msglen < ch_msglen) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE2(kssl_err__invalid_message_length_after_cslen,

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal int, msglen, int, ch_msglen);

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* The length has to be even since a cipher suite is 2-byte long. */

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri if (cslen & 0x1) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE1(kssl_err__uneven_cipher_suite_length,

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal uint_t, cslen);

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais suitesp = mp->b_rptr;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* session resumption checks */

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->sid.cached == B_TRUE) {

c28749e97052f09388969427adf7df641cdcdc22kais suite = ssl->sid.cipher_suite;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri for (j = 0; j < cslen; j += 2) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE2(kssl_cipher_suite_check_resumpt,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t, suite,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (uint16_t)((suitesp[j] << 8) + suitesp[j+1]));

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Check for regular (true) cipher suite. */

c28749e97052f09388969427adf7df641cdcdc22kais if (suitesp[j] == ((suite >> 8) & 0xff) &&

c28749e97052f09388969427adf7df641cdcdc22kais suitesp[j + 1] == (suite & 0xff)) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE1(kssl_cipher_suite_found_resumpt,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t, suite);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal suite_found = B_TRUE;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal selected_suite = suite;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Check for SCSV. */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (suitesp[j] == ((SSL_SCSV >> 8) & 0xff) &&

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal suitesp[j + 1] == (SSL_SCSV & 0xff)) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE(kssl_scsv_found_resumpt);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ssl->secure_renegotiation = B_TRUE;

c28749e97052f09388969427adf7df641cdcdc22kais }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (suite_found && ssl->secure_renegotiation)

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal break;

c28749e97052f09388969427adf7df641cdcdc22kais }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (suite_found)

c28749e97052f09388969427adf7df641cdcdc22kais goto suite_found;

c28749e97052f09388969427adf7df641cdcdc22kais kssl_uncache_sid(&ssl->sid, ssl->kssl_entry);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Check if this server is capable of the cipher suite. */

c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < ssl->kssl_entry->kssl_cipherSuites_nentries; i++) {

c28749e97052f09388969427adf7df641cdcdc22kais suite = ssl->kssl_entry->kssl_cipherSuites[i];

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri for (j = 0; j < cslen; j += 2) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE2(kssl_cipher_suite_check, uint16_t, suite,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (uint16_t)((suitesp[j] << 8) + suitesp[j+1]));

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Check for regular (true) cipher suite. */

c28749e97052f09388969427adf7df641cdcdc22kais if (suitesp[j] == ((suite >> 8) & 0xff) &&

c28749e97052f09388969427adf7df641cdcdc22kais suitesp[j + 1] == (suite & 0xff)) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE1(kssl_cipher_suite_found,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t, suite);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal suite_found = B_TRUE;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal selected_suite = suite;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Check for SCSV. */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (suitesp[j] == ((SSL_SCSV >> 8) & 0xff) &&

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal suitesp[j + 1] == (SSL_SCSV & 0xff)) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE(kssl_scsv_found);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ssl->secure_renegotiation = B_TRUE;

c28749e97052f09388969427adf7df641cdcdc22kais }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (suite_found &&

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (ssl->secure_renegotiation || (i > 0)))

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal break;

c28749e97052f09388969427adf7df641cdcdc22kais }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (suite_found)

c28749e97052f09388969427adf7df641cdcdc22kais break;

c28749e97052f09388969427adf7df641cdcdc22kais }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (!suite_found) {

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->sslcnt == 1) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE(kssl_no_cipher_suite_found);

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(no_suite_found, 1);

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal /*

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal if (ssl->kssl_entry->ke_fallback_head == NULL) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE(kssl_no_fallback);

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal desc = handshake_failure;

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal goto falert;

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal } else {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal return (SSL_MISS);

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal }

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais desc = handshake_failure;

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE(kssl_err__no_cipher_suites_found);

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaissuite_found:

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri mp->b_rptr += cslen;

c28749e97052f09388969427adf7df641cdcdc22kais

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri /*

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri cmlen = *mp->b_rptr++;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri ch_msglen += cmlen - 1; /* -1 accounts for the null method */

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri if (msglen < ch_msglen) {

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE2(kssl_err__invalid_message_length_after_complen,

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal int, msglen, int, ch_msglen);

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri goto falert;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri }

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal /*

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri while (cmlen >= 1) {

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri if (*mp->b_rptr++ == 0)

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri break;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri cmlen--;

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri }

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri

51144063f3afc862c6cb3f54fd4341724f765075Krishna Yenduri if (cmlen == 0) {

c28749e97052f09388969427adf7df641cdcdc22kais desc = handshake_failure;

65d184575ba5adcc532b970fc99d2f67e2df7af6Vladimir Kotal DTRACE_PROBE(kssl_err__no_null_compression_method);

c28749e97052f09388969427adf7df641cdcdc22kais goto falert;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Find the suite in the internal cipher suite table. */

c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < cipher_suite_defs_nentries; i++) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (selected_suite == cipher_suite_defs[i].suite) {

c28749e97052f09388969427adf7df641cdcdc22kais break;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Get past the remaining compression methods (minus null method). */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_rptr += cmlen - 1;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(i < cipher_suite_defs_nentries);

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ssl->pending_cipher_suite = selected_suite;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->pending_malg = cipher_suite_defs[i].malg;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->pending_calg = cipher_suite_defs[i].calg;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->pending_keyblksz = cipher_suite_defs[i].keyblksz;

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Parse TLS extensions (if any). */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ch_msglen + 2 < msglen) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Get the length of the extensions. */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t ext_total_len = ((uint_t)mp->b_rptr[0] << 8) +

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (uint_t)mp->b_rptr[1];

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE1(kssl_total_length_extensions, uint16_t,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ext_total_len);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ext_total_len == 0) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE1(kssl_err__zero_extensions_length,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mblk_t *, mp);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal goto falert;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ch_msglen += 2;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ch_msglen + ext_total_len > msglen) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE2(kssl_err__invalid_extensions_length,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal int, msglen, int, ch_msglen);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal goto falert;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_rptr += 2;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal while (mp->b_rptr < msgend) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t ext_len, ext_type;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ch_msglen + 4 > msglen) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE(kssl_err__invalid_ext_format);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal goto falert;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Get extension type and length */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ext_type = ((uint_t)mp->b_rptr[0] << 8) +

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (uint_t)mp->b_rptr[1];

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_rptr += 2;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ext_len = ((uint_t)mp->b_rptr[0] << 8) +

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (uint_t)mp->b_rptr[1];

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_rptr += 2;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ch_msglen += 4;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE3(kssl_ext_detected, uint16_t, ext_type,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t, ext_len, mblk_t *, mp);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ch_msglen + ext_len > msglen) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE1(

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal kssl_err__invalid_ext_len,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t, ext_len);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal goto falert;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal switch (ext_type) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal case TLSEXT_RENEGOTIATION_INFO:

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE(kssl_reneg_info_found);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if ((ext_len != 1) ||

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal (*mp->b_rptr != 0)) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal DTRACE_PROBE2(

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal kssl_err__non_empty_reneg_info,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t, ext_len,

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mblk_t *, mp);

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal goto falert;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ssl->secure_renegotiation = B_TRUE;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal break;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal default:

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* FALLTHRU */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal break;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* jump to the next extension */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ch_msglen += ext_len;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_rptr += ext_len;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_rptr = msgend;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

c28749e97052f09388969427adf7df641cdcdc22kais if (ssl->sid.cached == B_TRUE) {

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_send_server_hello(ssl);

c28749e97052f09388969427adf7df641cdcdc22kais if (err != 0) {

c28749e97052f09388969427adf7df641cdcdc22kais return (err);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais if (IS_TLS(ssl))

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_generate_tls_keyblock(ssl);

c28749e97052f09388969427adf7df641cdcdc22kais else

c28749e97052f09388969427adf7df641cdcdc22kais kssl_generate_keyblock(ssl);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_send_change_cipher_specs(ssl);

c28749e97052f09388969427adf7df641cdcdc22kais if (err != 0) {

c28749e97052f09388969427adf7df641cdcdc22kais return (err);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_send_finished(ssl, 1);

c28749e97052f09388969427adf7df641cdcdc22kais if (err != 0)

c28749e97052f09388969427adf7df641cdcdc22kais return (err);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_compute_handshake_hashes(ssl, &ssl->hs_hashes,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk sender_client);

c28749e97052f09388969427adf7df641cdcdc22kais if (err != 0)

c28749e97052f09388969427adf7df641cdcdc22kais return (err);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ssl->hs_waitstate = wait_change_cipher;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->resumed = B_TRUE;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(resumed_sessions, 1);

c28749e97052f09388969427adf7df641cdcdc22kais return (0);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais (void) random_get_pseudo_bytes(ssl->sid.session_id,

c28749e97052f09388969427adf7df641cdcdc22kais SSL3_SESSIONID_BYTES);

c28749e97052f09388969427adf7df641cdcdc22kais ssl->sid.client_addr = ssl->faddr;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal ssl->sid.cipher_suite = selected_suite;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_send_server_hello(ssl);

c28749e97052f09388969427adf7df641cdcdc22kais if (err != 0) {

c28749e97052f09388969427adf7df641cdcdc22kais return (err);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais err = kssl_send_certificate_and_server_hello_done(ssl);

c28749e97052f09388969427adf7df641cdcdc22kais if (err != 0) {

c28749e97052f09388969427adf7df641cdcdc22kais return (err);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(full_handshakes, 1);

c28749e97052f09388969427adf7df641cdcdc22kais ssl->hs_waitstate = wait_client_key;

c28749e97052f09388969427adf7df641cdcdc22kais ssl->activeinput = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais return (0);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisfalert:

c28749e97052f09388969427adf7df641cdcdc22kais kssl_send_alert(ssl, alert_fatal, desc);

c28749e97052f09388969427adf7df641cdcdc22kais return (EBADMSG);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri#define SET_HASH_INDEX(index, s, clnt_addr) { \

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri int addr; \

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri \

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri IN6_V4MAPPED_TO_IPADDR(clnt_addr, addr); \

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri index = addr ^ (((int)(s)[0] << 24) | ((int)(s)[1] << 16) | \

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri ((int)(s)[2] << 8) | (int)(s)[SSL3_SESSIONID_BYTES - 1]); \

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri}

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_cache_sid(sslSessionID *sid, kssl_entry_t *kssl_entry)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais uint_t index;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *s = sid->session_id;

c28749e97052f09388969427adf7df641cdcdc22kais kmutex_t *lock;

c28749e97052f09388969427adf7df641cdcdc22kais

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri ASSERT(sid->cached == B_FALSE);

c28749e97052f09388969427adf7df641cdcdc22kais

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri /* set the values before creating the cache entry */

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri sid->cached = B_TRUE;

d3d50737e566cade9a08d73d2af95105ac7cd960Rafael Vanoni sid->time = ddi_get_lbolt();

c28749e97052f09388969427adf7df641cdcdc22kais

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri SET_HASH_INDEX(index, s, &sid->client_addr);

c28749e97052f09388969427adf7df641cdcdc22kais index %= kssl_entry->sid_cache_nentries;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais lock = &(kssl_entry->sid_cache[index].se_lock);

c28749e97052f09388969427adf7df641cdcdc22kais mutex_enter(lock);

c28749e97052f09388969427adf7df641cdcdc22kais kssl_entry->sid_cache[index].se_used++;

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(sid, &(kssl_entry->sid_cache[index].se_sid), sizeof (*sid));

c28749e97052f09388969427adf7df641cdcdc22kais mutex_exit(lock);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri KSSL_COUNTER(sid_cached, 1);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri}

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yendurikssl_uncache_sid(sslSessionID *sid, kssl_entry_t *kssl_entry)

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri{

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri uint_t index;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri uchar_t *s = sid->session_id;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri sslSessionID *csid;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri kmutex_t *lock;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri ASSERT(sid->cached == B_TRUE);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri sid->cached = B_FALSE;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri SET_HASH_INDEX(index, s, &sid->client_addr);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri index %= kssl_entry->sid_cache_nentries;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri lock = &(kssl_entry->sid_cache[index].se_lock);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri mutex_enter(lock);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri csid = &(kssl_entry->sid_cache[index].se_sid);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri if (!(IN6_ARE_ADDR_EQUAL(&csid->client_addr, &sid->client_addr)) ||

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri bcmp(csid->session_id, s, SSL3_SESSIONID_BYTES)) {

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri mutex_exit(lock);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri return;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri }

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri csid->cached = B_FALSE;

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri mutex_exit(lock);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri KSSL_COUNTER(sid_uncached, 1);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yendurikssl_lookup_sid(sslSessionID *sid, uchar_t *s, in6_addr_t *faddr,

c28749e97052f09388969427adf7df641cdcdc22kais kssl_entry_t *kssl_entry)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais uint_t index;

c28749e97052f09388969427adf7df641cdcdc22kais kmutex_t *lock;

c28749e97052f09388969427adf7df641cdcdc22kais sslSessionID *csid;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(sid_cache_lookups, 1);

c28749e97052f09388969427adf7df641cdcdc22kais

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri SET_HASH_INDEX(index, s, faddr);

c28749e97052f09388969427adf7df641cdcdc22kais index %= kssl_entry->sid_cache_nentries;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais lock = &(kssl_entry->sid_cache[index].se_lock);

c28749e97052f09388969427adf7df641cdcdc22kais mutex_enter(lock);

c28749e97052f09388969427adf7df641cdcdc22kais csid = &(kssl_entry->sid_cache[index].se_sid);

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri if (csid->cached == B_FALSE ||

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri !IN6_ARE_ADDR_EQUAL(&csid->client_addr, faddr) ||

c28749e97052f09388969427adf7df641cdcdc22kais bcmp(csid->session_id, s, SSL3_SESSIONID_BYTES)) {

c28749e97052f09388969427adf7df641cdcdc22kais mutex_exit(lock);

c28749e97052f09388969427adf7df641cdcdc22kais return;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

d3d50737e566cade9a08d73d2af95105ac7cd960Rafael Vanoni if (TICK_TO_SEC(ddi_get_lbolt() - csid->time) >

d3d50737e566cade9a08d73d2af95105ac7cd960Rafael Vanoni kssl_entry->sid_cache_timeout) {

c28749e97052f09388969427adf7df641cdcdc22kais csid->cached = B_FALSE;

c28749e97052f09388969427adf7df641cdcdc22kais mutex_exit(lock);

c28749e97052f09388969427adf7df641cdcdc22kais return;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(csid, sid, sizeof (*sid));

c28749e97052f09388969427adf7df641cdcdc22kais mutex_exit(lock);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(sid->cached == B_TRUE);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(sid_cache_hits, 1);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic uchar_t *

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_rsa_unwrap(uchar_t *buf, size_t *lenp)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais size_t len = *lenp;

c28749e97052f09388969427adf7df641cdcdc22kais int i = 2;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (buf[0] != 0 || buf[1] != 2) {

c28749e97052f09388969427adf7df641cdcdc22kais return (NULL);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais while (i < len) {

c28749e97052f09388969427adf7df641cdcdc22kais if (buf[i++] == 0) {

c28749e97052f09388969427adf7df641cdcdc22kais *lenp = len - i;

c28749e97052f09388969427adf7df641cdcdc22kais break;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais if (i == len) {

c28749e97052f09388969427adf7df641cdcdc22kais return (NULL);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais return (buf + i);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#define KSSL_SSL3_SH_RECLEN (74)

c28749e97052f09388969427adf7df641cdcdc22kais#define KSSL_SSL3_FIN_MSGLEN (36)

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal#define KSSL_EMPTY_RENEG_INFO_LEN (7)

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais#define KSSL_SSL3_MAX_CCP_FIN_MSGLEN (128) /* comfortable upper bound */

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_send_server_hello(ssl_t *ssl)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais mblk_t *mp;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *buf;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *msgstart;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal uint16_t reclen = KSSL_SSL3_SH_RECLEN;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais mp = allocb(ssl->tcp_mss, BPRI_HI);

c28749e97052f09388969427adf7df641cdcdc22kais if (mp == NULL) {

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(alloc_fails, 1);

c28749e97052f09388969427adf7df641cdcdc22kais return (ENOMEM);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais ssl->handshake_sendbuf = mp;

c28749e97052f09388969427adf7df641cdcdc22kais buf = mp->b_wptr;

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ssl->secure_renegotiation)

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal reclen += KSSL_EMPTY_RENEG_INFO_LEN;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

c28749e97052f09388969427adf7df641cdcdc22kais /* 5 byte record header */

c28749e97052f09388969427adf7df641cdcdc22kais buf[0] = content_handshake;

c28749e97052f09388969427adf7df641cdcdc22kais buf[1] = ssl->major_version;

c28749e97052f09388969427adf7df641cdcdc22kais buf[2] = ssl->minor_version;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[3] = reclen >> 8;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[4] = reclen & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais buf += SSL3_HDR_LEN;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais msgstart = buf;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* 6 byte message header */

c28749e97052f09388969427adf7df641cdcdc22kais buf[0] = (uchar_t)server_hello; /* message type */

c28749e97052f09388969427adf7df641cdcdc22kais buf[1] = 0; /* message len byte 0 */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[2] = ((reclen - 4) >> 8) &

c28749e97052f09388969427adf7df641cdcdc22kais 0xff; /* message len byte 1 */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[3] = (reclen - 4) & 0xff; /* message len byte 2 */

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais buf[4] = ssl->major_version; /* version byte 0 */

c28749e97052f09388969427adf7df641cdcdc22kais buf[5] = ssl->minor_version; /* version byte 1 */

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais buf += 6;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais kssl_get_hello_random(ssl->server_random);

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(ssl->server_random, buf, SSL3_RANDOM_LENGTH);

c28749e97052f09388969427adf7df641cdcdc22kais buf += SSL3_RANDOM_LENGTH;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais buf[0] = SSL3_SESSIONID_BYTES;

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(ssl->sid.session_id, buf + 1, SSL3_SESSIONID_BYTES);

c28749e97052f09388969427adf7df641cdcdc22kais buf += SSL3_SESSIONID_BYTES + 1;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais buf[0] = (ssl->pending_cipher_suite >> 8) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais buf[1] = ssl->pending_cipher_suite & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais buf[2] = 0; /* No compression */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf += 3;

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /*

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal if (ssl->secure_renegotiation) {

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* Extensions length */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[0] = 0x00;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[1] = 0x05;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal /* empty renegotiation_info extension encoding (section 3.2) */

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[2] = 0xff;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[3] = 0x01;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[4] = 0x00;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[5] = 0x01;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf[6] = 0x00;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal buf += KSSL_EMPTY_RENEG_INFO_LEN;

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal }

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal mp->b_wptr = buf;

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(mp->b_wptr < mp->b_datap->db_lim);

c28749e97052f09388969427adf7df641cdcdc22kais

11d0a659fdd288190c17d8600ecd218e9a9b546dVladimir Kotal kssl_update_handshake_hashes(ssl, msgstart, reclen);

c28749e97052f09388969427adf7df641cdcdc22kais return (0);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_get_hello_random(uchar_t *buf)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais timestruc_t ts;

c28749e97052f09388969427adf7df641cdcdc22kais time_t sec;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais gethrestime(&ts);

c28749e97052f09388969427adf7df641cdcdc22kais sec = ts.tv_sec;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais buf[0] = (sec >> 24) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais buf[1] = (sec >> 16) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais buf[2] = (sec >> 8) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais buf[3] = (sec) & 0xff;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais (void) random_get_pseudo_bytes(&buf[4], SSL3_RANDOM_LENGTH - 4);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* Should this be caching? */

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_tls_P_hash(crypto_mechanism_t *mech, crypto_key_t *key,

c28749e97052f09388969427adf7df641cdcdc22kais size_t hashlen,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *label, size_t label_len,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *seed, size_t seedlen,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *data, size_t datalen)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais int rv = 0;

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t A1[MAX_HASH_LEN], result[MAX_HASH_LEN];

dd49f125507979bb2ab505a8daf2a46d1be27051Anders Persson int bytes_left = (int)datalen;

c28749e97052f09388969427adf7df641cdcdc22kais crypto_data_t dd, mac;

c28749e97052f09388969427adf7df641cdcdc22kais crypto_context_t ctx;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais dd.cd_format = CRYPTO_DATA_RAW;

c28749e97052f09388969427adf7df641cdcdc22kais dd.cd_offset = 0;

c28749e97052f09388969427adf7df641cdcdc22kais mac.cd_format = CRYPTO_DATA_RAW;

c28749e97052f09388969427adf7df641cdcdc22kais mac.cd_offset = 0;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /*

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_INIT(mech, key, &ctx);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_UPDATE(ctx, label, label_len);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_UPDATE(ctx, seed, seedlen);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_FINAL(ctx, A1, hashlen);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* Compute A(2) ... A(n) */

c28749e97052f09388969427adf7df641cdcdc22kais while (bytes_left > 0) {

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_INIT(mech, key, &ctx);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_UPDATE(ctx, A1, hashlen);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_UPDATE(ctx, label, label_len);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_UPDATE(ctx, seed, seedlen);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_FINAL(ctx, result, hashlen);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /*

c28749e97052f09388969427adf7df641cdcdc22kais if (bytes_left > hashlen) {

c28749e97052f09388969427adf7df641cdcdc22kais /* Store the chunk result */

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(result, data, hashlen);

c28749e97052f09388969427adf7df641cdcdc22kais data += hashlen;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais bytes_left -= hashlen;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* Update A1 for next iteration */

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_INIT(mech, key, &ctx);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_UPDATE(ctx, A1, hashlen);

c28749e97052f09388969427adf7df641cdcdc22kais HMAC_FINAL(ctx, A1, hashlen);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais } else {

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(result, data, bytes_left);

c28749e97052f09388969427adf7df641cdcdc22kais data += bytes_left;

c28749e97052f09388969427adf7df641cdcdc22kais bytes_left = 0;

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kaisend:

c28749e97052f09388969427adf7df641cdcdc22kais if (CRYPTO_ERR(rv)) {

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE1(kssl_err__crypto_mac_error, int, rv);

c28749e97052f09388969427adf7df641cdcdc22kais KSSL_COUNTER(compute_mac_failure, 1);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais return (rv);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_tls_PRF(ssl_t *ssl,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *secret, size_t secret_len,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *label, size_t label_len,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *seed, size_t seed_len,

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *prfresult, size_t prfresult_len)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais /*

c28749e97052f09388969427adf7df641cdcdc22kais

2ec7cc7fc084163eaed884efee9bbd322cc8951bKrishna Yenduri int rv, i;

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna uchar_t psha1[MAX_KEYBLOCK_LENGTH];

c28749e97052f09388969427adf7df641cdcdc22kais crypto_key_t S1, S2;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* length of secret keys is ceil(length/2) */

c28749e97052f09388969427adf7df641cdcdc22kais size_t slen = roundup(secret_len, 2) / 2;

c28749e97052f09388969427adf7df641cdcdc22kais

2bd70d4be73561631df9cb3d9eb4c65fa94fa665krishna if (prfresult_len > MAX_KEYBLOCK_LENGTH) {

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE1(kssl_err__unexpected_keyblock_size,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk size_t, prfresult_len);

c28749e97052f09388969427adf7df641cdcdc22kais return (CRYPTO_ARGUMENTS_BAD);

c28749e97052f09388969427adf7df641cdcdc22kais }

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(prfresult != NULL);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(label != NULL);

c28749e97052f09388969427adf7df641cdcdc22kais ASSERT(seed != NULL);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais S1.ck_data = secret;

c28749e97052f09388969427adf7df641cdcdc22kais S1.ck_length = slen * 8; /* bits */

c28749e97052f09388969427adf7df641cdcdc22kais S1.ck_format = CRYPTO_KEY_RAW;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais S2.ck_data = secret + slen;

c28749e97052f09388969427adf7df641cdcdc22kais S2.ck_length = slen * 8; /* bits */

c28749e97052f09388969427adf7df641cdcdc22kais S2.ck_format = CRYPTO_KEY_RAW;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais rv = kssl_tls_P_hash(&hmac_md5_mech, &S1, MD5_HASH_LEN,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk label, label_len,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk seed, seed_len,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk prfresult, prfresult_len);

c28749e97052f09388969427adf7df641cdcdc22kais if (CRYPTO_ERR(rv))

c28749e97052f09388969427adf7df641cdcdc22kais goto end;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais rv = kssl_tls_P_hash(&hmac_sha1_mech, &S2, SHA1_HASH_LEN,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk label, label_len,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk seed, seed_len,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk psha1, prfresult_len);

c28749e97052f09388969427adf7df641cdcdc22kais if (CRYPTO_ERR(rv))

c28749e97052f09388969427adf7df641cdcdc22kais goto end;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais for (i = 0; i < prfresult_len; i++)

c28749e97052f09388969427adf7df641cdcdc22kais prfresult[i] ^= psha1[i];

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kaisend:

c28749e97052f09388969427adf7df641cdcdc22kais if (CRYPTO_ERR(rv))

c28749e97052f09388969427adf7df641cdcdc22kais bzero(prfresult, prfresult_len);

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais return (rv);

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

968d6dde54d2efa62910a3cf36438325d0b69031krishna#define IS_BAD_PRE_MASTER_SECRET(pms, pmslen, ssl) \

968d6dde54d2efa62910a3cf36438325d0b69031krishna (pms == NULL || pmslen != SSL3_PRE_MASTER_SECRET_LEN || \

968d6dde54d2efa62910a3cf36438325d0b69031krishna pms[0] != ssl->major_version || pms[1] != ssl->minor_version)

968d6dde54d2efa62910a3cf36438325d0b69031krishna

968d6dde54d2efa62910a3cf36438325d0b69031krishna#define FAKE_PRE_MASTER_SECRET(pms, pmslen, ssl, buf) { \

968d6dde54d2efa62910a3cf36438325d0b69031krishna KSSL_COUNTER(bad_pre_master_secret, 1); \

968d6dde54d2efa62910a3cf36438325d0b69031krishna pms = buf; \

968d6dde54d2efa62910a3cf36438325d0b69031krishna pmslen = SSL3_PRE_MASTER_SECRET_LEN; \

968d6dde54d2efa62910a3cf36438325d0b69031krishna pms[0] = ssl->major_version; \

968d6dde54d2efa62910a3cf36438325d0b69031krishna pms[1] = ssl->minor_version; \

968d6dde54d2efa62910a3cf36438325d0b69031krishna (void) random_get_pseudo_bytes(&buf[2], pmslen - 2); \

968d6dde54d2efa62910a3cf36438325d0b69031krishna}

968d6dde54d2efa62910a3cf36438325d0b69031krishna

c28749e97052f09388969427adf7df641cdcdc22kaisstatic int

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_generate_tls_ms(ssl_t *ssl, uchar_t *pms, size_t pmslen)

c28749e97052f09388969427adf7df641cdcdc22kais{

968d6dde54d2efa62910a3cf36438325d0b69031krishna uchar_t buf[SSL3_PRE_MASTER_SECRET_LEN];

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t seed[SSL3_RANDOM_LENGTH * 2];

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /*

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(ssl->client_random, seed, SSL3_RANDOM_LENGTH);

c28749e97052f09388969427adf7df641cdcdc22kais bcopy(ssl->server_random, seed + SSL3_RANDOM_LENGTH,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk SSL3_RANDOM_LENGTH);

c28749e97052f09388969427adf7df641cdcdc22kais

968d6dde54d2efa62910a3cf36438325d0b69031krishna /* if pms is bad fake it to thwart Bleichenbacher attack */

968d6dde54d2efa62910a3cf36438325d0b69031krishna if (IS_BAD_PRE_MASTER_SECRET(pms, pmslen, ssl)) {

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk DTRACE_PROBE(kssl_err__under_Bleichenbacher_attack);

968d6dde54d2efa62910a3cf36438325d0b69031krishna FAKE_PRE_MASTER_SECRET(pms, pmslen, ssl, buf);

968d6dde54d2efa62910a3cf36438325d0b69031krishna }

968d6dde54d2efa62910a3cf36438325d0b69031krishna

c28749e97052f09388969427adf7df641cdcdc22kais return (kssl_tls_PRF(ssl,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk pms, pmslen,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk (uchar_t *)TLS_MASTER_SECRET_LABEL,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk (size_t)strlen(TLS_MASTER_SECRET_LABEL),

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk seed, sizeof (seed),

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk ssl->sid.master_secret,

51dd2c77f06e5663c28bd4f7a760cae4cf159e79vk (size_t)sizeof (ssl->sid.master_secret)));

c28749e97052f09388969427adf7df641cdcdc22kais}

c28749e97052f09388969427adf7df641cdcdc22kais

968d6dde54d2efa62910a3cf36438325d0b69031krishna

c28749e97052f09388969427adf7df641cdcdc22kaisstatic void

c28749e97052f09388969427adf7df641cdcdc22kaiskssl_generate_ssl_ms(ssl_t *ssl, uchar_t *pms, size_t pmslen)

c28749e97052f09388969427adf7df641cdcdc22kais{

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t buf[SSL3_PRE_MASTER_SECRET_LEN];

c28749e97052f09388969427adf7df641cdcdc22kais uchar_t *ms;

c28749e97052f09388969427adf7df641cdcdc22kais int hlen = MD5_HASH_LEN;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais ms = ssl->sid.master_secret;

c28749e97052f09388969427adf7df641cdcdc22kais

c28749e97052f09388969427adf7df641cdcdc22kais /* if pms is bad fake it to thwart Bleichenbacher attack */

968d6dde54d2efa62910a3cf36438325d0b69031krishna if (IS_BAD_PRE_MASTER_SECRET(pms, pmslen, ssl)) {