1 /* 2 * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/crypto.h> 11 #include <openssl/rand.h> 12 #include <openssl/err.h> 13 #include "ssl_locl.h" 14 15 #ifndef OPENSSL_NO_SRP 16 # include <openssl/srp.h> 17 18 int SSL_CTX_SRP_CTX_free(struct ssl_ctx_st *ctx) 19 { 20 if (ctx == NULL) 21 return 0; 22 OPENSSL_free(ctx->srp_ctx.login); 23 OPENSSL_free(ctx->srp_ctx.info); 24 BN_free(ctx->srp_ctx.N); 25 BN_free(ctx->srp_ctx.g); 26 BN_free(ctx->srp_ctx.s); 27 BN_free(ctx->srp_ctx.B); 28 BN_free(ctx->srp_ctx.A); 29 BN_free(ctx->srp_ctx.a); 30 BN_free(ctx->srp_ctx.b); 31 BN_free(ctx->srp_ctx.v); 32 memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx)); 33 ctx->srp_ctx.strength = SRP_MINIMAL_N; 34 return (1); 35 } 36 37 int SSL_SRP_CTX_free(struct ssl_st *s) 38 { 39 if (s == NULL) 40 return 0; 41 OPENSSL_free(s->srp_ctx.login); 42 OPENSSL_free(s->srp_ctx.info); 43 BN_free(s->srp_ctx.N); 44 BN_free(s->srp_ctx.g); 45 BN_free(s->srp_ctx.s); 46 BN_free(s->srp_ctx.B); 47 BN_free(s->srp_ctx.A); 48 BN_free(s->srp_ctx.a); 49 BN_free(s->srp_ctx.b); 50 BN_free(s->srp_ctx.v); 51 memset(&s->srp_ctx, 0, sizeof(s->srp_ctx)); 52 s->srp_ctx.strength = SRP_MINIMAL_N; 53 return (1); 54 } 55 56 int SSL_SRP_CTX_init(struct ssl_st *s) 57 { 58 SSL_CTX *ctx; 59 60 if ((s == NULL) || ((ctx = s->ctx) == NULL)) 61 return 0; 62 63 memset(&s->srp_ctx, 0, sizeof(s->srp_ctx)); 64 65 s->srp_ctx.SRP_cb_arg = ctx->srp_ctx.SRP_cb_arg; 66 /* set client Hello login callback */ 67 s->srp_ctx.TLS_ext_srp_username_callback = 68 ctx->srp_ctx.TLS_ext_srp_username_callback; 69 /* set SRP N/g param callback for verification */ 70 s->srp_ctx.SRP_verify_param_callback = 71 ctx->srp_ctx.SRP_verify_param_callback; 72 /* set SRP client passwd callback */ 73 s->srp_ctx.SRP_give_srp_client_pwd_callback = 74 ctx->srp_ctx.SRP_give_srp_client_pwd_callback; 75 76 s->srp_ctx.strength = ctx->srp_ctx.strength; 77 78 if (((ctx->srp_ctx.N != NULL) && 79 ((s->srp_ctx.N = BN_dup(ctx->srp_ctx.N)) == NULL)) || 80 ((ctx->srp_ctx.g != NULL) && 81 ((s->srp_ctx.g = BN_dup(ctx->srp_ctx.g)) == NULL)) || 82 ((ctx->srp_ctx.s != NULL) && 83 ((s->srp_ctx.s = BN_dup(ctx->srp_ctx.s)) == NULL)) || 84 ((ctx->srp_ctx.B != NULL) && 85 ((s->srp_ctx.B = BN_dup(ctx->srp_ctx.B)) == NULL)) || 86 ((ctx->srp_ctx.A != NULL) && 87 ((s->srp_ctx.A = BN_dup(ctx->srp_ctx.A)) == NULL)) || 88 ((ctx->srp_ctx.a != NULL) && 89 ((s->srp_ctx.a = BN_dup(ctx->srp_ctx.a)) == NULL)) || 90 ((ctx->srp_ctx.v != NULL) && 91 ((s->srp_ctx.v = BN_dup(ctx->srp_ctx.v)) == NULL)) || 92 ((ctx->srp_ctx.b != NULL) && 93 ((s->srp_ctx.b = BN_dup(ctx->srp_ctx.b)) == NULL))) { 94 SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_BN_LIB); 95 goto err; 96 } 97 if ((ctx->srp_ctx.login != NULL) && 98 ((s->srp_ctx.login = OPENSSL_strdup(ctx->srp_ctx.login)) == NULL)) { 99 SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR); 100 goto err; 101 } 102 if ((ctx->srp_ctx.info != NULL) && 103 ((s->srp_ctx.info = BUF_strdup(ctx->srp_ctx.info)) == NULL)) { 104 SSLerr(SSL_F_SSL_SRP_CTX_INIT, ERR_R_INTERNAL_ERROR); 105 goto err; 106 } 107 s->srp_ctx.srp_Mask = ctx->srp_ctx.srp_Mask; 108 109 return (1); 110 err: 111 OPENSSL_free(s->srp_ctx.login); 112 OPENSSL_free(s->srp_ctx.info); 113 BN_free(s->srp_ctx.N); 114 BN_free(s->srp_ctx.g); 115 BN_free(s->srp_ctx.s); 116 BN_free(s->srp_ctx.B); 117 BN_free(s->srp_ctx.A); 118 BN_free(s->srp_ctx.a); 119 BN_free(s->srp_ctx.b); 120 BN_free(s->srp_ctx.v); 121 memset(&s->srp_ctx, 0, sizeof(s->srp_ctx)); 122 return (0); 123 } 124 125 int SSL_CTX_SRP_CTX_init(struct ssl_ctx_st *ctx) 126 { 127 if (ctx == NULL) 128 return 0; 129 130 memset(&ctx->srp_ctx, 0, sizeof(ctx->srp_ctx)); 131 ctx->srp_ctx.strength = SRP_MINIMAL_N; 132 133 return (1); 134 } 135 136 /* server side */ 137 int SSL_srp_server_param_with_username(SSL *s, int *ad) 138 { 139 unsigned char b[SSL_MAX_MASTER_KEY_LENGTH]; 140 int al; 141 142 *ad = SSL_AD_UNKNOWN_PSK_IDENTITY; 143 if ((s->srp_ctx.TLS_ext_srp_username_callback != NULL) && 144 ((al = 145 s->srp_ctx.TLS_ext_srp_username_callback(s, ad, 146 s->srp_ctx.SRP_cb_arg)) != 147 SSL_ERROR_NONE)) 148 return al; 149 150 *ad = SSL_AD_INTERNAL_ERROR; 151 if ((s->srp_ctx.N == NULL) || 152 (s->srp_ctx.g == NULL) || 153 (s->srp_ctx.s == NULL) || (s->srp_ctx.v == NULL)) 154 return SSL3_AL_FATAL; 155 156 if (RAND_bytes(b, sizeof(b)) <= 0) 157 return SSL3_AL_FATAL; 158 s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL); 159 OPENSSL_cleanse(b, sizeof(b)); 160 161 /* Calculate: B = (kv + g^b) % N */ 162 163 return ((s->srp_ctx.B = 164 SRP_Calc_B(s->srp_ctx.b, s->srp_ctx.N, s->srp_ctx.g, 165 s->srp_ctx.v)) != 166 NULL) ? SSL_ERROR_NONE : SSL3_AL_FATAL; 167 } 168 169 /* 170 * If the server just has the raw password, make up a verifier entry on the 171 * fly 172 */ 173 int SSL_set_srp_server_param_pw(SSL *s, const char *user, const char *pass, 174 const char *grp) 175 { 176 SRP_gN *GN = SRP_get_default_gN(grp); 177 if (GN == NULL) 178 return -1; 179 s->srp_ctx.N = BN_dup(GN->N); 180 s->srp_ctx.g = BN_dup(GN->g); 181 BN_clear_free(s->srp_ctx.v); 182 s->srp_ctx.v = NULL; 183 BN_clear_free(s->srp_ctx.s); 184 s->srp_ctx.s = NULL; 185 if (!SRP_create_verifier_BN 186 (user, pass, &s->srp_ctx.s, &s->srp_ctx.v, GN->N, GN->g)) 187 return -1; 188 189 return 1; 190 } 191 192 int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g, 193 BIGNUM *sa, BIGNUM *v, char *info) 194 { 195 if (N != NULL) { 196 if (s->srp_ctx.N != NULL) { 197 if (!BN_copy(s->srp_ctx.N, N)) { 198 BN_free(s->srp_ctx.N); 199 s->srp_ctx.N = NULL; 200 } 201 } else 202 s->srp_ctx.N = BN_dup(N); 203 } 204 if (g != NULL) { 205 if (s->srp_ctx.g != NULL) { 206 if (!BN_copy(s->srp_ctx.g, g)) { 207 BN_free(s->srp_ctx.g); 208 s->srp_ctx.g = NULL; 209 } 210 } else 211 s->srp_ctx.g = BN_dup(g); 212 } 213 if (sa != NULL) { 214 if (s->srp_ctx.s != NULL) { 215 if (!BN_copy(s->srp_ctx.s, sa)) { 216 BN_free(s->srp_ctx.s); 217 s->srp_ctx.s = NULL; 218 } 219 } else 220 s->srp_ctx.s = BN_dup(sa); 221 } 222 if (v != NULL) { 223 if (s->srp_ctx.v != NULL) { 224 if (!BN_copy(s->srp_ctx.v, v)) { 225 BN_free(s->srp_ctx.v); 226 s->srp_ctx.v = NULL; 227 } 228 } else 229 s->srp_ctx.v = BN_dup(v); 230 } 231 if (info != NULL) { 232 if (s->srp_ctx.info) 233 OPENSSL_free(s->srp_ctx.info); 234 if ((s->srp_ctx.info = BUF_strdup(info)) == NULL) 235 return -1; 236 } 237 238 if (!(s->srp_ctx.N) || 239 !(s->srp_ctx.g) || !(s->srp_ctx.s) || !(s->srp_ctx.v)) 240 return -1; 241 242 return 1; 243 } 244 245 int srp_generate_server_master_secret(SSL *s) 246 { 247 BIGNUM *K = NULL, *u = NULL; 248 int ret = -1, tmp_len = 0; 249 unsigned char *tmp = NULL; 250 251 if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N)) 252 goto err; 253 if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL) 254 goto err; 255 if ((K = SRP_Calc_server_key(s->srp_ctx.A, s->srp_ctx.v, u, s->srp_ctx.b, 256 s->srp_ctx.N)) == NULL) 257 goto err; 258 259 tmp_len = BN_num_bytes(K); 260 if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) 261 goto err; 262 BN_bn2bin(K, tmp); 263 ret = ssl_generate_master_secret(s, tmp, tmp_len, 1); 264 err: 265 BN_clear_free(K); 266 BN_clear_free(u); 267 return ret; 268 } 269 270 /* client side */ 271 int srp_generate_client_master_secret(SSL *s) 272 { 273 BIGNUM *x = NULL, *u = NULL, *K = NULL; 274 int ret = -1, tmp_len = 0; 275 char *passwd = NULL; 276 unsigned char *tmp = NULL; 277 278 /* 279 * Checks if b % n == 0 280 */ 281 if (SRP_Verify_B_mod_N(s->srp_ctx.B, s->srp_ctx.N) == 0) 282 goto err; 283 if ((u = SRP_Calc_u(s->srp_ctx.A, s->srp_ctx.B, s->srp_ctx.N)) == NULL) 284 goto err; 285 if (s->srp_ctx.SRP_give_srp_client_pwd_callback == NULL) 286 goto err; 287 if (! 288 (passwd = 289 s->srp_ctx.SRP_give_srp_client_pwd_callback(s, s->srp_ctx.SRP_cb_arg))) 290 goto err; 291 if ((x = SRP_Calc_x(s->srp_ctx.s, s->srp_ctx.login, passwd)) == NULL) 292 goto err; 293 if ((K = SRP_Calc_client_key(s->srp_ctx.N, s->srp_ctx.B, s->srp_ctx.g, x, 294 s->srp_ctx.a, u)) == NULL) 295 goto err; 296 297 tmp_len = BN_num_bytes(K); 298 if ((tmp = OPENSSL_malloc(tmp_len)) == NULL) 299 goto err; 300 BN_bn2bin(K, tmp); 301 ret = ssl_generate_master_secret(s, tmp, tmp_len, 1); 302 err: 303 BN_clear_free(K); 304 BN_clear_free(x); 305 if (passwd != NULL) 306 OPENSSL_clear_free(passwd, strlen(passwd)); 307 BN_clear_free(u); 308 return ret; 309 } 310 311 int srp_verify_server_param(SSL *s, int *al) 312 { 313 SRP_CTX *srp = &s->srp_ctx; 314 /* 315 * Sanity check parameters: we can quickly check B % N == 0 by checking B 316 * != 0 since B < N 317 */ 318 if (BN_ucmp(srp->g, srp->N) >= 0 || BN_ucmp(srp->B, srp->N) >= 0 319 || BN_is_zero(srp->B)) { 320 *al = SSL3_AD_ILLEGAL_PARAMETER; 321 return 0; 322 } 323 324 if (BN_num_bits(srp->N) < srp->strength) { 325 *al = TLS1_AD_INSUFFICIENT_SECURITY; 326 return 0; 327 } 328 329 if (srp->SRP_verify_param_callback) { 330 if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0) { 331 *al = TLS1_AD_INSUFFICIENT_SECURITY; 332 return 0; 333 } 334 } else if (!SRP_check_known_gN_param(srp->g, srp->N)) { 335 *al = TLS1_AD_INSUFFICIENT_SECURITY; 336 return 0; 337 } 338 339 return 1; 340 } 341 342 int SRP_Calc_A_param(SSL *s) 343 { 344 unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH]; 345 346 if (RAND_bytes(rnd, sizeof(rnd)) <= 0) 347 return 0; 348 s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a); 349 OPENSSL_cleanse(rnd, sizeof(rnd)); 350 351 if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a, s->srp_ctx.N, s->srp_ctx.g))) 352 return 0; 353 354 return 1; 355 } 356 357 BIGNUM *SSL_get_srp_g(SSL *s) 358 { 359 if (s->srp_ctx.g != NULL) 360 return s->srp_ctx.g; 361 return s->ctx->srp_ctx.g; 362 } 363 364 BIGNUM *SSL_get_srp_N(SSL *s) 365 { 366 if (s->srp_ctx.N != NULL) 367 return s->srp_ctx.N; 368 return s->ctx->srp_ctx.N; 369 } 370 371 char *SSL_get_srp_username(SSL *s) 372 { 373 if (s->srp_ctx.login != NULL) 374 return s->srp_ctx.login; 375 return s->ctx->srp_ctx.login; 376 } 377 378 char *SSL_get_srp_userinfo(SSL *s) 379 { 380 if (s->srp_ctx.info != NULL) 381 return s->srp_ctx.info; 382 return s->ctx->srp_ctx.info; 383 } 384 385 # define tls1_ctx_ctrl ssl3_ctx_ctrl 386 # define tls1_ctx_callback_ctrl ssl3_ctx_callback_ctrl 387 388 int SSL_CTX_set_srp_username(SSL_CTX *ctx, char *name) 389 { 390 return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME, 0, name); 391 } 392 393 int SSL_CTX_set_srp_password(SSL_CTX *ctx, char *password) 394 { 395 return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD, 0, password); 396 } 397 398 int SSL_CTX_set_srp_strength(SSL_CTX *ctx, int strength) 399 { 400 return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH, strength, 401 NULL); 402 } 403 404 int SSL_CTX_set_srp_verify_param_callback(SSL_CTX *ctx, 405 int (*cb) (SSL *, void *)) 406 { 407 return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_VERIFY_PARAM_CB, 408 (void (*)(void))cb); 409 } 410 411 int SSL_CTX_set_srp_cb_arg(SSL_CTX *ctx, void *arg) 412 { 413 return tls1_ctx_ctrl(ctx, SSL_CTRL_SET_SRP_ARG, 0, arg); 414 } 415 416 int SSL_CTX_set_srp_username_callback(SSL_CTX *ctx, 417 int (*cb) (SSL *, int *, void *)) 418 { 419 return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB, 420 (void (*)(void))cb); 421 } 422 423 int SSL_CTX_set_srp_client_pwd_callback(SSL_CTX *ctx, 424 char *(*cb) (SSL *, void *)) 425 { 426 return tls1_ctx_callback_ctrl(ctx, SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB, 427 (void (*)(void))cb); 428 } 429 430 #endif 431