diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/buffers.c | 27 | ||||
| -rw-r--r-- | lib/constate.c | 4 | ||||
| -rw-r--r-- | lib/gnutls_int.h | 2 | ||||
| -rw-r--r-- | lib/includes/gnutls/gnutls.h.in | 47 | ||||
| -rw-r--r-- | lib/libgnutls.map | 2 | ||||
| -rw-r--r-- | lib/record.c | 61 | ||||
| -rw-r--r-- | lib/state.c | 17 |
7 files changed, 157 insertions, 3 deletions
diff --git a/lib/buffers.c b/lib/buffers.c index 2d0e3d8afc..3a058a2b18 100644 --- a/lib/buffers.c +++ b/lib/buffers.c @@ -792,9 +792,26 @@ ssize_t _gnutls_handshake_io_write_flush(gnutls_session_t session) { epoch = cur->epoch; - ret = _gnutls_send_int(session, cur->type, - cur->htype, - epoch, msg.data, msg.size, 0); + if (session->internals.read_func) { + record_parameters_st *params; + + ret = _gnutls_epoch_get(session, epoch, ¶ms); + if (ret < 0) + return gnutls_assert_val(ret); + ret = session->internals.read_func(session, + cur->htype, + params->write.level, + msg.data, + msg.size); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = msg.size; + } else { + ret = _gnutls_send_int(session, cur->type, + cur->htype, + epoch, msg.data, msg.size, 0); + } if (ret >= 0) { total += ret; @@ -1429,6 +1446,10 @@ _gnutls_handshake_io_recv_int(gnutls_session_t session, return gnutls_assert_val(ret); } + /* If handshake is handled manually, don't receive records from I/O */ + if (session->internals.read_func) + return GNUTLS_E_AGAIN; + if (htype != (gnutls_handshake_description_t) -1) { ret = handshake_remaining_time(session); if (ret < 0) diff --git a/lib/constate.c b/lib/constate.c index a11577d7ba..b8cac84101 100644 --- a/lib/constate.c +++ b/lib/constate.c @@ -528,6 +528,10 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage, buf, sizeof(buf), NULL)); } + client_write->level = server_write->level = stage == STAGE_HS ? + GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE : + GNUTLS_ENCRYPTION_LEVEL_APPLICATION; + return 0; } diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index cd2adc103d..d7ca6ed473 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -867,6 +867,7 @@ struct record_state_st { unsigned aead_tag_size; unsigned is_aead; uint64_t sequence_number; + gnutls_record_encryption_level_t level; }; @@ -1244,6 +1245,7 @@ typedef struct { int16_t h_post; /* whether post-generation/receive */ gnutls_handshake_secret_func secret_func; + gnutls_handshake_read_func read_func; /* holds the selected certificate and key. * use _gnutls_selected_certs_deinit() and _gnutls_selected_certs_set() diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in index 13b6c35659..bb8a36b139 100644 --- a/lib/includes/gnutls/gnutls.h.in +++ b/lib/includes/gnutls/gnutls.h.in @@ -2345,6 +2345,53 @@ typedef int (*gnutls_handshake_secret_func) (gnutls_session_t session, void gnutls_handshake_set_secret_function(gnutls_session_t session, gnutls_handshake_secret_func func); +/** + * gnutls_record_encryption_level_t: + * @GNUTLS_ENCRYPTION_LEVEL_INITIAL: initial level that doesn't involve any + * encryption + * @GNUTLS_ENCRYPTION_LEVEL_EARLY: early traffic secret is installed + * @GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE: handshake traffic secret is installed + * @GNUTLS_ENCRYPTION_LEVEL_APPLICATION: application traffic secret is installed + * + * Enumeration of of different levels of record encryption currently in place. + * This is used by gnutls_handshake_set_read_function() and + * gnutls_handshake_write(). + * + * Since 3.6.13 + */ +typedef enum { + GNUTLS_ENCRYPTION_LEVEL_INITIAL, + GNUTLS_ENCRYPTION_LEVEL_EARLY, + GNUTLS_ENCRYPTION_LEVEL_HANDSHAKE, + GNUTLS_ENCRYPTION_LEVEL_APPLICATION +} gnutls_record_encryption_level_t; + + /** + * gnutls_handshake_read_func: + * @session: the current session + * @htype: the type of the handshake message (#gnutls_handshake_description_t) + * @level: #gnutls_record_encryption_level_t + * @data: the (const) data that was being sent + * @data_size: the size of data + * + * Function prototype for handshake intercepting hooks. It is set using + * gnutls_handshake_set_read_function(). + * + * Returns: Non zero on error. + * Since: 3.6.13 + */ +typedef int (*gnutls_handshake_read_func) (gnutls_session_t session, + gnutls_handshake_description_t htype, + gnutls_record_encryption_level_t level, + const void *data, size_t data_size); + +void gnutls_handshake_set_read_function(gnutls_session_t session, + gnutls_handshake_read_func func); + +int gnutls_handshake_write(gnutls_session_t session, + gnutls_record_encryption_level_t level, + const void *data, size_t data_size); + /* Diffie-Hellman parameter handling. */ int gnutls_dh_params_init(gnutls_dh_params_t * dh_params); diff --git a/lib/libgnutls.map b/lib/libgnutls.map index c1aace905e..f093a8825e 100644 --- a/lib/libgnutls.map +++ b/lib/libgnutls.map @@ -1316,6 +1316,8 @@ GNUTLS_3_6_13 gnutls_hkdf_expand; gnutls_pbkdf2; gnutls_handshake_set_secret_function; + gnutls_handshake_set_read_function; + gnutls_handshake_write; } GNUTLS_3_6_12; GNUTLS_FIPS140_3_4 { diff --git a/lib/record.c b/lib/record.c index af993fe6e5..bb69d94fa7 100644 --- a/lib/record.c +++ b/lib/record.c @@ -2339,3 +2339,64 @@ void gnutls_record_set_timeout(gnutls_session_t session, unsigned int ms) { session->internals.record_timeout_ms = ms; } + +/** + * gnutls_handshake_write: + * @session: is a #gnutls_session_t type. + * @level: the current encryption level for reading a handshake message + * @data: the (const) handshake data to be processed + * @data_size: the size of data + * + * This function processes a handshake message in the encryption level + * specified with @level. Prior to calling this function, a handshake + * read callback must be set on @session. Use + * gnutls_handshake_set_read_function() to do this. + * + * Since: 3.6.13 + */ +int +gnutls_handshake_write(gnutls_session_t session, + gnutls_record_encryption_level_t level, + const void *data, size_t data_size) +{ + record_parameters_st *record_params; + record_state_st *record_state; + mbuffer_st *bufel; + uint8_t *p; + int ret; + + /* DTLS is not supported */ + if (IS_DTLS(session)) + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + + /* When using this, the outgoing handshake messages should + * also be handled manually */ + if (!session->internals.read_func) + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + + ret = _gnutls_epoch_get(session, EPOCH_READ_CURRENT, &record_params); + if (ret < 0) + return gnutls_assert_val(ret); + + record_state = &record_params->read; + if (record_state->level > level) + return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED); + + bufel = _mbuffer_alloc_align16(data_size, 0); + if (bufel == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + + memcpy(_mbuffer_get_udata_ptr(bufel), data, data_size); + _mbuffer_set_udata_size(bufel, data_size); + p = _mbuffer_get_udata_ptr(bufel); + bufel->htype = p[0]; + + if (sequence_increment(session, &record_state->sequence_number) != 0) { + _mbuffer_xfree(&bufel); + return gnutls_assert_val(GNUTLS_E_RECORD_LIMIT_REACHED); + } + + _gnutls_record_buffer_put(session, GNUTLS_HANDSHAKE, + record_state->sequence_number, bufel); + return 0; +} diff --git a/lib/state.c b/lib/state.c index f33cd5a8bc..a26c1c7a2f 100644 --- a/lib/state.c +++ b/lib/state.c @@ -1419,6 +1419,23 @@ gnutls_handshake_set_hook_function(gnutls_session_t session, } /** + * gnutls_handshake_set_read_function: + * @session: is #gnutls_session_t type + * @func: is the function to be called + * + * This function will set a callback to be called when a handshake + * message is being sent. + * + * Since: 3.6.13 + */ +void +gnutls_handshake_set_read_function(gnutls_session_t session, + gnutls_handshake_read_func func) +{ + session->internals.read_func = func; +} + +/** * gnutls_record_get_state: * @session: is a #gnutls_session_t type * @read: if non-zero the read parameters are returned, otherwise the write |