tls_handshake_io.cpp

Go to the documentation of this file.

/*
* TLS Handshake IO
* (C) 2012,2014,2015 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
 
#include <botan/internal/tls_handshake_io.h>
 
#include <botan/exceptn.h>
#include <botan/tls_exceptn.h>
#include <botan/tls_handshake_msg.h>
#include <botan/internal/fmt.h>
#include <botan/internal/loadstor.h>
#include <botan/internal/tls_record.h>
#include <botan/internal/tls_seq_numbers.h>
#include <chrono>
 
namespace Botan::TLS {
 
namespace {
 
inline size_t load_be24(const uint8_t q[3]) {
   return make_uint32(0, q[0], q[1], q[2]);
}
 
// Reject handshake type values that are internal sentinels, not wire values
void verify_is_expected_wire_handshake_type(Handshake_Type type) {
   switch(type) {
      case Handshake_Type::HelloRetryRequest:
      case Handshake_Type::HandshakeCCS:
      case Handshake_Type::None:
         throw TLS_Exception(Alert::UnexpectedMessage, "Invalid handshake message type");
      default:
         break;
   }
}
 
void store_be24(uint8_t out[3], size_t val) {
   out[0] = get_byte<1>(static_cast<uint32_t>(val));
   out[1] = get_byte<2>(static_cast<uint32_t>(val));
   out[2] = get_byte<3>(static_cast<uint32_t>(val));
}
 
uint64_t steady_clock_ms() {
   return std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now().time_since_epoch())
      .count();
}
 
}  // namespace
 
Protocol_Version Stream_Handshake_IO::initial_record_version() const {
   return Protocol_Version::TLS_V12;
}
 
void Stream_Handshake_IO::add_record(const uint8_t record[],
                                     size_t record_len,
                                     Record_Type record_type,
                                     uint64_t /*sequence_number*/) {
   if(record_type == Record_Type::Handshake) {
      m_queue.insert(m_queue.end(), record, record + record_len);
   } else if(record_type == Record_Type::ChangeCipherSpec) {
      if(record_len != 1 || record[0] != 1) {
         throw Decoding_Error("Invalid ChangeCipherSpec");
      }
 
      // Pretend it's a regular handshake message of zero length
      const uint8_t ccs_hs[] = {static_cast<uint8_t>(Handshake_Type::HandshakeCCS), 0, 0, 0};
      m_queue.insert(m_queue.end(), ccs_hs, ccs_hs + sizeof(ccs_hs));
   } else {
      throw Decoding_Error("Unknown message type " + std::to_string(static_cast<size_t>(record_type)) +
                           " in handshake processing");
   }
}
 
std::pair<Handshake_Type, std::vector<uint8_t>> Stream_Handshake_IO::get_next_record(bool expecting_ccs,
                                                                                     size_t max_message_size) {
   if(m_queue.size() >= 4) {
      const Handshake_Type type = static_cast<Handshake_Type>(m_queue[0]);
 
      const size_t rec_length = make_uint32(0, m_queue[1], m_queue[2], m_queue[3]);
 
      // If we are expecting a CCS but the next queued message is not a CCS,
      // the peer has skipped the CCS message. This can happen when the peer
      // sends an encrypted Finished without the preceding CCS, in which case
      // the encrypted bytes are misinterpreted as a handshake message.
      if(expecting_ccs) {
         const bool is_ccs = (type == Handshake_Type::HandshakeCCS && rec_length == 0);
         if(!is_ccs) {
            throw TLS_Exception(Alert::UnexpectedMessage, "Expected ChangeCipherSpec but got a handshake message");
         }
      } else {
         verify_is_expected_wire_handshake_type(type);
 
         if(max_message_size > 0 && rec_length > max_message_size) {
            throw TLS_Exception(
               Alert::HandshakeFailure,
               Botan::fmt("Handshake message is {} bytes, policy maximum is {}", rec_length, max_message_size));
         }
      }
 
      const size_t length = 4 + rec_length;
 
      if(m_queue.size() >= length) {
         const std::vector<uint8_t> contents(m_queue.begin() + 4, m_queue.begin() + length);
 
         m_queue.erase(m_queue.begin(), m_queue.begin() + length);
 
         return std::make_pair(type, contents);
      }
   }
 
   return std::make_pair(Handshake_Type::None, std::vector<uint8_t>());
}
 
std::vector<uint8_t> Stream_Handshake_IO::format(const std::vector<uint8_t>& msg, Handshake_Type type) const {
   std::vector<uint8_t> send_buf(4 + msg.size());
 
   const size_t buf_size = msg.size();
 
   send_buf[0] = static_cast<uint8_t>(type);
 
   store_be24(&send_buf[1], buf_size);
 
   if(!msg.empty()) {
      copy_mem(&send_buf[4], msg.data(), msg.size());
   }
 
   return send_buf;
}
 
std::vector<uint8_t> Stream_Handshake_IO::send_under_epoch(const Handshake_Message& /*msg*/, uint16_t /*epoch*/) {
   throw Invalid_State("Not possible to send under arbitrary epoch with stream based TLS");
}
 
std::vector<uint8_t> Stream_Handshake_IO::send(const Handshake_Message& msg) {
   const std::vector<uint8_t> msg_bits = msg.serialize();
 
   if(msg.type() == Handshake_Type::HandshakeCCS) {
      m_send_hs(Record_Type::ChangeCipherSpec, msg_bits);
      return std::vector<uint8_t>();  // not included in handshake hashes
   }
 
   auto buf = format(msg_bits, msg.wire_type());
   m_send_hs(Record_Type::Handshake, buf);
   return buf;
}
 
Protocol_Version Datagram_Handshake_IO::initial_record_version() const {
   return Protocol_Version::DTLS_V12;
}
 
void Datagram_Handshake_IO::retransmit_last_flight() {
   const size_t flight_idx = (m_flights.size() == 1) ? 0 : (m_flights.size() - 2);
   retransmit_flight(flight_idx);
}
 
void Datagram_Handshake_IO::retransmit_flight(size_t flight_idx) {
   const std::vector<uint16_t>& flight = m_flights.at(flight_idx);
 
   BOTAN_ASSERT(!flight.empty(), "Nonempty flight to retransmit");
 
   uint16_t epoch = m_flight_data[flight[0]].epoch;
 
   for(auto msg_seq : flight) {
      auto& msg = m_flight_data[msg_seq];
 
      if(msg.epoch != epoch) {
         // Epoch gap: insert the CCS
         const std::vector<uint8_t> ccs(1, 1);
         m_send_hs(epoch, Record_Type::ChangeCipherSpec, ccs);
      }
 
      send_message(msg_seq, msg.epoch, msg.msg_type, msg.msg_bits);
      epoch = msg.epoch;
   }
}
 
bool Datagram_Handshake_IO::have_more_data() const {
   return false;
}
 
bool Datagram_Handshake_IO::timeout_check() {
   if(m_last_write == 0 || (m_flights.size() > 1 && !m_flights.rbegin()->empty())) {
      /*
      If we haven't written anything yet obviously no timeout.
      Also no timeout possible if we are mid-flight,
      */
      return false;
   }
 
   const uint64_t ms_since_write = steady_clock_ms() - m_last_write;
 
   if(ms_since_write < m_next_timeout) {
      return false;
   }
 
   retransmit_last_flight();
 
   m_next_timeout = std::min(2 * m_next_timeout, m_max_timeout);
   return true;
}
 
void Datagram_Handshake_IO::add_record(const uint8_t record[],
                                       size_t record_len,
                                       Record_Type record_type,
                                       uint64_t record_sequence) {
   const uint16_t epoch = static_cast<uint16_t>(record_sequence >> 48);
 
   if(record_type == Record_Type::ChangeCipherSpec) {
      if(record_len != 1 || record[0] != 1) {
         throw Decoding_Error("Invalid ChangeCipherSpec");
      }
 
      // TODO: check this is otherwise empty
      m_ccs_epochs.insert(epoch);
      return;
   }
 
   const size_t DTLS_HANDSHAKE_HEADER_LEN = 12;
 
   while(record_len > 0) {
      if(record_len < DTLS_HANDSHAKE_HEADER_LEN) {
         return;  // completely bogus? at least degenerate/weird
      }
 
      const Handshake_Type msg_type = static_cast<Handshake_Type>(record[0]);
 
      verify_is_expected_wire_handshake_type(msg_type);
 
      const size_t msg_len = load_be24(&record[1]);
 
      if(m_max_handshake_msg_size > 0 && msg_len > m_max_handshake_msg_size) {
         throw TLS_Exception(
            Alert::HandshakeFailure,
            Botan::fmt("Handshake message is {} bytes, policy maximum is {}", msg_len, m_max_handshake_msg_size));
      }
 
      const uint16_t message_seq = load_be<uint16_t>(&record[4], 0);
      const size_t fragment_offset = load_be24(&record[6]);
      const size_t fragment_length = load_be24(&record[9]);
 
      const size_t total_size = DTLS_HANDSHAKE_HEADER_LEN + fragment_length;
 
      if(record_len < total_size) {
         throw Decoding_Error("Bad lengths in DTLS header");
      }
 
      // Bound the out-of-order reassembly window.
      constexpr uint16_t reassembly_window = 16;
 
      // Independently cap total bytes committed to in-flight reassembly slots
      const size_t max_pending = 4 * m_max_handshake_msg_size;
 
      if(message_seq >= m_in_message_seq && (message_seq - m_in_message_seq) < reassembly_window) {
         auto [it, inserted] = m_messages.try_emplace(message_seq);
         if(inserted) {
            if(m_max_handshake_msg_size > 0 && m_pending_reassembly_bytes + msg_len > max_pending) {
               m_messages.erase(it);
               record += total_size;
               record_len -= total_size;
               continue;
            }
            m_pending_reassembly_bytes += msg_len;
         }
         it->second.add_fragment(
            &record[DTLS_HANDSHAKE_HEADER_LEN], fragment_length, fragment_offset, epoch, msg_type, msg_len);
      } else {
         // TODO: detect retransmitted flight
      }
 
      record += total_size;
      record_len -= total_size;
   }
}
 
std::pair<Handshake_Type, std::vector<uint8_t>> Datagram_Handshake_IO::get_next_record(bool expecting_ccs,
                                                                                       size_t /*max_message_size*/) {
   // Expecting a message means the last flight is concluded
   if(!m_flights.rbegin()->empty()) {
      m_flights.push_back(std::vector<uint16_t>());
   }
 
   if(expecting_ccs) {
      if(!m_messages.empty()) {
         const uint16_t current_epoch = m_messages.begin()->second.epoch();
 
         if(m_ccs_epochs.contains(current_epoch)) {
            return std::make_pair(Handshake_Type::HandshakeCCS, std::vector<uint8_t>());
         }
      }
      return std::make_pair(Handshake_Type::None, std::vector<uint8_t>());
   }
 
   auto i = m_messages.find(m_in_message_seq);
 
   if(i == m_messages.end() || !i->second.complete()) {
      return std::make_pair(Handshake_Type::None, std::vector<uint8_t>());
   }
 
   m_in_message_seq += 1;
 
   auto result = i->second.message();
 
   // Free the reassembly buffer for this delivered slot and uncommit its
   // bytes against the cap. The entry itself stays in m_messages because
   // the expecting_ccs branch above uses m_messages.begin()->second.epoch()
   // as an epoch-0 sentinel; it only needs the metadata, not the buffers.
   BOTAN_ASSERT_NOMSG(m_pending_reassembly_bytes >= i->second.msg_length());
   m_pending_reassembly_bytes -= i->second.msg_length();
   i->second.release_buffers();
 
   return result;
}
 
void Datagram_Handshake_IO::Handshake_Reassembly::release_buffers() {
   m_received_mask.clear();
   m_received_mask.shrink_to_fit();
   m_message.clear();
   m_message.shrink_to_fit();
}
 
void Datagram_Handshake_IO::Handshake_Reassembly::add_fragment(const uint8_t fragment[],
                                                               size_t fragment_length,
                                                               size_t fragment_offset,
                                                               uint16_t epoch,
                                                               Handshake_Type msg_type,
                                                               size_t msg_length) {
   if(m_msg_type == Handshake_Type::None) {
      // First fragment for this message_seq
      m_epoch = epoch;
      m_msg_type = msg_type;
      m_msg_length = msg_length;
      m_message.resize(msg_length);
      m_received_mask.assign(msg_length, 0);
   } else {
      if(msg_type != m_msg_type || msg_length != m_msg_length || epoch != m_epoch) {
         throw Decoding_Error("Inconsistent values in fragmented DTLS handshake header");
      }
 
      if(complete()) {
         return;  // already have entire message, ignore this
      }
   }
 
   if(fragment_offset > m_msg_length) {
      throw Decoding_Error("Fragment offset past end of message");
   }
 
   if(fragment_offset + fragment_length > m_msg_length) {
      throw Decoding_Error("Fragment overlaps past end of message");
   }
 
   BOTAN_ASSERT_NOMSG(m_received_mask.size() == m_msg_length);
 
   for(size_t i = 0; i != fragment_length; ++i) {
      const size_t off = fragment_offset + i;
      if(m_received_mask[off] != 0) {
         // RFC 6347 4.2.3 permits overlapping retransmissions, but the
         // overlapping bytes must agree.
         if(m_message[off] != fragment[i]) {
            throw Decoding_Error("Inconsistent overlapping DTLS handshake fragment");
         }
      } else {
         m_message[off] = fragment[i];
         m_received_mask[off] = 1;
         ++m_bytes_received;
      }
   }
}
 
bool Datagram_Handshake_IO::Handshake_Reassembly::complete() const {
   return (m_msg_type != Handshake_Type::None && m_bytes_received == m_msg_length);
}
 
std::pair<Handshake_Type, std::vector<uint8_t>> Datagram_Handshake_IO::Handshake_Reassembly::message() const {
   if(!complete()) {
      throw Internal_Error("Datagram_Handshake_IO - message not complete");
   }
 
   return std::make_pair(m_msg_type, m_message);
}
 
std::vector<uint8_t> Datagram_Handshake_IO::format_fragment(const uint8_t fragment[],
                                                            size_t frag_len,
                                                            uint32_t frag_offset,
                                                            uint32_t msg_len,
                                                            Handshake_Type type,
                                                            uint16_t msg_sequence) const {
   std::vector<uint8_t> send_buf(12 + frag_len);
 
   send_buf[0] = static_cast<uint8_t>(type);
 
   store_be24(&send_buf[1], msg_len);
 
   store_be(msg_sequence, &send_buf[4]);
 
   store_be24(&send_buf[6], frag_offset);
   store_be24(&send_buf[9], frag_len);
 
   if(frag_len > 0) {
      copy_mem(&send_buf[12], fragment, frag_len);
   }
 
   return send_buf;
}
 
std::vector<uint8_t> Datagram_Handshake_IO::format_w_seq(const std::vector<uint8_t>& msg,
                                                         Handshake_Type type,
                                                         uint16_t msg_sequence) const {
   return format_fragment(msg.data(), msg.size(), 0, static_cast<uint32_t>(msg.size()), type, msg_sequence);
}
 
std::vector<uint8_t> Datagram_Handshake_IO::format(const std::vector<uint8_t>& msg, Handshake_Type type) const {
   BOTAN_ASSERT_NOMSG(m_in_message_seq > 0);
   return format_w_seq(msg, type, m_in_message_seq - 1);
}
 
std::vector<uint8_t> Datagram_Handshake_IO::send(const Handshake_Message& msg) {
   return this->send_under_epoch(msg, m_seqs.current_write_epoch());
}
 
std::vector<uint8_t> Datagram_Handshake_IO::send_under_epoch(const Handshake_Message& msg, uint16_t epoch) {
   const std::vector<uint8_t> msg_bits = msg.serialize();
   const Handshake_Type msg_type = msg.type();
 
   if(msg_type == Handshake_Type::HandshakeCCS) {
      m_send_hs(epoch, Record_Type::ChangeCipherSpec, msg_bits);
      return std::vector<uint8_t>();  // not included in handshake hashes
   } else if(msg_type == Handshake_Type::HelloVerifyRequest) {
      // This message is not included in the handshake hashes
      send_message(m_out_message_seq, epoch, msg_type, msg_bits);
      m_out_message_seq += 1;
      return std::vector<uint8_t>();
   }
 
   // Note: not saving CCS, instead we know it was there due to change in epoch
   m_flights.rbegin()->push_back(m_out_message_seq);
   m_flight_data[m_out_message_seq] = Message_Info(epoch, msg_type, msg_bits);
 
   m_out_message_seq += 1;
   m_last_write = steady_clock_ms();
   m_next_timeout = m_initial_timeout;
 
   return send_message(m_out_message_seq - 1, epoch, msg_type, msg_bits);
}
 
std::vector<uint8_t> Datagram_Handshake_IO::send_message(uint16_t msg_seq,
                                                         uint16_t epoch,
                                                         Handshake_Type msg_type,
                                                         const std::vector<uint8_t>& msg_bits) {
   const size_t DTLS_HANDSHAKE_HEADER_LEN = 12;
 
   auto no_fragment = format_w_seq(msg_bits, msg_type, msg_seq);
 
   if(no_fragment.size() + DTLS_HEADER_SIZE <= m_mtu) {
      m_send_hs(epoch, Record_Type::Handshake, no_fragment);
   } else {
      size_t frag_offset = 0;
 
      /**
      * Largest possible overhead is for SHA-384 CBC ciphers, with 16 byte IV,
      * 16+ for padding and 48 bytes for MAC. 128 is probably a strict
      * over-estimate here. When CBC ciphers are removed this can be reduced
      * since AEAD modes have no padding, at most 16 byte mac, and smaller
      * per-record nonce.
      */
      const size_t ciphersuite_overhead = (epoch > 0) ? 128 : 0;
      const size_t header_overhead = DTLS_HEADER_SIZE + DTLS_HANDSHAKE_HEADER_LEN;
 
      if(m_mtu <= (header_overhead + ciphersuite_overhead)) {
         throw Invalid_Argument("DTLS MTU is too small to send headers");
      }
 
      const size_t max_rec_size = m_mtu - (header_overhead + ciphersuite_overhead);
 
      while(frag_offset != msg_bits.size()) {
         const size_t frag_len = std::min<size_t>(msg_bits.size() - frag_offset, max_rec_size);
 
         const std::vector<uint8_t> frag = format_fragment(&msg_bits[frag_offset],
                                                           frag_len,
                                                           static_cast<uint32_t>(frag_offset),
                                                           static_cast<uint32_t>(msg_bits.size()),
                                                           msg_type,
                                                           msg_seq);
 
         m_send_hs(epoch, Record_Type::Handshake, frag);
 
         frag_offset += frag_len;
      }
   }
 
   return no_fragment;
}
 
}  // namespace Botan::TLS