ssl: DTLS record handling

Also refactor so that TLS and DTLS can have common functions when possible.

1 files changed, 0 insertions, 432 deletions

diff --git a/lib/ssl/src/ssl_tls1.erl b/lib/ssl/src/ssl_tls1.erl
deleted file mode 100644
index 8ab66d0627..0000000000
--- a/lib/ssl/src/ssl_tls1.erl
+++ /dev/null
@@ -1,432 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 2007-2013. All Rights Reserved.
-%%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%%
-%%----------------------------------------------------------------------
-%% Purpose: Handles tls1 encryption.
-%%----------------------------------------------------------------------
-
--module(ssl_tls1).
-
--include("ssl_cipher.hrl").
--include("ssl_internal.hrl").
--include("ssl_record.hrl").
-
--export([master_secret/4, finished/5, certificate_verify/3, mac_hash/7,
-	 setup_keys/8, suites/1, prf/5,
-	 ecc_curves/1, oid_to_enum/1, enum_to_oid/1]).
-
-%%====================================================================
-%% Internal application API
-%%====================================================================
-
--spec master_secret(integer(), binary(), binary(), binary()) -> binary().
-
-master_secret(PrfAlgo, PreMasterSecret, ClientRandom, ServerRandom) ->
-    %% RFC 2246 & 4346 && RFC 5246 - 8.1 %% master_secret = PRF(pre_master_secret,
-    %%                                      "master secret", ClientHello.random +
-    %%                                      ServerHello.random)[0..47];
-
-    prf(PrfAlgo, PreMasterSecret, <<"master secret">>,
-	[ClientRandom, ServerRandom], 48).
-
--spec finished(client | server, integer(), integer(), binary(), [binary()]) -> binary().
-
-finished(Role, Version, PrfAlgo, MasterSecret, Handshake)
-  when Version == 1; Version == 2; PrfAlgo == ?MD5SHA ->
-    %% RFC 2246 & 4346 - 7.4.9. Finished
-    %% struct {
-    %%          opaque verify_data[12];
-    %%      } Finished;
-    %%
-    %%      verify_data
-    %%          PRF(master_secret, finished_label, MD5(handshake_messages) +
-    %%          SHA-1(handshake_messages)) [0..11];
-    MD5 = crypto:hash(md5, Handshake),
-    SHA = crypto:hash(sha, Handshake),
-    prf(?MD5SHA, MasterSecret, finished_label(Role), [MD5, SHA], 12);
-
-finished(Role, Version, PrfAlgo, MasterSecret, Handshake)
-  when Version == 3 ->
-    %% RFC 5246 - 7.4.9. Finished
-    %% struct {
-    %%          opaque verify_data[12];
-    %%      } Finished;
-    %%
-    %%      verify_data
-    %%          PRF(master_secret, finished_label, Hash(handshake_messages)) [0..11];
-    Hash = crypto:hash(mac_algo(PrfAlgo), Handshake),
-    prf(PrfAlgo, MasterSecret, finished_label(Role), Hash, 12).
-
--spec certificate_verify(md5sha | sha, integer(), [binary()]) -> binary().
-
-certificate_verify(md5sha, _Version, Handshake) ->
-    MD5 = crypto:hash(md5, Handshake),
-    SHA = crypto:hash(sha, Handshake),
-    <<MD5/binary, SHA/binary>>;
-
-certificate_verify(HashAlgo, _Version, Handshake) ->
-    crypto:hash(HashAlgo, Handshake).
-
--spec setup_keys(integer(), integer(), binary(), binary(), binary(), integer(),
-		 integer(), integer()) -> {binary(), binary(), binary(),
-					  binary(), binary(), binary()}.  
-
-setup_keys(Version, _PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize,
-	   KeyMatLen, IVSize)
-  when Version == 1 ->
-    %% RFC 2246 - 6.3. Key calculation
-    %% key_block = PRF(SecurityParameters.master_secret,
-    %%                      "key expansion",
-    %%                      SecurityParameters.server_random +
-    %%                      SecurityParameters.client_random);
-    %% Then the key_block is partitioned as follows:
-    %%  client_write_MAC_secret[SecurityParameters.hash_size]
-    %%  server_write_MAC_secret[SecurityParameters.hash_size]
-    %%  client_write_key[SecurityParameters.key_material_length]
-    %%  server_write_key[SecurityParameters.key_material_length]
-    %%  client_write_IV[SecurityParameters.IV_size]
-    %%  server_write_IV[SecurityParameters.IV_size]
-    WantedLength = 2 * (HashSize + KeyMatLen + IVSize),
-    KeyBlock = prf(?MD5SHA, MasterSecret, "key expansion",
-		   [ServerRandom, ClientRandom], WantedLength),
-    <<ClientWriteMacSecret:HashSize/binary, 
-     ServerWriteMacSecret:HashSize/binary,
-     ClientWriteKey:KeyMatLen/binary, ServerWriteKey:KeyMatLen/binary,
-     ClientIV:IVSize/binary, ServerIV:IVSize/binary>> = KeyBlock,
-    {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
-     ServerWriteKey, ClientIV, ServerIV};
-
-%% TLS v1.1
-setup_keys(Version, _PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize,
-	   KeyMatLen, IVSize)
-  when Version == 2 ->
-    %% RFC 4346 - 6.3. Key calculation
-    %% key_block = PRF(SecurityParameters.master_secret,
-    %%                      "key expansion",
-    %%                      SecurityParameters.server_random +
-    %%                      SecurityParameters.client_random);
-    %% Then the key_block is partitioned as follows:
-    %%  client_write_MAC_secret[SecurityParameters.hash_size]
-    %%  server_write_MAC_secret[SecurityParameters.hash_size]
-    %%  client_write_key[SecurityParameters.key_material_length]
-    %%  server_write_key[SecurityParameters.key_material_length]
-    %%
-    %% RFC 4346 is incomplete, the client and server IVs have to
-    %% be generated just like for TLS 1.0
-    WantedLength = 2 * (HashSize + KeyMatLen + IVSize),
-    KeyBlock = prf(?MD5SHA, MasterSecret, "key expansion",
-		   [ServerRandom, ClientRandom], WantedLength),
-    <<ClientWriteMacSecret:HashSize/binary,
-     ServerWriteMacSecret:HashSize/binary,
-     ClientWriteKey:KeyMatLen/binary, ServerWriteKey:KeyMatLen/binary,
-     ClientIV:IVSize/binary, ServerIV:IVSize/binary>> = KeyBlock,
-    {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
-     ServerWriteKey, ClientIV, ServerIV};
-
-%% TLS v1.2
-setup_keys(Version, PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize,
-	   KeyMatLen, IVSize)
-  when Version == 3 ->
-    %% RFC 5246 - 6.3. Key calculation
-    %% key_block = PRF(SecurityParameters.master_secret,
-    %%                      "key expansion",
-    %%                      SecurityParameters.server_random +
-    %%                      SecurityParameters.client_random);
-    %% Then the key_block is partitioned as follows:
-    %%  client_write_MAC_secret[SecurityParameters.hash_size]
-    %%  server_write_MAC_secret[SecurityParameters.hash_size]
-    %%  client_write_key[SecurityParameters.key_material_length]
-    %%  server_write_key[SecurityParameters.key_material_length]
-    %%  client_write_IV[SecurityParameters.fixed_iv_length]
-    %%  server_write_IV[SecurityParameters.fixed_iv_length]
-    WantedLength = 2 * (HashSize + KeyMatLen + IVSize),
-    KeyBlock = prf(PrfAlgo, MasterSecret, "key expansion",
-		   [ServerRandom, ClientRandom], WantedLength),
-    <<ClientWriteMacSecret:HashSize/binary,
-     ServerWriteMacSecret:HashSize/binary,
-     ClientWriteKey:KeyMatLen/binary, ServerWriteKey:KeyMatLen/binary,
-     ClientIV:IVSize/binary, ServerIV:IVSize/binary>> = KeyBlock,
-    {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
-     ServerWriteKey, ClientIV, ServerIV}.
-
--spec mac_hash(integer(), binary(), integer(), integer(), tls_version(),
-	       integer(), binary()) -> binary(). 
-
-mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor}, 
-	 Length, Fragment) ->
-    %% RFC 2246 & 4346 - 6.2.3.1.
-    %% HMAC_hash(MAC_write_secret, seq_num + TLSCompressed.type +
-    %%              TLSCompressed.version + TLSCompressed.length +
-    %%              TLSCompressed.fragment));
-    Mac = hmac_hash(Method, Mac_write_secret, 
-		    [<<?UINT64(Seq_num), ?BYTE(Type), 
-		      ?BYTE(Major), ?BYTE(Minor), ?UINT16(Length)>>, 
-		     Fragment]),
-    Mac.
-
--spec suites(1|2|3) -> [cipher_suite()].
-    
-suites(Minor) when Minor == 1; Minor == 2->
-    case sufficent_ec_support() of
-	true ->
-	    all_suites(Minor);
-	false ->
-	    no_ec_suites(Minor)
-    end;
-
-suites(Minor) when Minor == 3 ->
-    case sufficent_ec_support() of
-	true ->
-	    all_suites(3) ++ all_suites(2);
-	false ->
-	    no_ec_suites(3) ++ no_ec_suites(2)
-    end.
-
-all_suites(Minor) when Minor == 1; Minor == 2->		
-    [ 
-      ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-      ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-      ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
-      ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
-      ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
-      ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
-      ?TLS_RSA_WITH_AES_256_CBC_SHA,
-
-      ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-
-      ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-      ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-      ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
-      ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
-      ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
-      ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
-      ?TLS_RSA_WITH_AES_128_CBC_SHA,
-      
-      ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
-      ?TLS_ECDHE_RSA_WITH_RC4_128_SHA,
-      ?TLS_RSA_WITH_RC4_128_SHA,
-      ?TLS_RSA_WITH_RC4_128_MD5,
-      ?TLS_DHE_RSA_WITH_DES_CBC_SHA,
-      ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
-      ?TLS_ECDH_RSA_WITH_RC4_128_SHA,
-      
-      ?TLS_RSA_WITH_DES_CBC_SHA
-    ];
-all_suites(3) ->	
-    [
-     ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
-     ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
-     
-     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
-     ?TLS_RSA_WITH_AES_256_CBC_SHA256,
-     
-     ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
-     
-     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
-     ?TLS_RSA_WITH_AES_128_CBC_SHA256
-    ].
-
-no_ec_suites(Minor) when Minor == 1; Minor == 2->		
-    [ 
-      ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
-      ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
-      ?TLS_RSA_WITH_AES_256_CBC_SHA,
-      ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-      ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
-      ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
-      ?TLS_RSA_WITH_AES_128_CBC_SHA,
-      ?TLS_RSA_WITH_RC4_128_SHA,
-      ?TLS_RSA_WITH_RC4_128_MD5,
-      ?TLS_DHE_RSA_WITH_DES_CBC_SHA,
-      ?TLS_RSA_WITH_DES_CBC_SHA
-    ];
-no_ec_suites(3) ->	
-    [
-     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
-     ?TLS_RSA_WITH_AES_256_CBC_SHA256,
-     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
-     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
-     ?TLS_RSA_WITH_AES_128_CBC_SHA256
-    ].
-
-%%--------------------------------------------------------------------
-%%% Internal functions
-%%--------------------------------------------------------------------
-%%%% HMAC and the Pseudorandom Functions RFC 2246 & 4346 - 5.%%%%
-hmac_hash(?NULL, _, _) ->
-    <<>>;
-hmac_hash(Alg, Key, Value) ->
-    crypto:hmac(mac_algo(Alg), Key, Value).
-
-mac_algo(?MD5)    -> md5;
-mac_algo(?SHA)    -> sha;
-mac_algo(?SHA256) -> sha256;
-mac_algo(?SHA384) -> sha384;
-mac_algo(?SHA512) -> sha512.
-
-% First, we define a data expansion function, P_hash(secret, data) that
-% uses a single hash function to expand a secret and seed into an
-% arbitrary quantity of output:
-%% P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
-%%                        HMAC_hash(secret, A(2) + seed) +
-%%                        HMAC_hash(secret, A(3) + seed) + ...
-
-p_hash(Secret, Seed, WantedLength, Method) ->
-    p_hash(Secret, Seed, WantedLength, Method, 0, []).
-
-p_hash(_Secret, _Seed, WantedLength, _Method, _N, [])
-  when WantedLength =< 0 ->
-    [];
-p_hash(_Secret, _Seed, WantedLength, _Method, _N, [Last | Acc])
-  when WantedLength =< 0 ->
-    Keep = byte_size(Last) + WantedLength,
-    <<B:Keep/binary, _/binary>> = Last,
-    list_to_binary(lists:reverse(Acc, [B]));
-p_hash(Secret, Seed, WantedLength, Method, N, Acc) ->
-    N1 = N+1,
-    Bin = hmac_hash(Method, Secret, [a(N1, Secret, Seed, Method), Seed]),
-    p_hash(Secret, Seed, WantedLength - byte_size(Bin), Method, N1, [Bin|Acc]).
-
-
-%% ... Where  A(0) = seed
-%%            A(i) = HMAC_hash(secret, A(i-1))
-%% a(0, _Secret, Seed, _Method) -> 
-%%     Seed.
-%% a(N, Secret, Seed, Method) ->
-%%     hmac_hash(Method, Secret, a(N-1, Secret, Seed, Method)).
-a(0, _Secret, Seed, _Method) ->
-    Seed;
-a(N, Secret, Seed0, Method) ->
-    Seed = hmac_hash(Method, Secret, Seed0),
-    a(N-1, Secret, Seed, Method).
-
-split_secret(BinSecret) ->
-    %% L_S = length in bytes of secret;
-    %% L_S1 = L_S2 = ceil(L_S / 2);
-    %% The secret is partitioned into two halves (with the possibility of
-    %% one shared byte) as described above, S1 taking the first L_S1 bytes,
-    %% and S2 the last L_S2 bytes.
-    Length = byte_size(BinSecret),
-    Div = Length div 2,
-    EvenLength = Length - Div,
-    <<Secret1:EvenLength/binary, _/binary>> = BinSecret,
-    <<_:Div/binary, Secret2:EvenLength/binary>> = BinSecret,
-    {Secret1, Secret2}.
-
-prf(?MD5SHA, Secret, Label, Seed, WantedLength) ->
-    %% PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
-    %%                            P_SHA-1(S2, label + seed);
-    {S1, S2} = split_secret(Secret),
-    LS = list_to_binary([Label, Seed]),
-    crypto:exor(p_hash(S1, LS, WantedLength, ?MD5),
-		p_hash(S2, LS, WantedLength, ?SHA));
-
-prf(MAC, Secret, Label, Seed, WantedLength) ->
-    %% PRF(secret, label, seed) = P_SHA256(secret, label + seed);
-    LS = list_to_binary([Label, Seed]),
-    p_hash(Secret, LS, WantedLength, MAC).
-
-%%%% Misc help functions %%%%
-
-finished_label(client) ->
-    <<"client finished">>;
-finished_label(server) ->
-    <<"server finished">>.
-
-%% list ECC curves in prefered order
-ecc_curves(_Minor) ->
-    [?sect571r1,?sect571k1,?secp521r1,?sect409k1,?sect409r1,
-     ?secp384r1,?sect283k1,?sect283r1,?secp256k1,?secp256r1,
-     ?sect239k1,?sect233k1,?sect233r1,?secp224k1,?secp224r1,
-     ?sect193r1,?sect193r2,?secp192k1,?secp192r1,?sect163k1,
-     ?sect163r1,?sect163r2,?secp160k1,?secp160r1,?secp160r2].
-
-%% ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005)
-oid_to_enum(?sect163k1) -> 1;
-oid_to_enum(?sect163r1) -> 2;
-oid_to_enum(?sect163r2) -> 3;
-oid_to_enum(?sect193r1) -> 4;
-oid_to_enum(?sect193r2) -> 5;
-oid_to_enum(?sect233k1) -> 6;
-oid_to_enum(?sect233r1) -> 7;
-oid_to_enum(?sect239k1) -> 8;
-oid_to_enum(?sect283k1) -> 9;
-oid_to_enum(?sect283r1) -> 10;
-oid_to_enum(?sect409k1) -> 11;
-oid_to_enum(?sect409r1) -> 12;
-oid_to_enum(?sect571k1) -> 13;
-oid_to_enum(?sect571r1) -> 14;
-oid_to_enum(?secp160k1) -> 15;
-oid_to_enum(?secp160r1) -> 16;
-oid_to_enum(?secp160r2) -> 17;
-oid_to_enum(?secp192k1) -> 18;
-oid_to_enum(?secp192r1) -> 19;
-oid_to_enum(?secp224k1) -> 20;
-oid_to_enum(?secp224r1) -> 21;
-oid_to_enum(?secp256k1) -> 22;
-oid_to_enum(?secp256r1) -> 23;
-oid_to_enum(?secp384r1) -> 24;
-oid_to_enum(?secp521r1) -> 25.
-
-enum_to_oid(1) -> ?sect163k1;
-enum_to_oid(2) -> ?sect163r1;
-enum_to_oid(3) -> ?sect163r2;
-enum_to_oid(4) -> ?sect193r1;
-enum_to_oid(5) -> ?sect193r2;
-enum_to_oid(6) -> ?sect233k1;
-enum_to_oid(7) -> ?sect233r1;
-enum_to_oid(8) -> ?sect239k1;
-enum_to_oid(9) -> ?sect283k1;
-enum_to_oid(10) -> ?sect283r1;
-enum_to_oid(11) -> ?sect409k1;
-enum_to_oid(12) -> ?sect409r1;
-enum_to_oid(13) -> ?sect571k1;
-enum_to_oid(14) -> ?sect571r1;
-enum_to_oid(15) -> ?secp160k1;
-enum_to_oid(16) -> ?secp160r1;
-enum_to_oid(17) -> ?secp160r2;
-enum_to_oid(18) -> ?secp192k1;
-enum_to_oid(19) -> ?secp192r1;
-enum_to_oid(20) -> ?secp224k1;
-enum_to_oid(21) -> ?secp224r1;
-enum_to_oid(22) -> ?secp256k1;
-enum_to_oid(23) -> ?secp256r1;
-enum_to_oid(24) -> ?secp384r1;
-enum_to_oid(25) -> ?secp521r1.
-
-sufficent_ec_support() ->
-    CryptoSupport = crypto:supports(),
-    proplists:get_bool(ecdh, proplists:get_value(public_keys, CryptoSupport)).