Return to tls_protection.c CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libtls

Annotation of embedaddon/strongswan/src/libtls/tls_protection.c, revision 1.1

1.1     ! misho       1: /*
        !             2:  * Copyright (C) 2010 Martin Willi
        !             3:  * Copyright (C) 2010 revosec AG
        !             4:  *
        !             5:  * This program is free software; you can redistribute it and/or modify it
        !             6:  * under the terms of the GNU General Public License as published by the
        !             7:  * Free Software Foundation; either version 2 of the License, or (at your
        !             8:  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
        !             9:  *
        !            10:  * This program is distributed in the hope that it will be useful, but
        !            11:  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
        !            12:  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
        !            13:  * for more details.
        !            14:  */
        !            15: 
        !            16: #include "tls_protection.h"
        !            17: 
        !            18: #include <utils/debug.h>
        !            19: 
        !            20: typedef struct private_tls_protection_t private_tls_protection_t;
        !            21: 
        !            22: /**
        !            23:  * Private data of an tls_protection_t object.
        !            24:  */
        !            25: struct private_tls_protection_t {
        !            26: 
        !            27:        /**
        !            28:         * Public tls_protection_t interface.
        !            29:         */
        !            30:        tls_protection_t public;
        !            31: 
        !            32:        /**
        !            33:         * negotiated TLS version
        !            34:         */
        !            35:        tls_version_t version;
        !            36: 
        !            37:        /**
        !            38:         * Upper layer, TLS record compression
        !            39:         */
        !            40:        tls_compression_t *compression;
        !            41: 
        !            42:        /**
        !            43:         * TLS alert handler
        !            44:         */
        !            45:        tls_alert_t *alert;
        !            46: 
        !            47:        /**
        !            48:         * Sequence number of incoming records
        !            49:         */
        !            50:        uint64_t seq_in;
        !            51: 
        !            52:        /**
        !            53:         * Sequence number for outgoing records
        !            54:         */
        !            55:        uint64_t seq_out;
        !            56: 
        !            57:        /**
        !            58:         * AEAD transform for inbound traffic
        !            59:         */
        !            60:        tls_aead_t *aead_in;
        !            61: 
        !            62:        /**
        !            63:         * AEAD transform for outbound traffic
        !            64:         */
        !            65:        tls_aead_t *aead_out;
        !            66: };
        !            67: 
        !            68: METHOD(tls_protection_t, process, status_t,
        !            69:        private_tls_protection_t *this, tls_content_type_t type, chunk_t data)
        !            70: {
        !            71:        if (this->alert->fatal(this->alert))
        !            72:        {       /* don't accept more input, fatal error occurred */
        !            73:                return NEED_MORE;
        !            74:        }
        !            75: 
        !            76:        if (this->aead_in)
        !            77:        {
        !            78:                if (!this->aead_in->decrypt(this->aead_in, this->version,
        !            79:                                                                        type, this->seq_in, &data))
        !            80:                {
        !            81:                        DBG1(DBG_TLS, "TLS record decryption failed");
        !            82:                        this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC);
        !            83:                        return NEED_MORE;
        !            84:                }
        !            85:        }
        !            86: 
        !            87:        if (type == TLS_CHANGE_CIPHER_SPEC)
        !            88:        {
        !            89:                this->seq_in = 0;
        !            90:        }
        !            91:        else
        !            92:        {
        !            93:                this->seq_in++;
        !            94:        }
        !            95:        return this->compression->process(this->compression, type, data);
        !            96: }
        !            97: 
        !            98: METHOD(tls_protection_t, build, status_t,
        !            99:        private_tls_protection_t *this, tls_content_type_t *type, chunk_t *data)
        !           100: {
        !           101:        status_t status;
        !           102: 
        !           103:        status = this->compression->build(this->compression, type, data);
        !           104:        if (status == NEED_MORE)
        !           105:        {
        !           106:                if (*type == TLS_CHANGE_CIPHER_SPEC)
        !           107:                {
        !           108:                        this->seq_out = 0;
        !           109:                        return status;
        !           110:                }
        !           111:                if (this->aead_out)
        !           112:                {
        !           113:                        if (!this->aead_out->encrypt(this->aead_out, this->version,
        !           114:                                                                                 *type, this->seq_out, data))
        !           115:                        {
        !           116:                                DBG1(DBG_TLS, "TLS record encryption failed");
        !           117:                                chunk_free(data);
        !           118:                                return FAILED;
        !           119:                        }
        !           120:                }
        !           121:                this->seq_out++;
        !           122:        }
        !           123:        return status;
        !           124: }
        !           125: 
        !           126: METHOD(tls_protection_t, set_cipher, void,
        !           127:        private_tls_protection_t *this, bool inbound, tls_aead_t *aead)
        !           128: {
        !           129:        if (inbound)
        !           130:        {
        !           131:                this->aead_in = aead;
        !           132:        }
        !           133:        else
        !           134:        {
        !           135:                this->aead_out = aead;
        !           136:        }
        !           137: }
        !           138: 
        !           139: METHOD(tls_protection_t, set_version, void,
        !           140:        private_tls_protection_t *this, tls_version_t version)
        !           141: {
        !           142:        this->version = version;
        !           143: }
        !           144: 
        !           145: METHOD(tls_protection_t, destroy, void,
        !           146:        private_tls_protection_t *this)
        !           147: {
        !           148:        free(this);
        !           149: }
        !           150: 
        !           151: /**
        !           152:  * See header
        !           153:  */
        !           154: tls_protection_t *tls_protection_create(tls_compression_t *compression,
        !           155:                                                                                tls_alert_t *alert)
        !           156: {
        !           157:        private_tls_protection_t *this;
        !           158: 
        !           159:        INIT(this,
        !           160:                .public = {
        !           161:                        .process = _process,
        !           162:                        .build = _build,
        !           163:                        .set_cipher = _set_cipher,
        !           164:                        .set_version = _set_version,
        !           165:                        .destroy = _destroy,
        !           166:                },
        !           167:                .alert = alert,
        !           168:                .compression = compression,
        !           169:        );
        !           170: 
        !           171:        return &this->public;
        !           172: }