MastersThesis/PQ_TIIGER_TLS/lib/tls_client_send.cpp

// 
// Process output sent to Server
//

#include "tls_client_send.h"
#include "tls_logger.h"
#include "tls_certs.h"

// send Change Cipher Suite - helps get past middleboxes (WTF?)
void sendCCCS(TLS_session *session)
{
    char cccs[10];
    octad CCCS={0,sizeof(cccs),cccs};
    OCT_from_hex(&CCCS,(char *)"140303000101");
    sendOctad(session->sockptr,&CCCS);
}

// Functions to build clientHello Extensions based on our preferences/capabilities

// Build Heartbeat Extension
void addHeartbeat(octad *EXT)
{
    OCT_append_int(EXT,HEARTBEAT,2);  // This extension is HEARTBEAT
    OCT_append_int(EXT,1,2);
#ifdef PEER_CAN_HEARTBEAT
    OCT_append_int(EXT,1,1);  // peer can heartbeat
#else
    OCT_append_int(EXT,2,1);  // peer cannot heartbeat
#endif
}

// Build Certificate Authorities Extension
/*
void addCertAuthorities(octad *EXT)
{
    char dn[256];
    octad DN={0,sizeof(dn),dn};
    OCT_from_base64(&DN,(char *)mysupportedca);
    OCT_append_int(EXT,CERT_AUTHORITIES,2);     
    OCT_append_int(EXT,DN.len+2,2);   // only one CA allowed (for now)
    OCT_append_int(EXT,DN.len,2);
    OCT_append_octad(EXT,&DN);
}
*/
// Build Servername Extension
void addServerNameExt(octad *EXT,char *servername)
{
    int len=strlen(servername);
    OCT_append_int(EXT,SERVER_NAME,2);  // This extension is SERVER_NAME(0)
    OCT_append_int(EXT,5+len,2);        // In theory its a list..
    OCT_append_int(EXT,3+len,2);        // but only one entry
    OCT_append_int(EXT,0,1);            // Server is of type DNS Hostname (only one type supported, and only one of each type)
    OCT_append_int(EXT,len,2);            // serverName length
    OCT_append_string(EXT,servername);    // servername
}
    
// Build Supported Groups Extension
void addSupportedGroupsExt(octad *EXT,int nsg,int *supportedGroups)
{
    OCT_append_int(EXT,SUPPORTED_GROUPS,2); // This extension is SUPPORTED GROUPS(0x0a)
    OCT_append_int(EXT,2*nsg+2,2);          // Total length
    OCT_append_int(EXT,2*nsg,2);            // Number of entries
    for (int i=0;i<nsg;i++)                    // One entry per supported group 
        OCT_append_int(EXT,supportedGroups[i],2);
}

// Build client cert type extension for raw public key
void addClientRawPublicKey(octad *EXT)
{
    OCT_append_int(EXT,CLIENT_CERT_TYPE,2);
    OCT_append_int(EXT,3,2);
    OCT_append_int(EXT,2,1);
    OCT_append_int(EXT,RAW_PUBLIC_KEY,1);
    OCT_append_int(EXT,X509_CERT,1);
}

// Build server cert type extension for raw public key
void addServerRawPublicKey(octad *EXT)
{
    OCT_append_int(EXT,SERVER_CERT_TYPE,2);
    OCT_append_int(EXT,3,2);
    OCT_append_int(EXT,2,1);
    OCT_append_int(EXT,RAW_PUBLIC_KEY,1);
    OCT_append_int(EXT,X509_CERT,1);
}

// Build Signature algorithms Extension
void addSigAlgsExt(octad *EXT,int nsa,int *sigAlgs)
{
    OCT_append_int(EXT,SIG_ALGS,2);        // This extension is SIGNATURE_ALGORITHMS(0x0d)
    OCT_append_int(EXT,2*nsa+2,2);        // Total length
    OCT_append_int(EXT,2*nsa,2);        // Number of entries
    for (int i=0;i<nsa;i++)                // One entry per supported signature algorithm
        OCT_append_int(EXT,sigAlgs[i],2);
}

// Build Signature algorithms Cert Extension
void addSigAlgsCertExt(octad *EXT,int nsac,int *sigAlgsCert)
{
    OCT_append_int(EXT,SIG_ALGS_CERT,2);    // This extension is SIGNATURE_ALGORITHMS_CERT (0x32)
    OCT_append_int(EXT,2*nsac+2,2);            // Total length
    OCT_append_int(EXT,2*nsac,2);            // Number of entries
    for (int i=0;i<nsac;i++)                // One entry per supported signature algorithm
        OCT_append_int(EXT,sigAlgsCert[i],2);
}

// Add Pre-Shared-Key ...
// ..but omit binding
int addPreSharedKeyExt(octad *EXT,unsign32 age,octad *IDS,int sha)
{
    int tlen1,tlen2;
    tlen1=tlen2=0;
    tlen1+=IDS->len+2+4;
    tlen2+=sha+1;
    OCT_append_int(EXT,PRESHARED_KEY,2);
    OCT_append_int(EXT,tlen1+tlen2+4,2);
// PSK Identifiers
    OCT_append_int(EXT,tlen1,2);
    OCT_append_int(EXT,IDS->len,2);
    OCT_append_octad(EXT,IDS);
    OCT_append_int(EXT,age,4);
    return tlen2+2;  // length of binders
}

// Add Client Key Share extension
// Offer just one public key
void addKeyShareExt(octad *EXT,int alg,octad *PK)
{
    int tlen=PK->len+4;
    OCT_append_int(EXT,KEY_SHARE,2); // This extension is KEY_SHARE(0x0033)
    OCT_append_int(EXT,tlen+2,2);
    OCT_append_int(EXT,tlen,2);
    OCT_append_int(EXT,alg,2);
    OCT_append_int(EXT,PK->len,2);
    OCT_append_octad(EXT,PK);
}

// Add ALPN extension
// Offer just one option
void addALPNExt(octad *EXT,octad *AP)
{
    int tlen=AP->len+1;
    OCT_append_int(EXT,APP_PROTOCOL,2);
    OCT_append_int(EXT,tlen+2,2);
    OCT_append_int(EXT,tlen,2);
    OCT_append_int(EXT,AP->len,1);
    OCT_append_octad(EXT,AP);
}

// indicate supported PSK mode
void addPSKModesExt(octad *EXT,int mode)
{
    OCT_append_int(EXT,PSK_MODE,2);
    OCT_append_int(EXT,2,2);
    OCT_append_int(EXT,1,1);
    OCT_append_int(EXT,mode,1);
}

// indicate preferred maximum fragment length
void addMFLExt(octad *EXT,int mode)
{
    if (mode>0)
    {
        OCT_append_int(EXT,MAX_FRAG_LENGTH,2);
        OCT_append_int(EXT,1,2);
        OCT_append_int(EXT,mode,1);
    }
}

// indicate preferred maximum record size
void addRSLExt(octad *EXT,int size)
{
    OCT_append_int(EXT,RECORD_SIZE_LIMIT,2);
    OCT_append_int(EXT,2,2);
    OCT_append_int(EXT,size,2);
}

// add n padding bytes
void addPadding(octad *EXT,int n)
{
    OCT_append_int(EXT,PADDING,2);
    OCT_append_int(EXT,n,2);
    OCT_append_byte(EXT,0,n);
}

// indicate TLS version support
void addVersionExt(octad *EXT,int version)
{
    OCT_append_int(EXT,TLS_VER,2);
    OCT_append_int(EXT,3,2);
    OCT_append_int(EXT,2,1);
    OCT_append_int(EXT,version,2);
}

// Add a cookie - useful for handshake resumption
void addCookieExt(octad *EXT,octad *CK)
{
    OCT_append_int(EXT,COOKIE,2);
    OCT_append_int(EXT,CK->len,2);
    OCT_append_octad(EXT,CK);
}

// indicate desire to send early data
void addEarlyDataExt(octad *EXT)
{
    OCT_append_int(EXT,EARLY_DATA,2);
    OCT_append_int(EXT,0,2);
}

// indicate willingness to do post handshake authentication
void addPostHSAuth(octad *EXT)
{
    OCT_append_int(EXT,POST_HANDSHAKE_AUTH,2);
    OCT_append_int(EXT,0,2);
}

// build cipher-suites octad from ciphers we support
int cipherSuites(octad *CS,int ncs,int *ciphers)
{
    OCT_kill(CS);
    OCT_append_int(CS,2*ncs,2);
    for (int i=0;i<ncs;i++)
        OCT_append_int(CS,ciphers[i],2);
    return CS->len;
}

void sendZeroRecord(TLS_session *session) {
    char rh[5];
    char tag[TLS_MAX_TAG_SIZE];
    octad TAG={0,sizeof(tag),tag};
    int taglen=session->K_send.taglen;
    int ctlen=TLS_MAX_OUTPUT_RECORD_SIZE+1;
    int reclen=ctlen+taglen;
    rh[0]=APPLICATION;
    rh[1]=(TLS1_2/256);
    rh[2]=(TLS1_2%256);
    rh[3]=(reclen/256);
    rh[4]=(reclen%256);

    session->OBUFF.val[5]=APPLICATION;
    session->OBUFF.len=ctlen+5;

    SAL_aeadEncrypt(&session->K_send,5,rh,ctlen,&session->OBUFF.val[5],&TAG);
    incrementCryptoContext(&session->K_send);  // increment IV
    OCT_append_octad(&session->OBUFF,&TAG);

    for (int j=0;j<5;j++)
        session->OBUFF.val[j]=rh[j];

    sendOctad(session->sockptr,&session->OBUFF); // transmit it
    OCT_kill(&session->OBUFF); // empty it
    session->OBUFF.len=5;
}

// send one or more records, maybe encrypted.
void sendRecord(TLS_session *session,int rectype,int version,octad *DATA,bool flush) {
    char rh[5];
    int alen;
    if (session->OBUFF.len==0)
    { // first time - reserve 5 spaces for header
        session->OBUFF.len=5;
        alen=0;
    } else {
        alen=session->OBUFF.len-5; // payload length
    }

    for (int i=0;i<DATA->len;i++) {
        OCT_append_byte(&session->OBUFF,DATA->val[i],1); alen++;
        bool flushing=false;
        if (i==DATA->len-1 && flush) flushing=true;;
        if (alen==TLS_MAX_OUTPUT_RECORD_SIZE || flushing)
        {
            int reclen,ctlen;
            if (!session->K_send.active) { // no encryption
                reclen=alen;
                rh[0]=rectype;
                rh[1]=(version/256);
                rh[2]=(version%256);
                rh[3]=(reclen/256);
                rh[4]=(reclen%256);
            } else {
                char tag[TLS_MAX_TAG_SIZE];
                octad TAG={0,sizeof(tag),tag};
                int taglen=session->K_send.taglen;
                OCT_append_byte(&session->OBUFF,rectype,1); 
#ifdef PAD_SHORT_RECORDS
                ctlen=TLS_MAX_OUTPUT_RECORD_SIZE+1; // pad to full length - should be padded with 0s
                session->OBUFF.len=ctlen+5;
#else
                ctlen=alen+1; 
#endif
                reclen=ctlen+taglen;
                rh[0]=APPLICATION;
                rh[1]=(TLS1_2/256);
                rh[2]=(TLS1_2%256);
                rh[3]=(reclen/256);
                rh[4]=(reclen%256);

                SAL_aeadEncrypt(&session->K_send,5,rh,ctlen,&session->OBUFF.val[5],&TAG);
                incrementCryptoContext(&session->K_send);  // increment IV
                OCT_append_octad(&session->OBUFF,&TAG);
            }
            for (int j=0;j<5;j++)
                session->OBUFF.val[j]=rh[j];

            sendOctad(session->sockptr,&session->OBUFF); // transmit it
            OCT_kill(&session->OBUFF); // empty it
            alen=0;
            session->OBUFF.len=5;
        }
        if (flushing) session->OBUFF.len=0;
    }
} 


// ALL Client to Server output goes via this function 
// Send a client message CM|EXT (as a single record). 
// Only transmit (flush) on a key change, or end of pass
void sendClientMessage(TLS_session *session,int rectype,int version,octad *CM,octad *EXT,bool flush)
{
    if (session->status==TLS13_DISCONNECTED) {
        return;
    }

    bool choice=flush;
#ifndef MERGE_MESSAGES
    choice=true;
#endif
    if (EXT!=NULL)
    {
        sendRecord(session,rectype,version,CM,false);
        sendRecord(session,rectype,version,EXT,choice);
    } else {
        sendRecord(session,rectype,version,CM,choice);
    } 
}

// Send a heartbeat request record. Note my payloads are always of length 0.
// should it be encrypted? Yes
void sendHeartbeatRequest(TLS_session *session)
{
    char hb[20];
    octad HB={0,sizeof(hb),hb};
    if (session->status==TLS13_DISCONNECTED || !session->allowed_to_heartbeat || session->heartbeat_req_in_flight) {
        return;
    }
//printf("Sending HEART_BEAT REQ\n");
    OCT_append_int(&HB,1,1); // heartbeat request
    OCT_append_int(&HB,0,2); // zero payload
    for (int i=0;i<16;i++)
        OCT_append_int(&HB,SAL_randomByte(),1);
    session->heartbeat_req_in_flight=true;
    sendRecord(session,HEART_BEAT,TLS1_2,&HB,true);
}


// build and transmit unencrypted client hello. Append pre-prepared extensions
void sendClientHello(TLS_session *session,int version,octad *CH,octad *CRN,bool already_agreed,octad *EXTENSIONS,int extra,bool resume,bool flush)
{
    char cs[2+TLS_MAX_CIPHER_SUITES*2];
    octad CS = {0, sizeof(cs), cs};
    int nsc;
    int ciphers[TLS_MAX_CIPHER_SUITES];
    int compressionMethods=0x0100;
    int total=8;
    int extlen=EXTENSIONS->len+extra;

    nsc=SAL_ciphers(ciphers);  
    if (already_agreed)
    { // cipher suite already agreed
        nsc=1;
        ciphers[0]=session->cipher_suite;
    }

    total+=32; // Random bytes clientRandom(&RN);
    total+=33;
    if (!resume) { // if its a handshake resumption, re-use the old id?? Since its the same session?
        for (int i=0;i<32;i++)
            session->id[i]=SAL_randomByte();
    }
 
    total+=cipherSuites(&CS,nsc,ciphers);

    OCT_kill(CH);
    OCT_append_byte(CH,CLIENT_HELLO,1);        // clientHello handshake message  // 1
    OCT_append_int(CH,total+extlen-2,3);    // 3

    OCT_append_int(CH,TLS1_2,2);            // 2
    OCT_append_octad(CH,CRN);                // 32
    OCT_append_byte(CH,32,1);                // 1   
    OCT_append_bytes(CH,session->id,32);    // 32
    OCT_append_octad(CH,&CS);                // 2+TLS_MAX_CIPHER_SUITES*2
    OCT_append_int(CH,compressionMethods,2);  // 2
    OCT_append_int(CH,extlen,2);              // 2

// transmit it
    sendClientMessage(session,HSHAKE,version,CH,EXTENSIONS,flush);
}

// Send "binder",
void sendBinder(TLS_session *session,octad *BND)
{
    char b[TLS_MAX_HASH+3];
    octad B={0,sizeof(b),b};
    int tlen2=BND->len+1;
    //OCT_kill(B);
    OCT_append_int(&B,tlen2,2);
    OCT_append_int(&B,BND->len,1);
    OCT_append_octad(&B,BND);
    runningHash(session,&B);
    sendClientMessage(session,HSHAKE,TLS1_2,&B,NULL,true);
}

// send client alert - might be encrypted if send!=NULL
void sendAlert(TLS_session *session,int type)
{
    char pt[2];
    octad PT={0,sizeof(pt),pt};
    OCT_append_byte(&PT,0x02,1);  // alerts are always fatal
    OCT_append_byte(&PT,type,1);  // alert type
    OCT_kill(&session->IBUFF); session->ptr=0;
    sendClientMessage(session,ALERT,TLS1_2,&PT,NULL,true);
    if (session->status!=TLS13_DISCONNECTED)
    {
        log(IO_PROTOCOL,(char *)"Alert sent to Server - ",NULL,0,NULL);
        logAlert(type);
    }
    session->status=TLS13_DISCONNECTED; // write side of connection is now off
}

void sendKeyUpdate(TLS_session *session,int type)
{
    char up[5];
    octad UP={0,sizeof(up),up};
    OCT_append_byte(&UP,KEY_UPDATE,1);
    OCT_append_int(&UP,1,3);
    OCT_append_int(&UP,type,1);
    OCT_kill(&session->IBUFF); session->ptr=0;
    sendClientMessage(session,HSHAKE,TLS1_2,&UP,NULL,true); // sent using old keys
    deriveUpdatedKeys(&session->K_send,&session->CTS);        // now update keys
    log(IO_PROTOCOL,(char *)"KEY UPDATE REQUESTED\n",NULL,0,NULL);
}

// Send final client handshake verification data
void sendClientFinish(TLS_session *session,octad *CHF)
{
    char pt[4];
    octad PT={0,sizeof(pt),pt};

    OCT_append_byte(&PT,FINISHED,1);    // indicates handshake message "client finished" 
    OCT_append_int(&PT,CHF->len,3);        // .. and its length 

    runningHash(session,&PT);
    runningHash(session,CHF);
    sendClientMessage(session,HSHAKE,TLS1_2,&PT,CHF,true); // now we can flush
}

/* Send Client Cert Verify */
void sendClientCertVerify(TLS_session *session, int sigAlg, octad *CCVSIG)
{
    char pt[10];
    octad PT={0,sizeof(pt),pt};
    OCT_append_byte(&PT,CERT_VERIFY,1);
    OCT_append_int(&PT,4+CCVSIG->len,3);
    OCT_append_int(&PT,sigAlg,2);
    OCT_append_int(&PT,CCVSIG->len,2);
    runningHash(session,&PT);
    runningHash(session,CCVSIG);
    sendClientMessage(session,HSHAKE,TLS1_2,&PT,CCVSIG,false);
}

// Send Client Certificate 
void sendClientCertificateChain(TLS_session *session,octad *CERTCHAIN)
{
    char pt[50];
    octad PT={0,sizeof(pt),pt};

    OCT_append_byte(&PT,CERTIFICATE,1);
    if (CERTCHAIN==NULL) {  // no acceptable certificate available
        OCT_append_int(&PT,4,3);
        int nb=session->CTX.len;
        OCT_append_byte(&PT,nb,1); // cert context
        if (nb>0)
            OCT_append_octad(&PT,&session->CTX);
        OCT_append_int(&PT,0,3);  // zero length
        runningHash(session,&PT);
        sendClientMessage(session,HSHAKE,TLS1_2,&PT,NULL,true);
    } else {
        OCT_append_int(&PT,4+CERTCHAIN->len,3);
        int nb=session->CTX.len;
        OCT_append_byte(&PT,nb,1); // cert context
        if (nb>0)
            OCT_append_octad(&PT,&session->CTX);
        OCT_append_int(&PT,CERTCHAIN->len,3);  // length of certificate chain
        runningHash(session,&PT);
        runningHash(session,CERTCHAIN);
        sendClientMessage(session,HSHAKE,TLS1_2,&PT,CERTCHAIN,false);
       
    }
} 

// if early data was accepted, send this to indicate early data is finished
void sendEndOfEarlyData(TLS_session *session)
{
    char ed[4];
    octad ED={0,sizeof(ed),ed};
    OCT_append_byte(&ED,END_OF_EARLY_DATA,1);
    OCT_append_int(&ED,0,3);
    runningHash(session,&ED);
    sendClientMessage(session,HSHAKE,TLS1_2,&ED,NULL,true); // change of encryption keys coming, so flush
}

//
// map causes to alerts
//
int alert_from_cause(int rtn)
{
    switch (rtn)
    {
    case NOT_TLS1_3:
        return ILLEGAL_PARAMETER;
    case ID_MISMATCH:
        return ILLEGAL_PARAMETER;
    case UNRECOGNIZED_EXT:
        return ILLEGAL_PARAMETER;
    case BAD_HELLO:
        return ILLEGAL_PARAMETER;        
    case WRONG_MESSAGE:                 // Cause
        return UNEXPECTED_MESSAGE;      // Alert
    case BAD_CERT_CHAIN:                // Cause
        return BAD_CERTIFICATE;         // Alert
    case MISSING_REQUEST_CONTEXT:
        return ILLEGAL_PARAMETER;
    case AUTHENTICATION_FAILURE:
        return BAD_RECORD_MAC;
    case BAD_RECORD:
        return DECODE_ERROR;
    case BAD_TICKET:
        return ILLEGAL_PARAMETER;
    case NOT_EXPECTED:
        return UNSUPPORTED_EXTENSION;
    case CA_NOT_FOUND:
        return UNKNOWN_CA;
    case CERT_OUTOFDATE:
        return CERTIFICATE_EXPIRED;
    case MEM_OVERFLOW:
        return DECODE_ERROR;
    case FORBIDDEN_EXTENSION:
        return ILLEGAL_PARAMETER;
    case MAX_EXCEEDED:
        return RECORD_OVERFLOW;
    case CERT_VERIFY_FAIL:
        return DECRYPT_ERROR;
    case BAD_HANDSHAKE:
        return HANDSHAKE_FAILURE;
    case BAD_REQUEST_UPDATE:
        return ILLEGAL_PARAMETER;
    case MISSING_EXTENSIONS:
        return MISSING_EXTENSION;
    case BAD_MESSAGE:
    case EMPTY_CERT_CHAIN:
        return DECODE_ERROR;
    default:
        return ILLEGAL_PARAMETER;    
    }
}