mirror of https://github.com/lukechilds/node.git
Browse Source
Share ClientHelloParser code between `tls_wrap.cc` and `node_crypto.cc`. fix #5959v0.11.5-release
Fedor Indutny
12 years ago
8 changed files with 536 additions and 414 deletions
@ -0,0 +1,74 @@ |
|||||
|
// Copyright Joyent, Inc. and other Node contributors.
|
||||
|
//
|
||||
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
||||
|
// copy of this software and associated documentation files (the
|
||||
|
// "Software"), to deal in the Software without restriction, including
|
||||
|
// without limitation the rights to use, copy, modify, merge, publish,
|
||||
|
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
||||
|
// persons to whom the Software is furnished to do so, subject to the
|
||||
|
// following conditions:
|
||||
|
//
|
||||
|
// The above copyright notice and this permission notice shall be included
|
||||
|
// in all copies or substantial portions of the Software.
|
||||
|
//
|
||||
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||||
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
|
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
||||
|
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
||||
|
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
||||
|
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
||||
|
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
|
||||
|
#ifndef SRC_NODE_CRYPTO_CLIENTHELLO_INL_H_ |
||||
|
#define SRC_NODE_CRYPTO_CLIENTHELLO_INL_H_ |
||||
|
|
||||
|
#include <assert.h> |
||||
|
|
||||
|
namespace node { |
||||
|
|
||||
|
inline void ClientHelloParser::Reset() { |
||||
|
frame_len_ = 0; |
||||
|
body_offset_ = 0; |
||||
|
extension_offset_ = 0; |
||||
|
session_size_ = 0; |
||||
|
session_id_ = NULL; |
||||
|
tls_ticket_size_ = -1; |
||||
|
tls_ticket_ = NULL; |
||||
|
} |
||||
|
|
||||
|
inline void ClientHelloParser::Start(ClientHelloParser::OnHelloCb onhello_cb, |
||||
|
ClientHelloParser::OnEndCb onend_cb, |
||||
|
void* onend_arg) { |
||||
|
if (!IsEnded()) |
||||
|
return; |
||||
|
Reset(); |
||||
|
|
||||
|
assert(onhello_cb != NULL); |
||||
|
|
||||
|
state_ = kWaiting; |
||||
|
onhello_cb_ = onhello_cb; |
||||
|
onend_cb_ = onend_cb; |
||||
|
cb_arg_ = onend_arg; |
||||
|
} |
||||
|
|
||||
|
inline void ClientHelloParser::End() { |
||||
|
if (state_ == kEnded) |
||||
|
return; |
||||
|
state_ = kEnded; |
||||
|
if (onend_cb_ != NULL) { |
||||
|
onend_cb_(cb_arg_); |
||||
|
onend_cb_ = NULL; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
inline bool ClientHelloParser::IsEnded() const { |
||||
|
return state_ == kEnded; |
||||
|
} |
||||
|
|
||||
|
inline bool ClientHelloParser::IsPaused() const { |
||||
|
return state_ == kPaused; |
||||
|
} |
||||
|
|
||||
|
} // namespace node
|
||||
|
|
||||
|
#endif // SRC_NODE_CRYPTO_CLIENTHELLO_INL_H_
|
||||
@ -0,0 +1,240 @@ |
|||||
|
// Copyright Joyent, Inc. and other Node contributors.
|
||||
|
//
|
||||
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
||||
|
// copy of this software and associated documentation files (the
|
||||
|
// "Software"), to deal in the Software without restriction, including
|
||||
|
// without limitation the rights to use, copy, modify, merge, publish,
|
||||
|
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
||||
|
// persons to whom the Software is furnished to do so, subject to the
|
||||
|
// following conditions:
|
||||
|
//
|
||||
|
// The above copyright notice and this permission notice shall be included
|
||||
|
// in all copies or substantial portions of the Software.
|
||||
|
//
|
||||
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||||
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
|
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
||||
|
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
||||
|
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
||||
|
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
||||
|
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
|
||||
|
#include "node_crypto_clienthello.h" |
||||
|
#include "node_crypto_clienthello-inl.h" |
||||
|
#include "node_buffer.h" // Buffer |
||||
|
|
||||
|
namespace node { |
||||
|
|
||||
|
void ClientHelloParser::Parse(const uint8_t* data, size_t avail) { |
||||
|
switch (state_) { |
||||
|
case kWaiting: |
||||
|
if (!ParseRecordHeader(data, avail)) |
||||
|
break; |
||||
|
// Fall through
|
||||
|
case kTLSHeader: |
||||
|
case kSSL2Header: |
||||
|
ParseHeader(data, avail); |
||||
|
break; |
||||
|
case kPaused: |
||||
|
// Just nop
|
||||
|
case kEnded: |
||||
|
// Already ended, just ignore it
|
||||
|
break; |
||||
|
default: |
||||
|
break; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
|
||||
|
bool ClientHelloParser::ParseRecordHeader(const uint8_t* data, size_t avail) { |
||||
|
// >= 5 bytes for header parsing
|
||||
|
if (avail < 5) |
||||
|
return false; |
||||
|
|
||||
|
if (data[0] == kChangeCipherSpec || |
||||
|
data[0] == kAlert || |
||||
|
data[0] == kHandshake || |
||||
|
data[0] == kApplicationData) { |
||||
|
frame_len_ = (data[3] << 8) + data[4]; |
||||
|
state_ = kTLSHeader; |
||||
|
body_offset_ = 5; |
||||
|
} else { |
||||
|
#ifdef OPENSSL_NO_SSL2 |
||||
|
frame_len_ = ((data[0] << 8) & kSSL2HeaderMask) + data[1]; |
||||
|
state_ = kSSL2Header; |
||||
|
if (data[0] & kSSL2TwoByteHeaderBit) { |
||||
|
// header without padding
|
||||
|
body_offset_ = 2; |
||||
|
} else { |
||||
|
// header with padding
|
||||
|
body_offset_ = 3; |
||||
|
} |
||||
|
#else |
||||
|
End(); |
||||
|
return false; |
||||
|
#endif // OPENSSL_NO_SSL2
|
||||
|
} |
||||
|
|
||||
|
// Sanity check (too big frame, or too small)
|
||||
|
// Let OpenSSL handle it
|
||||
|
if (frame_len_ >= kMaxTLSFrameLen) { |
||||
|
End(); |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
|
||||
|
void ClientHelloParser::ParseHeader(const uint8_t* data, size_t avail) { |
||||
|
// >= 5 + frame size bytes for frame parsing
|
||||
|
if (body_offset_ + frame_len_ > avail) |
||||
|
return; |
||||
|
|
||||
|
// Skip unsupported frames and gather some data from frame
|
||||
|
|
||||
|
// TODO(indutny): Check hello protocol version
|
||||
|
if (data[body_offset_] == kClientHello) { |
||||
|
if (state_ == kTLSHeader) { |
||||
|
if (!ParseTLSClientHello(data, avail)) |
||||
|
return End(); |
||||
|
} else if (state_ == kSSL2Header) { |
||||
|
#ifdef OPENSSL_NO_SSL2 |
||||
|
if (!ParseSSL2ClientHello(data, avail)) |
||||
|
return End(); |
||||
|
#else |
||||
|
abort(); // Unreachable
|
||||
|
#endif // OPENSSL_NO_SSL2
|
||||
|
} else { |
||||
|
// We couldn't get here, but whatever
|
||||
|
return End(); |
||||
|
} |
||||
|
|
||||
|
// Check if we overflowed (do not reply with any private data)
|
||||
|
if (session_id_ == NULL || |
||||
|
session_size_ > 32 || |
||||
|
session_id_ + session_size_ > data + avail) { |
||||
|
return End(); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
state_ = kPaused; |
||||
|
ClientHello hello; |
||||
|
hello.session_id_ = session_id_; |
||||
|
hello.session_size_ = session_size_; |
||||
|
hello.has_ticket_ = tls_ticket_ != NULL && tls_ticket_size_ != 0; |
||||
|
onhello_cb_(cb_arg_, hello); |
||||
|
} |
||||
|
|
||||
|
|
||||
|
void ClientHelloParser::ParseExtension(ClientHelloParser::ExtensionType type, |
||||
|
const uint8_t* data, |
||||
|
size_t len) { |
||||
|
// NOTE: In case of anything we're just returning back, ignoring the problem.
|
||||
|
// That's because we're heavily relying on OpenSSL to solve any problem with
|
||||
|
// incoming data.
|
||||
|
switch (type) { |
||||
|
case kTLSSessionTicket: |
||||
|
tls_ticket_size_ = len; |
||||
|
tls_ticket_ = data + len; |
||||
|
break; |
||||
|
default: |
||||
|
// Ignore
|
||||
|
break; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
|
||||
|
bool ClientHelloParser::ParseTLSClientHello(const uint8_t* data, size_t avail) { |
||||
|
const uint8_t* body; |
||||
|
|
||||
|
// Skip frame header, hello header, protocol version and random data
|
||||
|
size_t session_offset = body_offset_ + 4 + 2 + 32; |
||||
|
|
||||
|
if (session_offset + 1 >= avail) |
||||
|
return false; |
||||
|
|
||||
|
body = data + session_offset; |
||||
|
session_size_ = *body; |
||||
|
session_id_ = body + 1; |
||||
|
|
||||
|
size_t cipher_offset = session_offset + 1 + session_size_; |
||||
|
|
||||
|
// Session OOB failure
|
||||
|
if (cipher_offset + 1 >= avail) |
||||
|
return false; |
||||
|
|
||||
|
uint16_t cipher_len = |
||||
|
(data[cipher_offset] << 8) + data[cipher_offset + 1]; |
||||
|
size_t comp_offset = cipher_offset + 2 + cipher_len; |
||||
|
|
||||
|
// Cipher OOB failure
|
||||
|
if (comp_offset >= avail) |
||||
|
return false; |
||||
|
|
||||
|
uint8_t comp_len = data[comp_offset]; |
||||
|
size_t extension_offset = comp_offset + 1 + comp_len; |
||||
|
|
||||
|
// Compression OOB failure
|
||||
|
if (extension_offset > avail) |
||||
|
return false; |
||||
|
|
||||
|
// No extensions present
|
||||
|
if (extension_offset == avail) |
||||
|
return true; |
||||
|
|
||||
|
size_t ext_off = extension_offset + 2; |
||||
|
|
||||
|
// Parse known extensions
|
||||
|
while (ext_off < avail) { |
||||
|
// Extension OOB
|
||||
|
if (ext_off + 4 > avail) |
||||
|
return false; |
||||
|
|
||||
|
uint16_t ext_type = (data[ext_off] << 8) + data[ext_off + 1]; |
||||
|
uint16_t ext_len = (data[ext_off + 2] << 8) + data[ext_off + 3]; |
||||
|
ext_off += 4; |
||||
|
|
||||
|
// Extension OOB
|
||||
|
if (ext_off + ext_len > avail) |
||||
|
return false; |
||||
|
|
||||
|
ParseExtension(static_cast<ExtensionType>(ext_type), |
||||
|
data + ext_off, |
||||
|
ext_len); |
||||
|
|
||||
|
ext_off += ext_len; |
||||
|
} |
||||
|
|
||||
|
// Extensions OOB failure
|
||||
|
if (ext_off > avail) |
||||
|
return false; |
||||
|
|
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
|
||||
|
#ifdef OPENSSL_NO_SSL2 |
||||
|
bool ClientHelloParser::ParseSSL2ClientHello(const uint8_t* data, |
||||
|
size_t avail) { |
||||
|
const uint8_t* body; |
||||
|
|
||||
|
// Skip header, version
|
||||
|
size_t session_offset = body_offset_ + 3; |
||||
|
|
||||
|
if (session_offset + 4 < avail) { |
||||
|
body = data + session_offset; |
||||
|
|
||||
|
uint16_t ciphers_size = (body[0] << 8) + body[1]; |
||||
|
|
||||
|
if (body + 4 + ciphers_size < data + avail) { |
||||
|
session_size_ = (body[2] << 8) + body[3]; |
||||
|
session_id_ = body + 4 + ciphers_size; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return true; |
||||
|
} |
||||
|
#endif // OPENSSL_NO_SSL2
|
||||
|
|
||||
|
} // namespace node
|
||||
@ -0,0 +1,124 @@ |
|||||
|
// Copyright Joyent, Inc. and other Node contributors.
|
||||
|
//
|
||||
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
||||
|
// copy of this software and associated documentation files (the
|
||||
|
// "Software"), to deal in the Software without restriction, including
|
||||
|
// without limitation the rights to use, copy, modify, merge, publish,
|
||||
|
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
||||
|
// persons to whom the Software is furnished to do so, subject to the
|
||||
|
// following conditions:
|
||||
|
//
|
||||
|
// The above copyright notice and this permission notice shall be included
|
||||
|
// in all copies or substantial portions of the Software.
|
||||
|
//
|
||||
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||||
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
|
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
||||
|
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
||||
|
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
||||
|
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
||||
|
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
|
||||
|
#ifndef SRC_NODE_CRYPTO_CLIENTHELLO_H_ |
||||
|
#define SRC_NODE_CRYPTO_CLIENTHELLO_H_ |
||||
|
|
||||
|
#include "node.h" |
||||
|
|
||||
|
#include <stddef.h> // size_t |
||||
|
#include <stdlib.h> // NULL |
||||
|
|
||||
|
namespace node { |
||||
|
|
||||
|
class ClientHelloParser { |
||||
|
public: |
||||
|
ClientHelloParser() : state_(kEnded), |
||||
|
onhello_cb_(NULL), |
||||
|
onend_cb_(NULL), |
||||
|
cb_arg_(NULL) { |
||||
|
Reset(); |
||||
|
} |
||||
|
|
||||
|
class ClientHello { |
||||
|
public: |
||||
|
ClientHello() { |
||||
|
} |
||||
|
|
||||
|
inline uint8_t session_size() const { return session_size_; } |
||||
|
inline const uint8_t* session_id() const { return session_id_; } |
||||
|
inline bool has_ticket() const { return has_ticket_; } |
||||
|
|
||||
|
private: |
||||
|
uint8_t session_size_; |
||||
|
const uint8_t* session_id_; |
||||
|
bool has_ticket_; |
||||
|
|
||||
|
friend class ClientHelloParser; |
||||
|
}; |
||||
|
|
||||
|
typedef void (*OnHelloCb)(void* arg, const ClientHello& hello); |
||||
|
typedef void (*OnEndCb)(void* arg); |
||||
|
|
||||
|
void Parse(const uint8_t* data, size_t avail); |
||||
|
|
||||
|
inline void Reset(); |
||||
|
inline void Start(OnHelloCb onhello_cb, OnEndCb onend_cb, void* onend_arg); |
||||
|
inline void End(); |
||||
|
inline bool IsPaused() const; |
||||
|
inline bool IsEnded() const; |
||||
|
|
||||
|
private: |
||||
|
static const uint8_t kSSL2TwoByteHeaderBit = 0x80; |
||||
|
static const uint8_t kSSL2HeaderMask = 0x3f; |
||||
|
static const size_t kMaxTLSFrameLen = 16 * 1024 + 5; |
||||
|
static const size_t kMaxSSLExFrameLen = 32 * 1024; |
||||
|
|
||||
|
enum ParseState { |
||||
|
kWaiting, |
||||
|
kTLSHeader, |
||||
|
kSSL2Header, |
||||
|
kPaused, |
||||
|
kEnded |
||||
|
}; |
||||
|
|
||||
|
enum FrameType { |
||||
|
kChangeCipherSpec = 20, |
||||
|
kAlert = 21, |
||||
|
kHandshake = 22, |
||||
|
kApplicationData = 23, |
||||
|
kOther = 255 |
||||
|
}; |
||||
|
|
||||
|
enum HandshakeType { |
||||
|
kClientHello = 1 |
||||
|
}; |
||||
|
|
||||
|
enum ExtensionType { |
||||
|
kTLSSessionTicket = 35 |
||||
|
}; |
||||
|
|
||||
|
bool ParseRecordHeader(const uint8_t* data, size_t avail); |
||||
|
void ParseHeader(const uint8_t* data, size_t avail); |
||||
|
void ParseExtension(ExtensionType type, |
||||
|
const uint8_t* data, |
||||
|
size_t len); |
||||
|
bool ParseTLSClientHello(const uint8_t* data, size_t avail); |
||||
|
#ifdef OPENSSL_NO_SSL2 |
||||
|
bool ParseSSL2ClientHello(const uint8_t* data, size_t avail); |
||||
|
#endif // OPENSSL_NO_SSL2
|
||||
|
|
||||
|
ParseState state_; |
||||
|
OnHelloCb onhello_cb_; |
||||
|
OnEndCb onend_cb_; |
||||
|
void* cb_arg_; |
||||
|
size_t frame_len_; |
||||
|
size_t body_offset_; |
||||
|
size_t extension_offset_; |
||||
|
uint8_t session_size_; |
||||
|
const uint8_t* session_id_; |
||||
|
uint16_t tls_ticket_size_; |
||||
|
const uint8_t* tls_ticket_; |
||||
|
}; |
||||
|
|
||||
|
} // namespace node
|
||||
|
|
||||
|
#endif // SRC_NODE_CRYPTO_CLIENTHELLO_H_
|
||||
Loading…
Reference in new issue