1 /* -*- c-basic-offset: 8 -*-
2 rdesktop: A Remote Desktop Protocol client.
3 Secure sockets abstraction layer
4 Copyright (C) Matthew Chapman <matthewc.unsw.edu.au> 1999-2008
5 Copyright (C) Jay Sorg <j@american-data.com> 2006-2008
6 Copyright 2016-2017 Henrik Andersson <hean01@cendio.se> for Cendio AB
7 Copyright 2017 Alexander Zakharov <uglym8@gmail.com>
8
9 This program is free software: you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation, either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rdesktop.h"
24 #include "ssl.h"
25 #include "asn.h"
26
27 #include <gnutls/x509.h>
28
29 void
rdssl_sha1_init(RDSSL_SHA1 * sha1)30 rdssl_sha1_init(RDSSL_SHA1 * sha1)
31 {
32 sha1_init(sha1);
33 }
34
35 void
rdssl_sha1_update(RDSSL_SHA1 * sha1,uint8 * data,uint32 len)36 rdssl_sha1_update(RDSSL_SHA1 * sha1, uint8 * data, uint32 len)
37 {
38 sha1_update(sha1, len, data);
39 }
40
41 void
rdssl_sha1_final(RDSSL_SHA1 * sha1,uint8 * out_data)42 rdssl_sha1_final(RDSSL_SHA1 * sha1, uint8 * out_data)
43 {
44 sha1_digest(sha1, SHA1_DIGEST_SIZE, out_data);
45 }
46
47 void
rdssl_md5_init(RDSSL_MD5 * md5)48 rdssl_md5_init(RDSSL_MD5 * md5)
49 {
50 md5_init(md5);
51 }
52
53 void
rdssl_md5_update(RDSSL_MD5 * md5,uint8 * data,uint32 len)54 rdssl_md5_update(RDSSL_MD5 * md5, uint8 * data, uint32 len)
55 {
56 md5_update(md5, len, data);
57 }
58
59 void
rdssl_md5_final(RDSSL_MD5 * md5,uint8 * out_data)60 rdssl_md5_final(RDSSL_MD5 * md5, uint8 * out_data)
61 {
62 md5_digest(md5, MD5_DIGEST_SIZE, out_data);
63 }
64
65 void
rdssl_rc4_set_key(RDSSL_RC4 * rc4,uint8 * key,uint32 len)66 rdssl_rc4_set_key(RDSSL_RC4 * rc4, uint8 * key, uint32 len)
67 {
68 arcfour_set_key(rc4, len, key);
69 }
70
71 void
rdssl_rc4_crypt(RDSSL_RC4 * rc4,uint8 * in_data,uint8 * out_data,uint32 len)72 rdssl_rc4_crypt(RDSSL_RC4 * rc4, uint8 * in_data, uint8 * out_data, uint32 len)
73 {
74 arcfour_crypt(rc4, len, out_data, in_data);
75 }
76
77 void
rdssl_rsa_encrypt(uint8 * out,uint8 * in,int len,uint32 modulus_size,uint8 * modulus,uint8 * exponent)78 rdssl_rsa_encrypt(uint8 * out, uint8 * in, int len, uint32 modulus_size, uint8 * modulus,
79 uint8 * exponent)
80 {
81 mpz_t exp, mod;
82
83 mpz_t y;
84 mpz_t x;
85
86 size_t outlen;
87
88 mpz_init(y);
89 mpz_init(x);
90 mpz_init(exp);
91 mpz_init(mod);
92
93 mpz_import(mod, modulus_size, -1, sizeof(modulus[0]), 0, 0, modulus);
94 mpz_import(exp, SEC_EXPONENT_SIZE, -1, sizeof(exponent[0]), 0, 0, exponent);
95
96 mpz_import(x, len, -1, sizeof(in[0]), 0, 0, in);
97
98 mpz_powm(y, x, exp, mod);
99
100 mpz_export(out, &outlen, -1, sizeof(out[0]), 0, 0, y);
101
102 mpz_clear(y);
103 mpz_clear(x);
104 mpz_clear(exp);
105 mpz_clear(mod);
106
107 if (outlen < (int) modulus_size)
108 memset(out + outlen, 0, modulus_size - outlen);
109 }
110
111 /* returns newly allocated RDSSL_CERT or NULL */
112 RDSSL_CERT *
rdssl_cert_read(uint8 * data,uint32 len)113 rdssl_cert_read(uint8 * data, uint32 len)
114 {
115 int ret;
116 gnutls_datum_t cert_data;
117 gnutls_x509_crt_t *cert;
118
119 cert = malloc(sizeof(*cert));
120
121 if (!cert) {
122 logger(Protocol, Error, "%s:%s:%d: Failed to allocate memory for certificate structure.\n",
123 __FILE__, __func__, __LINE__);
124 return NULL;
125 }
126
127 if ((ret = gnutls_x509_crt_init(cert)) != GNUTLS_E_SUCCESS) {
128 logger(Protocol, Error, "%s:%s:%d: Failed to init certificate structure. GnuTLS error = 0x%02x (%s)\n",
129 __FILE__, __func__, __LINE__, ret, gnutls_strerror(ret));
130
131 return NULL;
132 }
133
134 cert_data.size = len;
135 cert_data.data = data;
136
137 if ((ret = gnutls_x509_crt_import(*cert, &cert_data, GNUTLS_X509_FMT_DER)) != GNUTLS_E_SUCCESS) {
138 logger(Protocol, Error, "%s:%s:%d: Failed to import DER encoded certificate. GnuTLS error = 0x%02x (%s)\n",
139 __FILE__, __func__, __LINE__, ret, gnutls_strerror(ret));
140 return NULL;
141 }
142
143 return cert;
144 }
145
146 void
rdssl_cert_free(RDSSL_CERT * cert)147 rdssl_cert_free(RDSSL_CERT * cert)
148 {
149 gnutls_x509_crt_deinit(*cert);
150 free(cert);
151 }
152
153
154 /*
155 * AFAIK, there's no way to alter the decoded certificate using GnuTLS.
156 *
157 * Upon detecting "problem" (wrong public RSA key OID) certificate
158 * we basically have two options:
159 *
160 * 1)) encode certificate back to DER, then parse it using libtasn1,
161 * fix public key OID (set it to 1.2.840.113549.1.1.1), encode to DER again
162 * and finally reparse using GnuTLS
163 *
164 * 2) encode cert back to DER, get RSA public key parameters using libtasn1
165 *
166 * Or can rewrite the whole certificate related stuff later.
167 */
168
169 /* returns newly allocated RDSSL_RKEY or NULL */
170 RDSSL_RKEY *
rdssl_cert_to_rkey(RDSSL_CERT * cert,uint32 * key_len)171 rdssl_cert_to_rkey(RDSSL_CERT * cert, uint32 * key_len)
172 {
173 int ret;
174
175 RDSSL_RKEY *pkey;
176 gnutls_datum_t m, e;
177
178 unsigned int algo, bits;
179 char oid[64];
180 size_t oid_size = sizeof(oid);
181
182 uint8_t data[2048];
183 size_t len;
184
185 algo = gnutls_x509_crt_get_pk_algorithm(*cert, &bits);
186
187 /* By some reason, Microsoft sets the OID of the Public RSA key to
188 the oid for "MD5 with RSA Encryption" instead of "RSA Encryption"
189
190 Kudos to Richard Levitte for the finding this and proposed the fix
191 using OpenSSL. */
192
193 if (algo == GNUTLS_PK_RSA) {
194
195 if ((ret = gnutls_x509_crt_get_pk_rsa_raw(*cert, &m, &e)) != GNUTLS_E_SUCCESS) {
196 logger(Protocol, Error, "%s:%s:%d: Failed to get RSA public key parameters from certificate. GnuTLS error = 0x%02x (%s)\n",
197 __FILE__, __func__, __LINE__, ret, gnutls_strerror(ret));
198 return NULL;
199 }
200
201 } else if (algo == GNUTLS_E_UNIMPLEMENTED_FEATURE) {
202
203 len = sizeof(data);
204 if ((ret = gnutls_x509_crt_export(*cert, GNUTLS_X509_FMT_DER, data, &len)) != GNUTLS_E_SUCCESS) {
205 logger(Protocol, Error, "%s:%s:%d: Failed to encode X.509 certificate to DER. GnuTLS error = 0x%02x (%s)\n",
206 __FILE__, __func__, __LINE__, ret, gnutls_strerror(ret));
207 return NULL;
208 }
209
210 /* Validate public key algorithm as OID_SHA_WITH_RSA_SIGNATURE
211 or OID_MD5_WITH_RSA_SIGNATURE
212 */
213 if ((ret = libtasn_read_cert_pk_oid(data, len, oid, &oid_size)) != 0) {
214 logger(Protocol, Error, "%s:%s:%d: Failed to get OID of public key algorithm.\n",
215 __FILE__, __func__, __LINE__);
216 return NULL;
217 }
218
219 if (!(strncmp(oid, OID_SHA_WITH_RSA_SIGNATURE, strlen(OID_SHA_WITH_RSA_SIGNATURE)) == 0
220 || strncmp(oid, OID_MD5_WITH_RSA_SIGNATURE, strlen(OID_MD5_WITH_RSA_SIGNATURE)) == 0))
221 {
222 logger(Protocol, Error, "%s:%s:%d: Wrong public key algorithm algo = 0x%02x (%s)\n",
223 __FILE__, __func__, __LINE__, algo, oid);
224 return NULL;
225 }
226
227 /* Get public key parameters */
228 if ((ret = libtasn_read_cert_pk_parameters(data, len, &m, &e)) != 0) {
229 logger(Protocol, Error, "%s:%s:%d: Failed to read RSA public key parameters\n",
230 __FILE__, __func__, __LINE__);
231
232 return NULL;
233 }
234
235 } else {
236 logger(Protocol, Error, "%s:%s:%d: Failed to get public key algorithm from certificate. algo = 0x%02x (%d)\n",
237 __FILE__, __func__, __LINE__, algo, algo);
238 return NULL;
239 }
240
241 pkey = malloc(sizeof(*pkey));
242
243 if (!pkey) {
244 logger(Protocol, Error, "%s:%s:%d: Failed to allocate memory for RSA public key\n",
245 __FILE__, __func__, __LINE__);
246 return NULL;
247 }
248
249 rsa_public_key_init(pkey);
250
251 mpz_import(pkey->n, m.size, 1, sizeof(m.data[0]), 0, 0, m.data);
252 mpz_import(pkey->e, e.size, 1, sizeof(e.data[0]), 0, 0, e.data);
253
254 rsa_public_key_prepare(pkey);
255
256 *key_len = pkey->size;
257
258 return pkey;
259 }
260
261 /* returns boolean */
262 RD_BOOL
rdssl_certs_ok(RDSSL_CERT * server_cert,RDSSL_CERT * cacert)263 rdssl_certs_ok(RDSSL_CERT * server_cert, RDSSL_CERT * cacert)
264 {
265 UNUSED(server_cert);
266 UNUSED(cacert);
267 /* Currently, we don't use the CA Certificate.
268 FIXME:
269 *) Verify the server certificate (server_cert) with the
270 CA certificate.
271 *) Store the CA Certificate with the hostname of the
272 server we are connecting to as key, and compare it
273 when we connect the next time, in order to prevent
274 MITM-attacks.
275 */
276 return True;
277 }
278
279 int
rdssl_cert_print_fp(FILE * fp,RDSSL_CERT * cert)280 rdssl_cert_print_fp(FILE * fp, RDSSL_CERT * cert)
281 {
282 int ret;
283 gnutls_datum_t cinfo;
284
285 ret = gnutls_x509_crt_print(*cert, GNUTLS_CRT_PRINT_ONELINE, &cinfo);
286
287 if (ret == 0) {
288 fprintf (fp, "\t%s\n", cinfo.data);
289 gnutls_free(cinfo.data);
290 }
291
292 return 0;
293 }
294
295 void
rdssl_rkey_free(RDSSL_RKEY * rkey)296 rdssl_rkey_free(RDSSL_RKEY * rkey)
297 {
298 rsa_public_key_clear(rkey);
299 free(rkey);
300 }
301
302 /* Actually we can get rid of this function and use rsa_public)_key in rdssl_rsa_encrypt */
303 /* returns error */
304 int
rdssl_rkey_get_exp_mod(RDSSL_RKEY * rkey,uint8 * exponent,uint32 max_exp_len,uint8 * modulus,uint32 max_mod_len)305 rdssl_rkey_get_exp_mod(RDSSL_RKEY * rkey, uint8 * exponent, uint32 max_exp_len, uint8 * modulus,
306 uint32 max_mod_len)
307 {
308 size_t outlen;
309
310 outlen = (mpz_sizeinbase(modulus, 2) + 7) / 8;
311 if (outlen > max_mod_len)
312 return 1;
313 outlen = (mpz_sizeinbase(exponent, 2) + 7) / 8;
314 if (outlen > max_exp_len)
315 return 1;
316
317 mpz_export(modulus, &outlen, -1, sizeof(uint8), 0, 0, rkey->n);
318 mpz_export(exponent, &outlen, -1, sizeof(uint8), 0, 0, rkey->e);
319
320 /*
321 * Note that gnutls_x509_crt_get_pk_rsa_raw() exports modulus with additional
322 * zero byte as signed bignum. We can easily import this value using mpz_import()
323 * After we use mpz_export() on pkey.n (modulus) it will (according to GMP docs)
324 * export data without sign byte.
325 *
326 * This is only important if you get modulus from certificate using GnuTLS,
327 * save it somewhere, import it into mpz and then export it from the said mpz to some
328 * buffer. If you then compare initiail (saved) modulus with newly exported one they
329 * will be different.
330 *
331 * On the other hand if we use mpz_t all the way, there will be no such situation.
332 */
333
334 return 0;
335 }
336
337 /* returns boolean */
338 RD_BOOL
rdssl_sig_ok(uint8 * exponent,uint32 exp_len,uint8 * modulus,uint32 mod_len,uint8 * signature,uint32 sig_len)339 rdssl_sig_ok(uint8 * exponent, uint32 exp_len, uint8 * modulus, uint32 mod_len,
340 uint8 * signature, uint32 sig_len)
341 {
342 UNUSED(exponent);
343 UNUSED(exp_len);
344 UNUSED(modulus);
345 UNUSED(mod_len);
346 UNUSED(signature);
347 UNUSED(sig_len);
348 /* Currently, we don't check the signature
349 FIXME:
350 */
351 return True;
352 }
353
354
355 void
rdssl_hmac_md5(const void * key,int key_len,const unsigned char * msg,int msg_len,unsigned char * md)356 rdssl_hmac_md5(const void *key, int key_len, const unsigned char *msg, int msg_len,
357 unsigned char *md)
358 {
359 struct hmac_md5_ctx ctx;
360
361 hmac_md5_set_key(&ctx, key_len, key);
362 hmac_md5_update(&ctx, msg_len, msg);
363 hmac_md5_digest(&ctx, MD5_DIGEST_SIZE, md);
364 }
365