diff options
Diffstat (limited to 'Tools/Hazel-Networking/Hazel/Dtls')
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/AesGcmRecordProtection.cs | 147 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/DtlsConnectionListener.cs | 1424 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/DtlsUnityConnection.cs | 1246 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/Handshake.cs | 734 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/IHandshakeCipherSuite.cs | 63 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/IRecordProtection.cs | 84 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/NullRecordProtection.cs | 66 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/PrfSha256.cs | 84 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/Record.cs | 123 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/ThreadedHmacHelper.cs | 159 | ||||
| -rw-r--r-- | Tools/Hazel-Networking/Hazel/Dtls/X25519EcdheRsaSha256.cs | 202 |
11 files changed, 4332 insertions, 0 deletions
diff --git a/Tools/Hazel-Networking/Hazel/Dtls/AesGcmRecordProtection.cs b/Tools/Hazel-Networking/Hazel/Dtls/AesGcmRecordProtection.cs new file mode 100644 index 0000000..65df39e --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/AesGcmRecordProtection.cs @@ -0,0 +1,147 @@ +using Hazel.Crypto; +using System; +using System.Diagnostics; + +namespace Hazel.Dtls +{ + /// <summary> + /// *_AES_128_GCM_* cipher suite + /// </summary> + public class Aes128GcmRecordProtection: IRecordProtection + { + private const int ImplicitNonceSize = 4; + private const int ExplicitNonceSize = 8; + + private readonly Aes128Gcm serverWriteCipher; + private readonly Aes128Gcm clientWriteCipher; + + private readonly ByteSpan serverWriteIV; + private readonly ByteSpan clientWriteIV; + + /// <summary> + /// Create a new instance of the AES128_GCM record protection + /// </summary> + /// <param name="masterSecret">Shared secret</param> + /// <param name="serverRandom">Server random data</param> + /// <param name="clientRandom">Client random data</param> + public Aes128GcmRecordProtection(ByteSpan masterSecret, ByteSpan serverRandom, ByteSpan clientRandom) + { + ByteSpan combinedRandom = new byte[serverRandom.Length + clientRandom.Length]; + serverRandom.CopyTo(combinedRandom); + clientRandom.CopyTo(combinedRandom.Slice(serverRandom.Length)); + + // Expand master_secret to encryption keys + const int ExpandedSize = 0 + + 0 // mac_key_length + + 0 // mac_key_length + + Aes128Gcm.KeySize // enc_key_length + + Aes128Gcm.KeySize // enc_key_length + + ImplicitNonceSize // fixed_iv_length + + ImplicitNonceSize // fixed_iv_length + ; + + ByteSpan expandedKey = new byte[ExpandedSize]; + PrfSha256.ExpandSecret(expandedKey, masterSecret, PrfLabel.KEY_EXPANSION, combinedRandom); + + ByteSpan clientWriteKey = expandedKey.Slice(0, Aes128Gcm.KeySize); + ByteSpan serverWriteKey = expandedKey.Slice(Aes128Gcm.KeySize, Aes128Gcm.KeySize); + this.clientWriteIV = expandedKey.Slice(2 * Aes128Gcm.KeySize, ImplicitNonceSize); + this.serverWriteIV = expandedKey.Slice(2 * Aes128Gcm.KeySize + ImplicitNonceSize, ImplicitNonceSize); + + this.serverWriteCipher = new Aes128Gcm(serverWriteKey); + this.clientWriteCipher = new Aes128Gcm(clientWriteKey); + } + + /// <inheritdoc /> + public void Dispose() + { + this.serverWriteCipher.Dispose(); + this.clientWriteCipher.Dispose(); + } + + /// <inheritdoc /> + private static int GetEncryptedSizeImpl(int dataSize) + { + return dataSize + Aes128Gcm.CiphertextOverhead; + } + + /// <inheritdoc /> + public int GetEncryptedSize(int dataSize) + { + return GetEncryptedSizeImpl(dataSize); + } + + private static int GetDecryptedSizeImpl(int dataSize) + { + return dataSize - Aes128Gcm.CiphertextOverhead; + } + + /// <inheritdoc /> + public int GetDecryptedSize(int dataSize) + { + return GetDecryptedSizeImpl(dataSize); + } + + /// <inheritdoc /> + public void EncryptServerPlaintext(ByteSpan output, ByteSpan input, ref Record record) + { + EncryptPlaintext(output, input, ref record, this.serverWriteCipher, this.serverWriteIV); + } + + /// <inheritdoc /> + public void EncryptClientPlaintext(ByteSpan output, ByteSpan input, ref Record record) + { + EncryptPlaintext(output, input, ref record, this.clientWriteCipher, this.clientWriteIV); + } + + private static void EncryptPlaintext(ByteSpan output, ByteSpan input, ref Record record, Aes128Gcm cipher, ByteSpan writeIV) + { + Debug.Assert(output.Length >= GetEncryptedSizeImpl(input.Length)); + + // Build GCM nonce (authenticated data) + ByteSpan nonce = new byte[ImplicitNonceSize + ExplicitNonceSize]; + writeIV.CopyTo(nonce); + nonce.WriteBigEndian16(record.Epoch, ImplicitNonceSize); + nonce.WriteBigEndian48(record.SequenceNumber, ImplicitNonceSize + 2); + + // Serialize record as additional data + Record plaintextRecord = record; + plaintextRecord.Length = (ushort)input.Length; + ByteSpan associatedData = new byte[Record.Size]; + plaintextRecord.Encode(associatedData); + + cipher.Seal(output, nonce, input, associatedData); + } + + /// <inheritdoc /> + public bool DecryptCiphertextFromServer(ByteSpan output, ByteSpan input, ref Record record) + { + return DecryptCiphertext(output, input, ref record, this.serverWriteCipher, this.serverWriteIV); + } + + /// <inheritdoc /> + public bool DecryptCiphertextFromClient(ByteSpan output, ByteSpan input, ref Record record) + { + return DecryptCiphertext(output, input, ref record, this.clientWriteCipher, this.clientWriteIV); + } + + private static bool DecryptCiphertext(ByteSpan output, ByteSpan input, ref Record record, Aes128Gcm cipher, ByteSpan writeIV) + { + Debug.Assert(output.Length >= GetDecryptedSizeImpl(input.Length)); + + // Build GCM nonce (authenticated data) + ByteSpan nonce = new byte[ImplicitNonceSize + ExplicitNonceSize]; + writeIV.CopyTo(nonce); + nonce.WriteBigEndian16(record.Epoch, ImplicitNonceSize); + nonce.WriteBigEndian48(record.SequenceNumber, ImplicitNonceSize + 2); + + // Serialize record as additional data + Record plaintextRecord = record; + plaintextRecord.Length = (ushort)GetDecryptedSizeImpl(input.Length); + ByteSpan associatedData = new byte[Record.Size]; + plaintextRecord.Encode(associatedData); + + return cipher.Open(output, nonce, input, associatedData); + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/DtlsConnectionListener.cs b/Tools/Hazel-Networking/Hazel/Dtls/DtlsConnectionListener.cs new file mode 100644 index 0000000..61f41d3 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/DtlsConnectionListener.cs @@ -0,0 +1,1424 @@ +using System; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.Diagnostics; +using System.Net; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; +using System.Threading; +using Hazel.Udp.FewerThreads; +using Hazel.Crypto; + +namespace Hazel.Dtls +{ + /// <summary> + /// Listens for new UDP-DTLS connections and creates UdpConnections for them. + /// </summary> + /// <inheritdoc /> + public class DtlsConnectionListener : ThreadLimitedUdpConnectionListener + { + private const int MaxCertFragmentSizeV0 = 1200; + + // Min MTU - UDP+IP header - 1 (for good measure. :)) + private const int MaxCertFragmentSizeV1 = 576 - 32 - 1; + + /// <summary> + /// Current state of handshake sequence + /// </summary> + enum HandshakeState + { + ExpectingHello, + ExpectingClientKeyExchange, + ExpectingChangeCipherSpec, + ExpectingFinish + } + + /// <summary> + /// State to manage the current epoch `N` + /// </summary> + struct CurrentEpoch + { + public ulong NextOutgoingSequence; + + public ulong NextExpectedSequence; + public ulong PreviousSequenceWindowBitmask; + + public IRecordProtection RecordProtection; + public IRecordProtection PreviousRecordProtection; + + // Need to keep these around so we can re-transmit our + // last handshake record flight + public ByteSpan ExpectedClientFinishedVerification; + public ByteSpan ServerFinishedVerification; + public ulong NextOutgoingSequenceForPreviousEpoch; + } + + /// <summary> + /// State to manage the transition from the current + /// epoch `N` to epoch `N+1` + /// </summary> + struct NextEpoch + { + public ushort Epoch; + + public HandshakeState State; + public CipherSuite SelectedCipherSuite; + + public ulong NextOutgoingSequence; + + public IHandshakeCipherSuite Handshake; + public IRecordProtection RecordProtection; + + public ByteSpan ClientRandom; + public ByteSpan ServerRandom; + + public Sha256Stream VerificationStream; + + public ByteSpan ClientVerification; + public ByteSpan ServerVerification; + + } + + /// <summary> + /// Per-peer state + /// </summary> + sealed class PeerData : IDisposable + { + public ushort Epoch; + public bool CanHandleApplicationData; + + public HazelDtlsSessionInfo Session; + + public CurrentEpoch CurrentEpoch; + public NextEpoch NextEpoch; + + public ConnectionId ConnectionId; + + public readonly List<ByteSpan> QueuedApplicationDataMessage = new List<ByteSpan>(); + public readonly ConcurrentBag<MessageReader> ApplicationData = new ConcurrentBag<MessageReader>(); + public readonly ProtocolVersion ProtocolVersion; + + public DateTime StartOfNegotiation; + + public PeerData(ConnectionId connectionId, ulong nextExpectedSequenceNumber, ProtocolVersion protocolVersion) + { + ByteSpan block = new byte[2 * Finished.Size]; + this.CurrentEpoch.ServerFinishedVerification = block.Slice(0, Finished.Size); + this.CurrentEpoch.ExpectedClientFinishedVerification = block.Slice(Finished.Size, Finished.Size); + this.ProtocolVersion = protocolVersion; + + ResetPeer(connectionId, nextExpectedSequenceNumber); + } + + public void ResetPeer(ConnectionId connectionId, ulong nextExpectedSequenceNumber) + { + Dispose(); + + this.Epoch = 0; + this.CanHandleApplicationData = false; + this.QueuedApplicationDataMessage.Clear(); + + this.CurrentEpoch.NextOutgoingSequence = 2; // Account for our ClientHelloVerify + this.CurrentEpoch.NextExpectedSequence = nextExpectedSequenceNumber; + this.CurrentEpoch.PreviousSequenceWindowBitmask = 0; + this.CurrentEpoch.RecordProtection = NullRecordProtection.Instance; + this.CurrentEpoch.PreviousRecordProtection = null; + this.CurrentEpoch.ServerFinishedVerification.SecureClear(); + this.CurrentEpoch.ExpectedClientFinishedVerification.SecureClear(); + + this.NextEpoch.State = HandshakeState.ExpectingHello; + this.NextEpoch.RecordProtection = null; + this.NextEpoch.Handshake = null; + this.NextEpoch.ClientRandom = new byte[Random.Size]; + this.NextEpoch.ServerRandom = new byte[Random.Size]; + this.NextEpoch.VerificationStream = new Sha256Stream(); + this.NextEpoch.ClientVerification = new byte[Finished.Size]; + this.NextEpoch.ServerVerification = new byte[Finished.Size]; + + this.ConnectionId = connectionId; + + this.StartOfNegotiation = DateTime.UtcNow; + } + + public void Dispose() + { + this.CurrentEpoch.RecordProtection?.Dispose(); + this.CurrentEpoch.PreviousRecordProtection?.Dispose(); + this.NextEpoch.RecordProtection?.Dispose(); + this.NextEpoch.Handshake?.Dispose(); + this.NextEpoch.VerificationStream?.Dispose(); + + while (this.ApplicationData.TryTake(out var msg)) + { + try + { + msg.Recycle(); + } + catch { } + } + } + } + + private RandomNumberGenerator random; + + // Private key component of certificate's public key + private ByteSpan encodedCertificate; + private RSA certificatePrivateKey; + + // HMAC key to validate ClientHello cookie + private ThreadedHmacHelper hmacHelper; + private HMAC CurrentCookieHmac { + get + { + return hmacHelper.GetCurrentCookieHmacsForThread(); + } + } + private HMAC PreviousCookieHmac + { + get + { + return hmacHelper.GetPreviousCookieHmacsForThread(); + } + } + + private ConcurrentStack<ConnectionId> staleConnections = new ConcurrentStack<ConnectionId>(); + private readonly ConcurrentDictionary<IPEndPoint, PeerData> existingPeers = new ConcurrentDictionary<IPEndPoint, PeerData>(); + public int PeerCount => this.existingPeers.Count; + + // TODO: Move these into an DtlsErrorStatistics class + public int NonPeerNonHelloPacketsDropped; + public int NonVerifiedFinishedHandshake; + public int NonPeerVerifyHelloRequests; + public int PeerVerifyHelloRequests; + + private int connectionSerial_unsafe = 0; + + private Timer staleConnectionUpkeep; + + /// <summary> + /// Create a new instance of the DTLS listener + /// </summary> + /// <param name="numWorkers"></param> + /// <param name="endPoint"></param> + /// <param name="logger"></param> + /// <param name="ipMode"></param> + public DtlsConnectionListener(int numWorkers, IPEndPoint endPoint, ILogger logger, IPMode ipMode = IPMode.IPv4) + : base(numWorkers, endPoint, logger, ipMode) + { + this.random = RandomNumberGenerator.Create(); + + this.staleConnectionUpkeep = new Timer(this.HandleStaleConnections, null, 2500, 1000); + this.hmacHelper = new ThreadedHmacHelper(logger); + } + + /// <inheritdoc /> + protected override void Dispose(bool disposing) + { + base.Dispose(disposing); + + this.staleConnectionUpkeep.Dispose(); + + this.random?.Dispose(); + this.random = null; + + this.hmacHelper?.Dispose(); + this.hmacHelper = null; + + foreach (var pair in this.existingPeers) + { + pair.Value.Dispose(); + } + this.existingPeers.Clear(); + } + + /// <summary> + /// Set the certificate key pair for the listener + /// </summary> + /// <param name="certificate">Certificate for the server</param> + public void SetCertificate(X509Certificate2 certificate) + { + if (!certificate.HasPrivateKey) + { + throw new ArgumentException("Certificate must have a private key attached", nameof(certificate)); + } + + RSA privateKey = certificate.GetRSAPrivateKey(); + if (privateKey == null) + { + throw new ArgumentException("Certificate must be signed by an RSA key", nameof(certificate)); + } + + this.certificatePrivateKey?.Dispose(); + this.certificatePrivateKey = privateKey; + + this.encodedCertificate = Certificate.Encode(certificate); + } + + /// <summary> + /// Handle an incoming datagram from the network. + /// + /// This is primarily a wrapper around ProcessIncomingMessage + /// to ensure `reader.Recycle()` is always called + /// </summary> + protected override void ReadCallback(MessageReader reader, IPEndPoint peerAddress, ConnectionId connectionId) + { + try + { + ByteSpan message = new ByteSpan(reader.Buffer, reader.Offset + reader.Position, reader.BytesRemaining); + this.ProcessIncomingMessage(message, peerAddress); + } + finally + { + reader.Recycle(); + } + } + + /// <summary> + /// Handle an incoming datagram from the network + /// </summary> + private void ProcessIncomingMessage(ByteSpan message, IPEndPoint peerAddress) + { + PeerData peer = null; + if (!this.existingPeers.TryGetValue(peerAddress, out peer)) + { + lock (this.existingPeers) + { + if (!this.existingPeers.TryGetValue(peerAddress, out peer)) + { + HandleNonPeerRecord(message, peerAddress); + return; + } + } + } + + ConnectionId peerConnectionId; + + lock (peer) + { + peerConnectionId = peer.ConnectionId; + + // Each incoming packet may contain multiple DTLS + // records + while (message.Length > 0) + { + Record record; + if (!Record.Parse(out record, peer.ProtocolVersion, message)) + { + this.Logger.WriteError($"Dropping malformed record from `{peerAddress}`"); + return; + } + message = message.Slice(Record.Size); + + if (message.Length < record.Length) + { + this.Logger.WriteError($"Dropping malformed record from `{peerAddress}` Length({record.Length}) AvailableBytes({message.Length})"); + return; + } + + ByteSpan recordPayload = message.Slice(0, record.Length); + message = message.Slice(record.Length); + + // Early-out and drop ApplicationData records + if (record.ContentType == ContentType.ApplicationData && !peer.CanHandleApplicationData) + { + this.Logger.WriteInfo($"Dropping ApplicationData record from `{peerAddress}` Cannot process yet"); + continue; + } + + // Drop records from a different epoch + if (record.Epoch != peer.Epoch) + { + // Handle existing client negotiating a new connection + if (record.Epoch == 0 && record.ContentType == ContentType.Handshake) + { + ByteSpan handshakePayload = recordPayload; + + Handshake handshake; + if (!Handshake.Parse(out handshake, recordPayload)) + { + this.Logger.WriteError($"Dropping malformed re-negotiation Handshake from `{peerAddress}`"); + continue; + } + handshakePayload = handshakePayload.Slice(Handshake.Size); + + if (handshake.FragmentOffset != 0 || handshake.Length != handshake.FragmentLength) + { + this.Logger.WriteError($"Dropping fragmented re-negotiation Handshake from `{peerAddress}`"); + continue; + } + else if (handshake.MessageType != HandshakeType.ClientHello) + { + this.Logger.WriteVerbose($"Dropping non-ClientHello re-negotiation Handshake from `{peerAddress}`"); + continue; + } + else if (handshakePayload.Length < handshake.Length) + { + this.Logger.WriteError($"Dropping malformed re-negotiation Handshake from `{peerAddress}`: Length({handshake.Length}) AvailableBytes({handshakePayload.Length})"); + } + + if (!this.HandleClientHello(peer, peerAddress, ref record, ref handshake, recordPayload, handshakePayload)) + { + return; + } + continue; + } + + this.Logger.WriteVerbose($"Dropping bad-epoch record from `{peerAddress}` RecordEpoch({record.Epoch}) CurrentEpoch({peer.Epoch})"); + continue; + } + + // Prevent replay attacks by dropping records + // we've already processed + int windowIndex = (int)(peer.CurrentEpoch.NextExpectedSequence - record.SequenceNumber - 1); + ulong windowMask = 1ul << windowIndex; + if (record.SequenceNumber < peer.CurrentEpoch.NextExpectedSequence) + { + if (windowIndex >= 64) + { + this.Logger.WriteInfo($"Dropping too-old record from `{peerAddress}` Sequence({record.SequenceNumber}) Expected({peer.CurrentEpoch.NextExpectedSequence})"); + continue; + } + + if ((peer.CurrentEpoch.PreviousSequenceWindowBitmask & windowMask) != 0) + { + this.Logger.WriteInfo($"Dropping duplicate record from `{peerAddress}`"); + continue; + } + } + + // Validate record authenticity + int decryptedSize = peer.CurrentEpoch.RecordProtection.GetDecryptedSize(recordPayload.Length); + if (decryptedSize < 0) + { + this.Logger.WriteInfo($"Dropping malformed record: Length {recordPayload.Length} Decrypted length: {decryptedSize}"); + continue; + } + + ByteSpan decryptedPayload = recordPayload.ReuseSpanIfPossible(decryptedSize); + ProtocolVersion protocolVersion = peer.ProtocolVersion; + + if (!peer.CurrentEpoch.RecordProtection.DecryptCiphertextFromClient(decryptedPayload, recordPayload, ref record)) + { + this.Logger.WriteVerbose($"Dropping non-authentic {record.ContentType} record from `{peerAddress}`"); + return; + } + + recordPayload = decryptedPayload; + + // Update our squence number bookeeping + if (record.SequenceNumber >= peer.CurrentEpoch.NextExpectedSequence) + { + int windowShift = (int)(record.SequenceNumber + 1 - peer.CurrentEpoch.NextExpectedSequence); + peer.CurrentEpoch.PreviousSequenceWindowBitmask <<= windowShift; + peer.CurrentEpoch.NextExpectedSequence = record.SequenceNumber + 1; + } + else + { + peer.CurrentEpoch.PreviousSequenceWindowBitmask |= windowMask; + } + + // This is handy for debugging, but too verbose even for verbose. + // this.Logger.WriteVerbose($"Record type {record.ContentType} ({peer.NextEpoch.State})"); + switch (record.ContentType) + { + case ContentType.ChangeCipherSpec: + if (peer.NextEpoch.State != HandshakeState.ExpectingChangeCipherSpec) + { + this.Logger.WriteError($"Dropping unexpected ChangeChiperSpec record from `{peerAddress}` State({peer.NextEpoch.State})"); + break; + } + else if (peer.NextEpoch.RecordProtection == null) + { + ///NOTE(mendsley): This _should_ not + /// happen on a well-formed server. + Debug.Assert(false, "How did we receive a ChangeCipherSpec message without a pending record protection instance?"); + + this.Logger.WriteError($"Dropping ChangeCipherSpec message from `{peerAddress}`: No pending record protection"); + break; + } + + if (!ChangeCipherSpec.Parse(recordPayload)) + { + this.Logger.WriteError($"Dropping malformed ChangeCipherSpec message from `{peerAddress}`"); + break; + } + + // Migrate to the next epoch + peer.Epoch = peer.NextEpoch.Epoch; + peer.CanHandleApplicationData = false; // Need a Finished message + peer.CurrentEpoch.NextOutgoingSequenceForPreviousEpoch = peer.CurrentEpoch.NextOutgoingSequence; + peer.CurrentEpoch.PreviousRecordProtection?.Dispose(); + peer.CurrentEpoch.PreviousRecordProtection = peer.CurrentEpoch.RecordProtection; + peer.CurrentEpoch.RecordProtection = peer.NextEpoch.RecordProtection; + peer.CurrentEpoch.NextOutgoingSequence = 1; + peer.CurrentEpoch.NextExpectedSequence = 1; + peer.CurrentEpoch.PreviousSequenceWindowBitmask = 0; + peer.NextEpoch.ClientVerification.CopyTo(peer.CurrentEpoch.ExpectedClientFinishedVerification); + peer.NextEpoch.ServerVerification.CopyTo(peer.CurrentEpoch.ServerFinishedVerification); + + peer.NextEpoch.State = HandshakeState.ExpectingHello; + peer.NextEpoch.Handshake?.Dispose(); + peer.NextEpoch.Handshake = null; + peer.NextEpoch.NextOutgoingSequence = 1; + peer.NextEpoch.RecordProtection = null; + peer.NextEpoch.VerificationStream.Reset(); + peer.NextEpoch.ClientVerification.SecureClear(); + peer.NextEpoch.ServerVerification.SecureClear(); + break; + + case ContentType.Alert: + this.Logger.WriteError($"Dropping unsupported Alert record from `{peerAddress}`"); + break; + + case ContentType.Handshake: + if (!ProcessHandshake(peer, peerAddress, ref record, recordPayload)) + { + return; + } + break; + + case ContentType.ApplicationData: + // Forward data to the application + MessageReader reader = MessageReader.GetSized(recordPayload.Length); + reader.Length = recordPayload.Length; + recordPayload.CopyTo(reader.Buffer); + + peer.ApplicationData.Add(reader); + break; + } + } + } + + // The peer lock must be exited before leaving the DtlsConnectionListener context to prevent deadlocks + // because ApplicationData processing may reenter this context + while (peer.ApplicationData.TryTake(out var appMsg)) + { + base.ReadCallback(appMsg, peerAddress, peerConnectionId); + } + } + + /// <summary> + /// Process an incoming Handshake protocol message + /// </summary> + /// <param name="peer">Originating peer</param> + /// <param name="peerAddress">Peer's network address</param> + /// <param name="record">Parent record</param> + /// <param name="message">Record payload</param> + /// <returns> + /// True if further processing of the underlying datagram + /// should be continues. Otherwise, false. + /// </returns> + private bool ProcessHandshake(PeerData peer, IPEndPoint peerAddress, ref Record record, ByteSpan message) + { + // Each record may have multiple handshake payloads + while (message.Length > 0) + { + ByteSpan originalMessage = message; + + Handshake handshake; + if (!Handshake.Parse(out handshake, message)) + { + this.Logger.WriteError($"Dropping malformed Handshake message from `{peerAddress}`"); + return false; + } + message = message.Slice(Handshake.Size); + + if (message.Length < handshake.Length) + { + this.Logger.WriteError($"Dropping malformed Handshake message from `{peerAddress}`"); + return false; + } + + ByteSpan payload = message.Slice(0, (int)message.Length); + message = message.Slice((int)handshake.Length); + originalMessage = originalMessage.Slice(0, Handshake.Size + (int)handshake.Length); + + // We do not support fragmented handshake messages + // from the client + if (handshake.FragmentOffset != 0 || handshake.FragmentLength != handshake.Length) + { + this.Logger.WriteError($"Dropping fragmented Handshake message from `{peerAddress}` Offset({handshake.FragmentOffset}) FragmentLength({handshake.FragmentLength}) Length({handshake.Length})"); + continue; + } + + ByteSpan packet; + ByteSpan writer; + +#if DEBUG + this.Logger.WriteVerbose($"Received handshake {handshake.MessageType} ({peer.NextEpoch.State})"); +#endif + switch (handshake.MessageType) + { + case HandshakeType.ClientHello: + if (!this.HandleClientHello(peer, peerAddress, ref record, ref handshake, originalMessage, payload)) + { + return false; + } + break; + + case HandshakeType.ClientKeyExchange: + if (peer.NextEpoch.State != HandshakeState.ExpectingClientKeyExchange) + { + this.Logger.WriteError($"Dropping unexpected ClientKeyExchange message form `{peerAddress}` State({peer.NextEpoch.State})"); + continue; + } + else if (handshake.MessageSequence != 5) + { + this.Logger.WriteError($"Dropping bad-sequence ClientKeyExchange message from `{peerAddress}` MessageSequence({handshake.MessageSequence})"); + continue; + } + + ByteSpan sharedSecret = new byte[peer.NextEpoch.Handshake.SharedKeySize()]; + if (!peer.NextEpoch.Handshake.VerifyClientMessageAndGenerateSharedKey(sharedSecret, payload)) + { + this.Logger.WriteError($"Dropping malformed ClientKeyExchange message from `{peerAddress}`"); + return false; + } + + // Record incoming ClientKeyExchange message + // to verification stream + peer.NextEpoch.VerificationStream.AddData(originalMessage); + + ByteSpan randomSeed = new byte[2 * Random.Size]; + peer.NextEpoch.ClientRandom.CopyTo(randomSeed); + peer.NextEpoch.ServerRandom.CopyTo(randomSeed.Slice(Random.Size)); + + const int MasterSecretSize = 48; + ByteSpan masterSecret = new byte[MasterSecretSize]; + PrfSha256.ExpandSecret( + masterSecret + , sharedSecret + , PrfLabel.MASTER_SECRET + , randomSeed + ); + + // Create the record protection for the upcoming epoch + switch (peer.NextEpoch.SelectedCipherSuite) + { + case CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: + peer.NextEpoch.RecordProtection = new Aes128GcmRecordProtection( + masterSecret + , peer.NextEpoch.ServerRandom + , peer.NextEpoch.ClientRandom); + break; + + default: + Debug.Assert(false, $"How did we agree to a cipher suite {peer.NextEpoch.SelectedCipherSuite} we can't create?"); + this.Logger.WriteError($"Dropping ClientKeyExchange message from `{peerAddress}` Unsuppored cipher suite"); + return false; + } + + // Generate verification signatures + ByteSpan handshakeStreamHash = new byte[Sha256Stream.DigestSize]; + peer.NextEpoch.VerificationStream.CopyOrCalculateFinalHash(handshakeStreamHash); + + PrfSha256.ExpandSecret( + peer.NextEpoch.ClientVerification + , masterSecret + , PrfLabel.CLIENT_FINISHED + , handshakeStreamHash + ); + PrfSha256.ExpandSecret( + peer.NextEpoch.ServerVerification + , masterSecret + , PrfLabel.SERVER_FINISHED + , handshakeStreamHash + ); + + + // Update handshake state + masterSecret.SecureClear(); + peer.NextEpoch.State = HandshakeState.ExpectingChangeCipherSpec; + break; + + case HandshakeType.Finished: + // Unlike other handshake messages, this is + // for the current epoch - not the next epoch + + // Cannot process a Finished message for + // epoch 0 + if (peer.Epoch == 0) + { + this.Logger.WriteError($"Dropping Finished message for 0-epoch from `{peerAddress}`"); + continue; + } + // Cannot process a Finished message when we + // are negotiating the next epoch + else if (peer.NextEpoch.State != HandshakeState.ExpectingHello) + { + this.Logger.WriteError($"Dropping Finished message while negotiating new epoch from `{peerAddress}`"); + continue; + } + // Cannot process a Finished message without + // verify data + else if (peer.CurrentEpoch.ExpectedClientFinishedVerification.Length != Finished.Size || peer.CurrentEpoch.ServerFinishedVerification.Length != Finished.Size) + { + ///NOTE(mendsley): This _should_ not + /// happen on a well-formed server. + Debug.Assert(false, "How do we have an established non-zero epoch without verify data?"); + + this.Logger.WriteError($"Dropping Finished message (no verify data) from `{peerAddress}`"); + return false; + } + // Cannot process a Finished message without + // record protection for the previous epoch + else if (peer.CurrentEpoch.PreviousRecordProtection == null) + { + ///NOTE(mendsley): This _should_ not + /// happen on a well-formed server. + Debug.Assert(false, "How do we have an established non-zero epoch with record protection for the previous epoch?"); + + this.Logger.WriteError($"Dropping Finished message from `{peerAddress}`: No previous epoch record protection"); + return false; + } + + // Verify message sequence + if (handshake.MessageSequence != 6) + { + this.Logger.WriteError($"Dropping bad-sequence Finished message from `{peerAddress}` MessageSequence({handshake.MessageSequence})"); + continue; + } + + // Verify the client has the correct + // handshake sequence + if (payload.Length != Finished.Size) + { + this.Logger.WriteError($"Dropping malformed Finished message from `{peerAddress}`"); + return false; + } + else if (1 != Crypto.Const.ConstantCompareSpans(payload, peer.CurrentEpoch.ExpectedClientFinishedVerification)) + { + +#if DEBUG + this.Logger.WriteError($"Dropping non-verified Finished Handshake from `{peerAddress}`"); +#else + Interlocked.Increment(ref this.NonVerifiedFinishedHandshake); +#endif + + // Abort the connection here + // + // The client is either broken, or + // doen not agree on our epoch settings. + // + // Either way, there is not a feasible + // way to progress the connection. + MarkConnectionAsStale(peer.ConnectionId); + this.existingPeers.TryRemove(peerAddress, out _); + + return false; + } + + ProtocolVersion protocolVersion = peer.ProtocolVersion; + + // Describe our ChangeCipherSpec+Finished + Handshake outgoingHandshake = new Handshake(); + outgoingHandshake.MessageType = HandshakeType.Finished; + outgoingHandshake.Length = Finished.Size; + outgoingHandshake.MessageSequence = 7; + outgoingHandshake.FragmentOffset = 0; + outgoingHandshake.FragmentLength = outgoingHandshake.Length; + + Record changeCipherSpecRecord = new Record(); + changeCipherSpecRecord.ContentType = ContentType.ChangeCipherSpec; + changeCipherSpecRecord.ProtocolVersion = protocolVersion; + changeCipherSpecRecord.Epoch = (ushort)(peer.Epoch - 1); + changeCipherSpecRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequenceForPreviousEpoch; + changeCipherSpecRecord.Length = (ushort)peer.CurrentEpoch.PreviousRecordProtection.GetEncryptedSize(ChangeCipherSpec.Size); + ++peer.CurrentEpoch.NextOutgoingSequenceForPreviousEpoch; + + int plaintextFinishedPayloadSize = Handshake.Size + (int)outgoingHandshake.Length; + Record finishedRecord = new Record(); + finishedRecord.ContentType = ContentType.Handshake; + finishedRecord.ProtocolVersion = protocolVersion; + finishedRecord.Epoch = peer.Epoch; + finishedRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequence; + finishedRecord.Length = (ushort)peer.CurrentEpoch.RecordProtection.GetEncryptedSize(plaintextFinishedPayloadSize); + ++peer.CurrentEpoch.NextOutgoingSequence; + + // Encode the flight into wire format + packet = new byte[Record.Size + changeCipherSpecRecord.Length + Record.Size + finishedRecord.Length]; + writer = packet; + changeCipherSpecRecord.Encode(writer); + writer = writer.Slice(Record.Size); + ChangeCipherSpec.Encode(writer); + + ByteSpan startOfFinishedRecord = packet.Slice(Record.Size + changeCipherSpecRecord.Length); + writer = startOfFinishedRecord; + finishedRecord.Encode(writer); + writer = writer.Slice(Record.Size); + outgoingHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + peer.CurrentEpoch.ServerFinishedVerification.CopyTo(writer); + + // Protect the ChangeChipherSpec record + peer.CurrentEpoch.PreviousRecordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, changeCipherSpecRecord.Length), + packet.Slice(Record.Size, ChangeCipherSpec.Size), + ref changeCipherSpecRecord + ); + + // Protect the Finished Handshake record + peer.CurrentEpoch.RecordProtection.EncryptServerPlaintext( + startOfFinishedRecord.Slice(Record.Size, finishedRecord.Length), + startOfFinishedRecord.Slice(Record.Size, plaintextFinishedPayloadSize), + ref finishedRecord + ); + + // Current epoch can now handle application data + peer.CanHandleApplicationData = true; + + base.QueueRawData(packet, peerAddress); + break; + + // Drop messages that we do not support + case HandshakeType.CertificateVerify: + this.Logger.WriteError($"Dropping unsupported Handshake message from `{peerAddress}` MessageType({handshake.MessageType})"); + continue; + + // Drop messages that originate from the server + case HandshakeType.HelloRequest: + case HandshakeType.ServerHello: + case HandshakeType.HelloVerifyRequest: + case HandshakeType.Certificate: + case HandshakeType.ServerKeyExchange: + case HandshakeType.CertificateRequest: + case HandshakeType.ServerHelloDone: + this.Logger.WriteError($"Dropping server Handshake message from `{peerAddress}` MessageType({handshake.MessageType})"); + continue; + } + } + + return true; + } + + /// <summary> + /// Handle a ClientHello message for a peer + /// </summary> + /// <param name="peer">Originating peer</param> + /// <param name="peerAddress">Peer address</param> + /// <param name="record">Parent record</param> + /// <param name="handshake">Parent Handshake header</param> + /// <param name="payload">Handshake payload</param> + private bool HandleClientHello(PeerData peer, IPEndPoint peerAddress, ref Record record, ref Handshake handshake, ByteSpan originalMessage, ByteSpan payload) + { + // Verify message sequence + if (handshake.MessageSequence != 0) + { + this.Logger.WriteError($"Dropping bad-sequence ClientHello from `{peerAddress}` MessageSequence({handshake.MessageSequence})`"); + return true; + } + + // Make sure we can handle a ClientHello message + if (peer.NextEpoch.State != HandshakeState.ExpectingHello && peer.NextEpoch.State != HandshakeState.ExpectingClientKeyExchange) + { + // Always handle ClientHello for epoch 0 + if (record.Epoch != 0) + { + this.Logger.WriteError($"Dropping ClientHello from `{peer}` Not expecting ClientHello"); + return true; + } + } + + ProtocolVersion protocolVersion = peer.ProtocolVersion; + if (!ClientHello.Parse(out ClientHello clientHello, protocolVersion, payload)) + { + this.Logger.WriteError($"Dropping malformed ClientHello Handshake message from `{peerAddress}`"); + return false; + } + + // Find an acceptable cipher suite we can use + CipherSuite selectedCipherSuite = CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256; + if (!clientHello.ContainsCipherSuite(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) || !clientHello.ContainsCurve(NamedCurve.x25519)) + { + this.Logger.WriteError($"Dropping ClientHello from `{peerAddress}` No compatible cipher suite"); + return false; + } + + // If this message was not signed by us, + // request a signed message before doing anything else + if (!HelloVerifyRequest.VerifyCookie(clientHello.Cookie, peerAddress, this.CurrentCookieHmac)) + { + if (!HelloVerifyRequest.VerifyCookie(clientHello.Cookie, peerAddress, this.PreviousCookieHmac)) + { + ulong outgoingSequence = 1; + IRecordProtection recordProtection = NullRecordProtection.Instance; + if (record.Epoch != 0) + { + outgoingSequence = peer.CurrentEpoch.NextExpectedSequence; + ++peer.CurrentEpoch.NextOutgoingSequenceForPreviousEpoch; + + recordProtection = peer.CurrentEpoch.RecordProtection; + } + +#if DEBUG + this.Logger.WriteError($"Sending HelloVerifyRequest to peer `{peerAddress}`"); +#else + Interlocked.Increment(ref this.PeerVerifyHelloRequests); +#endif + this.SendHelloVerifyRequest(peerAddress, outgoingSequence, record.Epoch, recordProtection, protocolVersion); + return true; + } + } + + // Client is initiating a brand new connection. We need + // to destroy the existing connection and establish a + // new session. + if (record.Epoch == 0 && peer.Epoch != 0) + { + ConnectionId oldConnectionId = peer.ConnectionId; + peer.ResetPeer(this.AllocateConnectionId(peerAddress), record.SequenceNumber + 1); + + // Inform the parent layer that the existing + // connection should be abandoned. + MarkConnectionAsStale(oldConnectionId); + } + + // Determine if this is an original message, or a retransmission + bool recordMessagesForVerifyData = false; + if (peer.NextEpoch.State == HandshakeState.ExpectingHello) + { + // Create our handhake cipher suite + IHandshakeCipherSuite handshakeCipherSuite = null; + switch (selectedCipherSuite) + { + case CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: + if (clientHello.ContainsCurve(NamedCurve.x25519)) + { + handshakeCipherSuite = new X25519EcdheRsaSha256(this.random); + } + else + { + this.Logger.WriteError($"Dropping ClientHello from `{peerAddress}` Could not create TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suite"); + return false; + } + + break; + + default: + this.Logger.WriteError($"Dropping ClientHello from `{peerAddress}` Could not create handshake cipher suite"); + return false; + } + + peer.Session = clientHello.Session; + + // Update the state of our epoch transition + peer.NextEpoch.Epoch = (ushort)(record.Epoch + 1); + peer.NextEpoch.State = HandshakeState.ExpectingClientKeyExchange; + peer.NextEpoch.SelectedCipherSuite = selectedCipherSuite; + peer.NextEpoch.Handshake = handshakeCipherSuite; + clientHello.Random.CopyTo(peer.NextEpoch.ClientRandom); + peer.NextEpoch.ServerRandom.FillWithRandom(this.random); + recordMessagesForVerifyData = true; + +#if DEBUG + this.Logger.WriteVerbose($"ClientRandom: {peer.NextEpoch.ClientRandom} ServerRandom: {peer.NextEpoch.ServerRandom}"); +#endif + + // Copy the original ClientHello + // handshake to our verification stream + peer.NextEpoch.VerificationStream.AddData( + originalMessage.Slice( + 0 + , Handshake.Size + (int)handshake.Length + ) + ); + } + + // The initial record flight from the server + // contains the following Handshake messages: + // * ServerHello + // * Certificate + // * ServerKeyExchange + // * ServerHelloDone + // + // The Certificate message is almost always + // too large to fit into a single datagram, + // so it is pre-fragmented + // (see `SetCertificates`). Therefore, we + // need to send multiple record packets for + // this flight. + // + // The first record contains the ServerHello + // handshake message, as well as the first + // portion of the Certificate message. + // + // We then send a record packet until the + // entire Certificate message has been sent + // to the client. + // + // The final record packet contains the + // ServerKeyExchange and the ServerHelloDone + // messages. + + // Describe first record of the flight + ServerHello serverHello = new ServerHello(); + serverHello.ServerProtocolVersion = protocolVersion; + serverHello.Random = peer.NextEpoch.ServerRandom; + serverHello.CipherSuite = selectedCipherSuite; + + Handshake serverHelloHandshake = new Handshake(); + serverHelloHandshake.MessageType = HandshakeType.ServerHello; + serverHelloHandshake.Length = ServerHello.MinSize; + serverHelloHandshake.MessageSequence = 1; + serverHelloHandshake.FragmentOffset = 0; + serverHelloHandshake.FragmentLength = serverHelloHandshake.Length; + + int maxCertFragmentSize = peer.Session.Version == 0 ? MaxCertFragmentSizeV0 : MaxCertFragmentSizeV1; + + // The first certificate data needs to leave room for + // * Record header + // * ServerHello header + // * ServerHello payload + // * Certificate header + + var certificateData = this.encodedCertificate; + int initialCertPadding = Record.Size + Handshake.Size + serverHello.Size + Handshake.Size; + int certInitialFragmentSize = Math.Min(certificateData.Length, maxCertFragmentSize - initialCertPadding); + + Handshake certificateHandshake = new Handshake(); + certificateHandshake.MessageType = HandshakeType.Certificate; + certificateHandshake.Length = (uint)certificateData.Length; + certificateHandshake.MessageSequence = 2; + certificateHandshake.FragmentOffset = 0; + certificateHandshake.FragmentLength = (uint)certInitialFragmentSize; + + int initialRecordPayloadSize = 0 + + Handshake.Size + serverHello.Size + + Handshake.Size + (int)certificateHandshake.FragmentLength + ; + Record initialRecord = new Record(); + initialRecord.ContentType = ContentType.Handshake; + initialRecord.ProtocolVersion = protocolVersion; + initialRecord.Epoch = peer.Epoch; + initialRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequence; + initialRecord.Length = (ushort)peer.CurrentEpoch.RecordProtection.GetEncryptedSize(initialRecordPayloadSize); + ++peer.CurrentEpoch.NextOutgoingSequence; + + // Convert initial record of the flight to + // wire format + ByteSpan packet = new byte[Record.Size + initialRecord.Length]; + ByteSpan writer = packet; + initialRecord.Encode(writer); + writer = writer.Slice(Record.Size); + serverHelloHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + serverHello.Encode(writer); + writer = writer.Slice(ServerHello.MinSize); + certificateHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + certificateData.Slice(0, certInitialFragmentSize).CopyTo(writer); + certificateData = certificateData.Slice(certInitialFragmentSize); + + // Protect initial record of the flight + peer.CurrentEpoch.RecordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, initialRecord.Length), + packet.Slice(Record.Size, initialRecordPayloadSize), + ref initialRecord + ); + + base.QueueRawData(packet, peerAddress); + + // Record record payload for verification + if (recordMessagesForVerifyData) + { + Handshake fullCeritficateHandshake = certificateHandshake; + fullCeritficateHandshake.FragmentLength = fullCeritficateHandshake.Length; + + packet = new byte[Handshake.Size + ServerHello.MinSize + Handshake.Size]; + writer = packet; + serverHelloHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + serverHello.Encode(writer); + writer = writer.Slice(ServerHello.MinSize); + fullCeritficateHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + + peer.NextEpoch.VerificationStream.AddData(packet); + peer.NextEpoch.VerificationStream.AddData(this.encodedCertificate); + } + + // Process additional certificate records + // Subsequent certificate data needs to leave room for + // * Record header + // * Certificate header + const int CertPadding = Record.Size + Handshake.Size; + while (certificateData.Length > 0) + { + int certFragmentSize = Math.Min(certificateData.Length, maxCertFragmentSize - CertPadding); + + certificateHandshake.FragmentOffset += certificateHandshake.FragmentLength; + certificateHandshake.FragmentLength = (uint)certFragmentSize; + + int additionalRecordPayloadSize = Handshake.Size + (int)certificateHandshake.FragmentLength; + Record additionalRecord = new Record(); + additionalRecord.ContentType = ContentType.Handshake; + additionalRecord.ProtocolVersion = protocolVersion; + additionalRecord.Epoch = peer.Epoch; + additionalRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequence; + additionalRecord.Length = (ushort)peer.CurrentEpoch.RecordProtection.GetEncryptedSize(additionalRecordPayloadSize); + ++peer.CurrentEpoch.NextOutgoingSequence; + + // Convert record to wire format + packet = new byte[Record.Size + additionalRecord.Length]; + writer = packet; + additionalRecord.Encode(writer); + writer = writer.Slice(Record.Size); + certificateHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + certificateData.Slice(0, certFragmentSize).CopyTo(writer); + + certificateData = certificateData.Slice(certFragmentSize); + + // Protect record + peer.CurrentEpoch.RecordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, additionalRecord.Length), + packet.Slice(Record.Size, additionalRecordPayloadSize), + ref additionalRecord + ); + + base.QueueRawData(packet, peerAddress); + } + + // Describe final record of the flight + Handshake serverKeyExchangeHandshake = new Handshake(); + serverKeyExchangeHandshake.MessageType = HandshakeType.ServerKeyExchange; + serverKeyExchangeHandshake.Length = (uint)peer.NextEpoch.Handshake.CalculateServerMessageSize(this.certificatePrivateKey); + serverKeyExchangeHandshake.MessageSequence = 3; + serverKeyExchangeHandshake.FragmentOffset = 0; + serverKeyExchangeHandshake.FragmentLength = serverKeyExchangeHandshake.Length; + + Handshake serverHelloDoneHandshake = new Handshake(); + serverHelloDoneHandshake.MessageType = HandshakeType.ServerHelloDone; + serverHelloDoneHandshake.Length = 0; + serverHelloDoneHandshake.MessageSequence = 4; + serverHelloDoneHandshake.FragmentOffset = 0; + serverHelloDoneHandshake.FragmentLength = 0; + + int finalRecordPayloadSize = 0 + + Handshake.Size + (int)serverKeyExchangeHandshake.Length + + Handshake.Size + (int)serverHelloDoneHandshake.Length + ; + Record finalRecord = new Record(); + finalRecord.ContentType = ContentType.Handshake; + finalRecord.ProtocolVersion = protocolVersion; + finalRecord.Epoch = peer.Epoch; + finalRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequence; + finalRecord.Length = (ushort)peer.CurrentEpoch.RecordProtection.GetEncryptedSize(finalRecordPayloadSize); + ++peer.CurrentEpoch.NextOutgoingSequence; + + // Convert final record of the flight to wire + // format + packet = new byte[Record.Size + finalRecord.Length]; + writer = packet; + finalRecord.Encode(writer); + writer = writer.Slice(Record.Size); + serverKeyExchangeHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + peer.NextEpoch.Handshake.EncodeServerKeyExchangeMessage(writer, this.certificatePrivateKey); + writer = writer.Slice((int)serverKeyExchangeHandshake.Length); + serverHelloDoneHandshake.Encode(writer); + + // Record record payload for verification + if (recordMessagesForVerifyData) + { + peer.NextEpoch.VerificationStream.AddData( + packet.Slice( + packet.Offset + Record.Size + , finalRecordPayloadSize + ) + ); + } + + // Protect final record of the flight + peer.CurrentEpoch.RecordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, finalRecord.Length), + packet.Slice(Record.Size, finalRecordPayloadSize), + ref finalRecord + ); + + base.QueueRawData(packet, peerAddress); + + return true; + } + + /// <summary> + /// Handle an incoming packet that is not tied to an existing peer + /// </summary> + /// <param name="message">Incoming datagram</param> + /// <param name="peerAddress">Originating address</param> + private void HandleNonPeerRecord(ByteSpan message, IPEndPoint peerAddress) + { + Record record; + if (!Record.Parse(out record, expectedProtocolVersion: null, message)) + { + this.Logger.WriteError($"Dropping malformed record from non-peer `{peerAddress}`"); + return; + } + message = message.Slice(Record.Size); + + // The protocol only supports receiving a single record + // from a non-peer. + if (record.Length != message.Length) + { + // NOTE(mendsley): This isn't always fatal. + // However, this is an indication that something + // fishy is going on. In the best case, there's a + // bug on the client or in the UDP stack (some + // stacks don't both to verify the checksum). In the + // worst case we're dealing with a malicious actor. + // In the malicious case, we'll end up dropping the + // connection later in the process. + if (message.Length < record.Length) + { + this.Logger.WriteInfo($"Dropping bad record from non-peer `{peerAddress}`. Msg length {message.Length} < {record.Length}"); + return; + } + } + + // We only accept zero-epoch records from non-peers + if (record.Epoch != 0) + { + ///NOTE(mendsley): Not logging anything here, as + /// this could easily be latent data arriving from a + /// recently disconnected peer. + return; + } + + // We only accept Handshake protocol messages from non-peers + if (record.ContentType != ContentType.Handshake) + { + this.Logger.WriteError($"Dropping non-handhsake message from non-peer `{peerAddress}`"); + return; + } + + ByteSpan originalMessage = message; + + Handshake handshake; + if (!Handshake.Parse(out handshake, message)) + { + this.Logger.WriteError($"Dropping malformed handshake message from non-peer `{peerAddress}`"); + return; + } + + // We only accept ClientHello messages from non-peers + if (handshake.MessageType != HandshakeType.ClientHello) + { +#if DEBUG + this.Logger.WriteError($"Dropping non-ClientHello ({handshake.MessageType}) message from non-peer `{peerAddress}`"); +#else + Interlocked.Increment(ref this.NonPeerNonHelloPacketsDropped); +#endif + return; + } + message = message.Slice(Handshake.Size); + + if (!ClientHello.Parse(out ClientHello clientHello, expectedProtocolVersion: null, message)) + { + this.Logger.WriteError($"Dropping malformed ClientHello message from non-peer `{peerAddress}`"); + return; + } + + // If this ClientHello is not signed by us, request the + // client send us a signed message + if (!HelloVerifyRequest.VerifyCookie(clientHello.Cookie, peerAddress, this.CurrentCookieHmac)) + { + if (!HelloVerifyRequest.VerifyCookie(clientHello.Cookie, peerAddress, this.PreviousCookieHmac)) + { +#if DEBUG + this.Logger.WriteVerbose($"Sending HelloVerifyRequest to non-peer `{peerAddress}`"); +#else + Interlocked.Increment(ref this.NonPeerVerifyHelloRequests); +#endif + this.SendHelloVerifyRequest(peerAddress, 1, 0, NullRecordProtection.Instance, clientHello.ClientProtocolVersion); + return; + } + } + + // Allocate state for the new peer and register it + PeerData peer = new PeerData(this.AllocateConnectionId(peerAddress), record.SequenceNumber + 1, clientHello.ClientProtocolVersion); + this.ProcessHandshake(peer, peerAddress, ref record, originalMessage); + this.existingPeers[peerAddress] = peer; + } + + //Send a HelloVerifyRequest handshake message to a peer + private void SendHelloVerifyRequest(IPEndPoint peerAddress, ulong recordSequence, ushort epoch, IRecordProtection recordProtection, ProtocolVersion protocolVersion) + { + Handshake handshake = new Handshake(); + handshake.MessageType = HandshakeType.HelloVerifyRequest; + handshake.Length = HelloVerifyRequest.Size; + handshake.MessageSequence = 0; + handshake.FragmentOffset = 0; + handshake.FragmentLength = handshake.Length; + + int plaintextPayloadSize = Handshake.Size + (int)handshake.Length; + + Record record = new Record(); + record.ContentType = ContentType.Handshake; + record.ProtocolVersion = protocolVersion; + record.Epoch = epoch; + record.SequenceNumber = recordSequence; + record.Length = (ushort)recordProtection.GetEncryptedSize(plaintextPayloadSize); + + // Encode record to wire format + ByteSpan packet = new byte[Record.Size + record.Length]; + ByteSpan writer = packet; + record.Encode(writer); + writer = writer.Slice(Record.Size); + handshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + HelloVerifyRequest.Encode(writer, peerAddress, this.CurrentCookieHmac, protocolVersion); + + // Protect record payload + recordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, record.Length), + packet.Slice(Record.Size, plaintextPayloadSize), + ref record + ); + + base.QueueRawData(packet, peerAddress); + } + + /// <summary> + /// Handle a requrest to send a datagram to the network + /// </summary> + protected override void QueueRawData(ByteSpan span, IPEndPoint remoteEndPoint) + { + PeerData peer; + if (!this.existingPeers.TryGetValue(remoteEndPoint, out peer)) + { + // Drop messages if we don't know how to send them + return; + } + + lock (peer) + { + // If we're negotiating a new epoch, queue data + if (peer.Epoch == 0 || peer.NextEpoch.State != HandshakeState.ExpectingHello) + { + ByteSpan copyOfSpan = new byte[span.Length]; + span.CopyTo(copyOfSpan); + + peer.QueuedApplicationDataMessage.Add(copyOfSpan); + return; + } + + ProtocolVersion protocolVersion = peer.ProtocolVersion; + + // Send any queued application data now + for (int ii = 0, nn = peer.QueuedApplicationDataMessage.Count; ii != nn; ++ii) + { + ByteSpan queuedSpan = peer.QueuedApplicationDataMessage[ii]; + + Record outgoingRecord = new Record(); + outgoingRecord.ContentType = ContentType.ApplicationData; + outgoingRecord.ProtocolVersion = protocolVersion; + outgoingRecord.Epoch = peer.Epoch; + outgoingRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequence; + outgoingRecord.Length = (ushort)peer.CurrentEpoch.RecordProtection.GetEncryptedSize(queuedSpan.Length); + ++peer.CurrentEpoch.NextOutgoingSequence; + + // Encode the record to wire format + ByteSpan packet = new byte[Record.Size + outgoingRecord.Length]; + ByteSpan writer = packet; + outgoingRecord.Encode(writer); + writer = writer.Slice(Record.Size); + queuedSpan.CopyTo(writer); + + // Protect the record + peer.CurrentEpoch.RecordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, outgoingRecord.Length), + packet.Slice(Record.Size, queuedSpan.Length), + ref outgoingRecord + ); + + base.QueueRawData(packet, remoteEndPoint); + } + peer.QueuedApplicationDataMessage.Clear(); + + { + Record outgoingRecord = new Record(); + outgoingRecord.ContentType = ContentType.ApplicationData; + outgoingRecord.ProtocolVersion = protocolVersion; + outgoingRecord.Epoch = peer.Epoch; + outgoingRecord.SequenceNumber = peer.CurrentEpoch.NextOutgoingSequence; + outgoingRecord.Length = (ushort)peer.CurrentEpoch.RecordProtection.GetEncryptedSize(span.Length); + ++peer.CurrentEpoch.NextOutgoingSequence; + + // Encode the record to wire format + ByteSpan packet = new byte[Record.Size + outgoingRecord.Length]; + ByteSpan writer = packet; + outgoingRecord.Encode(writer); + writer = writer.Slice(Record.Size); + span.CopyTo(writer); + + // Protect the record + peer.CurrentEpoch.RecordProtection.EncryptServerPlaintext( + packet.Slice(Record.Size, outgoingRecord.Length), + packet.Slice(Record.Size, span.Length), + ref outgoingRecord + ); + + base.QueueRawData(packet, remoteEndPoint); + } + } + } + + private void HandleStaleConnections(object _) + { + TimeSpan maxAge = TimeSpan.FromSeconds(2.5f); + DateTime now = DateTime.UtcNow; + foreach (KeyValuePair<IPEndPoint, PeerData> kvp in this.existingPeers) + { + PeerData peer = kvp.Value; + lock (peer) + { + if (peer.Epoch == 0 || peer.NextEpoch.State != HandshakeState.ExpectingHello) + { + TimeSpan negotiationAge = now - peer.StartOfNegotiation; + if (negotiationAge > maxAge) + { + MarkConnectionAsStale(peer.ConnectionId); + } + } + } + } + + ConnectionId connectionId; + while (this.staleConnections.TryPop(out connectionId)) + { + ThreadLimitedUdpServerConnection connection; + if (this.allConnections.TryGetValue(connectionId, out connection)) + { + connection.Disconnect("Stale Connection", null); + } + } + } + + protected void MarkConnectionAsStale(ConnectionId connectionId) + { + if (this.allConnections.ContainsKey(connectionId)) + { + this.staleConnections.Push(connectionId); + } + } + + /// <inheritdoc /> + internal override void RemovePeerRecord(ConnectionId connectionId) + { + if (this.existingPeers.TryRemove(connectionId.EndPoint, out var peer)) + { + peer.Dispose(); + } + } + + /// <summary> + /// Allocate a new connection id + /// </summary> + private ConnectionId AllocateConnectionId(IPEndPoint endPoint) + { + int rawSerialId = Interlocked.Increment(ref this.connectionSerial_unsafe); + return ConnectionId.Create(endPoint, rawSerialId); + } + + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/DtlsUnityConnection.cs b/Tools/Hazel-Networking/Hazel/Dtls/DtlsUnityConnection.cs new file mode 100644 index 0000000..4da2051 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/DtlsUnityConnection.cs @@ -0,0 +1,1246 @@ +using Hazel.Crypto; +using Hazel.Udp; +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.Net; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; + +namespace Hazel.Dtls +{ + /// <summary> + /// Connects to a UDP-DTLS server + /// </summary> + /// <inheritdoc /> + public class DtlsUnityConnection : UnityUdpClientConnection + { + /// <summary> + /// Current state of the handshake sequence + /// </summary> + enum HandshakeState + { + Initializing, + + ExpectingServerHello, + ExpectingCertificate, + ExpectingServerKeyExchange, + ExpectingServerHelloDone, + + ExpectingChangeCipherSpec, + ExpectingFinished, + + Established, + } + + /// <summary> + /// State data for the current epoch + /// </summary> + struct CurrentEpoch + { + public ulong NextOutgoingSequence; + + public ulong NextExpectedSequence; + public ulong PreviousSequenceWindowBitmask; + + public IRecordProtection RecordProtection; + } + + struct FragmentRange + { + public int Offset; + public int Length; + } + + /// <summary> + /// State data for the next epoch + /// </summary> + struct NextEpoch + { + public ushort Epoch; + + public HandshakeState State; + + public ulong NextOutgoingSequence; + + public DateTime NegotiationStartTime; + public DateTime NextPacketResendTime; + public int PacketResendCount; + + public CipherSuite SelectedCipherSuite; + public IRecordProtection RecordProtection; + public IHandshakeCipherSuite Handshake; + public ByteSpan Cookie; + public Sha256Stream VerificationStream; + public RSA ServerPublicKey; + + public ByteSpan ClientRandom; + public ByteSpan ServerRandom; + + public ByteSpan MasterSecret; + public ByteSpan ServerVerification; + + public List<FragmentRange> CertificateFragments; + public ByteSpan CertificatePayload; + } + + struct QueuedAppData + { + public byte[] Bytes; + public byte SendOption; + public Action AckCallback; + } + + private const ProtocolVersion DtlsVersion = ProtocolVersion.UDP; + + internal byte HazelSessionVersion = HazelDtlsSessionInfo.CurrentClientSessionVersion; + + private readonly object syncRoot = new object(); + private readonly RandomNumberGenerator random = RandomNumberGenerator.Create(); + + private ushort epoch; + private CurrentEpoch currentEpoch; + private NextEpoch nextEpoch; + private TimeSpan handshakeResendTimeout = TimeSpan.FromMilliseconds(200); + + private readonly Queue<QueuedAppData> queuedApplicationData = new Queue<QueuedAppData>(); + + private X509Certificate2Collection serverCertificates = new X509Certificate2Collection(); + + public bool HandshakeComplete + { + get + { + lock (this.syncRoot) + { + return this.nextEpoch.State == HandshakeState.Established; + } + } + } + + /// <summary> + /// Create a new instance of the DTLS connection + /// </summary> + /// <inheritdoc /> + public DtlsUnityConnection(ILogger logger, IPEndPoint remoteEndPoint, IPMode ipMode = IPMode.IPv4) + : base(logger, remoteEndPoint, ipMode) + { + this.nextEpoch.ServerRandom = new byte[Random.Size]; + this.nextEpoch.ClientRandom = new byte[Random.Size]; + this.nextEpoch.ServerVerification = new byte[Finished.Size]; + this.nextEpoch.CertificateFragments = new List<FragmentRange>(); + + this.ResetConnectionState(); + } + + /// <inheritdoc /> + protected override void Dispose(bool disposing) + { + base.Dispose(disposing); + + lock (this.syncRoot) + { + this.ResetConnectionState(); + } + } + + /// <summary> + /// Set the list of valid server certificates + /// </summary> + /// <param name="certificateCollection"> + /// List of certificates of authentic servers + /// </param> + public void SetValidServerCertificates(X509Certificate2Collection certificateCollection) + { + lock (this.syncRoot) + { + foreach (X509Certificate2 certificate in certificateCollection) + { + if (!(certificate.PublicKey.Key is RSA)) + { + throw new ArgumentException("Certificate must be signed with an RSA key", nameof(certificateCollection)); + } + } + + this.serverCertificates = certificateCollection; + } + } + + /// <summary> + /// Set the packet resend timer for handshake messages + /// </summary> + public void SetHandshakeResendTimeout(TimeSpan timeout) + { + lock (this.syncRoot) + { + this.handshakeResendTimeout = timeout; + } + } + + /// <summary> + /// Reset existing connection state + /// </summary> + private void ResetConnectionState() + { + this.currentEpoch.NextOutgoingSequence = 1; + this.currentEpoch.NextExpectedSequence = 1; + this.currentEpoch.PreviousSequenceWindowBitmask = 0; + this.currentEpoch.RecordProtection?.Dispose(); + this.currentEpoch.RecordProtection = NullRecordProtection.Instance; + + this.nextEpoch.Epoch = 1; + this.nextEpoch.State = HandshakeState.Initializing; + this.nextEpoch.NextOutgoingSequence = 1; + this.nextEpoch.NegotiationStartTime = DateTime.MinValue; + this.nextEpoch.NextPacketResendTime = DateTime.MinValue; + this.nextEpoch.SelectedCipherSuite = CipherSuite.TLS_NULL_WITH_NULL_NULL; + this.nextEpoch.RecordProtection?.Dispose(); + this.nextEpoch.RecordProtection = null; + this.nextEpoch.Handshake?.Dispose(); + this.nextEpoch.Handshake = null; + this.nextEpoch.Cookie = ByteSpan.Empty; + this.nextEpoch.VerificationStream?.Dispose(); + this.nextEpoch.VerificationStream = new Sha256Stream(); + this.nextEpoch.ServerPublicKey = null; + this.nextEpoch.ServerRandom.SecureClear(); + this.nextEpoch.ClientRandom.SecureClear(); + this.nextEpoch.MasterSecret.SecureClear(); + this.nextEpoch.ServerVerification.SecureClear(); + this.nextEpoch.CertificateFragments.Clear(); + this.nextEpoch.CertificatePayload = ByteSpan.Empty; + + this.epoch = 0; + while (this.queuedApplicationData.TryDequeue(out _)) ; + } + + /// <summary> + /// Abort the existing connection and restart the process + /// </summary> + protected override void RestartConnection() + { + lock (this.syncRoot) + { + this.ResetConnectionState(); + this.nextEpoch.ClientRandom.FillWithRandom(this.random); + this.SendClientHello(isRetransmit: false); + } + + base.RestartConnection(); + } + + /// <inheritdoc /> + protected override void ResendPacketsIfNeeded() + { + lock (this.syncRoot) + { + // Check if we need to resend handshake message + if (this.nextEpoch.State != HandshakeState.Established) + { + DateTime now = DateTime.UtcNow; + if (now >= this.nextEpoch.NextPacketResendTime) + { + double negotiationDurationMs = (now - this.nextEpoch.NegotiationStartTime).TotalMilliseconds; + this.nextEpoch.PacketResendCount++; + + if ((this.ResendLimit > 0 && this.nextEpoch.PacketResendCount > this.ResendLimit) + || negotiationDurationMs > this.DisconnectTimeoutMs) + { + this.DisconnectInternal(HazelInternalErrors.DtlsNegotiationFailed, $"DTLS negotiation failed after {this.nextEpoch.PacketResendCount} resends ({(int)negotiationDurationMs} ms)."); + } + else + { + switch (this.nextEpoch.State) + { + case HandshakeState.ExpectingServerHello: + case HandshakeState.ExpectingCertificate: + case HandshakeState.ExpectingServerKeyExchange: + case HandshakeState.ExpectingServerHelloDone: + this.SendClientHello(isRetransmit: true); + break; + + case HandshakeState.ExpectingChangeCipherSpec: + case HandshakeState.ExpectingFinished: + this.SendClientKeyExchangeFlight(isRetransmit: true); + break; + + case HandshakeState.Established: + default: + break; + } + } + } + } + } + + base.ResendPacketsIfNeeded(); + } + + /// <summary> + /// Flush any queued application data packets + /// </summary> + private void FlushQueuedApplicationData() + { + while (this.queuedApplicationData.TryDequeue(out var queuedData)) + { + base.HandleSend(queuedData.Bytes, queuedData.SendOption, queuedData.AckCallback); + } + } + + /// <summary> + /// Request from the application to write data to the DTLS + /// stream. If appropriate, returns a byte span to send to + /// the wire. + /// </summary> + /// <param name="bytes">Plaintext bytes to write</param> + /// <param name="length">Length of the bytes to write</param> + /// <returns> + /// Encrypted data to put on the wire if appropriate, + /// otherwise an empty span + /// </returns> + private ByteSpan WriteBytesToConnectionInternal(byte[] bytes, int length) + { + lock (this.syncRoot) + { + Record outgoinRecord = new Record(); + outgoinRecord.ContentType = ContentType.ApplicationData; + outgoinRecord.ProtocolVersion = DtlsVersion; + outgoinRecord.Epoch = this.epoch; + outgoinRecord.SequenceNumber = this.currentEpoch.NextOutgoingSequence; + outgoinRecord.Length = (ushort)this.currentEpoch.RecordProtection.GetEncryptedSize(length); + ++this.currentEpoch.NextOutgoingSequence; + + // Encode the record to wire format + ByteSpan packet = new byte[Record.Size + outgoinRecord.Length]; + ByteSpan writer = packet; + outgoinRecord.Encode(writer); + writer = writer.Slice(Record.Size); + new ByteSpan(bytes, 0, length).CopyTo(writer); + + // Protect the record + this.currentEpoch.RecordProtection.EncryptClientPlaintext( + packet.Slice(Record.Size, outgoinRecord.Length), + packet.Slice(Record.Size, length), + ref outgoinRecord + ); + + return packet; + } + } + + protected override void HandleSend(byte[] data, byte sendOption, Action ackCallback = null) + { + lock (this.syncRoot) + { + // If we're negotiating a new epoch, queue data + if (this.nextEpoch.State != HandshakeState.Established) + { + this.queuedApplicationData.Enqueue(new QueuedAppData + { + Bytes = data, + SendOption = sendOption, + AckCallback = ackCallback + }); + + return; + } + } + + base.HandleSend(data, sendOption, ackCallback); + } + + /// <inheritdoc /> + protected override void WriteBytesToConnection(byte[] bytes, int length) + { + ByteSpan wireData = this.WriteBytesToConnectionInternal(bytes, length); + if (wireData.Length > 0) + { + Debug.Assert(wireData.Offset == 0, "Got a non-zero write data offset"); + base.WriteBytesToConnection(wireData.GetUnderlyingArray(), wireData.Length); + } + } + + /// <inheritdoc /> + protected override void WriteBytesToConnectionSync(byte[] bytes, int length) + { + ByteSpan wireData = this.WriteBytesToConnectionInternal(bytes, length); + if (wireData.Length > 0) + { + Debug.Assert(wireData.Offset == 0, "Got a non-zero write data offset"); + base.WriteBytesToConnectionSync(wireData.GetUnderlyingArray(), wireData.Length); + } + } + + /// <inheritdoc /> + protected internal override void HandleReceive(MessageReader reader, int bytesReceived) + { + ByteSpan message = new ByteSpan(reader.Buffer, reader.Offset + reader.Position, reader.BytesRemaining); + lock (this.syncRoot) + { + this.HandleReceive(message); + } + + reader.Recycle(); + } + + /// <summary> + /// Handle an incoming datagram + /// </summary> + /// <param name="span">Bytes of the datagram</param> + private void HandleReceive(ByteSpan span) + { + // Each incoming packet may contain multiple DTLS + // records + while (span.Length > 0) + { + Record record; + if (!Record.Parse(out record, DtlsVersion, span)) + { + this.logger.WriteError("Dropping malformed record"); + return; + } + span = span.Slice(Record.Size); + + if (span.Length < record.Length) + { + this.logger.WriteError($"Dropping malformed record. Length({record.Length}) Available Bytes({span.Length})"); + return; + } + + ByteSpan recordPayload = span.Slice(0, record.Length); + span = span.Slice(record.Length); + + // Early out and drop ApplicationData records + if (record.ContentType == ContentType.ApplicationData && this.nextEpoch.State != HandshakeState.Established) + { + this.logger.WriteError("Dropping ApplicationData record. Cannot process yet"); + continue; + } + + // Drop records from a different epoch + if (record.Epoch != this.epoch) + { + this.logger.WriteError($"Dropping bad-epoch record. RecordEpoch({record.Epoch}) Epoch({this.epoch})"); + continue; + } + + // Prevent replay attacks by dropping records + // we've already processed + int windowIndex = (int)(this.currentEpoch.NextExpectedSequence - record.SequenceNumber - 1); + ulong windowMask = 1ul << windowIndex; + if (record.SequenceNumber < this.currentEpoch.NextExpectedSequence) + { + if (windowIndex >= 64) + { + this.logger.WriteError($"Dropping too-old record: Sequnce({record.SequenceNumber}) Expected({this.currentEpoch.NextExpectedSequence})"); + continue; + } + + if ((this.currentEpoch.PreviousSequenceWindowBitmask & windowMask) != 0) + { + this.logger.WriteWarning("Dropping duplicate record"); + continue; + } + } + + // Verify record authenticity + int decryptedSize = this.currentEpoch.RecordProtection.GetDecryptedSize(recordPayload.Length); + ByteSpan decryptedPayload = recordPayload.ReuseSpanIfPossible(decryptedSize); + + if (!this.currentEpoch.RecordProtection.DecryptCiphertextFromServer(decryptedPayload, recordPayload, ref record)) + { + this.logger.WriteError("Dropping non-authentic record"); + return; + } + + recordPayload = decryptedPayload; + + // Update out sequence number bookkeeping + if (record.SequenceNumber >= this.currentEpoch.NextExpectedSequence) + { + int windowShift = (int)(record.SequenceNumber + 1 - this.currentEpoch.NextExpectedSequence); + this.currentEpoch.PreviousSequenceWindowBitmask <<= windowShift; + this.currentEpoch.NextExpectedSequence = record.SequenceNumber + 1; + } + else + { + this.currentEpoch.PreviousSequenceWindowBitmask |= windowMask; + } + + // This is handy for debugging, but too verbose even for verbose. + // this.logger.WriteVerbose($"Content type was {record.ContentType} ({this.nextEpoch.State})"); + switch (record.ContentType) + { + case ContentType.ChangeCipherSpec: + if (this.nextEpoch.State != HandshakeState.ExpectingChangeCipherSpec) + { + this.logger.WriteError($"Dropping unexpected ChangeCipherSpec State({this.nextEpoch.State})"); + break; + } + else if (this.nextEpoch.RecordProtection == null) + { + ///NOTE(mendsley): This _should_ not + /// happen on a well-formed client. + Debug.Assert(false, "How did we receive a ChangeCipherSpec message without a pending record protection instance?"); + break; + } + + if (!ChangeCipherSpec.Parse(recordPayload)) + { + this.logger.WriteError("Dropping malformed ChangeCipherSpec message"); + break; + } + + // Migrate to the next epoch + this.epoch = this.nextEpoch.Epoch; + this.currentEpoch.RecordProtection = this.nextEpoch.RecordProtection; + this.currentEpoch.NextOutgoingSequence = this.nextEpoch.NextOutgoingSequence; + this.currentEpoch.NextExpectedSequence = 1; + this.currentEpoch.PreviousSequenceWindowBitmask = 0; + + this.nextEpoch.State = HandshakeState.ExpectingFinished; + this.nextEpoch.SelectedCipherSuite = CipherSuite.TLS_NULL_WITH_NULL_NULL; + this.nextEpoch.RecordProtection = null; + this.nextEpoch.Handshake?.Dispose(); + this.nextEpoch.Cookie = ByteSpan.Empty; + this.nextEpoch.VerificationStream.Reset(); + this.nextEpoch.ServerPublicKey = null; + this.nextEpoch.ServerRandom.SecureClear(); + this.nextEpoch.ClientRandom.SecureClear(); + this.nextEpoch.MasterSecret.SecureClear(); + break; + + case ContentType.Alert: + this.logger.WriteError("Dropping unsupported alert record"); + continue; + + case ContentType.Handshake: + if (!ProcessHandshake(ref record, recordPayload)) + { + return; + } + break; + + case ContentType.ApplicationData: + // Forward data to the application + MessageReader reader = MessageReader.GetSized(recordPayload.Length); + reader.Length = recordPayload.Length; + recordPayload.CopyTo(reader.Buffer); + + base.HandleReceive(reader, recordPayload.Length); + break; + } + } + } + + /// <summary> + /// Process an incoming Handshake protocol message + /// </summary> + /// <param name="record">Parent record</param> + /// <param name="message">Record payload</param> + /// <returns> + /// True if further processing of the underlying datagram + /// should be continues. Otherwise, false. + /// </returns> + private bool ProcessHandshake(ref Record record, ByteSpan message) + { + // Each record may have multiple Handshake messages + while (message.Length > 0) + { + ByteSpan originalPayload = message; + + Handshake handshake; + if (!Handshake.Parse(out handshake, message)) + { + this.logger.WriteError("Dropping malformed handshake message"); + return false; + } + message = message.Slice(Handshake.Size); + + // Check for fragmented messages + if (handshake.FragmentOffset != 0 || handshake.FragmentLength != handshake.Length) + { + // We only support fragmentation on Certificate messages + if (handshake.MessageType != HandshakeType.Certificate) + { + this.logger.WriteError($"Dropping fragmented handshake message Type({handshake.MessageType}) Offset({handshake.FragmentOffset}) FragmentLength({handshake.FragmentLength}) Length({handshake.Length})"); + continue; + } + + if (message.Length < handshake.FragmentLength) + { + this.logger.WriteError($"Dropping malformed fragmented handshake message: AvailableBytes({message.Length}) Size({handshake.FragmentLength})"); + return false; + } + + originalPayload = originalPayload.Slice(0, (int)(Handshake.Size + handshake.FragmentLength)); + message = message.Slice((int)handshake.FragmentLength); + } + else + { + if (message.Length < handshake.Length) + { + this.logger.WriteError($"Dropping malformed handshake message: AvailableBytes({message.Length}) Size({handshake.Length})"); + return false; + } + + originalPayload = originalPayload.Slice(0, (int)(Handshake.Size + handshake.Length)); + message = message.Slice((int)handshake.Length); + } + + ByteSpan payload = originalPayload.Slice(Handshake.Size); + +#if DEBUG + this.logger.WriteVerbose($"Handshake record was {handshake.MessageType} (Frag: {handshake.FragmentOffset}) ({this.nextEpoch.State})"); +#endif + switch (handshake.MessageType) + { + case HandshakeType.HelloVerifyRequest: + if (this.nextEpoch.State != HandshakeState.ExpectingServerHello) + { + this.logger.WriteError($"Dropping unexpected HelloVerifyRequest handshake message State({this.nextEpoch.State})"); + continue; + } + else if (handshake.MessageSequence != 0) + { + this.logger.WriteError($"Dropping bad-sequence HelloVerifyRequest MessageSequence({handshake.MessageSequence})"); + continue; + } + + HelloVerifyRequest helloVerifyRequest; + if (!HelloVerifyRequest.Parse(out helloVerifyRequest, DtlsVersion, payload)) + { + this.logger.WriteError("Dropping malformed HelloVerifyRequest handshake message"); + continue; + } + + // If the cookie differs, save it and restart the handshake + if (this.nextEpoch.Cookie.Length == helloVerifyRequest.Cookie.Length + && Const.ConstantCompareSpans(this.nextEpoch.Cookie, helloVerifyRequest.Cookie) == 1) + { + this.logger.WriteWarning("Dropping duplicate HelloVerifyRequest handshake message"); + continue; + } + + this.nextEpoch.Cookie = new byte[helloVerifyRequest.Cookie.Length]; + helloVerifyRequest.Cookie.CopyTo(this.nextEpoch.Cookie); + this.nextEpoch.ClientRandom.FillWithRandom(this.random); + + // We don't need to resend here. We already have the cookie so we already sent it once. + this.SendClientHello(isRetransmit: false); + + break; + + case HandshakeType.ServerHello: + if (this.nextEpoch.State != HandshakeState.ExpectingServerHello) + { + this.logger.WriteError($"Dropping unexpected ServerHello handshake message State({this.nextEpoch.State})"); + continue; + } + else if (handshake.MessageSequence != 1) + { + this.logger.WriteError($"Dropping bad-sequence ServerHello MessageSequence({handshake.MessageSequence})"); + continue; + } + + ServerHello serverHello; + if (!ServerHello.Parse(out serverHello, payload)) + { + this.logger.WriteError("Dropping malformed ServerHello message"); + continue; + } + + switch (serverHello.CipherSuite) + { + case CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: + this.nextEpoch.Handshake = new X25519EcdheRsaSha256(this.random); + break; + + default: + this.logger.WriteError($"Dropping malformed ServerHello message. Unsupported CipherSuite({serverHello.CipherSuite})"); + continue; + } + + // Save server parameters + this.nextEpoch.SelectedCipherSuite = serverHello.CipherSuite; + serverHello.Random.CopyTo(this.nextEpoch.ServerRandom); + this.nextEpoch.State = HandshakeState.ExpectingCertificate; + this.nextEpoch.CertificateFragments.Clear(); + this.nextEpoch.CertificatePayload = ByteSpan.Empty; + +#if DEBUG + this.logger.WriteVerbose($"ClientRandom: {this.nextEpoch.ClientRandom} ServerRandom: {this.nextEpoch.ServerRandom}"); +#endif + + // Append ServerHelllo message to the verification stream + this.nextEpoch.VerificationStream.AddData(originalPayload); + break; + + case HandshakeType.Certificate: + if (this.nextEpoch.State != HandshakeState.ExpectingCertificate) + { + this.logger.WriteError($"Dropping unexpected Certificate handshake message State({this.nextEpoch.State})"); + continue; + } + else if (handshake.MessageSequence != 2) + { + this.logger.WriteError($"Dropping bad-sequence Certificate MessageSequence({handshake.MessageSequence})"); + continue; + } + + // If this is a fragmented message + if (handshake.FragmentLength != handshake.Length) + { + if (this.nextEpoch.CertificatePayload.Length != handshake.Length) + { + this.nextEpoch.CertificatePayload = new byte[handshake.Length]; + this.nextEpoch.CertificateFragments.Clear(); + } + + // Should we add this fragment? + // According to the RFC 9147 Section 5.5, we are supposed to be tolerant of overlapping segments + // But if we... weren't... Hazel isn't going to change the fragment sizes. So would it really hurt? + // So let's just ignore that and assume that the sender always wants to send the same fragments. + if (IsFragmentOverlapping(this.nextEpoch.CertificateFragments, handshake.FragmentOffset, handshake.FragmentLength)) + { + continue; + } + + payload.CopyTo(this.nextEpoch.CertificatePayload.Slice((int)handshake.FragmentOffset, (int)handshake.FragmentLength)); + this.nextEpoch.CertificateFragments.Add(new FragmentRange {Offset = (int)handshake.FragmentOffset, Length = (int)handshake.FragmentLength }); + this.nextEpoch.CertificateFragments.Sort((FragmentRange lhs, FragmentRange rhs) => { + return lhs.Offset.CompareTo(rhs.Offset); + }); + + // Have we completed the message? + int currentOffset = 0; + bool valid = true; + foreach (FragmentRange range in this.nextEpoch.CertificateFragments) + { + if (range.Offset != currentOffset) + { + valid = false; + break; + } + + currentOffset += range.Length; + } + + if (currentOffset != this.nextEpoch.CertificatePayload.Length) + { + valid = false; + } + + // Still waiting on more fragments? + if (!valid) + { + continue; + } + + // Replace the message payload, and continue + this.nextEpoch.CertificateFragments.Clear(); + payload = this.nextEpoch.CertificatePayload; + } + + X509Certificate2 certificate; + if (!Certificate.Parse(out certificate, payload)) + { + this.logger.WriteError("Dropping malformed Certificate message"); + continue; + } + + // Verify the certificate is authenticate + if (!this.serverCertificates.Contains(certificate)) + { + this.logger.WriteError("Dropping malformed Certificate message: Certificate not authentic"); + continue; + } + + RSA publicKey = certificate.PublicKey.Key as RSA; + if (publicKey == null) + { + this.logger.WriteError("Dropping malfomed Certificate message: Certificate is not RSA signed"); + continue; + } + + // Add the final Certificate message to the verification stream + Handshake fullCertificateHandhake = handshake; + fullCertificateHandhake.FragmentOffset = 0; + fullCertificateHandhake.FragmentLength = fullCertificateHandhake.Length; + + ByteSpan serializedCertificateHandshake = new byte[Handshake.Size]; + fullCertificateHandhake.Encode(serializedCertificateHandshake); + this.nextEpoch.VerificationStream.AddData(serializedCertificateHandshake); + this.nextEpoch.VerificationStream.AddData(payload); + + this.nextEpoch.ServerPublicKey = publicKey; + this.nextEpoch.State = HandshakeState.ExpectingServerKeyExchange; + break; + + case HandshakeType.ServerKeyExchange: + if (this.nextEpoch.State != HandshakeState.ExpectingServerKeyExchange) + { + this.logger.WriteError($"Dropping unexpected ServerKeyExchange handshake message State({this.nextEpoch.State})"); + continue; + } + else if (this.nextEpoch.ServerPublicKey == null) + { + ///NOTE(mendsley): This _should_ not + /// happen on a well-formed client + Debug.Assert(false, "How are we processing a ServerKeyExchange message without a server public key?"); + + this.logger.WriteError($"Dropping unexpected ServerKeyExchange handshake message: No server public key"); + continue; + } + else if (this.nextEpoch.Handshake == null) + { + ///NOTE(mendsley): This _should_ not + /// happen on a well-formed client + Debug.Assert(false, "How did we receive a ServerKeyExchange message without a handshake instance?"); + + this.logger.WriteError($"Dropping unexpected ServerKeyExchange handshake message: No key agreement interface"); + continue; + } + else if (handshake.MessageSequence != 3) + { + this.logger.WriteError($"Dropping bad-sequence ServerKeyExchange MessageSequence({handshake.MessageSequence})"); + continue; + } + + ByteSpan sharedSecret = new byte[this.nextEpoch.Handshake.SharedKeySize()]; + if (!this.nextEpoch.Handshake.VerifyServerMessageAndGenerateSharedKey(sharedSecret, payload, this.nextEpoch.ServerPublicKey)) + { + this.logger.WriteError("Dropping malformed ServerKeyExchangeMessage"); + return false; + } + + // Generate the session master secret + ByteSpan randomSeed = new byte[2 * Random.Size]; + this.nextEpoch.ClientRandom.CopyTo(randomSeed); + this.nextEpoch.ServerRandom.CopyTo(randomSeed.Slice(Random.Size)); + + const int MasterSecretSize = 48; + ByteSpan masterSecret = new byte[MasterSecretSize]; + PrfSha256.ExpandSecret( + masterSecret + , sharedSecret + , PrfLabel.MASTER_SECRET + , randomSeed + ); + + // Create record protection for the upcoming epoch + switch (this.nextEpoch.SelectedCipherSuite) + { + case CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: + this.nextEpoch.RecordProtection = new Aes128GcmRecordProtection( + masterSecret + , this.nextEpoch.ServerRandom + , this.nextEpoch.ClientRandom + ); + break; + + default: + ///NOTE(mendsley): this _should_ not + /// happen on a well-formed client. + Debug.Assert(false, "SeverHello processing already approved this ciphersuite"); + + this.logger.WriteError($"Dropping malformed ServerKeyExchangeMessage: Could not create record protection"); + return false; + } + + this.nextEpoch.State = HandshakeState.ExpectingServerHelloDone; + this.nextEpoch.MasterSecret = masterSecret; + + // Append ServerKeyExchange to the verification stream + this.nextEpoch.VerificationStream.AddData(originalPayload); + break; + + case HandshakeType.ServerHelloDone: + if (this.nextEpoch.State != HandshakeState.ExpectingServerHelloDone) + { + this.logger.WriteError($"Dropping unexpected ServerHelloDone handshake message State({this.nextEpoch.State})"); + continue; + } + else if (handshake.MessageSequence != 4) + { + this.logger.WriteError($"Dropping bad-sequence ServerHelloDone MessageSequence({handshake.MessageSequence})"); + continue; + } + + this.nextEpoch.State = HandshakeState.ExpectingChangeCipherSpec; + + // Append ServerHelloDone to the verification stream + this.nextEpoch.VerificationStream.AddData(originalPayload); + + this.SendClientKeyExchangeFlight(isRetransmit: false); + break; + + case HandshakeType.Finished: + if (this.nextEpoch.State != HandshakeState.ExpectingFinished) + { + this.logger.WriteError($"Dropping unexpected Finished handshake message State({this.nextEpoch.State})"); + continue; + } + else if (payload.Length != Finished.Size) + { + this.logger.WriteError($"Dropping malformed Finished handshake message Size({payload.Length})"); + continue; + } + else if (handshake.MessageSequence != 7) + { + this.logger.WriteError($"Dropping bad-sequence Finished MessageSequence({handshake.MessageSequence})"); + continue; + } + + // Verify the digest from the server + if (1 != Crypto.Const.ConstantCompareSpans(payload, this.nextEpoch.ServerVerification)) + { + this.logger.WriteError("Dropping non-verified Finished handshake message"); + return false; + } + + ++this.nextEpoch.Epoch; + this.nextEpoch.State = HandshakeState.Established; + this.nextEpoch.NegotiationStartTime = DateTime.MinValue; + this.nextEpoch.NextPacketResendTime = DateTime.MinValue; + this.nextEpoch.ServerVerification.SecureClear(); + this.nextEpoch.MasterSecret.SecureClear(); + + this.FlushQueuedApplicationData(); + break; + + // Drop messages we do not support + case HandshakeType.CertificateRequest: + case HandshakeType.HelloRequest: + this.logger.WriteError($"Dropping unsupported handshake message MessageType({handshake.MessageType})"); + break; + + // Drop messages that originate from the client + case HandshakeType.ClientHello: + case HandshakeType.ClientKeyExchange: + case HandshakeType.CertificateVerify: + this.logger.WriteError($"Dropping client handshake message MessageType({handshake.MessageType})"); + break; + } + } + + return true; + } + + private bool IsFragmentOverlapping(List<FragmentRange> fragments, uint newOffset, uint newLength) + { + foreach (var frag in fragments) + { + // New fragment overlaps an existing one + if (newOffset <= frag.Offset + && frag.Offset < newOffset + newLength) + { + return true; + } + + // Existing fragment overlaps this new one + if (frag.Offset <= newOffset + && newOffset < frag.Offset + frag.Length) + { + return true; + } + } + + return false; + } + + /// <summary> + /// Send (resend) a ClientHello message to the server + /// </summary> + protected virtual void SendClientHello(bool isRetransmit) + { +#if DEBUG + var verb = isRetransmit ? "Resending" : "Sending"; + this.logger.WriteVerbose($"{verb} ClientHello in state: {this.nextEpoch.State}. Epoch: {this.epoch} Cookie: {this.nextEpoch.Cookie} Random: {this.nextEpoch.ClientRandom}"); +#endif + + // Describe our ClientHello flight + ClientHello clientHello = new ClientHello(); + clientHello.ClientProtocolVersion = DtlsVersion; + clientHello.Random = this.nextEpoch.ClientRandom; + clientHello.Cookie = this.nextEpoch.Cookie; + clientHello.Session = new HazelDtlsSessionInfo(this.HazelSessionVersion); + clientHello.CipherSuites = new byte[2]; + clientHello.CipherSuites.WriteBigEndian16((ushort)CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); + clientHello.SupportedCurves = new byte[2]; + clientHello.SupportedCurves.WriteBigEndian16((ushort)NamedCurve.x25519); + + Handshake handshake = new Handshake(); + handshake.MessageType = HandshakeType.ClientHello; + handshake.Length = (uint)clientHello.CalculateSize(); + handshake.MessageSequence = 0; + handshake.FragmentOffset = 0; + handshake.FragmentLength = handshake.Length; + + // Describe the record + int plaintextLength = (int)(Handshake.Size + handshake.Length); + Record outgoingRecord = new Record(); + outgoingRecord.ContentType = ContentType.Handshake; + outgoingRecord.ProtocolVersion = DtlsVersion; + outgoingRecord.Epoch = this.epoch; + outgoingRecord.SequenceNumber = this.currentEpoch.NextOutgoingSequence; + outgoingRecord.Length = (ushort)this.currentEpoch.RecordProtection.GetEncryptedSize(plaintextLength); + ++this.currentEpoch.NextOutgoingSequence; + + // Convert the record to wire format + ByteSpan packet = new byte[Record.Size + outgoingRecord.Length]; + ByteSpan writer = packet; + outgoingRecord.Encode(packet); + writer = writer.Slice(Record.Size); + handshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + clientHello.Encode(writer); + + // If this is our first valid attempt at contacting the server: + // - Reset our verification stream + // - Write ClientHello to the verification stream + // - We next expect a ServerHello + // + // ClientHello+Cookie triggers many sequential packets in response + // It's important to make forward progress as the packets may be reordered in-flight + // But with enough resends, we will read them all in an appropriate order + if (!isRetransmit) + { + this.nextEpoch.VerificationStream.Reset(); + this.nextEpoch.VerificationStream.AddData( + packet.Slice(Record.Size, Handshake.Size + (int)handshake.Length) + ); + + this.nextEpoch.State = HandshakeState.ExpectingServerHello; + } + + // Protect the record + this.currentEpoch.RecordProtection.EncryptClientPlaintext( + packet.Slice(Record.Size, outgoingRecord.Length), + packet.Slice(Record.Size, plaintextLength), + ref outgoingRecord + ); + + if (this.nextEpoch.NegotiationStartTime == DateTime.MinValue) this.nextEpoch.NegotiationStartTime = DateTime.UtcNow; + this.nextEpoch.NextPacketResendTime = DateTime.UtcNow + this.handshakeResendTimeout; + + base.WriteBytesToConnection(packet.GetUnderlyingArray(), packet.Length); + } + + protected void Test_SendClientHello(Func<ClientHello, ByteSpan, ByteSpan> encodeCallback) + { + // Reset our verification stream + this.nextEpoch.VerificationStream.Reset(); + + // Describe our ClientHello flight + ClientHello clientHello = new ClientHello(); + clientHello.Random = this.nextEpoch.ClientRandom; + clientHello.Cookie = this.nextEpoch.Cookie; + clientHello.CipherSuites = new byte[2]; + clientHello.CipherSuites.WriteBigEndian16((ushort)CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); + clientHello.SupportedCurves = new byte[2]; + clientHello.SupportedCurves.WriteBigEndian16((ushort)NamedCurve.x25519); + + Handshake handshake = new Handshake(); + handshake.MessageType = HandshakeType.ClientHello; + handshake.Length = (uint)clientHello.CalculateSize(); + handshake.MessageSequence = 0; + handshake.FragmentOffset = 0; + handshake.FragmentLength = handshake.Length; + + // Describe the record + int plaintextLength = (int)(Handshake.Size + handshake.Length); + Record outgoingRecord = new Record(); + outgoingRecord.ContentType = ContentType.Handshake; + outgoingRecord.ProtocolVersion = DtlsVersion; + outgoingRecord.Epoch = this.epoch; + outgoingRecord.SequenceNumber = this.currentEpoch.NextOutgoingSequence; + outgoingRecord.Length = (ushort)this.currentEpoch.RecordProtection.GetEncryptedSize(plaintextLength); + ++this.currentEpoch.NextOutgoingSequence; + + // Convert the record to wire format + ByteSpan packet = new byte[Record.Size + outgoingRecord.Length]; + ByteSpan writer = packet; + outgoingRecord.Encode(packet); + writer = writer.Slice(Record.Size); + handshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + + writer = encodeCallback(clientHello, writer); + + // Write ClientHello to the verification stream + this.nextEpoch.VerificationStream.AddData( + packet.Slice( + Record.Size + , Handshake.Size + (int)handshake.Length + ) + ); + + // Protect the record + this.currentEpoch.RecordProtection.EncryptClientPlaintext( + packet.Slice(Record.Size, outgoingRecord.Length), + packet.Slice(Record.Size, plaintextLength), + ref outgoingRecord + ); + + this.nextEpoch.State = HandshakeState.ExpectingServerHello; + if (this.nextEpoch.NegotiationStartTime == DateTime.MinValue) this.nextEpoch.NegotiationStartTime = DateTime.UtcNow; + this.nextEpoch.NextPacketResendTime = DateTime.UtcNow + this.handshakeResendTimeout; + base.WriteBytesToConnection(packet.GetUnderlyingArray(), packet.Length); + } + + /// <summary> + /// Send (resend) the ClientKeyExchange flight + /// </summary> + /// <param name="isRetransmit"> + /// True if this is a retransmit of the flight. Otherwise, + /// false + /// </param> + protected virtual void SendClientKeyExchangeFlight(bool isRetransmit) + { +#if DEBUG + var verb = isRetransmit ? "Resending" : "Sending"; + this.logger.WriteVerbose($"{verb} ClientKeyExchangeFlight in state: {this.nextEpoch.State}"); +#endif + if (this.nextEpoch.State == HandshakeState.Established) + { + return; + } + + // Describe our flight + Handshake keyExchangeHandshake = new Handshake(); + keyExchangeHandshake.MessageType = HandshakeType.ClientKeyExchange; + keyExchangeHandshake.Length = (ushort)this.nextEpoch.Handshake.CalculateClientMessageSize(); + keyExchangeHandshake.MessageSequence = 5; + keyExchangeHandshake.FragmentOffset = 0; + keyExchangeHandshake.FragmentLength = keyExchangeHandshake.Length; + + Record keyExchangeRecord = new Record(); + keyExchangeRecord.ContentType = ContentType.Handshake; + keyExchangeRecord.ProtocolVersion = DtlsVersion; + keyExchangeRecord.Epoch = this.epoch; + keyExchangeRecord.SequenceNumber = this.currentEpoch.NextOutgoingSequence; + keyExchangeRecord.Length = (ushort)this.currentEpoch.RecordProtection.GetEncryptedSize(Handshake.Size + (int)keyExchangeHandshake.Length); + ++this.currentEpoch.NextOutgoingSequence; + + Record changeCipherSpecRecord = new Record(); + changeCipherSpecRecord.ContentType = ContentType.ChangeCipherSpec; + changeCipherSpecRecord.ProtocolVersion = DtlsVersion; + changeCipherSpecRecord.Epoch = this.epoch; + changeCipherSpecRecord.SequenceNumber = this.currentEpoch.NextOutgoingSequence; + changeCipherSpecRecord.Length = (ushort)this.currentEpoch.RecordProtection.GetEncryptedSize(ChangeCipherSpec.Size); + ++this.currentEpoch.NextOutgoingSequence; + + Handshake finishedHandshake = new Handshake(); + finishedHandshake.MessageType = HandshakeType.Finished; + finishedHandshake.Length = Finished.Size; + finishedHandshake.MessageSequence = 6; + finishedHandshake.FragmentOffset = 0; + finishedHandshake.FragmentLength = finishedHandshake.Length; + + Record finishedRecord = new Record(); + finishedRecord.ContentType = ContentType.Handshake; + finishedRecord.ProtocolVersion = DtlsVersion; + finishedRecord.Epoch = this.nextEpoch.Epoch; + finishedRecord.SequenceNumber = this.nextEpoch.NextOutgoingSequence; + finishedRecord.Length = (ushort)this.nextEpoch.RecordProtection.GetEncryptedSize(Handshake.Size + (int)finishedHandshake.Length); + ++this.nextEpoch.NextOutgoingSequence; + + // Encode flight to wire format + int packetLength = 0 + + Record.Size + keyExchangeRecord.Length + + Record.Size + changeCipherSpecRecord.Length + + Record.Size + finishedRecord.Length; + ; + ByteSpan packet = new byte[packetLength]; + ByteSpan writer = packet; + + keyExchangeRecord.Encode(writer); + writer = writer.Slice(Record.Size); + keyExchangeHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + this.nextEpoch.Handshake.EncodeClientKeyExchangeMessage(writer); + + ByteSpan startOfChangeCipherSpecRecord = packet.Slice(Record.Size + keyExchangeRecord.Length); + writer = startOfChangeCipherSpecRecord; + changeCipherSpecRecord.Encode(writer); + writer = writer.Slice(Record.Size); + ChangeCipherSpec.Encode(writer); + writer = writer.Slice(ChangeCipherSpec.Size); + + ByteSpan startOfFinishedRecord = startOfChangeCipherSpecRecord.Slice(Record.Size + changeCipherSpecRecord.Length); + writer = startOfFinishedRecord; + finishedRecord.Encode(writer); + writer = writer.Slice(Record.Size); + finishedHandshake.Encode(writer); + writer = writer.Slice(Handshake.Size); + + // Interject here to writer our client key exchange + // message into the verification stream + if (!isRetransmit) + { + this.nextEpoch.VerificationStream.AddData( + packet.Slice( + Record.Size + , Handshake.Size + (int)keyExchangeHandshake.Length + ) + ); + } + + // Calculate the hash of the verification stream + ByteSpan handshakeHash = new byte[Sha256Stream.DigestSize]; + this.nextEpoch.VerificationStream.CopyOrCalculateFinalHash(handshakeHash); + + // Expand our master secret into Finished digests for the client and server + PrfSha256.ExpandSecret( + this.nextEpoch.ServerVerification + , this.nextEpoch.MasterSecret + , PrfLabel.SERVER_FINISHED + , handshakeHash + ); + + PrfSha256.ExpandSecret( + writer.Slice(0, Finished.Size) + , this.nextEpoch.MasterSecret + , PrfLabel.CLIENT_FINISHED + , handshakeHash + ); + writer = writer.Slice(Finished.Size); + + // Protect the ClientKeyExchange record + this.currentEpoch.RecordProtection.EncryptClientPlaintext( + packet.Slice(Record.Size, keyExchangeRecord.Length), + packet.Slice(Record.Size, Handshake.Size + (int)keyExchangeHandshake.Length), + ref keyExchangeRecord + ); + + // Protect the ChangeCipherSpec record + this.currentEpoch.RecordProtection.EncryptClientPlaintext( + startOfChangeCipherSpecRecord.Slice(Record.Size, changeCipherSpecRecord.Length), + startOfChangeCipherSpecRecord.Slice(Record.Size, ChangeCipherSpec.Size), + ref changeCipherSpecRecord + ); + + // Protect the Finished record + this.nextEpoch.RecordProtection.EncryptClientPlaintext( + startOfFinishedRecord.Slice(Record.Size, finishedRecord.Length), + startOfFinishedRecord.Slice(Record.Size, Handshake.Size + (int)finishedHandshake.Length), + ref finishedRecord + ); + + this.nextEpoch.State = HandshakeState.ExpectingChangeCipherSpec; + this.nextEpoch.NextPacketResendTime = DateTime.UtcNow + this.handshakeResendTimeout; +#if DEBUG + if (DropClientKeyExchangeFlight()) + { + return; + } +#endif + base.WriteBytesToConnection(packet.GetUnderlyingArray(), packet.Length); + } + + protected virtual bool DropClientKeyExchangeFlight() + { + return false; + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/Handshake.cs b/Tools/Hazel-Networking/Hazel/Dtls/Handshake.cs new file mode 100644 index 0000000..f840053 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/Handshake.cs @@ -0,0 +1,734 @@ +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.Net; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; + +namespace Hazel.Dtls +{ + /// <summary> + /// Handshake message type + /// </summary> + public enum HandshakeType : byte + { + HelloRequest = 0, + ClientHello = 1, + ServerHello = 2, + HelloVerifyRequest = 3, + Certificate = 11, + ServerKeyExchange = 12, + CertificateRequest = 13, + ServerHelloDone = 14, + CertificateVerify = 15, + ClientKeyExchange = 16, + Finished = 20, + } + + /// <summary> + /// List of cipher suites + /// </summary> + public enum CipherSuite + { + TLS_NULL_WITH_NULL_NULL = 0x0000, + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xC02F, + } + + /// <summary> + /// List of compression methods + /// </summary> + public enum CompressionMethod : byte + { + Null = 0, + } + + /// <summary> + /// Extension type + /// </summary> + public enum ExtensionType : ushort + { + EllipticCurves = 10, + } + + /// <summary> + /// Named curves + /// </summary> + public enum NamedCurve : ushort + { + Reserved = 0, + secp256r1 = 23, + x25519 = 29, + } + + /// <summary> + /// Elliptic curve type + /// </summary> + public enum ECCurveType : byte + { + NamedCurve = 3, + } + + /// <summary> + /// Hash algorithms + /// </summary> + public enum HashAlgorithm : byte + { + None = 0, + Sha256 = 4, + } + + /// <summary> + /// Signature algorithms + /// </summary> + public enum SignatureAlgorithm : byte + { + Anonymous = 0, + RSA = 1, + ECDSA = 3, + } + + /// <summary> + /// Random state for entropy + /// </summary> + public struct Random + { + public const int Size = 0 + + 4 // gmt_unix_time + + 28 // random_bytes + ; + } + + /// <summary> + /// Encode/decode handshake protocol header + /// </summary> + public struct Handshake + { + public HandshakeType MessageType; + public uint Length; + public ushort MessageSequence; + public uint FragmentOffset; + public uint FragmentLength; + + public const int Size = 12; + + /// <summary> + /// Parse a Handshake protocol header from wire format + /// </summary> + /// <returns>True if we successfully decode a handshake header. Otherwise false</returns> + public static bool Parse(out Handshake header, ByteSpan span) + { + header = new Handshake(); + + if (span.Length < Size) + { + return false; + } + + header.MessageType = (HandshakeType)span[0]; + header.Length = span.ReadBigEndian24(1); + header.MessageSequence = span.ReadBigEndian16(4); + header.FragmentOffset = span.ReadBigEndian24(6); + header.FragmentLength = span.ReadBigEndian24(9); + return true; + } + + /// <summary> + /// Encode the Handshake protocol header to wire format + /// </summary> + /// <param name="span"></param> + public void Encode(ByteSpan span) + { + span[0] = (byte)this.MessageType; + span.WriteBigEndian24(this.Length, 1); + span.WriteBigEndian16(this.MessageSequence, 4); + span.WriteBigEndian24(this.FragmentOffset, 6); + span.WriteBigEndian24(this.FragmentLength, 9); + } + } + + /// <summary> + /// Encode/decode ClientHello Handshake message + /// </summary> + public struct ClientHello + { + public ProtocolVersion ClientProtocolVersion; + public ByteSpan Random; + public ByteSpan Cookie; + public HazelDtlsSessionInfo Session; + public ByteSpan CipherSuites; + public ByteSpan SupportedCurves; + + public const int MinSize = 0 + + 2 // client_version + + Dtls.Random.Size // random + + 1 // session_id (size) + + 1 // cookie (size) + + 2 // cipher_suites (size) + + 1 // compression_methods (size) + + 1 // compression_method[0] (NULL) + + + 2 // extensions size + + + 0 // NamedCurveList extensions[0] + + 2 // extensions[0].extension_type + + 2 // extensions[0].extension_data (length) + + 2 // extensions[0].named_curve_list (size) + ; + + /// <summary> + /// Calculate the size in bytes required for the ClientHello payload + /// </summary> + /// <returns></returns> + public int CalculateSize() + { + return MinSize + + this.Session.PayloadSize + + this.Cookie.Length + + this.CipherSuites.Length + + this.SupportedCurves.Length + ; + } + + /// <summary> + /// Parse a Handshake ClientHello payload from wire format + /// </summary> + /// <returns>True if we successfully decode the ClientHello message. Otherwise false</returns> + public static bool Parse(out ClientHello result, ProtocolVersion? expectedProtocolVersion, ByteSpan span) + { + result = new ClientHello(); + if (span.Length < MinSize) + { + return false; + } + + result.ClientProtocolVersion = (ProtocolVersion)span.ReadBigEndian16(); + if (expectedProtocolVersion.HasValue && result.ClientProtocolVersion != expectedProtocolVersion.Value) + { + return false; + } + + span = span.Slice(2); + + result.Random = span.Slice(0, Dtls.Random.Size); + span = span.Slice(Dtls.Random.Size); + + if (!HazelDtlsSessionInfo.Parse(out result.Session, span)) + { + return false; + } + + span = span.Slice(result.Session.FullSize); + + byte cookieSize = span[0]; + if (span.Length < 1 + cookieSize) + { + return false; + } + result.Cookie = span.Slice(1, cookieSize); + span = span.Slice(1 + cookieSize); + + ushort cipherSuiteSize = span.ReadBigEndian16(); + if (span.Length < 2 + cipherSuiteSize) + { + return false; + } + else if (cipherSuiteSize % 2 != 0) + { + return false; + } + result.CipherSuites = span.Slice(2, cipherSuiteSize); + span = span.Slice(2 + cipherSuiteSize); + + int compressionMethodsSize = span[0]; + bool foundNullCompressionMethod = false; + for (int ii = 0; ii != compressionMethodsSize; ++ii) + { + if (span[1+ii] == (byte)CompressionMethod.Null) + { + foundNullCompressionMethod = true; + break; + } + } + + if (!foundNullCompressionMethod + || span.Length < 1 + compressionMethodsSize) + { + return false; + } + + span = span.Slice(1 + compressionMethodsSize); + + // Parse extensions + if (span.Length > 0) + { + if (span.Length < 2) + { + return false; + } + + ushort extensionsSize = span.ReadBigEndian16(); + span = span.Slice(2); + if (span.Length != extensionsSize) + { + return false; + } + + while (span.Length > 0) + { + // Parse extension header + if (span.Length < 4) + { + return false; + } + + ExtensionType extensionType = (ExtensionType)span.ReadBigEndian16(0); + ushort extensionLength = span.ReadBigEndian16(2); + + if (span.Length < 4 + extensionLength) + { + return false; + } + + ByteSpan extensionData = span.Slice(4, extensionLength); + span = span.Slice(4 + extensionLength); + result.ParseExtension(extensionType, extensionData); + } + } + + return true; + } + + /// <summary> + /// Decode a ClientHello extension + /// </summary> + /// <param name="extensionType">Extension type</param> + /// <param name="extensionData">Extension data</param> + private void ParseExtension(ExtensionType extensionType, ByteSpan extensionData) + { + switch (extensionType) + { + case ExtensionType.EllipticCurves: + if (extensionData.Length % 2 != 0) + { + break; + } + else if (extensionData.Length < 2) + { + break; + } + + ushort namedCurveSize = extensionData.ReadBigEndian16(0); + if (namedCurveSize % 2 != 0) + { + break; + } + + this.SupportedCurves = extensionData.Slice(2, namedCurveSize); + break; + } + } + + /// <summary> + /// Determines if the ClientHello message advertises support + /// for the specified cipher suite + /// </summary> + public bool ContainsCipherSuite(CipherSuite cipherSuite) + { + ByteSpan iterator = this.CipherSuites; + while (iterator.Length >= 2) + { + if (iterator.ReadBigEndian16() == (ushort)cipherSuite) + { + return true; + } + + iterator = iterator.Slice(2); + } + + return false; + } + + /// <summary> + /// Determines if the ClientHello message advertises support + /// for the specified curve + /// </summary> + public bool ContainsCurve(NamedCurve curve) + { + ByteSpan iterator = this.SupportedCurves; + while (iterator.Length >= 2) + { + if (iterator.ReadBigEndian16() == (ushort)curve) + { + return true; + } + + iterator = iterator.Slice(2); + } + + return false; + } + + /// <summary> + /// Encode Handshake ClientHello payload to wire format + /// </summary> + public void Encode(ByteSpan span) + { + span.WriteBigEndian16((ushort)this.ClientProtocolVersion); + span = span.Slice(2); + + Debug.Assert(this.Random.Length == Dtls.Random.Size); + this.Random.CopyTo(span); + span = span.Slice(Dtls.Random.Size); + + this.Session.Encode(span); + span = span.Slice(this.Session.FullSize); + + span[0] = (byte)this.Cookie.Length; + this.Cookie.CopyTo(span.Slice(1)); + span = span.Slice(1 + this.Cookie.Length); + + span.WriteBigEndian16((ushort)this.CipherSuites.Length); + this.CipherSuites.CopyTo(span.Slice(2)); + span = span.Slice(2 + this.CipherSuites.Length); + + span[0] = 1; + span[1] = (byte)CompressionMethod.Null; + span = span.Slice(2); + + // Extensions size + span.WriteBigEndian16((ushort)(6 + this.SupportedCurves.Length)); + span = span.Slice(2); + + // Supported curves extension + span.WriteBigEndian16((ushort)ExtensionType.EllipticCurves); + span.WriteBigEndian16((ushort)(2 + this.SupportedCurves.Length), 2); + span.WriteBigEndian16((ushort)this.SupportedCurves.Length, 4); + this.SupportedCurves.CopyTo(span.Slice(6)); + } + } + + /// <summary> + /// Encode/Decode session information in ClientHello + /// </summary> + public struct HazelDtlsSessionInfo + { + public const byte CurrentClientSessionSize = 1; + public const byte CurrentClientSessionVersion = 1; + + public byte FullSize => (byte)(1 + this.PayloadSize); + public byte PayloadSize; + public byte Version; + + public HazelDtlsSessionInfo(byte version) + { + this.Version = version; + switch (version) + { + case 0: // Does not write version byte + this.PayloadSize = 0; + return; + case 1: // Writes version byte only + this.PayloadSize = 1; + return; + } + + throw new ArgumentOutOfRangeException("Unimplemented Hazel session version"); + } + + public void Encode(ByteSpan writer) + { + writer[0] = this.PayloadSize; + + if (this.Version > 0) + { + writer[1] = this.Version; + } + } + + public static bool Parse(out HazelDtlsSessionInfo result, ByteSpan reader) + { + result = new HazelDtlsSessionInfo(); + if (reader.Length < 1) + { + return false; + } + + result.PayloadSize = reader[0]; + + // Back compat, length may be zero, version defaults to 0. + if (result.PayloadSize == 0) + { + result.Version = 0; + return true; + } + + // Forward compat, if length > 1, ignore the rest + result.Version = reader[1]; + return true; + } + } + + /// <summary> + /// Encode/decode Handshake HelloVerifyRequest message + /// </summary> + public struct HelloVerifyRequest + { + public const int CookieSize = 20; + public const int Size = 0 + + 2 // server_version + + 1 // cookie (size) + + CookieSize // cookie (data) + ; + + public ProtocolVersion ServerProtocolVersion; + public ByteSpan Cookie; + + /// <summary> + /// Parse a Handshake HelloVerifyRequest payload from wire + /// format + /// </summary> + /// <returns> + /// True if we successfully decode the HelloVerifyRequest + /// message. Otherwise false. + /// </returns> + public static bool Parse(out HelloVerifyRequest result, ProtocolVersion? expectedProtocolVersion, ByteSpan span) + { + result = new HelloVerifyRequest(); + if (span.Length < 3) + { + return false; + } + + result.ServerProtocolVersion = (ProtocolVersion)span.ReadBigEndian16(0); + if (expectedProtocolVersion.HasValue && result.ServerProtocolVersion != expectedProtocolVersion.Value) + { + return false; + } + + byte cookieSize = span[2]; + span = span.Slice(3); + + if (span.Length < cookieSize) + { + return false; + } + + result.Cookie = span; + return true; + } + + /// <summary> + /// Encode a HelloVerifyRequest payload to wire format + /// </summary> + /// <param name="peerAddress">Address of the remote peer</param> + /// <param name="hmac">Listener HMAC signature provider</param> + public static void Encode(ByteSpan span, EndPoint peerAddress, HMAC hmac, ProtocolVersion protocolVersion) + { + ByteSpan cookie = ComputeAddressMac(peerAddress, hmac); + + span.WriteBigEndian16((ushort)protocolVersion); + span[2] = (byte)CookieSize; + cookie.CopyTo(span.Slice(3)); + } + + /// <summary> + /// Generate an HMAC for a peer address + /// </summary> + /// <param name="peerAddress">Address of the remote peer</param> + /// <param name="hmac">Listener HMAC signature provider</param> + public static ByteSpan ComputeAddressMac(EndPoint peerAddress, HMAC hmac) + { + SocketAddress address = peerAddress.Serialize(); + byte[] data = new byte[address.Size]; + for (int ii = 0, nn = data.Length; ii != nn; ++ii) + { + data[ii] = address[ii]; + } + + ///NOTE(mendsley): Lame that we need to allocate+copy here + ByteSpan signature = hmac.ComputeHash(data); + return signature.Slice(0, CookieSize); + } + + /// <summary> + /// Verify a client's cookie was signed by our listener + /// </summary> + /// <param name="cookie">Wire format cookie</param> + /// <param name="peerAddress">Address of the remote peer</param> + /// <param name="hmac">Listener HMAC signature provider</param> + /// <returns>True if the cookie is valid. Otherwise false</returns> + public static bool VerifyCookie(ByteSpan cookie, EndPoint peerAddress, HMAC hmac) + { + if (cookie.Length != CookieSize) + { + return false; + } + + ByteSpan expectedHash = ComputeAddressMac(peerAddress, hmac); + if (expectedHash.Length != cookie.Length) + { + return false; + } + + return (1 == Crypto.Const.ConstantCompareSpans(cookie, expectedHash)); + } + } + + /// <summary> + /// Encode/decode Handshake ServerHello message + /// </summary> + public struct ServerHello + { + public ProtocolVersion ServerProtocolVersion; + public ByteSpan Random; + public CipherSuite CipherSuite; + public HazelDtlsSessionInfo Session; + + public const int MinSize = 0 + + 2 // server_version + + Dtls.Random.Size // random + + 1 // session_id (size) + + 2 // cipher_suite + + 1 // compression_method + ; + + public int Size => MinSize + Session.PayloadSize; + + /// <summary> + /// Parse a Handshake ServerHello payload from wire format + /// </summary> + /// <returns> + /// True if we successfully decode the ServerHello + /// message. Otherwise false. + /// </returns> + public static bool Parse(out ServerHello result, ByteSpan span) + { + result = new ServerHello(); + if (span.Length < MinSize) + { + return false; + } + + result.ServerProtocolVersion = (ProtocolVersion)span.ReadBigEndian16(); + span = span.Slice(2); + + result.Random = span.Slice(0, Dtls.Random.Size); + span = span.Slice(Dtls.Random.Size); + + if (!HazelDtlsSessionInfo.Parse(out result.Session, span)) + { + return false; + } + + span = span.Slice(result.Session.FullSize); + + result.CipherSuite = (CipherSuite)span.ReadBigEndian16(); + span = span.Slice(2); + + CompressionMethod compressionMethod = (CompressionMethod)span[0]; + if (compressionMethod != CompressionMethod.Null) + { + return false; + } + + return true; + } + + /// <summary> + /// Encode Handshake ServerHello to wire format + /// </summary> + public void Encode(ByteSpan span) + { + Debug.Assert(this.Random.Length == Dtls.Random.Size); + + span.WriteBigEndian16((ushort)this.ServerProtocolVersion, 0); + span = span.Slice(2); + + this.Random.CopyTo(span); + span = span.Slice(Dtls.Random.Size); + + this.Session.Encode(span); + span = span.Slice(this.Session.FullSize); + + span.WriteBigEndian16((ushort)this.CipherSuite); + span = span.Slice(2); + + span[0] = (byte)CompressionMethod.Null; + } + } + + /// <summary> + /// Encode/decode Handshake Certificate message + /// </summary> + public struct Certificate + { + /// <summary> + /// Encode a certificate to wire formate + /// </summary> + public static ByteSpan Encode(X509Certificate2 certificate) + { + ByteSpan certData = certificate.GetRawCertData(); + int totalSize = certData.Length + 3 + 3; + + ByteSpan result = new byte[totalSize]; + + ByteSpan writer = result; + writer.WriteBigEndian24((uint)certData.Length + 3); + writer = writer.Slice(3); + writer.WriteBigEndian24((uint)certData.Length); + writer = writer.Slice(3); + + certData.CopyTo(writer); + return result; + } + + /// <summary> + /// Parse a Handshake Certificate payload from wire format + /// </summary> + /// <returns>True if we successfully decode the Certificate message. Otherwise false</returns> + public static bool Parse(out X509Certificate2 certificate, ByteSpan span) + { + certificate = null; + if (span.Length < 6) + { + return false; + } + + uint totalSize = span.ReadBigEndian24(); + span = span.Slice(3); + + if (span.Length < totalSize) + { + return false; + } + + uint certificateSize = span.ReadBigEndian24(); + span = span.Slice(3); + if (span.Length < certificateSize) + { + return false; + } + + byte[] rawData = new byte[certificateSize]; + span.CopyTo(rawData, 0); + try + { + certificate = new X509Certificate2(rawData); + } + catch (Exception) + { + return false; + } + + return true; + } + } + + /// <summary> + /// Encode/decode Handshake Finished message + /// </summary> + public struct Finished + { + public const int Size = 12; + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/IHandshakeCipherSuite.cs b/Tools/Hazel-Networking/Hazel/Dtls/IHandshakeCipherSuite.cs new file mode 100644 index 0000000..eedd977 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/IHandshakeCipherSuite.cs @@ -0,0 +1,63 @@ +using System; + +namespace Hazel.Dtls +{ + /// <summary> + /// DTLS cipher suite interface for the handshake portion of + /// the connection. + /// </summary> + public interface IHandshakeCipherSuite : IDisposable + { + /// <summary> + /// Gets the size of the shared key + /// </summary> + /// <returns>Size of the shared key in bytes </returns> + int SharedKeySize(); + + /// <summary> + /// Calculate the size of the ServerKeyExchnage message + /// </summary> + /// <param name="privateKey"> + /// Private key that will be used to sign the message + /// </param> + /// <returns>Size of the message in bytes</returns> + int CalculateServerMessageSize(object privateKey); + + /// <summary> + /// Encodes the ServerKeyExchange message + /// </summary> + /// <param name="privateKey">Private key to use for signing</param> + void EncodeServerKeyExchangeMessage(ByteSpan output, object privateKey); + + /// <summary> + /// Verifies the authenticity of a server key exchange + /// message and calculates the shared secret. + /// </summary> + /// <returns> + /// True if the authenticity has been validated and a shared key + /// was generated. Otherwise, false. + /// </returns> + bool VerifyServerMessageAndGenerateSharedKey(ByteSpan output, ByteSpan serverKeyExchangeMessage, object publicKey); + + /// <summary> + /// Calculate the size of the ClientKeyExchange message + /// </summary> + /// <returns>Size of the message in bytes</returns> + int CalculateClientMessageSize(); + + /// <summary> + /// Encodes the ClientKeyExchangeMessage + /// </summary> + void EncodeClientKeyExchangeMessage(ByteSpan output); + + /// <summary> + /// Verifies the validity of a client key exchange message + /// and calculats the hsared secret. + /// </summary> + /// <returns> + /// True if the client exchange message is valid and a + /// shared key was generated. Otherwise, false. + /// </returns> + bool VerifyClientMessageAndGenerateSharedKey(ByteSpan output, ByteSpan clientKeyExchangeMessage); + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/IRecordProtection.cs b/Tools/Hazel-Networking/Hazel/Dtls/IRecordProtection.cs new file mode 100644 index 0000000..cbee1b0 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/IRecordProtection.cs @@ -0,0 +1,84 @@ +using System; + +namespace Hazel.Dtls +{ + /// <summary> + /// DTLS cipher suite interface for protection of record payload. + /// </summary> + public interface IRecordProtection : IDisposable + { + /// <summary> + /// Calculate the size of an encrypted plaintext + /// </summary> + /// <param name="dataSize">Size of plaintext in bytes</param> + /// <returns>Size of encrypted ciphertext in bytes</returns> + int GetEncryptedSize(int dataSize); + + /// <summary> + /// Calculate the size of decrypted ciphertext + /// </summary> + /// <param name="dataSize">Size of ciphertext in bytes</param> + /// <returns>Size of decrypted plaintext in bytes</returns> + int GetDecryptedSize(int dataSize); + + /// <summary> + /// Encrypt a plaintext intput with server keys + /// + /// Output may overlap with input. + /// </summary> + /// <param name="output">Output ciphertext</param> + /// <param name="input">Input plaintext</param> + /// <param name="record">Parent DTLS record</param> + void EncryptServerPlaintext(ByteSpan output, ByteSpan input, ref Record record); + + /// <summary> + /// Encrypt a plaintext intput with client keys + /// + /// Output may overlap with input. + /// </summary> + /// <param name="output">Output ciphertext</param> + /// <param name="input">Input plaintext</param> + /// <param name="record">Parent DTLS record</param> + void EncryptClientPlaintext(ByteSpan output, ByteSpan input, ref Record record); + + /// <summary> + /// Decrypt a ciphertext intput with server keys + /// + /// Output may overlap with input. + /// </summary> + /// <param name="output">Output plaintext</param> + /// <param name="input">Input ciphertext</param> + /// <param name="record">Parent DTLS record</param> + /// <returns>True if the input was authenticated and decrypted. Otherwise false</returns> + bool DecryptCiphertextFromServer(ByteSpan output, ByteSpan input, ref Record record); + + /// <summary> + /// Decrypt a ciphertext intput with client keys + /// + /// Output may overlap with input. + /// </summary> + /// <param name="output">Output plaintext</param> + /// <param name="input">Input ciphertext</param> + /// <param name="record">Parent DTLS record</param> + /// <returns>True if the input was authenticated and decrypted. Otherwise false</returns> + bool DecryptCiphertextFromClient(ByteSpan output, ByteSpan input, ref Record record); + } + + /// <summary> + /// Factory to create record protection from cipher suite identifiers + /// </summary> + public sealed class RecordProtectionFactory + { + public static IRecordProtection Create(CipherSuite cipherSuite, ByteSpan masterSecret, ByteSpan serverRandom, ByteSpan clientRandom) + { + switch (cipherSuite) + { + case CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: + return new Aes128GcmRecordProtection(masterSecret, serverRandom, clientRandom); + + default: + return null; + } + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/NullRecordProtection.cs b/Tools/Hazel-Networking/Hazel/Dtls/NullRecordProtection.cs new file mode 100644 index 0000000..76fa132 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/NullRecordProtection.cs @@ -0,0 +1,66 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Threading.Tasks; + +namespace Hazel.Dtls +{ + /// <summary> + /// Passthrough record protection implementaion + /// </summary> + public class NullRecordProtection : IRecordProtection + { + public readonly static NullRecordProtection Instance = new NullRecordProtection(); + + public void Dispose() + { + } + + public int GetEncryptedSize(int dataSize) + { + return dataSize; + } + + public int GetDecryptedSize(int dataSize) + { + return dataSize; + } + + public void EncryptServerPlaintext(ByteSpan output, ByteSpan input, ref Record record) + { + CopyMaybeOverlappingSpans(output, input); + } + + public void EncryptClientPlaintext(ByteSpan output, ByteSpan input, ref Record record) + { + CopyMaybeOverlappingSpans(output, input); + } + + public bool DecryptCiphertextFromServer(ByteSpan output, ByteSpan input, ref Record record) + { + CopyMaybeOverlappingSpans(output, input); + return true; + } + + public bool DecryptCiphertextFromClient(ByteSpan output, ByteSpan input, ref Record record) + { + CopyMaybeOverlappingSpans(output, input); + return true; + } + + private static void CopyMaybeOverlappingSpans(ByteSpan output, ByteSpan input) + { + // Early out if the ranges `output` is equal to `input` + if (output.GetUnderlyingArray() == input.GetUnderlyingArray()) + { + if (output.Offset == input.Offset && output.Length == input.Length) + { + return; + } + } + + input.CopyTo(output); + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/PrfSha256.cs b/Tools/Hazel-Networking/Hazel/Dtls/PrfSha256.cs new file mode 100644 index 0000000..1fa7f17 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/PrfSha256.cs @@ -0,0 +1,84 @@ +using System.Text; +using System.Security.Cryptography; + +namespace Hazel.Dtls +{ + /// <summary> + /// Common Psuedorandom Function labels for TLS + /// </summary> + public struct PrfLabel + { + public static readonly ByteSpan MASTER_SECRET = LabelToBytes("master secert"); + public static readonly ByteSpan KEY_EXPANSION = LabelToBytes("key expansion"); + public static readonly ByteSpan CLIENT_FINISHED = LabelToBytes("client finished"); + public static readonly ByteSpan SERVER_FINISHED = LabelToBytes("server finished"); + + /// <summary> + /// Convert a text label to a byte sequence + /// </summary> + public static ByteSpan LabelToBytes(string label) + { + return Encoding.ASCII.GetBytes(label); + } + } + + /// <summary> + /// The P_SHA256 Psuedorandom Function + /// </summary> + public struct PrfSha256 + { + /// <summary> + /// Expand a secret key + /// </summary> + /// <param name="output">Output span. Length determines how much data to generate</param> + /// <param name="key">Original key to expand</param> + /// <param name="label">Label (treated as a salt)</param> + /// <param name="initialSeed">Seed for expansion (treated as a salt)</param> + public static void ExpandSecret(ByteSpan output, ByteSpan key, string label, ByteSpan initialSeed) + { + ExpandSecret(output, key, PrfLabel.LabelToBytes(label), initialSeed); + } + + /// <summary> + /// Expand a secret key + /// </summary> + /// <param name="output">Output span. Length determines how much data to generate</param> + /// <param name="key">Original key to expand</param> + /// <param name="label">Label (treated as a salt)</param> + /// <param name="initialSeed">Seed for expansion (treated as a salt)</param> + public static void ExpandSecret(ByteSpan output, ByteSpan key, ByteSpan label, ByteSpan initialSeed) + { + ByteSpan writer = output; + + byte[] roundSeed = new byte[label.Length + initialSeed.Length]; + label.CopyTo(roundSeed); + initialSeed.CopyTo(roundSeed, label.Length); + + byte[] hashA = roundSeed; + + using (HMACSHA256 hmac = new HMACSHA256(key.ToArray())) + { + byte[] input = new byte[hmac.OutputBlockSize + roundSeed.Length]; + new ByteSpan(roundSeed).CopyTo(input, hmac.OutputBlockSize); + + while (writer.Length > 0) + { + // Update hashA + hashA = hmac.ComputeHash(hashA); + + // generate hash input + new ByteSpan(hashA).CopyTo(input); + + ByteSpan roundOutput = hmac.ComputeHash(input); + if (roundOutput.Length > writer.Length) + { + roundOutput = roundOutput.Slice(0, writer.Length); + } + + roundOutput.CopyTo(writer); + writer = writer.Slice(roundOutput.Length); + } + } + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/Record.cs b/Tools/Hazel-Networking/Hazel/Dtls/Record.cs new file mode 100644 index 0000000..23eaa95 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/Record.cs @@ -0,0 +1,123 @@ +namespace Hazel.Dtls +{ + /// <summary> + /// DTLS version constants + /// </summary> + public enum ProtocolVersion : ushort + { + /// <summary> + /// Use to obfuscate DTLS as regular UDP packets + /// </summary> + UDP = 0, + + /// <summary> + /// DTLS 1.2 + /// </summary> + DTLS1_2 = 0xFEFD, + } + + /// <summary> + /// DTLS record content type + /// </summary> + public enum ContentType : byte + { + ChangeCipherSpec = 20, + Alert = 21, + Handshake = 22, + ApplicationData = 23, + } + + /// <summary> + /// Encode/decode DTLS record header + /// </summary> + public struct Record + { + public ContentType ContentType; + public ProtocolVersion ProtocolVersion; + public ushort Epoch; + public ulong SequenceNumber; + public ushort Length; + + public const int Size = 13; + + /// <summary> + /// Parse a DTLS record from wire format + /// </summary> + /// <returns>True if we successfully parse the record header. Otherwise false</returns> + public static bool Parse(out Record record, ProtocolVersion? expectedProtocolVersion, ByteSpan span) + { + record = new Record(); + + if (span.Length < Size) + { + return false; + } + + record.ContentType = (ContentType)span[0]; + record.ProtocolVersion = (ProtocolVersion)span.ReadBigEndian16(1); + record.Epoch = span.ReadBigEndian16(3); + record.SequenceNumber = span.ReadBigEndian48(5); + record.Length = span.ReadBigEndian16(11); + + if (expectedProtocolVersion.HasValue && record.ProtocolVersion != expectedProtocolVersion.Value) + { + return false; + } + + return true; + } + + /// <summary> + /// Encode a DTLS record to wire format + /// </summary> + public void Encode(ByteSpan span) + { + span[0] = (byte)this.ContentType; + span.WriteBigEndian16((ushort)this.ProtocolVersion, 1); + span.WriteBigEndian16(this.Epoch, 3); + span.WriteBigEndian48(this.SequenceNumber, 5); + span.WriteBigEndian16(this.Length, 11); + } + } + + public struct ChangeCipherSpec + { + public const int Size = 1; + + enum Value : byte + { + ChangeCipherSpec = 1, + } + + /// <summary> + /// Parse a ChangeCipherSpec record from wire format + /// </summary> + /// <returns> + /// True if we successfully parse the ChangeCipherSpec + /// record. Otherwise, false. + /// </returns> + public static bool Parse(ByteSpan span) + { + if (span.Length != 1) + { + return false; + } + + Value value = (Value)span[0]; + if (value != Value.ChangeCipherSpec) + { + return false; + } + + return true; + } + + /// <summary> + /// Encode a ChangeCipherSpec record to wire format + /// </summary> + public static void Encode(ByteSpan span) + { + span[0] = (byte)Value.ChangeCipherSpec; + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/ThreadedHmacHelper.cs b/Tools/Hazel-Networking/Hazel/Dtls/ThreadedHmacHelper.cs new file mode 100644 index 0000000..38da061 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/ThreadedHmacHelper.cs @@ -0,0 +1,159 @@ +using System; +using System.Collections.Concurrent; +using System.Security.Cryptography; +using System.Threading; + +namespace Hazel.Dtls +{ + internal class ThreadedHmacHelper : IDisposable + { + private class ThreadHmacs + { + public HMAC currentHmac; + public HMAC previousHmac; + public HMAC hmacToDispose; + } + + private static readonly int CookieHmacRotationTimeout = (int)TimeSpan.FromHours(1.0).TotalMilliseconds; + + private readonly ILogger logger; + private readonly ConcurrentDictionary<int, ThreadHmacs> hmacs; + private Timer rotateKeyTimer; + private RandomNumberGenerator cryptoRandom; + private byte[] currentHmacKey; + + public ThreadedHmacHelper(ILogger logger) + { + this.hmacs = new ConcurrentDictionary<int, ThreadHmacs>(); + this.rotateKeyTimer = new Timer(RotateKeys, null, CookieHmacRotationTimeout, CookieHmacRotationTimeout); + this.cryptoRandom = RandomNumberGenerator.Create(); + + this.logger = logger; + SetHmacKey(); + } + + /// <summary> + /// [ThreadSafe] Get the current cookie hmac for the current thread. + /// </summary> + public HMAC GetCurrentCookieHmacsForThread() + { + return GetHmacsForThread().currentHmac; + } + + /// <summary> + /// [ThreadSafe] Get the previous cookie hmac for the current thread. + /// </summary> + public HMAC GetPreviousCookieHmacsForThread() + { + return GetHmacsForThread().previousHmac; + } + + public void Dispose() + { + ManualResetEvent signalRotateKeyTimerEnded = new ManualResetEvent(false); + this.rotateKeyTimer.Dispose(signalRotateKeyTimerEnded); + signalRotateKeyTimerEnded.WaitOne(); + signalRotateKeyTimerEnded.Dispose(); + signalRotateKeyTimerEnded = null; + this.rotateKeyTimer = null; + + this.cryptoRandom.Dispose(); + this.cryptoRandom = null; + + foreach (var threadIdToHmac in this.hmacs) + { + ThreadHmacs threadHmacs = threadIdToHmac.Value; + threadHmacs.currentHmac?.Dispose(); + threadHmacs.currentHmac = null; + threadHmacs.previousHmac?.Dispose(); + threadHmacs.previousHmac = null; + threadHmacs.hmacToDispose?.Dispose(); + threadHmacs.hmacToDispose = null; + } + + this.hmacs.Clear(); + } + + private ThreadHmacs GetHmacsForThread() + { + int threadId = Thread.CurrentThread.ManagedThreadId; + + if (!this.hmacs.TryGetValue(threadId, out ThreadHmacs threadHmacs)) + { + threadHmacs = CreateNewThreadHmacs(); + + if (!this.hmacs.TryAdd(threadId, threadHmacs)) + { + this.logger.WriteError($"Cannot add threadHmacs for thread {threadId} during GetHmacsForThread! Should never happen!"); + } + } + + return threadHmacs; + } + + /// <summary> + /// Rotates the hmacs of all active threads + /// </summary> + private void RotateKeys(object _) + { + SetHmacKey(); + + foreach (var threadIds in this.hmacs) + { + RotateKey(threadIds.Key); + } + } + + /// <summary> + /// Rotate hmacs of single thread + /// </summary> + /// <param name="threadId">Managed thread Id of thread calling this method.</param> + private void RotateKey(int threadId) + { + ThreadHmacs threadHmacs; + + if (!this.hmacs.TryGetValue(threadId, out threadHmacs)) + { + this.logger.WriteError($"Cannot find thread {threadId} in hmacs during rotation! Should never happen!"); + return; + } + + // No thread should still have a reference to hmacToDispose, which should now have a lifetime of > 1 hour + threadHmacs.hmacToDispose?.Dispose(); + threadHmacs.hmacToDispose = threadHmacs.previousHmac; + threadHmacs.previousHmac = threadHmacs.currentHmac; + threadHmacs.currentHmac = CreateNewCookieHMAC(); + } + + private ThreadHmacs CreateNewThreadHmacs() + { + return new ThreadHmacs + { + previousHmac = CreateNewCookieHMAC(), + currentHmac = CreateNewCookieHMAC() + }; + } + + /// <summary> + /// Create a new cookie HMAC signer + /// </summary> + private HMAC CreateNewCookieHMAC() + { + const string HMACProvider = "System.Security.Cryptography.HMACSHA1"; + HMAC hmac = HMAC.Create(HMACProvider); + hmac.Key = this.currentHmacKey; + return hmac; + } + + /// <summary> + /// Creates a new cryptographically secure random Hmac key + /// </summary> + private void SetHmacKey() + { + // MSDN recommends 64 bytes key for HMACSHA-1 + byte[] newKey = new byte[64]; + this.cryptoRandom.GetBytes(newKey); + this.currentHmacKey = newKey; + } + } +} diff --git a/Tools/Hazel-Networking/Hazel/Dtls/X25519EcdheRsaSha256.cs b/Tools/Hazel-Networking/Hazel/Dtls/X25519EcdheRsaSha256.cs new file mode 100644 index 0000000..f567252 --- /dev/null +++ b/Tools/Hazel-Networking/Hazel/Dtls/X25519EcdheRsaSha256.cs @@ -0,0 +1,202 @@ +using Hazel.Crypto; +using System; +using System.Diagnostics; +using System.Security.Cryptography; + +namespace Hazel.Dtls +{ + /// <summary> + /// ECDHE_RSA_*_256 cipher suite + /// </summary> + public class X25519EcdheRsaSha256 : IHandshakeCipherSuite + { + private readonly ByteSpan privateAgreementKey; + private SHA256 sha256 = SHA256.Create(); + + /// <summary> + /// Create a new instance of the x25519 key exchange + /// </summary> + /// <param name="random">Random data source</param> + public X25519EcdheRsaSha256(RandomNumberGenerator random) + { + byte[] buffer = new byte[X25519.KeySize]; + random.GetBytes(buffer); + this.privateAgreementKey = buffer; + } + + /// <inheritdoc /> + public void Dispose() + { + this.sha256?.Dispose(); + this.sha256 = null; + } + + /// <inheritdoc /> + public int SharedKeySize() + { + return X25519.KeySize; + } + + /// <summary> + /// Calculate the server message size given an RSA key size + /// </summary> + /// <param name="keySize"> + /// Size of the private key (in bits) + /// </param> + /// <returns> + /// Size of the ServerKeyExchange message in bytes + /// </returns> + private static int CalculateServerMessageSize(int keySize) + { + int signatureSize = keySize / 8; + + return 0 + + 1 // ECCurveType ServerKeyExchange.params.curve_params.curve_type + + 2 // NamedCurve ServerKeyExchange.params.curve_params.namedcurve + + 1 + X25519.KeySize // ECPoint ServerKeyExchange.params.public + + 1 // HashAlgorithm ServerKeyExchange.algorithm.hash + + 1 // SignatureAlgorithm ServerKeyExchange.signed_params.algorithm.signature + + 2 // ServerKeyExchange.signed_params.size + + signatureSize // ServerKeyExchange.signed_params.opaque + ; + } + + /// <inheritdoc /> + public int CalculateServerMessageSize(object privateKey) + { + RSA rsaPrivateKey = privateKey as RSA; + if (rsaPrivateKey == null) + { + throw new ArgumentException("Invalid private key", nameof(privateKey)); + } + + return CalculateServerMessageSize(rsaPrivateKey.KeySize); + } + + /// <inheritdoc /> + public void EncodeServerKeyExchangeMessage(ByteSpan output, object privateKey) + { + RSA rsaPrivateKey = privateKey as RSA; + if (rsaPrivateKey == null) + { + throw new ArgumentException("Invalid private key", nameof(privateKey)); + } + + output[0] = (byte)ECCurveType.NamedCurve; + output.WriteBigEndian16((ushort)NamedCurve.x25519, 1); + output[3] = (byte)X25519.KeySize; + X25519.Func(output.Slice(4, X25519.KeySize), this.privateAgreementKey); + + // Hash the key parameters + byte[] paramterDigest = this.sha256.ComputeHash(output.GetUnderlyingArray(), output.Offset, 4 + X25519.KeySize); + + // Sign the paramter digest + RSAPKCS1SignatureFormatter signer = new RSAPKCS1SignatureFormatter(rsaPrivateKey); + signer.SetHashAlgorithm("SHA256"); + ByteSpan signature = signer.CreateSignature(paramterDigest); + + Debug.Assert(signature.Length == rsaPrivateKey.KeySize/8); + output[4 + X25519.KeySize] = (byte)HashAlgorithm.Sha256; + output[5 + X25519.KeySize] = (byte)SignatureAlgorithm.RSA; + output.Slice(6+X25519.KeySize).WriteBigEndian16((ushort)signature.Length); + signature.CopyTo(output.Slice(8+X25519.KeySize)); + } + + /// <inheritdoc /> + public bool VerifyServerMessageAndGenerateSharedKey(ByteSpan output, ByteSpan serverKeyExchangeMessage, object publicKey) + { + RSA rsaPublicKey = publicKey as RSA; + if (rsaPublicKey == null) + { + return false; + } + else if (output.Length != X25519.KeySize) + { + return false; + } + + // Verify message is compatible with this cipher suite + if (serverKeyExchangeMessage.Length != CalculateServerMessageSize(rsaPublicKey.KeySize)) + { + return false; + } + else if (serverKeyExchangeMessage[0] != (byte)ECCurveType.NamedCurve) + { + return false; + } + else if (serverKeyExchangeMessage.ReadBigEndian16(1) != (ushort)NamedCurve.x25519) + { + return false; + } + else if (serverKeyExchangeMessage[3] != X25519.KeySize) + { + return false; + } + else if (serverKeyExchangeMessage[4 + X25519.KeySize] != (byte)HashAlgorithm.Sha256) + { + return false; + } + else if (serverKeyExchangeMessage[5 + X25519.KeySize] != (byte)SignatureAlgorithm.RSA) + { + return false; + } + + ByteSpan keyParameters = serverKeyExchangeMessage.Slice(0, 4+X25519.KeySize); + ByteSpan othersPublicKey = keyParameters.Slice(4); + ushort signatureSize = serverKeyExchangeMessage.ReadBigEndian16(6 + X25519.KeySize); + ByteSpan signature = serverKeyExchangeMessage.Slice(4+keyParameters.Length); + + if (signatureSize != signature.Length) + { + return false; + } + + // Hash the key parameters + byte[] parameterDigest = this.sha256.ComputeHash(keyParameters.GetUnderlyingArray(), keyParameters.Offset, keyParameters.Length); + + // Verify the signature + RSAPKCS1SignatureDeformatter verifier = new RSAPKCS1SignatureDeformatter(rsaPublicKey); + verifier.SetHashAlgorithm("SHA256"); + if (!verifier.VerifySignature(parameterDigest, signature.ToArray())) + { + return false; + } + + // Signature has been validated, generate the shared key + return X25519.Func(output, this.privateAgreementKey, othersPublicKey); + } + + private static int ClientMessageSize = 0 + + 1 + X25519.KeySize // ECPoint ClientKeyExchange.ecdh_Yc + ; + + /// <inheritdoc /> + public int CalculateClientMessageSize() + { + return ClientMessageSize; + } + + /// <inheritdoc /> + public void EncodeClientKeyExchangeMessage(ByteSpan output) + { + output[0] = (byte)X25519.KeySize; + X25519.Func(output.Slice(1, X25519.KeySize), this.privateAgreementKey); + } + + /// <inheritdoc /> + public bool VerifyClientMessageAndGenerateSharedKey(ByteSpan output, ByteSpan clientKeyExchangeMessage) + { + if (clientKeyExchangeMessage.Length != ClientMessageSize) + { + return false; + } + else if (clientKeyExchangeMessage[0] != (byte)X25519.KeySize) + { + return false; + } + + ByteSpan othersPublicKey = clientKeyExchangeMessage.Slice(1); + return X25519.Func(output, this.privateAgreementKey, othersPublicKey); + } + } +} |