use session::{Session, SessionRandoms, SessionSecrets, SessionCommon};
use suites::{SupportedCipherSuite, ALL_CIPHERSUITES, KeyExchange};
use msgs::enums::{ContentType, SignatureScheme};
use msgs::enums::{AlertDescription, HandshakeType, ProtocolVersion};
use msgs::handshake::{SessionID, CertificatePayload};
use msgs::message::Message;
use msgs::codec::Codec;
use hash_hs;
use server_hs;
use error::TLSError;
use rand;
use sign;
use verify;
use anchors;
use key;
use std::collections;
use std::sync::{Arc, Mutex};
use std::io;
pub trait StoresServerSessions : Send + Sync {
fn generate(&self) -> SessionID;
fn put(&mut self, id: &SessionID, value: Vec<u8>) -> bool;
fn get(&self, id: &SessionID) -> Option<Vec<u8>>;
fn del(&mut self, id: &SessionID) -> bool;
}
pub trait ProducesTickets : Send + Sync {
fn enabled(&self) -> bool;
fn get_lifetime(&self) -> u32;
fn encrypt(&self, plain: &[u8]) -> Option<Vec<u8>>;
fn decrypt(&self, cipher: &[u8]) -> Option<Vec<u8>>;
}
pub trait ResolvesServerCert : Send + Sync {
fn resolve(&self,
server_name: Option<&str>,
sigschemes: &[SignatureScheme])
-> Option<sign::CertChainAndSigner>;
}
pub struct ServerConfig {
pub ciphersuites: Vec<&'static SupportedCipherSuite>,
pub ignore_client_order: bool,
pub session_storage: Mutex<Box<StoresServerSessions + Send>>,
pub ticketer: Box<ProducesTickets>,
pub cert_resolver: Box<ResolvesServerCert>,
pub alpn_protocols: Vec<String>,
pub client_auth_roots: anchors::RootCertStore,
pub client_auth_offer: bool,
pub client_auth_mandatory: bool,
pub versions: Vec<ProtocolVersion>,
verifier: Box<verify::ClientCertVerifier>,
}
struct NoSessionStorage {}
impl StoresServerSessions for NoSessionStorage {
fn generate(&self) -> SessionID {
SessionID::empty()
}
fn put(&mut self, _id: &SessionID, _sec: Vec<u8>) -> bool {
false
}
fn get(&self, _id: &SessionID) -> Option<Vec<u8>> {
None
}
fn del(&mut self, _id: &SessionID) -> bool {
false
}
}
pub struct ServerSessionMemoryCache {
cache: collections::HashMap<Vec<u8>, Vec<u8>>,
max_entries: usize,
}
impl ServerSessionMemoryCache {
pub fn new(size: usize) -> Box<ServerSessionMemoryCache> {
debug_assert!(size > 0);
Box::new(ServerSessionMemoryCache {
cache: collections::HashMap::new(),
max_entries: size,
})
}
fn limit_size(&mut self) {
while self.cache.len() > self.max_entries {
let k = self.cache.keys().next().unwrap().clone();
self.cache.remove(&k);
}
}
}
impl StoresServerSessions for ServerSessionMemoryCache {
fn generate(&self) -> SessionID {
let mut v = [0u8; 32];
rand::fill_random(&mut v);
SessionID::new(&v)
}
fn put(&mut self, id: &SessionID, sec: Vec<u8>) -> bool {
self.cache.insert(id.get_encoding(), sec);
self.limit_size();
true
}
fn get(&self, id: &SessionID) -> Option<Vec<u8>> {
self.cache.get(&id.get_encoding()).cloned()
}
fn del(&mut self, id: &SessionID) -> bool {
self.cache.remove(&id.get_encoding()).is_some()
}
}
struct NeverProducesTickets {}
impl ProducesTickets for NeverProducesTickets {
fn enabled(&self) -> bool {
false
}
fn get_lifetime(&self) -> u32 {
0
}
fn encrypt(&self, _bytes: &[u8]) -> Option<Vec<u8>> {
None
}
fn decrypt(&self, _bytes: &[u8]) -> Option<Vec<u8>> {
None
}
}
struct FailResolveChain {}
impl ResolvesServerCert for FailResolveChain {
fn resolve(&self,
_server_name: Option<&str>,
_sigschemes: &[SignatureScheme])
-> Option<sign::CertChainAndSigner> {
None
}
}
struct AlwaysResolvesChain {
chain: Vec<key::Certificate>,
key: Arc<Box<sign::Signer>>,
}
impl AlwaysResolvesChain {
fn new_rsa(chain: Vec<key::Certificate>, priv_key: &key::PrivateKey) -> AlwaysResolvesChain {
let key = sign::RSASigner::new(priv_key)
.expect("Invalid RSA private key");
AlwaysResolvesChain {
chain: chain,
key: Arc::new(Box::new(key)),
}
}
}
impl ResolvesServerCert for AlwaysResolvesChain {
fn resolve(&self,
_server_name: Option<&str>,
_sigschemes: &[SignatureScheme])
-> Option<sign::CertChainAndSigner> {
Some((self.chain.clone(), self.key.clone()))
}
}
impl ServerConfig {
pub fn new() -> ServerConfig {
ServerConfig {
ciphersuites: ALL_CIPHERSUITES.to_vec(),
ignore_client_order: false,
session_storage: Mutex::new(Box::new(NoSessionStorage {})),
ticketer: Box::new(NeverProducesTickets {}),
alpn_protocols: Vec::new(),
cert_resolver: Box::new(FailResolveChain {}),
client_auth_roots: anchors::RootCertStore::empty(),
client_auth_offer: false,
client_auth_mandatory: false,
versions: vec![ ProtocolVersion::TLSv1_3, ProtocolVersion::TLSv1_2 ],
verifier: Box::new(verify::WebPKIVerifier {}),
}
}
#[doc(hidden)]
pub fn get_verifier(&self) -> &verify::ClientCertVerifier {
self.verifier.as_ref()
}
pub fn set_persistence(&mut self, persist: Box<StoresServerSessions + Send>) {
self.session_storage = Mutex::new(persist);
}
pub fn set_single_cert(&mut self,
cert_chain: Vec<key::Certificate>,
key_der: key::PrivateKey) {
self.cert_resolver = Box::new(AlwaysResolvesChain::new_rsa(cert_chain, &key_der));
}
pub fn set_protocols(&mut self, protocols: &[String]) {
self.alpn_protocols.clear();
self.alpn_protocols.extend_from_slice(protocols);
}
pub fn set_client_auth_roots(&mut self, certs: Vec<key::Certificate>, mandatory: bool) {
for cert in certs {
self.client_auth_roots
.add(&cert)
.unwrap()
}
self.client_auth_offer = true;
self.client_auth_mandatory = mandatory;
}
#[cfg(feature = "dangerous_configuration")]
pub fn dangerous(&mut self) -> danger::DangerousServerConfig {
danger::DangerousServerConfig { cfg: self }
}
}
#[cfg(feature = "dangerous_configuration")]
pub mod danger {
use super::ServerConfig;
use super::verify::ClientCertVerifier;
pub struct DangerousServerConfig<'a> {
pub cfg: &'a mut ServerConfig
}
impl<'a> DangerousServerConfig<'a> {
pub fn set_certificate_verifier(&mut self,
verifier: Box<ClientCertVerifier>) {
self.cfg.verifier = verifier;
}
}
}
pub struct ServerHandshakeData {
pub server_cert_chain: Option<CertificatePayload>,
pub session_id: SessionID,
pub randoms: SessionRandoms,
pub transcript: hash_hs::HandshakeHash,
pub hash_at_server_fin: Vec<u8>,
pub kx_data: Option<KeyExchange>,
pub doing_resume: bool,
pub send_ticket: bool,
pub using_ems: bool,
pub doing_client_auth: bool,
pub done_retry: bool,
pub valid_client_cert_chain: Option<Vec<key::Certificate>>,
}
impl ServerHandshakeData {
fn new() -> ServerHandshakeData {
ServerHandshakeData {
server_cert_chain: None,
session_id: SessionID::empty(),
randoms: SessionRandoms::for_server(),
transcript: hash_hs::HandshakeHash::new(),
hash_at_server_fin: vec![],
kx_data: None,
send_ticket: false,
using_ems: false,
doing_resume: false,
doing_client_auth: false,
done_retry: false,
valid_client_cert_chain: None,
}
}
}
pub struct ServerSessionImpl {
pub config: Arc<ServerConfig>,
pub handshake_data: ServerHandshakeData,
pub secrets: Option<SessionSecrets>,
pub common: SessionCommon,
pub alpn_protocol: Option<String>,
pub error: Option<TLSError>,
pub state: &'static server_hs::State,
}
impl ServerSessionImpl {
pub fn new(server_config: &Arc<ServerConfig>) -> ServerSessionImpl {
let mut sess = ServerSessionImpl {
config: server_config.clone(),
handshake_data: ServerHandshakeData::new(),
secrets: None,
common: SessionCommon::new(None, false),
alpn_protocol: None,
error: None,
state: &server_hs::EXPECT_CLIENT_HELLO,
};
if sess.config.client_auth_offer {
sess.handshake_data.transcript.set_client_auth_enabled();
}
sess
}
pub fn wants_read(&self) -> bool {
!self.common.has_readable_plaintext()
}
pub fn wants_write(&self) -> bool {
!self.common.sendable_tls.is_empty()
}
pub fn is_handshaking(&self) -> bool {
!self.common.traffic
}
pub fn set_buffer_limit(&mut self, len: usize) {
self.common.set_buffer_limit(len)
}
pub fn process_msg(&mut self, mut msg: Message) -> Result<(), TLSError> {
if self.common.peer_encrypting {
let dm = self.common.decrypt_incoming(msg)?;
msg = dm;
}
if self.common.handshake_joiner.want_message(&msg) {
self.common.handshake_joiner.take_message(msg)
.ok_or_else(|| {
self.common.send_fatal_alert(AlertDescription::DecodeError);
TLSError::CorruptMessagePayload(ContentType::Handshake)
})?;
return self.process_new_handshake_messages();
}
msg.decode_payload();
if msg.is_content_type(ContentType::Alert) {
return self.common.process_alert(msg);
}
self.process_main_protocol(msg)
}
fn process_new_handshake_messages(&mut self) -> Result<(), TLSError> {
while let Some(msg) = self.common.handshake_joiner.frames.pop_front() {
self.process_main_protocol(msg)?;
}
Ok(())
}
fn queue_unexpected_alert(&mut self) {
self.common.send_fatal_alert(AlertDescription::UnexpectedMessage);
}
pub fn process_main_protocol(&mut self, msg: Message) -> Result<(), TLSError> {
if self.common.traffic && !self.common.is_tls13() &&
msg.is_handshake_type(HandshakeType::ClientHello) {
self.common.send_warning_alert(AlertDescription::NoRenegotiation);
return Ok(());
}
self.state.expect.check_message(&msg)
.map_err(|err| { self.queue_unexpected_alert(); err })?;
let new_state = (self.state.handle)(self, msg)?;
self.state = new_state;
Ok(())
}
pub fn process_new_packets(&mut self) -> Result<(), TLSError> {
if let Some(ref err) = self.error {
return Err(err.clone());
}
if self.common.message_deframer.desynced {
return Err(TLSError::CorruptMessage);
}
while let Some(msg) = self.common.message_deframer.frames.pop_front() {
match self.process_msg(msg) {
Ok(_) => {}
Err(err) => {
self.error = Some(err.clone());
return Err(err);
}
}
}
Ok(())
}
pub fn start_encryption_tls12(&mut self) {
self.common.start_encryption_tls12(self.secrets.as_ref().unwrap());
}
pub fn get_peer_certificates(&self) -> Option<Vec<key::Certificate>> {
if self.handshake_data.valid_client_cert_chain.is_none() {
return None;
}
let mut r = Vec::new();
for cert in self.handshake_data.valid_client_cert_chain.as_ref().unwrap() {
r.push(cert.clone());
}
Some(r)
}
pub fn get_alpn_protocol(&self) -> Option<String> {
self.alpn_protocol.clone()
}
pub fn get_protocol_version(&self) -> Option<ProtocolVersion> {
self.common.negotiated_version
}
}
pub struct ServerSession {
imp: ServerSessionImpl,
}
impl ServerSession {
pub fn new(config: &Arc<ServerConfig>) -> ServerSession {
ServerSession { imp: ServerSessionImpl::new(config) }
}
}
impl Session for ServerSession {
fn read_tls(&mut self, rd: &mut io::Read) -> io::Result<usize> {
self.imp.common.read_tls(rd)
}
fn write_tls(&mut self, wr: &mut io::Write) -> io::Result<usize> {
self.imp.common.write_tls(wr)
}
fn process_new_packets(&mut self) -> Result<(), TLSError> {
self.imp.process_new_packets()
}
fn wants_read(&self) -> bool {
self.imp.wants_read()
}
fn wants_write(&self) -> bool {
self.imp.wants_write()
}
fn is_handshaking(&self) -> bool {
self.imp.is_handshaking()
}
fn set_buffer_limit(&mut self, len: usize) {
self.imp.set_buffer_limit(len)
}
fn send_close_notify(&mut self) {
self.imp.common.send_close_notify()
}
fn get_peer_certificates(&self) -> Option<Vec<key::Certificate>> {
self.imp.get_peer_certificates()
}
fn get_alpn_protocol(&self) -> Option<String> {
self.imp.get_alpn_protocol()
}
fn get_protocol_version(&self) -> Option<ProtocolVersion> {
self.imp.get_protocol_version()
}
}
impl io::Read for ServerSession {
fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
self.imp.common.read(buf)
}
}
impl io::Write for ServerSession {
fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
self.imp.common.send_some_plaintext(buf)
}
fn flush(&mut self) -> io::Result<()> {
self.imp.common.flush_plaintext();
Ok(())
}
}