sys/src/9/port/devtls.c

   1 /*
   2  *  devtls - record layer for transport layer security 1.0 and secure sockets layer 3.0
   3  */
   4 #include        "u.h"
   5 #include        "../port/lib.h"
   6 #include        "mem.h"
   7 #include        "dat.h"
   8 #include        "fns.h"
   9 #include        "../port/error.h"
  10
  11 #include        <libsec.h>
  12
  13 typedef struct OneWay   OneWay;
  14 typedef struct Secret           Secret;
  15 typedef struct TlsRec   TlsRec;
  16 typedef struct TlsErrs  TlsErrs;
  17
  18 enum {
  19         Statlen=        1024,           /* max. length of status or stats message */
  20         /* buffer limits */
  21         MaxRecLen               = 1<<14,        /* max payload length of a record layer message */
  22         MaxCipherRecLen = MaxRecLen + 2048,
  23         RecHdrLen               = 5,
  24         MaxMacLen               = SHA1dlen,
  25
  26         /* protocol versions we can accept */
  27         TLSVersion              = 0x0301,
  28         SSL3Version             = 0x0300,
  29         ProtocolVersion = 0x0301,       /* maximum version we speak */
  30         MinProtoVersion = 0x0300,       /* limits on version we accept */
  31         MaxProtoVersion = 0x03ff,
  32
  33         /* connection states */
  34         SHandshake      = 1 << 0,       /* doing handshake */
  35         SOpen           = 1 << 1,       /* application data can be sent */
  36         SRClose         = 1 << 2,       /* remote side has closed down */
  37         SLClose         = 1 << 3,       /* sent a close notify alert */
  38         SAlert          = 1 << 5,       /* sending or sent a fatal alert */
  39         SError          = 1 << 6,       /* some sort of error has occured */
  40         SClosed         = 1 << 7,       /* it is all over */
  41
  42         /* record types */
  43         RChangeCipherSpec = 20,
  44         RAlert,
  45         RHandshake,
  46         RApplication,
  47
  48         SSL2ClientHello = 1,
  49         HSSL2ClientHello = 9,  /* local convention;  see tlshand.c */
  50
  51         /* alerts */
  52         ECloseNotify                    = 0,
  53         EUnexpectedMessage      = 10,
  54         EBadRecordMac           = 20,
  55         EDecryptionFailed               = 21,
  56         ERecordOverflow                 = 22,
  57         EDecompressionFailure   = 30,
  58         EHandshakeFailure               = 40,
  59         ENoCertificate                  = 41,
  60         EBadCertificate                 = 42,
  61         EUnsupportedCertificate         = 43,
  62         ECertificateRevoked             = 44,
  63         ECertificateExpired             = 45,
  64         ECertificateUnknown     = 46,
  65         EIllegalParameter               = 47,
  66         EUnknownCa                      = 48,
  67         EAccessDenied           = 49,
  68         EDecodeError                    = 50,
  69         EDecryptError                   = 51,
  70         EExportRestriction              = 60,
  71         EProtocolVersion                = 70,
  72         EInsufficientSecurity   = 71,
  73         EInternalError                  = 80,
  74         EUserCanceled                   = 90,
  75         ENoRenegotiation                = 100,
  76         EUnrecognizedName               = 112,
  77
  78         EMAX = 256
  79 };
  80
  81 struct Secret
  82 {
  83         char            *encalg;        /* name of encryption alg */
  84         char            *hashalg;       /* name of hash alg */
  85         int             (*enc)(Secret*, uchar*, int);
  86         int             (*dec)(Secret*, uchar*, int);
  87         int             (*unpad)(uchar*, int, int);
  88         DigestState     *(*mac)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
  89         int             block;          /* encryption block len, 0 if none */
  90         int             maclen;
  91         void            *enckey;
  92         uchar   mackey[MaxMacLen];
  93 };
  94
  95 struct OneWay
  96 {
  97         QLock           io;             /* locks io access */
  98         QLock           seclock;        /* locks secret paramaters */
  99         ulong           seq;
 100         Secret          *sec;           /* cipher in use */
 101         Secret          *new;           /* cipher waiting for enable */
 102 };
 103
 104 struct TlsRec
 105 {
 106         Chan    *c;                             /* io channel */
 107         int             ref;                            /* serialized by tdlock for atomic destroy */
 108         int             version;                        /* version of the protocol we are speaking */
 109         char            verset;                 /* version has been set */
 110         char            opened;                 /* opened command every issued? */
 111         char            err[ERRMAX];            /* error message to return to handshake requests */
 112         vlong   handin;                 /* bytes communicated by the record layer */
 113         vlong   handout;
 114         vlong   datain;
 115         vlong   dataout;
 116
 117         Lock            statelk;
 118         int             state;
 119         int             debug;
 120
 121         /* record layer mac functions for different protocol versions */
 122         void            (*packMac)(Secret*, uchar*, uchar*, uchar*, uchar*, int, uchar*);
 123
 124         /* input side -- protected by in.io */
 125         OneWay          in;
 126         Block           *processed;     /* next bunch of application data */
 127         Block           *unprocessed;   /* data read from c but not parsed into records */
 128
 129         /* handshake queue */
 130         Lock            hqlock;                 /* protects hqref, alloc & free of handq, hprocessed */
 131         int             hqref;
 132         Queue           *handq;         /* queue of handshake messages */
 133         Block           *hprocessed;    /* remainder of last block read from handq */
 134         QLock           hqread;         /* protects reads for hprocessed, handq */
 135
 136         /* output side */
 137         OneWay          out;
 138
 139         /* protections */
 140         char            *user;
 141         int             perm;
 142 };
 143
 144 struct TlsErrs{
 145         int     err;
 146         int     sslerr;
 147         int     tlserr;
 148         int     fatal;
 149         char    *msg;
 150 };
 151
 152 static TlsErrs tlserrs[] = {
 153         {ECloseNotify,                  ECloseNotify,                   ECloseNotify,                   0,      "close notify"},
 154         {EUnexpectedMessage,    EUnexpectedMessage,     EUnexpectedMessage,     1, "unexpected message"},
 155         {EBadRecordMac,         EBadRecordMac,          EBadRecordMac,          1, "bad record mac"},
 156         {EDecryptionFailed,             EIllegalParameter,              EDecryptionFailed,              1, "decryption failed"},
 157         {ERecordOverflow,               EIllegalParameter,              ERecordOverflow,                1, "record too long"},
 158         {EDecompressionFailure, EDecompressionFailure,  EDecompressionFailure,  1, "decompression failed"},
 159         {EHandshakeFailure,             EHandshakeFailure,              EHandshakeFailure,              1, "could not negotiate acceptable security parameters"},
 160         {ENoCertificate,                ENoCertificate,                 ECertificateUnknown,    1, "no appropriate certificate available"},
 161         {EBadCertificate,               EBadCertificate,                EBadCertificate,                1, "corrupted or invalid certificate"},
 162         {EUnsupportedCertificate,       EUnsupportedCertificate,        EUnsupportedCertificate,        1, "unsupported certificate type"},
 163         {ECertificateRevoked,   ECertificateRevoked,            ECertificateRevoked,            1, "revoked certificate"},
 164         {ECertificateExpired,           ECertificateExpired,            ECertificateExpired,            1, "expired certificate"},
 165         {ECertificateUnknown,   ECertificateUnknown,    ECertificateUnknown,    1, "unacceptable certificate"},
 166         {EIllegalParameter,             EIllegalParameter,              EIllegalParameter,              1, "illegal parameter"},
 167         {EUnknownCa,                    EHandshakeFailure,              EUnknownCa,                     1, "unknown certificate authority"},
 168         {EAccessDenied,         EHandshakeFailure,              EAccessDenied,          1, "access denied"},
 169         {EDecodeError,                  EIllegalParameter,              EDecodeError,                   1, "error decoding message"},
 170         {EDecryptError,                 EIllegalParameter,              EDecryptError,                  1, "error decrypting message"},
 171         {EExportRestriction,            EHandshakeFailure,              EExportRestriction,             1, "export restriction violated"},
 172         {EProtocolVersion,              EIllegalParameter,              EProtocolVersion,               1, "protocol version not supported"},
 173         {EInsufficientSecurity, EHandshakeFailure,              EInsufficientSecurity,  1, "stronger security routines required"},
 174         {EInternalError,                        EHandshakeFailure,              EInternalError,                 1, "internal error"},
 175         {EUserCanceled,         ECloseNotify,                   EUserCanceled,                  0, "handshake canceled by user"},
 176         {ENoRenegotiation,              EUnexpectedMessage,     ENoRenegotiation,               0, "no renegotiation"},
 177 };
 178
 179 enum
 180 {
 181         /* max. open tls connections */
 182         MaxTlsDevs      = 1024
 183 };
 184
 185 static  Lock    tdlock;
 186 static  int     tdhiwat;
 187 static  int     maxtlsdevs = 128;
 188 static  TlsRec  **tlsdevs;
 189 static  char    **trnames;
 190 static  char    *encalgs;
 191 static  char    *hashalgs;
 192
 193 enum{
 194         Qtopdir         = 1,    /* top level directory */
 195         Qprotodir,
 196         Qclonus,
 197         Qencalgs,
 198         Qhashalgs,
 199         Qconvdir,               /* directory for a conversation */
 200         Qdata,
 201         Qctl,
 202         Qhand,
 203         Qstatus,
 204         Qstats,
 205 };
 206
 207 #define TYPE(x)         ((x).path & 0xf)
 208 #define CONV(x)         (((x).path >> 5)&(MaxTlsDevs-1))
 209 #define QID(c, y)       (((c)<<5) | (y))
 210
 211 static void     checkstate(TlsRec *, int, int);
 212 static void     ensure(TlsRec*, Block**, int);
 213 static void     consume(Block**, uchar*, int);
 214 static Chan*    buftochan(char*);
 215 static void     tlshangup(TlsRec*);
 216 static void     tlsError(TlsRec*, char *);
 217 static void     alertHand(TlsRec*, char *);
 218 static TlsRec   *newtls(Chan *c);
 219 static TlsRec   *mktlsrec(void);
 220 static DigestState*sslmac_md5(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
 221 static DigestState*sslmac_sha1(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
 222 static DigestState*nomac(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s);
 223 static void     sslPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac);
 224 static void     tlsPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac);
 225 static void     put64(uchar *p, vlong x);
 226 static void     put32(uchar *p, u32int);
 227 static void     put24(uchar *p, int);
 228 static void     put16(uchar *p, int);
 229 static u32int   get32(uchar *p);
 230 static int      get16(uchar *p);
 231 static void     tlsSetState(TlsRec *tr, int new, int old);
 232 static void     rcvAlert(TlsRec *tr, int err);
 233 static void     sendAlert(TlsRec *tr, int err);
 234 static void     rcvError(TlsRec *tr, int err, char *msg, ...);
 235 static int      rc4enc(Secret *sec, uchar *buf, int n);
 236 static int      des3enc(Secret *sec, uchar *buf, int n);
 237 static int      des3dec(Secret *sec, uchar *buf, int n);
 238 static int      aesenc(Secret *sec, uchar *buf, int n);
 239 static int      aesdec(Secret *sec, uchar *buf, int n);
 240 static int      noenc(Secret *sec, uchar *buf, int n);
 241 static int      sslunpad(uchar *buf, int n, int block);
 242 static int      tlsunpad(uchar *buf, int n, int block);
 243 static void     freeSec(Secret *sec);
 244 static char     *tlsstate(int s);
 245 static void     pdump(int, void*, char*);
 246
 247 #pragma varargck        argpos  rcvError        3
 248
 249 static char *tlsnames[] = {
 250 [Qclonus]               "clone",
 251 [Qencalgs]      "encalgs",
 252 [Qhashalgs]     "hashalgs",
 253 [Qdata]         "data",
 254 [Qctl]          "ctl",
 255 [Qhand]         "hand",
 256 [Qstatus]               "status",
 257 [Qstats]                "stats",
 258 };
 259
 260 static int convdir[] = { Qctl, Qdata, Qhand, Qstatus, Qstats };
 261
 262 static int
 263 tlsgen(Chan *c, char*, Dirtab *, int, int s, Dir *dp)
 264 {
 265         Qid q;
 266         TlsRec *tr;
 267         char *name, *nm;
 268         int perm, t;
 269
 270         q.vers = 0;
 271         q.type = QTFILE;
 272
 273         t = TYPE(c->qid);
 274         switch(t) {
 275         case Qtopdir:
 276                 if(s == DEVDOTDOT){
 277                         q.path = QID(0, Qtopdir);
 278                         q.type = QTDIR;
 279                         devdir(c, q, "#a", 0, eve, 0555, dp);
 280                         return 1;
 281                 }
 282                 if(s > 0)
 283                         return -1;
 284                 q.path = QID(0, Qprotodir);
 285                 q.type = QTDIR;
 286                 devdir(c, q, "tls", 0, eve, 0555, dp);
 287                 return 1;
 288         case Qprotodir:
 289                 if(s == DEVDOTDOT){
 290                         q.path = QID(0, Qtopdir);
 291                         q.type = QTDIR;
 292                         devdir(c, q, ".", 0, eve, 0555, dp);
 293                         return 1;
 294                 }
 295                 if(s < 3){
 296                         switch(s) {
 297                         default:
 298                                 return -1;
 299                         case 0:
 300                                 q.path = QID(0, Qclonus);
 301                                 break;
 302                         case 1:
 303                                 q.path = QID(0, Qencalgs);
 304                                 break;
 305                         case 2:
 306                                 q.path = QID(0, Qhashalgs);
 307                                 break;
 308                         }
 309                         perm = 0444;
 310                         if(TYPE(q) == Qclonus)
 311                                 perm = 0555;
 312                         devdir(c, q, tlsnames[TYPE(q)], 0, eve, perm, dp);
 313                         return 1;
 314                 }
 315                 s -= 3;
 316                 if(s >= tdhiwat)
 317                         return -1;
 318                 q.path = QID(s, Qconvdir);
 319                 q.type = QTDIR;
 320                 lock(&tdlock);
 321                 tr = tlsdevs[s];
 322                 if(tr != nil)
 323                         nm = tr->user;
 324                 else
 325                         nm = eve;
 326                 if((name = trnames[s]) == nil){
 327                         name = trnames[s] = smalloc(16);
 328                         sprint(name, "%d", s);
 329                 }
 330                 devdir(c, q, name, 0, nm, 0555, dp);
 331                 unlock(&tdlock);
 332                 return 1;
 333         case Qconvdir:
 334                 if(s == DEVDOTDOT){
 335                         q.path = QID(0, Qprotodir);
 336                         q.type = QTDIR;
 337                         devdir(c, q, "tls", 0, eve, 0555, dp);
 338                         return 1;
 339                 }
 340                 if(s < 0 || s >= nelem(convdir))
 341                         return -1;
 342                 lock(&tdlock);
 343                 tr = tlsdevs[CONV(c->qid)];
 344                 if(tr != nil){
 345                         nm = tr->user;
 346                         perm = tr->perm;
 347                 }else{
 348                         perm = 0;
 349                         nm = eve;
 350                 }
 351                 t = convdir[s];
 352                 if(t == Qstatus || t == Qstats)
 353                         perm &= 0444;
 354                 q.path = QID(CONV(c->qid), t);
 355                 devdir(c, q, tlsnames[t], 0, nm, perm, dp);
 356                 unlock(&tdlock);
 357                 return 1;
 358         case Qclonus:
 359         case Qencalgs:
 360         case Qhashalgs:
 361                 perm = 0444;
 362                 if(t == Qclonus)
 363                         perm = 0555;
 364                 devdir(c, c->qid, tlsnames[t], 0, eve, perm, dp);
 365                 return 1;
 366         default:
 367                 lock(&tdlock);
 368                 tr = tlsdevs[CONV(c->qid)];
 369                 if(tr != nil){
 370                         nm = tr->user;
 371                         perm = tr->perm;
 372                 }else{
 373                         perm = 0;
 374                         nm = eve;
 375                 }
 376                 if(t == Qstatus || t == Qstats)
 377                         perm &= 0444;
 378                 devdir(c, c->qid, tlsnames[t], 0, nm, perm, dp);
 379                 unlock(&tdlock);
 380                 return 1;
 381         }
 382 }
 383
 384 static Chan*
 385 tlsattach(char *spec)
 386 {
 387         Chan *c;
 388
 389         c = devattach('a', spec);
 390         c->qid.path = QID(0, Qtopdir);
 391         c->qid.type = QTDIR;
 392         c->qid.vers = 0;
 393         return c;
 394 }
 395
 396 static Walkqid*
 397 tlswalk(Chan *c, Chan *nc, char **name, int nname)
 398 {
 399         return devwalk(c, nc, name, nname, nil, 0, tlsgen);
 400 }
 401
 402 static int
 403 tlsstat(Chan *c, uchar *db, int n)
 404 {
 405         return devstat(c, db, n, nil, 0, tlsgen);
 406 }
 407
 408 static Chan*
 409 tlsopen(Chan *c, int omode)
 410 {
 411         TlsRec *tr, **pp;
 412         int t, perm;
 413
 414         perm = 0;
 415         omode &= 3;
 416         switch(omode) {
 417         case OREAD:
 418                 perm = 4;
 419                 break;
 420         case OWRITE:
 421                 perm = 2;
 422                 break;
 423         case ORDWR:
 424                 perm = 6;
 425                 break;
 426         }
 427
 428         t = TYPE(c->qid);
 429         switch(t) {
 430         default:
 431                 panic("tlsopen");
 432         case Qtopdir:
 433         case Qprotodir:
 434         case Qconvdir:
 435                 if(omode != OREAD)
 436                         error(Eperm);
 437                 break;
 438         case Qclonus:
 439                 tr = newtls(c);
 440                 if(tr == nil)
 441                         error(Enodev);
 442                 break;
 443         case Qctl:
 444         case Qdata:
 445         case Qhand:
 446         case Qstatus:
 447         case Qstats:
 448                 if((t == Qstatus || t == Qstats) && omode != OREAD)
 449                         error(Eperm);
 450                 if(waserror()) {
 451                         unlock(&tdlock);
 452                         nexterror();
 453                 }
 454                 lock(&tdlock);
 455                 pp = &tlsdevs[CONV(c->qid)];
 456                 tr = *pp;
 457                 if(tr == nil)
 458                         error("must open connection using clone");
 459                 if((perm & (tr->perm>>6)) != perm
 460                 && (strcmp(up->user, tr->user) != 0
 461                     || (perm & tr->perm) != perm))
 462                         error(Eperm);
 463                 if(t == Qhand){
 464                         if(waserror()){
 465                                 unlock(&tr->hqlock);
 466                                 nexterror();
 467                         }
 468                         lock(&tr->hqlock);
 469                         if(tr->handq != nil)
 470                                 error(Einuse);
 471                         tr->handq = qopen(2 * MaxCipherRecLen, 0, nil, nil);
 472                         if(tr->handq == nil)
 473                                 error("cannot allocate handshake queue");
 474                         tr->hqref = 1;
 475                         unlock(&tr->hqlock);
 476                         poperror();
 477                 }
 478                 tr->ref++;
 479                 unlock(&tdlock);
 480                 poperror();
 481                 break;
 482         case Qencalgs:
 483         case Qhashalgs:
 484                 if(omode != OREAD)
 485                         error(Eperm);
 486                 break;
 487         }
 488         c->mode = openmode(omode);
 489         c->flag |= COPEN;
 490         c->offset = 0;
 491         c->iounit = qiomaxatomic;
 492         return c;
 493 }
 494
 495 static int
 496 tlswstat(Chan *c, uchar *dp, int n)
 497 {
 498         Dir *d;
 499         TlsRec *tr;
 500         int rv;
 501
 502         d = nil;
 503         if(waserror()){
 504                 free(d);
 505                 unlock(&tdlock);
 506                 nexterror();
 507         }
 508
 509         lock(&tdlock);
 510         tr = tlsdevs[CONV(c->qid)];
 511         if(tr == nil)
 512                 error(Ebadusefd);
 513         if(strcmp(tr->user, up->user) != 0)
 514                 error(Eperm);
 515
 516         d = smalloc(n + sizeof *d);
 517         rv = convM2D(dp, n, &d[0], (char*) &d[1]);
 518         if(rv == 0)
 519                 error(Eshortstat);
 520         if(!emptystr(d->uid))
 521                 kstrdup(&tr->user, d->uid);
 522         if(d->mode != ~0UL)
 523                 tr->perm = d->mode;
 524
 525         free(d);
 526         poperror();
 527         unlock(&tdlock);
 528
 529         return rv;
 530 }
 531
 532 static void
 533 dechandq(TlsRec *tr)
 534 {
 535         lock(&tr->hqlock);
 536         if(--tr->hqref == 0){
 537                 if(tr->handq != nil){
 538                         qfree(tr->handq);
 539                         tr->handq = nil;
 540                 }
 541                 if(tr->hprocessed != nil){
 542                         freeb(tr->hprocessed);
 543                         tr->hprocessed = nil;
 544                 }
 545         }
 546         unlock(&tr->hqlock);
 547 }
 548
 549 static void
 550 tlsclose(Chan *c)
 551 {
 552         TlsRec *tr;
 553         int t;
 554
 555         t = TYPE(c->qid);
 556         switch(t) {
 557         case Qctl:
 558         case Qdata:
 559         case Qhand:
 560         case Qstatus:
 561         case Qstats:
 562                 if((c->flag & COPEN) == 0)
 563                         break;
 564
 565                 tr = tlsdevs[CONV(c->qid)];
 566                 if(tr == nil)
 567                         break;
 568
 569                 if(t == Qhand)
 570                         dechandq(tr);
 571
 572                 lock(&tdlock);
 573                 if(--tr->ref > 0) {
 574                         unlock(&tdlock);
 575                         return;
 576                 }
 577                 tlsdevs[CONV(c->qid)] = nil;
 578                 unlock(&tdlock);
 579
 580                 if(tr->c != nil && !waserror()){
 581                         checkstate(tr, 0, SOpen|SHandshake|SRClose);
 582                         sendAlert(tr, ECloseNotify);
 583                         poperror();
 584                 }
 585                 tlshangup(tr);
 586                 if(tr->c != nil)
 587                         cclose(tr->c);
 588                 freeSec(tr->in.sec);
 589                 freeSec(tr->in.new);
 590                 freeSec(tr->out.sec);
 591                 freeSec(tr->out.new);
 592                 free(tr->user);
 593                 free(tr);
 594                 break;
 595         }
 596 }
 597
 598 /*
 599  *  make sure we have at least 'n' bytes in list 'l'
 600  */
 601 static void
 602 ensure(TlsRec *s, Block **l, int n)
 603 {
 604         int sofar, i;
 605         Block *b, *bl;
 606
 607         sofar = 0;
 608         for(b = *l; b; b = b->next){
 609                 sofar += BLEN(b);
 610                 if(sofar >= n)
 611                         return;
 612                 l = &b->next;
 613         }
 614
 615         while(sofar < n){
 616                 bl = devtab[s->c->type]->bread(s->c, MaxCipherRecLen + RecHdrLen, 0);
 617                 if(bl == 0)
 618                         error(Ehungup);
 619                 *l = bl;
 620                 i = 0;
 621                 for(b = bl; b; b = b->next){
 622                         i += BLEN(b);
 623                         l = &b->next;
 624                 }
 625                 if(i == 0)
 626                         error(Ehungup);
 627                 sofar += i;
 628         }
 629 if(s->debug) pprint("ensure read %d\n", sofar);
 630 }
 631
 632 /*
 633  *  copy 'n' bytes from 'l' into 'p' and free
 634  *  the bytes in 'l'
 635  */
 636 static void
 637 consume(Block **l, uchar *p, int n)
 638 {
 639         Block *b;
 640         int i;
 641
 642         for(; *l && n > 0; n -= i){
 643                 b = *l;
 644                 i = BLEN(b);
 645                 if(i > n)
 646                         i = n;
 647                 memmove(p, b->rp, i);
 648                 b->rp += i;
 649                 p += i;
 650                 if(BLEN(b) < 0)
 651                         panic("consume");
 652                 if(BLEN(b))
 653                         break;
 654                 *l = b->next;
 655                 freeb(b);
 656         }
 657 }
 658
 659 /*
 660  *  give back n bytes
 661  */
 662 static void
 663 regurgitate(TlsRec *s, uchar *p, int n)
 664 {
 665         Block *b;
 666
 667         if(n <= 0)
 668                 return;
 669         b = s->unprocessed;
 670         if(s->unprocessed == nil || b->rp - b->base < n) {
 671                 b = allocb(n);
 672                 memmove(b->wp, p, n);
 673                 b->wp += n;
 674                 b->next = s->unprocessed;
 675                 s->unprocessed = b;
 676         } else {
 677                 b->rp -= n;
 678                 memmove(b->rp, p, n);
 679         }
 680 }
 681
 682 /*
 683  *  remove at most n bytes from the queue
 684  */
 685 static Block*
 686 qgrab(Block **l, int n)
 687 {
 688         Block *bb, *b;
 689         int i;
 690
 691         b = *l;
 692         if(BLEN(b) == n){
 693                 *l = b->next;
 694                 b->next = nil;
 695                 return b;
 696         }
 697
 698         i = 0;
 699         for(bb = b; bb != nil && i < n; bb = bb->next)
 700                 i += BLEN(bb);
 701         if(i > n)
 702                 i = n;
 703
 704         bb = allocb(i);
 705         consume(l, bb->wp, i);
 706         bb->wp += i;
 707         return bb;
 708 }
 709
 710 static void
 711 tlsclosed(TlsRec *tr, int new)
 712 {
 713         lock(&tr->statelk);
 714         if(tr->state == SOpen || tr->state == SHandshake)
 715                 tr->state = new;
 716         else if((new | tr->state) == (SRClose|SLClose))
 717                 tr->state = SClosed;
 718         unlock(&tr->statelk);
 719         alertHand(tr, "close notify");
 720 }
 721
 722 /*
 723  *  read and process one tls record layer message
 724  *  must be called with tr->in.io held
 725  *  We can't let Eintrs lose data, since doing so will get
 726  *  us out of sync with the sender and break the reliablity
 727  *  of the channel.  Eintr only happens during the reads in
 728  *  consume.  Therefore we put back any bytes consumed before
 729  *  the last call to ensure.
 730  */
 731 static void
 732 tlsrecread(TlsRec *tr)
 733 {
 734         OneWay *volatile in;
 735         Block *volatile b;
 736         uchar *p, seq[8], header[RecHdrLen], hmac[MaxMacLen];
 737         int volatile nconsumed;
 738         int len, type, ver, unpad_len;
 739
 740         nconsumed = 0;
 741         if(waserror()){
 742                 if(strcmp(up->errstr, Eintr) == 0 && !waserror()){
 743                         regurgitate(tr, header, nconsumed);
 744                         poperror();
 745                 }else
 746                         tlsError(tr, "channel error");
 747                 nexterror();
 748         }
 749         ensure(tr, &tr->unprocessed, RecHdrLen);
 750         consume(&tr->unprocessed, header, RecHdrLen);
 751 if(tr->debug)pprint("consumed %d header\n", RecHdrLen);
 752         nconsumed = RecHdrLen;
 753
 754         if((tr->handin == 0) && (header[0] & 0x80)){
 755                 /* Cope with an SSL3 ClientHello expressed in SSL2 record format.
 756                         This is sent by some clients that we must interoperate
 757                         with, such as Java's JSSE and Microsoft's Internet Explorer. */
 758                 len = (get16(header) & ~0x8000) - 3;
 759                 type = header[2];
 760                 ver = get16(header + 3);
 761                 if(type != SSL2ClientHello || len < 22)
 762                         rcvError(tr, EProtocolVersion, "invalid initial SSL2-like message");
 763         }else{  /* normal SSL3 record format */
 764                 type = header[0];
 765                 ver = get16(header+1);
 766                 len = get16(header+3);
 767         }
 768         if(ver != tr->version && (tr->verset || ver < MinProtoVersion || ver > MaxProtoVersion))
 769                 rcvError(tr, EProtocolVersion, "devtls expected ver=%x%s, saw (len=%d) type=%x ver=%x '%.12s'",
 770                         tr->version, tr->verset?"/set":"", len, type, ver, (char*)header);
 771         if(len > MaxCipherRecLen || len < 0)
 772                 rcvError(tr, ERecordOverflow, "record message too long %d", len);
 773         ensure(tr, &tr->unprocessed, len);
 774         nconsumed = 0;
 775         poperror();
 776
 777         /*
 778          * If an Eintr happens after this, we'll get out of sync.
 779          * Make sure nothing we call can sleep.
 780          * Errors are ok, as they kill the connection.
 781          * Luckily, allocb won't sleep, it'll just error out.
 782          */
 783         b = nil;
 784         if(waserror()){
 785                 if(b != nil)
 786                         freeb(b);
 787                 tlsError(tr, "channel error");
 788                 nexterror();
 789         }
 790         b = qgrab(&tr->unprocessed, len);
 791 if(tr->debug) pprint("consumed unprocessed %d\n", len);
 792
 793         in = &tr->in;
 794         if(waserror()){
 795                 qunlock(&in->seclock);
 796                 nexterror();
 797         }
 798         qlock(&in->seclock);
 799         p = b->rp;
 800         if(in->sec != nil) {
 801                 /* to avoid Canvel-Hiltgen-Vaudenay-Vuagnoux attack, all errors here
 802                         should look alike, including timing of the response. */
 803                 unpad_len = (*in->sec->dec)(in->sec, p, len);
 804                 if(unpad_len >= in->sec->maclen)
 805                         len = unpad_len - in->sec->maclen;
 806 if(tr->debug) pprint("decrypted %d\n", unpad_len);
 807 if(tr->debug) pdump(unpad_len, p, "decrypted:");
 808
 809                 /* update length */
 810                 put16(header+3, len);
 811                 put64(seq, in->seq);
 812                 in->seq++;
 813                 (*tr->packMac)(in->sec, in->sec->mackey, seq, header, p, len, hmac);
 814                 if(unpad_len < in->sec->maclen)
 815                         rcvError(tr, EBadRecordMac, "short record mac");
 816                 if(memcmp(hmac, p+len, in->sec->maclen) != 0)
 817                         rcvError(tr, EBadRecordMac, "record mac mismatch");
 818                 b->wp = b->rp + len;
 819         }
 820         qunlock(&in->seclock);
 821         poperror();
 822         if(len < 0)
 823                 rcvError(tr, EDecodeError, "runt record message");
 824
 825         switch(type) {
 826         default:
 827                 rcvError(tr, EIllegalParameter, "invalid record message %#x", type);
 828                 break;
 829         case RChangeCipherSpec:
 830                 if(len != 1 || p[0] != 1)
 831                         rcvError(tr, EDecodeError, "invalid change cipher spec");
 832                 qlock(&in->seclock);
 833                 if(in->new == nil){
 834                         qunlock(&in->seclock);
 835                         rcvError(tr, EUnexpectedMessage, "unexpected change cipher spec");
 836                 }
 837                 freeSec(in->sec);
 838                 in->sec = in->new;
 839                 in->new = nil;
 840                 in->seq = 0;
 841                 qunlock(&in->seclock);
 842                 break;
 843         case RAlert:
 844                 if(len != 2)
 845                         rcvError(tr, EDecodeError, "invalid alert");
 846                 if(p[0] == 2)
 847                         rcvAlert(tr, p[1]);
 848                 if(p[0] != 1)
 849                         rcvError(tr, EIllegalParameter, "invalid alert fatal code");
 850
 851                 /*
 852                  * propagate non-fatal alerts to handshaker
 853                  */
 854                 switch(p[1]){
 855                 case ECloseNotify:
 856                         tlsclosed(tr, SRClose);
 857                         if(tr->opened)
 858                                 error("tls hungup");
 859                         error("close notify");
 860                         break;
 861                 case ENoRenegotiation:
 862                         alertHand(tr, "no renegotiation");
 863                         break;
 864                 case EUserCanceled:
 865                         alertHand(tr, "handshake canceled by user");
 866                         break;
 867                 case EUnrecognizedName:
 868                         /* happens in response to SNI, can be ignored. */
 869                         break;
 870                 default:
 871                         rcvError(tr, EIllegalParameter, "invalid alert code");
 872                 }
 873                 break;
 874         case RHandshake:
 875                 /*
 876                  * don't worry about dropping the block
 877                  * qbwrite always queues even if flow controlled and interrupted.
 878                  *
 879                  * if there isn't any handshaker, ignore the request,
 880                  * but notify the other side we are doing so.
 881                  */
 882                 lock(&tr->hqlock);
 883                 if(tr->handq != nil){
 884                         tr->hqref++;
 885                         unlock(&tr->hqlock);
 886                         if(waserror()){
 887                                 dechandq(tr);
 888                                 nexterror();
 889                         }
 890                         b = padblock(b, 1);
 891                         *b->rp = RHandshake;
 892                         qbwrite(tr->handq, b);
 893                         b = nil;
 894                         poperror();
 895                         dechandq(tr);
 896                 }else{
 897                         unlock(&tr->hqlock);
 898                         if(tr->verset && tr->version != SSL3Version && !waserror()){
 899                                 sendAlert(tr, ENoRenegotiation);
 900                                 poperror();
 901                         }
 902                 }
 903                 break;
 904         case SSL2ClientHello:
 905                 lock(&tr->hqlock);
 906                 if(tr->handq != nil){
 907                         tr->hqref++;
 908                         unlock(&tr->hqlock);
 909                         if(waserror()){
 910                                 dechandq(tr);
 911                                 nexterror();
 912                         }
 913                         /* Pass the SSL2 format data, so that the handshake code can compute
 914                                 the correct checksums.  HSSL2ClientHello = HandshakeType 9 is
 915                                 unused in RFC2246. */
 916                         b = padblock(b, 8);
 917                         b->rp[0] = RHandshake;
 918                         b->rp[1] = HSSL2ClientHello;
 919                         put24(&b->rp[2], len+3);
 920                         b->rp[5] = SSL2ClientHello;
 921                         put16(&b->rp[6], ver);
 922                         qbwrite(tr->handq, b);
 923                         b = nil;
 924                         poperror();
 925                         dechandq(tr);
 926                 }else{
 927                         unlock(&tr->hqlock);
 928                         if(tr->verset && tr->version != SSL3Version && !waserror()){
 929                                 sendAlert(tr, ENoRenegotiation);
 930                                 poperror();
 931                         }
 932                 }
 933                 break;
 934         case RApplication:
 935                 if(!tr->opened)
 936                         rcvError(tr, EUnexpectedMessage, "application message received before handshake completed");
 937                 if(BLEN(b) > 0){
 938                         tr->processed = b;
 939                         b = nil;
 940                 }
 941                 break;
 942         }
 943         if(b != nil)
 944                 freeb(b);
 945         poperror();
 946 }
 947
 948 /*
 949  * got a fatal alert message
 950  */
 951 static void
 952 rcvAlert(TlsRec *tr, int err)
 953 {
 954         char *s;
 955         int i;
 956
 957         s = "unknown error";
 958         for(i=0; i < nelem(tlserrs); i++){
 959                 if(tlserrs[i].err == err){
 960                         s = tlserrs[i].msg;
 961                         break;
 962                 }
 963         }
 964 if(tr->debug) pprint("rcvAlert: %s\n", s);
 965
 966         tlsError(tr, s);
 967         if(!tr->opened)
 968                 error(s);
 969         error("tls error");
 970 }
 971
 972 /*
 973  * found an error while decoding the input stream
 974  */
 975 static void
 976 rcvError(TlsRec *tr, int err, char *fmt, ...)
 977 {
 978         char msg[ERRMAX];
 979         va_list arg;
 980
 981         va_start(arg, fmt);
 982         vseprint(msg, msg+sizeof(msg), fmt, arg);
 983         va_end(arg);
 984 if(tr->debug) pprint("rcvError: %s\n", msg);
 985
 986         sendAlert(tr, err);
 987
 988         if(!tr->opened)
 989                 error(msg);
 990         error("tls error");
 991 }
 992
 993 /*
 994  * make sure the next hand operation returns with a 'msg' error
 995  */
 996 static void
 997 alertHand(TlsRec *tr, char *msg)
 998 {
 999         Block *b;
1000         int n;
1001
1002         lock(&tr->hqlock);
1003         if(tr->handq == nil){
1004                 unlock(&tr->hqlock);
1005                 return;
1006         }
1007         tr->hqref++;
1008         unlock(&tr->hqlock);
1009
1010         n = strlen(msg);
1011         if(waserror()){
1012                 dechandq(tr);
1013                 nexterror();
1014         }
1015         b = allocb(n + 2);
1016         *b->wp++ = RAlert;
1017         memmove(b->wp, msg, n + 1);
1018         b->wp += n + 1;
1019
1020         qbwrite(tr->handq, b);
1021
1022         poperror();
1023         dechandq(tr);
1024 }
1025
1026 static void
1027 checkstate(TlsRec *tr, int ishand, int ok)
1028 {
1029         int state;
1030
1031         lock(&tr->statelk);
1032         state = tr->state;
1033         unlock(&tr->statelk);
1034         if(state & ok)
1035                 return;
1036         switch(state){
1037         case SHandshake:
1038         case SOpen:
1039                 break;
1040         case SError:
1041         case SAlert:
1042                 if(ishand)
1043                         error(tr->err);
1044                 error("tls error");
1045         case SRClose:
1046         case SLClose:
1047         case SClosed:
1048                 error("tls hungup");
1049         }
1050         error("tls improperly configured");
1051 }
1052
1053 static Block*
1054 tlsbread(Chan *c, long n, ulong offset)
1055 {
1056         int ty;
1057         Block *b;
1058         TlsRec *volatile tr;
1059
1060         ty = TYPE(c->qid);
1061         switch(ty) {
1062         default:
1063                 return devbread(c, n, offset);
1064         case Qhand:
1065         case Qdata:
1066                 break;
1067         }
1068
1069         tr = tlsdevs[CONV(c->qid)];
1070         if(tr == nil)
1071                 panic("tlsbread");
1072
1073         if(waserror()){
1074                 qunlock(&tr->in.io);
1075                 nexterror();
1076         }
1077         qlock(&tr->in.io);
1078         if(ty == Qdata){
1079                 checkstate(tr, 0, SOpen);
1080                 while(tr->processed == nil)
1081                         tlsrecread(tr);
1082
1083                 /* return at most what was asked for */
1084                 b = qgrab(&tr->processed, n);
1085 if(tr->debug) pprint("consumed processed %ld\n", BLEN(b));
1086 if(tr->debug) pdump(BLEN(b), b->rp, "consumed:");
1087                 qunlock(&tr->in.io);
1088                 poperror();
1089                 tr->datain += BLEN(b);
1090         }else{
1091                 checkstate(tr, 1, SOpen|SHandshake|SLClose);
1092
1093                 /*
1094                  * it's ok to look at state without the lock
1095                  * since it only protects reading records,
1096                  * and we have that tr->in.io held.
1097                  */
1098                 while(!tr->opened && tr->hprocessed == nil && !qcanread(tr->handq))
1099                         tlsrecread(tr);
1100
1101                 qunlock(&tr->in.io);
1102                 poperror();
1103
1104                 if(waserror()){
1105                         qunlock(&tr->hqread);
1106                         nexterror();
1107                 }
1108                 qlock(&tr->hqread);
1109                 if(tr->hprocessed == nil){
1110                         b = qbread(tr->handq, MaxRecLen + 1);
1111                         if(*b->rp++ == RAlert){
1112                                 kstrcpy(up->errstr, (char*)b->rp, ERRMAX);
1113                                 freeb(b);
1114                                 nexterror();
1115                         }
1116                         tr->hprocessed = b;
1117                 }
1118                 b = qgrab(&tr->hprocessed, n);
1119                 poperror();
1120                 qunlock(&tr->hqread);
1121                 tr->handin += BLEN(b);
1122         }
1123
1124         return b;
1125 }
1126
1127 static long
1128 tlsread(Chan *c, void *a, long n, vlong off)
1129 {
1130         Block *volatile b;
1131         Block *nb;
1132         uchar *va;
1133         int i, ty;
1134         char *buf, *s, *e;
1135         ulong offset = off;
1136         TlsRec * tr;
1137
1138         if(c->qid.type & QTDIR)
1139                 return devdirread(c, a, n, 0, 0, tlsgen);
1140
1141         tr = tlsdevs[CONV(c->qid)];
1142         ty = TYPE(c->qid);
1143         switch(ty) {
1144         default:
1145                 error(Ebadusefd);
1146         case Qstatus:
1147                 buf = smalloc(Statlen);
1148                 qlock(&tr->in.seclock);
1149                 qlock(&tr->out.seclock);
1150                 s = buf;
1151                 e = buf + Statlen;
1152                 s = seprint(s, e, "State: %s\n", tlsstate(tr->state));
1153                 s = seprint(s, e, "Version: %#x\n", tr->version);
1154                 if(tr->in.sec != nil)
1155                         s = seprint(s, e, "EncIn: %s\nHashIn: %s\n", tr->in.sec->encalg, tr->in.sec->hashalg);
1156                 if(tr->in.new != nil)
1157                         s = seprint(s, e, "NewEncIn: %s\nNewHashIn: %s\n", tr->in.new->encalg, tr->in.new->hashalg);
1158                 if(tr->out.sec != nil)
1159                         s = seprint(s, e, "EncOut: %s\nHashOut: %s\n", tr->out.sec->encalg, tr->out.sec->hashalg);
1160                 if(tr->out.new != nil)
1161                         seprint(s, e, "NewEncOut: %s\nNewHashOut: %s\n", tr->out.new->encalg, tr->out.new->hashalg);
1162                 qunlock(&tr->in.seclock);
1163                 qunlock(&tr->out.seclock);
1164                 n = readstr(offset, a, n, buf);
1165                 free(buf);
1166                 return n;
1167         case Qstats:
1168                 buf = smalloc(Statlen);
1169                 s = buf;
1170                 e = buf + Statlen;
1171                 s = seprint(s, e, "DataIn: %lld\n", tr->datain);
1172                 s = seprint(s, e, "DataOut: %lld\n", tr->dataout);
1173                 s = seprint(s, e, "HandIn: %lld\n", tr->handin);
1174                 seprint(s, e, "HandOut: %lld\n", tr->handout);
1175                 n = readstr(offset, a, n, buf);
1176                 free(buf);
1177                 return n;
1178         case Qctl:
1179                 buf = smalloc(Statlen);
1180                 snprint(buf, Statlen, "%llud", CONV(c->qid));
1181                 n = readstr(offset, a, n, buf);
1182                 free(buf);
1183                 return n;
1184         case Qdata:
1185         case Qhand:
1186                 b = tlsbread(c, n, offset);
1187                 break;
1188         case Qencalgs:
1189                 return readstr(offset, a, n, encalgs);
1190         case Qhashalgs:
1191                 return readstr(offset, a, n, hashalgs);
1192         }
1193
1194         if(waserror()){
1195                 freeblist(b);
1196                 nexterror();
1197         }
1198
1199         n = 0;
1200         va = a;
1201         for(nb = b; nb; nb = nb->next){
1202                 i = BLEN(nb);
1203                 memmove(va+n, nb->rp, i);
1204                 n += i;
1205         }
1206
1207         freeblist(b);
1208         poperror();
1209
1210         return n;
1211 }
1212
1213 /*
1214  *  write a block in tls records
1215  */
1216 static void
1217 tlsrecwrite(TlsRec *tr, int type, Block *b)
1218 {
1219         Block *volatile bb;
1220         Block *nb;
1221         uchar *p, seq[8];
1222         OneWay *volatile out;
1223         int n, maclen, pad, ok;
1224
1225         out = &tr->out;
1226         bb = b;
1227         if(waserror()){
1228                 qunlock(&out->io);
1229                 if(bb != nil)
1230                         freeb(bb);
1231                 nexterror();
1232         }
1233         qlock(&out->io);
1234 if(tr->debug)pprint("send %ld\n", BLEN(b));
1235 if(tr->debug)pdump(BLEN(b), b->rp, "sent:");
1236
1237
1238         ok = SHandshake|SOpen|SRClose;
1239         if(type == RAlert)
1240                 ok |= SAlert;
1241         while(bb != nil){
1242                 checkstate(tr, type != RApplication, ok);
1243
1244                 /*
1245                  * get at most one maximal record's input,
1246                  * with padding on the front for header and
1247                  * back for mac and maximal block padding.
1248                  */
1249                 if(waserror()){
1250                         qunlock(&out->seclock);
1251                         nexterror();
1252                 }
1253                 qlock(&out->seclock);
1254                 maclen = 0;
1255                 pad = 0;
1256                 if(out->sec != nil){
1257                         maclen = out->sec->maclen;
1258                         pad = maclen + out->sec->block;
1259                 }
1260                 n = BLEN(bb);
1261                 if(n > MaxRecLen){
1262                         n = MaxRecLen;
1263                         nb = allocb(n + pad + RecHdrLen);
1264                         memmove(nb->wp + RecHdrLen, bb->rp, n);
1265                         bb->rp += n;
1266                 }else{
1267                         /*
1268                          * carefully reuse bb so it will get freed if we're out of memory
1269                          */
1270                         bb = padblock(bb, RecHdrLen);
1271                         if(pad)
1272                                 nb = padblock(bb, -pad);
1273                         else
1274                                 nb = bb;
1275                         bb = nil;
1276                 }
1277
1278                 p = nb->rp;
1279                 p[0] = type;
1280                 put16(p+1, tr->version);
1281                 put16(p+3, n);
1282
1283                 if(out->sec != nil){
1284                         put64(seq, out->seq);
1285                         out->seq++;
1286                         (*tr->packMac)(out->sec, out->sec->mackey, seq, p, p + RecHdrLen, n, p + RecHdrLen + n);
1287                         n += maclen;
1288
1289                         /* encrypt */
1290                         n = (*out->sec->enc)(out->sec, p + RecHdrLen, n);
1291                         nb->wp = p + RecHdrLen + n;
1292
1293                         /* update length */
1294                         put16(p+3, n);
1295                 }
1296                 if(type == RChangeCipherSpec){
1297                         if(out->new == nil)
1298                                 error("change cipher without a new cipher");
1299                         freeSec(out->sec);
1300                         out->sec = out->new;
1301                         out->new = nil;
1302                         out->seq = 0;
1303                 }
1304                 qunlock(&out->seclock);
1305                 poperror();
1306
1307                 /*
1308                  * if bwrite error's, we assume the block is queued.
1309                  * if not, we're out of sync with the receiver and will not recover.
1310                  */
1311                 if(waserror()){
1312                         if(strcmp(up->errstr, "interrupted") != 0)
1313                                 tlsError(tr, "channel error");
1314                         nexterror();
1315                 }
1316                 devtab[tr->c->type]->bwrite(tr->c, nb, 0);
1317                 poperror();
1318         }
1319         qunlock(&out->io);
1320         poperror();
1321 }
1322
1323 static long
1324 tlsbwrite(Chan *c, Block *b, ulong offset)
1325 {
1326         int ty;
1327         ulong n;
1328         TlsRec *tr;
1329
1330         n = BLEN(b);
1331
1332         tr = tlsdevs[CONV(c->qid)];
1333         if(tr == nil)
1334                 panic("tlsbwrite");
1335
1336         ty = TYPE(c->qid);
1337         switch(ty) {
1338         default:
1339                 return devbwrite(c, b, offset);
1340         case Qhand:
1341                 tlsrecwrite(tr, RHandshake, b);
1342                 tr->handout += n;
1343                 break;
1344         case Qdata:
1345                 checkstate(tr, 0, SOpen);
1346                 tlsrecwrite(tr, RApplication, b);
1347                 tr->dataout += n;
1348                 break;
1349         }
1350
1351         return n;
1352 }
1353
1354 typedef struct Hashalg Hashalg;
1355 struct Hashalg
1356 {
1357         char    *name;
1358         int     maclen;
1359         void    (*initkey)(Hashalg *, int, Secret *, uchar*);
1360 };
1361
1362 static void
1363 initmd5key(Hashalg *ha, int version, Secret *s, uchar *p)
1364 {
1365         s->maclen = ha->maclen;
1366         if(version == SSL3Version)
1367                 s->mac = sslmac_md5;
1368         else
1369                 s->mac = hmac_md5;
1370         memmove(s->mackey, p, ha->maclen);
1371 }
1372
1373 static void
1374 initclearmac(Hashalg *, int, Secret *s, uchar *)
1375 {
1376         s->maclen = 0;
1377         s->mac = nomac;
1378 }
1379
1380 static void
1381 initsha1key(Hashalg *ha, int version, Secret *s, uchar *p)
1382 {
1383         s->maclen = ha->maclen;
1384         if(version == SSL3Version)
1385                 s->mac = sslmac_sha1;
1386         else
1387                 s->mac = hmac_sha1;
1388         memmove(s->mackey, p, ha->maclen);
1389 }
1390
1391 static Hashalg hashtab[] =
1392 {
1393         { "clear", 0, initclearmac, },
1394         { "md5", MD5dlen, initmd5key, },
1395         { "sha1", SHA1dlen, initsha1key, },
1396         { 0 }
1397 };
1398
1399 static Hashalg*
1400 parsehashalg(char *p)
1401 {
1402         Hashalg *ha;
1403
1404         for(ha = hashtab; ha->name; ha++)
1405                 if(strcmp(p, ha->name) == 0)
1406                         return ha;
1407         error("unsupported hash algorithm");
1408         return nil;
1409 }
1410
1411 typedef struct Encalg Encalg;
1412 struct Encalg
1413 {
1414         char    *name;
1415         int     keylen;
1416         int     ivlen;
1417         void    (*initkey)(Encalg *ea, Secret *, uchar*, uchar*);
1418 };
1419
1420 static void
1421 initRC4key(Encalg *ea, Secret *s, uchar *p, uchar *)
1422 {
1423         s->enckey = smalloc(sizeof(RC4state));
1424         s->enc = rc4enc;
1425         s->dec = rc4enc;
1426         s->block = 0;
1427         setupRC4state(s->enckey, p, ea->keylen);
1428 }
1429
1430 static void
1431 initDES3key(Encalg *, Secret *s, uchar *p, uchar *iv)
1432 {
1433         s->enckey = smalloc(sizeof(DES3state));
1434         s->enc = des3enc;
1435         s->dec = des3dec;
1436         s->block = 8;
1437         setupDES3state(s->enckey, (uchar(*)[8])p, iv);
1438 }
1439
1440 static void
1441 initAESkey(Encalg *ea, Secret *s, uchar *p, uchar *iv)
1442 {
1443         s->enckey = smalloc(sizeof(AESstate));
1444         s->enc = aesenc;
1445         s->dec = aesdec;
1446         s->block = 16;
1447         setupAESstate(s->enckey, p, ea->keylen, iv);
1448 }
1449
1450 static void
1451 initclearenc(Encalg *, Secret *s, uchar *, uchar *)
1452 {
1453         s->enc = noenc;
1454         s->dec = noenc;
1455         s->block = 0;
1456 }
1457
1458 static Encalg encrypttab[] =
1459 {
1460         { "clear", 0, 0, initclearenc },
1461         { "rc4_128", 128/8, 0, initRC4key },
1462         { "3des_ede_cbc", 3 * 8, 8, initDES3key },
1463         { "aes_128_cbc", 128/8, 16, initAESkey },
1464         { "aes_256_cbc", 256/8, 16, initAESkey },
1465         { 0 }
1466 };
1467
1468 static Encalg*
1469 parseencalg(char *p)
1470 {
1471         Encalg *ea;
1472
1473         for(ea = encrypttab; ea->name; ea++)
1474                 if(strcmp(p, ea->name) == 0)
1475                         return ea;
1476         error("unsupported encryption algorithm");
1477         return nil;
1478 }
1479
1480 static long
1481 tlswrite(Chan *c, void *a, long n, vlong off)
1482 {
1483         Encalg *ea;
1484         Hashalg *ha;
1485         TlsRec *volatile tr;
1486         Secret *volatile tos, *volatile toc;
1487         Block *volatile b;
1488         Cmdbuf *volatile cb;
1489         int m, ty;
1490         char *p, *e;
1491         uchar *volatile x;
1492         ulong offset = off;
1493
1494         tr = tlsdevs[CONV(c->qid)];
1495         if(tr == nil)
1496                 panic("tlswrite");
1497
1498         ty = TYPE(c->qid);
1499         switch(ty){
1500         case Qdata:
1501         case Qhand:
1502                 p = a;
1503                 e = p + n;
1504                 do{
1505                         m = e - p;
1506                         if(m > MaxRecLen)
1507                                 m = MaxRecLen;
1508
1509                         b = allocb(m);
1510                         if(waserror()){
1511                                 freeb(b);
1512                                 nexterror();
1513                         }
1514                         memmove(b->wp, p, m);
1515                         poperror();
1516                         b->wp += m;
1517
1518                         tlsbwrite(c, b, offset);
1519
1520                         p += m;
1521                 }while(p < e);
1522                 return n;
1523         case Qctl:
1524                 break;
1525         default:
1526                 error(Ebadusefd);
1527                 return -1;
1528         }
1529
1530         cb = parsecmd(a, n);
1531         if(waserror()){
1532                 free(cb);
1533                 nexterror();
1534         }
1535         if(cb->nf < 1)
1536                 error("short control request");
1537
1538         /* mutex with operations using what we're about to change */
1539         if(waserror()){
1540                 qunlock(&tr->in.seclock);
1541                 qunlock(&tr->out.seclock);
1542                 nexterror();
1543         }
1544         qlock(&tr->in.seclock);
1545         qlock(&tr->out.seclock);
1546
1547         if(strcmp(cb->f[0], "fd") == 0){
1548                 if(cb->nf != 3)
1549                         error("usage: fd open-fd version");
1550                 if(tr->c != nil)
1551                         error(Einuse);
1552                 m = strtol(cb->f[2], nil, 0);
1553                 if(m < MinProtoVersion || m > MaxProtoVersion)
1554                         error("unsupported version");
1555                 tr->c = buftochan(cb->f[1]);
1556                 tr->version = m;
1557                 tlsSetState(tr, SHandshake, SClosed);
1558         }else if(strcmp(cb->f[0], "version") == 0){
1559                 if(cb->nf != 2)
1560                         error("usage: version vers");
1561                 if(tr->c == nil)
1562                         error("must set fd before version");
1563                 if(tr->verset)
1564                         error("version already set");
1565                 m = strtol(cb->f[1], nil, 0);
1566                 if(m == SSL3Version)
1567                         tr->packMac = sslPackMac;
1568                 else if(m == TLSVersion)
1569                         tr->packMac = tlsPackMac;
1570                 else
1571                         error("unsupported version");
1572                 tr->verset = 1;
1573                 tr->version = m;
1574         }else if(strcmp(cb->f[0], "secret") == 0){
1575                 if(cb->nf != 5)
1576                         error("usage: secret hashalg encalg isclient secretdata");
1577                 if(tr->c == nil || !tr->verset)
1578                         error("must set fd and version before secrets");
1579
1580                 if(tr->in.new != nil){
1581                         freeSec(tr->in.new);
1582                         tr->in.new = nil;
1583                 }
1584                 if(tr->out.new != nil){
1585                         freeSec(tr->out.new);
1586                         tr->out.new = nil;
1587                 }
1588
1589                 ha = parsehashalg(cb->f[1]);
1590                 ea = parseencalg(cb->f[2]);
1591
1592                 p = cb->f[4];
1593                 m = (strlen(p)*3)/2;
1594                 x = smalloc(m);
1595                 tos = nil;
1596                 toc = nil;
1597                 if(waserror()){
1598                         freeSec(tos);
1599                         freeSec(toc);
1600                         free(x);
1601                         nexterror();
1602                 }
1603                 m = dec64(x, m, p, strlen(p));
1604                 if(m < 2 * ha->maclen + 2 * ea->keylen + 2 * ea->ivlen)
1605                         error("not enough secret data provided");
1606
1607                 tos = smalloc(sizeof(Secret));
1608                 toc = smalloc(sizeof(Secret));
1609                 if(!ha->initkey || !ea->initkey)
1610                         error("misimplemented secret algorithm");
1611                 (*ha->initkey)(ha, tr->version, tos, &x[0]);
1612                 (*ha->initkey)(ha, tr->version, toc, &x[ha->maclen]);
1613                 (*ea->initkey)(ea, tos, &x[2 * ha->maclen], &x[2 * ha->maclen + 2 * ea->keylen]);
1614                 (*ea->initkey)(ea, toc, &x[2 * ha->maclen + ea->keylen], &x[2 * ha->maclen + 2 * ea->keylen + ea->ivlen]);
1615
1616                 if(!tos->mac || !tos->enc || !tos->dec
1617                 || !toc->mac || !toc->enc || !toc->dec)
1618                         error("missing algorithm implementations");
1619                 if(strtol(cb->f[3], nil, 0) == 0){
1620                         tr->in.new = tos;
1621                         tr->out.new = toc;
1622                 }else{
1623                         tr->in.new = toc;
1624                         tr->out.new = tos;
1625                 }
1626                 if(tr->version == SSL3Version){
1627                         toc->unpad = sslunpad;
1628                         tos->unpad = sslunpad;
1629                 }else{
1630                         toc->unpad = tlsunpad;
1631                         tos->unpad = tlsunpad;
1632                 }
1633                 toc->encalg = ea->name;
1634                 toc->hashalg = ha->name;
1635                 tos->encalg = ea->name;
1636                 tos->hashalg = ha->name;
1637
1638                 free(x);
1639                 poperror();
1640         }else if(strcmp(cb->f[0], "changecipher") == 0){
1641                 if(cb->nf != 1)
1642                         error("usage: changecipher");
1643                 if(tr->out.new == nil)
1644                         error("cannot change cipher spec without setting secret");
1645
1646                 qunlock(&tr->in.seclock);
1647                 qunlock(&tr->out.seclock);
1648                 poperror();
1649                 free(cb);
1650                 poperror();
1651
1652                 /*
1653                  * the real work is done as the message is written
1654                  * so the stream is encrypted in sync.
1655                  */
1656                 b = allocb(1);
1657                 *b->wp++ = 1;
1658                 tlsrecwrite(tr, RChangeCipherSpec, b);
1659                 return n;
1660         }else if(strcmp(cb->f[0], "opened") == 0){
1661                 if(cb->nf != 1)
1662                         error("usage: opened");
1663                 if(tr->in.sec == nil || tr->out.sec == nil)
1664                         error("cipher must be configured before enabling data messages");
1665                 lock(&tr->statelk);
1666                 if(tr->state != SHandshake && tr->state != SOpen){
1667                         unlock(&tr->statelk);
1668                         error("cannot enable data messages");
1669                 }
1670                 tr->state = SOpen;
1671                 unlock(&tr->statelk);
1672                 tr->opened = 1;
1673         }else if(strcmp(cb->f[0], "alert") == 0){
1674                 if(cb->nf != 2)
1675                         error("usage: alert n");
1676                 if(tr->c == nil)
1677                         error("must set fd before sending alerts");
1678                 m = strtol(cb->f[1], nil, 0);
1679
1680                 qunlock(&tr->in.seclock);
1681                 qunlock(&tr->out.seclock);
1682                 poperror();
1683                 free(cb);
1684                 poperror();
1685
1686                 sendAlert(tr, m);
1687
1688                 if(m == ECloseNotify)
1689                         tlsclosed(tr, SLClose);
1690
1691                 return n;
1692         } else if(strcmp(cb->f[0], "debug") == 0){
1693                 if(cb->nf == 2){
1694                         if(strcmp(cb->f[1], "on") == 0)
1695                                 tr->debug = 1;
1696                         else
1697                                 tr->debug = 0;
1698                 } else
1699                         tr->debug = 1;
1700         } else
1701                 error(Ebadarg);
1702
1703         qunlock(&tr->in.seclock);
1704         qunlock(&tr->out.seclock);
1705         poperror();
1706         free(cb);
1707         poperror();
1708
1709         return n;
1710 }
1711
1712 static void
1713 tlsinit(void)
1714 {
1715         struct Encalg *e;
1716         struct Hashalg *h;
1717         int n;
1718         char *cp;
1719         static int already;
1720
1721         if(!already){
1722                 fmtinstall('H', encodefmt);
1723                 already = 1;
1724         }
1725
1726         tlsdevs = smalloc(sizeof(TlsRec*) * maxtlsdevs);
1727         trnames = smalloc((sizeof *trnames) * maxtlsdevs);
1728
1729         n = 1;
1730         for(e = encrypttab; e->name != nil; e++)
1731                 n += strlen(e->name) + 1;
1732         cp = encalgs = smalloc(n);
1733         for(e = encrypttab;;){
1734                 strcpy(cp, e->name);
1735                 cp += strlen(e->name);
1736                 e++;
1737                 if(e->name == nil)
1738                         break;
1739                 *cp++ = ' ';
1740         }
1741         *cp = 0;
1742
1743         n = 1;
1744         for(h = hashtab; h->name != nil; h++)
1745                 n += strlen(h->name) + 1;
1746         cp = hashalgs = smalloc(n);
1747         for(h = hashtab;;){
1748                 strcpy(cp, h->name);
1749                 cp += strlen(h->name);
1750                 h++;
1751                 if(h->name == nil)
1752                         break;
1753                 *cp++ = ' ';
1754         }
1755         *cp = 0;
1756 }
1757
1758 Dev tlsdevtab = {
1759         'a',
1760         "tls",
1761
1762         devreset,
1763         tlsinit,
1764         devshutdown,
1765         tlsattach,
1766         tlswalk,
1767         tlsstat,
1768         tlsopen,
1769         devcreate,
1770         tlsclose,
1771         tlsread,
1772         tlsbread,
1773         tlswrite,
1774         tlsbwrite,
1775         devremove,
1776         tlswstat,
1777 };
1778
1779 /* get channel associated with an fd */
1780 static Chan*
1781 buftochan(char *p)
1782 {
1783         Chan *c;
1784         int fd;
1785
1786         if(p == 0)
1787                 error(Ebadarg);
1788         fd = strtoul(p, 0, 0);
1789         if(fd < 0)
1790                 error(Ebadarg);
1791         c = fdtochan(fd, -1, 0, 1);     /* error check and inc ref */
1792         return c;
1793 }
1794
1795 static void
1796 sendAlert(TlsRec *tr, int err)
1797 {
1798         Block *b;
1799         int i, fatal;
1800         char *msg;
1801
1802 if(tr->debug)pprint("sendAlert %d\n", err);
1803         fatal = 1;
1804         msg = "tls unknown alert";
1805         for(i=0; i < nelem(tlserrs); i++) {
1806                 if(tlserrs[i].err == err) {
1807                         msg = tlserrs[i].msg;
1808                         if(tr->version == SSL3Version)
1809                                 err = tlserrs[i].sslerr;
1810                         else
1811                                 err = tlserrs[i].tlserr;
1812                         fatal = tlserrs[i].fatal;
1813                         break;
1814                 }
1815         }
1816
1817         if(!waserror()){
1818                 b = allocb(2);
1819                 *b->wp++ = fatal + 1;
1820                 *b->wp++ = err;
1821                 if(fatal)
1822                         tlsSetState(tr, SAlert, SOpen|SHandshake|SRClose);
1823                 tlsrecwrite(tr, RAlert, b);
1824                 poperror();
1825         }
1826         if(fatal)
1827                 tlsError(tr, msg);
1828 }
1829
1830 static void
1831 tlsError(TlsRec *tr, char *msg)
1832 {
1833         int s;
1834
1835 if(tr->debug)pprint("tlsError %s\n", msg);
1836         lock(&tr->statelk);
1837         s = tr->state;
1838         tr->state = SError;
1839         if(s != SError){
1840                 strncpy(tr->err, msg, ERRMAX - 1);
1841                 tr->err[ERRMAX - 1] = '\0';
1842         }
1843         unlock(&tr->statelk);
1844         if(s != SError)
1845                 alertHand(tr, msg);
1846 }
1847
1848 static void
1849 tlsSetState(TlsRec *tr, int new, int old)
1850 {
1851         lock(&tr->statelk);
1852         if(tr->state & old)
1853                 tr->state = new;
1854         unlock(&tr->statelk);
1855 }
1856
1857 /* hand up a digest connection */
1858 static void
1859 tlshangup(TlsRec *tr)
1860 {
1861         Block *b;
1862
1863         qlock(&tr->in.io);
1864         for(b = tr->processed; b; b = tr->processed){
1865                 tr->processed = b->next;
1866                 freeb(b);
1867         }
1868         if(tr->unprocessed != nil){
1869                 freeb(tr->unprocessed);
1870                 tr->unprocessed = nil;
1871         }
1872         qunlock(&tr->in.io);
1873
1874         tlsSetState(tr, SClosed, ~0);
1875 }
1876
1877 static TlsRec*
1878 newtls(Chan *ch)
1879 {
1880         TlsRec **pp, **ep, **np;
1881         char **nmp;
1882         int t, newmax;
1883
1884         if(waserror()) {
1885                 unlock(&tdlock);
1886                 nexterror();
1887         }
1888         lock(&tdlock);
1889         ep = &tlsdevs[maxtlsdevs];
1890         for(pp = tlsdevs; pp < ep; pp++)
1891                 if(*pp == nil)
1892                         break;
1893         if(pp >= ep) {
1894                 if(maxtlsdevs >= MaxTlsDevs) {
1895                         unlock(&tdlock);
1896                         poperror();
1897                         return nil;
1898                 }
1899                 newmax = 2 * maxtlsdevs;
1900                 if(newmax > MaxTlsDevs)
1901                         newmax = MaxTlsDevs;
1902                 np = smalloc(sizeof(TlsRec*) * newmax);
1903                 memmove(np, tlsdevs, sizeof(TlsRec*) * maxtlsdevs);
1904                 tlsdevs = np;
1905                 pp = &tlsdevs[maxtlsdevs];
1906                 memset(pp, 0, sizeof(TlsRec*)*(newmax - maxtlsdevs));
1907
1908                 nmp = smalloc(sizeof *nmp * newmax);
1909                 memmove(nmp, trnames, sizeof *nmp * maxtlsdevs);
1910                 trnames = nmp;
1911
1912                 maxtlsdevs = newmax;
1913         }
1914         *pp = mktlsrec();
1915         if(pp - tlsdevs >= tdhiwat)
1916                 tdhiwat++;
1917         t = TYPE(ch->qid);
1918         if(t == Qclonus)
1919                 t = Qctl;
1920         ch->qid.path = QID(pp - tlsdevs, t);
1921         ch->qid.vers = 0;
1922         unlock(&tdlock);
1923         poperror();
1924         return *pp;
1925 }
1926
1927 static TlsRec *
1928 mktlsrec(void)
1929 {
1930         TlsRec *tr;
1931
1932         tr = mallocz(sizeof(*tr), 1);
1933         if(tr == nil)
1934                 error(Enomem);
1935         tr->state = SClosed;
1936         tr->ref = 1;
1937         kstrdup(&tr->user, up->user);
1938         tr->perm = 0660;
1939         return tr;
1940 }
1941
1942 static char*
1943 tlsstate(int s)
1944 {
1945         switch(s){
1946         case SHandshake:
1947                 return "Handshaking";
1948         case SOpen:
1949                 return "Established";
1950         case SRClose:
1951                 return "RemoteClosed";
1952         case SLClose:
1953                 return "LocalClosed";
1954         case SAlert:
1955                 return "Alerting";
1956         case SError:
1957                 return "Errored";
1958         case SClosed:
1959                 return "Closed";
1960         }
1961         return "Unknown";
1962 }
1963
1964 static void
1965 freeSec(Secret *s)
1966 {
1967         if(s != nil){
1968                 free(s->enckey);
1969                 free(s);
1970         }
1971 }
1972
1973 static int
1974 noenc(Secret *, uchar *, int n)
1975 {
1976         return n;
1977 }
1978
1979 static int
1980 rc4enc(Secret *sec, uchar *buf, int n)
1981 {
1982         rc4(sec->enckey, buf, n);
1983         return n;
1984 }
1985
1986 static int
1987 tlsunpad(uchar *buf, int n, int block)
1988 {
1989         int pad, nn;
1990
1991         pad = buf[n - 1];
1992         nn = n - 1 - pad;
1993         if(nn <= 0 || n % block)
1994                 return -1;
1995         while(--n > nn)
1996                 if(pad != buf[n - 1])
1997                         return -1;
1998         return nn;
1999 }
2000
2001 static int
2002 sslunpad(uchar *buf, int n, int block)
2003 {
2004         int pad, nn;
2005
2006         pad = buf[n - 1];
2007         nn = n - 1 - pad;
2008         if(nn <= 0 || n % block)
2009                 return -1;
2010         return nn;
2011 }
2012
2013 static int
2014 blockpad(uchar *buf, int n, int block)
2015 {
2016         int pad, nn;
2017
2018         nn = n + block;
2019         nn -= nn % block;
2020         pad = nn - (n + 1);
2021         while(n < nn)
2022                 buf[n++] = pad;
2023         return nn;
2024 }
2025
2026 static int
2027 des3enc(Secret *sec, uchar *buf, int n)
2028 {
2029         n = blockpad(buf, n, 8);
2030         des3CBCencrypt(buf, n, sec->enckey);
2031         return n;
2032 }
2033
2034 static int
2035 des3dec(Secret *sec, uchar *buf, int n)
2036 {
2037         des3CBCdecrypt(buf, n, sec->enckey);
2038         return (*sec->unpad)(buf, n, 8);
2039 }
2040
2041 static int
2042 aesenc(Secret *sec, uchar *buf, int n)
2043 {
2044         n = blockpad(buf, n, 16);
2045         aesCBCencrypt(buf, n, sec->enckey);
2046         return n;
2047 }
2048
2049 static int
2050 aesdec(Secret *sec, uchar *buf, int n)
2051 {
2052         aesCBCdecrypt(buf, n, sec->enckey);
2053         return (*sec->unpad)(buf, n, 16);
2054 }
2055
2056 static DigestState*
2057 nomac(uchar *, ulong, uchar *, ulong, uchar *, DigestState *)
2058 {
2059         return nil;
2060 }
2061
2062 /*
2063  * sslmac: mac calculations for ssl 3.0 only; tls 1.0 uses the standard hmac.
2064  */
2065 static DigestState*
2066 sslmac_x(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s,
2067         DigestState*(*x)(uchar*, ulong, uchar*, DigestState*), int xlen, int padlen)
2068 {
2069         int i;
2070         uchar pad[48], innerdigest[20];
2071
2072         if(xlen > sizeof(innerdigest)
2073         || padlen > sizeof(pad))
2074                 return nil;
2075
2076         if(klen>64)
2077                 return nil;
2078
2079         /* first time through */
2080         if(s == nil){
2081                 for(i=0; i<padlen; i++)
2082                         pad[i] = 0x36;
2083                 s = (*x)(key, klen, nil, nil);
2084                 s = (*x)(pad, padlen, nil, s);
2085                 if(s == nil)
2086                         return nil;
2087         }
2088
2089         s = (*x)(p, len, nil, s);
2090         if(digest == nil)
2091                 return s;
2092
2093         /* last time through */
2094         for(i=0; i<padlen; i++)
2095                 pad[i] = 0x5c;
2096         (*x)(nil, 0, innerdigest, s);
2097         s = (*x)(key, klen, nil, nil);
2098         s = (*x)(pad, padlen, nil, s);
2099         (*x)(innerdigest, xlen, digest, s);
2100         return nil;
2101 }
2102
2103 static DigestState*
2104 sslmac_sha1(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s)
2105 {
2106         return sslmac_x(p, len, key, klen, digest, s, sha1, SHA1dlen, 40);
2107 }
2108
2109 static DigestState*
2110 sslmac_md5(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s)
2111 {
2112         return sslmac_x(p, len, key, klen, digest, s, md5, MD5dlen, 48);
2113 }
2114
2115 static void
2116 sslPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac)
2117 {
2118         DigestState *s;
2119         uchar buf[11];
2120
2121         memmove(buf, seq, 8);
2122         buf[8] = header[0];
2123         buf[9] = header[3];
2124         buf[10] = header[4];
2125
2126         s = (*sec->mac)(buf, 11, mackey, sec->maclen, 0, 0);
2127         (*sec->mac)(body, len, mackey, sec->maclen, mac, s);
2128 }
2129
2130 static void
2131 tlsPackMac(Secret *sec, uchar *mackey, uchar *seq, uchar *header, uchar *body, int len, uchar *mac)
2132 {
2133         DigestState *s;
2134         uchar buf[13];
2135
2136         memmove(buf, seq, 8);
2137         memmove(&buf[8], header, 5);
2138
2139         s = (*sec->mac)(buf, 13, mackey, sec->maclen, 0, 0);
2140         (*sec->mac)(body, len, mackey, sec->maclen, mac, s);
2141 }
2142
2143 static void
2144 put32(uchar *p, u32int x)
2145 {
2146         p[0] = x>>24;
2147         p[1] = x>>16;
2148         p[2] = x>>8;
2149         p[3] = x;
2150 }
2151
2152 static void
2153 put64(uchar *p, vlong x)
2154 {
2155         put32(p, (u32int)(x >> 32));
2156         put32(p+4, (u32int)x);
2157 }
2158
2159 static void
2160 put24(uchar *p, int x)
2161 {
2162         p[0] = x>>16;
2163         p[1] = x>>8;
2164         p[2] = x;
2165 }
2166
2167 static void
2168 put16(uchar *p, int x)
2169 {
2170         p[0] = x>>8;
2171         p[1] = x;
2172 }
2173
2174 static u32int
2175 get32(uchar *p)
2176 {
2177         return (p[0]<<24)|(p[1]<<16)|(p[2]<<8)|p[3];
2178 }
2179
2180 static int
2181 get16(uchar *p)
2182 {
2183         return (p[0]<<8)|p[1];
2184 }
2185
2186 static char *charmap = "0123456789abcdef";
2187
2188 static void
2189 pdump(int len, void *a, char *tag)
2190 {
2191         uchar *p;
2192         int i;
2193         char buf[65+32];
2194         char *q;
2195
2196         p = a;
2197         strcpy(buf, tag);
2198         while(len > 0){
2199                 q = buf + strlen(tag);
2200                 for(i = 0; len > 0 && i < 32; i++){
2201                         if(*p >= ' ' && *p < 0x7f){
2202                                 *q++ = ' ';
2203                                 *q++ = *p;
2204                         } else {
2205                                 *q++ = charmap[*p>>4];
2206                                 *q++ = charmap[*p & 0xf];
2207                         }
2208                         len--;
2209                         p++;
2210                 }
2211                 *q = 0;
2212
2213                 if(len > 0)
2214                         pprint("%s...\n", buf);
2215                 else
2216                         pprint("%s\n", buf);
2217         }
2218 }