profiles/internal/rpc/stream/crypto/tls.go - release.go.x.ref - Git at Google

 // Copyright 2015 The Vanadium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

 // +build go1.4

 package crypto

 import (
 	"bytes"
 	"crypto/tls"
 	"fmt"
 	"io"
 	"net"
 	"sync"
 	"time"

 	"v.io/v23/verror"

 	"v.io/x/ref/profiles/internal/lib/iobuf"
 	"v.io/x/ref/profiles/internal/rpc/stream"
 )

 var (
 	// These errors are intended to be used as arguments to higher
 	// level errors and hence {1}{2} is omitted from their format
 	// strings to avoid repeating these n-times in the final error
 	// message visible to the user.
 	errDeadlinesNotSupported = reg(".errDeadlinesNotSupported", "deadlines not supported")
 	errEndOfEncryptedSlice   = reg(".errEndOfEncryptedSlice", "end of encrypted slice")
 )

 // TLSClientSessionCacheOpt specifies the ClientSessionCache used to resume TLS sessions.
 // It adapts tls.ClientSessionCache to the v.io/v23/x/ref/profiles/internal/rpc/stream.VCOpt interface.
 type TLSClientSessionCache struct{ tls.ClientSessionCache }

 func (TLSClientSessionCache) RPCStreamVCOpt() {}

 // NewTLSClient returns a Crypter implementation that uses TLS, assuming
 // handshaker was initiated by a client.
 func NewTLSClient(handshaker io.ReadWriteCloser, local, remote net.Addr, sessionCache TLSClientSessionCache, pool *iobuf.Pool) (Crypter, error) {
 	var config tls.Config
 	// TLS + resumption + channel bindings is broken: <https://secure-resumption.com/#channelbindings>.
 	config.SessionTicketsDisabled = true
 	config.InsecureSkipVerify = true
 	config.ClientSessionCache = sessionCache.ClientSessionCache
 	return newTLSCrypter(handshaker, local, remote, &config, pool, false)
 }

 // NewTLSServer returns a Crypter implementation that uses TLS, assuming
 // handshaker was accepted by a server.
 func NewTLSServer(handshaker io.ReadWriteCloser, local, remote net.Addr, pool *iobuf.Pool) (Crypter, error) {
 	return newTLSCrypter(handshaker, local, remote, ServerTLSConfig(), pool, true)
 }

 type fakeConn struct {
 	handshakeConn io.ReadWriteCloser
 	out           bytes.Buffer
 	in            []byte
 	laddr, raddr  net.Addr
 }

 func (c *fakeConn) Read(b []byte) (n int, err error) {
 	if c.handshakeConn != nil {
 		return c.handshakeConn.Read(b)
 	}
 	if len(c.in) == 0 {
 		return 0, stream.NewNetError(verror.New(stream.ErrNetwork, nil, verror.New(errEndOfEncryptedSlice, nil)), false, true)
 	}
 	n = copy(b, c.in)
 	c.in = c.in[n:]
 	return
 }

 func (c *fakeConn) Write(b []byte) (int, error) {
 	if c.handshakeConn != nil {
 		return c.handshakeConn.Write(b)
 	}
 	return c.out.Write(b)
 }

 func (*fakeConn) Close() error           { return nil }
 func (c *fakeConn) LocalAddr() net.Addr  { return c.laddr }
 func (c *fakeConn) RemoteAddr() net.Addr { return c.raddr }
 func (*fakeConn) SetDeadline(t time.Time) error {
 	return verror.New(stream.ErrBadState, nil, verror.New(errDeadlinesNotSupported, nil))
 }
 func (*fakeConn) SetReadDeadline(t time.Time) error {
 	return verror.New(stream.ErrBadState, nil, verror.New(errDeadlinesNotSupported, nil))
 }
 func (*fakeConn) SetWriteDeadline(t time.Time) error {
 	return verror.New(stream.ErrBadState, nil, verror.New(errDeadlinesNotSupported, nil))
 }

 // tlsCrypter implements the Crypter interface using crypto/tls.
 //
 // crypto/tls provides a net.Conn, while the Crypter interface operates on
 // iobuf.Slice objects. In order to adapt to the Crypter in stream.ErrNetwork, verrorterface, the
 // strategy is as follows:
 //
 // - netTLSCrypter wraps a net.Conn with an alternative implementation
 //   (fakeConn) for the TLS handshake protocol.
 // - Once the TLS handshake is complete, fakeConn switches to a mode where all
 //   Write calls add to a bytes.Buffer and all Read calls read from a
 //   bytes.Buffer.
 // - Encrypt uses tls.Conn.Write, which in-turn invokes fakeConn.Write and then
 //   it extracts the contents of the underlying bytes.Buffer.
 // - Decrypt adds to the read buffer and then invokes tls.Conn.Read, which
 //   in-turn invokes fakeConn.Read, which reads from that buffer.
 type tlsCrypter struct {
 	mu    sync.Mutex
 	alloc *iobuf.Allocator
 	tls   *tls.Conn
 	fc    *fakeConn
 }

 func newTLSCrypter(handshaker io.ReadWriteCloser, local, remote net.Addr, config *tls.Config, pool *iobuf.Pool, server bool) (Crypter, error) {
 	fc := &fakeConn{handshakeConn: handshaker, laddr: local, raddr: remote}
 	var t *tls.Conn
 	if server {
 		t = tls.Server(fc, config)
 	} else {
 		// The TLS handshake protocol ends with a message received by the client.
 		// handshaker should be closed only after the handshake protocol completes.
 		// So, the client closes the handshaker.
 		defer handshaker.Close()
 		t = tls.Client(fc, config)
 	}
 	if err := t.Handshake(); err != nil {
 		return nil, err
 	}
 	// Must have used Diffie-Hellman to exchange keys (so that the key selection
 	// is independent of any TLS certificates used). This helps ensure that
 	// identities exchanged during the vanadium authentication protocol cannot be
 	// stolen and are bound to the session key established during the TLS handshake.
 	switch cs := t.ConnectionState().CipherSuite; cs {
 	case tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
 	case tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
 	case tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
 	case tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA:
 	case tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
 	case tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
 	case tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
 	case tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
 	case tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
 	default:
 		t.Close()
 		return nil, verror.New(stream.ErrBadArg, nil, verror.New(errUnrecognizedCipherText, nil, fmt.Sprintf("0x%04x", cs)))
 	}
 	fc.handshakeConn = nil
 	return &tlsCrypter{
 		alloc: iobuf.NewAllocator(pool, 0),
 		tls:   t,
 		fc:    fc,
 	}, nil
 }

 func (c *tlsCrypter) Encrypt(plaintext *iobuf.Slice) (*iobuf.Slice, error) {
 	defer plaintext.Release()
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	defer c.fc.out.Reset()
 	if _, err := c.tls.Write(plaintext.Contents); err != nil {
 		return nil, err
 	}
 	return c.alloc.Copy(c.fc.out.Bytes()), nil
 }

 func (c *tlsCrypter) Decrypt(ciphertext *iobuf.Slice) (*iobuf.Slice, error) {
 	defer ciphertext.Release()
 	if ciphertext.Size() == 0 {
 		return ciphertext, nil
 	}
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.fc.in = ciphertext.Contents
 	// Given the cipher suites used, len(plaintext) < len(ciphertext)
 	// (ciphertext includes TLS record headers). Allocating space for
 	// plaintext based on ciphertext.Size should suffice.
 	plaintext := c.alloc.Alloc(uint(ciphertext.Size()))
 	out := plaintext.Contents
 	for {
 		n, err := c.tls.Read(out)
 		if err != nil {
 			if _, exit := err.(*stream.NetError); exit {
 				break
 			}
 			plaintext.Release()
 			return nil, err
 		}
 		out = out[n:]
 	}
 	plaintext.Contents = plaintext.Contents[:plaintext.Size()-len(out)]
 	return plaintext, nil
 }

 func (c *tlsCrypter) String() string {
 	state := c.tls.ConnectionState()
 	return fmt.Sprintf("TLS CipherSuite:0x%04x Resumed:%v", state.CipherSuite, state.DidResume)
 }

 // ServerTLSConfig returns the tls.Config used by NewTLSServer.
 func ServerTLSConfig() *tls.Config {
 	c, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
 	if err != nil {
 		panic(err)
 	}
 	return &tls.Config{
 		// TLS + resumption + channel bindings is broken: <https://secure-resumption.com/#channelbindings>.
 		SessionTicketsDisabled: true,
 		Certificates:           []tls.Certificate{c},
 		InsecureSkipVerify:     true,
 		// RC4_128_SHA is 4-5X faster compared to the other cipher suites.
 		// There are concerns with its security (see http://en.wikipedia.org/wiki/RC4 and
 		// https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/alFardan),
 		// so this decision will be revisted.
 		// TODO(ashankar,ataly): Figure out what cipher to use and how to
 		// have a speedy Go implementation of it.
 		CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA},
 	}
 }

 func (c *tlsCrypter) ChannelBinding() []byte {
 	return c.tls.ConnectionState().TLSUnique
 }

 // PEM-encoded certificates and keys used in the tests.
 // One way to generate them is:
 //   go run $GOROOT/src/pkg/crypto/tls/generate_cert.go  --host=localhost --duration=87600h --ecdsa-curve=P256
 // (This generates a self-signed certificate valid for 10 years)
 // which will create cert.pem and key.pem files.
 const (
 	serverCert = `
 -----BEGIN CERTIFICATE-----
 MIIBbTCCAROgAwIBAgIQMD+Kzawjvhij1B/BmvHxLDAKBggqhkjOPQQDAjASMRAw
 DgYDVQQKEwdBY21lIENvMB4XDTE0MDcxODIzMTYxMloXDTI0MDcxNTIzMTYxMlow
 EjEQMA4GA1UEChMHQWNtZSBDbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLiz
 Ajsly1DS8NJF2KE195V83TgidfgGEB7nudscdKWH3+5uQHgCc+2BV/7AGGj3yePR
 ZZLzYD95goJ/a7eet/2jSzBJMA4GA1UdDwEB/wQEAwIAoDATBgNVHSUEDDAKBggr
 BgEFBQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAKBggq
 hkjOPQQDAgNIADBFAiAb4tBxggEpnKdxv66TBVFxAUn3EBWX25XlL1G2GF8RkAIh
 AOAwys3mvzM4Td/2kV9QNyQPZ9kLLQr9A9ryB0H3N9Yz
 -----END CERTIFICATE-----
 `
 	serverKey = `
 -----BEGIN ECDSA PRIVATE KEY-----
 MHcCAQEEIPLfwg+SVC2/xUcKq0bI9y2+SDEEdCeGuxuBz22BhAw1oAoGCCqGSM49
 AwEHoUQDQgAEuLMCOyXLUNLw0kXYoTX3lXzdOCJ1+AYQHue52xx0pYff7m5AeAJz
 7YFX/sAYaPfJ49FlkvNgP3mCgn9rt563/Q==
 -----END ECDSA PRIVATE KEY-----
 `
 )
	// Copyright 2015 The Vanadium Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style
	// license that can be found in the LICENSE file.

	// +build go1.4

	package crypto

	import (
	"bytes"
	"crypto/tls"
	"fmt"
	"io"
	"net"
	"sync"
	"time"

	"v.io/v23/verror"

	"v.io/x/ref/profiles/internal/lib/iobuf"
	"v.io/x/ref/profiles/internal/rpc/stream"
	)

	var (
	// These errors are intended to be used as arguments to higher
	// level errors and hence {1}{2} is omitted from their format
	// strings to avoid repeating these n-times in the final error
	// message visible to the user.
	errDeadlinesNotSupported = reg(".errDeadlinesNotSupported", "deadlines not supported")
	errEndOfEncryptedSlice = reg(".errEndOfEncryptedSlice", "end of encrypted slice")
	)

	// TLSClientSessionCacheOpt specifies the ClientSessionCache used to resume TLS sessions.
	// It adapts tls.ClientSessionCache to the v.io/v23/x/ref/profiles/internal/rpc/stream.VCOpt interface.
	type TLSClientSessionCache struct{ tls.ClientSessionCache }

	func (TLSClientSessionCache) RPCStreamVCOpt() {}

	// NewTLSClient returns a Crypter implementation that uses TLS, assuming
	// handshaker was initiated by a client.
	func NewTLSClient(handshaker io.ReadWriteCloser, local, remote net.Addr, sessionCache TLSClientSessionCache, pool *iobuf.Pool) (Crypter, error) {
	var config tls.Config
	// TLS + resumption + channel bindings is broken: <https://secure-resumption.com/#channelbindings>.
	config.SessionTicketsDisabled = true
	config.InsecureSkipVerify = true
	config.ClientSessionCache = sessionCache.ClientSessionCache
	return newTLSCrypter(handshaker, local, remote, &config, pool, false)
	}

	// NewTLSServer returns a Crypter implementation that uses TLS, assuming
	// handshaker was accepted by a server.
	func NewTLSServer(handshaker io.ReadWriteCloser, local, remote net.Addr, pool *iobuf.Pool) (Crypter, error) {
	return newTLSCrypter(handshaker, local, remote, ServerTLSConfig(), pool, true)
	}

	type fakeConn struct {
	handshakeConn io.ReadWriteCloser
	out bytes.Buffer
	in []byte
	laddr, raddr net.Addr
	}

	func (c *fakeConn) Read(b []byte) (n int, err error) {
	if c.handshakeConn != nil {
	return c.handshakeConn.Read(b)
	}
	if len(c.in) == 0 {
	return 0, stream.NewNetError(verror.New(stream.ErrNetwork, nil, verror.New(errEndOfEncryptedSlice, nil)), false, true)
	}
	n = copy(b, c.in)
	c.in = c.in[n:]
	return
	}

	func (c *fakeConn) Write(b []byte) (int, error) {
	if c.handshakeConn != nil {
	return c.handshakeConn.Write(b)
	}
	return c.out.Write(b)
	}

	func (*fakeConn) Close() error { return nil }
	func (c *fakeConn) LocalAddr() net.Addr { return c.laddr }
	func (c *fakeConn) RemoteAddr() net.Addr { return c.raddr }
	func (*fakeConn) SetDeadline(t time.Time) error {
	return verror.New(stream.ErrBadState, nil, verror.New(errDeadlinesNotSupported, nil))
	}
	func (*fakeConn) SetReadDeadline(t time.Time) error {
	return verror.New(stream.ErrBadState, nil, verror.New(errDeadlinesNotSupported, nil))
	}
	func (*fakeConn) SetWriteDeadline(t time.Time) error {
	return verror.New(stream.ErrBadState, nil, verror.New(errDeadlinesNotSupported, nil))
	}

	// tlsCrypter implements the Crypter interface using crypto/tls.
	//
	// crypto/tls provides a net.Conn, while the Crypter interface operates on
	// iobuf.Slice objects. In order to adapt to the Crypter in stream.ErrNetwork, verrorterface, the
	// strategy is as follows:
	//
	// - netTLSCrypter wraps a net.Conn with an alternative implementation
	// (fakeConn) for the TLS handshake protocol.
	// - Once the TLS handshake is complete, fakeConn switches to a mode where all
	// Write calls add to a bytes.Buffer and all Read calls read from a
	// bytes.Buffer.
	// - Encrypt uses tls.Conn.Write, which in-turn invokes fakeConn.Write and then
	// it extracts the contents of the underlying bytes.Buffer.
	// - Decrypt adds to the read buffer and then invokes tls.Conn.Read, which
	// in-turn invokes fakeConn.Read, which reads from that buffer.
	type tlsCrypter struct {
	mu sync.Mutex
	alloc *iobuf.Allocator
	tls *tls.Conn
	fc *fakeConn
	}

	func newTLSCrypter(handshaker io.ReadWriteCloser, local, remote net.Addr, config tls.Config, pool iobuf.Pool, server bool) (Crypter, error) {
	fc := &fakeConn{handshakeConn: handshaker, laddr: local, raddr: remote}
	var t *tls.Conn
	if server {
	t = tls.Server(fc, config)
	} else {
	// The TLS handshake protocol ends with a message received by the client.
	// handshaker should be closed only after the handshake protocol completes.
	// So, the client closes the handshaker.
	defer handshaker.Close()
	t = tls.Client(fc, config)
	}
	if err := t.Handshake(); err != nil {
	return nil, err
	}
	// Must have used Diffie-Hellman to exchange keys (so that the key selection
	// is independent of any TLS certificates used). This helps ensure that
	// identities exchanged during the vanadium authentication protocol cannot be
	// stolen and are bound to the session key established during the TLS handshake.
	switch cs := t.ConnectionState().CipherSuite; cs {
	case tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
	case tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
	case tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
	case tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA:
	case tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
	case tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
	case tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
	case tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
	case tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
	default:
	t.Close()
	return nil, verror.New(stream.ErrBadArg, nil, verror.New(errUnrecognizedCipherText, nil, fmt.Sprintf("0x%04x", cs)))
	}
	fc.handshakeConn = nil
	return &tlsCrypter{
	alloc: iobuf.NewAllocator(pool, 0),
	tls: t,
	fc: fc,
	}, nil
	}

	func (c tlsCrypter) Encrypt(plaintext iobuf.Slice) (*iobuf.Slice, error) {
	defer plaintext.Release()
	c.mu.Lock()
	defer c.mu.Unlock()
	defer c.fc.out.Reset()
	if _, err := c.tls.Write(plaintext.Contents); err != nil {
	return nil, err
	}
	return c.alloc.Copy(c.fc.out.Bytes()), nil
	}

	func (c tlsCrypter) Decrypt(ciphertext iobuf.Slice) (*iobuf.Slice, error) {
	defer ciphertext.Release()
	if ciphertext.Size() == 0 {
	return ciphertext, nil
	}
	c.mu.Lock()
	defer c.mu.Unlock()
	c.fc.in = ciphertext.Contents
	// Given the cipher suites used, len(plaintext) < len(ciphertext)
	// (ciphertext includes TLS record headers). Allocating space for
	// plaintext based on ciphertext.Size should suffice.
	plaintext := c.alloc.Alloc(uint(ciphertext.Size()))
	out := plaintext.Contents
	for {
	n, err := c.tls.Read(out)
	if err != nil {
	if _, exit := err.(*stream.NetError); exit {
	break
	}
	plaintext.Release()
	return nil, err
	}
	out = out[n:]
	}
	plaintext.Contents = plaintext.Contents[:plaintext.Size()-len(out)]
	return plaintext, nil
	}

	func (c *tlsCrypter) String() string {
	state := c.tls.ConnectionState()
	return fmt.Sprintf("TLS CipherSuite:0x%04x Resumed:%v", state.CipherSuite, state.DidResume)
	}

	// ServerTLSConfig returns the tls.Config used by NewTLSServer.
	func ServerTLSConfig() *tls.Config {
	c, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
	if err != nil {
	panic(err)
	}
	return &tls.Config{
	// TLS + resumption + channel bindings is broken: <https://secure-resumption.com/#channelbindings>.
	SessionTicketsDisabled: true,
	Certificates: []tls.Certificate{c},
	InsecureSkipVerify: true,
	// RC4_128_SHA is 4-5X faster compared to the other cipher suites.
	// There are concerns with its security (see http://en.wikipedia.org/wiki/RC4 and
	// https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/alFardan),
	// so this decision will be revisted.
	// TODO(ashankar,ataly): Figure out what cipher to use and how to
	// have a speedy Go implementation of it.
	CipherSuites: []uint16{tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA},
	}
	}

	func (c *tlsCrypter) ChannelBinding() []byte {
	return c.tls.ConnectionState().TLSUnique
	}

	// PEM-encoded certificates and keys used in the tests.
	// One way to generate them is:
	// go run $GOROOT/src/pkg/crypto/tls/generate_cert.go --host=localhost --duration=87600h --ecdsa-curve=P256
	// (This generates a self-signed certificate valid for 10 years)
	// which will create cert.pem and key.pem files.
	const (
	serverCert = `
	-----BEGIN CERTIFICATE-----
	MIIBbTCCAROgAwIBAgIQMD+Kzawjvhij1B/BmvHxLDAKBggqhkjOPQQDAjASMRAw
	DgYDVQQKEwdBY21lIENvMB4XDTE0MDcxODIzMTYxMloXDTI0MDcxNTIzMTYxMlow
	EjEQMA4GA1UEChMHQWNtZSBDbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLiz
	Ajsly1DS8NJF2KE195V83TgidfgGEB7nudscdKWH3+5uQHgCc+2BV/7AGGj3yePR
	ZZLzYD95goJ/a7eet/2jSzBJMA4GA1UdDwEB/wQEAwIAoDATBgNVHSUEDDAKBggr
	BgEFBQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAKBggq
	hkjOPQQDAgNIADBFAiAb4tBxggEpnKdxv66TBVFxAUn3EBWX25XlL1G2GF8RkAIh
	AOAwys3mvzM4Td/2kV9QNyQPZ9kLLQr9A9ryB0H3N9Yz
	-----END CERTIFICATE-----
	`
	serverKey = `
	-----BEGIN ECDSA PRIVATE KEY-----
	MHcCAQEEIPLfwg+SVC2/xUcKq0bI9y2+SDEEdCeGuxuBz22BhAw1oAoGCCqGSM49
	AwEHoUQDQgAEuLMCOyXLUNLw0kXYoTX3lXzdOCJ1+AYQHue52xx0pYff7m5AeAJz
	7YFX/sAYaPfJ49FlkvNgP3mCgn9rt563/Q==
	-----END ECDSA PRIVATE KEY-----
	`
	)