codtls 0.0.1.alpha

data/lib/codtls/h_shello.rb

@@ -0,0 +1,51 @@
+require 'codtls/h_type'
+
+module CoDTLS
+  module Handshake
+    # Tolle Klasse
+    class ServerHello < Type
+      attr_reader :time, :random, :session
+
+      def self.parse(data)
+        data.force_encoding('ASCII-8BIT')
+        data.slice!(0...2) # TODO: check version
+        t = data.slice!(0...4).unpack('N')[0]
+        r = data.slice!(0...28)
+        s = data.slice!(0...data.slice!(0).ord)
+        ServerHello.new(t, r, s)
+      end
+
+      public
+
+      def initialize(time, random, session)
+        super(2)
+        self.time = time
+        self.random = random
+        self.session = session
+      end
+
+      def time=(time)
+        if time.nil? || time > 0xFFFFFFFF
+          fail HandshakeError, 'Invalid time value'
+        end
+        @time = time
+      end
+
+      def random=(random)
+        if random.nil? || random.b.length != 28
+          fail HandshakeError, 'Random needs to have a length of 28 byte'
+        else
+          @random = random.force_encoding('ASCII-8BIT')
+        end
+      end
+
+      def session=(session)
+        if session.nil? || session.b.length.between?(1, 255)
+          fail HandshakeError, 'Session length needs to be in 1 - 255'
+        end
+        @session = session
+        @session.force_encoding('ASCII-8BIT')
+      end
+    end
+  end
+end

data/lib/codtls/h_shellodone.rb

@@ -0,0 +1,22 @@
+require 'codtls/h_type'
+
+module CoDTLS
+  module Handshake
+    # Tolle Klasse
+    class ServerHelloDone < Type
+      def self.parse(data)
+        ServerHelloDone.new
+      end
+
+      public
+
+      def initialize
+        super(32)
+      end
+
+      def to_wire
+        ''.force_encoding('ASCII-8BIT')
+      end
+    end
+  end
+end

data/lib/codtls/h_type.rb

@@ -0,0 +1,22 @@
+module CoDTLS
+  module Handshake
+    # Tolle Klasse
+    class Type
+      attr_reader :id
+
+      def self.parse(data)
+        fail HandshakeError, 'Not implemented'
+      end
+
+      public
+
+      def initialize(id)
+        @id = id
+      end
+
+      def to_wire
+        fail HandshakeError, 'Not implemented'
+      end
+    end
+  end
+end

data/lib/codtls/h_verify.rb

@@ -0,0 +1,30 @@
+require 'codtls/h_type'
+
+module CoDTLS
+  module Handshake
+    # Tolle Klasse
+    class HelloVerifyRequest < Type
+      attr_reader :cookie
+
+      def self.parse(data)
+        # typedef struct {
+        #   ProtocolVersion server_version;
+        #   uint8_t cookie_len;
+        #   uint8_t cookie[0];
+        # } __attribute__ ((packed)) HelloVerifyRequest_t;
+
+        # Zu erledigen: checks auf version und laenge
+        HelloVerifyRequest.new(data.force_encoding('ASCII-8BIT')[3..-1])
+      end
+
+      public
+
+      def initialize(cookie)
+        super(3)
+        @cookie = cookie
+        @cookie = '' if cookie.nil?
+        @cookie.force_encoding('ASCII-8BIT')
+      end
+    end
+  end
+end

data/lib/codtls/handshake.rb

@@ -0,0 +1,173 @@
+require 'codtls/h_content'
+require 'codtls/ecc'
+require 'openssl/cmac'
+require 'openssl/ccm'
+require 'codtls/prf'
+require 'codtls/pskdb'
+require 'coap'
+
+module CoDTLS
+  # TODO
+  class HandshakeError < StandardError
+  end
+
+  # Tolles Modul
+  module Handshake
+    # TODO
+    def self.handshake(numeric_address)
+      logger = Logger.new(STDOUT)
+      logger.level = CoDTLS::LOG_LEVEL
+      logger.debug("Handshake gestarted #{numeric_address}")
+
+      session = Session.new(numeric_address)
+      session.enable_handshake
+
+      logger.debug("Session created")
+
+      c = CoAP::Client.new(48).use_dtls
+      uuid = c.get(numeric_address, 5684, '/d/uuid').payload
+
+      logger.debug("UUID erhalten: #{uuid}")
+
+      psk = CoDTLS::PSKDB.get_psk(uuid)
+      logger.debug("PSK: #{psk}")
+      psk.nil? ? 5 : 0
+=begin
+      session = Session.new(numeric_address)
+      session.enable_handshake
+
+      c = CoAP::Client.new(48).use_dtls
+
+      state = State.new
+
+      # Step 1 - ClientHello ohne Cookie
+      msg = ''.force_encoding('ASCII-8BIT')
+      client_hello = ClientHello.new(state.client_time, state.client_random)
+      Content.add_content(msg, client_hello)
+      r = c.post(numeric_address, 5684, '/dtls', msg)
+
+      hello_verify = Content.get_content(r.payload)
+      return 1 unless hello_verify.class == HelloVerifyRequest
+
+      # Step 2 - ClientHello mit Cookie
+      msg.clear
+      client_hello.cookie = hello_verify.cookie
+      Content.add_content(msg, client_hello)
+      state.add_finished_source(msg)
+      r = c.post(numeric_address, 5684, '/dtls', msg)
+      state.add_finished_source(r)
+
+      server_hello = Content.get_content(r.payload)
+      return 2 unless server_hello == ServerHello
+      server_key_exchange = Content.get_content(r.payload)
+      return 3 unless server_key_exchange == ServerKeyExchange
+      server_hello_done = Content.get_content(r.payload)
+      return 4 unless server_hello_done == ServerHelloDone
+
+      # Step 3 - ClientKeyExchange, ChangeCipherSpec, Finished
+      msg.clear
+      state.server_time = server_hello.time
+      state.server_random = server_hello.random
+      session.id = server_hello.session
+      return 5 unless state.choose_psk(server_key_exchange.psk_hint)
+      state.server_key = server_key_exchange.point
+      session.key_block = state.key_block
+
+      client_key_exchange = ClientKeyExchange.new(
+        server_key_exchange.psk_hint,
+        KeyExchange::NAMEDCURVE[:secp256r1],
+        state.public_key)
+      Content.add_content(msg, client_key_exchange)
+      state.add_finished_source(msg)
+
+      client_finished = state.finished('client finished')
+
+      change_cipher_spec = ChangeCipherSpec.new
+      Content.add_content(msg, change_cipher_spec)
+      finished = Finished.new(client_finished)
+
+      finished_content = ''.force_encoding('ASCII-8BIT')
+      Content.add_content(msg, change_cipher_spec)
+      state.add_finished_source(finished_content)
+
+      server_finished = state.finished('server finished')
+
+      ccm = OpenSSL::CCM.new('AES', state.key_block[0..15], 8)
+      nonce = state.key_block[32..35] + ("\x00" * 8)
+      msg.concat(ccm.encrypt(finished_content, nonce))
+
+      r = c.post(numeric_address, 5684, '/dtls', msg)
+
+      0
+=end
+    end
+
+    # Finished muss enthalten:
+    # ClientHello, ServerHello, ServerKeyExchange, ServerHelloDone,
+    # ClientKeyExchange, (ClientFinished)
+
+    # Tolle Klasse
+    class State
+      attr_reader :client_time, :client_random
+      attr_accessor :server_time, :server_random
+
+      def initialize
+        @client_time = Time.new.to_i
+        @client_random = Random.new.bytes(28)
+        @private_key = Random.new.bytes(32)
+        @finished_source = ''.force_encoding('ASCII-8BIT')
+        @psk = ''
+        @master_secret = ''
+      end
+
+      def client_full_random
+        [@client_time].pack('N') + @client_random
+      end
+
+      def choose_psk(psk_hint)
+        @psk = CoDTLS::PSKDB.get_psk(psk_hint)
+        @psk.nil? ? false : true
+      end
+
+      def public_key
+        CoDTLS::ECC.mult(@private_key)
+      end
+
+      def server_key=(key)
+        secret = CoDTLS::ECC.mult(@private_key, key)
+        pre_master = "\x00\x10"
+        pre_master += @psk
+        pre_master += "\x00\x20"
+        pre_master += secret[1..32]
+
+        server_full_random = [@server_time].pack('N') + @server_random
+
+        prf = OpenSSL::PRF.new(pre_master, 'master secret',
+                               client_full_random + server_full_random)
+        @master_secret = prf.get(48)
+      end
+
+      def key_block
+        fail HandshakeError, 'Missing mastersecret' if @master_secret == ''
+
+        server_full_random = [@server_time].pack('N') + @server_random
+        prf = OpenSSL::PRF.new(@master_secret, 'key expansion',
+                               server_full_random + client_full_random)
+        prf.get(40)
+      end
+
+      def add_finished_source(data)
+        @finished_source.concat(data)
+      end
+
+      def finished(label)
+        fail HandshakeError, 'Missing mastersecret' if @master_secret == ''
+        fail HandshakeError, 'Missing pre-shared key' if @psk == ''
+
+        seed = OpenSSL::CMAC.digest('AES', @psk, @finished_source)
+        prf = OpenSSL::PRF.new(@master_secret, label, seed)
+        prf.get(12)
+      end
+    end
+  end
+end

data/lib/codtls/models/codtls_connection.rb

@@ -0,0 +1,3 @@
+# Class representing the dtls_connections table in the database.
+class CODTLSConnection < ActiveRecord::Base
+end

data/lib/codtls/models/codtls_device.rb

@@ -0,0 +1,3 @@
+# Class representn the dtls_devices table in the database
+class CODTLSDevice < ActiveRecord::Base
+end

data/lib/codtls/prf.rb

@@ -0,0 +1,40 @@
+require 'openssl'
+
+module OpenSSL
+  class PRFError < StandardError
+  end
+
+  # PRF(secret, label, seed) = P_<hash>(secret, label + seed)
+  #
+  # P_hash(secret, seed) = CMAC_hash(secret, A(1) + seed) +
+  #                        CMAC_hash(secret, A(2) + seed) +
+  #                        CMAC_hash(secret, A(3) + seed) + ...
+  #
+  # A() is defined as:
+  #       A(0) = seed
+  #       A(i) = CMAC_hash(secret, A(i-1))
+  class PRF
+    def initialize(secret, label, seed)
+      @secret = secret.force_encoding('ASCII-8BIT')
+      @seed = label.force_encoding('ASCII-8BIT')
+      @seed += seed.force_encoding('ASCII-8BIT')
+      @buffer = ''.force_encoding('ASCII-8BIT')
+      @a_x = @seed.dup
+    end
+
+    def get(bytes)
+      output = ''.force_encoding('ASCII-8BIT')
+      while output.length < bytes
+        output += @buffer.slice!(0...(bytes - output.length))
+        fill_buffer if @buffer.length == 0
+      end
+      output
+    end
+
+    def fill_buffer
+      @a_x = OpenSSL::CMAC.digest('AES', @secret, @a_x)
+      @buffer = OpenSSL::CMAC.digest('AES', @secret, @a_x + @seed)
+      @buffer.force_encoding('ASCII-8BIT')
+    end
+  end
+end

data/lib/codtls/pskdb.rb

@@ -0,0 +1,104 @@
+require 'active_record'
+require 'sqlite3'
+require 'pathname'
+require 'codtls/models/codtls_device'
+
+module CoDTLS
+  # A Class for managing PSKs per IP. The class has no initializer, because
+  # every method is static.
+  class PSKDB
+    # Migrates the database to the current version. An ActiveRecord Connection
+    # has to exist for migration.
+    def self.migrate
+      ActiveRecord::Migration.verbose = false
+      ActiveRecord::Migrator.migrate('db/migrate')
+    end
+
+    # Sets PSK for the specified UUID. If PSK for UUID is already set,
+    # PSK ist saved into PSK_new. So PSK is set one time, while PSK_new
+    # maybe gets overwritten more times. Other values are set to standard.
+    #
+    # @param uuid [Binary] the UUID of the device in 16 byte binary form
+    # @param psk [String] the 16 byte long pre-shared key of the device
+    def self.set_psk(uuid, psk, desc = '')
+      ActiveRecord::Base.connection_pool.with_connection do
+        entry = CODTLSDevice.find_by_uuid(uuid)
+        if entry.nil?
+          CODTLSDevice.create(psk: psk,
+                              uuid: uuid,
+                              desc: desc
+                              )
+        else
+          if entry.psk.nil?
+            entry.psk = psk
+          else
+            entry.psk_new = psk
+          end
+          entry.save
+        end
+      end
+    end
+
+    # Gets PSK for the specified UUID. If PSK_new is set, the return value
+    # is PSK_new, else PSK is return value. If UUID is not existing
+    # nil will be returned.
+    #
+    # @param uuid [Binary] the UUID of the device in 16 byte binary form
+    # @return [String] the 16 byte long pre-shared key for the UUID
+    def self.get_psk(uuid)
+      logger = Logger.new(STDOUT)
+      logger.level = CoDTLS::LOG_LEVEL
+      logger.debug('get_psk 1')
+      entry = nil
+      ActiveRecord::Base.connection_pool.with_connection do
+        logger.debug('get_psk 2')
+        entry = CODTLSDevice.find_by_uuid(uuid)
+      end
+      logger.debug('get_psk 3')
+      return nil if entry.nil?
+
+      if entry.psk_new.nil?
+        logger.debug('get_psk 4.1')
+        return entry.psk
+      else
+        logger.debug('get_psk 4.2')
+        return entry.psk_new
+      end
+    end
+
+    # Deletes the PSK for the provided UUID. Handle with care, PSK_new and PSK
+    # are lost after this.
+    #
+    # @param uuid [Binary] the UUID of the device in 16 byte binary form
+    # @return [NilCLass] nil if uuid couldn't be found
+    def self.del_psk!(uuid)
+      ActiveRecord::Base.connection_pool.with_connection do
+        entry = CODTLSDevice.find_by_uuid(uuid)
+        return nil if entry.nil?
+        entry.destroy
+      end
+    end
+
+    # Returns an array of all registered UUIDs.
+    #
+    # @return [Array] of {uuid: A, psk: B, desc: C}
+    def self.all_registered
+      ActiveRecord::Base.connection_pool.with_connection do
+        entries = CODTLSDevice.all
+        return nil if entries.nil?
+        entries.map { |i| [i.uuid, i.psk_new.nil? ? i.psk : i.psk_new, i.desc] }
+      end
+    end
+
+    # Removes the all entrys from database in TABLE 2.
+    def self.clear_all
+      ActiveRecord::Base.connection_pool.with_connection do
+        CODTLSDevice.destroy_all
+      end
+    end
+  end
+end
+
+def create_sqlite_db(dbname)
+  SQLite3::Database.new(dbname)
+end