TLS 1.2 在 OpenSSL 中的实现(一）

// openssl在启动的时候，可以指定加载CA证书，命令如下： 
$ openssl s_client -connect www.baidu.com:443 -CAfile /usr/local/etc/openssl@1.1/cert.pem

// CA证书读取的代码调用栈 
libcrypto.1.1.dylib                 0x0000000101ce27d8 PEM_X509_INFO_read_bio + 120
libcrypto.1.1.dylib                 0x0000000101d64a6f X509_load_cert_crl_file + 159
libcrypto.1.1.dylib                 0x0000000101d64d38 by_file_ctrl + 248
libcrypto.1.1.dylib                 0x0000000101d69a55 X509_LOOKUP_ctrl + 181
libcrypto.1.1.dylib                 0x0000000101d6904f X509_STORE_load_locations + 143
libssl.1.1.dylib                    0x000000010170e759 SSL_CTX_load_verify_locations + 41
openssl                             0x000000010155253e ctx_set_verify_locations + 158
openssl                             0x000000010152a5de s_client_main + 12382
openssl                             0x0000000101514a99 do_cmd + 233
openssl                             0x000000010151443b main + 651
dyld                                0x00007ff80337a41f start + 1903

// 读取代码
STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk,..) {

    for (;;) {
        i = PEM_read_bio(bp, &name, &header, &data, &len);
        d2i = (D2I_OF(void)) d2i_X509;
        if (strcmp(name, PEM_STRING_X509) == 0) {
            sk_X509_INFO_push(ret, xi)
            xi = X509_INFO_new();
            pp = &(xi->x509);
        }
        PEM_get_EVP_CIPHER_INFO(header, &cipher);
        PEM_do_header(&cipher, data, &len, cb, u);
        const unsigned char* p = data;
        // 把perm文件中的CA证书转换为x509 
        d2i(pp, &p, len);
    }
}

// 部分预置的ROOT CA证书
x509_object_idx i = 0, /C=FR/O=Dhimyotis/CN=Certigna
x509_object_idx i = 1, /O=TeliaSonera/CN=TeliaSonera Root CA v1
x509_object_idx i = 2, /C=ES/O=IZENPE S.A./CN=Izenpe.com
x509_object_idx i = 3, /C=US/O=Amazon/CN=Amazon Root CA 1
x509_object_idx i = 4, /C=US/O=Amazon/CN=Amazon Root CA 2
x509_object_idx i = 5, /C=US/O=Amazon/CN=Amazon Root CA 3
... 
x509_object_idx i = 70, /C=CN/O=China Financial Certification Authority/CN=CFCA EV ROOT
x509_object_idx i = 71, /C=US/OU=emSign PKI/O=eMudhra Inc/CN=emSign Root CA - C1
x509_object_idx i = 72, /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA

libcrypto.1.1.dylib                 0x0000000101d15fa0 int_rsa_verify + 992
libcrypto.1.1.dylib                 0x0000000101d160fb RSA_verify + 139
libcrypto.1.1.dylib                 0x0000000101d12e12 pkey_rsa_verify + 130
libcrypto.1.1.dylib                 0x0000000101cb82f0 EVP_PKEY_verify + 208
libcrypto.1.1.dylib                 0x0000000101cb3490 EVP_DigestVerifyFinal + 464
libcrypto.1.1.dylib                 0x0000000101cb356c EVP_DigestVerify + 156
libcrypto.1.1.dylib                 0x0000000101b89fcf ASN1_item_verify + 959
libcrypto.1.1.dylib                 0x0000000101d7a80e X509_verify + 158
libcrypto.1.1.dylib                 0x0000000101d71ee6 internal_verify + 870
libcrypto.1.1.dylib                 0x0000000101d6fffc verify_chain + 348
libcrypto.1.1.dylib                 0x0000000101d6fad6 X509_verify_cert + 534
libssl.1.1.dylib                    0x00000001016fc1b1 ssl_verify_cert_chain + 705
libssl.1.1.dylib                    0x0000000101730b89 tls_process_server_certificate + 1113
libssl.1.1.dylib                    0x000000010172f771 ossl_statem_client_process_message + 177
libssl.1.1.dylib                    0x000000010172bb55 read_state_machine + 901
libssl.1.1.dylib                    0x000000010172b37a state_machine + 1226
libssl.1.1.dylib                    0x000000010172aea7 ossl_statem_connect + 23
libssl.1.1.dylib                    0x00000001016e6567 ssl3_write_bytes + 503
libssl.1.1.dylib                    0x00000001016f8669 ssl3_write + 105
libssl.1.1.dylib                    0x0000000101709925 ssl_write_internal + 437
libssl.1.1.dylib                    0x000000010170999f SSL_write + 95
openssl                             0x000000010152d38c s_client_main + 24076
openssl                             0x0000000101514a99 do_cmd + 233
openssl                             0x000000010151443b main + 651
dyld                                0x00007ff80337a41f start + 1903     

/* verify the issuer signatures and cert times of ctx->chain */
static int internal_verify(X509_STORE_CTX *ctx) {
    X509 *xi, *xs;               // xi是CA证书，xs是待校验证书。
    int n = sk_x509_num(ctx->chain) - 1;    // (3 - 1)
    while (n > 0) {
        fprintf(stderr, "CA: use xi's public key to verify the signature of xs\n");

        if (xs != xi || ((ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE)   // 跳过自签名证书，默认不校验
                        && (xi->ex_flags & EXFLAG_SS) != 0)) {
        
            EVP_PKEY *pkey;
            int issuer_depth = n + (xs == xi ? 0 : 1);
            pkey = X509_get0_pubkey(xi);
            X509_verify(xs, pkey);     // 用xi的公钥对xs证书签名进行验签名
        } 
    }
}

int int_rsa_verify(int type, const unsigned char *m, unsigned int m_len,
                    unsigned char *rm, size_t *prm_len,
                    const unsigned char *sigbuf, size_t siglen, RSA *rsa) {

    // 用CA的公钥对签名进行解密，解密出的内容为tbsCertificate的sha256哈希值并且进行了ASN.1编码，descrypt_buf = encode_pkcs1(sha256(tbsCertificate))
    decrypt_len = RSA_public_decrypt((int)siglen, sigbuf, decrypt_buf, rsa,
                        RSA_PKCS1_PADDING);

    // 输入的m为证书签名主体tbsCertificate的sha256哈希值，对m进行ASN.1编码
    if (!encode_pkcs1(&encoded, &encoded_len, type, m, m_len))     // 对m（hash）进行ASN.1编码

     
    // 签名验证
    // 比较encode和decrypt_buf ,都是ASN.1编码的sha256(tbsCertificate)
    memcmp(encoded, decrypt_buf, encoded_len) != 0)
}    

libssl.1.1.dylib                    0x000000010b8fc993 tls_process_ske_ecdhe + 51
libssl.1.1.dylib                    0x000000010b8fa0b2 tls_process_key_exchange + 354
libssl.1.1.dylib                    0x000000010b8f88f0 ossl_statem_client_process_message + 240
libssl.1.1.dylib                    0x000000010b8f4ce5 read_state_machine + 901
libssl.1.1.dylib                    0x000000010b8f450a state_machine + 1226
libssl.1.1.dylib                    0x000000010b8f4037 ossl_statem_connect + 23
libssl.1.1.dylib                    0x000000010b8afce7 ssl3_write_bytes + 503
libssl.1.1.dylib                    0x000000010b8c1899 ssl3_write + 105
libssl.1.1.dylib                    0x000000010b8d2aa5 ssl_write_internal + 437
libssl.1.1.dylib                    0x000000010b8d2b1f SSL_write + 95
openssl                             0x000000010b6fd54c s_client_main + 24076
openssl                             0x000000010b6e4d59 do_cmd + 233
openssl                             0x000000010b6e471b main + 651
dyld                                0x00007ff80337a41f start + 1903

MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) {
    ...
    EVP_PKEY *pkey = NULL;
    int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) 
    {
        ...
        if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA)
            *pkey = X509_get0_pubkey(s->session->peer);            // 获取服务端证书的公钥
        else if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aRSA)     // rsa_pkcs1_sha512 = 1
            *pkey = X509_get0_pubkey(s->session->peer);   
        ...
    }

    if (pkey != NULL) {
         // 构建待验签的内容tbs =  【client-random(32) + server-random(32) + Pubkey Length(4) + Pubkey(65)】
        tbslen = construct_key_exchange_tbs(s, &tbs, PACKET_data(&params), PACKET_remaining(&params));
        // 用服务端证书的公钥对tbs进行验签，
        EVP_DigestVerifyInit(md_ctx, &pctx, md, NULL, pkey);  // md = sha512
        rv = EVP_DigestVerify(md_ctx, PACKET_data(&signature),      
                    PACKET_remaining(&signature), tbs, tbslen);
    }
}

TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 333
    Handshake Protocol: Server Key Exchange
        Handshake Type: Server Key Exchange (12)
        Length: 329
        EC Diffie-Hellman Server Params
            Curve Type: named_curve (0x03)
            Named Curve: secp256r1 (0x0017)
            Pubkey Length: 65
            Pubkey: 04f0c946215b6087886061603731a85...
            Signature Algorithm: rsa_pkcs1_sha512 (0x0601)
            Signature Length: 256
            Signature [truncated]: 34720afa82341de0b766bfa0...

int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) { 
   ...
   tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) {
    //  服务端EC公钥
    EVP_PKEY* skey = s->s3->peer_tmp;
    //  客户端生成EC公私钥对
    EVP_PKEY* ckey = ssl_generate_pkey(skey);
    /* Generate encoding of client key */
    encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(ckey, &encodedPoint);
    // [encodedPoint, encoded_pt_len]为客户端的EC公钥
    // 客户端的EC公钥通过Client Key Exchange消息发送到服务端
    Handshake Protocol: Client Key Exchange
        Handshake Type: Client Key Exchange (16)
        Length: 66
        EC Diffie-Hellman Client Params
            Pubkey Length: 65
            Pubkey: 041fde8f0f40e54ba73e0d5893bd95a5b13bd02...

       ...
   }    

int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) {
    ...
    int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) {
        EVP_PKEY* skey = s->s3->peer_tmp;
        EVP_PKEY* ckey = ssl_generate_pkey(skey);
        // 通过客户端的EC私钥ckey和服务端的EC公钥skey【派生出】预主密钥pre master key
        ssl_derive(s, ckey, skey, 0);
         int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey, int gensecret) {

              EVP_PKEY_CTX* pctx = EVP_PKEY_CTX_new(privkey, NULL);
              EVP_PKEY_derive_init(pctx);
              EVP_PKEY_derive_set_peer(pctx, pubkey);
              EVP_PKEY_derive(pctx, NULL, &pmslen);
              EVP_PKEY_derive(pctx, pms, &pmslen);
              
              /* Save premaster secret */
                 s->s3->tmp.pms = pms;
                 s->s3->tmp.pmslen = pmslen;
         }
        
    }
 ...           
}    

int tls_client_key_exchange_post_work(SSL *s) {
     pms = s->s3->tmp.pms;
     pmslen = s->s3->tmp.pmslen;
     ssl_generate_master_secret(s, pms, pmslen, 1); {
         
         s->method->ssl3_enc->generate_master_secret(s,    // // tls1.2, tls1_generate_master_secret
             s->session->master_key, pms, pmslen,
              &s->session->master_key_length);
}

int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
                                size_t len, size_t *secret_size) {

    //......
    tls1_PRF(s,
                TLS_MD_MASTER_SECRET_CONST,
                TLS_MD_MASTER_SECRET_CONST_SIZE,
                s->s3->client_random, SSL3_RANDOM_SIZE,
                NULL, 0,
                s->s3->server_random, SSL3_RANDOM_SIZE,
                NULL, 0, p, len, out,
                SSL3_MASTER_SECRET_SIZE, 1));
    ...

    *secret_size = SSL3_MASTER_SECRET_SIZE;
}

// 生成Key Block
static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num)
{	
    int ret;
     /* Calls SSLfatal() as required */
    ret = tls1_PRF(s,
               TLS_MD_KEY_EXPANSION_CONST, TLS_MD_KEY_EXPANSION_CONST_SIZE, 
               s->s3->server_random, SSL3_RANDOM_SIZE, 
               s->s3->client_random, SSL3_RANDOM_SIZE,
               NULL, 0, NULL, 0, s->session->master_key,
               s->session->master_key_length, km, num, 1);
    return ret;
}

// 从Key Block中提取会话密钥
int tls1_change_cipher_state(SSL *s, int which) {
    // 数据加解密的会话密钥上下文,  数据发送和接收使用不同的加密密钥 
    s->enc_write_ctx;  
    s->enc_read_ctx;

   // 数据签名的会话密钥上下文
   s->write_hash
   s->read_hash
}

1   libcrypto.1.1.dylib                 0x000000010a15c949 aes_gcm_cipher + 73
2   libcrypto.1.1.dylib                 0x000000010a173a2f evp_EncryptDecryptUpdate + 303
3   libcrypto.1.1.dylib                 0x000000010a172d70 EVP_EncryptUpdate + 112
4   libcrypto.1.1.dylib                 0x000000010a172cd3 EVP_CipherUpdate + 67
5   libssl.1.1.dylib                    0x0000000109bb5464 tls13_enc + 1956
6   libssl.1.1.dylib                    0x0000000109baca8c do_ssl3_write + 4924
7   libssl.1.1.dylib                    0x0000000109bab2f0 ssl3_write_bytes + 3408
8   libssl.1.1.dylib                    0x0000000109bbc369 ssl3_write + 105
9   libssl.1.1.dylib                    0x0000000109bcd615 ssl_write_internal + 437
10  libssl.1.1.dylib                    0x0000000109bcd68f SSL_write + 95
11  openssl                             0x00000001099f854c s_client_main + 24076
12  openssl                             0x00000001099dfd59 do_cmd + 233
13  openssl                             0x00000001099df71b main + 651
14  dyld                                0x00007ff80337a41f start + 1903 

static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                          const unsigned char *in, size_t len)
{
    EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);
    if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ? EVP_CTRL_GCM_IV_GEN
                                              : EVP_CTRL_GCM_SET_IV_INV,
                            EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)
    /* Use saved AAD */ 
    // 输入认证附加数据
    if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))
        goto err;
    in += EVP_GCM_TLS_EXPLICIT_IV_LEN; (8)
    out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN(16);
    if (ctx->encrypt) {
        /* Encrypt payload  */
        // 进行数据加密
        if (gctx->ctr) {
            size_t bulk = 0;
            if (len >= 32 && AES_GCM_ASM(gctx)) {
                if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))
                    return -1;
                bulk = AES_gcm_encrypt(in, out, len,
                                       gctx->gcm.key,
                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);
                gctx->gcm.len.u[1] += bulk;
            }
        } 
    }
    out += len;
    /* Finally write tag  */
    // 数据加签，生成认证tag，防止数据被篡改。
    CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);
}

   Encrypted Application Data = IV (8) + Encrypted DATA (15) + TAG (16)