1 /* $OpenBSD: tls13_lib.c,v 1.11 2019/03/17 15:13:23 jsing Exp $ */ 2 /* 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <limits.h> 19 #include <stddef.h> 20 21 #include <openssl/evp.h> 22 23 #include "ssl_locl.h" 24 #include "tls13_internal.h" 25 26 const EVP_AEAD * 27 tls13_cipher_aead(const SSL_CIPHER *cipher) 28 { 29 if (cipher == NULL) 30 return NULL; 31 if (cipher->algorithm_ssl != SSL_TLSV1_3) 32 return NULL; 33 34 switch (cipher->algorithm_enc) { 35 case SSL_AES128GCM: 36 return EVP_aead_aes_128_gcm(); 37 case SSL_AES256GCM: 38 return EVP_aead_aes_256_gcm(); 39 case SSL_CHACHA20POLY1305: 40 return EVP_aead_chacha20_poly1305(); 41 } 42 43 return NULL; 44 } 45 46 const EVP_MD * 47 tls13_cipher_hash(const SSL_CIPHER *cipher) 48 { 49 if (cipher == NULL) 50 return NULL; 51 if (cipher->algorithm_ssl != SSL_TLSV1_3) 52 return NULL; 53 54 switch (cipher->algorithm2) { 55 case SSL_HANDSHAKE_MAC_SHA256: 56 return EVP_sha256(); 57 case SSL_HANDSHAKE_MAC_SHA384: 58 return EVP_sha384(); 59 } 60 61 return NULL; 62 } 63 64 static void 65 tls13_alert_received_cb(uint8_t alert_desc, void *arg) 66 { 67 struct tls13_ctx *ctx = arg; 68 SSL *s = ctx->ssl; 69 70 if (alert_desc == SSL_AD_CLOSE_NOTIFY) { 71 ctx->ssl->internal->shutdown |= SSL_RECEIVED_SHUTDOWN; 72 S3I(ctx->ssl)->warn_alert = alert_desc; 73 return; 74 } 75 76 if (alert_desc == SSL_AD_USER_CANCELLED) { 77 /* 78 * We treat this as advisory, since a close_notify alert 79 * SHOULD follow this alert (RFC 8446 section 6.1). 80 */ 81 return; 82 } 83 84 /* All other alerts are treated as fatal in TLSv1.3. */ 85 S3I(ctx->ssl)->fatal_alert = alert_desc; 86 87 SSLerror(ctx->ssl, SSL_AD_REASON_OFFSET + alert_desc); 88 ERR_asprintf_error_data("SSL alert number %d", alert_desc); 89 90 SSL_CTX_remove_session(s->ctx, s->session); 91 } 92 93 struct tls13_ctx * 94 tls13_ctx_new(int mode) 95 { 96 struct tls13_ctx *ctx = NULL; 97 98 if ((ctx = calloc(sizeof(struct tls13_ctx), 1)) == NULL) 99 goto err; 100 101 ctx->mode = mode; 102 103 if ((ctx->rl = tls13_record_layer_new(tls13_legacy_wire_read_cb, 104 tls13_legacy_wire_write_cb, tls13_alert_received_cb, NULL, 105 ctx)) == NULL) 106 goto err; 107 108 return ctx; 109 110 err: 111 tls13_ctx_free(ctx); 112 113 return NULL; 114 } 115 116 void 117 tls13_ctx_free(struct tls13_ctx *ctx) 118 { 119 if (ctx == NULL) 120 return; 121 122 tls13_record_layer_free(ctx->rl); 123 124 freezero(ctx, sizeof(struct tls13_ctx)); 125 } 126 127 static ssize_t 128 tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len) 129 { 130 int n; 131 132 if (ssl->rbio == NULL) { 133 SSLerror(ssl, SSL_R_BIO_NOT_SET); 134 return TLS13_IO_FAILURE; 135 } 136 137 ssl->internal->rwstate = SSL_READING; 138 139 if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) { 140 if (BIO_should_read(ssl->rbio)) 141 return TLS13_IO_WANT_POLLIN; 142 if (BIO_should_write(ssl->rbio)) 143 return TLS13_IO_WANT_POLLOUT; 144 if (n == 0) 145 return TLS13_IO_EOF; 146 147 return TLS13_IO_FAILURE; 148 } 149 150 if (n == len) 151 ssl->internal->rwstate = SSL_NOTHING; 152 153 return n; 154 } 155 156 ssize_t 157 tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg) 158 { 159 struct tls13_ctx *ctx = arg; 160 161 return tls13_legacy_wire_read(ctx->ssl, buf, n); 162 } 163 164 static ssize_t 165 tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len) 166 { 167 int n; 168 169 if (ssl->wbio == NULL) { 170 SSLerror(ssl, SSL_R_BIO_NOT_SET); 171 return TLS13_IO_FAILURE; 172 } 173 174 ssl->internal->rwstate = SSL_WRITING; 175 176 if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) { 177 if (BIO_should_read(ssl->wbio)) 178 return TLS13_IO_WANT_POLLIN; 179 if (BIO_should_write(ssl->wbio)) 180 return TLS13_IO_WANT_POLLOUT; 181 182 return TLS13_IO_FAILURE; 183 } 184 185 if (n == len) 186 ssl->internal->rwstate = SSL_NOTHING; 187 188 return n; 189 } 190 191 ssize_t 192 tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg) 193 { 194 struct tls13_ctx *ctx = arg; 195 196 return tls13_legacy_wire_write(ctx->ssl, buf, n); 197 } 198 199 int 200 tls13_legacy_return_code(SSL *ssl, ssize_t ret) 201 { 202 if (ret > INT_MAX) { 203 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 204 return -1; 205 } 206 207 /* A successful read, write or other operation. */ 208 if (ret > 0) 209 return ret; 210 211 ssl->internal->rwstate = SSL_NOTHING; 212 213 switch (ret) { 214 case TLS13_IO_EOF: 215 return 0; 216 217 case TLS13_IO_FAILURE: 218 /* XXX - we need to record/map internal errors. */ 219 if (ERR_peek_error() == 0) 220 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 221 return -1; 222 223 case TLS13_IO_WANT_POLLIN: 224 BIO_set_retry_read(ssl->rbio); 225 ssl->internal->rwstate = SSL_READING; 226 return -1; 227 228 case TLS13_IO_WANT_POLLOUT: 229 BIO_set_retry_write(ssl->wbio); 230 ssl->internal->rwstate = SSL_WRITING; 231 return -1; 232 } 233 234 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 235 return -1; 236 } 237 238 int 239 tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek) 240 { 241 struct tls13_ctx *ctx = ssl->internal->tls13; 242 ssize_t ret; 243 244 if (ctx == NULL || !ctx->handshake_completed) { 245 if ((ret = ssl->internal->handshake_func(ssl)) <= 0) 246 return ret; 247 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN); 248 } 249 250 if (peek) { 251 /* XXX - support peek... */ 252 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 253 return -1; 254 } 255 256 if (type != SSL3_RT_APPLICATION_DATA) { 257 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 258 return -1; 259 } 260 if (len < 0) { 261 SSLerror(ssl, SSL_R_BAD_LENGTH); 262 return -1; 263 } 264 265 ret = tls13_read_application_data(ctx->rl, buf, len); 266 return tls13_legacy_return_code(ssl, ret); 267 } 268 269 int 270 tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len) 271 { 272 struct tls13_ctx *ctx = ssl->internal->tls13; 273 const uint8_t *buf = vbuf; 274 size_t n, sent; 275 ssize_t ret; 276 277 if (ctx == NULL || !ctx->handshake_completed) { 278 if ((ret = ssl->internal->handshake_func(ssl)) <= 0) 279 return ret; 280 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT); 281 } 282 283 if (type != SSL3_RT_APPLICATION_DATA) { 284 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 285 return -1; 286 } 287 if (len <= 0) { 288 SSLerror(ssl, SSL_R_BAD_LENGTH); 289 return -1; 290 } 291 292 /* 293 * The TLSv1.3 record layer write behaviour is the same as 294 * SSL_MODE_ENABLE_PARTIAL_WRITE. 295 */ 296 if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) { 297 ret = tls13_write_application_data(ctx->rl, buf, len); 298 return tls13_legacy_return_code(ssl, ret); 299 } 300 301 /* 302 * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until 303 * we have written out all of the requested data. 304 */ 305 sent = S3I(ssl)->wnum; 306 if (len < sent) { 307 SSLerror(ssl, SSL_R_BAD_LENGTH); 308 return -1; 309 } 310 n = len - sent; 311 for (;;) { 312 if (n == 0) { 313 S3I(ssl)->wnum = 0; 314 return sent; 315 } 316 if ((ret = tls13_write_application_data(ctx->rl, 317 &buf[sent], n)) <= 0) { 318 S3I(ssl)->wnum = sent; 319 return tls13_legacy_return_code(ssl, ret); 320 } 321 sent += ret; 322 n -= ret; 323 } 324 } 325