1 /* $OpenBSD: tls13_lib.c,v 1.76 2022/11/26 16:08:56 tb Exp $ */ 2 /* 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 4 * Copyright (c) 2019 Bob Beck <beck@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <stddef.h> 20 21 #include <openssl/evp.h> 22 23 #include "ssl_local.h" 24 #include "ssl_tlsext.h" 25 #include "tls13_internal.h" 26 27 /* 28 * RFC 8446, section 4.6.1. Servers must not indicate a lifetime longer than 29 * 7 days and clients must not cache tickets for longer than 7 days. 30 */ 31 32 #define TLS13_MAX_TICKET_LIFETIME (7 * 24 * 3600) 33 34 /* 35 * Downgrade sentinels - RFC 8446 section 4.1.3, magic values which must be set 36 * by the server in server random if it is willing to downgrade but supports 37 * TLSv1.3 38 */ 39 const uint8_t tls13_downgrade_12[8] = { 40 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x01, 41 }; 42 const uint8_t tls13_downgrade_11[8] = { 43 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x00, 44 }; 45 46 /* 47 * HelloRetryRequest hash - RFC 8446 section 4.1.3. 48 */ 49 const uint8_t tls13_hello_retry_request_hash[32] = { 50 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 51 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91, 52 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 53 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c, 54 }; 55 56 /* 57 * Certificate Verify padding - RFC 8446 section 4.4.3. 58 */ 59 const uint8_t tls13_cert_verify_pad[64] = { 60 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 61 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 62 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 63 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 64 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 65 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 66 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 67 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 68 }; 69 70 const uint8_t tls13_cert_client_verify_context[] = 71 "TLS 1.3, client CertificateVerify"; 72 const uint8_t tls13_cert_server_verify_context[] = 73 "TLS 1.3, server CertificateVerify"; 74 75 const EVP_AEAD * 76 tls13_cipher_aead(const SSL_CIPHER *cipher) 77 { 78 if (cipher == NULL) 79 return NULL; 80 if (cipher->algorithm_ssl != SSL_TLSV1_3) 81 return NULL; 82 83 switch (cipher->algorithm_enc) { 84 case SSL_AES128GCM: 85 return EVP_aead_aes_128_gcm(); 86 case SSL_AES256GCM: 87 return EVP_aead_aes_256_gcm(); 88 case SSL_CHACHA20POLY1305: 89 return EVP_aead_chacha20_poly1305(); 90 } 91 92 return NULL; 93 } 94 95 const EVP_MD * 96 tls13_cipher_hash(const SSL_CIPHER *cipher) 97 { 98 if (cipher == NULL) 99 return NULL; 100 if (cipher->algorithm_ssl != SSL_TLSV1_3) 101 return NULL; 102 103 switch (cipher->algorithm2) { 104 case SSL_HANDSHAKE_MAC_SHA256: 105 return EVP_sha256(); 106 case SSL_HANDSHAKE_MAC_SHA384: 107 return EVP_sha384(); 108 } 109 110 return NULL; 111 } 112 113 void 114 tls13_alert_received_cb(uint8_t alert_desc, void *arg) 115 { 116 struct tls13_ctx *ctx = arg; 117 118 if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) { 119 ctx->close_notify_recv = 1; 120 ctx->ssl->shutdown |= SSL_RECEIVED_SHUTDOWN; 121 ctx->ssl->s3->warn_alert = alert_desc; 122 return; 123 } 124 125 if (alert_desc == TLS13_ALERT_USER_CANCELED) { 126 /* 127 * We treat this as advisory, since a close_notify alert 128 * SHOULD follow this alert (RFC 8446 section 6.1). 129 */ 130 return; 131 } 132 133 /* All other alerts are treated as fatal in TLSv1.3. */ 134 ctx->ssl->s3->fatal_alert = alert_desc; 135 136 SSLerror(ctx->ssl, SSL_AD_REASON_OFFSET + alert_desc); 137 ERR_asprintf_error_data("SSL alert number %d", alert_desc); 138 139 SSL_CTX_remove_session(ctx->ssl->ctx, ctx->ssl->session); 140 } 141 142 void 143 tls13_alert_sent_cb(uint8_t alert_desc, void *arg) 144 { 145 struct tls13_ctx *ctx = arg; 146 147 if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) { 148 ctx->close_notify_sent = 1; 149 return; 150 } 151 152 if (alert_desc == TLS13_ALERT_USER_CANCELED) { 153 return; 154 } 155 156 /* All other alerts are treated as fatal in TLSv1.3. */ 157 if (ctx->error.code == 0) 158 SSLerror(ctx->ssl, SSL_AD_REASON_OFFSET + alert_desc); 159 } 160 161 static void 162 tls13_legacy_handshake_message_recv_cb(void *arg) 163 { 164 struct tls13_ctx *ctx = arg; 165 SSL *s = ctx->ssl; 166 CBS cbs; 167 168 if (s->msg_callback == NULL) 169 return; 170 171 tls13_handshake_msg_data(ctx->hs_msg, &cbs); 172 ssl_msg_callback_cbs(s, 0, SSL3_RT_HANDSHAKE, &cbs); 173 } 174 175 static void 176 tls13_legacy_handshake_message_sent_cb(void *arg) 177 { 178 struct tls13_ctx *ctx = arg; 179 SSL *s = ctx->ssl; 180 CBS cbs; 181 182 if (s->msg_callback == NULL) 183 return; 184 185 tls13_handshake_msg_data(ctx->hs_msg, &cbs); 186 ssl_msg_callback_cbs(s, 1, SSL3_RT_HANDSHAKE, &cbs); 187 } 188 189 static void 190 tls13_legacy_info_cb(void *arg, int state, int ret) 191 { 192 struct tls13_ctx *ctx = arg; 193 SSL *s = ctx->ssl; 194 195 ssl_info_callback(s, state, ret); 196 } 197 198 static int 199 tls13_legacy_ocsp_status_recv_cb(void *arg) 200 { 201 struct tls13_ctx *ctx = arg; 202 SSL *s = ctx->ssl; 203 int ret; 204 205 if (s->ctx->tlsext_status_cb == NULL) 206 return 1; 207 208 ret = s->ctx->tlsext_status_cb(s, 209 s->ctx->tlsext_status_arg); 210 if (ret < 0) { 211 ctx->alert = TLS13_ALERT_INTERNAL_ERROR; 212 SSLerror(s, ERR_R_MALLOC_FAILURE); 213 return 0; 214 } 215 if (ret == 0) { 216 ctx->alert = TLS13_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE; 217 SSLerror(s, SSL_R_INVALID_STATUS_RESPONSE); 218 return 0; 219 } 220 221 return 1; 222 } 223 224 static int 225 tls13_phh_update_read_traffic_secret(struct tls13_ctx *ctx) 226 { 227 struct tls13_secrets *secrets = ctx->hs->tls13.secrets; 228 struct tls13_secret *secret; 229 230 if (ctx->mode == TLS13_HS_CLIENT) { 231 secret = &secrets->server_application_traffic; 232 if (!tls13_update_server_traffic_secret(secrets)) 233 return 0; 234 } else { 235 secret = &secrets->client_application_traffic; 236 if (!tls13_update_client_traffic_secret(secrets)) 237 return 0; 238 } 239 240 return tls13_record_layer_set_read_traffic_key(ctx->rl, 241 secret, ssl_encryption_application); 242 } 243 244 static int 245 tls13_phh_update_write_traffic_secret(struct tls13_ctx *ctx) 246 { 247 struct tls13_secrets *secrets = ctx->hs->tls13.secrets; 248 struct tls13_secret *secret; 249 250 if (ctx->mode == TLS13_HS_CLIENT) { 251 secret = &secrets->client_application_traffic; 252 if (!tls13_update_client_traffic_secret(secrets)) 253 return 0; 254 } else { 255 secret = &secrets->server_application_traffic; 256 if (!tls13_update_server_traffic_secret(secrets)) 257 return 0; 258 } 259 260 return tls13_record_layer_set_write_traffic_key(ctx->rl, 261 secret, ssl_encryption_application); 262 } 263 264 /* 265 * XXX arbitrarily chosen limit of 100 post handshake handshake 266 * messages in an hour - to avoid a hostile peer from constantly 267 * requesting certificates or key renegotiaitons, etc. 268 */ 269 static int 270 tls13_phh_limit_check(struct tls13_ctx *ctx) 271 { 272 time_t now = time(NULL); 273 274 if (ctx->phh_last_seen > now - TLS13_PHH_LIMIT_TIME) { 275 if (ctx->phh_count > TLS13_PHH_LIMIT) 276 return 0; 277 } else 278 ctx->phh_count = 0; 279 ctx->phh_count++; 280 ctx->phh_last_seen = now; 281 return 1; 282 } 283 284 static ssize_t 285 tls13_key_update_recv(struct tls13_ctx *ctx, CBS *cbs) 286 { 287 struct tls13_handshake_msg *hs_msg = NULL; 288 CBB cbb_hs; 289 CBS cbs_hs; 290 uint8_t alert = TLS13_ALERT_INTERNAL_ERROR; 291 uint8_t key_update_request; 292 ssize_t ret; 293 294 if (!CBS_get_u8(cbs, &key_update_request)) { 295 alert = TLS13_ALERT_DECODE_ERROR; 296 goto err; 297 } 298 if (CBS_len(cbs) != 0) { 299 alert = TLS13_ALERT_DECODE_ERROR; 300 goto err; 301 } 302 if (key_update_request > 1) { 303 alert = TLS13_ALERT_ILLEGAL_PARAMETER; 304 goto err; 305 } 306 307 if (!tls13_phh_update_read_traffic_secret(ctx)) 308 goto err; 309 310 if (key_update_request == 0) 311 return TLS13_IO_SUCCESS; 312 313 /* Our peer requested that we update our write traffic keys. */ 314 if ((hs_msg = tls13_handshake_msg_new()) == NULL) 315 goto err; 316 if (!tls13_handshake_msg_start(hs_msg, &cbb_hs, TLS13_MT_KEY_UPDATE)) 317 goto err; 318 if (!CBB_add_u8(&cbb_hs, 0)) 319 goto err; 320 if (!tls13_handshake_msg_finish(hs_msg)) 321 goto err; 322 323 ctx->key_update_request = 1; 324 tls13_handshake_msg_data(hs_msg, &cbs_hs); 325 ret = tls13_record_layer_phh(ctx->rl, &cbs_hs); 326 327 tls13_handshake_msg_free(hs_msg); 328 hs_msg = NULL; 329 330 return ret; 331 332 err: 333 tls13_handshake_msg_free(hs_msg); 334 335 return tls13_send_alert(ctx->rl, alert); 336 } 337 338 /* RFC 8446 section 4.6.1 */ 339 static ssize_t 340 tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs) 341 { 342 struct tls13_secrets *secrets = ctx->hs->tls13.secrets; 343 struct tls13_secret nonce; 344 uint32_t ticket_lifetime, ticket_age_add; 345 CBS ticket_nonce, ticket; 346 SSL_SESSION *sess = NULL; 347 int alert, session_id_length; 348 ssize_t ret = 0; 349 350 memset(&nonce, 0, sizeof(nonce)); 351 352 if (ctx->mode != TLS13_HS_CLIENT) { 353 alert = TLS13_ALERT_UNEXPECTED_MESSAGE; 354 goto err; 355 } 356 357 alert = TLS13_ALERT_DECODE_ERROR; 358 359 if (!CBS_get_u32(cbs, &ticket_lifetime)) 360 goto err; 361 if (!CBS_get_u32(cbs, &ticket_age_add)) 362 goto err; 363 if (!CBS_get_u8_length_prefixed(cbs, &ticket_nonce)) 364 goto err; 365 if (!CBS_get_u16_length_prefixed(cbs, &ticket)) 366 goto err; 367 /* Extensions can only contain early_data, which we currently ignore. */ 368 if (!tlsext_client_parse(ctx->ssl, SSL_TLSEXT_MSG_NST, cbs, &alert)) 369 goto err; 370 371 if (CBS_len(cbs) != 0) 372 goto err; 373 374 /* Zero indicates that the ticket should be discarded immediately. */ 375 if (ticket_lifetime == 0) { 376 ret = TLS13_IO_SUCCESS; 377 goto done; 378 } 379 380 /* Servers MUST NOT use any value larger than 7 days. */ 381 if (ticket_lifetime > TLS13_MAX_TICKET_LIFETIME) { 382 alert = TLS13_ALERT_ILLEGAL_PARAMETER; 383 goto err; 384 } 385 386 alert = TLS13_ALERT_INTERNAL_ERROR; 387 388 /* 389 * Create new session instead of modifying the current session. 390 * The current session could already be in the session cache. 391 */ 392 if ((sess = ssl_session_dup(ctx->ssl->session, 0)) == NULL) 393 goto err; 394 395 sess->time = time(NULL); 396 397 sess->tlsext_tick_lifetime_hint = ticket_lifetime; 398 sess->tlsext_tick_age_add = ticket_age_add; 399 400 if (!CBS_stow(&ticket, &sess->tlsext_tick, &sess->tlsext_ticklen)) 401 goto err; 402 403 /* XXX - ensure this doesn't overflow session_id if hash is changed. */ 404 if (!EVP_Digest(CBS_data(&ticket), CBS_len(&ticket), 405 sess->session_id, &session_id_length, EVP_sha256(), NULL)) 406 goto err; 407 sess->session_id_length = session_id_length; 408 409 if (!CBS_stow(&ticket_nonce, &nonce.data, &nonce.len)) 410 goto err; 411 412 if (!tls13_secret_init(&sess->resumption_master_secret, 256)) 413 goto err; 414 415 if (!tls13_derive_secret(&sess->resumption_master_secret, 416 secrets->digest, &secrets->resumption_master, "resumption", 417 &nonce)) 418 goto err; 419 420 SSL_SESSION_free(ctx->ssl->session); 421 ctx->ssl->session = sess; 422 sess = NULL; 423 424 ssl_update_cache(ctx->ssl, SSL_SESS_CACHE_CLIENT); 425 426 ret = TLS13_IO_SUCCESS; 427 goto done; 428 429 err: 430 ret = tls13_send_alert(ctx->rl, alert); 431 432 done: 433 tls13_secret_cleanup(&nonce); 434 SSL_SESSION_free(sess); 435 436 return ret; 437 } 438 439 ssize_t 440 tls13_phh_received_cb(void *cb_arg) 441 { 442 ssize_t ret = TLS13_IO_FAILURE; 443 struct tls13_ctx *ctx = cb_arg; 444 CBS cbs; 445 446 if (!tls13_phh_limit_check(ctx)) 447 return tls13_send_alert(ctx->rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 448 449 if ((ctx->hs_msg == NULL) && 450 ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)) 451 return TLS13_IO_FAILURE; 452 453 if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) != 454 TLS13_IO_SUCCESS) 455 return ret; 456 457 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 458 return TLS13_IO_FAILURE; 459 460 switch(tls13_handshake_msg_type(ctx->hs_msg)) { 461 case TLS13_MT_KEY_UPDATE: 462 ret = tls13_key_update_recv(ctx, &cbs); 463 break; 464 case TLS13_MT_NEW_SESSION_TICKET: 465 ret = tls13_new_session_ticket_recv(ctx, &cbs); 466 break; 467 case TLS13_MT_CERTIFICATE_REQUEST: 468 /* XXX add support if we choose to advertise this */ 469 /* FALLTHROUGH */ 470 default: 471 ret = TLS13_IO_FAILURE; /* XXX send alert */ 472 break; 473 } 474 475 tls13_handshake_msg_free(ctx->hs_msg); 476 ctx->hs_msg = NULL; 477 return ret; 478 } 479 480 void 481 tls13_phh_done_cb(void *cb_arg) 482 { 483 struct tls13_ctx *ctx = cb_arg; 484 485 if (ctx->key_update_request) { 486 tls13_phh_update_write_traffic_secret(ctx); 487 ctx->key_update_request = 0; 488 } 489 } 490 491 static const struct tls13_record_layer_callbacks tls13_rl_callbacks = { 492 .wire_read = tls13_legacy_wire_read_cb, 493 .wire_write = tls13_legacy_wire_write_cb, 494 .wire_flush = tls13_legacy_wire_flush_cb, 495 496 .alert_recv = tls13_alert_received_cb, 497 .alert_sent = tls13_alert_sent_cb, 498 .phh_recv = tls13_phh_received_cb, 499 .phh_sent = tls13_phh_done_cb, 500 }; 501 502 struct tls13_ctx * 503 tls13_ctx_new(int mode, SSL *ssl) 504 { 505 struct tls13_ctx *ctx = NULL; 506 507 if ((ctx = calloc(sizeof(struct tls13_ctx), 1)) == NULL) 508 goto err; 509 510 ctx->hs = &ssl->s3->hs; 511 ctx->mode = mode; 512 ctx->ssl = ssl; 513 514 if ((ctx->rl = tls13_record_layer_new(&tls13_rl_callbacks, ctx)) == NULL) 515 goto err; 516 517 ctx->handshake_message_sent_cb = tls13_legacy_handshake_message_sent_cb; 518 ctx->handshake_message_recv_cb = tls13_legacy_handshake_message_recv_cb; 519 ctx->info_cb = tls13_legacy_info_cb; 520 ctx->ocsp_status_recv_cb = tls13_legacy_ocsp_status_recv_cb; 521 522 ctx->middlebox_compat = 1; 523 524 ssl->tls13 = ctx; 525 526 if (SSL_is_quic(ssl)) { 527 if (!tls13_quic_init(ctx)) 528 goto err; 529 } 530 531 return ctx; 532 533 err: 534 tls13_ctx_free(ctx); 535 536 return NULL; 537 } 538 539 void 540 tls13_ctx_free(struct tls13_ctx *ctx) 541 { 542 if (ctx == NULL) 543 return; 544 545 tls13_error_clear(&ctx->error); 546 tls13_record_layer_free(ctx->rl); 547 tls13_handshake_msg_free(ctx->hs_msg); 548 549 freezero(ctx, sizeof(struct tls13_ctx)); 550 } 551 552 int 553 tls13_cert_add(struct tls13_ctx *ctx, CBB *cbb, X509 *cert, 554 int (*build_extensions)(SSL *s, uint16_t msg_type, CBB *cbb)) 555 { 556 CBB cert_data, cert_exts; 557 uint8_t *data; 558 int cert_len; 559 560 if ((cert_len = i2d_X509(cert, NULL)) < 0) 561 return 0; 562 563 if (!CBB_add_u24_length_prefixed(cbb, &cert_data)) 564 return 0; 565 if (!CBB_add_space(&cert_data, &data, cert_len)) 566 return 0; 567 if (i2d_X509(cert, &data) != cert_len) 568 return 0; 569 if (build_extensions != NULL) { 570 if (!build_extensions(ctx->ssl, SSL_TLSEXT_MSG_CT, cbb)) 571 return 0; 572 } else { 573 if (!CBB_add_u16_length_prefixed(cbb, &cert_exts)) 574 return 0; 575 } 576 if (!CBB_flush(cbb)) 577 return 0; 578 579 return 1; 580 } 581 582 int 583 tls13_synthetic_handshake_message(struct tls13_ctx *ctx) 584 { 585 struct tls13_handshake_msg *hm = NULL; 586 unsigned char buf[EVP_MAX_MD_SIZE]; 587 size_t hash_len; 588 CBB cbb; 589 CBS cbs; 590 SSL *s = ctx->ssl; 591 int ret = 0; 592 593 /* 594 * Replace ClientHello with synthetic handshake message - see 595 * RFC 8446 section 4.4.1. 596 */ 597 if (!tls1_transcript_hash_init(s)) 598 goto err; 599 if (!tls1_transcript_hash_value(s, buf, sizeof(buf), &hash_len)) 600 goto err; 601 602 if ((hm = tls13_handshake_msg_new()) == NULL) 603 goto err; 604 if (!tls13_handshake_msg_start(hm, &cbb, TLS13_MT_MESSAGE_HASH)) 605 goto err; 606 if (!CBB_add_bytes(&cbb, buf, hash_len)) 607 goto err; 608 if (!tls13_handshake_msg_finish(hm)) 609 goto err; 610 611 tls13_handshake_msg_data(hm, &cbs); 612 613 tls1_transcript_reset(ctx->ssl); 614 if (!tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs))) 615 goto err; 616 617 ret = 1; 618 619 err: 620 tls13_handshake_msg_free(hm); 621 622 return ret; 623 } 624 625 int 626 tls13_clienthello_hash_init(struct tls13_ctx *ctx) 627 { 628 if (ctx->hs->tls13.clienthello_md_ctx != NULL) 629 return 0; 630 if ((ctx->hs->tls13.clienthello_md_ctx = EVP_MD_CTX_new()) == NULL) 631 return 0; 632 if (!EVP_DigestInit_ex(ctx->hs->tls13.clienthello_md_ctx, 633 EVP_sha256(), NULL)) 634 return 0; 635 636 if ((ctx->hs->tls13.clienthello_hash == NULL) && 637 (ctx->hs->tls13.clienthello_hash = calloc(1, EVP_MAX_MD_SIZE)) == 638 NULL) 639 return 0; 640 641 return 1; 642 } 643 644 void 645 tls13_clienthello_hash_clear(struct ssl_handshake_tls13_st *hs) /* XXX */ 646 { 647 EVP_MD_CTX_free(hs->clienthello_md_ctx); 648 hs->clienthello_md_ctx = NULL; 649 freezero(hs->clienthello_hash, EVP_MAX_MD_SIZE); 650 hs->clienthello_hash = NULL; 651 } 652 653 int 654 tls13_clienthello_hash_update_bytes(struct tls13_ctx *ctx, void *data, 655 size_t len) 656 { 657 return EVP_DigestUpdate(ctx->hs->tls13.clienthello_md_ctx, data, len); 658 } 659 660 int 661 tls13_clienthello_hash_update(struct tls13_ctx *ctx, CBS *cbs) 662 { 663 return tls13_clienthello_hash_update_bytes(ctx, (void *)CBS_data(cbs), 664 CBS_len(cbs)); 665 } 666 667 int 668 tls13_clienthello_hash_finalize(struct tls13_ctx *ctx) 669 { 670 if (!EVP_DigestFinal_ex(ctx->hs->tls13.clienthello_md_ctx, 671 ctx->hs->tls13.clienthello_hash, 672 &ctx->hs->tls13.clienthello_hash_len)) 673 return 0; 674 EVP_MD_CTX_free(ctx->hs->tls13.clienthello_md_ctx); 675 ctx->hs->tls13.clienthello_md_ctx = NULL; 676 return 1; 677 } 678 679 int 680 tls13_clienthello_hash_validate(struct tls13_ctx *ctx) 681 { 682 unsigned char new_ch_hash[EVP_MAX_MD_SIZE]; 683 unsigned int new_ch_hash_len; 684 685 if (ctx->hs->tls13.clienthello_hash == NULL) 686 return 0; 687 688 if (!EVP_DigestFinal_ex(ctx->hs->tls13.clienthello_md_ctx, 689 new_ch_hash, &new_ch_hash_len)) 690 return 0; 691 EVP_MD_CTX_free(ctx->hs->tls13.clienthello_md_ctx); 692 ctx->hs->tls13.clienthello_md_ctx = NULL; 693 694 if (ctx->hs->tls13.clienthello_hash_len != new_ch_hash_len) 695 return 0; 696 if (memcmp(ctx->hs->tls13.clienthello_hash, new_ch_hash, 697 new_ch_hash_len) != 0) 698 return 0; 699 700 return 1; 701 } 702