xref: /openbsd-src/lib/libssl/tls13_server.c (revision be8ffa848e48af7cb9aae9d1e134f5bcd89137b4) 
1 /* $OpenBSD: tls13_server.c,v 1.14 2020/01/24 04:43:09 jsing Exp $ */
2 /*
3  * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
4  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <openssl/curve25519.h>
20 
21 #include "ssl_locl.h"
22 #include "ssl_tlsext.h"
23 
24 #include "tls13_handshake.h"
25 #include "tls13_internal.h"
26 
27 static int
28 tls13_accept(struct tls13_ctx *ctx)
29 {
30 	if (ctx->mode != TLS13_HS_SERVER)
31 		return TLS13_IO_FAILURE;
32 
33 	return tls13_handshake_perform(ctx);
34 }
35 
36 static int
37 tls13_server_init(struct tls13_ctx *ctx)
38 {
39 	SSL *s = ctx->ssl;
40 
41 	if (!ssl_supported_version_range(s, &ctx->hs->min_version,
42 	    &ctx->hs->max_version)) {
43 		SSLerror(s, SSL_R_NO_PROTOCOLS_AVAILABLE);
44 		return 0;
45 	}
46 	s->version = ctx->hs->max_version;
47 
48 	if (!tls1_transcript_init(s))
49 		return 0;
50 
51 	if ((s->session = SSL_SESSION_new()) == NULL)
52 		return 0;
53 
54 	arc4random_buf(s->s3->server_random, SSL3_RANDOM_SIZE);
55 
56 	return 1;
57 }
58 
59 int
60 tls13_legacy_accept(SSL *ssl)
61 {
62 	struct tls13_ctx *ctx = ssl->internal->tls13;
63 	int ret;
64 
65 	if (ctx == NULL) {
66 		if ((ctx = tls13_ctx_new(TLS13_HS_SERVER)) == NULL) {
67 			SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
68 			return -1;
69 		}
70 		ssl->internal->tls13 = ctx;
71 		ctx->ssl = ssl;
72 		ctx->hs = &S3I(ssl)->hs_tls13;
73 
74 		if (!tls13_server_init(ctx)) {
75 			if (ERR_peek_error() == 0)
76 				SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
77 			return -1;
78 		}
79 	}
80 
81 	S3I(ssl)->hs.state = SSL_ST_ACCEPT;
82 
83 	ret = tls13_accept(ctx);
84 	if (ret == TLS13_IO_USE_LEGACY)
85 		return ssl->method->internal->ssl_accept(ssl);
86 	if (ret == TLS13_IO_SUCCESS)
87 		S3I(ssl)->hs.state = SSL_ST_OK;
88 
89 	return tls13_legacy_return_code(ssl, ret);
90 }
91 
92 int
93 tls13_use_legacy_server(struct tls13_ctx *ctx)
94 {
95 	SSL *s = ctx->ssl;
96 	CBS cbs;
97 
98 	s->method = tls_legacy_server_method();
99 	s->client_version = s->version = s->method->internal->max_version;
100 	s->server = 1;
101 
102 	if (!ssl3_setup_init_buffer(s))
103 		goto err;
104 	if (!ssl3_setup_buffers(s))
105 		goto err;
106 	if (!ssl_init_wbio_buffer(s, 0))
107 		goto err;
108 
109 	if (s->bbio != s->wbio)
110 		s->wbio = BIO_push(s->bbio, s->wbio);
111 
112 	/* Stash any unprocessed data from the last record. */
113 	tls13_record_layer_rbuf(ctx->rl, &cbs);
114 	if (CBS_len(&cbs) > 0) {
115 		if (!CBS_write_bytes(&cbs,
116 		    S3I(s)->rbuf.buf + SSL3_RT_HEADER_LENGTH,
117 		    S3I(s)->rbuf.len - SSL3_RT_HEADER_LENGTH, NULL))
118 			goto err;
119 
120 		S3I(s)->rbuf.offset = SSL3_RT_HEADER_LENGTH;
121 		S3I(s)->rbuf.left = CBS_len(&cbs);
122 		S3I(s)->rrec.type = SSL3_RT_HANDSHAKE;
123 		S3I(s)->rrec.length = CBS_len(&cbs);
124 		s->internal->rstate = SSL_ST_READ_BODY;
125 		s->internal->packet = S3I(s)->rbuf.buf;
126 		s->internal->packet_length = SSL3_RT_HEADER_LENGTH;
127 		s->internal->mac_packet = 1;
128 	}
129 
130 	/* Stash the current handshake message. */
131 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
132 	if (!CBS_write_bytes(&cbs, s->internal->init_buf->data,
133 	    s->internal->init_buf->length, NULL))
134 		goto err;
135 
136 	S3I(s)->tmp.reuse_message = 1;
137 	S3I(s)->tmp.message_type = tls13_handshake_msg_type(ctx->hs_msg);
138 	S3I(s)->tmp.message_size = CBS_len(&cbs);
139 
140 	S3I(s)->hs.state = SSL3_ST_SR_CLNT_HELLO_A;
141 
142 	return 1;
143 
144  err:
145 	return 0;
146 }
147 
148 static int
149 tls13_client_hello_is_legacy(CBS *cbs)
150 {
151 	CBS extensions_block, extensions, extension_data, versions;
152 	uint16_t version, max_version = 0;
153 	uint16_t type;
154 
155 	CBS_dup(cbs, &extensions_block);
156 
157 	if (!CBS_get_u16_length_prefixed(&extensions_block, &extensions))
158 		return 1;
159 
160 	while (CBS_len(&extensions) > 0) {
161 		if (!CBS_get_u16(&extensions, &type))
162 			return 1;
163 		if (!CBS_get_u16_length_prefixed(&extensions, &extension_data))
164 			return 1;
165 
166 		if (type != TLSEXT_TYPE_supported_versions)
167 			continue;
168 		if (!CBS_get_u8_length_prefixed(&extension_data, &versions))
169 			return 1;
170 		while (CBS_len(&versions) > 0) {
171 			if (!CBS_get_u16(&versions, &version))
172 				return 1;
173 			if (version >= max_version)
174 				max_version = version;
175 		}
176 		if (CBS_len(&extension_data) != 0)
177 			return 1;
178 	}
179 
180 	return (max_version < TLS1_3_VERSION);
181 }
182 
183 static int
184 tls13_client_hello_process(struct tls13_ctx *ctx, CBS *cbs)
185 {
186 	CBS cipher_suites, client_random, compression_methods, session_id;
187 	STACK_OF(SSL_CIPHER) *ciphers = NULL;
188 	const SSL_CIPHER *cipher;
189 	uint16_t legacy_version;
190 	uint8_t compression_method;
191 	int alert_desc, comp_null;
192 	SSL *s = ctx->ssl;
193 	int ret = 0;
194 
195 	if (!CBS_get_u16(cbs, &legacy_version))
196 		goto err;
197 	if (!CBS_get_bytes(cbs, &client_random, SSL3_RANDOM_SIZE))
198 		goto err;
199 	if (!CBS_get_u8_length_prefixed(cbs, &session_id))
200 		goto err;
201 	if (!CBS_get_u16_length_prefixed(cbs, &cipher_suites))
202 		goto err;
203 	if (!CBS_get_u8_length_prefixed(cbs, &compression_methods))
204 		goto err;
205 
206 	if (tls13_client_hello_is_legacy(cbs)) {
207 		if (!CBS_skip(cbs, CBS_len(cbs)))
208 			goto err;
209 		return tls13_use_legacy_server(ctx);
210 	}
211 
212 	if (!tlsext_server_parse(s, cbs, &alert_desc, SSL_TLSEXT_MSG_CH)) {
213 		ctx->alert = alert_desc;
214 		goto err;
215 	}
216 
217 	/*
218 	 * If we got this far we have a supported versions extension that offers
219 	 * TLS 1.3 or later. This requires the legacy version be set to 0x0303.
220 	 */
221 	if (legacy_version != TLS1_2_VERSION) {
222 		ctx->alert = SSL_AD_PROTOCOL_VERSION;
223 		goto err;
224 	}
225 
226 	/* Parse cipher suites list and select preferred cipher. */
227 	if ((ciphers = ssl_bytes_to_cipher_list(s, &cipher_suites)) == NULL) {
228 		ctx->alert = SSL_AD_ILLEGAL_PARAMETER;
229 		goto err;
230 	}
231 	cipher = ssl3_choose_cipher(s, ciphers, SSL_get_ciphers(s));
232 	if (cipher == NULL) {
233 		tls13_set_errorx(ctx, TLS13_ERR_NO_SHARED_CIPHER, 0,
234 		    "no shared cipher found", NULL);
235 		ctx->alert = SSL_AD_HANDSHAKE_FAILURE;
236 		goto err;
237 	}
238 	S3I(s)->hs.new_cipher = cipher;
239 
240 	/* Ensure they advertise the NULL compression method. */
241 	comp_null = 0;
242 	while (CBS_len(&compression_methods) > 0) {
243 		if (!CBS_get_u8(&compression_methods, &compression_method))
244 			goto err;
245 		if (compression_method == 0)
246 			comp_null = 1;
247 	}
248 	if (!comp_null) {
249 		ctx->alert = SSL_AD_ILLEGAL_PARAMETER;
250 		goto err;
251 	}
252 
253 	ret = 1;
254 
255  err:
256 	sk_SSL_CIPHER_free(ciphers);
257 
258 	return ret;
259 }
260 
261 int
262 tls13_client_hello_recv(struct tls13_ctx *ctx, CBS *cbs)
263 {
264 	SSL *s = ctx->ssl;
265 
266 	if (!tls13_client_hello_process(ctx, cbs))
267 		goto err;
268 
269 	/* See if we switched back to the legacy client method. */
270 	if (s->method->internal->version < TLS1_3_VERSION)
271 		return 1;
272 
273 	tls13_record_layer_allow_ccs(ctx->rl, 1);
274 
275 	return 1;
276 
277  err:
278 	return 0;
279 }
280 
281 int
282 tls13_client_hello_retry_send(struct tls13_ctx *ctx, CBB *cbb)
283 {
284 	return 0;
285 }
286 
287 int
288 tls13_server_hello_retry_recv(struct tls13_ctx *ctx, CBS *cbs)
289 {
290 	return 0;
291 }
292 
293 int
294 tls13_client_end_of_early_data_send(struct tls13_ctx *ctx, CBB *cbb)
295 {
296 	return 0;
297 }
298 
299 int
300 tls13_client_end_of_early_data_recv(struct tls13_ctx *ctx, CBS *cbs)
301 {
302 	return 0;
303 }
304 
305 int
306 tls13_client_certificate_send(struct tls13_ctx *ctx, CBB *cbb)
307 {
308 	return 0;
309 }
310 
311 int
312 tls13_client_certificate_recv(struct tls13_ctx *ctx, CBS *cbs)
313 {
314 	return 0;
315 }
316 
317 int
318 tls13_client_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
319 {
320 	return 0;
321 }
322 
323 int
324 tls13_client_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
325 {
326 	return 0;
327 }
328 
329 int
330 tls13_client_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
331 {
332 	tls13_record_layer_allow_ccs(ctx->rl, 0);
333 
334 	return 0;
335 }
336 
337 int
338 tls13_client_key_update_send(struct tls13_ctx *ctx, CBB *cbb)
339 {
340 	return 0;
341 }
342 
343 int
344 tls13_client_key_update_recv(struct tls13_ctx *ctx, CBS *cbs)
345 {
346 	return 0;
347 }
348 
349 static int
350 tls13_server_hello_build(struct tls13_ctx *ctx, CBB *cbb)
351 {
352 	CBB session_id;
353 	SSL *s = ctx->ssl;
354 	uint16_t cipher;
355 
356 	cipher = SSL_CIPHER_get_value(S3I(s)->hs.new_cipher);
357 
358 	if (!CBB_add_u16(cbb, TLS1_2_VERSION))
359 		goto err;
360 	if (!CBB_add_bytes(cbb, s->s3->server_random, SSL3_RANDOM_SIZE))
361 		goto err;
362 	if (!CBB_add_u8_length_prefixed(cbb, &session_id))
363 		goto err;
364 	if (!CBB_add_bytes(&session_id, ctx->hs->legacy_session_id,
365 	    ctx->hs->legacy_session_id_len))
366 		goto err;
367 	if (!CBB_add_u16(cbb, cipher))
368 		goto err;
369 	if (!CBB_add_u8(cbb, 0))
370 		goto err;
371 	if (!tlsext_server_build(s, cbb, SSL_TLSEXT_MSG_SH))
372 		goto err;
373 
374 	if (!CBB_flush(cbb))
375 		goto err;
376 
377 	return 1;
378 err:
379 	return 0;
380 }
381 
382 int
383 tls13_server_hello_send(struct tls13_ctx *ctx, CBB *cbb)
384 {
385 	if (!tls13_server_hello_build(ctx, cbb))
386 		return 0;
387 
388 	return 1;
389 }
390 
391 int
392 tls13_server_hello_sent(struct tls13_ctx *ctx)
393 {
394 	struct tls13_secrets *secrets;
395 	struct tls13_secret context;
396 	unsigned char buf[EVP_MAX_MD_SIZE];
397 	uint8_t *shared_key = NULL;
398 	size_t hash_len;
399 	SSL *s = ctx->ssl;
400 	int ret = 0;
401 
402 	/* XXX - handle other key share types. */
403 	if (ctx->hs->x25519_peer_public == NULL) {
404 		/* XXX - alert. */
405 		goto err;
406 	}
407 	if ((shared_key = malloc(X25519_KEY_LENGTH)) == NULL)
408 		goto err;
409 	if (!X25519(shared_key, ctx->hs->x25519_private,
410 	    ctx->hs->x25519_peer_public))
411 		goto err;
412 
413 	s->session->cipher = S3I(s)->hs.new_cipher;
414 	s->session->ssl_version = ctx->hs->server_version;
415 
416 	if ((ctx->aead = tls13_cipher_aead(S3I(s)->hs.new_cipher)) == NULL)
417 		goto err;
418 	if ((ctx->hash = tls13_cipher_hash(S3I(s)->hs.new_cipher)) == NULL)
419 		goto err;
420 
421 	if ((secrets = tls13_secrets_create(ctx->hash, 0)) == NULL)
422 		goto err;
423 	S3I(ctx->ssl)->hs_tls13.secrets = secrets;
424 
425 	/* XXX - pass in hash. */
426 	if (!tls1_transcript_hash_init(s))
427 		goto err;
428 	if (!tls1_transcript_hash_value(s, buf, sizeof(buf), &hash_len))
429 		goto err;
430 	context.data = buf;
431 	context.len = hash_len;
432 
433 	/* Early secrets. */
434 	if (!tls13_derive_early_secrets(secrets, secrets->zeros.data,
435 	    secrets->zeros.len, &context))
436 		goto err;
437 
438 	/* Handshake secrets. */
439 	if (!tls13_derive_handshake_secrets(ctx->hs->secrets, shared_key,
440 	    X25519_KEY_LENGTH, &context))
441 		goto err;
442 
443 	tls13_record_layer_set_aead(ctx->rl, ctx->aead);
444 	tls13_record_layer_set_hash(ctx->rl, ctx->hash);
445 
446 	if (!tls13_record_layer_set_read_traffic_key(ctx->rl,
447 	    &secrets->client_handshake_traffic))
448 		goto err;
449 	if (!tls13_record_layer_set_write_traffic_key(ctx->rl,
450 	    &secrets->server_handshake_traffic))
451 		goto err;
452 
453  	ctx->handshake_stage.hs_type |= NEGOTIATED | WITHOUT_CR;
454 	ret = 1;
455 
456  err:
457 	freezero(shared_key, X25519_KEY_LENGTH);
458 	return ret;
459 }
460 
461 int
462 tls13_server_hello_retry_send(struct tls13_ctx *ctx, CBB *cbb)
463 {
464 	return 0;
465 }
466 
467 int
468 tls13_server_encrypted_extensions_send(struct tls13_ctx *ctx, CBB *cbb)
469 {
470 	if (!tlsext_server_build(ctx->ssl, cbb, SSL_TLSEXT_MSG_EE))
471 		goto err;
472 
473 	return 1;
474  err:
475 	return 0;
476 }
477 
478 int
479 tls13_server_certificate_send(struct tls13_ctx *ctx, CBB *cbb)
480 {
481 	return 0;
482 }
483 
484 int
485 tls13_server_certificate_request_send(struct tls13_ctx *ctx, CBB *cbb)
486 {
487 	CBB certificate_request_context;
488 
489 	if (!CBB_add_u8_length_prefixed(cbb, &certificate_request_context))
490 		goto err;
491 	if (!tlsext_server_build(ctx->ssl, cbb, SSL_TLSEXT_MSG_CR))
492 		goto err;
493 
494 	if (!CBB_flush(cbb))
495 		goto err;
496 
497 	return 1;
498  err:
499 	return 0;
500 }
501 
502 int
503 tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
504 {
505 	return 0;
506 }
507 
508 int
509 tls13_server_finished_send(struct tls13_ctx *ctx, CBB *cbb)
510 {
511 	return 0;
512 }
513