1 /* 2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* ==================================================================== 11 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 12 * 13 * Portions of the attached software ("Contribution") are developed by 14 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. 15 * 16 * The Contribution is licensed pursuant to the OpenSSL open source 17 * license provided above. 18 * 19 * ECC cipher suite support in OpenSSL originally written by 20 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories. 21 * 22 */ 23 /* ==================================================================== 24 * Copyright 2005 Nokia. All rights reserved. 25 * 26 * The portions of the attached software ("Contribution") is developed by 27 * Nokia Corporation and is licensed pursuant to the OpenSSL open source 28 * license. 29 * 30 * The Contribution, originally written by Mika Kousa and Pasi Eronen of 31 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites 32 * support (see RFC 4279) to OpenSSL. 33 * 34 * No patent licenses or other rights except those expressly stated in 35 * the OpenSSL open source license shall be deemed granted or received 36 * expressly, by implication, estoppel, or otherwise. 37 * 38 * No assurances are provided by Nokia that the Contribution does not 39 * infringe the patent or other intellectual property rights of any third 40 * party or that the license provides you with all the necessary rights 41 * to make use of the Contribution. 42 * 43 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN 44 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA 45 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY 46 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR 47 * OTHERWISE. 48 */ 49 50 #include <stdio.h> 51 #include "../ssl_locl.h" 52 #include "statem_locl.h" 53 #include "internal/constant_time_locl.h" 54 #include <openssl/buffer.h> 55 #include <openssl/rand.h> 56 #include <openssl/objects.h> 57 #include <openssl/evp.h> 58 #include <openssl/hmac.h> 59 #include <openssl/x509.h> 60 #include <openssl/dh.h> 61 #include <openssl/bn.h> 62 #include <openssl/md5.h> 63 64 static STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s, 65 PACKET *cipher_suites, 66 STACK_OF(SSL_CIPHER) 67 **skp, int sslv2format, 68 int *al); 69 70 /* 71 * server_read_transition() encapsulates the logic for the allowed handshake 72 * state transitions when the server is reading messages from the client. The 73 * message type that the client has sent is provided in |mt|. The current state 74 * is in |s->statem.hand_state|. 75 * 76 * Valid return values are: 77 * 1: Success (transition allowed) 78 * 0: Error (transition not allowed) 79 */ 80 int ossl_statem_server_read_transition(SSL *s, int mt) 81 { 82 OSSL_STATEM *st = &s->statem; 83 84 switch (st->hand_state) { 85 case TLS_ST_BEFORE: 86 case DTLS_ST_SW_HELLO_VERIFY_REQUEST: 87 if (mt == SSL3_MT_CLIENT_HELLO) { 88 st->hand_state = TLS_ST_SR_CLNT_HELLO; 89 return 1; 90 } 91 break; 92 93 case TLS_ST_SW_SRVR_DONE: 94 /* 95 * If we get a CKE message after a ServerDone then either 96 * 1) We didn't request a Certificate 97 * OR 98 * 2) If we did request one then 99 * a) We allow no Certificate to be returned 100 * AND 101 * b) We are running SSL3 (in TLS1.0+ the client must return a 0 102 * list if we requested a certificate) 103 */ 104 if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) { 105 if (s->s3->tmp.cert_request) { 106 if (s->version == SSL3_VERSION) { 107 if ((s->verify_mode & SSL_VERIFY_PEER) 108 && (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) { 109 /* 110 * This isn't an unexpected message as such - we're just 111 * not going to accept it because we require a client 112 * cert. 113 */ 114 ssl3_send_alert(s, SSL3_AL_FATAL, 115 SSL3_AD_HANDSHAKE_FAILURE); 116 SSLerr(SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION, 117 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); 118 return 0; 119 } 120 st->hand_state = TLS_ST_SR_KEY_EXCH; 121 return 1; 122 } 123 } else { 124 st->hand_state = TLS_ST_SR_KEY_EXCH; 125 return 1; 126 } 127 } else if (s->s3->tmp.cert_request) { 128 if (mt == SSL3_MT_CERTIFICATE) { 129 st->hand_state = TLS_ST_SR_CERT; 130 return 1; 131 } 132 } 133 break; 134 135 case TLS_ST_SR_CERT: 136 if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) { 137 st->hand_state = TLS_ST_SR_KEY_EXCH; 138 return 1; 139 } 140 break; 141 142 case TLS_ST_SR_KEY_EXCH: 143 /* 144 * We should only process a CertificateVerify message if we have 145 * received a Certificate from the client. If so then |s->session->peer| 146 * will be non NULL. In some instances a CertificateVerify message is 147 * not required even if the peer has sent a Certificate (e.g. such as in 148 * the case of static DH). In that case |st->no_cert_verify| should be 149 * set. 150 */ 151 if (s->session->peer == NULL || st->no_cert_verify) { 152 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 153 /* 154 * For the ECDH ciphersuites when the client sends its ECDH 155 * pub key in a certificate, the CertificateVerify message is 156 * not sent. Also for GOST ciphersuites when the client uses 157 * its key from the certificate for key exchange. 158 */ 159 st->hand_state = TLS_ST_SR_CHANGE; 160 return 1; 161 } 162 } else { 163 if (mt == SSL3_MT_CERTIFICATE_VERIFY) { 164 st->hand_state = TLS_ST_SR_CERT_VRFY; 165 return 1; 166 } 167 } 168 break; 169 170 case TLS_ST_SR_CERT_VRFY: 171 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 172 st->hand_state = TLS_ST_SR_CHANGE; 173 return 1; 174 } 175 break; 176 177 case TLS_ST_SR_CHANGE: 178 #ifndef OPENSSL_NO_NEXTPROTONEG 179 if (s->s3->next_proto_neg_seen) { 180 if (mt == SSL3_MT_NEXT_PROTO) { 181 st->hand_state = TLS_ST_SR_NEXT_PROTO; 182 return 1; 183 } 184 } else { 185 #endif 186 if (mt == SSL3_MT_FINISHED) { 187 st->hand_state = TLS_ST_SR_FINISHED; 188 return 1; 189 } 190 #ifndef OPENSSL_NO_NEXTPROTONEG 191 } 192 #endif 193 break; 194 195 #ifndef OPENSSL_NO_NEXTPROTONEG 196 case TLS_ST_SR_NEXT_PROTO: 197 if (mt == SSL3_MT_FINISHED) { 198 st->hand_state = TLS_ST_SR_FINISHED; 199 return 1; 200 } 201 break; 202 #endif 203 204 case TLS_ST_SW_FINISHED: 205 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 206 st->hand_state = TLS_ST_SR_CHANGE; 207 return 1; 208 } 209 break; 210 211 default: 212 break; 213 } 214 215 /* No valid transition found */ 216 ssl3_send_alert(s, SSL3_AL_FATAL, SSL3_AD_UNEXPECTED_MESSAGE); 217 SSLerr(SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION, SSL_R_UNEXPECTED_MESSAGE); 218 return 0; 219 } 220 221 /* 222 * Should we send a ServerKeyExchange message? 223 * 224 * Valid return values are: 225 * 1: Yes 226 * 0: No 227 */ 228 static int send_server_key_exchange(SSL *s) 229 { 230 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 231 232 /* 233 * only send a ServerKeyExchange if DH or fortezza but we have a 234 * sign only certificate PSK: may send PSK identity hints For 235 * ECC ciphersuites, we send a serverKeyExchange message only if 236 * the cipher suite is either ECDH-anon or ECDHE. In other cases, 237 * the server certificate contains the server's public key for 238 * key exchange. 239 */ 240 if (alg_k & (SSL_kDHE | SSL_kECDHE) 241 /* 242 * PSK: send ServerKeyExchange if PSK identity hint if 243 * provided 244 */ 245 #ifndef OPENSSL_NO_PSK 246 /* Only send SKE if we have identity hint for plain PSK */ 247 || ((alg_k & (SSL_kPSK | SSL_kRSAPSK)) 248 && s->cert->psk_identity_hint) 249 /* For other PSK always send SKE */ 250 || (alg_k & (SSL_PSK & (SSL_kDHEPSK | SSL_kECDHEPSK))) 251 #endif 252 #ifndef OPENSSL_NO_SRP 253 /* SRP: send ServerKeyExchange */ 254 || (alg_k & SSL_kSRP) 255 #endif 256 ) { 257 return 1; 258 } 259 260 return 0; 261 } 262 263 /* 264 * Should we send a CertificateRequest message? 265 * 266 * Valid return values are: 267 * 1: Yes 268 * 0: No 269 */ 270 static int send_certificate_request(SSL *s) 271 { 272 if ( 273 /* don't request cert unless asked for it: */ 274 s->verify_mode & SSL_VERIFY_PEER 275 /* 276 * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert 277 * during re-negotiation: 278 */ 279 && (s->s3->tmp.finish_md_len == 0 || 280 !(s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) 281 /* 282 * never request cert in anonymous ciphersuites (see 283 * section "Certificate request" in SSL 3 drafts and in 284 * RFC 2246): 285 */ 286 && (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) 287 /* 288 * ... except when the application insists on 289 * verification (against the specs, but statem_clnt.c accepts 290 * this for SSL 3) 291 */ 292 || (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) 293 /* don't request certificate for SRP auth */ 294 && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP) 295 /* 296 * With normal PSK Certificates and Certificate Requests 297 * are omitted 298 */ 299 && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aPSK)) { 300 return 1; 301 } 302 303 return 0; 304 } 305 306 /* 307 * server_write_transition() works out what handshake state to move to next 308 * when the server is writing messages to be sent to the client. 309 */ 310 WRITE_TRAN ossl_statem_server_write_transition(SSL *s) 311 { 312 OSSL_STATEM *st = &s->statem; 313 314 switch (st->hand_state) { 315 case TLS_ST_BEFORE: 316 /* Just go straight to trying to read from the client */ 317 return WRITE_TRAN_FINISHED; 318 319 case TLS_ST_OK: 320 /* We must be trying to renegotiate */ 321 st->hand_state = TLS_ST_SW_HELLO_REQ; 322 return WRITE_TRAN_CONTINUE; 323 324 case TLS_ST_SW_HELLO_REQ: 325 st->hand_state = TLS_ST_OK; 326 ossl_statem_set_in_init(s, 0); 327 return WRITE_TRAN_CONTINUE; 328 329 case TLS_ST_SR_CLNT_HELLO: 330 if (SSL_IS_DTLS(s) && !s->d1->cookie_verified 331 && (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE)) 332 st->hand_state = DTLS_ST_SW_HELLO_VERIFY_REQUEST; 333 else 334 st->hand_state = TLS_ST_SW_SRVR_HELLO; 335 return WRITE_TRAN_CONTINUE; 336 337 case DTLS_ST_SW_HELLO_VERIFY_REQUEST: 338 return WRITE_TRAN_FINISHED; 339 340 case TLS_ST_SW_SRVR_HELLO: 341 if (s->hit) { 342 if (s->tlsext_ticket_expected) 343 st->hand_state = TLS_ST_SW_SESSION_TICKET; 344 else 345 st->hand_state = TLS_ST_SW_CHANGE; 346 } else { 347 /* Check if it is anon DH or anon ECDH, */ 348 /* normal PSK or SRP */ 349 if (!(s->s3->tmp.new_cipher->algorithm_auth & 350 (SSL_aNULL | SSL_aSRP | SSL_aPSK))) { 351 st->hand_state = TLS_ST_SW_CERT; 352 } else if (send_server_key_exchange(s)) { 353 st->hand_state = TLS_ST_SW_KEY_EXCH; 354 } else if (send_certificate_request(s)) { 355 st->hand_state = TLS_ST_SW_CERT_REQ; 356 } else { 357 st->hand_state = TLS_ST_SW_SRVR_DONE; 358 } 359 } 360 return WRITE_TRAN_CONTINUE; 361 362 case TLS_ST_SW_CERT: 363 if (s->tlsext_status_expected) { 364 st->hand_state = TLS_ST_SW_CERT_STATUS; 365 return WRITE_TRAN_CONTINUE; 366 } 367 /* Fall through */ 368 369 case TLS_ST_SW_CERT_STATUS: 370 if (send_server_key_exchange(s)) { 371 st->hand_state = TLS_ST_SW_KEY_EXCH; 372 return WRITE_TRAN_CONTINUE; 373 } 374 /* Fall through */ 375 376 case TLS_ST_SW_KEY_EXCH: 377 if (send_certificate_request(s)) { 378 st->hand_state = TLS_ST_SW_CERT_REQ; 379 return WRITE_TRAN_CONTINUE; 380 } 381 /* Fall through */ 382 383 case TLS_ST_SW_CERT_REQ: 384 st->hand_state = TLS_ST_SW_SRVR_DONE; 385 return WRITE_TRAN_CONTINUE; 386 387 case TLS_ST_SW_SRVR_DONE: 388 return WRITE_TRAN_FINISHED; 389 390 case TLS_ST_SR_FINISHED: 391 if (s->hit) { 392 st->hand_state = TLS_ST_OK; 393 ossl_statem_set_in_init(s, 0); 394 return WRITE_TRAN_CONTINUE; 395 } else if (s->tlsext_ticket_expected) { 396 st->hand_state = TLS_ST_SW_SESSION_TICKET; 397 } else { 398 st->hand_state = TLS_ST_SW_CHANGE; 399 } 400 return WRITE_TRAN_CONTINUE; 401 402 case TLS_ST_SW_SESSION_TICKET: 403 st->hand_state = TLS_ST_SW_CHANGE; 404 return WRITE_TRAN_CONTINUE; 405 406 case TLS_ST_SW_CHANGE: 407 st->hand_state = TLS_ST_SW_FINISHED; 408 return WRITE_TRAN_CONTINUE; 409 410 case TLS_ST_SW_FINISHED: 411 if (s->hit) { 412 return WRITE_TRAN_FINISHED; 413 } 414 st->hand_state = TLS_ST_OK; 415 ossl_statem_set_in_init(s, 0); 416 return WRITE_TRAN_CONTINUE; 417 418 default: 419 /* Shouldn't happen */ 420 return WRITE_TRAN_ERROR; 421 } 422 } 423 424 /* 425 * Perform any pre work that needs to be done prior to sending a message from 426 * the server to the client. 427 */ 428 WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst) 429 { 430 OSSL_STATEM *st = &s->statem; 431 432 switch (st->hand_state) { 433 case TLS_ST_SW_HELLO_REQ: 434 s->shutdown = 0; 435 if (SSL_IS_DTLS(s)) 436 dtls1_clear_sent_buffer(s); 437 break; 438 439 case DTLS_ST_SW_HELLO_VERIFY_REQUEST: 440 s->shutdown = 0; 441 if (SSL_IS_DTLS(s)) { 442 dtls1_clear_sent_buffer(s); 443 /* We don't buffer this message so don't use the timer */ 444 st->use_timer = 0; 445 } 446 break; 447 448 case TLS_ST_SW_SRVR_HELLO: 449 if (SSL_IS_DTLS(s)) { 450 /* 451 * Messages we write from now on should be buffered and 452 * retransmitted if necessary, so we need to use the timer now 453 */ 454 st->use_timer = 1; 455 } 456 break; 457 458 case TLS_ST_SW_SRVR_DONE: 459 #ifndef OPENSSL_NO_SCTP 460 if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) 461 return dtls_wait_for_dry(s); 462 #endif 463 return WORK_FINISHED_CONTINUE; 464 465 case TLS_ST_SW_SESSION_TICKET: 466 if (SSL_IS_DTLS(s)) { 467 /* 468 * We're into the last flight. We don't retransmit the last flight 469 * unless we need to, so we don't use the timer 470 */ 471 st->use_timer = 0; 472 } 473 break; 474 475 case TLS_ST_SW_CHANGE: 476 s->session->cipher = s->s3->tmp.new_cipher; 477 if (!s->method->ssl3_enc->setup_key_block(s)) { 478 ossl_statem_set_error(s); 479 return WORK_ERROR; 480 } 481 if (SSL_IS_DTLS(s)) { 482 /* 483 * We're into the last flight. We don't retransmit the last flight 484 * unless we need to, so we don't use the timer. This might have 485 * already been set to 0 if we sent a NewSessionTicket message, 486 * but we'll set it again here in case we didn't. 487 */ 488 st->use_timer = 0; 489 } 490 return WORK_FINISHED_CONTINUE; 491 492 case TLS_ST_OK: 493 return tls_finish_handshake(s, wst); 494 495 default: 496 /* No pre work to be done */ 497 break; 498 } 499 500 return WORK_FINISHED_CONTINUE; 501 } 502 503 /* 504 * Perform any work that needs to be done after sending a message from the 505 * server to the client. 506 */ 507 WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst) 508 { 509 OSSL_STATEM *st = &s->statem; 510 511 s->init_num = 0; 512 513 switch (st->hand_state) { 514 case TLS_ST_SW_HELLO_REQ: 515 if (statem_flush(s) != 1) 516 return WORK_MORE_A; 517 if (!ssl3_init_finished_mac(s)) { 518 ossl_statem_set_error(s); 519 return WORK_ERROR; 520 } 521 break; 522 523 case DTLS_ST_SW_HELLO_VERIFY_REQUEST: 524 if (statem_flush(s) != 1) 525 return WORK_MORE_A; 526 /* HelloVerifyRequest resets Finished MAC */ 527 if (s->version != DTLS1_BAD_VER && !ssl3_init_finished_mac(s)) { 528 ossl_statem_set_error(s); 529 return WORK_ERROR; 530 } 531 /* 532 * The next message should be another ClientHello which we need to 533 * treat like it was the first packet 534 */ 535 s->first_packet = 1; 536 break; 537 538 case TLS_ST_SW_SRVR_HELLO: 539 #ifndef OPENSSL_NO_SCTP 540 if (SSL_IS_DTLS(s) && s->hit) { 541 unsigned char sctpauthkey[64]; 542 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; 543 544 /* 545 * Add new shared key for SCTP-Auth, will be ignored if no 546 * SCTP used. 547 */ 548 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, 549 sizeof(DTLS1_SCTP_AUTH_LABEL)); 550 551 if (SSL_export_keying_material(s, sctpauthkey, 552 sizeof(sctpauthkey), labelbuffer, 553 sizeof(labelbuffer), NULL, 0, 554 0) <= 0) { 555 ossl_statem_set_error(s); 556 return WORK_ERROR; 557 } 558 559 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, 560 sizeof(sctpauthkey), sctpauthkey); 561 } 562 #endif 563 break; 564 565 case TLS_ST_SW_CHANGE: 566 #ifndef OPENSSL_NO_SCTP 567 if (SSL_IS_DTLS(s) && !s->hit) { 568 /* 569 * Change to new shared key of SCTP-Auth, will be ignored if 570 * no SCTP used. 571 */ 572 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 573 0, NULL); 574 } 575 #endif 576 if (!s->method->ssl3_enc->change_cipher_state(s, 577 SSL3_CHANGE_CIPHER_SERVER_WRITE)) 578 { 579 ossl_statem_set_error(s); 580 return WORK_ERROR; 581 } 582 583 if (SSL_IS_DTLS(s)) 584 dtls1_reset_seq_numbers(s, SSL3_CC_WRITE); 585 break; 586 587 case TLS_ST_SW_SRVR_DONE: 588 if (statem_flush(s) != 1) 589 return WORK_MORE_A; 590 break; 591 592 case TLS_ST_SW_FINISHED: 593 if (statem_flush(s) != 1) 594 return WORK_MORE_A; 595 #ifndef OPENSSL_NO_SCTP 596 if (SSL_IS_DTLS(s) && s->hit) { 597 /* 598 * Change to new shared key of SCTP-Auth, will be ignored if 599 * no SCTP used. 600 */ 601 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 602 0, NULL); 603 } 604 #endif 605 break; 606 607 default: 608 /* No post work to be done */ 609 break; 610 } 611 612 return WORK_FINISHED_CONTINUE; 613 } 614 615 /* 616 * Construct a message to be sent from the server to the client. 617 * 618 * Valid return values are: 619 * 1: Success 620 * 0: Error 621 */ 622 int ossl_statem_server_construct_message(SSL *s) 623 { 624 OSSL_STATEM *st = &s->statem; 625 626 switch (st->hand_state) { 627 case DTLS_ST_SW_HELLO_VERIFY_REQUEST: 628 return dtls_construct_hello_verify_request(s); 629 630 case TLS_ST_SW_HELLO_REQ: 631 return tls_construct_hello_request(s); 632 633 case TLS_ST_SW_SRVR_HELLO: 634 return tls_construct_server_hello(s); 635 636 case TLS_ST_SW_CERT: 637 return tls_construct_server_certificate(s); 638 639 case TLS_ST_SW_KEY_EXCH: 640 return tls_construct_server_key_exchange(s); 641 642 case TLS_ST_SW_CERT_REQ: 643 return tls_construct_certificate_request(s); 644 645 case TLS_ST_SW_SRVR_DONE: 646 return tls_construct_server_done(s); 647 648 case TLS_ST_SW_SESSION_TICKET: 649 return tls_construct_new_session_ticket(s); 650 651 case TLS_ST_SW_CERT_STATUS: 652 return tls_construct_cert_status(s); 653 654 case TLS_ST_SW_CHANGE: 655 if (SSL_IS_DTLS(s)) 656 return dtls_construct_change_cipher_spec(s); 657 else 658 return tls_construct_change_cipher_spec(s); 659 660 case TLS_ST_SW_FINISHED: 661 return tls_construct_finished(s, 662 s->method-> 663 ssl3_enc->server_finished_label, 664 s->method-> 665 ssl3_enc->server_finished_label_len); 666 667 default: 668 /* Shouldn't happen */ 669 break; 670 } 671 672 return 0; 673 } 674 675 /* 676 * Maximum size (excluding the Handshake header) of a ClientHello message, 677 * calculated as follows: 678 * 679 * 2 + # client_version 680 * 32 + # only valid length for random 681 * 1 + # length of session_id 682 * 32 + # maximum size for session_id 683 * 2 + # length of cipher suites 684 * 2^16-2 + # maximum length of cipher suites array 685 * 1 + # length of compression_methods 686 * 2^8-1 + # maximum length of compression methods 687 * 2 + # length of extensions 688 * 2^16-1 # maximum length of extensions 689 */ 690 #define CLIENT_HELLO_MAX_LENGTH 131396 691 692 #define CLIENT_KEY_EXCH_MAX_LENGTH 2048 693 #define NEXT_PROTO_MAX_LENGTH 514 694 695 /* 696 * Returns the maximum allowed length for the current message that we are 697 * reading. Excludes the message header. 698 */ 699 unsigned long ossl_statem_server_max_message_size(SSL *s) 700 { 701 OSSL_STATEM *st = &s->statem; 702 703 switch (st->hand_state) { 704 case TLS_ST_SR_CLNT_HELLO: 705 return CLIENT_HELLO_MAX_LENGTH; 706 707 case TLS_ST_SR_CERT: 708 return s->max_cert_list; 709 710 case TLS_ST_SR_KEY_EXCH: 711 return CLIENT_KEY_EXCH_MAX_LENGTH; 712 713 case TLS_ST_SR_CERT_VRFY: 714 return SSL3_RT_MAX_PLAIN_LENGTH; 715 716 #ifndef OPENSSL_NO_NEXTPROTONEG 717 case TLS_ST_SR_NEXT_PROTO: 718 return NEXT_PROTO_MAX_LENGTH; 719 #endif 720 721 case TLS_ST_SR_CHANGE: 722 return CCS_MAX_LENGTH; 723 724 case TLS_ST_SR_FINISHED: 725 return FINISHED_MAX_LENGTH; 726 727 default: 728 /* Shouldn't happen */ 729 break; 730 } 731 732 return 0; 733 } 734 735 /* 736 * Process a message that the server has received from the client. 737 */ 738 MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt) 739 { 740 OSSL_STATEM *st = &s->statem; 741 742 switch (st->hand_state) { 743 case TLS_ST_SR_CLNT_HELLO: 744 return tls_process_client_hello(s, pkt); 745 746 case TLS_ST_SR_CERT: 747 return tls_process_client_certificate(s, pkt); 748 749 case TLS_ST_SR_KEY_EXCH: 750 return tls_process_client_key_exchange(s, pkt); 751 752 case TLS_ST_SR_CERT_VRFY: 753 return tls_process_cert_verify(s, pkt); 754 755 #ifndef OPENSSL_NO_NEXTPROTONEG 756 case TLS_ST_SR_NEXT_PROTO: 757 return tls_process_next_proto(s, pkt); 758 #endif 759 760 case TLS_ST_SR_CHANGE: 761 return tls_process_change_cipher_spec(s, pkt); 762 763 case TLS_ST_SR_FINISHED: 764 return tls_process_finished(s, pkt); 765 766 default: 767 /* Shouldn't happen */ 768 break; 769 } 770 771 return MSG_PROCESS_ERROR; 772 } 773 774 /* 775 * Perform any further processing required following the receipt of a message 776 * from the client 777 */ 778 WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst) 779 { 780 OSSL_STATEM *st = &s->statem; 781 782 switch (st->hand_state) { 783 case TLS_ST_SR_CLNT_HELLO: 784 return tls_post_process_client_hello(s, wst); 785 786 case TLS_ST_SR_KEY_EXCH: 787 return tls_post_process_client_key_exchange(s, wst); 788 789 default: 790 break; 791 } 792 793 /* Shouldn't happen */ 794 return WORK_ERROR; 795 } 796 797 #ifndef OPENSSL_NO_SRP 798 static int ssl_check_srp_ext_ClientHello(SSL *s, int *al) 799 { 800 int ret = SSL_ERROR_NONE; 801 802 *al = SSL_AD_UNRECOGNIZED_NAME; 803 804 if ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) && 805 (s->srp_ctx.TLS_ext_srp_username_callback != NULL)) { 806 if (s->srp_ctx.login == NULL) { 807 /* 808 * RFC 5054 says SHOULD reject, we do so if There is no srp 809 * login name 810 */ 811 ret = SSL3_AL_FATAL; 812 *al = SSL_AD_UNKNOWN_PSK_IDENTITY; 813 } else { 814 ret = SSL_srp_server_param_with_username(s, al); 815 } 816 } 817 return ret; 818 } 819 #endif 820 821 int tls_construct_hello_request(SSL *s) 822 { 823 if (!ssl_set_handshake_header(s, SSL3_MT_HELLO_REQUEST, 0)) { 824 SSLerr(SSL_F_TLS_CONSTRUCT_HELLO_REQUEST, ERR_R_INTERNAL_ERROR); 825 ossl_statem_set_error(s); 826 return 0; 827 } 828 829 return 1; 830 } 831 832 unsigned int dtls_raw_hello_verify_request(unsigned char *buf, 833 unsigned char *cookie, 834 unsigned char cookie_len) 835 { 836 unsigned int msg_len; 837 unsigned char *p; 838 839 p = buf; 840 /* Always use DTLS 1.0 version: see RFC 6347 */ 841 *(p++) = DTLS1_VERSION >> 8; 842 *(p++) = DTLS1_VERSION & 0xFF; 843 844 *(p++) = (unsigned char)cookie_len; 845 memcpy(p, cookie, cookie_len); 846 p += cookie_len; 847 msg_len = p - buf; 848 849 return msg_len; 850 } 851 852 int dtls_construct_hello_verify_request(SSL *s) 853 { 854 unsigned int len; 855 unsigned char *buf; 856 857 buf = (unsigned char *)s->init_buf->data; 858 859 if (s->ctx->app_gen_cookie_cb == NULL || 860 s->ctx->app_gen_cookie_cb(s, s->d1->cookie, 861 &(s->d1->cookie_len)) == 0 || 862 s->d1->cookie_len > 255) { 863 SSLerr(SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST, 864 SSL_R_COOKIE_GEN_CALLBACK_FAILURE); 865 ossl_statem_set_error(s); 866 return 0; 867 } 868 869 len = dtls_raw_hello_verify_request(&buf[DTLS1_HM_HEADER_LENGTH], 870 s->d1->cookie, s->d1->cookie_len); 871 872 dtls1_set_message_header(s, DTLS1_MT_HELLO_VERIFY_REQUEST, len, 0, len); 873 len += DTLS1_HM_HEADER_LENGTH; 874 875 /* number of bytes to write */ 876 s->init_num = len; 877 s->init_off = 0; 878 879 return 1; 880 } 881 882 MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt) 883 { 884 int i, al = SSL_AD_INTERNAL_ERROR; 885 unsigned int j, complen = 0; 886 unsigned long id; 887 const SSL_CIPHER *c; 888 #ifndef OPENSSL_NO_COMP 889 SSL_COMP *comp = NULL; 890 #endif 891 STACK_OF(SSL_CIPHER) *ciphers = NULL; 892 int protverr; 893 /* |cookie| will only be initialized for DTLS. */ 894 PACKET session_id, cipher_suites, compression, extensions, cookie; 895 int is_v2_record; 896 static const unsigned char null_compression = 0; 897 898 is_v2_record = RECORD_LAYER_is_sslv2_record(&s->rlayer); 899 900 PACKET_null_init(&cookie); 901 /* First lets get s->client_version set correctly */ 902 if (is_v2_record) { 903 unsigned int version; 904 unsigned int mt; 905 /*- 906 * An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2 907 * header is sent directly on the wire, not wrapped as a TLS 908 * record. Our record layer just processes the message length and passes 909 * the rest right through. Its format is: 910 * Byte Content 911 * 0-1 msg_length - decoded by the record layer 912 * 2 msg_type - s->init_msg points here 913 * 3-4 version 914 * 5-6 cipher_spec_length 915 * 7-8 session_id_length 916 * 9-10 challenge_length 917 * ... ... 918 */ 919 920 if (!PACKET_get_1(pkt, &mt) 921 || mt != SSL2_MT_CLIENT_HELLO) { 922 /* 923 * Should never happen. We should have tested this in the record 924 * layer in order to have determined that this is a SSLv2 record 925 * in the first place 926 */ 927 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); 928 goto err; 929 } 930 931 if (!PACKET_get_net_2(pkt, &version)) { 932 /* No protocol version supplied! */ 933 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); 934 goto err; 935 } 936 if (version == 0x0002) { 937 /* This is real SSLv2. We don't support it. */ 938 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); 939 goto err; 940 } else if ((version & 0xff00) == (SSL3_VERSION_MAJOR << 8)) { 941 /* SSLv3/TLS */ 942 s->client_version = version; 943 } else { 944 /* No idea what protocol this is */ 945 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); 946 goto err; 947 } 948 } else { 949 /* 950 * use version from inside client hello, not from record header (may 951 * differ: see RFC 2246, Appendix E, second paragraph) 952 */ 953 if (!PACKET_get_net_2(pkt, (unsigned int *)&s->client_version)) { 954 al = SSL_AD_DECODE_ERROR; 955 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); 956 goto f_err; 957 } 958 } 959 960 /* 961 * Do SSL/TLS version negotiation if applicable. For DTLS we just check 962 * versions are potentially compatible. Version negotiation comes later. 963 */ 964 if (!SSL_IS_DTLS(s)) { 965 protverr = ssl_choose_server_version(s); 966 } else if (s->method->version != DTLS_ANY_VERSION && 967 DTLS_VERSION_LT(s->client_version, s->version)) { 968 protverr = SSL_R_VERSION_TOO_LOW; 969 } else { 970 protverr = 0; 971 } 972 973 if (protverr) { 974 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr); 975 if ((!s->enc_write_ctx && !s->write_hash)) { 976 /* 977 * similar to ssl3_get_record, send alert using remote version 978 * number 979 */ 980 s->version = s->client_version; 981 } 982 al = SSL_AD_PROTOCOL_VERSION; 983 goto f_err; 984 } 985 986 /* Parse the message and load client random. */ 987 if (is_v2_record) { 988 /* 989 * Handle an SSLv2 backwards compatible ClientHello 990 * Note, this is only for SSLv3+ using the backward compatible format. 991 * Real SSLv2 is not supported, and is rejected above. 992 */ 993 unsigned int cipher_len, session_id_len, challenge_len; 994 PACKET challenge; 995 996 if (!PACKET_get_net_2(pkt, &cipher_len) 997 || !PACKET_get_net_2(pkt, &session_id_len) 998 || !PACKET_get_net_2(pkt, &challenge_len)) { 999 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1000 SSL_R_RECORD_LENGTH_MISMATCH); 1001 al = SSL_AD_DECODE_ERROR; 1002 goto f_err; 1003 } 1004 1005 if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) { 1006 al = SSL_AD_DECODE_ERROR; 1007 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); 1008 goto f_err; 1009 } 1010 1011 if (!PACKET_get_sub_packet(pkt, &cipher_suites, cipher_len) 1012 || !PACKET_get_sub_packet(pkt, &session_id, session_id_len) 1013 || !PACKET_get_sub_packet(pkt, &challenge, challenge_len) 1014 /* No extensions. */ 1015 || PACKET_remaining(pkt) != 0) { 1016 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1017 SSL_R_RECORD_LENGTH_MISMATCH); 1018 al = SSL_AD_DECODE_ERROR; 1019 goto f_err; 1020 } 1021 1022 /* Load the client random and compression list. */ 1023 challenge_len = challenge_len > SSL3_RANDOM_SIZE ? SSL3_RANDOM_SIZE : 1024 challenge_len; 1025 memset(s->s3->client_random, 0, SSL3_RANDOM_SIZE); 1026 if (!PACKET_copy_bytes(&challenge, 1027 s->s3->client_random + SSL3_RANDOM_SIZE - 1028 challenge_len, challenge_len) 1029 /* Advertise only null compression. */ 1030 || !PACKET_buf_init(&compression, &null_compression, 1)) { 1031 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); 1032 al = SSL_AD_INTERNAL_ERROR; 1033 goto f_err; 1034 } 1035 1036 PACKET_null_init(&extensions); 1037 } else { 1038 /* Regular ClientHello. */ 1039 if (!PACKET_copy_bytes(pkt, s->s3->client_random, SSL3_RANDOM_SIZE) 1040 || !PACKET_get_length_prefixed_1(pkt, &session_id)) { 1041 al = SSL_AD_DECODE_ERROR; 1042 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); 1043 goto f_err; 1044 } 1045 1046 if (PACKET_remaining(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) { 1047 al = SSL_AD_DECODE_ERROR; 1048 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); 1049 goto f_err; 1050 } 1051 1052 if (SSL_IS_DTLS(s)) { 1053 if (!PACKET_get_length_prefixed_1(pkt, &cookie)) { 1054 al = SSL_AD_DECODE_ERROR; 1055 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); 1056 goto f_err; 1057 } 1058 /* 1059 * If we require cookies and this ClientHello doesn't contain one, 1060 * just return since we do not want to allocate any memory yet. 1061 * So check cookie length... 1062 */ 1063 if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) { 1064 if (PACKET_remaining(&cookie) == 0) 1065 return 1; 1066 } 1067 } 1068 1069 if (!PACKET_get_length_prefixed_2(pkt, &cipher_suites) 1070 || !PACKET_get_length_prefixed_1(pkt, &compression)) { 1071 al = SSL_AD_DECODE_ERROR; 1072 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); 1073 goto f_err; 1074 } 1075 /* Could be empty. */ 1076 extensions = *pkt; 1077 } 1078 1079 if (SSL_IS_DTLS(s)) { 1080 /* Empty cookie was already handled above by returning early. */ 1081 if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) { 1082 if (s->ctx->app_verify_cookie_cb != NULL) { 1083 if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&cookie), 1084 PACKET_remaining(&cookie)) == 1085 0) { 1086 al = SSL_AD_HANDSHAKE_FAILURE; 1087 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1088 SSL_R_COOKIE_MISMATCH); 1089 goto f_err; 1090 /* else cookie verification succeeded */ 1091 } 1092 /* default verification */ 1093 } else if (!PACKET_equal(&cookie, s->d1->cookie, s->d1->cookie_len)) { 1094 al = SSL_AD_HANDSHAKE_FAILURE; 1095 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH); 1096 goto f_err; 1097 } 1098 s->d1->cookie_verified = 1; 1099 } 1100 if (s->method->version == DTLS_ANY_VERSION) { 1101 protverr = ssl_choose_server_version(s); 1102 if (protverr != 0) { 1103 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr); 1104 s->version = s->client_version; 1105 al = SSL_AD_PROTOCOL_VERSION; 1106 goto f_err; 1107 } 1108 } 1109 } 1110 1111 s->hit = 0; 1112 1113 /* 1114 * We don't allow resumption in a backwards compatible ClientHello. 1115 * TODO(openssl-team): in TLS1.1+, session_id MUST be empty. 1116 * 1117 * Versions before 0.9.7 always allow clients to resume sessions in 1118 * renegotiation. 0.9.7 and later allow this by default, but optionally 1119 * ignore resumption requests with flag 1120 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION (it's a new flag rather 1121 * than a change to default behavior so that applications relying on 1122 * this for security won't even compile against older library versions). 1123 * 1.0.1 and later also have a function SSL_renegotiate_abbreviated() to 1124 * request renegotiation but not a new session (s->new_session remains 1125 * unset): for servers, this essentially just means that the 1126 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be 1127 * ignored. 1128 */ 1129 if (is_v2_record || 1130 (s->new_session && 1131 (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) { 1132 if (!ssl_get_new_session(s, 1)) 1133 goto err; 1134 } else { 1135 i = ssl_get_prev_session(s, &extensions, &session_id); 1136 /* 1137 * Only resume if the session's version matches the negotiated 1138 * version. 1139 * RFC 5246 does not provide much useful advice on resumption 1140 * with a different protocol version. It doesn't forbid it but 1141 * the sanity of such behaviour would be questionable. 1142 * In practice, clients do not accept a version mismatch and 1143 * will abort the handshake with an error. 1144 */ 1145 if (i == 1 && s->version == s->session->ssl_version) { 1146 /* previous session */ 1147 s->hit = 1; 1148 } else if (i == -1) { 1149 goto err; 1150 } else { 1151 /* i == 0 */ 1152 if (!ssl_get_new_session(s, 1)) 1153 goto err; 1154 } 1155 } 1156 1157 if (ssl_bytes_to_cipher_list(s, &cipher_suites, &(ciphers), 1158 is_v2_record, &al) == NULL) { 1159 goto f_err; 1160 } 1161 1162 /* If it is a hit, check that the cipher is in the list */ 1163 if (s->hit) { 1164 j = 0; 1165 id = s->session->cipher->id; 1166 1167 #ifdef CIPHER_DEBUG 1168 fprintf(stderr, "client sent %d ciphers\n", sk_SSL_CIPHER_num(ciphers)); 1169 #endif 1170 for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) { 1171 c = sk_SSL_CIPHER_value(ciphers, i); 1172 #ifdef CIPHER_DEBUG 1173 fprintf(stderr, "client [%2d of %2d]:%s\n", 1174 i, sk_SSL_CIPHER_num(ciphers), SSL_CIPHER_get_name(c)); 1175 #endif 1176 if (c->id == id) { 1177 j = 1; 1178 break; 1179 } 1180 } 1181 if (j == 0) { 1182 /* 1183 * we need to have the cipher in the cipher list if we are asked 1184 * to reuse it 1185 */ 1186 al = SSL_AD_ILLEGAL_PARAMETER; 1187 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1188 SSL_R_REQUIRED_CIPHER_MISSING); 1189 goto f_err; 1190 } 1191 } 1192 1193 complen = PACKET_remaining(&compression); 1194 for (j = 0; j < complen; j++) { 1195 if (PACKET_data(&compression)[j] == 0) 1196 break; 1197 } 1198 1199 if (j >= complen) { 1200 /* no compress */ 1201 al = SSL_AD_DECODE_ERROR; 1202 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_COMPRESSION_SPECIFIED); 1203 goto f_err; 1204 } 1205 1206 /* TLS extensions */ 1207 if (s->version >= SSL3_VERSION) { 1208 if (!ssl_parse_clienthello_tlsext(s, &extensions)) { 1209 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_PARSE_TLSEXT); 1210 goto err; 1211 } 1212 } 1213 1214 /* 1215 * Check if we want to use external pre-shared secret for this handshake 1216 * for not reused session only. We need to generate server_random before 1217 * calling tls_session_secret_cb in order to allow SessionTicket 1218 * processing to use it in key derivation. 1219 */ 1220 { 1221 unsigned char *pos; 1222 pos = s->s3->server_random; 1223 if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE) <= 0) { 1224 goto f_err; 1225 } 1226 } 1227 1228 if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) { 1229 const SSL_CIPHER *pref_cipher = NULL; 1230 1231 s->session->master_key_length = sizeof(s->session->master_key); 1232 if (s->tls_session_secret_cb(s, s->session->master_key, 1233 &s->session->master_key_length, ciphers, 1234 &pref_cipher, 1235 s->tls_session_secret_cb_arg)) { 1236 s->hit = 1; 1237 s->session->ciphers = ciphers; 1238 s->session->verify_result = X509_V_OK; 1239 1240 ciphers = NULL; 1241 1242 /* check if some cipher was preferred by call back */ 1243 pref_cipher = 1244 pref_cipher ? pref_cipher : ssl3_choose_cipher(s, 1245 s-> 1246 session->ciphers, 1247 SSL_get_ciphers 1248 (s)); 1249 if (pref_cipher == NULL) { 1250 al = SSL_AD_HANDSHAKE_FAILURE; 1251 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER); 1252 goto f_err; 1253 } 1254 1255 s->session->cipher = pref_cipher; 1256 sk_SSL_CIPHER_free(s->cipher_list); 1257 s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers); 1258 sk_SSL_CIPHER_free(s->cipher_list_by_id); 1259 s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers); 1260 } 1261 } 1262 1263 /* 1264 * Worst case, we will use the NULL compression, but if we have other 1265 * options, we will now look for them. We have complen-1 compression 1266 * algorithms from the client, starting at q. 1267 */ 1268 s->s3->tmp.new_compression = NULL; 1269 #ifndef OPENSSL_NO_COMP 1270 /* This only happens if we have a cache hit */ 1271 if (s->session->compress_meth != 0) { 1272 int m, comp_id = s->session->compress_meth; 1273 unsigned int k; 1274 /* Perform sanity checks on resumed compression algorithm */ 1275 /* Can't disable compression */ 1276 if (!ssl_allow_compression(s)) { 1277 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1278 SSL_R_INCONSISTENT_COMPRESSION); 1279 goto f_err; 1280 } 1281 /* Look for resumed compression method */ 1282 for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++) { 1283 comp = sk_SSL_COMP_value(s->ctx->comp_methods, m); 1284 if (comp_id == comp->id) { 1285 s->s3->tmp.new_compression = comp; 1286 break; 1287 } 1288 } 1289 if (s->s3->tmp.new_compression == NULL) { 1290 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1291 SSL_R_INVALID_COMPRESSION_ALGORITHM); 1292 goto f_err; 1293 } 1294 /* Look for resumed method in compression list */ 1295 for (k = 0; k < complen; k++) { 1296 if (PACKET_data(&compression)[k] == comp_id) 1297 break; 1298 } 1299 if (k >= complen) { 1300 al = SSL_AD_ILLEGAL_PARAMETER; 1301 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, 1302 SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING); 1303 goto f_err; 1304 } 1305 } else if (s->hit) 1306 comp = NULL; 1307 else if (ssl_allow_compression(s) && s->ctx->comp_methods) { 1308 /* See if we have a match */ 1309 int m, nn, v, done = 0; 1310 unsigned int o; 1311 1312 nn = sk_SSL_COMP_num(s->ctx->comp_methods); 1313 for (m = 0; m < nn; m++) { 1314 comp = sk_SSL_COMP_value(s->ctx->comp_methods, m); 1315 v = comp->id; 1316 for (o = 0; o < complen; o++) { 1317 if (v == PACKET_data(&compression)[o]) { 1318 done = 1; 1319 break; 1320 } 1321 } 1322 if (done) 1323 break; 1324 } 1325 if (done) 1326 s->s3->tmp.new_compression = comp; 1327 else 1328 comp = NULL; 1329 } 1330 #else 1331 /* 1332 * If compression is disabled we'd better not try to resume a session 1333 * using compression. 1334 */ 1335 if (s->session->compress_meth != 0) { 1336 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_INCONSISTENT_COMPRESSION); 1337 goto f_err; 1338 } 1339 #endif 1340 1341 /* 1342 * Given s->session->ciphers and SSL_get_ciphers, we must pick a cipher 1343 */ 1344 1345 if (!s->hit) { 1346 #ifdef OPENSSL_NO_COMP 1347 s->session->compress_meth = 0; 1348 #else 1349 s->session->compress_meth = (comp == NULL) ? 0 : comp->id; 1350 #endif 1351 sk_SSL_CIPHER_free(s->session->ciphers); 1352 s->session->ciphers = ciphers; 1353 if (ciphers == NULL) { 1354 al = SSL_AD_INTERNAL_ERROR; 1355 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); 1356 goto f_err; 1357 } 1358 ciphers = NULL; 1359 if (!tls1_set_server_sigalgs(s)) { 1360 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT); 1361 goto err; 1362 } 1363 } 1364 1365 sk_SSL_CIPHER_free(ciphers); 1366 return MSG_PROCESS_CONTINUE_PROCESSING; 1367 f_err: 1368 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1369 err: 1370 ossl_statem_set_error(s); 1371 1372 sk_SSL_CIPHER_free(ciphers); 1373 return MSG_PROCESS_ERROR; 1374 1375 } 1376 1377 WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) 1378 { 1379 int al = SSL_AD_HANDSHAKE_FAILURE; 1380 const SSL_CIPHER *cipher; 1381 1382 if (wst == WORK_MORE_A) { 1383 if (!s->hit) { 1384 /* Let cert callback update server certificates if required */ 1385 if (s->cert->cert_cb) { 1386 int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg); 1387 if (rv == 0) { 1388 al = SSL_AD_INTERNAL_ERROR; 1389 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 1390 SSL_R_CERT_CB_ERROR); 1391 goto f_err; 1392 } 1393 if (rv < 0) { 1394 s->rwstate = SSL_X509_LOOKUP; 1395 return WORK_MORE_A; 1396 } 1397 s->rwstate = SSL_NOTHING; 1398 } 1399 cipher = 1400 ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s)); 1401 1402 if (cipher == NULL) { 1403 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 1404 SSL_R_NO_SHARED_CIPHER); 1405 goto f_err; 1406 } 1407 s->s3->tmp.new_cipher = cipher; 1408 /* check whether we should disable session resumption */ 1409 if (s->not_resumable_session_cb != NULL) 1410 s->session->not_resumable = s->not_resumable_session_cb(s, 1411 ((cipher->algorithm_mkey & (SSL_kDHE | SSL_kECDHE)) != 0)); 1412 if (s->session->not_resumable) 1413 /* do not send a session ticket */ 1414 s->tlsext_ticket_expected = 0; 1415 } else { 1416 /* Session-id reuse */ 1417 s->s3->tmp.new_cipher = s->session->cipher; 1418 } 1419 1420 if (!(s->verify_mode & SSL_VERIFY_PEER)) { 1421 if (!ssl3_digest_cached_records(s, 0)) { 1422 al = SSL_AD_INTERNAL_ERROR; 1423 goto f_err; 1424 } 1425 } 1426 1427 /*- 1428 * we now have the following setup. 1429 * client_random 1430 * cipher_list - our preferred list of ciphers 1431 * ciphers - the clients preferred list of ciphers 1432 * compression - basically ignored right now 1433 * ssl version is set - sslv3 1434 * s->session - The ssl session has been setup. 1435 * s->hit - session reuse flag 1436 * s->s3->tmp.new_cipher- the new cipher to use. 1437 */ 1438 1439 /* Handles TLS extensions that we couldn't check earlier */ 1440 if (s->version >= SSL3_VERSION) { 1441 if (!ssl_check_clienthello_tlsext_late(s, &al)) { 1442 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 1443 SSL_R_CLIENTHELLO_TLSEXT); 1444 goto f_err; 1445 } 1446 } 1447 1448 wst = WORK_MORE_B; 1449 } 1450 #ifndef OPENSSL_NO_SRP 1451 if (wst == WORK_MORE_B) { 1452 int ret; 1453 if ((ret = ssl_check_srp_ext_ClientHello(s, &al)) < 0) { 1454 /* 1455 * callback indicates further work to be done 1456 */ 1457 s->rwstate = SSL_X509_LOOKUP; 1458 return WORK_MORE_B; 1459 } 1460 if (ret != SSL_ERROR_NONE) { 1461 /* 1462 * This is not really an error but the only means to for 1463 * a client to detect whether srp is supported. 1464 */ 1465 if (al != TLS1_AD_UNKNOWN_PSK_IDENTITY) 1466 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 1467 SSL_R_CLIENTHELLO_TLSEXT); 1468 else 1469 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 1470 SSL_R_PSK_IDENTITY_NOT_FOUND); 1471 goto f_err; 1472 } 1473 } 1474 #endif 1475 s->renegotiate = 2; 1476 1477 return WORK_FINISHED_STOP; 1478 f_err: 1479 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1480 ossl_statem_set_error(s); 1481 return WORK_ERROR; 1482 } 1483 1484 int tls_construct_server_hello(SSL *s) 1485 { 1486 unsigned char *buf; 1487 unsigned char *p, *d; 1488 int i, sl; 1489 int al = 0; 1490 unsigned long l; 1491 1492 buf = (unsigned char *)s->init_buf->data; 1493 1494 /* Do the message type and length last */ 1495 d = p = ssl_handshake_start(s); 1496 1497 *(p++) = s->version >> 8; 1498 *(p++) = s->version & 0xff; 1499 1500 /* 1501 * Random stuff. Filling of the server_random takes place in 1502 * tls_process_client_hello() 1503 */ 1504 memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); 1505 p += SSL3_RANDOM_SIZE; 1506 1507 /*- 1508 * There are several cases for the session ID to send 1509 * back in the server hello: 1510 * - For session reuse from the session cache, 1511 * we send back the old session ID. 1512 * - If stateless session reuse (using a session ticket) 1513 * is successful, we send back the client's "session ID" 1514 * (which doesn't actually identify the session). 1515 * - If it is a new session, we send back the new 1516 * session ID. 1517 * - However, if we want the new session to be single-use, 1518 * we send back a 0-length session ID. 1519 * s->hit is non-zero in either case of session reuse, 1520 * so the following won't overwrite an ID that we're supposed 1521 * to send back. 1522 */ 1523 if (s->session->not_resumable || 1524 (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER) 1525 && !s->hit)) 1526 s->session->session_id_length = 0; 1527 1528 sl = s->session->session_id_length; 1529 if (sl > (int)sizeof(s->session->session_id)) { 1530 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR); 1531 ossl_statem_set_error(s); 1532 return 0; 1533 } 1534 *(p++) = sl; 1535 memcpy(p, s->session->session_id, sl); 1536 p += sl; 1537 1538 /* put the cipher */ 1539 i = ssl3_put_cipher_by_char(s->s3->tmp.new_cipher, p); 1540 p += i; 1541 1542 /* put the compression method */ 1543 #ifdef OPENSSL_NO_COMP 1544 *(p++) = 0; 1545 #else 1546 if (s->s3->tmp.new_compression == NULL) 1547 *(p++) = 0; 1548 else 1549 *(p++) = s->s3->tmp.new_compression->id; 1550 #endif 1551 1552 if (ssl_prepare_serverhello_tlsext(s) <= 0) { 1553 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, SSL_R_SERVERHELLO_TLSEXT); 1554 ossl_statem_set_error(s); 1555 return 0; 1556 } 1557 if ((p = 1558 ssl_add_serverhello_tlsext(s, p, buf + SSL3_RT_MAX_PLAIN_LENGTH, 1559 &al)) == NULL) { 1560 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1561 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR); 1562 ossl_statem_set_error(s); 1563 return 0; 1564 } 1565 1566 /* do the header */ 1567 l = (p - d); 1568 if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_HELLO, l)) { 1569 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR); 1570 ossl_statem_set_error(s); 1571 return 0; 1572 } 1573 1574 return 1; 1575 } 1576 1577 int tls_construct_server_done(SSL *s) 1578 { 1579 if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_DONE, 0)) { 1580 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_DONE, ERR_R_INTERNAL_ERROR); 1581 ossl_statem_set_error(s); 1582 return 0; 1583 } 1584 1585 if (!s->s3->tmp.cert_request) { 1586 if (!ssl3_digest_cached_records(s, 0)) { 1587 ossl_statem_set_error(s); 1588 } 1589 } 1590 1591 return 1; 1592 } 1593 1594 int tls_construct_server_key_exchange(SSL *s) 1595 { 1596 #ifndef OPENSSL_NO_DH 1597 EVP_PKEY *pkdh = NULL; 1598 int j; 1599 #endif 1600 #ifndef OPENSSL_NO_EC 1601 unsigned char *encodedPoint = NULL; 1602 int encodedlen = 0; 1603 int curve_id = 0; 1604 #endif 1605 EVP_PKEY *pkey; 1606 const EVP_MD *md = NULL; 1607 unsigned char *p, *d; 1608 int al, i; 1609 unsigned long type; 1610 int n; 1611 const BIGNUM *r[4]; 1612 int nr[4], kn; 1613 BUF_MEM *buf; 1614 EVP_MD_CTX *md_ctx = EVP_MD_CTX_new(); 1615 1616 if (md_ctx == NULL) { 1617 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); 1618 al = SSL_AD_INTERNAL_ERROR; 1619 goto f_err; 1620 } 1621 1622 type = s->s3->tmp.new_cipher->algorithm_mkey; 1623 1624 buf = s->init_buf; 1625 1626 r[0] = r[1] = r[2] = r[3] = NULL; 1627 n = 0; 1628 #ifndef OPENSSL_NO_PSK 1629 if (type & SSL_PSK) { 1630 /* 1631 * reserve size for record length and PSK identity hint 1632 */ 1633 n += 2; 1634 if (s->cert->psk_identity_hint) 1635 n += strlen(s->cert->psk_identity_hint); 1636 } 1637 /* Plain PSK or RSAPSK nothing to do */ 1638 if (type & (SSL_kPSK | SSL_kRSAPSK)) { 1639 } else 1640 #endif /* !OPENSSL_NO_PSK */ 1641 #ifndef OPENSSL_NO_DH 1642 if (type & (SSL_kDHE | SSL_kDHEPSK)) { 1643 CERT *cert = s->cert; 1644 1645 EVP_PKEY *pkdhp = NULL; 1646 DH *dh; 1647 1648 if (s->cert->dh_tmp_auto) { 1649 DH *dhp = ssl_get_auto_dh(s); 1650 pkdh = EVP_PKEY_new(); 1651 if (pkdh == NULL || dhp == NULL) { 1652 DH_free(dhp); 1653 al = SSL_AD_INTERNAL_ERROR; 1654 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1655 ERR_R_INTERNAL_ERROR); 1656 goto f_err; 1657 } 1658 EVP_PKEY_assign_DH(pkdh, dhp); 1659 pkdhp = pkdh; 1660 } else { 1661 pkdhp = cert->dh_tmp; 1662 } 1663 if ((pkdhp == NULL) && (s->cert->dh_tmp_cb != NULL)) { 1664 DH *dhp = s->cert->dh_tmp_cb(s, 0, 1024); 1665 pkdh = ssl_dh_to_pkey(dhp); 1666 if (pkdh == NULL) { 1667 al = SSL_AD_INTERNAL_ERROR; 1668 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1669 ERR_R_INTERNAL_ERROR); 1670 goto f_err; 1671 } 1672 pkdhp = pkdh; 1673 } 1674 if (pkdhp == NULL) { 1675 al = SSL_AD_HANDSHAKE_FAILURE; 1676 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1677 SSL_R_MISSING_TMP_DH_KEY); 1678 goto f_err; 1679 } 1680 if (!ssl_security(s, SSL_SECOP_TMP_DH, 1681 EVP_PKEY_security_bits(pkdhp), 0, pkdhp)) { 1682 al = SSL_AD_HANDSHAKE_FAILURE; 1683 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1684 SSL_R_DH_KEY_TOO_SMALL); 1685 goto f_err; 1686 } 1687 if (s->s3->tmp.pkey != NULL) { 1688 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1689 ERR_R_INTERNAL_ERROR); 1690 goto err; 1691 } 1692 1693 s->s3->tmp.pkey = ssl_generate_pkey(pkdhp); 1694 1695 if (s->s3->tmp.pkey == NULL) { 1696 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB); 1697 goto err; 1698 } 1699 1700 dh = EVP_PKEY_get0_DH(s->s3->tmp.pkey); 1701 1702 EVP_PKEY_free(pkdh); 1703 pkdh = NULL; 1704 1705 DH_get0_pqg(dh, &r[0], NULL, &r[1]); 1706 DH_get0_key(dh, &r[2], NULL); 1707 } else 1708 #endif 1709 #ifndef OPENSSL_NO_EC 1710 if (type & (SSL_kECDHE | SSL_kECDHEPSK)) { 1711 int nid; 1712 1713 if (s->s3->tmp.pkey != NULL) { 1714 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1715 ERR_R_INTERNAL_ERROR); 1716 goto err; 1717 } 1718 1719 /* Get NID of appropriate shared curve */ 1720 nid = tls1_shared_curve(s, -2); 1721 curve_id = tls1_ec_nid2curve_id(nid); 1722 if (curve_id == 0) { 1723 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1724 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); 1725 goto err; 1726 } 1727 s->s3->tmp.pkey = ssl_generate_pkey_curve(curve_id); 1728 /* Generate a new key for this curve */ 1729 if (s->s3->tmp.pkey == NULL) { 1730 al = SSL_AD_INTERNAL_ERROR; 1731 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB); 1732 goto f_err; 1733 } 1734 1735 /* Encode the public key. */ 1736 encodedlen = EVP_PKEY_get1_tls_encodedpoint(s->s3->tmp.pkey, 1737 &encodedPoint); 1738 if (encodedlen == 0) { 1739 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EC_LIB); 1740 goto err; 1741 } 1742 1743 /* 1744 * We only support named (not generic) curves in ECDH ephemeral key 1745 * exchanges. In this situation, we need four additional bytes to 1746 * encode the entire ServerECDHParams structure. 1747 */ 1748 n += 4 + encodedlen; 1749 1750 /* 1751 * We'll generate the serverKeyExchange message explicitly so we 1752 * can set these to NULLs 1753 */ 1754 r[0] = NULL; 1755 r[1] = NULL; 1756 r[2] = NULL; 1757 r[3] = NULL; 1758 } else 1759 #endif /* !OPENSSL_NO_EC */ 1760 #ifndef OPENSSL_NO_SRP 1761 if (type & SSL_kSRP) { 1762 if ((s->srp_ctx.N == NULL) || 1763 (s->srp_ctx.g == NULL) || 1764 (s->srp_ctx.s == NULL) || (s->srp_ctx.B == NULL)) { 1765 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1766 SSL_R_MISSING_SRP_PARAM); 1767 goto err; 1768 } 1769 r[0] = s->srp_ctx.N; 1770 r[1] = s->srp_ctx.g; 1771 r[2] = s->srp_ctx.s; 1772 r[3] = s->srp_ctx.B; 1773 } else 1774 #endif 1775 { 1776 al = SSL_AD_HANDSHAKE_FAILURE; 1777 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1778 SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); 1779 goto f_err; 1780 } 1781 for (i = 0; i < 4 && r[i] != NULL; i++) { 1782 nr[i] = BN_num_bytes(r[i]); 1783 #ifndef OPENSSL_NO_SRP 1784 if ((i == 2) && (type & SSL_kSRP)) 1785 n += 1 + nr[i]; 1786 else 1787 #endif 1788 #ifndef OPENSSL_NO_DH 1789 /*- 1790 * for interoperability with some versions of the Microsoft TLS 1791 * stack, we need to zero pad the DHE pub key to the same length 1792 * as the prime, so use the length of the prime here 1793 */ 1794 if ((i == 2) && (type & (SSL_kDHE | SSL_kDHEPSK))) 1795 n += 2 + nr[0]; 1796 else 1797 #endif 1798 n += 2 + nr[i]; 1799 } 1800 1801 if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP)) 1802 && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) { 1803 if ((pkey = ssl_get_sign_pkey(s, s->s3->tmp.new_cipher, &md)) 1804 == NULL) { 1805 al = SSL_AD_DECODE_ERROR; 1806 goto f_err; 1807 } 1808 kn = EVP_PKEY_size(pkey); 1809 /* Allow space for signature algorithm */ 1810 if (SSL_USE_SIGALGS(s)) 1811 kn += 2; 1812 /* Allow space for signature length */ 1813 kn += 2; 1814 } else { 1815 pkey = NULL; 1816 kn = 0; 1817 } 1818 1819 if (!BUF_MEM_grow_clean(buf, n + SSL_HM_HEADER_LENGTH(s) + kn)) { 1820 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_BUF); 1821 goto err; 1822 } 1823 d = p = ssl_handshake_start(s); 1824 1825 #ifndef OPENSSL_NO_PSK 1826 if (type & SSL_PSK) { 1827 /* copy PSK identity hint */ 1828 if (s->cert->psk_identity_hint) { 1829 size_t len = strlen(s->cert->psk_identity_hint); 1830 if (len > PSK_MAX_IDENTITY_LEN) { 1831 /* 1832 * Should not happen - we already checked this when we set 1833 * the identity hint 1834 */ 1835 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1836 ERR_R_INTERNAL_ERROR); 1837 goto err; 1838 } 1839 s2n(len, p); 1840 memcpy(p, s->cert->psk_identity_hint, len); 1841 p += len; 1842 } else { 1843 s2n(0, p); 1844 } 1845 } 1846 #endif 1847 1848 for (i = 0; i < 4 && r[i] != NULL; i++) { 1849 #ifndef OPENSSL_NO_SRP 1850 if ((i == 2) && (type & SSL_kSRP)) { 1851 *p = nr[i]; 1852 p++; 1853 } else 1854 #endif 1855 #ifndef OPENSSL_NO_DH 1856 /*- 1857 * for interoperability with some versions of the Microsoft TLS 1858 * stack, we need to zero pad the DHE pub key to the same length 1859 * as the prime 1860 */ 1861 if ((i == 2) && (type & (SSL_kDHE | SSL_kDHEPSK))) { 1862 s2n(nr[0], p); 1863 for (j = 0; j < (nr[0] - nr[2]); ++j) { 1864 *p = 0; 1865 ++p; 1866 } 1867 } else 1868 #endif 1869 s2n(nr[i], p); 1870 BN_bn2bin(r[i], p); 1871 p += nr[i]; 1872 } 1873 1874 #ifndef OPENSSL_NO_EC 1875 if (type & (SSL_kECDHE | SSL_kECDHEPSK)) { 1876 /* 1877 * XXX: For now, we only support named (not generic) curves. In 1878 * this situation, the serverKeyExchange message has: [1 byte 1879 * CurveType], [2 byte CurveName] [1 byte length of encoded 1880 * point], followed by the actual encoded point itself 1881 */ 1882 *p = NAMED_CURVE_TYPE; 1883 p += 1; 1884 *p = 0; 1885 p += 1; 1886 *p = curve_id; 1887 p += 1; 1888 *p = encodedlen; 1889 p += 1; 1890 memcpy(p, encodedPoint, encodedlen); 1891 OPENSSL_free(encodedPoint); 1892 encodedPoint = NULL; 1893 p += encodedlen; 1894 } 1895 #endif 1896 1897 /* not anonymous */ 1898 if (pkey != NULL) { 1899 /* 1900 * n is the length of the params, they start at &(d[4]) and p 1901 * points to the space at the end. 1902 */ 1903 if (md) { 1904 /* send signature algorithm */ 1905 if (SSL_USE_SIGALGS(s)) { 1906 if (!tls12_get_sigandhash(p, pkey, md)) { 1907 /* Should never happen */ 1908 al = SSL_AD_INTERNAL_ERROR; 1909 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1910 ERR_R_INTERNAL_ERROR); 1911 goto f_err; 1912 } 1913 p += 2; 1914 } 1915 #ifdef SSL_DEBUG 1916 fprintf(stderr, "Using hash %s\n", EVP_MD_name(md)); 1917 #endif 1918 if (EVP_SignInit_ex(md_ctx, md, NULL) <= 0 1919 || EVP_SignUpdate(md_ctx, &(s->s3->client_random[0]), 1920 SSL3_RANDOM_SIZE) <= 0 1921 || EVP_SignUpdate(md_ctx, &(s->s3->server_random[0]), 1922 SSL3_RANDOM_SIZE) <= 0 1923 || EVP_SignUpdate(md_ctx, d, n) <= 0 1924 || EVP_SignFinal(md_ctx, &(p[2]), 1925 (unsigned int *)&i, pkey) <= 0) { 1926 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_EVP); 1927 al = SSL_AD_INTERNAL_ERROR; 1928 goto f_err; 1929 } 1930 s2n(i, p); 1931 n += i + 2; 1932 if (SSL_USE_SIGALGS(s)) 1933 n += 2; 1934 } else { 1935 /* Is this error check actually needed? */ 1936 al = SSL_AD_HANDSHAKE_FAILURE; 1937 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, 1938 SSL_R_UNKNOWN_PKEY_TYPE); 1939 goto f_err; 1940 } 1941 } 1942 1943 if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_KEY_EXCHANGE, n)) { 1944 al = SSL_AD_HANDSHAKE_FAILURE; 1945 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); 1946 goto f_err; 1947 } 1948 1949 EVP_MD_CTX_free(md_ctx); 1950 return 1; 1951 f_err: 1952 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1953 err: 1954 #ifndef OPENSSL_NO_DH 1955 EVP_PKEY_free(pkdh); 1956 #endif 1957 #ifndef OPENSSL_NO_EC 1958 OPENSSL_free(encodedPoint); 1959 #endif 1960 EVP_MD_CTX_free(md_ctx); 1961 ossl_statem_set_error(s); 1962 return 0; 1963 } 1964 1965 int tls_construct_certificate_request(SSL *s) 1966 { 1967 unsigned char *p, *d; 1968 int i, j, nl, off, n; 1969 STACK_OF(X509_NAME) *sk = NULL; 1970 X509_NAME *name; 1971 BUF_MEM *buf; 1972 1973 buf = s->init_buf; 1974 1975 d = p = ssl_handshake_start(s); 1976 1977 /* get the list of acceptable cert types */ 1978 p++; 1979 n = ssl3_get_req_cert_type(s, p); 1980 d[0] = n; 1981 p += n; 1982 n++; 1983 1984 if (SSL_USE_SIGALGS(s)) { 1985 const unsigned char *psigs; 1986 unsigned char *etmp = p; 1987 nl = tls12_get_psigalgs(s, 1, &psigs); 1988 /* Skip over length for now */ 1989 p += 2; 1990 nl = tls12_copy_sigalgs(s, p, psigs, nl); 1991 /* Now fill in length */ 1992 s2n(nl, etmp); 1993 p += nl; 1994 n += nl + 2; 1995 } 1996 1997 off = n; 1998 p += 2; 1999 n += 2; 2000 2001 sk = SSL_get_client_CA_list(s); 2002 nl = 0; 2003 if (sk != NULL) { 2004 for (i = 0; i < sk_X509_NAME_num(sk); i++) { 2005 name = sk_X509_NAME_value(sk, i); 2006 j = i2d_X509_NAME(name, NULL); 2007 if (!BUF_MEM_grow_clean(buf, SSL_HM_HEADER_LENGTH(s) + n + j + 2)) { 2008 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_BUF_LIB); 2009 goto err; 2010 } 2011 p = ssl_handshake_start(s) + n; 2012 s2n(j, p); 2013 i2d_X509_NAME(name, &p); 2014 n += 2 + j; 2015 nl += 2 + j; 2016 } 2017 } 2018 /* else no CA names */ 2019 p = ssl_handshake_start(s) + off; 2020 s2n(nl, p); 2021 2022 if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_REQUEST, n)) { 2023 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR); 2024 goto err; 2025 } 2026 2027 s->s3->tmp.cert_request = 1; 2028 2029 return 1; 2030 err: 2031 ossl_statem_set_error(s); 2032 return 0; 2033 } 2034 2035 static int tls_process_cke_psk_preamble(SSL *s, PACKET *pkt, int *al) 2036 { 2037 #ifndef OPENSSL_NO_PSK 2038 unsigned char psk[PSK_MAX_PSK_LEN]; 2039 size_t psklen; 2040 PACKET psk_identity; 2041 2042 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity)) { 2043 *al = SSL_AD_DECODE_ERROR; 2044 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_LENGTH_MISMATCH); 2045 return 0; 2046 } 2047 if (PACKET_remaining(&psk_identity) > PSK_MAX_IDENTITY_LEN) { 2048 *al = SSL_AD_DECODE_ERROR; 2049 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_DATA_LENGTH_TOO_LONG); 2050 return 0; 2051 } 2052 if (s->psk_server_callback == NULL) { 2053 *al = SSL_AD_INTERNAL_ERROR; 2054 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_PSK_NO_SERVER_CB); 2055 return 0; 2056 } 2057 2058 if (!PACKET_strndup(&psk_identity, &s->session->psk_identity)) { 2059 *al = SSL_AD_INTERNAL_ERROR; 2060 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); 2061 return 0; 2062 } 2063 2064 psklen = s->psk_server_callback(s, s->session->psk_identity, 2065 psk, sizeof(psk)); 2066 2067 if (psklen > PSK_MAX_PSK_LEN) { 2068 *al = SSL_AD_INTERNAL_ERROR; 2069 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); 2070 return 0; 2071 } else if (psklen == 0) { 2072 /* 2073 * PSK related to the given identity not found 2074 */ 2075 *al = SSL_AD_UNKNOWN_PSK_IDENTITY; 2076 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, 2077 SSL_R_PSK_IDENTITY_NOT_FOUND); 2078 return 0; 2079 } 2080 2081 OPENSSL_free(s->s3->tmp.psk); 2082 s->s3->tmp.psk = OPENSSL_memdup(psk, psklen); 2083 OPENSSL_cleanse(psk, psklen); 2084 2085 if (s->s3->tmp.psk == NULL) { 2086 *al = SSL_AD_INTERNAL_ERROR; 2087 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_MALLOC_FAILURE); 2088 return 0; 2089 } 2090 2091 s->s3->tmp.psklen = psklen; 2092 2093 return 1; 2094 #else 2095 /* Should never happen */ 2096 *al = SSL_AD_INTERNAL_ERROR; 2097 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); 2098 return 0; 2099 #endif 2100 } 2101 2102 static int tls_process_cke_rsa(SSL *s, PACKET *pkt, int *al) 2103 { 2104 #ifndef OPENSSL_NO_RSA 2105 unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH]; 2106 int decrypt_len; 2107 unsigned char decrypt_good, version_good; 2108 size_t j, padding_len; 2109 PACKET enc_premaster; 2110 RSA *rsa = NULL; 2111 unsigned char *rsa_decrypt = NULL; 2112 int ret = 0; 2113 2114 rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey); 2115 if (rsa == NULL) { 2116 *al = SSL_AD_HANDSHAKE_FAILURE; 2117 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_MISSING_RSA_CERTIFICATE); 2118 return 0; 2119 } 2120 2121 /* SSLv3 and pre-standard DTLS omit the length bytes. */ 2122 if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) { 2123 enc_premaster = *pkt; 2124 } else { 2125 if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster) 2126 || PACKET_remaining(pkt) != 0) { 2127 *al = SSL_AD_DECODE_ERROR; 2128 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_LENGTH_MISMATCH); 2129 return 0; 2130 } 2131 } 2132 2133 /* 2134 * We want to be sure that the plaintext buffer size makes it safe to 2135 * iterate over the entire size of a premaster secret 2136 * (SSL_MAX_MASTER_KEY_LENGTH). Reject overly short RSA keys because 2137 * their ciphertext cannot accommodate a premaster secret anyway. 2138 */ 2139 if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) { 2140 *al = SSL_AD_INTERNAL_ERROR; 2141 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, RSA_R_KEY_SIZE_TOO_SMALL); 2142 return 0; 2143 } 2144 2145 rsa_decrypt = OPENSSL_malloc(RSA_size(rsa)); 2146 if (rsa_decrypt == NULL) { 2147 *al = SSL_AD_INTERNAL_ERROR; 2148 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_MALLOC_FAILURE); 2149 return 0; 2150 } 2151 2152 /* 2153 * We must not leak whether a decryption failure occurs because of 2154 * Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246, 2155 * section 7.4.7.1). The code follows that advice of the TLS RFC and 2156 * generates a random premaster secret for the case that the decrypt 2157 * fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1 2158 */ 2159 2160 if (RAND_bytes(rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0) 2161 goto err; 2162 2163 /* 2164 * Decrypt with no padding. PKCS#1 padding will be removed as part of 2165 * the timing-sensitive code below. 2166 */ 2167 decrypt_len = RSA_private_decrypt(PACKET_remaining(&enc_premaster), 2168 PACKET_data(&enc_premaster), 2169 rsa_decrypt, rsa, RSA_NO_PADDING); 2170 if (decrypt_len < 0) 2171 goto err; 2172 2173 /* Check the padding. See RFC 3447, section 7.2.2. */ 2174 2175 /* 2176 * The smallest padded premaster is 11 bytes of overhead. Small keys 2177 * are publicly invalid, so this may return immediately. This ensures 2178 * PS is at least 8 bytes. 2179 */ 2180 if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) { 2181 *al = SSL_AD_DECRYPT_ERROR; 2182 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_DECRYPTION_FAILED); 2183 goto err; 2184 } 2185 2186 padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH; 2187 decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) & 2188 constant_time_eq_int_8(rsa_decrypt[1], 2); 2189 for (j = 2; j < padding_len - 1; j++) { 2190 decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]); 2191 } 2192 decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]); 2193 2194 /* 2195 * If the version in the decrypted pre-master secret is correct then 2196 * version_good will be 0xff, otherwise it'll be zero. The 2197 * Klima-Pokorny-Rosa extension of Bleichenbacher's attack 2198 * (http://eprint.iacr.org/2003/052/) exploits the version number 2199 * check as a "bad version oracle". Thus version checks are done in 2200 * constant time and are treated like any other decryption error. 2201 */ 2202 version_good = 2203 constant_time_eq_8(rsa_decrypt[padding_len], 2204 (unsigned)(s->client_version >> 8)); 2205 version_good &= 2206 constant_time_eq_8(rsa_decrypt[padding_len + 1], 2207 (unsigned)(s->client_version & 0xff)); 2208 2209 /* 2210 * The premaster secret must contain the same version number as the 2211 * ClientHello to detect version rollback attacks (strangely, the 2212 * protocol does not offer such protection for DH ciphersuites). 2213 * However, buggy clients exist that send the negotiated protocol 2214 * version instead if the server does not support the requested 2215 * protocol version. If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such 2216 * clients. 2217 */ 2218 if (s->options & SSL_OP_TLS_ROLLBACK_BUG) { 2219 unsigned char workaround_good; 2220 workaround_good = constant_time_eq_8(rsa_decrypt[padding_len], 2221 (unsigned)(s->version >> 8)); 2222 workaround_good &= 2223 constant_time_eq_8(rsa_decrypt[padding_len + 1], 2224 (unsigned)(s->version & 0xff)); 2225 version_good |= workaround_good; 2226 } 2227 2228 /* 2229 * Both decryption and version must be good for decrypt_good to 2230 * remain non-zero (0xff). 2231 */ 2232 decrypt_good &= version_good; 2233 2234 /* 2235 * Now copy rand_premaster_secret over from p using 2236 * decrypt_good_mask. If decryption failed, then p does not 2237 * contain valid plaintext, however, a check above guarantees 2238 * it is still sufficiently large to read from. 2239 */ 2240 for (j = 0; j < sizeof(rand_premaster_secret); j++) { 2241 rsa_decrypt[padding_len + j] = 2242 constant_time_select_8(decrypt_good, 2243 rsa_decrypt[padding_len + j], 2244 rand_premaster_secret[j]); 2245 } 2246 2247 if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len, 2248 sizeof(rand_premaster_secret), 0)) { 2249 *al = SSL_AD_INTERNAL_ERROR; 2250 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR); 2251 goto err; 2252 } 2253 2254 ret = 1; 2255 err: 2256 OPENSSL_free(rsa_decrypt); 2257 return ret; 2258 #else 2259 /* Should never happen */ 2260 *al = SSL_AD_INTERNAL_ERROR; 2261 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR); 2262 return 0; 2263 #endif 2264 } 2265 2266 static int tls_process_cke_dhe(SSL *s, PACKET *pkt, int *al) 2267 { 2268 #ifndef OPENSSL_NO_DH 2269 EVP_PKEY *skey = NULL; 2270 DH *cdh; 2271 unsigned int i; 2272 BIGNUM *pub_key; 2273 const unsigned char *data; 2274 EVP_PKEY *ckey = NULL; 2275 int ret = 0; 2276 2277 if (!PACKET_get_net_2(pkt, &i) || PACKET_remaining(pkt) != i) { 2278 *al = SSL_AD_HANDSHAKE_FAILURE; 2279 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, 2280 SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG); 2281 goto err; 2282 } 2283 skey = s->s3->tmp.pkey; 2284 if (skey == NULL) { 2285 *al = SSL_AD_HANDSHAKE_FAILURE; 2286 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_MISSING_TMP_DH_KEY); 2287 goto err; 2288 } 2289 2290 if (PACKET_remaining(pkt) == 0L) { 2291 *al = SSL_AD_HANDSHAKE_FAILURE; 2292 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_MISSING_TMP_DH_KEY); 2293 goto err; 2294 } 2295 if (!PACKET_get_bytes(pkt, &data, i)) { 2296 /* We already checked we have enough data */ 2297 *al = SSL_AD_INTERNAL_ERROR; 2298 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); 2299 goto err; 2300 } 2301 ckey = EVP_PKEY_new(); 2302 if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) == 0) { 2303 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_BN_LIB); 2304 goto err; 2305 } 2306 cdh = EVP_PKEY_get0_DH(ckey); 2307 pub_key = BN_bin2bn(data, i, NULL); 2308 2309 if (pub_key == NULL || !DH_set0_key(cdh, pub_key, NULL)) { 2310 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); 2311 if (pub_key != NULL) 2312 BN_free(pub_key); 2313 goto err; 2314 } 2315 2316 if (ssl_derive(s, skey, ckey) == 0) { 2317 *al = SSL_AD_INTERNAL_ERROR; 2318 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); 2319 goto err; 2320 } 2321 2322 ret = 1; 2323 EVP_PKEY_free(s->s3->tmp.pkey); 2324 s->s3->tmp.pkey = NULL; 2325 err: 2326 EVP_PKEY_free(ckey); 2327 return ret; 2328 #else 2329 /* Should never happen */ 2330 *al = SSL_AD_INTERNAL_ERROR; 2331 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); 2332 return 0; 2333 #endif 2334 } 2335 2336 static int tls_process_cke_ecdhe(SSL *s, PACKET *pkt, int *al) 2337 { 2338 #ifndef OPENSSL_NO_EC 2339 EVP_PKEY *skey = s->s3->tmp.pkey; 2340 EVP_PKEY *ckey = NULL; 2341 int ret = 0; 2342 2343 if (PACKET_remaining(pkt) == 0L) { 2344 /* We don't support ECDH client auth */ 2345 *al = SSL_AD_HANDSHAKE_FAILURE; 2346 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_MISSING_TMP_ECDH_KEY); 2347 goto err; 2348 } else { 2349 unsigned int i; 2350 const unsigned char *data; 2351 2352 /* 2353 * Get client's public key from encoded point in the 2354 * ClientKeyExchange message. 2355 */ 2356 2357 /* Get encoded point length */ 2358 if (!PACKET_get_1(pkt, &i) || !PACKET_get_bytes(pkt, &data, i) 2359 || PACKET_remaining(pkt) != 0) { 2360 *al = SSL_AD_DECODE_ERROR; 2361 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_LENGTH_MISMATCH); 2362 goto err; 2363 } 2364 ckey = EVP_PKEY_new(); 2365 if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) <= 0) { 2366 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_EVP_LIB); 2367 goto err; 2368 } 2369 if (EVP_PKEY_set1_tls_encodedpoint(ckey, data, i) == 0) { 2370 *al = SSL_AD_HANDSHAKE_FAILURE; 2371 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_EC_LIB); 2372 goto err; 2373 } 2374 } 2375 2376 if (ssl_derive(s, skey, ckey) == 0) { 2377 *al = SSL_AD_INTERNAL_ERROR; 2378 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_INTERNAL_ERROR); 2379 goto err; 2380 } 2381 2382 ret = 1; 2383 EVP_PKEY_free(s->s3->tmp.pkey); 2384 s->s3->tmp.pkey = NULL; 2385 err: 2386 EVP_PKEY_free(ckey); 2387 2388 return ret; 2389 #else 2390 /* Should never happen */ 2391 *al = SSL_AD_INTERNAL_ERROR; 2392 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_INTERNAL_ERROR); 2393 return 0; 2394 #endif 2395 } 2396 2397 static int tls_process_cke_srp(SSL *s, PACKET *pkt, int *al) 2398 { 2399 #ifndef OPENSSL_NO_SRP 2400 unsigned int i; 2401 const unsigned char *data; 2402 2403 if (!PACKET_get_net_2(pkt, &i) 2404 || !PACKET_get_bytes(pkt, &data, i)) { 2405 *al = SSL_AD_DECODE_ERROR; 2406 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, SSL_R_BAD_SRP_A_LENGTH); 2407 return 0; 2408 } 2409 if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) { 2410 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_BN_LIB); 2411 return 0; 2412 } 2413 if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0 || BN_is_zero(s->srp_ctx.A)) { 2414 *al = SSL_AD_ILLEGAL_PARAMETER; 2415 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, SSL_R_BAD_SRP_PARAMETERS); 2416 return 0; 2417 } 2418 OPENSSL_free(s->session->srp_username); 2419 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login); 2420 if (s->session->srp_username == NULL) { 2421 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_MALLOC_FAILURE); 2422 return 0; 2423 } 2424 2425 if (!srp_generate_server_master_secret(s)) { 2426 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_INTERNAL_ERROR); 2427 return 0; 2428 } 2429 2430 return 1; 2431 #else 2432 /* Should never happen */ 2433 *al = SSL_AD_INTERNAL_ERROR; 2434 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_INTERNAL_ERROR); 2435 return 0; 2436 #endif 2437 } 2438 2439 static int tls_process_cke_gost(SSL *s, PACKET *pkt, int *al) 2440 { 2441 #ifndef OPENSSL_NO_GOST 2442 EVP_PKEY_CTX *pkey_ctx; 2443 EVP_PKEY *client_pub_pkey = NULL, *pk = NULL; 2444 unsigned char premaster_secret[32]; 2445 const unsigned char *start; 2446 size_t outlen = 32, inlen; 2447 unsigned long alg_a; 2448 int Ttag, Tclass; 2449 long Tlen; 2450 long sess_key_len; 2451 const unsigned char *data; 2452 int ret = 0; 2453 2454 /* Get our certificate private key */ 2455 alg_a = s->s3->tmp.new_cipher->algorithm_auth; 2456 if (alg_a & SSL_aGOST12) { 2457 /* 2458 * New GOST ciphersuites have SSL_aGOST01 bit too 2459 */ 2460 pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey; 2461 if (pk == NULL) { 2462 pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey; 2463 } 2464 if (pk == NULL) { 2465 pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey; 2466 } 2467 } else if (alg_a & SSL_aGOST01) { 2468 pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey; 2469 } 2470 2471 pkey_ctx = EVP_PKEY_CTX_new(pk, NULL); 2472 if (pkey_ctx == NULL) { 2473 *al = SSL_AD_INTERNAL_ERROR; 2474 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_MALLOC_FAILURE); 2475 return 0; 2476 } 2477 if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) { 2478 *al = SSL_AD_INTERNAL_ERROR; 2479 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR); 2480 return 0; 2481 } 2482 /* 2483 * If client certificate is present and is of the same type, maybe 2484 * use it for key exchange. Don't mind errors from 2485 * EVP_PKEY_derive_set_peer, because it is completely valid to use a 2486 * client certificate for authorization only. 2487 */ 2488 client_pub_pkey = X509_get0_pubkey(s->session->peer); 2489 if (client_pub_pkey) { 2490 if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0) 2491 ERR_clear_error(); 2492 } 2493 /* Decrypt session key */ 2494 sess_key_len = PACKET_remaining(pkt); 2495 if (!PACKET_get_bytes(pkt, &data, sess_key_len)) { 2496 *al = SSL_AD_INTERNAL_ERROR; 2497 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR); 2498 goto err; 2499 } 2500 if (ASN1_get_object((const unsigned char **)&data, &Tlen, &Ttag, 2501 &Tclass, sess_key_len) != V_ASN1_CONSTRUCTED 2502 || Ttag != V_ASN1_SEQUENCE || Tclass != V_ASN1_UNIVERSAL) { 2503 *al = SSL_AD_DECODE_ERROR; 2504 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED); 2505 goto err; 2506 } 2507 start = data; 2508 inlen = Tlen; 2509 if (EVP_PKEY_decrypt 2510 (pkey_ctx, premaster_secret, &outlen, start, inlen) <= 0) { 2511 *al = SSL_AD_DECODE_ERROR; 2512 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED); 2513 goto err; 2514 } 2515 /* Generate master secret */ 2516 if (!ssl_generate_master_secret(s, premaster_secret, 2517 sizeof(premaster_secret), 0)) { 2518 *al = SSL_AD_INTERNAL_ERROR; 2519 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR); 2520 goto err; 2521 } 2522 /* Check if pubkey from client certificate was used */ 2523 if (EVP_PKEY_CTX_ctrl 2524 (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0) 2525 s->statem.no_cert_verify = 1; 2526 2527 ret = 1; 2528 err: 2529 EVP_PKEY_CTX_free(pkey_ctx); 2530 return ret; 2531 #else 2532 /* Should never happen */ 2533 *al = SSL_AD_INTERNAL_ERROR; 2534 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR); 2535 return 0; 2536 #endif 2537 } 2538 2539 MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt) 2540 { 2541 int al = -1; 2542 unsigned long alg_k; 2543 2544 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 2545 2546 /* For PSK parse and retrieve identity, obtain PSK key */ 2547 if ((alg_k & SSL_PSK) && !tls_process_cke_psk_preamble(s, pkt, &al)) 2548 goto err; 2549 2550 if (alg_k & SSL_kPSK) { 2551 /* Identity extracted earlier: should be nothing left */ 2552 if (PACKET_remaining(pkt) != 0) { 2553 al = SSL_AD_HANDSHAKE_FAILURE; 2554 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, 2555 SSL_R_LENGTH_MISMATCH); 2556 goto err; 2557 } 2558 /* PSK handled by ssl_generate_master_secret */ 2559 if (!ssl_generate_master_secret(s, NULL, 0, 0)) { 2560 al = SSL_AD_INTERNAL_ERROR; 2561 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); 2562 goto err; 2563 } 2564 } else if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) { 2565 if (!tls_process_cke_rsa(s, pkt, &al)) 2566 goto err; 2567 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { 2568 if (!tls_process_cke_dhe(s, pkt, &al)) 2569 goto err; 2570 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { 2571 if (!tls_process_cke_ecdhe(s, pkt, &al)) 2572 goto err; 2573 } else if (alg_k & SSL_kSRP) { 2574 if (!tls_process_cke_srp(s, pkt, &al)) 2575 goto err; 2576 } else if (alg_k & SSL_kGOST) { 2577 if (!tls_process_cke_gost(s, pkt, &al)) 2578 goto err; 2579 } else { 2580 al = SSL_AD_HANDSHAKE_FAILURE; 2581 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, 2582 SSL_R_UNKNOWN_CIPHER_TYPE); 2583 goto err; 2584 } 2585 2586 return MSG_PROCESS_CONTINUE_PROCESSING; 2587 err: 2588 if (al != -1) 2589 ssl3_send_alert(s, SSL3_AL_FATAL, al); 2590 #ifndef OPENSSL_NO_PSK 2591 OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen); 2592 s->s3->tmp.psk = NULL; 2593 #endif 2594 ossl_statem_set_error(s); 2595 return MSG_PROCESS_ERROR; 2596 } 2597 2598 WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst) 2599 { 2600 #ifndef OPENSSL_NO_SCTP 2601 if (wst == WORK_MORE_A) { 2602 if (SSL_IS_DTLS(s)) { 2603 unsigned char sctpauthkey[64]; 2604 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; 2605 /* 2606 * Add new shared key for SCTP-Auth, will be ignored if no SCTP 2607 * used. 2608 */ 2609 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, 2610 sizeof(DTLS1_SCTP_AUTH_LABEL)); 2611 2612 if (SSL_export_keying_material(s, sctpauthkey, 2613 sizeof(sctpauthkey), labelbuffer, 2614 sizeof(labelbuffer), NULL, 0, 2615 0) <= 0) { 2616 ossl_statem_set_error(s); 2617 return WORK_ERROR;; 2618 } 2619 2620 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, 2621 sizeof(sctpauthkey), sctpauthkey); 2622 } 2623 } 2624 #endif 2625 2626 if (s->statem.no_cert_verify || !s->session->peer) { 2627 /* 2628 * No certificate verify or no peer certificate so we no longer need 2629 * the handshake_buffer 2630 */ 2631 if (!ssl3_digest_cached_records(s, 0)) { 2632 ossl_statem_set_error(s); 2633 return WORK_ERROR; 2634 } 2635 return WORK_FINISHED_CONTINUE; 2636 } else { 2637 if (!s->s3->handshake_buffer) { 2638 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE, 2639 ERR_R_INTERNAL_ERROR); 2640 ossl_statem_set_error(s); 2641 return WORK_ERROR; 2642 } 2643 /* 2644 * For sigalgs freeze the handshake buffer. If we support 2645 * extms we've done this already so this is a no-op 2646 */ 2647 if (!ssl3_digest_cached_records(s, 1)) { 2648 ossl_statem_set_error(s); 2649 return WORK_ERROR; 2650 } 2651 } 2652 2653 return WORK_FINISHED_CONTINUE; 2654 } 2655 2656 MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt) 2657 { 2658 EVP_PKEY *pkey = NULL; 2659 const unsigned char *sig, *data; 2660 #ifndef OPENSSL_NO_GOST 2661 unsigned char *gost_data = NULL; 2662 #endif 2663 int al, ret = MSG_PROCESS_ERROR; 2664 int type = 0, j; 2665 unsigned int len; 2666 X509 *peer; 2667 const EVP_MD *md = NULL; 2668 long hdatalen = 0; 2669 void *hdata; 2670 2671 EVP_MD_CTX *mctx = EVP_MD_CTX_new(); 2672 2673 if (mctx == NULL) { 2674 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE); 2675 al = SSL_AD_INTERNAL_ERROR; 2676 goto f_err; 2677 } 2678 2679 peer = s->session->peer; 2680 pkey = X509_get0_pubkey(peer); 2681 if (pkey == NULL) { 2682 al = SSL_AD_INTERNAL_ERROR; 2683 goto f_err; 2684 } 2685 2686 type = X509_certificate_type(peer, pkey); 2687 2688 if (!(type & EVP_PKT_SIGN)) { 2689 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, 2690 SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE); 2691 al = SSL_AD_ILLEGAL_PARAMETER; 2692 goto f_err; 2693 } 2694 2695 if (SSL_USE_SIGALGS(s)) { 2696 int rv; 2697 2698 if (!PACKET_get_bytes(pkt, &sig, 2)) { 2699 al = SSL_AD_DECODE_ERROR; 2700 goto f_err; 2701 } 2702 rv = tls12_check_peer_sigalg(&md, s, sig, pkey); 2703 if (rv == -1) { 2704 al = SSL_AD_INTERNAL_ERROR; 2705 goto f_err; 2706 } else if (rv == 0) { 2707 al = SSL_AD_DECODE_ERROR; 2708 goto f_err; 2709 } 2710 #ifdef SSL_DEBUG 2711 fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md)); 2712 #endif 2713 } else { 2714 /* Use default digest for this key type */ 2715 int idx = ssl_cert_type(NULL, pkey); 2716 if (idx >= 0) 2717 md = s->s3->tmp.md[idx]; 2718 if (md == NULL) { 2719 al = SSL_AD_INTERNAL_ERROR; 2720 goto f_err; 2721 } 2722 } 2723 2724 /* Check for broken implementations of GOST ciphersuites */ 2725 /* 2726 * If key is GOST and len is exactly 64 or 128, it is signature without 2727 * length field (CryptoPro implementations at least till TLS 1.2) 2728 */ 2729 #ifndef OPENSSL_NO_GOST 2730 if (!SSL_USE_SIGALGS(s) 2731 && ((PACKET_remaining(pkt) == 64 2732 && (EVP_PKEY_id(pkey) == NID_id_GostR3410_2001 2733 || EVP_PKEY_id(pkey) == NID_id_GostR3410_2012_256)) 2734 || (PACKET_remaining(pkt) == 128 2735 && EVP_PKEY_id(pkey) == NID_id_GostR3410_2012_512))) { 2736 len = PACKET_remaining(pkt); 2737 } else 2738 #endif 2739 if (!PACKET_get_net_2(pkt, &len)) { 2740 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH); 2741 al = SSL_AD_DECODE_ERROR; 2742 goto f_err; 2743 } 2744 2745 j = EVP_PKEY_size(pkey); 2746 if (((int)len > j) || ((int)PACKET_remaining(pkt) > j) 2747 || (PACKET_remaining(pkt) == 0)) { 2748 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE); 2749 al = SSL_AD_DECODE_ERROR; 2750 goto f_err; 2751 } 2752 if (!PACKET_get_bytes(pkt, &data, len)) { 2753 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH); 2754 al = SSL_AD_DECODE_ERROR; 2755 goto f_err; 2756 } 2757 2758 hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata); 2759 if (hdatalen <= 0) { 2760 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_INTERNAL_ERROR); 2761 al = SSL_AD_INTERNAL_ERROR; 2762 goto f_err; 2763 } 2764 #ifdef SSL_DEBUG 2765 fprintf(stderr, "Using client verify alg %s\n", EVP_MD_name(md)); 2766 #endif 2767 if (!EVP_VerifyInit_ex(mctx, md, NULL) 2768 || !EVP_VerifyUpdate(mctx, hdata, hdatalen)) { 2769 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB); 2770 al = SSL_AD_INTERNAL_ERROR; 2771 goto f_err; 2772 } 2773 #ifndef OPENSSL_NO_GOST 2774 { 2775 int pktype = EVP_PKEY_id(pkey); 2776 if (pktype == NID_id_GostR3410_2001 2777 || pktype == NID_id_GostR3410_2012_256 2778 || pktype == NID_id_GostR3410_2012_512) { 2779 if ((gost_data = OPENSSL_malloc(len)) == NULL) { 2780 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE); 2781 al = SSL_AD_INTERNAL_ERROR; 2782 goto f_err; 2783 } 2784 BUF_reverse(gost_data, data, len); 2785 data = gost_data; 2786 } 2787 } 2788 #endif 2789 2790 if (s->version == SSL3_VERSION 2791 && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET, 2792 s->session->master_key_length, 2793 s->session->master_key)) { 2794 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB); 2795 al = SSL_AD_INTERNAL_ERROR; 2796 goto f_err; 2797 } 2798 2799 if (EVP_VerifyFinal(mctx, data, len, pkey) <= 0) { 2800 al = SSL_AD_DECRYPT_ERROR; 2801 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_BAD_SIGNATURE); 2802 goto f_err; 2803 } 2804 2805 ret = MSG_PROCESS_CONTINUE_READING; 2806 if (0) { 2807 f_err: 2808 ssl3_send_alert(s, SSL3_AL_FATAL, al); 2809 ossl_statem_set_error(s); 2810 } 2811 BIO_free(s->s3->handshake_buffer); 2812 s->s3->handshake_buffer = NULL; 2813 EVP_MD_CTX_free(mctx); 2814 #ifndef OPENSSL_NO_GOST 2815 OPENSSL_free(gost_data); 2816 #endif 2817 return ret; 2818 } 2819 2820 MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt) 2821 { 2822 int i, al = SSL_AD_INTERNAL_ERROR, ret = MSG_PROCESS_ERROR; 2823 X509 *x = NULL; 2824 unsigned long l, llen; 2825 const unsigned char *certstart, *certbytes; 2826 STACK_OF(X509) *sk = NULL; 2827 PACKET spkt; 2828 2829 if ((sk = sk_X509_new_null()) == NULL) { 2830 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE); 2831 goto f_err; 2832 } 2833 2834 if (!PACKET_get_net_3(pkt, &llen) 2835 || !PACKET_get_sub_packet(pkt, &spkt, llen) 2836 || PACKET_remaining(pkt) != 0) { 2837 al = SSL_AD_DECODE_ERROR; 2838 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_LENGTH_MISMATCH); 2839 goto f_err; 2840 } 2841 2842 while (PACKET_remaining(&spkt) > 0) { 2843 if (!PACKET_get_net_3(&spkt, &l) 2844 || !PACKET_get_bytes(&spkt, &certbytes, l)) { 2845 al = SSL_AD_DECODE_ERROR; 2846 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 2847 SSL_R_CERT_LENGTH_MISMATCH); 2848 goto f_err; 2849 } 2850 2851 certstart = certbytes; 2852 x = d2i_X509(NULL, (const unsigned char **)&certbytes, l); 2853 if (x == NULL) { 2854 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_ASN1_LIB); 2855 goto f_err; 2856 } 2857 if (certbytes != (certstart + l)) { 2858 al = SSL_AD_DECODE_ERROR; 2859 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 2860 SSL_R_CERT_LENGTH_MISMATCH); 2861 goto f_err; 2862 } 2863 if (!sk_X509_push(sk, x)) { 2864 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE); 2865 goto f_err; 2866 } 2867 x = NULL; 2868 } 2869 2870 if (sk_X509_num(sk) <= 0) { 2871 /* TLS does not mind 0 certs returned */ 2872 if (s->version == SSL3_VERSION) { 2873 al = SSL_AD_HANDSHAKE_FAILURE; 2874 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 2875 SSL_R_NO_CERTIFICATES_RETURNED); 2876 goto f_err; 2877 } 2878 /* Fail for TLS only if we required a certificate */ 2879 else if ((s->verify_mode & SSL_VERIFY_PEER) && 2880 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) { 2881 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 2882 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); 2883 al = SSL_AD_HANDSHAKE_FAILURE; 2884 goto f_err; 2885 } 2886 /* No client certificate so digest cached records */ 2887 if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) { 2888 goto f_err; 2889 } 2890 } else { 2891 EVP_PKEY *pkey; 2892 i = ssl_verify_cert_chain(s, sk); 2893 if (i <= 0) { 2894 al = ssl_verify_alarm_type(s->verify_result); 2895 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 2896 SSL_R_CERTIFICATE_VERIFY_FAILED); 2897 goto f_err; 2898 } 2899 if (i > 1) { 2900 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, i); 2901 al = SSL_AD_HANDSHAKE_FAILURE; 2902 goto f_err; 2903 } 2904 pkey = X509_get0_pubkey(sk_X509_value(sk, 0)); 2905 if (pkey == NULL) { 2906 al = SSL3_AD_HANDSHAKE_FAILURE; 2907 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, 2908 SSL_R_UNKNOWN_CERTIFICATE_TYPE); 2909 goto f_err; 2910 } 2911 } 2912 2913 X509_free(s->session->peer); 2914 s->session->peer = sk_X509_shift(sk); 2915 s->session->verify_result = s->verify_result; 2916 2917 sk_X509_pop_free(s->session->peer_chain, X509_free); 2918 s->session->peer_chain = sk; 2919 /* 2920 * Inconsistency alert: cert_chain does *not* include the peer's own 2921 * certificate, while we do include it in statem_clnt.c 2922 */ 2923 sk = NULL; 2924 ret = MSG_PROCESS_CONTINUE_READING; 2925 goto done; 2926 2927 f_err: 2928 ssl3_send_alert(s, SSL3_AL_FATAL, al); 2929 ossl_statem_set_error(s); 2930 done: 2931 X509_free(x); 2932 sk_X509_pop_free(sk, X509_free); 2933 return ret; 2934 } 2935 2936 int tls_construct_server_certificate(SSL *s) 2937 { 2938 CERT_PKEY *cpk; 2939 2940 cpk = ssl_get_server_send_pkey(s); 2941 if (cpk == NULL) { 2942 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR); 2943 ossl_statem_set_error(s); 2944 return 0; 2945 } 2946 2947 if (!ssl3_output_cert_chain(s, cpk)) { 2948 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR); 2949 ossl_statem_set_error(s); 2950 return 0; 2951 } 2952 2953 return 1; 2954 } 2955 2956 int tls_construct_new_session_ticket(SSL *s) 2957 { 2958 unsigned char *senc = NULL; 2959 EVP_CIPHER_CTX *ctx = NULL; 2960 HMAC_CTX *hctx = NULL; 2961 unsigned char *p, *macstart; 2962 const unsigned char *const_p; 2963 int len, slen_full, slen; 2964 SSL_SESSION *sess; 2965 unsigned int hlen; 2966 SSL_CTX *tctx = s->session_ctx; 2967 unsigned char iv[EVP_MAX_IV_LENGTH]; 2968 unsigned char key_name[TLSEXT_KEYNAME_LENGTH]; 2969 int iv_len; 2970 2971 /* get session encoding length */ 2972 slen_full = i2d_SSL_SESSION(s->session, NULL); 2973 /* 2974 * Some length values are 16 bits, so forget it if session is too 2975 * long 2976 */ 2977 if (slen_full == 0 || slen_full > 0xFF00) { 2978 ossl_statem_set_error(s); 2979 return 0; 2980 } 2981 senc = OPENSSL_malloc(slen_full); 2982 if (senc == NULL) { 2983 ossl_statem_set_error(s); 2984 return 0; 2985 } 2986 2987 ctx = EVP_CIPHER_CTX_new(); 2988 hctx = HMAC_CTX_new(); 2989 if (ctx == NULL || hctx == NULL) { 2990 SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE); 2991 goto err; 2992 } 2993 2994 p = senc; 2995 if (!i2d_SSL_SESSION(s->session, &p)) 2996 goto err; 2997 2998 /* 2999 * create a fresh copy (not shared with other threads) to clean up 3000 */ 3001 const_p = senc; 3002 sess = d2i_SSL_SESSION(NULL, &const_p, slen_full); 3003 if (sess == NULL) 3004 goto err; 3005 sess->session_id_length = 0; /* ID is irrelevant for the ticket */ 3006 3007 slen = i2d_SSL_SESSION(sess, NULL); 3008 if (slen == 0 || slen > slen_full) { /* shouldn't ever happen */ 3009 SSL_SESSION_free(sess); 3010 goto err; 3011 } 3012 p = senc; 3013 if (!i2d_SSL_SESSION(sess, &p)) { 3014 SSL_SESSION_free(sess); 3015 goto err; 3016 } 3017 SSL_SESSION_free(sess); 3018 3019 /*- 3020 * Grow buffer if need be: the length calculation is as 3021 * follows handshake_header_length + 3022 * 4 (ticket lifetime hint) + 2 (ticket length) + 3023 * sizeof(keyname) + max_iv_len (iv length) + 3024 * max_enc_block_size (max encrypted session * length) + 3025 * max_md_size (HMAC) + session_length. 3026 */ 3027 if (!BUF_MEM_grow(s->init_buf, 3028 SSL_HM_HEADER_LENGTH(s) + 6 + sizeof(key_name) + 3029 EVP_MAX_IV_LENGTH + EVP_MAX_BLOCK_LENGTH + 3030 EVP_MAX_MD_SIZE + slen)) 3031 goto err; 3032 3033 p = ssl_handshake_start(s); 3034 /* 3035 * Initialize HMAC and cipher contexts. If callback present it does 3036 * all the work otherwise use generated values from parent ctx. 3037 */ 3038 if (tctx->tlsext_ticket_key_cb) { 3039 /* if 0 is returned, write an empty ticket */ 3040 int ret = tctx->tlsext_ticket_key_cb(s, key_name, iv, ctx, 3041 hctx, 1); 3042 3043 if (ret == 0) { 3044 l2n(0, p); /* timeout */ 3045 s2n(0, p); /* length */ 3046 if (!ssl_set_handshake_header 3047 (s, SSL3_MT_NEWSESSION_TICKET, p - ssl_handshake_start(s))) 3048 goto err; 3049 OPENSSL_free(senc); 3050 EVP_CIPHER_CTX_free(ctx); 3051 HMAC_CTX_free(hctx); 3052 return 1; 3053 } 3054 if (ret < 0) 3055 goto err; 3056 iv_len = EVP_CIPHER_CTX_iv_length(ctx); 3057 } else { 3058 const EVP_CIPHER *cipher = EVP_aes_256_cbc(); 3059 3060 iv_len = EVP_CIPHER_iv_length(cipher); 3061 if (RAND_bytes(iv, iv_len) <= 0) 3062 goto err; 3063 if (!EVP_EncryptInit_ex(ctx, cipher, NULL, 3064 tctx->tlsext_tick_aes_key, iv)) 3065 goto err; 3066 if (!HMAC_Init_ex(hctx, tctx->tlsext_tick_hmac_key, 3067 sizeof(tctx->tlsext_tick_hmac_key), 3068 EVP_sha256(), NULL)) 3069 goto err; 3070 memcpy(key_name, tctx->tlsext_tick_key_name, 3071 sizeof(tctx->tlsext_tick_key_name)); 3072 } 3073 3074 /* 3075 * Ticket lifetime hint (advisory only): We leave this unspecified 3076 * for resumed session (for simplicity), and guess that tickets for 3077 * new sessions will live as long as their sessions. 3078 */ 3079 l2n(s->hit ? 0 : s->session->timeout, p); 3080 3081 /* Skip ticket length for now */ 3082 p += 2; 3083 /* Output key name */ 3084 macstart = p; 3085 memcpy(p, key_name, sizeof(key_name)); 3086 p += sizeof(key_name); 3087 /* output IV */ 3088 memcpy(p, iv, iv_len); 3089 p += iv_len; 3090 /* Encrypt session data */ 3091 if (!EVP_EncryptUpdate(ctx, p, &len, senc, slen)) 3092 goto err; 3093 p += len; 3094 if (!EVP_EncryptFinal(ctx, p, &len)) 3095 goto err; 3096 p += len; 3097 3098 if (!HMAC_Update(hctx, macstart, p - macstart)) 3099 goto err; 3100 if (!HMAC_Final(hctx, p, &hlen)) 3101 goto err; 3102 3103 EVP_CIPHER_CTX_free(ctx); 3104 HMAC_CTX_free(hctx); 3105 ctx = NULL; 3106 hctx = NULL; 3107 3108 p += hlen; 3109 /* Now write out lengths: p points to end of data written */ 3110 /* Total length */ 3111 len = p - ssl_handshake_start(s); 3112 /* Skip ticket lifetime hint */ 3113 p = ssl_handshake_start(s) + 4; 3114 s2n(len - 6, p); 3115 if (!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, len)) 3116 goto err; 3117 OPENSSL_free(senc); 3118 3119 return 1; 3120 err: 3121 OPENSSL_free(senc); 3122 EVP_CIPHER_CTX_free(ctx); 3123 HMAC_CTX_free(hctx); 3124 ossl_statem_set_error(s); 3125 return 0; 3126 } 3127 3128 int tls_construct_cert_status(SSL *s) 3129 { 3130 unsigned char *p; 3131 size_t msglen; 3132 3133 /*- 3134 * Grow buffer if need be: the length calculation is as 3135 * follows handshake_header_length + 3136 * 1 (ocsp response type) + 3 (ocsp response length) 3137 * + (ocsp response) 3138 */ 3139 msglen = 4 + s->tlsext_ocsp_resplen; 3140 if (!BUF_MEM_grow(s->init_buf, SSL_HM_HEADER_LENGTH(s) + msglen)) 3141 goto err; 3142 3143 p = ssl_handshake_start(s); 3144 3145 /* status type */ 3146 *(p++) = s->tlsext_status_type; 3147 /* length of OCSP response */ 3148 l2n3(s->tlsext_ocsp_resplen, p); 3149 /* actual response */ 3150 memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen); 3151 3152 if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_STATUS, msglen)) 3153 goto err; 3154 3155 return 1; 3156 3157 err: 3158 ossl_statem_set_error(s); 3159 return 0; 3160 } 3161 3162 #ifndef OPENSSL_NO_NEXTPROTONEG 3163 /* 3164 * tls_process_next_proto reads a Next Protocol Negotiation handshake message. 3165 * It sets the next_proto member in s if found 3166 */ 3167 MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt) 3168 { 3169 PACKET next_proto, padding; 3170 size_t next_proto_len; 3171 3172 /*- 3173 * The payload looks like: 3174 * uint8 proto_len; 3175 * uint8 proto[proto_len]; 3176 * uint8 padding_len; 3177 * uint8 padding[padding_len]; 3178 */ 3179 if (!PACKET_get_length_prefixed_1(pkt, &next_proto) 3180 || !PACKET_get_length_prefixed_1(pkt, &padding) 3181 || PACKET_remaining(pkt) > 0) { 3182 SSLerr(SSL_F_TLS_PROCESS_NEXT_PROTO, SSL_R_LENGTH_MISMATCH); 3183 goto err; 3184 } 3185 3186 if (!PACKET_memdup(&next_proto, &s->next_proto_negotiated, &next_proto_len)) { 3187 s->next_proto_negotiated_len = 0; 3188 goto err; 3189 } 3190 3191 s->next_proto_negotiated_len = (unsigned char)next_proto_len; 3192 3193 return MSG_PROCESS_CONTINUE_READING; 3194 err: 3195 ossl_statem_set_error(s); 3196 return MSG_PROCESS_ERROR; 3197 } 3198 #endif 3199 3200 #define SSLV2_CIPHER_LEN 3 3201 3202 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s, 3203 PACKET *cipher_suites, 3204 STACK_OF(SSL_CIPHER) **skp, 3205 int sslv2format, int *al) 3206 { 3207 const SSL_CIPHER *c; 3208 STACK_OF(SSL_CIPHER) *sk; 3209 int n; 3210 /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */ 3211 unsigned char cipher[SSLV2_CIPHER_LEN]; 3212 3213 s->s3->send_connection_binding = 0; 3214 3215 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; 3216 3217 if (PACKET_remaining(cipher_suites) == 0) { 3218 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED); 3219 *al = SSL_AD_ILLEGAL_PARAMETER; 3220 return NULL; 3221 } 3222 3223 if (PACKET_remaining(cipher_suites) % n != 0) { 3224 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 3225 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 3226 *al = SSL_AD_DECODE_ERROR; 3227 return NULL; 3228 } 3229 3230 sk = sk_SSL_CIPHER_new_null(); 3231 if (sk == NULL) { 3232 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 3233 *al = SSL_AD_INTERNAL_ERROR; 3234 return NULL; 3235 } 3236 3237 if (sslv2format) { 3238 size_t numciphers = PACKET_remaining(cipher_suites) / n; 3239 PACKET sslv2ciphers = *cipher_suites; 3240 unsigned int leadbyte; 3241 unsigned char *raw; 3242 3243 /* 3244 * We store the raw ciphers list in SSLv3+ format so we need to do some 3245 * preprocessing to convert the list first. If there are any SSLv2 only 3246 * ciphersuites with a non-zero leading byte then we are going to 3247 * slightly over allocate because we won't store those. But that isn't a 3248 * problem. 3249 */ 3250 raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN); 3251 s->s3->tmp.ciphers_raw = raw; 3252 if (raw == NULL) { 3253 *al = SSL_AD_INTERNAL_ERROR; 3254 goto err; 3255 } 3256 for (s->s3->tmp.ciphers_rawlen = 0; 3257 PACKET_remaining(&sslv2ciphers) > 0; 3258 raw += TLS_CIPHER_LEN) { 3259 if (!PACKET_get_1(&sslv2ciphers, &leadbyte) 3260 || (leadbyte == 0 3261 && !PACKET_copy_bytes(&sslv2ciphers, raw, 3262 TLS_CIPHER_LEN)) 3263 || (leadbyte != 0 3264 && !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) { 3265 *al = SSL_AD_INTERNAL_ERROR; 3266 OPENSSL_free(s->s3->tmp.ciphers_raw); 3267 s->s3->tmp.ciphers_raw = NULL; 3268 s->s3->tmp.ciphers_rawlen = 0; 3269 goto err; 3270 } 3271 if (leadbyte == 0) 3272 s->s3->tmp.ciphers_rawlen += TLS_CIPHER_LEN; 3273 } 3274 } else if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw, 3275 &s->s3->tmp.ciphers_rawlen)) { 3276 *al = SSL_AD_INTERNAL_ERROR; 3277 goto err; 3278 } 3279 3280 while (PACKET_copy_bytes(cipher_suites, cipher, n)) { 3281 /* 3282 * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the 3283 * first byte set to zero, while true SSLv2 ciphers have a non-zero 3284 * first byte. We don't support any true SSLv2 ciphers, so skip them. 3285 */ 3286 if (sslv2format && cipher[0] != '\0') 3287 continue; 3288 3289 /* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */ 3290 if ((cipher[n - 2] == ((SSL3_CK_SCSV >> 8) & 0xff)) && 3291 (cipher[n - 1] == (SSL3_CK_SCSV & 0xff))) { 3292 /* SCSV fatal if renegotiating */ 3293 if (s->renegotiate) { 3294 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 3295 SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING); 3296 *al = SSL_AD_HANDSHAKE_FAILURE; 3297 goto err; 3298 } 3299 s->s3->send_connection_binding = 1; 3300 continue; 3301 } 3302 3303 /* Check for TLS_FALLBACK_SCSV */ 3304 if ((cipher[n - 2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) && 3305 (cipher[n - 1] == (SSL3_CK_FALLBACK_SCSV & 0xff))) { 3306 /* 3307 * The SCSV indicates that the client previously tried a higher 3308 * version. Fail if the current version is an unexpected 3309 * downgrade. 3310 */ 3311 if (!ssl_check_version_downgrade(s)) { 3312 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 3313 SSL_R_INAPPROPRIATE_FALLBACK); 3314 *al = SSL_AD_INAPPROPRIATE_FALLBACK; 3315 goto err; 3316 } 3317 continue; 3318 } 3319 3320 /* For SSLv2-compat, ignore leading 0-byte. */ 3321 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher); 3322 if (c != NULL) { 3323 if (!sk_SSL_CIPHER_push(sk, c)) { 3324 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 3325 *al = SSL_AD_INTERNAL_ERROR; 3326 goto err; 3327 } 3328 } 3329 } 3330 if (PACKET_remaining(cipher_suites) > 0) { 3331 *al = SSL_AD_INTERNAL_ERROR; 3332 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_INTERNAL_ERROR); 3333 goto err; 3334 } 3335 3336 *skp = sk; 3337 return sk; 3338 err: 3339 sk_SSL_CIPHER_free(sk); 3340 return NULL; 3341 } 3342