xref: /openbsd-src/lib/libssl/tls13_legacy.c (revision 1a8dbaac879b9f3335ad7fb25429ce63ac1d6bac) 
1 /*	$OpenBSD: tls13_legacy.c,v 1.18 2020/10/11 12:45:52 guenther Exp $ */
2 /*
3  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <limits.h>
19 
20 #include "ssl_locl.h"
21 #include "tls13_internal.h"
22 
23 static ssize_t
24 tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len)
25 {
26 	int n;
27 
28 	if (ssl->rbio == NULL) {
29 		SSLerror(ssl, SSL_R_BIO_NOT_SET);
30 		return TLS13_IO_FAILURE;
31 	}
32 
33 	ssl->internal->rwstate = SSL_READING;
34 	errno = 0;
35 
36 	if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) {
37 		if (BIO_should_read(ssl->rbio))
38 			return TLS13_IO_WANT_POLLIN;
39 		if (BIO_should_write(ssl->rbio))
40 			return TLS13_IO_WANT_POLLOUT;
41 		if (n == 0)
42 			return TLS13_IO_EOF;
43 
44 		if (ERR_peek_error() == 0 && errno != 0)
45 			SYSerror(errno);
46 
47 		return TLS13_IO_FAILURE;
48 	}
49 
50 	if (n == len)
51 		ssl->internal->rwstate = SSL_NOTHING;
52 
53 	return n;
54 }
55 
56 ssize_t
57 tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg)
58 {
59 	struct tls13_ctx *ctx = arg;
60 
61 	return tls13_legacy_wire_read(ctx->ssl, buf, n);
62 }
63 
64 static ssize_t
65 tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len)
66 {
67 	int n;
68 
69 	if (ssl->wbio == NULL) {
70 		SSLerror(ssl, SSL_R_BIO_NOT_SET);
71 		return TLS13_IO_FAILURE;
72 	}
73 
74 	ssl->internal->rwstate = SSL_WRITING;
75 	errno = 0;
76 
77 	if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) {
78 		if (BIO_should_read(ssl->wbio))
79 			return TLS13_IO_WANT_POLLIN;
80 		if (BIO_should_write(ssl->wbio))
81 			return TLS13_IO_WANT_POLLOUT;
82 
83 		if (ERR_peek_error() == 0 && errno != 0)
84 			SYSerror(errno);
85 
86 		return TLS13_IO_FAILURE;
87 	}
88 
89 	if (n == len)
90 		ssl->internal->rwstate = SSL_NOTHING;
91 
92 	return n;
93 }
94 
95 ssize_t
96 tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg)
97 {
98 	struct tls13_ctx *ctx = arg;
99 
100 	return tls13_legacy_wire_write(ctx->ssl, buf, n);
101 }
102 
103 static void
104 tls13_legacy_error(SSL *ssl)
105 {
106 	struct tls13_ctx *ctx = ssl->internal->tls13;
107 	int reason = SSL_R_UNKNOWN;
108 
109 	/* If we received a fatal alert we already put an error on the stack. */
110 	if (S3I(ssl)->fatal_alert != 0)
111 		return;
112 
113 	switch (ctx->error.code) {
114 	case TLS13_ERR_VERIFY_FAILED:
115 		reason = SSL_R_CERTIFICATE_VERIFY_FAILED;
116 		break;
117 	case TLS13_ERR_HRR_FAILED:
118 		reason = SSL_R_NO_CIPHERS_AVAILABLE;
119 		break;
120 	case TLS13_ERR_TRAILING_DATA:
121 		reason = SSL_R_EXTRA_DATA_IN_MESSAGE;
122 		break;
123 	case TLS13_ERR_NO_SHARED_CIPHER:
124 		reason = SSL_R_NO_SHARED_CIPHER;
125 		break;
126 	case TLS13_ERR_NO_CERTIFICATE:
127 		reason = SSL_R_MISSING_RSA_CERTIFICATE; /* XXX */
128 		break;
129 	case TLS13_ERR_NO_PEER_CERTIFICATE:
130 		reason = SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE;
131 		break;
132 	}
133 
134 	/* Something (probably libcrypto) already pushed an error on the stack. */
135 	if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0)
136 		return;
137 
138 	ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file,
139 	    ctx->error.line);
140 }
141 
142 int
143 tls13_legacy_return_code(SSL *ssl, ssize_t ret)
144 {
145 	if (ret > INT_MAX) {
146 		SSLerror(ssl, ERR_R_INTERNAL_ERROR);
147 		return -1;
148 	}
149 
150 	/* A successful read, write or other operation. */
151 	if (ret > 0)
152 		return ret;
153 
154 	ssl->internal->rwstate = SSL_NOTHING;
155 
156 	switch (ret) {
157 	case TLS13_IO_EOF:
158 		return 0;
159 
160 	case TLS13_IO_FAILURE:
161 		tls13_legacy_error(ssl);
162 		return -1;
163 
164 	case TLS13_IO_ALERT:
165 		tls13_legacy_error(ssl);
166 		return -1;
167 
168 	case TLS13_IO_WANT_POLLIN:
169 		BIO_set_retry_read(ssl->rbio);
170 		ssl->internal->rwstate = SSL_READING;
171 		return -1;
172 
173 	case TLS13_IO_WANT_POLLOUT:
174 		BIO_set_retry_write(ssl->wbio);
175 		ssl->internal->rwstate = SSL_WRITING;
176 		return -1;
177 
178 	case TLS13_IO_WANT_RETRY:
179 		SSLerror(ssl, ERR_R_INTERNAL_ERROR);
180 		return -1;
181 	}
182 
183 	SSLerror(ssl, ERR_R_INTERNAL_ERROR);
184 	return -1;
185 }
186 
187 int
188 tls13_legacy_pending(const SSL *ssl)
189 {
190 	struct tls13_ctx *ctx = ssl->internal->tls13;
191 	ssize_t ret;
192 
193 	if (ctx == NULL)
194 		return 0;
195 
196 	ret = tls13_pending_application_data(ctx->rl);
197 	if (ret < 0 || ret > INT_MAX)
198 		return 0;
199 
200 	return ret;
201 }
202 
203 int
204 tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek)
205 {
206 	struct tls13_ctx *ctx = ssl->internal->tls13;
207 	ssize_t ret;
208 
209 	if (ctx == NULL || !ctx->handshake_completed) {
210 		if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
211 			return ret;
212 		return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN);
213 	}
214 
215 	tls13_record_layer_set_retry_after_phh(ctx->rl,
216 	    (ctx->ssl->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
217 
218 	if (type != SSL3_RT_APPLICATION_DATA) {
219 		SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
220 		return -1;
221 	}
222 	if (len < 0) {
223 		SSLerror(ssl, SSL_R_BAD_LENGTH);
224 		return -1;
225 	}
226 
227 	if (peek)
228 		ret = tls13_peek_application_data(ctx->rl, buf, len);
229 	else
230 		ret = tls13_read_application_data(ctx->rl, buf, len);
231 
232 	return tls13_legacy_return_code(ssl, ret);
233 }
234 
235 int
236 tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len)
237 {
238 	struct tls13_ctx *ctx = ssl->internal->tls13;
239 	const uint8_t *buf = vbuf;
240 	size_t n, sent;
241 	ssize_t ret;
242 
243 	if (ctx == NULL || !ctx->handshake_completed) {
244 		if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
245 			return ret;
246 		return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT);
247 	}
248 
249 	if (type != SSL3_RT_APPLICATION_DATA) {
250 		SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
251 		return -1;
252 	}
253 	if (len < 0) {
254 		SSLerror(ssl, SSL_R_BAD_LENGTH);
255 		return -1;
256 	}
257 
258 	/*
259 	 * The TLSv1.3 record layer write behaviour is the same as
260 	 * SSL_MODE_ENABLE_PARTIAL_WRITE.
261 	 */
262 	if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) {
263 		ret = tls13_write_application_data(ctx->rl, buf, len);
264 		return tls13_legacy_return_code(ssl, ret);
265 	}
266 
267 	/*
268  	 * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until
269 	 * we have written out all of the requested data.
270 	 */
271 	sent = S3I(ssl)->wnum;
272 	if (len < sent) {
273 		SSLerror(ssl, SSL_R_BAD_LENGTH);
274 		return -1;
275 	}
276 	n = len - sent;
277 	for (;;) {
278 		if (n == 0) {
279 			S3I(ssl)->wnum = 0;
280 			return sent;
281 		}
282 		if ((ret = tls13_write_application_data(ctx->rl,
283 		    &buf[sent], n)) <= 0) {
284 			S3I(ssl)->wnum = sent;
285 			return tls13_legacy_return_code(ssl, ret);
286 		}
287 		sent += ret;
288 		n -= ret;
289 	}
290 }
291 
292 static int
293 tls13_use_legacy_stack(struct tls13_ctx *ctx)
294 {
295 	SSL *s = ctx->ssl;
296 	CBB cbb, fragment;
297 	CBS cbs;
298 
299 	memset(&cbb, 0, sizeof(cbb));
300 
301 	s->method = tls_legacy_method();
302 
303 	if (!ssl3_setup_init_buffer(s))
304 		goto err;
305 	if (!ssl3_setup_buffers(s))
306 		goto err;
307 	if (!ssl_init_wbio_buffer(s, 1))
308 		goto err;
309 
310 	/* Stash any unprocessed data from the last record. */
311 	tls13_record_layer_rbuf(ctx->rl, &cbs);
312 	if (CBS_len(&cbs) > 0) {
313 		if (!CBB_init_fixed(&cbb, S3I(s)->rbuf.buf,
314 		    S3I(s)->rbuf.len))
315 			goto err;
316 		if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE))
317 			goto err;
318 		if (!CBB_add_u16(&cbb, TLS1_2_VERSION))
319 			goto err;
320 		if (!CBB_add_u16_length_prefixed(&cbb, &fragment))
321 			goto err;
322 		if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs)))
323 			goto err;
324 		if (!CBB_finish(&cbb, NULL, NULL))
325 			goto err;
326 
327 		S3I(s)->rbuf.offset = SSL3_RT_HEADER_LENGTH;
328 		S3I(s)->rbuf.left = CBS_len(&cbs);
329 		S3I(s)->rrec.type = SSL3_RT_HANDSHAKE;
330 		S3I(s)->rrec.length = CBS_len(&cbs);
331 		s->internal->rstate = SSL_ST_READ_BODY;
332 		s->internal->packet = S3I(s)->rbuf.buf;
333 		s->internal->packet_length = SSL3_RT_HEADER_LENGTH;
334 		s->internal->mac_packet = 1;
335 	}
336 
337 	/* Stash the current handshake message. */
338 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
339 	if (!BUF_MEM_grow_clean(s->internal->init_buf, CBS_len(&cbs)))
340 		goto err;
341 	if (!CBS_write_bytes(&cbs, s->internal->init_buf->data,
342 	    s->internal->init_buf->length, NULL))
343 		goto err;
344 
345 	S3I(s)->tmp.reuse_message = 1;
346 	S3I(s)->tmp.message_type = tls13_handshake_msg_type(ctx->hs_msg);
347 	S3I(s)->tmp.message_size = CBS_len(&cbs);
348 
349 	return 1;
350 
351  err:
352 	CBB_cleanup(&cbb);
353 
354 	return 0;
355 }
356 
357 int
358 tls13_use_legacy_client(struct tls13_ctx *ctx)
359 {
360 	SSL *s = ctx->ssl;
361 
362 	if (!tls13_use_legacy_stack(ctx))
363 		return 0;
364 
365 	s->internal->handshake_func = s->method->internal->ssl_connect;
366 	s->client_version = s->version = s->method->internal->max_version;
367 
368 	S3I(s)->hs.state = SSL3_ST_CR_SRVR_HELLO_A;
369 
370 	return 1;
371 }
372 
373 int
374 tls13_use_legacy_server(struct tls13_ctx *ctx)
375 {
376 	SSL *s = ctx->ssl;
377 
378 	if (!tls13_use_legacy_stack(ctx))
379 		return 0;
380 
381 	s->internal->handshake_func = s->method->internal->ssl_accept;
382 	s->client_version = s->version = s->method->internal->max_version;
383 	s->server = 1;
384 
385 	S3I(s)->hs.state = SSL3_ST_SR_CLNT_HELLO_A;
386 
387 	return 1;
388 }
389 
390 int
391 tls13_legacy_accept(SSL *ssl)
392 {
393 	struct tls13_ctx *ctx = ssl->internal->tls13;
394 	int ret;
395 
396 	if (ctx == NULL) {
397 		if ((ctx = tls13_ctx_new(TLS13_HS_SERVER)) == NULL) {
398 			SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
399 			return -1;
400 		}
401 		ssl->internal->tls13 = ctx;
402 		ctx->ssl = ssl;
403 		ctx->hs = &S3I(ssl)->hs_tls13;
404 
405 		if (!tls13_server_init(ctx)) {
406 			if (ERR_peek_error() == 0)
407 				SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
408 			return -1;
409 		}
410 	}
411 
412 	ERR_clear_error();
413 	S3I(ssl)->hs.state = SSL_ST_ACCEPT;
414 
415 	ret = tls13_server_accept(ctx);
416 	if (ret == TLS13_IO_USE_LEGACY)
417 		return ssl->method->internal->ssl_accept(ssl);
418 	if (ret == TLS13_IO_SUCCESS)
419 		S3I(ssl)->hs.state = SSL_ST_OK;
420 
421 	return tls13_legacy_return_code(ssl, ret);
422 }
423 
424 int
425 tls13_legacy_connect(SSL *ssl)
426 {
427 	struct tls13_ctx *ctx = ssl->internal->tls13;
428 	int ret;
429 
430 #ifdef TLS13_USE_LEGACY_CLIENT_AUTH
431 	/* XXX drop back to legacy for client auth for now */
432 	if (ssl->cert->key->privatekey != NULL) {
433 		ssl->method = tls_legacy_client_method();
434 		return ssl->method->internal->ssl_connect(ssl);
435 	}
436 #endif
437 
438 	if (ctx == NULL) {
439 		if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT)) == NULL) {
440 			SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
441 			return -1;
442 		}
443 		ssl->internal->tls13 = ctx;
444 		ctx->ssl = ssl;
445 		ctx->hs = &S3I(ssl)->hs_tls13;
446 
447 		if (!tls13_client_init(ctx)) {
448 			if (ERR_peek_error() == 0)
449 				SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
450 			return -1;
451 		}
452 	}
453 
454 	ERR_clear_error();
455 	S3I(ssl)->hs.state = SSL_ST_CONNECT;
456 
457 	ret = tls13_client_connect(ctx);
458 	if (ret == TLS13_IO_USE_LEGACY)
459 		return ssl->method->internal->ssl_connect(ssl);
460 	if (ret == TLS13_IO_SUCCESS)
461 		S3I(ssl)->hs.state = SSL_ST_OK;
462 
463 	return tls13_legacy_return_code(ssl, ret);
464 }
465 
466 int
467 tls13_legacy_shutdown(SSL *ssl)
468 {
469 	struct tls13_ctx *ctx = ssl->internal->tls13;
470 	uint8_t buf[512]; /* XXX */
471 	ssize_t ret;
472 
473 	/*
474 	 * We need to return 0 when we have sent a close-notify but have not
475 	 * yet received one. We return 1 only once we have sent and received
476 	 * close-notify alerts. All other cases return -1 and set internal
477 	 * state appropriately.
478 	 */
479 	if (ctx == NULL || ssl->internal->quiet_shutdown) {
480 		ssl->internal->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN;
481 		return 1;
482 	}
483 
484 	if (!ctx->close_notify_sent) {
485 		/* Enqueue and send close notify. */
486 		if (!(ssl->internal->shutdown & SSL_SENT_SHUTDOWN)) {
487 			ssl->internal->shutdown |= SSL_SENT_SHUTDOWN;
488 			if ((ret = tls13_send_alert(ctx->rl,
489 			    TLS13_ALERT_CLOSE_NOTIFY)) < 0)
490 				return tls13_legacy_return_code(ssl, ret);
491 		}
492 		if ((ret = tls13_record_layer_send_pending(ctx->rl)) !=
493 		    TLS13_IO_SUCCESS)
494 			return tls13_legacy_return_code(ssl, ret);
495 	} else if (!ctx->close_notify_recv) {
496 		/*
497 		 * If there is no application data pending, attempt to read more
498 		 * data in order to receive a close notify. This should trigger
499 		 * a record to be read from the wire, which may be application
500 		 * handshake or alert data. Only one attempt is made to match
501 		 * previous semantics.
502 		 */
503 		if (tls13_pending_application_data(ctx->rl) == 0) {
504 			if ((ret = tls13_read_application_data(ctx->rl, buf,
505 			    sizeof(buf))) < 0)
506 				return tls13_legacy_return_code(ssl, ret);
507 		}
508 	}
509 
510 	if (ctx->close_notify_recv)
511 		return 1;
512 
513 	return 0;
514 }
515 
516 int
517 tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert)
518 {
519 	int legacy_alert = SSL_AD_UNRECOGNIZED_NAME;
520 	int ret = SSL_TLSEXT_ERR_NOACK;
521 	SSL_CTX *ssl_ctx = ctx->ssl->ctx;
522 	SSL *ssl = ctx->ssl;
523 
524 	if (ssl_ctx->internal->tlsext_servername_callback == NULL)
525 		ssl_ctx = ssl->initial_ctx;
526 	if (ssl_ctx->internal->tlsext_servername_callback == NULL)
527 		return 1;
528 
529 	ret = ssl_ctx->internal->tlsext_servername_callback(ssl, &legacy_alert,
530 	    ssl_ctx->internal->tlsext_servername_arg);
531 
532 	if (ret == SSL_TLSEXT_ERR_ALERT_FATAL ||
533 	    ret == SSL_TLSEXT_ERR_ALERT_WARNING) {
534 		if (legacy_alert >= 0 && legacy_alert <= 255)
535 			*alert = legacy_alert;
536 		return 0;
537 	}
538 
539 	return 1;
540 }
541