1 /* $OpenBSD: tls13_legacy.c,v 1.33 2021/12/16 06:32:56 tb Exp $ */ 2 /* 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <limits.h> 19 20 #include "ssl_locl.h" 21 #include "tls13_internal.h" 22 23 static ssize_t 24 tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len) 25 { 26 int n; 27 28 if (ssl->rbio == NULL) { 29 SSLerror(ssl, SSL_R_BIO_NOT_SET); 30 return TLS13_IO_FAILURE; 31 } 32 33 ssl->internal->rwstate = SSL_READING; 34 errno = 0; 35 36 if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) { 37 if (BIO_should_read(ssl->rbio)) 38 return TLS13_IO_WANT_POLLIN; 39 if (n == 0) 40 return TLS13_IO_EOF; 41 42 if (ERR_peek_error() == 0 && errno != 0) 43 SYSerror(errno); 44 45 return TLS13_IO_FAILURE; 46 } 47 48 if (n == len) 49 ssl->internal->rwstate = SSL_NOTHING; 50 51 return n; 52 } 53 54 ssize_t 55 tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg) 56 { 57 struct tls13_ctx *ctx = arg; 58 59 return tls13_legacy_wire_read(ctx->ssl, buf, n); 60 } 61 62 static ssize_t 63 tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len) 64 { 65 int n; 66 67 if (ssl->wbio == NULL) { 68 SSLerror(ssl, SSL_R_BIO_NOT_SET); 69 return TLS13_IO_FAILURE; 70 } 71 72 ssl->internal->rwstate = SSL_WRITING; 73 errno = 0; 74 75 if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) { 76 if (BIO_should_write(ssl->wbio)) 77 return TLS13_IO_WANT_POLLOUT; 78 79 if (ERR_peek_error() == 0 && errno != 0) 80 SYSerror(errno); 81 82 return TLS13_IO_FAILURE; 83 } 84 85 if (n == len) 86 ssl->internal->rwstate = SSL_NOTHING; 87 88 return n; 89 } 90 91 ssize_t 92 tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg) 93 { 94 struct tls13_ctx *ctx = arg; 95 96 return tls13_legacy_wire_write(ctx->ssl, buf, n); 97 } 98 99 static ssize_t 100 tls13_legacy_wire_flush(SSL *ssl) 101 { 102 if (BIO_flush(ssl->wbio) <= 0) { 103 if (BIO_should_write(ssl->wbio)) 104 return TLS13_IO_WANT_POLLOUT; 105 106 if (ERR_peek_error() == 0 && errno != 0) 107 SYSerror(errno); 108 109 return TLS13_IO_FAILURE; 110 } 111 112 return TLS13_IO_SUCCESS; 113 } 114 115 ssize_t 116 tls13_legacy_wire_flush_cb(void *arg) 117 { 118 struct tls13_ctx *ctx = arg; 119 120 return tls13_legacy_wire_flush(ctx->ssl); 121 } 122 123 static void 124 tls13_legacy_error(SSL *ssl) 125 { 126 struct tls13_ctx *ctx = ssl->internal->tls13; 127 int reason = SSL_R_UNKNOWN; 128 129 /* If we received a fatal alert we already put an error on the stack. */ 130 if (S3I(ssl)->fatal_alert != 0) 131 return; 132 133 switch (ctx->error.code) { 134 case TLS13_ERR_VERIFY_FAILED: 135 reason = SSL_R_CERTIFICATE_VERIFY_FAILED; 136 break; 137 case TLS13_ERR_HRR_FAILED: 138 reason = SSL_R_NO_CIPHERS_AVAILABLE; 139 break; 140 case TLS13_ERR_TRAILING_DATA: 141 reason = SSL_R_EXTRA_DATA_IN_MESSAGE; 142 break; 143 case TLS13_ERR_NO_SHARED_CIPHER: 144 reason = SSL_R_NO_SHARED_CIPHER; 145 break; 146 case TLS13_ERR_NO_CERTIFICATE: 147 reason = SSL_R_MISSING_RSA_CERTIFICATE; /* XXX */ 148 break; 149 case TLS13_ERR_NO_PEER_CERTIFICATE: 150 reason = SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE; 151 break; 152 } 153 154 /* Something (probably libcrypto) already pushed an error on the stack. */ 155 if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0) 156 return; 157 158 ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file, 159 ctx->error.line); 160 } 161 162 int 163 tls13_legacy_return_code(SSL *ssl, ssize_t ret) 164 { 165 if (ret > INT_MAX) { 166 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 167 return -1; 168 } 169 170 /* A successful read, write or other operation. */ 171 if (ret > 0) 172 return ret; 173 174 ssl->internal->rwstate = SSL_NOTHING; 175 176 switch (ret) { 177 case TLS13_IO_EOF: 178 return 0; 179 180 case TLS13_IO_FAILURE: 181 tls13_legacy_error(ssl); 182 return -1; 183 184 case TLS13_IO_ALERT: 185 tls13_legacy_error(ssl); 186 return -1; 187 188 case TLS13_IO_WANT_POLLIN: 189 BIO_set_retry_read(ssl->rbio); 190 ssl->internal->rwstate = SSL_READING; 191 return -1; 192 193 case TLS13_IO_WANT_POLLOUT: 194 BIO_set_retry_write(ssl->wbio); 195 ssl->internal->rwstate = SSL_WRITING; 196 return -1; 197 198 case TLS13_IO_WANT_RETRY: 199 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 200 return -1; 201 } 202 203 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 204 return -1; 205 } 206 207 int 208 tls13_legacy_pending(const SSL *ssl) 209 { 210 struct tls13_ctx *ctx = ssl->internal->tls13; 211 ssize_t ret; 212 213 if (ctx == NULL) 214 return 0; 215 216 ret = tls13_pending_application_data(ctx->rl); 217 if (ret < 0 || ret > INT_MAX) 218 return 0; 219 220 return ret; 221 } 222 223 int 224 tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek) 225 { 226 struct tls13_ctx *ctx = ssl->internal->tls13; 227 ssize_t ret; 228 229 if (ctx == NULL || !ctx->handshake_completed) { 230 if ((ret = ssl->internal->handshake_func(ssl)) <= 0) 231 return ret; 232 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN); 233 } 234 235 tls13_record_layer_set_retry_after_phh(ctx->rl, 236 (ctx->ssl->internal->mode & SSL_MODE_AUTO_RETRY) != 0); 237 238 if (type != SSL3_RT_APPLICATION_DATA) { 239 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 240 return -1; 241 } 242 if (len < 0) { 243 SSLerror(ssl, SSL_R_BAD_LENGTH); 244 return -1; 245 } 246 247 if (peek) 248 ret = tls13_peek_application_data(ctx->rl, buf, len); 249 else 250 ret = tls13_read_application_data(ctx->rl, buf, len); 251 252 return tls13_legacy_return_code(ssl, ret); 253 } 254 255 int 256 tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len) 257 { 258 struct tls13_ctx *ctx = ssl->internal->tls13; 259 const uint8_t *buf = vbuf; 260 size_t n, sent; 261 ssize_t ret; 262 263 if (ctx == NULL || !ctx->handshake_completed) { 264 if ((ret = ssl->internal->handshake_func(ssl)) <= 0) 265 return ret; 266 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT); 267 } 268 269 if (type != SSL3_RT_APPLICATION_DATA) { 270 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 271 return -1; 272 } 273 if (len < 0) { 274 SSLerror(ssl, SSL_R_BAD_LENGTH); 275 return -1; 276 } 277 278 /* 279 * The TLSv1.3 record layer write behaviour is the same as 280 * SSL_MODE_ENABLE_PARTIAL_WRITE. 281 */ 282 if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) { 283 ret = tls13_write_application_data(ctx->rl, buf, len); 284 return tls13_legacy_return_code(ssl, ret); 285 } 286 287 /* 288 * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until 289 * we have written out all of the requested data. 290 */ 291 sent = S3I(ssl)->wnum; 292 if (len < sent) { 293 SSLerror(ssl, SSL_R_BAD_LENGTH); 294 return -1; 295 } 296 n = len - sent; 297 for (;;) { 298 if (n == 0) { 299 S3I(ssl)->wnum = 0; 300 return sent; 301 } 302 if ((ret = tls13_write_application_data(ctx->rl, 303 &buf[sent], n)) <= 0) { 304 S3I(ssl)->wnum = sent; 305 return tls13_legacy_return_code(ssl, ret); 306 } 307 sent += ret; 308 n -= ret; 309 } 310 } 311 312 static int 313 tls13_use_legacy_stack(struct tls13_ctx *ctx) 314 { 315 SSL *s = ctx->ssl; 316 CBB cbb, fragment; 317 CBS cbs; 318 319 memset(&cbb, 0, sizeof(cbb)); 320 321 s->method = tls_legacy_method(); 322 323 if (!ssl3_setup_init_buffer(s)) 324 goto err; 325 if (!ssl3_setup_buffers(s)) 326 goto err; 327 if (!ssl_init_wbio_buffer(s, 1)) 328 goto err; 329 330 /* Stash any unprocessed data from the last record. */ 331 tls13_record_layer_rcontent(ctx->rl, &cbs); 332 if (CBS_len(&cbs) > 0) { 333 if (!CBB_init_fixed(&cbb, S3I(s)->rbuf.buf, 334 S3I(s)->rbuf.len)) 335 goto err; 336 if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE)) 337 goto err; 338 if (!CBB_add_u16(&cbb, TLS1_2_VERSION)) 339 goto err; 340 if (!CBB_add_u16_length_prefixed(&cbb, &fragment)) 341 goto err; 342 if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs))) 343 goto err; 344 if (!CBB_finish(&cbb, NULL, NULL)) 345 goto err; 346 347 S3I(s)->rbuf.offset = SSL3_RT_HEADER_LENGTH; 348 S3I(s)->rbuf.left = CBS_len(&cbs); 349 S3I(s)->rrec.type = SSL3_RT_HANDSHAKE; 350 S3I(s)->rrec.length = CBS_len(&cbs); 351 s->internal->rstate = SSL_ST_READ_BODY; 352 s->internal->packet = S3I(s)->rbuf.buf; 353 s->internal->packet_length = SSL3_RT_HEADER_LENGTH; 354 s->internal->mac_packet = 1; 355 } 356 357 /* Stash the current handshake message. */ 358 tls13_handshake_msg_data(ctx->hs_msg, &cbs); 359 if (!BUF_MEM_grow_clean(s->internal->init_buf, CBS_len(&cbs))) 360 goto err; 361 if (!CBS_write_bytes(&cbs, s->internal->init_buf->data, 362 s->internal->init_buf->length, NULL)) 363 goto err; 364 365 S3I(s)->hs.tls12.reuse_message = 1; 366 S3I(s)->hs.tls12.message_type = tls13_handshake_msg_type(ctx->hs_msg); 367 S3I(s)->hs.tls12.message_size = CBS_len(&cbs) - SSL3_HM_HEADER_LENGTH; 368 369 return 1; 370 371 err: 372 CBB_cleanup(&cbb); 373 374 return 0; 375 } 376 377 int 378 tls13_use_legacy_client(struct tls13_ctx *ctx) 379 { 380 SSL *s = ctx->ssl; 381 382 if (!tls13_use_legacy_stack(ctx)) 383 return 0; 384 385 s->internal->handshake_func = s->method->ssl_connect; 386 s->version = s->method->max_tls_version; 387 388 return 1; 389 } 390 391 int 392 tls13_use_legacy_server(struct tls13_ctx *ctx) 393 { 394 SSL *s = ctx->ssl; 395 396 if (!tls13_use_legacy_stack(ctx)) 397 return 0; 398 399 s->internal->handshake_func = s->method->ssl_accept; 400 s->version = s->method->max_tls_version; 401 s->server = 1; 402 403 return 1; 404 } 405 406 int 407 tls13_legacy_accept(SSL *ssl) 408 { 409 struct tls13_ctx *ctx = ssl->internal->tls13; 410 int ret; 411 412 if (ctx == NULL) { 413 if ((ctx = tls13_ctx_new(TLS13_HS_SERVER)) == NULL) { 414 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 415 return -1; 416 } 417 ssl->internal->tls13 = ctx; 418 ctx->ssl = ssl; 419 ctx->hs = &S3I(ssl)->hs; 420 421 if (!tls13_server_init(ctx)) { 422 if (ERR_peek_error() == 0) 423 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 424 return -1; 425 } 426 } 427 428 ERR_clear_error(); 429 430 ret = tls13_server_accept(ctx); 431 if (ret == TLS13_IO_USE_LEGACY) 432 return ssl->method->ssl_accept(ssl); 433 434 ret = tls13_legacy_return_code(ssl, ret); 435 436 if (ctx->info_cb != NULL) 437 ctx->info_cb(ctx, TLS13_INFO_ACCEPT_EXIT, ret); 438 439 return ret; 440 } 441 442 int 443 tls13_legacy_connect(SSL *ssl) 444 { 445 struct tls13_ctx *ctx = ssl->internal->tls13; 446 int ret; 447 448 if (ctx == NULL) { 449 if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT)) == NULL) { 450 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 451 return -1; 452 } 453 ssl->internal->tls13 = ctx; 454 ctx->ssl = ssl; 455 ctx->hs = &S3I(ssl)->hs; 456 457 if (!tls13_client_init(ctx)) { 458 if (ERR_peek_error() == 0) 459 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 460 return -1; 461 } 462 } 463 464 ERR_clear_error(); 465 466 ret = tls13_client_connect(ctx); 467 if (ret == TLS13_IO_USE_LEGACY) 468 return ssl->method->ssl_connect(ssl); 469 470 ret = tls13_legacy_return_code(ssl, ret); 471 472 if (ctx->info_cb != NULL) 473 ctx->info_cb(ctx, TLS13_INFO_CONNECT_EXIT, ret); 474 475 return ret; 476 } 477 478 int 479 tls13_legacy_shutdown(SSL *ssl) 480 { 481 struct tls13_ctx *ctx = ssl->internal->tls13; 482 uint8_t buf[512]; /* XXX */ 483 ssize_t ret; 484 485 /* 486 * We need to return 0 when we have sent a close-notify but have not 487 * yet received one. We return 1 only once we have sent and received 488 * close-notify alerts. All other cases return -1 and set internal 489 * state appropriately. 490 */ 491 if (ctx == NULL || ssl->internal->quiet_shutdown) { 492 ssl->internal->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN; 493 return 1; 494 } 495 496 if (!ctx->close_notify_sent) { 497 /* Enqueue and send close notify. */ 498 if (!(ssl->internal->shutdown & SSL_SENT_SHUTDOWN)) { 499 ssl->internal->shutdown |= SSL_SENT_SHUTDOWN; 500 if ((ret = tls13_send_alert(ctx->rl, 501 TLS13_ALERT_CLOSE_NOTIFY)) < 0) 502 return tls13_legacy_return_code(ssl, ret); 503 } 504 if ((ret = tls13_record_layer_send_pending(ctx->rl)) != 505 TLS13_IO_SUCCESS) 506 return tls13_legacy_return_code(ssl, ret); 507 } else if (!ctx->close_notify_recv) { 508 /* 509 * If there is no application data pending, attempt to read more 510 * data in order to receive a close notify. This should trigger 511 * a record to be read from the wire, which may be application 512 * handshake or alert data. Only one attempt is made to match 513 * previous semantics. 514 */ 515 if (tls13_pending_application_data(ctx->rl) == 0) { 516 if ((ret = tls13_read_application_data(ctx->rl, buf, 517 sizeof(buf))) < 0) 518 return tls13_legacy_return_code(ssl, ret); 519 } 520 } 521 522 if (ctx->close_notify_recv) 523 return 1; 524 525 return 0; 526 } 527 528 int 529 tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert) 530 { 531 int legacy_alert = SSL_AD_UNRECOGNIZED_NAME; 532 int ret = SSL_TLSEXT_ERR_NOACK; 533 SSL_CTX *ssl_ctx = ctx->ssl->ctx; 534 SSL *s = ctx->ssl; 535 536 if (ssl_ctx->internal->tlsext_servername_callback == NULL) 537 ssl_ctx = s->initial_ctx; 538 if (ssl_ctx->internal->tlsext_servername_callback == NULL) 539 return 1; 540 541 ret = ssl_ctx->internal->tlsext_servername_callback(s, &legacy_alert, 542 ssl_ctx->internal->tlsext_servername_arg); 543 544 /* 545 * Ignore SSL_TLSEXT_ERR_ALERT_WARNING returns to match OpenSSL's 546 * behavior: the only warning alerts in TLSv1.3 are close_notify and 547 * user_canceled, neither of which should be returned by the callback. 548 */ 549 if (ret == SSL_TLSEXT_ERR_ALERT_FATAL) { 550 if (legacy_alert >= 0 && legacy_alert <= 255) 551 *alert = legacy_alert; 552 return 0; 553 } 554 555 return 1; 556 } 557