xref: /openbsd-src/lib/libssl/tls13_legacy.c (revision 824adb5411e4389b29bae28eba5c2c2bbd147f34) 
1 /*	$OpenBSD: tls13_legacy.c,v 1.31 2021/09/16 19:25:30 jsing Exp $ */
2 /*
3  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <limits.h>
19 
20 #include "ssl_locl.h"
21 #include "tls13_internal.h"
22 
23 static ssize_t
24 tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len)
25 {
26 	int n;
27 
28 	if (ssl->rbio == NULL) {
29 		SSLerror(ssl, SSL_R_BIO_NOT_SET);
30 		return TLS13_IO_FAILURE;
31 	}
32 
33 	ssl->internal->rwstate = SSL_READING;
34 	errno = 0;
35 
36 	if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) {
37 		if (BIO_should_read(ssl->rbio))
38 			return TLS13_IO_WANT_POLLIN;
39 		if (n == 0)
40 			return TLS13_IO_EOF;
41 
42 		if (ERR_peek_error() == 0 && errno != 0)
43 			SYSerror(errno);
44 
45 		return TLS13_IO_FAILURE;
46 	}
47 
48 	if (n == len)
49 		ssl->internal->rwstate = SSL_NOTHING;
50 
51 	return n;
52 }
53 
54 ssize_t
55 tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg)
56 {
57 	struct tls13_ctx *ctx = arg;
58 
59 	return tls13_legacy_wire_read(ctx->ssl, buf, n);
60 }
61 
62 static ssize_t
63 tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len)
64 {
65 	int n;
66 
67 	if (ssl->wbio == NULL) {
68 		SSLerror(ssl, SSL_R_BIO_NOT_SET);
69 		return TLS13_IO_FAILURE;
70 	}
71 
72 	ssl->internal->rwstate = SSL_WRITING;
73 	errno = 0;
74 
75 	if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) {
76 		if (BIO_should_write(ssl->wbio))
77 			return TLS13_IO_WANT_POLLOUT;
78 
79 		if (ERR_peek_error() == 0 && errno != 0)
80 			SYSerror(errno);
81 
82 		return TLS13_IO_FAILURE;
83 	}
84 
85 	if (n == len)
86 		ssl->internal->rwstate = SSL_NOTHING;
87 
88 	return n;
89 }
90 
91 ssize_t
92 tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg)
93 {
94 	struct tls13_ctx *ctx = arg;
95 
96 	return tls13_legacy_wire_write(ctx->ssl, buf, n);
97 }
98 
99 static ssize_t
100 tls13_legacy_wire_flush(SSL *ssl)
101 {
102 	if (BIO_flush(ssl->wbio) <= 0) {
103 		if (BIO_should_write(ssl->wbio))
104 			return TLS13_IO_WANT_POLLOUT;
105 
106 		if (ERR_peek_error() == 0 && errno != 0)
107 			SYSerror(errno);
108 
109 		return TLS13_IO_FAILURE;
110 	}
111 
112 	return TLS13_IO_SUCCESS;
113 }
114 
115 ssize_t
116 tls13_legacy_wire_flush_cb(void *arg)
117 {
118 	struct tls13_ctx *ctx = arg;
119 
120 	return tls13_legacy_wire_flush(ctx->ssl);
121 }
122 
123 static void
124 tls13_legacy_error(SSL *ssl)
125 {
126 	struct tls13_ctx *ctx = ssl->internal->tls13;
127 	int reason = SSL_R_UNKNOWN;
128 
129 	/* If we received a fatal alert we already put an error on the stack. */
130 	if (S3I(ssl)->fatal_alert != 0)
131 		return;
132 
133 	switch (ctx->error.code) {
134 	case TLS13_ERR_VERIFY_FAILED:
135 		reason = SSL_R_CERTIFICATE_VERIFY_FAILED;
136 		break;
137 	case TLS13_ERR_HRR_FAILED:
138 		reason = SSL_R_NO_CIPHERS_AVAILABLE;
139 		break;
140 	case TLS13_ERR_TRAILING_DATA:
141 		reason = SSL_R_EXTRA_DATA_IN_MESSAGE;
142 		break;
143 	case TLS13_ERR_NO_SHARED_CIPHER:
144 		reason = SSL_R_NO_SHARED_CIPHER;
145 		break;
146 	case TLS13_ERR_NO_CERTIFICATE:
147 		reason = SSL_R_MISSING_RSA_CERTIFICATE; /* XXX */
148 		break;
149 	case TLS13_ERR_NO_PEER_CERTIFICATE:
150 		reason = SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE;
151 		break;
152 	}
153 
154 	/* Something (probably libcrypto) already pushed an error on the stack. */
155 	if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0)
156 		return;
157 
158 	ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file,
159 	    ctx->error.line);
160 }
161 
162 int
163 tls13_legacy_return_code(SSL *ssl, ssize_t ret)
164 {
165 	if (ret > INT_MAX) {
166 		SSLerror(ssl, ERR_R_INTERNAL_ERROR);
167 		return -1;
168 	}
169 
170 	/* A successful read, write or other operation. */
171 	if (ret > 0)
172 		return ret;
173 
174 	ssl->internal->rwstate = SSL_NOTHING;
175 
176 	switch (ret) {
177 	case TLS13_IO_EOF:
178 		return 0;
179 
180 	case TLS13_IO_FAILURE:
181 		tls13_legacy_error(ssl);
182 		return -1;
183 
184 	case TLS13_IO_ALERT:
185 		tls13_legacy_error(ssl);
186 		return -1;
187 
188 	case TLS13_IO_WANT_POLLIN:
189 		BIO_set_retry_read(ssl->rbio);
190 		ssl->internal->rwstate = SSL_READING;
191 		return -1;
192 
193 	case TLS13_IO_WANT_POLLOUT:
194 		BIO_set_retry_write(ssl->wbio);
195 		ssl->internal->rwstate = SSL_WRITING;
196 		return -1;
197 
198 	case TLS13_IO_WANT_RETRY:
199 		SSLerror(ssl, ERR_R_INTERNAL_ERROR);
200 		return -1;
201 	}
202 
203 	SSLerror(ssl, ERR_R_INTERNAL_ERROR);
204 	return -1;
205 }
206 
207 int
208 tls13_legacy_pending(const SSL *ssl)
209 {
210 	struct tls13_ctx *ctx = ssl->internal->tls13;
211 	ssize_t ret;
212 
213 	if (ctx == NULL)
214 		return 0;
215 
216 	ret = tls13_pending_application_data(ctx->rl);
217 	if (ret < 0 || ret > INT_MAX)
218 		return 0;
219 
220 	return ret;
221 }
222 
223 int
224 tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek)
225 {
226 	struct tls13_ctx *ctx = ssl->internal->tls13;
227 	ssize_t ret;
228 
229 	if (ctx == NULL || !ctx->handshake_completed) {
230 		if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
231 			return ret;
232 		return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN);
233 	}
234 
235 	tls13_record_layer_set_retry_after_phh(ctx->rl,
236 	    (ctx->ssl->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
237 
238 	if (type != SSL3_RT_APPLICATION_DATA) {
239 		SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
240 		return -1;
241 	}
242 	if (len < 0) {
243 		SSLerror(ssl, SSL_R_BAD_LENGTH);
244 		return -1;
245 	}
246 
247 	if (peek)
248 		ret = tls13_peek_application_data(ctx->rl, buf, len);
249 	else
250 		ret = tls13_read_application_data(ctx->rl, buf, len);
251 
252 	return tls13_legacy_return_code(ssl, ret);
253 }
254 
255 int
256 tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len)
257 {
258 	struct tls13_ctx *ctx = ssl->internal->tls13;
259 	const uint8_t *buf = vbuf;
260 	size_t n, sent;
261 	ssize_t ret;
262 
263 	if (ctx == NULL || !ctx->handshake_completed) {
264 		if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
265 			return ret;
266 		return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT);
267 	}
268 
269 	if (type != SSL3_RT_APPLICATION_DATA) {
270 		SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
271 		return -1;
272 	}
273 	if (len < 0) {
274 		SSLerror(ssl, SSL_R_BAD_LENGTH);
275 		return -1;
276 	}
277 
278 	/*
279 	 * The TLSv1.3 record layer write behaviour is the same as
280 	 * SSL_MODE_ENABLE_PARTIAL_WRITE.
281 	 */
282 	if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) {
283 		ret = tls13_write_application_data(ctx->rl, buf, len);
284 		return tls13_legacy_return_code(ssl, ret);
285 	}
286 
287 	/*
288 	 * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until
289 	 * we have written out all of the requested data.
290 	 */
291 	sent = S3I(ssl)->wnum;
292 	if (len < sent) {
293 		SSLerror(ssl, SSL_R_BAD_LENGTH);
294 		return -1;
295 	}
296 	n = len - sent;
297 	for (;;) {
298 		if (n == 0) {
299 			S3I(ssl)->wnum = 0;
300 			return sent;
301 		}
302 		if ((ret = tls13_write_application_data(ctx->rl,
303 		    &buf[sent], n)) <= 0) {
304 			S3I(ssl)->wnum = sent;
305 			return tls13_legacy_return_code(ssl, ret);
306 		}
307 		sent += ret;
308 		n -= ret;
309 	}
310 }
311 
312 static int
313 tls13_use_legacy_stack(struct tls13_ctx *ctx)
314 {
315 	SSL *s = ctx->ssl;
316 	CBB cbb, fragment;
317 	CBS cbs;
318 
319 	memset(&cbb, 0, sizeof(cbb));
320 
321 	s->method = tls_legacy_method();
322 
323 	if (!ssl3_setup_init_buffer(s))
324 		goto err;
325 	if (!ssl3_setup_buffers(s))
326 		goto err;
327 	if (!ssl_init_wbio_buffer(s, 1))
328 		goto err;
329 
330 	/* Stash any unprocessed data from the last record. */
331 	tls13_record_layer_rcontent(ctx->rl, &cbs);
332 	if (CBS_len(&cbs) > 0) {
333 		if (!CBB_init_fixed(&cbb, S3I(s)->rbuf.buf,
334 		    S3I(s)->rbuf.len))
335 			goto err;
336 		if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE))
337 			goto err;
338 		if (!CBB_add_u16(&cbb, TLS1_2_VERSION))
339 			goto err;
340 		if (!CBB_add_u16_length_prefixed(&cbb, &fragment))
341 			goto err;
342 		if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs)))
343 			goto err;
344 		if (!CBB_finish(&cbb, NULL, NULL))
345 			goto err;
346 
347 		S3I(s)->rbuf.offset = SSL3_RT_HEADER_LENGTH;
348 		S3I(s)->rbuf.left = CBS_len(&cbs);
349 		S3I(s)->rrec.type = SSL3_RT_HANDSHAKE;
350 		S3I(s)->rrec.length = CBS_len(&cbs);
351 		s->internal->rstate = SSL_ST_READ_BODY;
352 		s->internal->packet = S3I(s)->rbuf.buf;
353 		s->internal->packet_length = SSL3_RT_HEADER_LENGTH;
354 		s->internal->mac_packet = 1;
355 	}
356 
357 	/* Stash the current handshake message. */
358 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
359 	if (!BUF_MEM_grow_clean(s->internal->init_buf, CBS_len(&cbs)))
360 		goto err;
361 	if (!CBS_write_bytes(&cbs, s->internal->init_buf->data,
362 	    s->internal->init_buf->length, NULL))
363 		goto err;
364 
365 	S3I(s)->hs.tls12.reuse_message = 1;
366 	S3I(s)->hs.tls12.message_type = tls13_handshake_msg_type(ctx->hs_msg);
367 	S3I(s)->hs.tls12.message_size = CBS_len(&cbs) - SSL3_HM_HEADER_LENGTH;
368 
369 	return 1;
370 
371  err:
372 	CBB_cleanup(&cbb);
373 
374 	return 0;
375 }
376 
377 int
378 tls13_use_legacy_client(struct tls13_ctx *ctx)
379 {
380 	SSL *s = ctx->ssl;
381 
382 	if (!tls13_use_legacy_stack(ctx))
383 		return 0;
384 
385 	s->internal->handshake_func = s->method->ssl_connect;
386 	s->client_version = s->version = s->method->max_tls_version;
387 
388 	return 1;
389 }
390 
391 int
392 tls13_use_legacy_server(struct tls13_ctx *ctx)
393 {
394 	SSL *s = ctx->ssl;
395 
396 	if (!tls13_use_legacy_stack(ctx))
397 		return 0;
398 
399 	s->internal->handshake_func = s->method->ssl_accept;
400 	s->client_version = s->version = s->method->max_tls_version;
401 	s->server = 1;
402 
403 	return 1;
404 }
405 
406 int
407 tls13_legacy_accept(SSL *ssl)
408 {
409 	struct tls13_ctx *ctx = ssl->internal->tls13;
410 	int ret;
411 
412 	if (ctx == NULL) {
413 		if ((ctx = tls13_ctx_new(TLS13_HS_SERVER)) == NULL) {
414 			SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
415 			return -1;
416 		}
417 		ssl->internal->tls13 = ctx;
418 		ctx->ssl = ssl;
419 		ctx->hs = &S3I(ssl)->hs;
420 
421 		if (!tls13_server_init(ctx)) {
422 			if (ERR_peek_error() == 0)
423 				SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
424 			return -1;
425 		}
426 	}
427 
428 	ERR_clear_error();
429 
430 	ret = tls13_server_accept(ctx);
431 	if (ret == TLS13_IO_USE_LEGACY)
432 		return ssl->method->ssl_accept(ssl);
433 
434 	ret = tls13_legacy_return_code(ssl, ret);
435 
436 	if (ctx->info_cb != NULL)
437 		ctx->info_cb(ctx, TLS13_INFO_ACCEPT_EXIT, ret);
438 
439 	return ret;
440 }
441 
442 int
443 tls13_legacy_connect(SSL *ssl)
444 {
445 	struct tls13_ctx *ctx = ssl->internal->tls13;
446 	int ret;
447 
448 #ifdef TLS13_USE_LEGACY_CLIENT_AUTH
449 	/* XXX drop back to legacy for client auth for now */
450 	if (ssl->cert->key->privatekey != NULL) {
451 		ssl->method = tls_legacy_client_method();
452 		return ssl->method->ssl_connect(ssl);
453 	}
454 #endif
455 
456 	if (ctx == NULL) {
457 		if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT)) == NULL) {
458 			SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
459 			return -1;
460 		}
461 		ssl->internal->tls13 = ctx;
462 		ctx->ssl = ssl;
463 		ctx->hs = &S3I(ssl)->hs;
464 
465 		if (!tls13_client_init(ctx)) {
466 			if (ERR_peek_error() == 0)
467 				SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
468 			return -1;
469 		}
470 	}
471 
472 	ERR_clear_error();
473 
474 	ret = tls13_client_connect(ctx);
475 	if (ret == TLS13_IO_USE_LEGACY)
476 		return ssl->method->ssl_connect(ssl);
477 
478 	ret = tls13_legacy_return_code(ssl, ret);
479 
480 	if (ctx->info_cb != NULL)
481 		ctx->info_cb(ctx, TLS13_INFO_CONNECT_EXIT, ret);
482 
483 	return ret;
484 }
485 
486 int
487 tls13_legacy_shutdown(SSL *ssl)
488 {
489 	struct tls13_ctx *ctx = ssl->internal->tls13;
490 	uint8_t buf[512]; /* XXX */
491 	ssize_t ret;
492 
493 	/*
494 	 * We need to return 0 when we have sent a close-notify but have not
495 	 * yet received one. We return 1 only once we have sent and received
496 	 * close-notify alerts. All other cases return -1 and set internal
497 	 * state appropriately.
498 	 */
499 	if (ctx == NULL || ssl->internal->quiet_shutdown) {
500 		ssl->internal->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN;
501 		return 1;
502 	}
503 
504 	if (!ctx->close_notify_sent) {
505 		/* Enqueue and send close notify. */
506 		if (!(ssl->internal->shutdown & SSL_SENT_SHUTDOWN)) {
507 			ssl->internal->shutdown |= SSL_SENT_SHUTDOWN;
508 			if ((ret = tls13_send_alert(ctx->rl,
509 			    TLS13_ALERT_CLOSE_NOTIFY)) < 0)
510 				return tls13_legacy_return_code(ssl, ret);
511 		}
512 		if ((ret = tls13_record_layer_send_pending(ctx->rl)) !=
513 		    TLS13_IO_SUCCESS)
514 			return tls13_legacy_return_code(ssl, ret);
515 	} else if (!ctx->close_notify_recv) {
516 		/*
517 		 * If there is no application data pending, attempt to read more
518 		 * data in order to receive a close notify. This should trigger
519 		 * a record to be read from the wire, which may be application
520 		 * handshake or alert data. Only one attempt is made to match
521 		 * previous semantics.
522 		 */
523 		if (tls13_pending_application_data(ctx->rl) == 0) {
524 			if ((ret = tls13_read_application_data(ctx->rl, buf,
525 			    sizeof(buf))) < 0)
526 				return tls13_legacy_return_code(ssl, ret);
527 		}
528 	}
529 
530 	if (ctx->close_notify_recv)
531 		return 1;
532 
533 	return 0;
534 }
535 
536 int
537 tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert)
538 {
539 	int legacy_alert = SSL_AD_UNRECOGNIZED_NAME;
540 	int ret = SSL_TLSEXT_ERR_NOACK;
541 	SSL_CTX *ssl_ctx = ctx->ssl->ctx;
542 	SSL *s = ctx->ssl;
543 
544 	if (ssl_ctx->internal->tlsext_servername_callback == NULL)
545 		ssl_ctx = s->initial_ctx;
546 	if (ssl_ctx->internal->tlsext_servername_callback == NULL)
547 		return 1;
548 
549 	ret = ssl_ctx->internal->tlsext_servername_callback(s, &legacy_alert,
550 	    ssl_ctx->internal->tlsext_servername_arg);
551 
552 	/*
553 	 * Ignore SSL_TLSEXT_ERR_ALERT_WARNING returns to match OpenSSL's
554 	 * behavior: the only warning alerts in TLSv1.3 are close_notify and
555 	 * user_canceled, neither of which should be returned by the callback.
556 	 */
557 	if (ret == SSL_TLSEXT_ERR_ALERT_FATAL) {
558 		if (legacy_alert >= 0 && legacy_alert <= 255)
559 			*alert = legacy_alert;
560 		return 0;
561 	}
562 
563 	return 1;
564 }
565