1 /* $OpenBSD: tls13_record_layer.c,v 1.49 2020/06/01 19:51:31 tb Exp $ */ 2 /* 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include "ssl_locl.h" 19 20 #include "tls13_internal.h" 21 #include "tls13_record.h" 22 23 static ssize_t tls13_record_layer_write_chunk(struct tls13_record_layer *rl, 24 uint8_t content_type, const uint8_t *buf, size_t n); 25 static ssize_t tls13_record_layer_write_record(struct tls13_record_layer *rl, 26 uint8_t content_type, const uint8_t *content, size_t content_len); 27 28 struct tls13_record_layer { 29 uint16_t legacy_version; 30 31 int ccs_allowed; 32 int ccs_seen; 33 int ccs_sent; 34 int handshake_completed; 35 int legacy_alerts_allowed; 36 int phh; 37 int phh_retry; 38 39 /* 40 * Read and/or write channels are closed due to an alert being 41 * sent or received. In the case of an error alert both channels 42 * are closed, whereas in the case of a close notify only one 43 * channel is closed. 44 */ 45 int read_closed; 46 int write_closed; 47 48 struct tls13_record *rrec; 49 50 struct tls13_record *wrec; 51 uint8_t wrec_content_type; 52 size_t wrec_appdata_len; 53 size_t wrec_content_len; 54 55 /* Alert to be sent on return from current read handler. */ 56 uint8_t alert; 57 58 /* Pending alert messages. */ 59 uint8_t *alert_data; 60 size_t alert_len; 61 uint8_t alert_level; 62 uint8_t alert_desc; 63 64 /* Pending post-handshake handshake messages (RFC 8446, section 4.6). */ 65 CBS phh_cbs; 66 uint8_t *phh_data; 67 size_t phh_len; 68 69 /* Buffer containing plaintext from opened records. */ 70 uint8_t rbuf_content_type; 71 uint8_t *rbuf; 72 size_t rbuf_len; 73 CBS rbuf_cbs; 74 75 /* Record protection. */ 76 const EVP_MD *hash; 77 const EVP_AEAD *aead; 78 EVP_AEAD_CTX read_aead_ctx; 79 EVP_AEAD_CTX write_aead_ctx; 80 struct tls13_secret read_iv; 81 struct tls13_secret write_iv; 82 struct tls13_secret read_nonce; 83 struct tls13_secret write_nonce; 84 uint8_t read_seq_num[TLS13_RECORD_SEQ_NUM_LEN]; 85 uint8_t write_seq_num[TLS13_RECORD_SEQ_NUM_LEN]; 86 87 /* Callbacks. */ 88 struct tls13_record_layer_callbacks cb; 89 void *cb_arg; 90 }; 91 92 static void 93 tls13_record_layer_rbuf_free(struct tls13_record_layer *rl) 94 { 95 CBS_init(&rl->rbuf_cbs, NULL, 0); 96 freezero(rl->rbuf, rl->rbuf_len); 97 rl->rbuf = NULL; 98 rl->rbuf_len = 0; 99 rl->rbuf_content_type = 0; 100 } 101 102 static void 103 tls13_record_layer_rrec_free(struct tls13_record_layer *rl) 104 { 105 tls13_record_free(rl->rrec); 106 rl->rrec = NULL; 107 } 108 109 static void 110 tls13_record_layer_wrec_free(struct tls13_record_layer *rl) 111 { 112 tls13_record_free(rl->wrec); 113 rl->wrec = NULL; 114 } 115 116 struct tls13_record_layer * 117 tls13_record_layer_new(const struct tls13_record_layer_callbacks *callbacks, 118 void *cb_arg) 119 { 120 struct tls13_record_layer *rl; 121 122 if ((rl = calloc(1, sizeof(struct tls13_record_layer))) == NULL) 123 return NULL; 124 125 rl->legacy_version = TLS1_2_VERSION; 126 rl->cb = *callbacks; 127 rl->cb_arg = cb_arg; 128 129 return rl; 130 } 131 132 void 133 tls13_record_layer_free(struct tls13_record_layer *rl) 134 { 135 if (rl == NULL) 136 return; 137 138 tls13_record_layer_rbuf_free(rl); 139 140 tls13_record_layer_rrec_free(rl); 141 tls13_record_layer_wrec_free(rl); 142 143 EVP_AEAD_CTX_cleanup(&rl->read_aead_ctx); 144 EVP_AEAD_CTX_cleanup(&rl->write_aead_ctx); 145 146 freezero(rl->read_iv.data, rl->read_iv.len); 147 freezero(rl->write_iv.data, rl->write_iv.len); 148 freezero(rl->read_nonce.data, rl->read_nonce.len); 149 freezero(rl->write_nonce.data, rl->write_nonce.len); 150 151 freezero(rl, sizeof(struct tls13_record_layer)); 152 } 153 154 void 155 tls13_record_layer_rbuf(struct tls13_record_layer *rl, CBS *cbs) 156 { 157 CBS_dup(&rl->rbuf_cbs, cbs); 158 } 159 160 static const uint8_t tls13_max_seq_num[TLS13_RECORD_SEQ_NUM_LEN] = { 161 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 162 }; 163 164 int 165 tls13_record_layer_inc_seq_num(uint8_t *seq_num) 166 { 167 int i; 168 169 /* RFC 8446 section 5.3 - sequence numbers must not wrap. */ 170 if (memcmp(seq_num, tls13_max_seq_num, TLS13_RECORD_SEQ_NUM_LEN) == 0) 171 return 0; 172 173 for (i = TLS13_RECORD_SEQ_NUM_LEN - 1; i >= 0; i--) { 174 if (++seq_num[i] != 0) 175 break; 176 } 177 178 return 1; 179 } 180 181 static int 182 tls13_record_layer_update_nonce(struct tls13_secret *nonce, 183 struct tls13_secret *iv, uint8_t *seq_num) 184 { 185 ssize_t i, j; 186 187 if (nonce->len != iv->len) 188 return 0; 189 190 /* 191 * RFC 8446 section 5.3 - sequence number is zero padded and XOR'd 192 * with the IV to produce a per-record nonce. The IV will also be 193 * at least 8-bytes in length. 194 */ 195 for (i = nonce->len - 1, j = TLS13_RECORD_SEQ_NUM_LEN - 1; i >= 0; i--, j--) 196 nonce->data[i] = iv->data[i] ^ (j >= 0 ? seq_num[j] : 0); 197 198 return 1; 199 } 200 201 void 202 tls13_record_layer_allow_ccs(struct tls13_record_layer *rl, int allow) 203 { 204 rl->ccs_allowed = allow; 205 } 206 207 void 208 tls13_record_layer_allow_legacy_alerts(struct tls13_record_layer *rl, int allow) 209 { 210 rl->legacy_alerts_allowed = allow; 211 } 212 213 void 214 tls13_record_layer_set_aead(struct tls13_record_layer *rl, 215 const EVP_AEAD *aead) 216 { 217 rl->aead = aead; 218 } 219 220 void 221 tls13_record_layer_set_hash(struct tls13_record_layer *rl, 222 const EVP_MD *hash) 223 { 224 rl->hash = hash; 225 } 226 227 void 228 tls13_record_layer_set_legacy_version(struct tls13_record_layer *rl, 229 uint16_t version) 230 { 231 rl->legacy_version = version; 232 } 233 234 void 235 tls13_record_layer_handshake_completed(struct tls13_record_layer *rl) 236 { 237 rl->handshake_completed = 1; 238 } 239 240 void 241 tls13_record_layer_set_retry_after_phh(struct tls13_record_layer *rl, int retry) 242 { 243 rl->phh_retry = retry; 244 } 245 246 static ssize_t 247 tls13_record_layer_process_alert(struct tls13_record_layer *rl) 248 { 249 uint8_t alert_level, alert_desc; 250 ssize_t ret = TLS13_IO_FAILURE; 251 252 /* 253 * RFC 8446 - sections 5.1 and 6. 254 * 255 * A TLSv1.3 alert record can only contain a single alert - this means 256 * that processing the alert must consume all of the record. The alert 257 * will result in one of three things - continuation (user_cancelled), 258 * read channel closure (close_notify) or termination (all others). 259 */ 260 if (rl->rbuf == NULL) 261 return TLS13_IO_FAILURE; 262 263 if (rl->rbuf_content_type != SSL3_RT_ALERT) 264 return TLS13_IO_FAILURE; 265 266 if (!CBS_get_u8(&rl->rbuf_cbs, &alert_level)) 267 return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR); 268 269 if (!CBS_get_u8(&rl->rbuf_cbs, &alert_desc)) 270 return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR); 271 272 if (CBS_len(&rl->rbuf_cbs) != 0) 273 return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR); 274 275 tls13_record_layer_rbuf_free(rl); 276 277 /* 278 * Alert level is ignored for closure alerts (RFC 8446 section 6.1), 279 * however for error alerts (RFC 8446 section 6.2), the alert level 280 * must be specified as fatal. 281 */ 282 if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) { 283 rl->read_closed = 1; 284 ret = TLS13_IO_EOF; 285 } else if (alert_desc == TLS13_ALERT_USER_CANCELED) { 286 /* Ignored at the record layer. */ 287 ret = TLS13_IO_WANT_RETRY; 288 } else if (alert_level == TLS13_ALERT_LEVEL_FATAL) { 289 rl->read_closed = 1; 290 rl->write_closed = 1; 291 ret = TLS13_IO_ALERT; 292 } else if (rl->legacy_alerts_allowed && 293 alert_level == TLS13_ALERT_LEVEL_WARNING) { 294 /* Ignored and not passed to the callback. */ 295 return TLS13_IO_WANT_RETRY; 296 } else { 297 return tls13_send_alert(rl, TLS13_ALERT_ILLEGAL_PARAMETER); 298 } 299 300 rl->cb.alert_recv(alert_desc, rl->cb_arg); 301 302 return ret; 303 } 304 305 static ssize_t 306 tls13_record_layer_send_alert(struct tls13_record_layer *rl) 307 { 308 ssize_t ret; 309 310 /* This has to fit into a single record, per RFC 8446 section 5.1. */ 311 if ((ret = tls13_record_layer_write_record(rl, SSL3_RT_ALERT, 312 rl->alert_data, rl->alert_len)) != rl->alert_len) { 313 if (ret == TLS13_IO_EOF) 314 ret = TLS13_IO_ALERT; 315 return ret; 316 } 317 318 freezero(rl->alert_data, rl->alert_len); 319 rl->alert_data = NULL; 320 rl->alert_len = 0; 321 322 if (rl->alert_desc == TLS13_ALERT_CLOSE_NOTIFY) { 323 rl->write_closed = 1; 324 ret = TLS13_IO_SUCCESS; 325 } else if (rl->alert_desc == TLS13_ALERT_USER_CANCELED) { 326 /* Ignored at the record layer. */ 327 ret = TLS13_IO_SUCCESS; 328 } else { 329 rl->read_closed = 1; 330 rl->write_closed = 1; 331 ret = TLS13_IO_ALERT; 332 } 333 334 rl->cb.alert_sent(rl->alert_desc, rl->cb_arg); 335 336 return ret; 337 } 338 339 static ssize_t 340 tls13_record_layer_send_phh(struct tls13_record_layer *rl) 341 { 342 ssize_t ret; 343 344 /* Push out pending post-handshake handshake messages. */ 345 if ((ret = tls13_record_layer_write_chunk(rl, SSL3_RT_HANDSHAKE, 346 CBS_data(&rl->phh_cbs), CBS_len(&rl->phh_cbs))) <= 0) 347 return ret; 348 if (!CBS_skip(&rl->phh_cbs, ret)) 349 return TLS13_IO_FAILURE; 350 if (CBS_len(&rl->phh_cbs) != 0) 351 return TLS13_IO_WANT_RETRY; 352 353 freezero(rl->phh_data, rl->phh_len); 354 rl->phh_data = NULL; 355 rl->phh_len = 0; 356 357 CBS_init(&rl->phh_cbs, rl->phh_data, rl->phh_len); 358 359 rl->cb.phh_sent(rl->cb_arg); 360 361 return TLS13_IO_SUCCESS; 362 } 363 364 ssize_t 365 tls13_record_layer_send_pending(struct tls13_record_layer *rl) 366 { 367 /* 368 * If an alert is pending, then it needs to be sent. However, 369 * if we're already part of the way through sending post-handshake 370 * handshake messages, then we need to finish that first... 371 */ 372 373 if (rl->phh_data != NULL && CBS_len(&rl->phh_cbs) != rl->phh_len) 374 return tls13_record_layer_send_phh(rl); 375 376 if (rl->alert_data != NULL) 377 return tls13_record_layer_send_alert(rl); 378 379 if (rl->phh_data != NULL) 380 return tls13_record_layer_send_phh(rl); 381 382 return TLS13_IO_SUCCESS; 383 } 384 385 static ssize_t 386 tls13_record_layer_alert(struct tls13_record_layer *rl, 387 uint8_t alert_level, uint8_t alert_desc) 388 { 389 CBB cbb; 390 391 if (rl->alert_data != NULL) 392 return TLS13_IO_FAILURE; 393 394 if (!CBB_init(&cbb, 0)) 395 goto err; 396 397 if (!CBB_add_u8(&cbb, alert_level)) 398 goto err; 399 if (!CBB_add_u8(&cbb, alert_desc)) 400 goto err; 401 if (!CBB_finish(&cbb, &rl->alert_data, &rl->alert_len)) 402 goto err; 403 404 rl->alert_level = alert_level; 405 rl->alert_desc = alert_desc; 406 407 return tls13_record_layer_send_pending(rl); 408 409 err: 410 CBB_cleanup(&cbb); 411 412 return TLS13_IO_FAILURE; 413 } 414 415 ssize_t 416 tls13_record_layer_phh(struct tls13_record_layer *rl, CBS *cbs) 417 { 418 if (rl->phh_data != NULL) 419 return TLS13_IO_FAILURE; 420 421 if (!CBS_stow(cbs, &rl->phh_data, &rl->phh_len)) 422 return TLS13_IO_FAILURE; 423 424 CBS_init(&rl->phh_cbs, rl->phh_data, rl->phh_len); 425 426 return tls13_record_layer_send_pending(rl); 427 } 428 429 static int 430 tls13_record_layer_set_traffic_key(const EVP_AEAD *aead, EVP_AEAD_CTX *aead_ctx, 431 const EVP_MD *hash, struct tls13_secret *iv, struct tls13_secret *nonce, 432 struct tls13_secret *traffic_key) 433 { 434 struct tls13_secret context = { .data = "", .len = 0 }; 435 struct tls13_secret key = { .data = NULL, .len = 0 }; 436 int ret = 0; 437 438 freezero(iv->data, iv->len); 439 iv->data = NULL; 440 iv->len = 0; 441 442 freezero(nonce->data, nonce->len); 443 nonce->data = NULL; 444 nonce->len = 0; 445 446 if ((iv->data = calloc(1, EVP_AEAD_nonce_length(aead))) == NULL) 447 goto err; 448 iv->len = EVP_AEAD_nonce_length(aead); 449 450 if ((nonce->data = calloc(1, EVP_AEAD_nonce_length(aead))) == NULL) 451 goto err; 452 nonce->len = EVP_AEAD_nonce_length(aead); 453 454 if ((key.data = calloc(1, EVP_AEAD_key_length(aead))) == NULL) 455 goto err; 456 key.len = EVP_AEAD_key_length(aead); 457 458 if (!tls13_hkdf_expand_label(iv, hash, traffic_key, "iv", &context)) 459 goto err; 460 if (!tls13_hkdf_expand_label(&key, hash, traffic_key, "key", &context)) 461 goto err; 462 463 if (!EVP_AEAD_CTX_init(aead_ctx, aead, key.data, key.len, 464 EVP_AEAD_DEFAULT_TAG_LENGTH, NULL)) 465 goto err; 466 467 ret = 1; 468 469 err: 470 freezero(key.data, key.len); 471 472 return ret; 473 } 474 475 int 476 tls13_record_layer_set_read_traffic_key(struct tls13_record_layer *rl, 477 struct tls13_secret *read_key) 478 { 479 memset(rl->read_seq_num, 0, TLS13_RECORD_SEQ_NUM_LEN); 480 481 return tls13_record_layer_set_traffic_key(rl->aead, &rl->read_aead_ctx, 482 rl->hash, &rl->read_iv, &rl->read_nonce, read_key); 483 } 484 485 int 486 tls13_record_layer_set_write_traffic_key(struct tls13_record_layer *rl, 487 struct tls13_secret *write_key) 488 { 489 memset(rl->write_seq_num, 0, TLS13_RECORD_SEQ_NUM_LEN); 490 491 return tls13_record_layer_set_traffic_key(rl->aead, &rl->write_aead_ctx, 492 rl->hash, &rl->write_iv, &rl->write_nonce, write_key); 493 } 494 495 static int 496 tls13_record_layer_open_record_plaintext(struct tls13_record_layer *rl) 497 { 498 CBS cbs; 499 500 if (rl->aead != NULL) 501 return 0; 502 503 /* 504 * We're still operating in plaintext mode, so just copy the 505 * content from the record to the plaintext buffer. 506 */ 507 if (!tls13_record_content(rl->rrec, &cbs)) 508 return 0; 509 510 if (CBS_len(&cbs) > TLS13_RECORD_MAX_PLAINTEXT_LEN) { 511 rl->alert = SSL_AD_RECORD_OVERFLOW; 512 return 0; 513 } 514 515 tls13_record_layer_rbuf_free(rl); 516 517 if (!CBS_stow(&cbs, &rl->rbuf, &rl->rbuf_len)) 518 return 0; 519 520 rl->rbuf_content_type = tls13_record_content_type(rl->rrec); 521 522 CBS_init(&rl->rbuf_cbs, rl->rbuf, rl->rbuf_len); 523 524 return 1; 525 } 526 527 static int 528 tls13_record_layer_open_record_protected(struct tls13_record_layer *rl) 529 { 530 CBS header, enc_record; 531 uint8_t *content = NULL; 532 ssize_t content_len = 0; 533 uint8_t content_type; 534 size_t out_len; 535 536 if (rl->aead == NULL) 537 goto err; 538 539 if (!tls13_record_header(rl->rrec, &header)) 540 goto err; 541 if (!tls13_record_content(rl->rrec, &enc_record)) 542 goto err; 543 544 if ((content = calloc(1, CBS_len(&enc_record))) == NULL) 545 goto err; 546 content_len = CBS_len(&enc_record); 547 548 if (!tls13_record_layer_update_nonce(&rl->read_nonce, &rl->read_iv, 549 rl->read_seq_num)) 550 goto err; 551 552 if (!EVP_AEAD_CTX_open(&rl->read_aead_ctx, 553 content, &out_len, content_len, 554 rl->read_nonce.data, rl->read_nonce.len, 555 CBS_data(&enc_record), CBS_len(&enc_record), 556 CBS_data(&header), CBS_len(&header))) 557 goto err; 558 559 if (out_len > TLS13_RECORD_MAX_INNER_PLAINTEXT_LEN) { 560 rl->alert = SSL_AD_RECORD_OVERFLOW; 561 goto err; 562 } 563 564 if (!tls13_record_layer_inc_seq_num(rl->read_seq_num)) 565 goto err; 566 567 /* 568 * The real content type is hidden at the end of the record content and 569 * it may be followed by padding that consists of one or more zeroes. 570 * Time to hunt for that elusive content type! 571 */ 572 /* XXX - CBS from end? CBS_get_end_u8()? */ 573 content_len = out_len - 1; 574 while (content_len >= 0 && content[content_len] == 0) 575 content_len--; 576 if (content_len < 0) 577 goto err; 578 if (content_len > TLS13_RECORD_MAX_PLAINTEXT_LEN) { 579 rl->alert = SSL_AD_RECORD_OVERFLOW; 580 goto err; 581 } 582 content_type = content[content_len]; 583 584 tls13_record_layer_rbuf_free(rl); 585 586 rl->rbuf_content_type = content_type; 587 rl->rbuf = content; 588 rl->rbuf_len = content_len; 589 590 CBS_init(&rl->rbuf_cbs, rl->rbuf, rl->rbuf_len); 591 592 return 1; 593 594 err: 595 freezero(content, content_len); 596 597 return 0; 598 } 599 600 static int 601 tls13_record_layer_open_record(struct tls13_record_layer *rl) 602 { 603 if (rl->handshake_completed && rl->aead == NULL) 604 return 0; 605 606 if (rl->aead == NULL) 607 return tls13_record_layer_open_record_plaintext(rl); 608 609 return tls13_record_layer_open_record_protected(rl); 610 } 611 612 static int 613 tls13_record_layer_seal_record_plaintext(struct tls13_record_layer *rl, 614 uint8_t content_type, const uint8_t *content, size_t content_len) 615 { 616 uint8_t *data = NULL; 617 size_t data_len = 0; 618 CBB cbb, body; 619 620 /* 621 * Allow dummy CCS messages to be sent in plaintext even when 622 * record protection has been engaged, as long as the handshake 623 * has not yet completed. 624 */ 625 if (rl->handshake_completed) 626 return 0; 627 if (rl->aead != NULL && content_type != SSL3_RT_CHANGE_CIPHER_SPEC) 628 return 0; 629 630 /* 631 * We're still operating in plaintext mode, so just copy the 632 * content into the record. 633 */ 634 if (!CBB_init(&cbb, TLS13_RECORD_HEADER_LEN + content_len)) 635 goto err; 636 637 if (!CBB_add_u8(&cbb, content_type)) 638 goto err; 639 if (!CBB_add_u16(&cbb, rl->legacy_version)) 640 goto err; 641 if (!CBB_add_u16_length_prefixed(&cbb, &body)) 642 goto err; 643 if (!CBB_add_bytes(&body, content, content_len)) 644 goto err; 645 646 if (!CBB_finish(&cbb, &data, &data_len)) 647 goto err; 648 649 if (!tls13_record_set_data(rl->wrec, data, data_len)) 650 goto err; 651 652 rl->wrec_content_len = content_len; 653 rl->wrec_content_type = content_type; 654 655 return 1; 656 657 err: 658 CBB_cleanup(&cbb); 659 freezero(data, data_len); 660 661 return 0; 662 } 663 664 static int 665 tls13_record_layer_seal_record_protected(struct tls13_record_layer *rl, 666 uint8_t content_type, const uint8_t *content, size_t content_len) 667 { 668 uint8_t *data = NULL, *header = NULL, *inner = NULL; 669 size_t data_len = 0, header_len = 0, inner_len = 0; 670 uint8_t *enc_record; 671 size_t enc_record_len; 672 ssize_t ret = 0; 673 size_t out_len; 674 CBB cbb; 675 676 if (rl->aead == NULL) 677 return 0; 678 679 memset(&cbb, 0, sizeof(cbb)); 680 681 /* Build inner plaintext. */ 682 if (!CBB_init(&cbb, content_len + 1)) 683 goto err; 684 if (!CBB_add_bytes(&cbb, content, content_len)) 685 goto err; 686 if (!CBB_add_u8(&cbb, content_type)) 687 goto err; 688 /* XXX - padding? */ 689 if (!CBB_finish(&cbb, &inner, &inner_len)) 690 goto err; 691 692 if (inner_len > TLS13_RECORD_MAX_INNER_PLAINTEXT_LEN) 693 goto err; 694 695 /* XXX EVP_AEAD_max_tag_len vs EVP_AEAD_CTX_tag_len. */ 696 enc_record_len = inner_len + EVP_AEAD_max_tag_len(rl->aead); 697 if (enc_record_len > TLS13_RECORD_MAX_CIPHERTEXT_LEN) 698 goto err; 699 700 /* Build the record header. */ 701 if (!CBB_init(&cbb, TLS13_RECORD_HEADER_LEN)) 702 goto err; 703 if (!CBB_add_u8(&cbb, SSL3_RT_APPLICATION_DATA)) 704 goto err; 705 if (!CBB_add_u16(&cbb, TLS1_2_VERSION)) 706 goto err; 707 if (!CBB_add_u16(&cbb, enc_record_len)) 708 goto err; 709 if (!CBB_finish(&cbb, &header, &header_len)) 710 goto err; 711 712 /* Build the actual record. */ 713 if (!CBB_init(&cbb, TLS13_RECORD_HEADER_LEN + enc_record_len)) 714 goto err; 715 if (!CBB_add_bytes(&cbb, header, header_len)) 716 goto err; 717 if (!CBB_add_space(&cbb, &enc_record, enc_record_len)) 718 goto err; 719 if (!CBB_finish(&cbb, &data, &data_len)) 720 goto err; 721 722 if (!tls13_record_layer_update_nonce(&rl->write_nonce, 723 &rl->write_iv, rl->write_seq_num)) 724 goto err; 725 726 /* 727 * XXX - consider a EVP_AEAD_CTX_seal_iov() that takes an iovec... 728 * this would avoid a copy since the inner would be passed as two 729 * separate pieces. 730 */ 731 if (!EVP_AEAD_CTX_seal(&rl->write_aead_ctx, 732 enc_record, &out_len, enc_record_len, 733 rl->write_nonce.data, rl->write_nonce.len, 734 inner, inner_len, header, header_len)) 735 goto err; 736 737 if (out_len != enc_record_len) 738 goto err; 739 740 if (!tls13_record_layer_inc_seq_num(rl->write_seq_num)) 741 goto err; 742 743 if (!tls13_record_set_data(rl->wrec, data, data_len)) 744 goto err; 745 746 rl->wrec_content_len = content_len; 747 rl->wrec_content_type = content_type; 748 749 data = NULL; 750 data_len = 0; 751 752 ret = 1; 753 754 err: 755 CBB_cleanup(&cbb); 756 757 freezero(data, data_len); 758 freezero(header, header_len); 759 freezero(inner, inner_len); 760 761 return ret; 762 } 763 764 static int 765 tls13_record_layer_seal_record(struct tls13_record_layer *rl, 766 uint8_t content_type, const uint8_t *content, size_t content_len) 767 { 768 if (rl->handshake_completed && rl->aead == NULL) 769 return 0; 770 771 tls13_record_layer_wrec_free(rl); 772 773 if ((rl->wrec = tls13_record_new()) == NULL) 774 return 0; 775 776 if (rl->aead == NULL || content_type == SSL3_RT_CHANGE_CIPHER_SPEC) 777 return tls13_record_layer_seal_record_plaintext(rl, 778 content_type, content, content_len); 779 780 return tls13_record_layer_seal_record_protected(rl, content_type, 781 content, content_len); 782 } 783 784 static ssize_t 785 tls13_record_layer_read_record(struct tls13_record_layer *rl) 786 { 787 uint8_t content_type, ccs; 788 ssize_t ret; 789 CBS cbs; 790 791 if (rl->rrec == NULL) { 792 if ((rl->rrec = tls13_record_new()) == NULL) 793 goto err; 794 } 795 796 if ((ret = tls13_record_recv(rl->rrec, rl->cb.wire_read, rl->cb_arg)) <= 0) { 797 switch (ret) { 798 case TLS13_IO_RECORD_VERSION: 799 return tls13_send_alert(rl, SSL_AD_PROTOCOL_VERSION); 800 case TLS13_IO_RECORD_OVERFLOW: 801 return tls13_send_alert(rl, SSL_AD_RECORD_OVERFLOW); 802 } 803 return ret; 804 } 805 806 if (rl->legacy_version == TLS1_2_VERSION && 807 tls13_record_version(rl->rrec) != TLS1_2_VERSION) 808 return tls13_send_alert(rl, SSL_AD_PROTOCOL_VERSION); 809 810 content_type = tls13_record_content_type(rl->rrec); 811 812 /* 813 * Bag of hacks ahead... after the first ClientHello message has been 814 * sent or received and before the peer's Finished message has been 815 * received, we may receive an unencrypted ChangeCipherSpec record 816 * (see RFC 8446 section 5 and appendix D.4). This record must be 817 * ignored. 818 */ 819 if (content_type == SSL3_RT_CHANGE_CIPHER_SPEC) { 820 if (!rl->ccs_allowed || rl->ccs_seen >= 2) 821 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 822 if (!tls13_record_content(rl->rrec, &cbs)) 823 return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR); 824 if (!CBS_get_u8(&cbs, &ccs)) 825 return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR); 826 if (ccs != 1) 827 return tls13_send_alert(rl, TLS13_ALERT_ILLEGAL_PARAMETER); 828 rl->ccs_seen++; 829 tls13_record_layer_rrec_free(rl); 830 return TLS13_IO_WANT_RETRY; 831 } 832 833 /* 834 * Once record protection is engaged, we should only receive 835 * protected application data messages (aside from the 836 * dummy ChangeCipherSpec messages, handled above). 837 */ 838 if (rl->aead != NULL && content_type != SSL3_RT_APPLICATION_DATA) 839 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 840 841 if (!tls13_record_layer_open_record(rl)) 842 goto err; 843 844 tls13_record_layer_rrec_free(rl); 845 846 /* 847 * On receiving a handshake or alert record with empty inner plaintext, 848 * we must terminate the connection with an unexpected_message alert. 849 * See RFC 8446 section 5.4. 850 */ 851 if (CBS_len(&rl->rbuf_cbs) == 0 && 852 (rl->rbuf_content_type == SSL3_RT_ALERT || 853 rl->rbuf_content_type == SSL3_RT_HANDSHAKE)) 854 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 855 856 switch (rl->rbuf_content_type) { 857 case SSL3_RT_ALERT: 858 return tls13_record_layer_process_alert(rl); 859 860 case SSL3_RT_HANDSHAKE: 861 break; 862 863 case SSL3_RT_APPLICATION_DATA: 864 if (!rl->handshake_completed) 865 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 866 break; 867 868 default: 869 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 870 } 871 872 return TLS13_IO_SUCCESS; 873 874 err: 875 return TLS13_IO_FAILURE; 876 } 877 878 static ssize_t 879 tls13_record_layer_pending(struct tls13_record_layer *rl, uint8_t content_type) 880 { 881 if (rl->rbuf_content_type != content_type) 882 return 0; 883 884 return CBS_len(&rl->rbuf_cbs); 885 } 886 887 static ssize_t 888 tls13_record_layer_recv_phh(struct tls13_record_layer *rl) 889 { 890 ssize_t ret = TLS13_IO_FAILURE; 891 892 rl->phh = 1; 893 894 /* 895 * The post handshake handshake receive callback is allowed to return: 896 * 897 * TLS13_IO_WANT_POLLIN need more handshake data. 898 * TLS13_IO_WANT_POLLOUT got whole handshake message, response enqueued. 899 * TLS13_IO_SUCCESS got the whole handshake, nothing more to do. 900 * TLS13_IO_FAILURE something broke. 901 */ 902 if (rl->cb.phh_recv != NULL) 903 ret = rl->cb.phh_recv(rl->cb_arg, &rl->rbuf_cbs); 904 905 tls13_record_layer_rbuf_free(rl); 906 907 /* Leave post handshake handshake mode unless we need more data. */ 908 if (ret != TLS13_IO_WANT_POLLIN) 909 rl->phh = 0; 910 911 if (ret == TLS13_IO_SUCCESS) { 912 if (rl->phh_retry) 913 return TLS13_IO_WANT_RETRY; 914 915 return TLS13_IO_WANT_POLLIN; 916 } 917 918 return ret; 919 } 920 921 static ssize_t 922 tls13_record_layer_read_internal(struct tls13_record_layer *rl, 923 uint8_t content_type, uint8_t *buf, size_t n, int peek) 924 { 925 ssize_t ret; 926 927 if ((ret = tls13_record_layer_send_pending(rl)) != TLS13_IO_SUCCESS) 928 return ret; 929 930 if (rl->read_closed) 931 return TLS13_IO_EOF; 932 933 /* If necessary, pull up the next record. */ 934 if (CBS_len(&rl->rbuf_cbs) == 0) { 935 if ((ret = tls13_record_layer_read_record(rl)) <= 0) 936 return ret; 937 938 /* 939 * We may have read a valid 0-byte application data record, 940 * in which case we need to read the next record. 941 */ 942 if (CBS_len(&rl->rbuf_cbs) == 0) { 943 tls13_record_layer_rbuf_free(rl); 944 return TLS13_IO_WANT_POLLIN; 945 } 946 } 947 948 /* 949 * If we are in post handshake handshake mode, we must not see 950 * any record type that isn't a handshake until we are done. 951 */ 952 if (rl->phh && rl->rbuf_content_type != SSL3_RT_HANDSHAKE) 953 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 954 955 /* 956 * Handshake content can appear as post-handshake messages (yup, 957 * the RFC reused the same content type...), which means we can 958 * be trying to read application data and need to handle a 959 * post-handshake handshake message instead... 960 */ 961 if (rl->rbuf_content_type != content_type) { 962 if (rl->rbuf_content_type == SSL3_RT_HANDSHAKE) { 963 if (rl->handshake_completed) 964 return tls13_record_layer_recv_phh(rl); 965 } 966 return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 967 } 968 969 if (n > CBS_len(&rl->rbuf_cbs)) 970 n = CBS_len(&rl->rbuf_cbs); 971 972 /* XXX - CBS_memcpy? CBS_copy_bytes? */ 973 memcpy(buf, CBS_data(&rl->rbuf_cbs), n); 974 975 if (!peek) { 976 if (!CBS_skip(&rl->rbuf_cbs, n)) 977 goto err; 978 } 979 980 if (CBS_len(&rl->rbuf_cbs) == 0) 981 tls13_record_layer_rbuf_free(rl); 982 983 return n; 984 985 err: 986 return TLS13_IO_FAILURE; 987 } 988 989 static ssize_t 990 tls13_record_layer_peek(struct tls13_record_layer *rl, uint8_t content_type, 991 uint8_t *buf, size_t n) 992 { 993 ssize_t ret; 994 995 do { 996 ret = tls13_record_layer_read_internal(rl, content_type, buf, n, 1); 997 } while (ret == TLS13_IO_WANT_RETRY); 998 999 if (rl->alert != 0) 1000 return tls13_send_alert(rl, rl->alert); 1001 1002 return ret; 1003 } 1004 1005 static ssize_t 1006 tls13_record_layer_read(struct tls13_record_layer *rl, uint8_t content_type, 1007 uint8_t *buf, size_t n) 1008 { 1009 ssize_t ret; 1010 1011 do { 1012 ret = tls13_record_layer_read_internal(rl, content_type, buf, n, 0); 1013 } while (ret == TLS13_IO_WANT_RETRY); 1014 1015 if (rl->alert != 0) 1016 return tls13_send_alert(rl, rl->alert); 1017 1018 return ret; 1019 } 1020 1021 static ssize_t 1022 tls13_record_layer_write_record(struct tls13_record_layer *rl, 1023 uint8_t content_type, const uint8_t *content, size_t content_len) 1024 { 1025 ssize_t ret; 1026 1027 if (rl->write_closed) 1028 return TLS13_IO_EOF; 1029 1030 /* 1031 * If we pushed out application data while handling other messages, 1032 * we need to return content length on the next call. 1033 */ 1034 if (content_type == SSL3_RT_APPLICATION_DATA && 1035 rl->wrec_appdata_len != 0) { 1036 ret = rl->wrec_appdata_len; 1037 rl->wrec_appdata_len = 0; 1038 return ret; 1039 } 1040 1041 /* See if there is an existing record and attempt to push it out... */ 1042 if (rl->wrec != NULL) { 1043 if ((ret = tls13_record_send(rl->wrec, rl->cb.wire_write, 1044 rl->cb_arg)) <= 0) 1045 return ret; 1046 tls13_record_layer_wrec_free(rl); 1047 1048 if (rl->wrec_content_type == content_type) { 1049 ret = rl->wrec_content_len; 1050 rl->wrec_content_len = 0; 1051 rl->wrec_content_type = 0; 1052 return ret; 1053 } 1054 1055 /* 1056 * The only partial record type should be application data. 1057 * All other cases are handled to completion. 1058 */ 1059 if (rl->wrec_content_type != SSL3_RT_APPLICATION_DATA) 1060 return TLS13_IO_FAILURE; 1061 rl->wrec_appdata_len = rl->wrec_content_len; 1062 } 1063 1064 if (content_len > TLS13_RECORD_MAX_PLAINTEXT_LEN) 1065 goto err; 1066 1067 if (!tls13_record_layer_seal_record(rl, content_type, content, content_len)) 1068 goto err; 1069 1070 if ((ret = tls13_record_send(rl->wrec, rl->cb.wire_write, rl->cb_arg)) <= 0) 1071 return ret; 1072 1073 tls13_record_layer_wrec_free(rl); 1074 1075 return content_len; 1076 1077 err: 1078 return TLS13_IO_FAILURE; 1079 } 1080 1081 static ssize_t 1082 tls13_record_layer_write_chunk(struct tls13_record_layer *rl, 1083 uint8_t content_type, const uint8_t *buf, size_t n) 1084 { 1085 if (n > TLS13_RECORD_MAX_PLAINTEXT_LEN) 1086 n = TLS13_RECORD_MAX_PLAINTEXT_LEN; 1087 1088 return tls13_record_layer_write_record(rl, content_type, buf, n); 1089 } 1090 1091 static ssize_t 1092 tls13_record_layer_write(struct tls13_record_layer *rl, uint8_t content_type, 1093 const uint8_t *buf, size_t n) 1094 { 1095 ssize_t ret; 1096 1097 do { 1098 ret = tls13_record_layer_send_pending(rl); 1099 } while (ret == TLS13_IO_WANT_RETRY); 1100 if (ret != TLS13_IO_SUCCESS) 1101 return ret; 1102 1103 do { 1104 ret = tls13_record_layer_write_chunk(rl, content_type, buf, n); 1105 } while (ret == TLS13_IO_WANT_RETRY); 1106 1107 return ret; 1108 } 1109 1110 static const uint8_t tls13_dummy_ccs[] = { 0x01 }; 1111 1112 ssize_t 1113 tls13_send_dummy_ccs(struct tls13_record_layer *rl) 1114 { 1115 ssize_t ret; 1116 1117 if (rl->ccs_sent) 1118 return TLS13_IO_FAILURE; 1119 1120 if ((ret = tls13_record_layer_write(rl, SSL3_RT_CHANGE_CIPHER_SPEC, 1121 tls13_dummy_ccs, sizeof(tls13_dummy_ccs))) <= 0) 1122 return ret; 1123 1124 rl->ccs_sent = 1; 1125 1126 return TLS13_IO_SUCCESS; 1127 } 1128 1129 ssize_t 1130 tls13_read_handshake_data(struct tls13_record_layer *rl, uint8_t *buf, size_t n) 1131 { 1132 return tls13_record_layer_read(rl, SSL3_RT_HANDSHAKE, buf, n); 1133 } 1134 1135 ssize_t 1136 tls13_write_handshake_data(struct tls13_record_layer *rl, const uint8_t *buf, 1137 size_t n) 1138 { 1139 return tls13_record_layer_write(rl, SSL3_RT_HANDSHAKE, buf, n); 1140 } 1141 1142 ssize_t 1143 tls13_pending_application_data(struct tls13_record_layer *rl) 1144 { 1145 if (!rl->handshake_completed) 1146 return 0; 1147 1148 return tls13_record_layer_pending(rl, SSL3_RT_APPLICATION_DATA); 1149 } 1150 1151 ssize_t 1152 tls13_peek_application_data(struct tls13_record_layer *rl, uint8_t *buf, size_t n) 1153 { 1154 if (!rl->handshake_completed) 1155 return TLS13_IO_FAILURE; 1156 1157 return tls13_record_layer_peek(rl, SSL3_RT_APPLICATION_DATA, buf, n); 1158 } 1159 1160 ssize_t 1161 tls13_read_application_data(struct tls13_record_layer *rl, uint8_t *buf, size_t n) 1162 { 1163 if (!rl->handshake_completed) 1164 return TLS13_IO_FAILURE; 1165 1166 return tls13_record_layer_read(rl, SSL3_RT_APPLICATION_DATA, buf, n); 1167 } 1168 1169 ssize_t 1170 tls13_write_application_data(struct tls13_record_layer *rl, const uint8_t *buf, 1171 size_t n) 1172 { 1173 if (!rl->handshake_completed) 1174 return TLS13_IO_FAILURE; 1175 1176 return tls13_record_layer_write(rl, SSL3_RT_APPLICATION_DATA, buf, n); 1177 } 1178 1179 ssize_t 1180 tls13_send_alert(struct tls13_record_layer *rl, uint8_t alert_desc) 1181 { 1182 uint8_t alert_level = TLS13_ALERT_LEVEL_FATAL; 1183 ssize_t ret; 1184 1185 if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY || 1186 alert_desc == TLS13_ALERT_USER_CANCELED) 1187 alert_level = TLS13_ALERT_LEVEL_WARNING; 1188 1189 do { 1190 ret = tls13_record_layer_alert(rl, alert_level, alert_desc); 1191 } while (ret == TLS13_IO_WANT_RETRY); 1192 1193 return ret; 1194 } 1195