1 /* $OpenBSD: tls_server.c,v 1.49 2023/05/14 07:26:25 op Exp $ */ 2 /* 3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/socket.h> 19 20 #include <arpa/inet.h> 21 22 #include <string.h> 23 24 #include <openssl/ec.h> 25 #include <openssl/err.h> 26 #include <openssl/ssl.h> 27 28 #include <tls.h> 29 #include "tls_internal.h" 30 31 struct tls * 32 tls_server(void) 33 { 34 struct tls *ctx; 35 36 if (tls_init() == -1) 37 return (NULL); 38 39 if ((ctx = tls_new()) == NULL) 40 return (NULL); 41 42 ctx->flags |= TLS_SERVER; 43 44 return (ctx); 45 } 46 47 struct tls * 48 tls_server_conn(struct tls *ctx) 49 { 50 struct tls *conn_ctx; 51 52 if ((conn_ctx = tls_new()) == NULL) 53 return (NULL); 54 55 conn_ctx->flags |= TLS_SERVER_CONN; 56 57 pthread_mutex_lock(&ctx->config->mutex); 58 ctx->config->refcount++; 59 pthread_mutex_unlock(&ctx->config->mutex); 60 61 conn_ctx->config = ctx->config; 62 conn_ctx->keypair = ctx->config->keypair; 63 64 return (conn_ctx); 65 } 66 67 static int 68 tls_server_alpn_cb(SSL *ssl, const unsigned char **out, unsigned char *outlen, 69 const unsigned char *in, unsigned int inlen, void *arg) 70 { 71 struct tls *ctx = arg; 72 73 if (SSL_select_next_proto((unsigned char**)out, outlen, 74 ctx->config->alpn, ctx->config->alpn_len, in, inlen) == 75 OPENSSL_NPN_NEGOTIATED) 76 return (SSL_TLSEXT_ERR_OK); 77 78 return (SSL_TLSEXT_ERR_NOACK); 79 } 80 81 static int 82 tls_servername_cb(SSL *ssl, int *al, void *arg) 83 { 84 struct tls *ctx = (struct tls *)arg; 85 struct tls_sni_ctx *sni_ctx; 86 union tls_addr addrbuf; 87 struct tls *conn_ctx; 88 const char *name; 89 int match; 90 91 if ((conn_ctx = SSL_get_app_data(ssl)) == NULL) 92 goto err; 93 94 if ((name = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name)) == 95 NULL) { 96 /* 97 * The servername callback gets called even when there is no 98 * TLS servername extension provided by the client. Sigh! 99 */ 100 return (SSL_TLSEXT_ERR_NOACK); 101 } 102 103 /* 104 * Per RFC 6066 section 3: ensure that name is not an IP literal. 105 * 106 * While we should treat this as an error, a number of clients 107 * (Python, Ruby and Safari) are not RFC compliant. To avoid handshake 108 * failures, pretend that we did not receive the extension. 109 */ 110 if (inet_pton(AF_INET, name, &addrbuf) == 1 || 111 inet_pton(AF_INET6, name, &addrbuf) == 1) 112 return (SSL_TLSEXT_ERR_NOACK); 113 114 free(conn_ctx->servername); 115 if ((conn_ctx->servername = strdup(name)) == NULL) 116 goto err; 117 118 /* Find appropriate SSL context for requested servername. */ 119 for (sni_ctx = ctx->sni_ctx; sni_ctx != NULL; sni_ctx = sni_ctx->next) { 120 if (tls_check_name(ctx, sni_ctx->ssl_cert, name, 121 &match) == -1) 122 goto err; 123 if (match) { 124 conn_ctx->keypair = sni_ctx->keypair; 125 SSL_set_SSL_CTX(conn_ctx->ssl_conn, sni_ctx->ssl_ctx); 126 return (SSL_TLSEXT_ERR_OK); 127 } 128 } 129 130 /* No match, use the existing context/certificate. */ 131 return (SSL_TLSEXT_ERR_OK); 132 133 err: 134 /* 135 * There is no way to tell libssl that an internal failure occurred. 136 * The only option we have is to return a fatal alert. 137 */ 138 *al = SSL_AD_INTERNAL_ERROR; 139 return (SSL_TLSEXT_ERR_ALERT_FATAL); 140 } 141 142 static struct tls_ticket_key * 143 tls_server_ticket_key(struct tls_config *config, unsigned char *keyname) 144 { 145 struct tls_ticket_key *key = NULL; 146 time_t now; 147 int i; 148 149 now = time(NULL); 150 if (config->ticket_autorekey == 1) { 151 if (now - 3 * (config->session_lifetime / 4) > 152 config->ticket_keys[0].time) { 153 if (tls_config_ticket_autorekey(config) == -1) 154 return (NULL); 155 } 156 } 157 for (i = 0; i < TLS_NUM_TICKETS; i++) { 158 struct tls_ticket_key *tk = &config->ticket_keys[i]; 159 if (now - config->session_lifetime > tk->time) 160 continue; 161 if (keyname == NULL || timingsafe_memcmp(keyname, 162 tk->key_name, sizeof(tk->key_name)) == 0) { 163 key = tk; 164 break; 165 } 166 } 167 return (key); 168 } 169 170 static int 171 tls_server_ticket_cb(SSL *ssl, unsigned char *keyname, unsigned char *iv, 172 EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int mode) 173 { 174 struct tls_ticket_key *key; 175 struct tls *tls_ctx; 176 177 if ((tls_ctx = SSL_get_app_data(ssl)) == NULL) 178 return (-1); 179 180 if (mode == 1) { 181 /* create new session */ 182 key = tls_server_ticket_key(tls_ctx->config, NULL); 183 if (key == NULL) { 184 tls_set_errorx(tls_ctx, "no valid ticket key found"); 185 return (-1); 186 } 187 188 memcpy(keyname, key->key_name, sizeof(key->key_name)); 189 arc4random_buf(iv, EVP_MAX_IV_LENGTH); 190 if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, 191 key->aes_key, iv)) { 192 tls_set_errorx(tls_ctx, "failed to init encrypt"); 193 return (-1); 194 } 195 if (!HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key), 196 EVP_sha256(), NULL)) { 197 tls_set_errorx(tls_ctx, "failed to init hmac"); 198 return (-1); 199 } 200 return (0); 201 } else { 202 /* get key by name */ 203 key = tls_server_ticket_key(tls_ctx->config, keyname); 204 if (key == NULL) 205 return (0); 206 207 if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, 208 key->aes_key, iv)) { 209 tls_set_errorx(tls_ctx, "failed to init decrypt"); 210 return (-1); 211 } 212 if (!HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key), 213 EVP_sha256(), NULL)) { 214 tls_set_errorx(tls_ctx, "failed to init hmac"); 215 return (-1); 216 } 217 218 /* time to renew the ticket? is it the primary key? */ 219 if (key != &tls_ctx->config->ticket_keys[0]) 220 return (2); 221 return (1); 222 } 223 } 224 225 static int 226 tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx, 227 struct tls_keypair *keypair) 228 { 229 SSL_CTX_free(*ssl_ctx); 230 231 if ((*ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) { 232 tls_set_errorx(ctx, "ssl context failure"); 233 goto err; 234 } 235 236 SSL_CTX_set_options(*ssl_ctx, SSL_OP_NO_CLIENT_RENEGOTIATION); 237 238 if (SSL_CTX_set_tlsext_servername_callback(*ssl_ctx, 239 tls_servername_cb) != 1) { 240 tls_set_error(ctx, "failed to set servername callback"); 241 goto err; 242 } 243 if (SSL_CTX_set_tlsext_servername_arg(*ssl_ctx, ctx) != 1) { 244 tls_set_error(ctx, "failed to set servername callback arg"); 245 goto err; 246 } 247 248 if (tls_configure_ssl(ctx, *ssl_ctx) != 0) 249 goto err; 250 if (tls_configure_ssl_keypair(ctx, *ssl_ctx, keypair, 1) != 0) 251 goto err; 252 if (ctx->config->verify_client != 0) { 253 int verify = SSL_VERIFY_PEER; 254 if (ctx->config->verify_client == 1) 255 verify |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; 256 if (tls_configure_ssl_verify(ctx, *ssl_ctx, verify) == -1) 257 goto err; 258 } 259 260 if (ctx->config->alpn != NULL) 261 SSL_CTX_set_alpn_select_cb(*ssl_ctx, tls_server_alpn_cb, 262 ctx); 263 264 if (ctx->config->dheparams == -1) 265 SSL_CTX_set_dh_auto(*ssl_ctx, 1); 266 else if (ctx->config->dheparams == 1024) 267 SSL_CTX_set_dh_auto(*ssl_ctx, 2); 268 269 if (ctx->config->ecdhecurves != NULL) { 270 SSL_CTX_set_ecdh_auto(*ssl_ctx, 1); 271 if (SSL_CTX_set1_groups(*ssl_ctx, ctx->config->ecdhecurves, 272 ctx->config->ecdhecurves_len) != 1) { 273 tls_set_errorx(ctx, "failed to set ecdhe curves"); 274 goto err; 275 } 276 } 277 278 if (ctx->config->ciphers_server == 1) 279 SSL_CTX_set_options(*ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE); 280 281 if (SSL_CTX_set_tlsext_status_cb(*ssl_ctx, tls_ocsp_stapling_cb) != 1) { 282 tls_set_errorx(ctx, "failed to add OCSP stapling callback"); 283 goto err; 284 } 285 286 if (ctx->config->session_lifetime > 0) { 287 /* set the session lifetime and enable tickets */ 288 SSL_CTX_set_timeout(*ssl_ctx, ctx->config->session_lifetime); 289 SSL_CTX_clear_options(*ssl_ctx, SSL_OP_NO_TICKET); 290 if (!SSL_CTX_set_tlsext_ticket_key_cb(*ssl_ctx, 291 tls_server_ticket_cb)) { 292 tls_set_error(ctx, 293 "failed to set the TLS ticket callback"); 294 goto err; 295 } 296 } 297 298 if (SSL_CTX_set_session_id_context(*ssl_ctx, ctx->config->session_id, 299 sizeof(ctx->config->session_id)) != 1) { 300 tls_set_error(ctx, "failed to set session id context"); 301 goto err; 302 } 303 304 return (0); 305 306 err: 307 SSL_CTX_free(*ssl_ctx); 308 *ssl_ctx = NULL; 309 310 return (-1); 311 } 312 313 static int 314 tls_configure_server_sni(struct tls *ctx) 315 { 316 struct tls_sni_ctx **sni_ctx; 317 struct tls_keypair *kp; 318 319 if (ctx->config->keypair->next == NULL) 320 return (0); 321 322 /* Set up additional SSL contexts for SNI. */ 323 sni_ctx = &ctx->sni_ctx; 324 for (kp = ctx->config->keypair->next; kp != NULL; kp = kp->next) { 325 if ((*sni_ctx = tls_sni_ctx_new()) == NULL) { 326 tls_set_errorx(ctx, "out of memory"); 327 goto err; 328 } 329 (*sni_ctx)->keypair = kp; 330 if (tls_configure_server_ssl(ctx, &(*sni_ctx)->ssl_ctx, kp) == -1) 331 goto err; 332 if (tls_keypair_load_cert(kp, &ctx->error, 333 &(*sni_ctx)->ssl_cert) == -1) 334 goto err; 335 sni_ctx = &(*sni_ctx)->next; 336 } 337 338 return (0); 339 340 err: 341 return (-1); 342 } 343 344 int 345 tls_configure_server(struct tls *ctx) 346 { 347 if (tls_configure_server_ssl(ctx, &ctx->ssl_ctx, 348 ctx->config->keypair) == -1) 349 goto err; 350 if (tls_configure_server_sni(ctx) == -1) 351 goto err; 352 353 return (0); 354 355 err: 356 return (-1); 357 } 358 359 static struct tls * 360 tls_accept_common(struct tls *ctx) 361 { 362 struct tls *conn_ctx = NULL; 363 364 if ((ctx->flags & TLS_SERVER) == 0) { 365 tls_set_errorx(ctx, "not a server context"); 366 goto err; 367 } 368 369 if ((conn_ctx = tls_server_conn(ctx)) == NULL) { 370 tls_set_errorx(ctx, "connection context failure"); 371 goto err; 372 } 373 374 if ((conn_ctx->ssl_conn = SSL_new(ctx->ssl_ctx)) == NULL) { 375 tls_set_errorx(ctx, "ssl failure"); 376 goto err; 377 } 378 379 if (SSL_set_app_data(conn_ctx->ssl_conn, conn_ctx) != 1) { 380 tls_set_errorx(ctx, "ssl application data failure"); 381 goto err; 382 } 383 384 return conn_ctx; 385 386 err: 387 tls_free(conn_ctx); 388 389 return (NULL); 390 } 391 392 int 393 tls_accept_socket(struct tls *ctx, struct tls **cctx, int s) 394 { 395 return (tls_accept_fds(ctx, cctx, s, s)); 396 } 397 398 int 399 tls_accept_fds(struct tls *ctx, struct tls **cctx, int fd_read, int fd_write) 400 { 401 struct tls *conn_ctx; 402 403 if ((conn_ctx = tls_accept_common(ctx)) == NULL) 404 goto err; 405 406 if (SSL_set_rfd(conn_ctx->ssl_conn, fd_read) != 1 || 407 SSL_set_wfd(conn_ctx->ssl_conn, fd_write) != 1) { 408 tls_set_errorx(ctx, "ssl file descriptor failure"); 409 goto err; 410 } 411 412 *cctx = conn_ctx; 413 414 return (0); 415 err: 416 tls_free(conn_ctx); 417 *cctx = NULL; 418 419 return (-1); 420 } 421 422 int 423 tls_accept_cbs(struct tls *ctx, struct tls **cctx, 424 tls_read_cb read_cb, tls_write_cb write_cb, void *cb_arg) 425 { 426 struct tls *conn_ctx; 427 428 if ((conn_ctx = tls_accept_common(ctx)) == NULL) 429 goto err; 430 431 if (tls_set_cbs(conn_ctx, read_cb, write_cb, cb_arg) != 0) 432 goto err; 433 434 *cctx = conn_ctx; 435 436 return (0); 437 err: 438 tls_free(conn_ctx); 439 *cctx = NULL; 440 441 return (-1); 442 } 443 444 int 445 tls_handshake_server(struct tls *ctx) 446 { 447 int ssl_ret; 448 int rv = -1; 449 450 if ((ctx->flags & TLS_SERVER_CONN) == 0) { 451 tls_set_errorx(ctx, "not a server connection context"); 452 goto err; 453 } 454 455 ctx->state |= TLS_SSL_NEEDS_SHUTDOWN; 456 457 ERR_clear_error(); 458 if ((ssl_ret = SSL_accept(ctx->ssl_conn)) != 1) { 459 rv = tls_ssl_error(ctx, ctx->ssl_conn, ssl_ret, "handshake"); 460 goto err; 461 } 462 463 ctx->state |= TLS_HANDSHAKE_COMPLETE; 464 rv = 0; 465 466 err: 467 return (rv); 468 } 469