t1_lib.c 130 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060
  1. /*
  2. * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <stdlib.h>
  11. #include <openssl/objects.h>
  12. #include <openssl/evp.h>
  13. #include <openssl/hmac.h>
  14. #include <openssl/core_names.h>
  15. #include <openssl/ocsp.h>
  16. #include <openssl/conf.h>
  17. #include <openssl/x509v3.h>
  18. #include <openssl/dh.h>
  19. #include <openssl/bn.h>
  20. #include <openssl/provider.h>
  21. #include <openssl/param_build.h>
  22. #include "internal/nelem.h"
  23. #include "internal/sizes.h"
  24. #include "internal/tlsgroups.h"
  25. #include "ssl_local.h"
  26. #include "quic/quic_local.h"
  27. #include <openssl/ct.h>
  28. static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pkey);
  29. static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, const SIGALG_LOOKUP *lu);
  30. SSL3_ENC_METHOD const TLSv1_enc_data = {
  31. tls1_setup_key_block,
  32. tls1_generate_master_secret,
  33. tls1_change_cipher_state,
  34. tls1_final_finish_mac,
  35. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  36. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  37. tls1_alert_code,
  38. tls1_export_keying_material,
  39. 0,
  40. ssl3_set_handshake_header,
  41. tls_close_construct_packet,
  42. ssl3_handshake_write
  43. };
  44. SSL3_ENC_METHOD const TLSv1_1_enc_data = {
  45. tls1_setup_key_block,
  46. tls1_generate_master_secret,
  47. tls1_change_cipher_state,
  48. tls1_final_finish_mac,
  49. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  50. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  51. tls1_alert_code,
  52. tls1_export_keying_material,
  53. SSL_ENC_FLAG_EXPLICIT_IV,
  54. ssl3_set_handshake_header,
  55. tls_close_construct_packet,
  56. ssl3_handshake_write
  57. };
  58. SSL3_ENC_METHOD const TLSv1_2_enc_data = {
  59. tls1_setup_key_block,
  60. tls1_generate_master_secret,
  61. tls1_change_cipher_state,
  62. tls1_final_finish_mac,
  63. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  64. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  65. tls1_alert_code,
  66. tls1_export_keying_material,
  67. SSL_ENC_FLAG_EXPLICIT_IV | SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF
  68. | SSL_ENC_FLAG_TLS1_2_CIPHERS,
  69. ssl3_set_handshake_header,
  70. tls_close_construct_packet,
  71. ssl3_handshake_write
  72. };
  73. SSL3_ENC_METHOD const TLSv1_3_enc_data = {
  74. tls13_setup_key_block,
  75. tls13_generate_master_secret,
  76. tls13_change_cipher_state,
  77. tls13_final_finish_mac,
  78. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  79. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  80. tls13_alert_code,
  81. tls13_export_keying_material,
  82. SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF,
  83. ssl3_set_handshake_header,
  84. tls_close_construct_packet,
  85. ssl3_handshake_write
  86. };
  87. OSSL_TIME tls1_default_timeout(void)
  88. {
  89. /*
  90. * 2 hours, the 24 hours mentioned in the TLSv1 spec is way too long for
  91. * http, the cache would over fill
  92. */
  93. return ossl_seconds2time(60 * 60 * 2);
  94. }
  95. int tls1_new(SSL *s)
  96. {
  97. if (!ssl3_new(s))
  98. return 0;
  99. if (!s->method->ssl_clear(s))
  100. return 0;
  101. return 1;
  102. }
  103. void tls1_free(SSL *s)
  104. {
  105. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  106. if (sc == NULL)
  107. return;
  108. OPENSSL_free(sc->ext.session_ticket);
  109. ssl3_free(s);
  110. }
  111. int tls1_clear(SSL *s)
  112. {
  113. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  114. if (sc == NULL)
  115. return 0;
  116. if (!ssl3_clear(s))
  117. return 0;
  118. if (s->method->version == TLS_ANY_VERSION)
  119. sc->version = TLS_MAX_VERSION_INTERNAL;
  120. else
  121. sc->version = s->method->version;
  122. return 1;
  123. }
  124. /* Legacy NID to group_id mapping. Only works for groups we know about */
  125. static const struct {
  126. int nid;
  127. uint16_t group_id;
  128. } nid_to_group[] = {
  129. {NID_sect163k1, OSSL_TLS_GROUP_ID_sect163k1},
  130. {NID_sect163r1, OSSL_TLS_GROUP_ID_sect163r1},
  131. {NID_sect163r2, OSSL_TLS_GROUP_ID_sect163r2},
  132. {NID_sect193r1, OSSL_TLS_GROUP_ID_sect193r1},
  133. {NID_sect193r2, OSSL_TLS_GROUP_ID_sect193r2},
  134. {NID_sect233k1, OSSL_TLS_GROUP_ID_sect233k1},
  135. {NID_sect233r1, OSSL_TLS_GROUP_ID_sect233r1},
  136. {NID_sect239k1, OSSL_TLS_GROUP_ID_sect239k1},
  137. {NID_sect283k1, OSSL_TLS_GROUP_ID_sect283k1},
  138. {NID_sect283r1, OSSL_TLS_GROUP_ID_sect283r1},
  139. {NID_sect409k1, OSSL_TLS_GROUP_ID_sect409k1},
  140. {NID_sect409r1, OSSL_TLS_GROUP_ID_sect409r1},
  141. {NID_sect571k1, OSSL_TLS_GROUP_ID_sect571k1},
  142. {NID_sect571r1, OSSL_TLS_GROUP_ID_sect571r1},
  143. {NID_secp160k1, OSSL_TLS_GROUP_ID_secp160k1},
  144. {NID_secp160r1, OSSL_TLS_GROUP_ID_secp160r1},
  145. {NID_secp160r2, OSSL_TLS_GROUP_ID_secp160r2},
  146. {NID_secp192k1, OSSL_TLS_GROUP_ID_secp192k1},
  147. {NID_X9_62_prime192v1, OSSL_TLS_GROUP_ID_secp192r1},
  148. {NID_secp224k1, OSSL_TLS_GROUP_ID_secp224k1},
  149. {NID_secp224r1, OSSL_TLS_GROUP_ID_secp224r1},
  150. {NID_secp256k1, OSSL_TLS_GROUP_ID_secp256k1},
  151. {NID_X9_62_prime256v1, OSSL_TLS_GROUP_ID_secp256r1},
  152. {NID_secp384r1, OSSL_TLS_GROUP_ID_secp384r1},
  153. {NID_secp521r1, OSSL_TLS_GROUP_ID_secp521r1},
  154. {NID_brainpoolP256r1, OSSL_TLS_GROUP_ID_brainpoolP256r1},
  155. {NID_brainpoolP384r1, OSSL_TLS_GROUP_ID_brainpoolP384r1},
  156. {NID_brainpoolP512r1, OSSL_TLS_GROUP_ID_brainpoolP512r1},
  157. {EVP_PKEY_X25519, OSSL_TLS_GROUP_ID_x25519},
  158. {EVP_PKEY_X448, OSSL_TLS_GROUP_ID_x448},
  159. {NID_brainpoolP256r1tls13, OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13},
  160. {NID_brainpoolP384r1tls13, OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13},
  161. {NID_brainpoolP512r1tls13, OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13},
  162. {NID_id_tc26_gost_3410_2012_256_paramSetA, OSSL_TLS_GROUP_ID_gc256A},
  163. {NID_id_tc26_gost_3410_2012_256_paramSetB, OSSL_TLS_GROUP_ID_gc256B},
  164. {NID_id_tc26_gost_3410_2012_256_paramSetC, OSSL_TLS_GROUP_ID_gc256C},
  165. {NID_id_tc26_gost_3410_2012_256_paramSetD, OSSL_TLS_GROUP_ID_gc256D},
  166. {NID_id_tc26_gost_3410_2012_512_paramSetA, OSSL_TLS_GROUP_ID_gc512A},
  167. {NID_id_tc26_gost_3410_2012_512_paramSetB, OSSL_TLS_GROUP_ID_gc512B},
  168. {NID_id_tc26_gost_3410_2012_512_paramSetC, OSSL_TLS_GROUP_ID_gc512C},
  169. {NID_ffdhe2048, OSSL_TLS_GROUP_ID_ffdhe2048},
  170. {NID_ffdhe3072, OSSL_TLS_GROUP_ID_ffdhe3072},
  171. {NID_ffdhe4096, OSSL_TLS_GROUP_ID_ffdhe4096},
  172. {NID_ffdhe6144, OSSL_TLS_GROUP_ID_ffdhe6144},
  173. {NID_ffdhe8192, OSSL_TLS_GROUP_ID_ffdhe8192}
  174. };
  175. static const unsigned char ecformats_default[] = {
  176. TLSEXT_ECPOINTFORMAT_uncompressed,
  177. TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
  178. TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
  179. };
  180. /* The default curves */
  181. static const uint16_t supported_groups_default[] = {
  182. OSSL_TLS_GROUP_ID_x25519, /* X25519 (29) */
  183. OSSL_TLS_GROUP_ID_secp256r1, /* secp256r1 (23) */
  184. OSSL_TLS_GROUP_ID_x448, /* X448 (30) */
  185. OSSL_TLS_GROUP_ID_secp521r1, /* secp521r1 (25) */
  186. OSSL_TLS_GROUP_ID_secp384r1, /* secp384r1 (24) */
  187. OSSL_TLS_GROUP_ID_gc256A, /* GC256A (34) */
  188. OSSL_TLS_GROUP_ID_gc256B, /* GC256B (35) */
  189. OSSL_TLS_GROUP_ID_gc256C, /* GC256C (36) */
  190. OSSL_TLS_GROUP_ID_gc256D, /* GC256D (37) */
  191. OSSL_TLS_GROUP_ID_gc512A, /* GC512A (38) */
  192. OSSL_TLS_GROUP_ID_gc512B, /* GC512B (39) */
  193. OSSL_TLS_GROUP_ID_gc512C, /* GC512C (40) */
  194. OSSL_TLS_GROUP_ID_ffdhe2048, /* ffdhe2048 (0x100) */
  195. OSSL_TLS_GROUP_ID_ffdhe3072, /* ffdhe3072 (0x101) */
  196. OSSL_TLS_GROUP_ID_ffdhe4096, /* ffdhe4096 (0x102) */
  197. OSSL_TLS_GROUP_ID_ffdhe6144, /* ffdhe6144 (0x103) */
  198. OSSL_TLS_GROUP_ID_ffdhe8192, /* ffdhe8192 (0x104) */
  199. };
  200. static const uint16_t suiteb_curves[] = {
  201. OSSL_TLS_GROUP_ID_secp256r1,
  202. OSSL_TLS_GROUP_ID_secp384r1,
  203. };
  204. struct provider_ctx_data_st {
  205. SSL_CTX *ctx;
  206. OSSL_PROVIDER *provider;
  207. };
  208. #define TLS_GROUP_LIST_MALLOC_BLOCK_SIZE 10
  209. static OSSL_CALLBACK add_provider_groups;
  210. static int add_provider_groups(const OSSL_PARAM params[], void *data)
  211. {
  212. struct provider_ctx_data_st *pgd = data;
  213. SSL_CTX *ctx = pgd->ctx;
  214. OSSL_PROVIDER *provider = pgd->provider;
  215. const OSSL_PARAM *p;
  216. TLS_GROUP_INFO *ginf = NULL;
  217. EVP_KEYMGMT *keymgmt;
  218. unsigned int gid;
  219. unsigned int is_kem = 0;
  220. int ret = 0;
  221. if (ctx->group_list_max_len == ctx->group_list_len) {
  222. TLS_GROUP_INFO *tmp = NULL;
  223. if (ctx->group_list_max_len == 0)
  224. tmp = OPENSSL_malloc(sizeof(TLS_GROUP_INFO)
  225. * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE);
  226. else
  227. tmp = OPENSSL_realloc(ctx->group_list,
  228. (ctx->group_list_max_len
  229. + TLS_GROUP_LIST_MALLOC_BLOCK_SIZE)
  230. * sizeof(TLS_GROUP_INFO));
  231. if (tmp == NULL)
  232. return 0;
  233. ctx->group_list = tmp;
  234. memset(tmp + ctx->group_list_max_len,
  235. 0,
  236. sizeof(TLS_GROUP_INFO) * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE);
  237. ctx->group_list_max_len += TLS_GROUP_LIST_MALLOC_BLOCK_SIZE;
  238. }
  239. ginf = &ctx->group_list[ctx->group_list_len];
  240. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME);
  241. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  242. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  243. goto err;
  244. }
  245. ginf->tlsname = OPENSSL_strdup(p->data);
  246. if (ginf->tlsname == NULL)
  247. goto err;
  248. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL);
  249. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  250. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  251. goto err;
  252. }
  253. ginf->realname = OPENSSL_strdup(p->data);
  254. if (ginf->realname == NULL)
  255. goto err;
  256. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ID);
  257. if (p == NULL || !OSSL_PARAM_get_uint(p, &gid) || gid > UINT16_MAX) {
  258. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  259. goto err;
  260. }
  261. ginf->group_id = (uint16_t)gid;
  262. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ALG);
  263. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  264. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  265. goto err;
  266. }
  267. ginf->algorithm = OPENSSL_strdup(p->data);
  268. if (ginf->algorithm == NULL)
  269. goto err;
  270. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS);
  271. if (p == NULL || !OSSL_PARAM_get_uint(p, &ginf->secbits)) {
  272. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  273. goto err;
  274. }
  275. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_IS_KEM);
  276. if (p != NULL && (!OSSL_PARAM_get_uint(p, &is_kem) || is_kem > 1)) {
  277. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  278. goto err;
  279. }
  280. ginf->is_kem = 1 & is_kem;
  281. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_TLS);
  282. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mintls)) {
  283. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  284. goto err;
  285. }
  286. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_TLS);
  287. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxtls)) {
  288. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  289. goto err;
  290. }
  291. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS);
  292. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mindtls)) {
  293. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  294. goto err;
  295. }
  296. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS);
  297. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxdtls)) {
  298. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  299. goto err;
  300. }
  301. /*
  302. * Now check that the algorithm is actually usable for our property query
  303. * string. Regardless of the result we still return success because we have
  304. * successfully processed this group, even though we may decide not to use
  305. * it.
  306. */
  307. ret = 1;
  308. ERR_set_mark();
  309. keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, ginf->algorithm, ctx->propq);
  310. if (keymgmt != NULL) {
  311. /*
  312. * We have successfully fetched the algorithm - however if the provider
  313. * doesn't match this one then we ignore it.
  314. *
  315. * Note: We're cheating a little here. Technically if the same algorithm
  316. * is available from more than one provider then it is undefined which
  317. * implementation you will get back. Theoretically this could be
  318. * different every time...we assume here that you'll always get the
  319. * same one back if you repeat the exact same fetch. Is this a reasonable
  320. * assumption to make (in which case perhaps we should document this
  321. * behaviour)?
  322. */
  323. if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) {
  324. /* We have a match - so we will use this group */
  325. ctx->group_list_len++;
  326. ginf = NULL;
  327. }
  328. EVP_KEYMGMT_free(keymgmt);
  329. }
  330. ERR_pop_to_mark();
  331. err:
  332. if (ginf != NULL) {
  333. OPENSSL_free(ginf->tlsname);
  334. OPENSSL_free(ginf->realname);
  335. OPENSSL_free(ginf->algorithm);
  336. ginf->algorithm = ginf->tlsname = ginf->realname = NULL;
  337. }
  338. return ret;
  339. }
  340. static int discover_provider_groups(OSSL_PROVIDER *provider, void *vctx)
  341. {
  342. struct provider_ctx_data_st pgd;
  343. pgd.ctx = vctx;
  344. pgd.provider = provider;
  345. return OSSL_PROVIDER_get_capabilities(provider, "TLS-GROUP",
  346. add_provider_groups, &pgd);
  347. }
  348. int ssl_load_groups(SSL_CTX *ctx)
  349. {
  350. size_t i, j, num_deflt_grps = 0;
  351. uint16_t tmp_supp_groups[OSSL_NELEM(supported_groups_default)];
  352. if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_groups, ctx))
  353. return 0;
  354. for (i = 0; i < OSSL_NELEM(supported_groups_default); i++) {
  355. for (j = 0; j < ctx->group_list_len; j++) {
  356. if (ctx->group_list[j].group_id == supported_groups_default[i]) {
  357. tmp_supp_groups[num_deflt_grps++] = ctx->group_list[j].group_id;
  358. break;
  359. }
  360. }
  361. }
  362. if (num_deflt_grps == 0)
  363. return 1;
  364. ctx->ext.supported_groups_default
  365. = OPENSSL_malloc(sizeof(uint16_t) * num_deflt_grps);
  366. if (ctx->ext.supported_groups_default == NULL)
  367. return 0;
  368. memcpy(ctx->ext.supported_groups_default,
  369. tmp_supp_groups,
  370. num_deflt_grps * sizeof(tmp_supp_groups[0]));
  371. ctx->ext.supported_groups_default_len = num_deflt_grps;
  372. return 1;
  373. }
  374. #define TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE 10
  375. static OSSL_CALLBACK add_provider_sigalgs;
  376. static int add_provider_sigalgs(const OSSL_PARAM params[], void *data)
  377. {
  378. struct provider_ctx_data_st *pgd = data;
  379. SSL_CTX *ctx = pgd->ctx;
  380. OSSL_PROVIDER *provider = pgd->provider;
  381. const OSSL_PARAM *p;
  382. TLS_SIGALG_INFO *sinf = NULL;
  383. EVP_KEYMGMT *keymgmt;
  384. const char *keytype;
  385. unsigned int code_point = 0;
  386. int ret = 0;
  387. if (ctx->sigalg_list_max_len == ctx->sigalg_list_len) {
  388. TLS_SIGALG_INFO *tmp = NULL;
  389. if (ctx->sigalg_list_max_len == 0)
  390. tmp = OPENSSL_malloc(sizeof(TLS_SIGALG_INFO)
  391. * TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE);
  392. else
  393. tmp = OPENSSL_realloc(ctx->sigalg_list,
  394. (ctx->sigalg_list_max_len
  395. + TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE)
  396. * sizeof(TLS_SIGALG_INFO));
  397. if (tmp == NULL)
  398. return 0;
  399. ctx->sigalg_list = tmp;
  400. memset(tmp + ctx->sigalg_list_max_len, 0,
  401. sizeof(TLS_SIGALG_INFO) * TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE);
  402. ctx->sigalg_list_max_len += TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE;
  403. }
  404. sinf = &ctx->sigalg_list[ctx->sigalg_list_len];
  405. /* First, mandatory parameters */
  406. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_NAME);
  407. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  408. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  409. goto err;
  410. }
  411. OPENSSL_free(sinf->sigalg_name);
  412. sinf->sigalg_name = OPENSSL_strdup(p->data);
  413. if (sinf->sigalg_name == NULL)
  414. goto err;
  415. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_IANA_NAME);
  416. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  417. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  418. goto err;
  419. }
  420. OPENSSL_free(sinf->name);
  421. sinf->name = OPENSSL_strdup(p->data);
  422. if (sinf->name == NULL)
  423. goto err;
  424. p = OSSL_PARAM_locate_const(params,
  425. OSSL_CAPABILITY_TLS_SIGALG_CODE_POINT);
  426. if (p == NULL
  427. || !OSSL_PARAM_get_uint(p, &code_point)
  428. || code_point > UINT16_MAX) {
  429. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  430. goto err;
  431. }
  432. sinf->code_point = (uint16_t)code_point;
  433. p = OSSL_PARAM_locate_const(params,
  434. OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS);
  435. if (p == NULL || !OSSL_PARAM_get_uint(p, &sinf->secbits)) {
  436. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  437. goto err;
  438. }
  439. /* Now, optional parameters */
  440. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_OID);
  441. if (p == NULL) {
  442. sinf->sigalg_oid = NULL;
  443. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  444. goto err;
  445. } else {
  446. OPENSSL_free(sinf->sigalg_oid);
  447. sinf->sigalg_oid = OPENSSL_strdup(p->data);
  448. if (sinf->sigalg_oid == NULL)
  449. goto err;
  450. }
  451. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_SIG_NAME);
  452. if (p == NULL) {
  453. sinf->sig_name = NULL;
  454. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  455. goto err;
  456. } else {
  457. OPENSSL_free(sinf->sig_name);
  458. sinf->sig_name = OPENSSL_strdup(p->data);
  459. if (sinf->sig_name == NULL)
  460. goto err;
  461. }
  462. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_SIG_OID);
  463. if (p == NULL) {
  464. sinf->sig_oid = NULL;
  465. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  466. goto err;
  467. } else {
  468. OPENSSL_free(sinf->sig_oid);
  469. sinf->sig_oid = OPENSSL_strdup(p->data);
  470. if (sinf->sig_oid == NULL)
  471. goto err;
  472. }
  473. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_HASH_NAME);
  474. if (p == NULL) {
  475. sinf->hash_name = NULL;
  476. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  477. goto err;
  478. } else {
  479. OPENSSL_free(sinf->hash_name);
  480. sinf->hash_name = OPENSSL_strdup(p->data);
  481. if (sinf->hash_name == NULL)
  482. goto err;
  483. }
  484. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_HASH_OID);
  485. if (p == NULL) {
  486. sinf->hash_oid = NULL;
  487. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  488. goto err;
  489. } else {
  490. OPENSSL_free(sinf->hash_oid);
  491. sinf->hash_oid = OPENSSL_strdup(p->data);
  492. if (sinf->hash_oid == NULL)
  493. goto err;
  494. }
  495. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_KEYTYPE);
  496. if (p == NULL) {
  497. sinf->keytype = NULL;
  498. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  499. goto err;
  500. } else {
  501. OPENSSL_free(sinf->keytype);
  502. sinf->keytype = OPENSSL_strdup(p->data);
  503. if (sinf->keytype == NULL)
  504. goto err;
  505. }
  506. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_KEYTYPE_OID);
  507. if (p == NULL) {
  508. sinf->keytype_oid = NULL;
  509. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  510. goto err;
  511. } else {
  512. OPENSSL_free(sinf->keytype_oid);
  513. sinf->keytype_oid = OPENSSL_strdup(p->data);
  514. if (sinf->keytype_oid == NULL)
  515. goto err;
  516. }
  517. /* The remaining parameters below are mandatory again */
  518. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MIN_TLS);
  519. if (p == NULL || !OSSL_PARAM_get_int(p, &sinf->mintls)) {
  520. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  521. goto err;
  522. }
  523. if ((sinf->mintls != 0) && (sinf->mintls != -1) &&
  524. ((sinf->mintls < TLS1_3_VERSION))) {
  525. /* ignore this sigalg as this OpenSSL doesn't know how to handle it */
  526. ret = 1;
  527. goto err;
  528. }
  529. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MAX_TLS);
  530. if (p == NULL || !OSSL_PARAM_get_int(p, &sinf->maxtls)) {
  531. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  532. goto err;
  533. }
  534. if ((sinf->maxtls != 0) && (sinf->maxtls != -1) &&
  535. ((sinf->maxtls < sinf->mintls))) {
  536. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  537. goto err;
  538. }
  539. if ((sinf->maxtls != 0) && (sinf->maxtls != -1) &&
  540. ((sinf->maxtls < TLS1_3_VERSION))) {
  541. /* ignore this sigalg as this OpenSSL doesn't know how to handle it */
  542. ret = 1;
  543. goto err;
  544. }
  545. /*
  546. * Now check that the algorithm is actually usable for our property query
  547. * string. Regardless of the result we still return success because we have
  548. * successfully processed this signature, even though we may decide not to
  549. * use it.
  550. */
  551. ret = 1;
  552. ERR_set_mark();
  553. keytype = (sinf->keytype != NULL
  554. ? sinf->keytype
  555. : (sinf->sig_name != NULL
  556. ? sinf->sig_name
  557. : sinf->sigalg_name));
  558. keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, keytype, ctx->propq);
  559. if (keymgmt != NULL) {
  560. /*
  561. * We have successfully fetched the algorithm - however if the provider
  562. * doesn't match this one then we ignore it.
  563. *
  564. * Note: We're cheating a little here. Technically if the same algorithm
  565. * is available from more than one provider then it is undefined which
  566. * implementation you will get back. Theoretically this could be
  567. * different every time...we assume here that you'll always get the
  568. * same one back if you repeat the exact same fetch. Is this a reasonable
  569. * assumption to make (in which case perhaps we should document this
  570. * behaviour)?
  571. */
  572. if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) {
  573. /*
  574. * We have a match - so we could use this signature;
  575. * Check proper object registration first, though.
  576. * Don't care about return value as this may have been
  577. * done within providers or previous calls to
  578. * add_provider_sigalgs.
  579. */
  580. OBJ_create(sinf->sigalg_oid, sinf->sigalg_name, NULL);
  581. /* sanity check: Without successful registration don't use alg */
  582. if ((OBJ_txt2nid(sinf->sigalg_name) == NID_undef) ||
  583. (OBJ_nid2obj(OBJ_txt2nid(sinf->sigalg_name)) == NULL)) {
  584. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  585. goto err;
  586. }
  587. if (sinf->sig_name != NULL)
  588. OBJ_create(sinf->sig_oid, sinf->sig_name, NULL);
  589. if (sinf->keytype != NULL)
  590. OBJ_create(sinf->keytype_oid, sinf->keytype, NULL);
  591. if (sinf->hash_name != NULL)
  592. OBJ_create(sinf->hash_oid, sinf->hash_name, NULL);
  593. OBJ_add_sigid(OBJ_txt2nid(sinf->sigalg_name),
  594. (sinf->hash_name != NULL
  595. ? OBJ_txt2nid(sinf->hash_name)
  596. : NID_undef),
  597. OBJ_txt2nid(keytype));
  598. ctx->sigalg_list_len++;
  599. sinf = NULL;
  600. }
  601. EVP_KEYMGMT_free(keymgmt);
  602. }
  603. ERR_pop_to_mark();
  604. err:
  605. if (sinf != NULL) {
  606. OPENSSL_free(sinf->name);
  607. sinf->name = NULL;
  608. OPENSSL_free(sinf->sigalg_name);
  609. sinf->sigalg_name = NULL;
  610. OPENSSL_free(sinf->sigalg_oid);
  611. sinf->sigalg_oid = NULL;
  612. OPENSSL_free(sinf->sig_name);
  613. sinf->sig_name = NULL;
  614. OPENSSL_free(sinf->sig_oid);
  615. sinf->sig_oid = NULL;
  616. OPENSSL_free(sinf->hash_name);
  617. sinf->hash_name = NULL;
  618. OPENSSL_free(sinf->hash_oid);
  619. sinf->hash_oid = NULL;
  620. OPENSSL_free(sinf->keytype);
  621. sinf->keytype = NULL;
  622. OPENSSL_free(sinf->keytype_oid);
  623. sinf->keytype_oid = NULL;
  624. }
  625. return ret;
  626. }
  627. static int discover_provider_sigalgs(OSSL_PROVIDER *provider, void *vctx)
  628. {
  629. struct provider_ctx_data_st pgd;
  630. pgd.ctx = vctx;
  631. pgd.provider = provider;
  632. OSSL_PROVIDER_get_capabilities(provider, "TLS-SIGALG",
  633. add_provider_sigalgs, &pgd);
  634. /*
  635. * Always OK, even if provider doesn't support the capability:
  636. * Reconsider testing retval when legacy sigalgs are also loaded this way.
  637. */
  638. return 1;
  639. }
  640. int ssl_load_sigalgs(SSL_CTX *ctx)
  641. {
  642. size_t i;
  643. SSL_CERT_LOOKUP lu;
  644. if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_sigalgs, ctx))
  645. return 0;
  646. /* now populate ctx->ssl_cert_info */
  647. if (ctx->sigalg_list_len > 0) {
  648. OPENSSL_free(ctx->ssl_cert_info);
  649. ctx->ssl_cert_info = OPENSSL_zalloc(sizeof(lu) * ctx->sigalg_list_len);
  650. if (ctx->ssl_cert_info == NULL)
  651. return 0;
  652. for(i = 0; i < ctx->sigalg_list_len; i++) {
  653. ctx->ssl_cert_info[i].nid = OBJ_txt2nid(ctx->sigalg_list[i].sigalg_name);
  654. ctx->ssl_cert_info[i].amask = SSL_aANY;
  655. }
  656. }
  657. /*
  658. * For now, leave it at this: legacy sigalgs stay in their own
  659. * data structures until "legacy cleanup" occurs.
  660. */
  661. return 1;
  662. }
  663. static uint16_t tls1_group_name2id(SSL_CTX *ctx, const char *name)
  664. {
  665. size_t i;
  666. for (i = 0; i < ctx->group_list_len; i++) {
  667. if (strcmp(ctx->group_list[i].tlsname, name) == 0
  668. || strcmp(ctx->group_list[i].realname, name) == 0)
  669. return ctx->group_list[i].group_id;
  670. }
  671. return 0;
  672. }
  673. const TLS_GROUP_INFO *tls1_group_id_lookup(SSL_CTX *ctx, uint16_t group_id)
  674. {
  675. size_t i;
  676. for (i = 0; i < ctx->group_list_len; i++) {
  677. if (ctx->group_list[i].group_id == group_id)
  678. return &ctx->group_list[i];
  679. }
  680. return NULL;
  681. }
  682. const char *tls1_group_id2name(SSL_CTX *ctx, uint16_t group_id)
  683. {
  684. const TLS_GROUP_INFO *tls_group_info = tls1_group_id_lookup(ctx, group_id);
  685. if (tls_group_info == NULL)
  686. return NULL;
  687. return tls_group_info->tlsname;
  688. }
  689. int tls1_group_id2nid(uint16_t group_id, int include_unknown)
  690. {
  691. size_t i;
  692. if (group_id == 0)
  693. return NID_undef;
  694. /*
  695. * Return well known Group NIDs - for backwards compatibility. This won't
  696. * work for groups we don't know about.
  697. */
  698. for (i = 0; i < OSSL_NELEM(nid_to_group); i++)
  699. {
  700. if (nid_to_group[i].group_id == group_id)
  701. return nid_to_group[i].nid;
  702. }
  703. if (!include_unknown)
  704. return NID_undef;
  705. return TLSEXT_nid_unknown | (int)group_id;
  706. }
  707. uint16_t tls1_nid2group_id(int nid)
  708. {
  709. size_t i;
  710. /*
  711. * Return well known Group ids - for backwards compatibility. This won't
  712. * work for groups we don't know about.
  713. */
  714. for (i = 0; i < OSSL_NELEM(nid_to_group); i++)
  715. {
  716. if (nid_to_group[i].nid == nid)
  717. return nid_to_group[i].group_id;
  718. }
  719. return 0;
  720. }
  721. /*
  722. * Set *pgroups to the supported groups list and *pgroupslen to
  723. * the number of groups supported.
  724. */
  725. void tls1_get_supported_groups(SSL_CONNECTION *s, const uint16_t **pgroups,
  726. size_t *pgroupslen)
  727. {
  728. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  729. /* For Suite B mode only include P-256, P-384 */
  730. switch (tls1_suiteb(s)) {
  731. case SSL_CERT_FLAG_SUITEB_128_LOS:
  732. *pgroups = suiteb_curves;
  733. *pgroupslen = OSSL_NELEM(suiteb_curves);
  734. break;
  735. case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
  736. *pgroups = suiteb_curves;
  737. *pgroupslen = 1;
  738. break;
  739. case SSL_CERT_FLAG_SUITEB_192_LOS:
  740. *pgroups = suiteb_curves + 1;
  741. *pgroupslen = 1;
  742. break;
  743. default:
  744. if (s->ext.supportedgroups == NULL) {
  745. *pgroups = sctx->ext.supported_groups_default;
  746. *pgroupslen = sctx->ext.supported_groups_default_len;
  747. } else {
  748. *pgroups = s->ext.supportedgroups;
  749. *pgroupslen = s->ext.supportedgroups_len;
  750. }
  751. break;
  752. }
  753. }
  754. int tls_valid_group(SSL_CONNECTION *s, uint16_t group_id,
  755. int minversion, int maxversion,
  756. int isec, int *okfortls13)
  757. {
  758. const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
  759. group_id);
  760. int ret;
  761. int group_minversion, group_maxversion;
  762. if (okfortls13 != NULL)
  763. *okfortls13 = 0;
  764. if (ginfo == NULL)
  765. return 0;
  766. group_minversion = SSL_CONNECTION_IS_DTLS(s) ? ginfo->mindtls : ginfo->mintls;
  767. group_maxversion = SSL_CONNECTION_IS_DTLS(s) ? ginfo->maxdtls : ginfo->maxtls;
  768. if (group_minversion < 0 || group_maxversion < 0)
  769. return 0;
  770. if (group_maxversion == 0)
  771. ret = 1;
  772. else
  773. ret = (ssl_version_cmp(s, minversion, group_maxversion) <= 0);
  774. if (group_minversion > 0)
  775. ret &= (ssl_version_cmp(s, maxversion, group_minversion) >= 0);
  776. if (!SSL_CONNECTION_IS_DTLS(s)) {
  777. if (ret && okfortls13 != NULL && maxversion == TLS1_3_VERSION)
  778. *okfortls13 = (group_maxversion == 0)
  779. || (group_maxversion >= TLS1_3_VERSION);
  780. }
  781. ret &= !isec
  782. || strcmp(ginfo->algorithm, "EC") == 0
  783. || strcmp(ginfo->algorithm, "X25519") == 0
  784. || strcmp(ginfo->algorithm, "X448") == 0;
  785. return ret;
  786. }
  787. /* See if group is allowed by security callback */
  788. int tls_group_allowed(SSL_CONNECTION *s, uint16_t group, int op)
  789. {
  790. const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
  791. group);
  792. unsigned char gtmp[2];
  793. if (ginfo == NULL)
  794. return 0;
  795. gtmp[0] = group >> 8;
  796. gtmp[1] = group & 0xff;
  797. return ssl_security(s, op, ginfo->secbits,
  798. tls1_group_id2nid(ginfo->group_id, 0), (void *)gtmp);
  799. }
  800. /* Return 1 if "id" is in "list" */
  801. static int tls1_in_list(uint16_t id, const uint16_t *list, size_t listlen)
  802. {
  803. size_t i;
  804. for (i = 0; i < listlen; i++)
  805. if (list[i] == id)
  806. return 1;
  807. return 0;
  808. }
  809. /*-
  810. * For nmatch >= 0, return the id of the |nmatch|th shared group or 0
  811. * if there is no match.
  812. * For nmatch == -1, return number of matches
  813. * For nmatch == -2, return the id of the group to use for
  814. * a tmp key, or 0 if there is no match.
  815. */
  816. uint16_t tls1_shared_group(SSL_CONNECTION *s, int nmatch)
  817. {
  818. const uint16_t *pref, *supp;
  819. size_t num_pref, num_supp, i;
  820. int k;
  821. SSL_CTX *ctx = SSL_CONNECTION_GET_CTX(s);
  822. /* Can't do anything on client side */
  823. if (s->server == 0)
  824. return 0;
  825. if (nmatch == -2) {
  826. if (tls1_suiteb(s)) {
  827. /*
  828. * For Suite B ciphersuite determines curve: we already know
  829. * these are acceptable due to previous checks.
  830. */
  831. unsigned long cid = s->s3.tmp.new_cipher->id;
  832. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
  833. return OSSL_TLS_GROUP_ID_secp256r1;
  834. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
  835. return OSSL_TLS_GROUP_ID_secp384r1;
  836. /* Should never happen */
  837. return 0;
  838. }
  839. /* If not Suite B just return first preference shared curve */
  840. nmatch = 0;
  841. }
  842. /*
  843. * If server preference set, our groups are the preference order
  844. * otherwise peer decides.
  845. */
  846. if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
  847. tls1_get_supported_groups(s, &pref, &num_pref);
  848. tls1_get_peer_groups(s, &supp, &num_supp);
  849. } else {
  850. tls1_get_peer_groups(s, &pref, &num_pref);
  851. tls1_get_supported_groups(s, &supp, &num_supp);
  852. }
  853. for (k = 0, i = 0; i < num_pref; i++) {
  854. uint16_t id = pref[i];
  855. const TLS_GROUP_INFO *inf;
  856. int minversion, maxversion;
  857. if (!tls1_in_list(id, supp, num_supp)
  858. || !tls_group_allowed(s, id, SSL_SECOP_CURVE_SHARED))
  859. continue;
  860. inf = tls1_group_id_lookup(ctx, id);
  861. if (!ossl_assert(inf != NULL))
  862. return 0;
  863. minversion = SSL_CONNECTION_IS_DTLS(s)
  864. ? inf->mindtls : inf->mintls;
  865. maxversion = SSL_CONNECTION_IS_DTLS(s)
  866. ? inf->maxdtls : inf->maxtls;
  867. if (maxversion == -1)
  868. continue;
  869. if ((minversion != 0 && ssl_version_cmp(s, s->version, minversion) < 0)
  870. || (maxversion != 0
  871. && ssl_version_cmp(s, s->version, maxversion) > 0))
  872. continue;
  873. if (nmatch == k)
  874. return id;
  875. k++;
  876. }
  877. if (nmatch == -1)
  878. return k;
  879. /* Out of range (nmatch > k). */
  880. return 0;
  881. }
  882. int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  883. int *groups, size_t ngroups)
  884. {
  885. uint16_t *glist;
  886. size_t i;
  887. /*
  888. * Bitmap of groups included to detect duplicates: two variables are added
  889. * to detect duplicates as some values are more than 32.
  890. */
  891. unsigned long *dup_list = NULL;
  892. unsigned long dup_list_egrp = 0;
  893. unsigned long dup_list_dhgrp = 0;
  894. if (ngroups == 0) {
  895. ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
  896. return 0;
  897. }
  898. if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL)
  899. return 0;
  900. for (i = 0; i < ngroups; i++) {
  901. unsigned long idmask;
  902. uint16_t id;
  903. id = tls1_nid2group_id(groups[i]);
  904. if ((id & 0x00FF) >= (sizeof(unsigned long) * 8))
  905. goto err;
  906. idmask = 1L << (id & 0x00FF);
  907. dup_list = (id < 0x100) ? &dup_list_egrp : &dup_list_dhgrp;
  908. if (!id || ((*dup_list) & idmask))
  909. goto err;
  910. *dup_list |= idmask;
  911. glist[i] = id;
  912. }
  913. OPENSSL_free(*pext);
  914. *pext = glist;
  915. *pextlen = ngroups;
  916. return 1;
  917. err:
  918. OPENSSL_free(glist);
  919. return 0;
  920. }
  921. # define GROUPLIST_INCREMENT 40
  922. # define GROUP_NAME_BUFFER_LENGTH 64
  923. typedef struct {
  924. SSL_CTX *ctx;
  925. size_t gidcnt;
  926. size_t gidmax;
  927. uint16_t *gid_arr;
  928. } gid_cb_st;
  929. static int gid_cb(const char *elem, int len, void *arg)
  930. {
  931. gid_cb_st *garg = arg;
  932. size_t i;
  933. uint16_t gid = 0;
  934. char etmp[GROUP_NAME_BUFFER_LENGTH];
  935. int ignore_unknown = 0;
  936. if (elem == NULL)
  937. return 0;
  938. if (elem[0] == '?') {
  939. ignore_unknown = 1;
  940. ++elem;
  941. --len;
  942. }
  943. if (garg->gidcnt == garg->gidmax) {
  944. uint16_t *tmp =
  945. OPENSSL_realloc(garg->gid_arr,
  946. (garg->gidmax + GROUPLIST_INCREMENT) * sizeof(*garg->gid_arr));
  947. if (tmp == NULL)
  948. return 0;
  949. garg->gidmax += GROUPLIST_INCREMENT;
  950. garg->gid_arr = tmp;
  951. }
  952. if (len > (int)(sizeof(etmp) - 1))
  953. return 0;
  954. memcpy(etmp, elem, len);
  955. etmp[len] = 0;
  956. gid = tls1_group_name2id(garg->ctx, etmp);
  957. if (gid == 0) {
  958. /* Unknown group - ignore, if ignore_unknown */
  959. return ignore_unknown;
  960. }
  961. for (i = 0; i < garg->gidcnt; i++)
  962. if (garg->gid_arr[i] == gid) {
  963. /* Duplicate group - ignore */
  964. return 1;
  965. }
  966. garg->gid_arr[garg->gidcnt++] = gid;
  967. return 1;
  968. }
  969. /* Set groups based on a colon separated list */
  970. int tls1_set_groups_list(SSL_CTX *ctx, uint16_t **pext, size_t *pextlen,
  971. const char *str)
  972. {
  973. gid_cb_st gcb;
  974. uint16_t *tmparr;
  975. int ret = 0;
  976. gcb.gidcnt = 0;
  977. gcb.gidmax = GROUPLIST_INCREMENT;
  978. gcb.gid_arr = OPENSSL_malloc(gcb.gidmax * sizeof(*gcb.gid_arr));
  979. if (gcb.gid_arr == NULL)
  980. return 0;
  981. gcb.ctx = ctx;
  982. if (!CONF_parse_list(str, ':', 1, gid_cb, &gcb))
  983. goto end;
  984. if (gcb.gidcnt == 0) {
  985. ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT,
  986. "No valid groups in '%s'", str);
  987. goto end;
  988. }
  989. if (pext == NULL) {
  990. ret = 1;
  991. goto end;
  992. }
  993. /*
  994. * gid_cb ensurse there are no duplicates so we can just go ahead and set
  995. * the result
  996. */
  997. tmparr = OPENSSL_memdup(gcb.gid_arr, gcb.gidcnt * sizeof(*tmparr));
  998. if (tmparr == NULL)
  999. goto end;
  1000. OPENSSL_free(*pext);
  1001. *pext = tmparr;
  1002. *pextlen = gcb.gidcnt;
  1003. ret = 1;
  1004. end:
  1005. OPENSSL_free(gcb.gid_arr);
  1006. return ret;
  1007. }
  1008. /* Check a group id matches preferences */
  1009. int tls1_check_group_id(SSL_CONNECTION *s, uint16_t group_id,
  1010. int check_own_groups)
  1011. {
  1012. const uint16_t *groups;
  1013. size_t groups_len;
  1014. if (group_id == 0)
  1015. return 0;
  1016. /* Check for Suite B compliance */
  1017. if (tls1_suiteb(s) && s->s3.tmp.new_cipher != NULL) {
  1018. unsigned long cid = s->s3.tmp.new_cipher->id;
  1019. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) {
  1020. if (group_id != OSSL_TLS_GROUP_ID_secp256r1)
  1021. return 0;
  1022. } else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) {
  1023. if (group_id != OSSL_TLS_GROUP_ID_secp384r1)
  1024. return 0;
  1025. } else {
  1026. /* Should never happen */
  1027. return 0;
  1028. }
  1029. }
  1030. if (check_own_groups) {
  1031. /* Check group is one of our preferences */
  1032. tls1_get_supported_groups(s, &groups, &groups_len);
  1033. if (!tls1_in_list(group_id, groups, groups_len))
  1034. return 0;
  1035. }
  1036. if (!tls_group_allowed(s, group_id, SSL_SECOP_CURVE_CHECK))
  1037. return 0;
  1038. /* For clients, nothing more to check */
  1039. if (!s->server)
  1040. return 1;
  1041. /* Check group is one of peers preferences */
  1042. tls1_get_peer_groups(s, &groups, &groups_len);
  1043. /*
  1044. * RFC 4492 does not require the supported elliptic curves extension
  1045. * so if it is not sent we can just choose any curve.
  1046. * It is invalid to send an empty list in the supported groups
  1047. * extension, so groups_len == 0 always means no extension.
  1048. */
  1049. if (groups_len == 0)
  1050. return 1;
  1051. return tls1_in_list(group_id, groups, groups_len);
  1052. }
  1053. void tls1_get_formatlist(SSL_CONNECTION *s, const unsigned char **pformats,
  1054. size_t *num_formats)
  1055. {
  1056. /*
  1057. * If we have a custom point format list use it otherwise use default
  1058. */
  1059. if (s->ext.ecpointformats) {
  1060. *pformats = s->ext.ecpointformats;
  1061. *num_formats = s->ext.ecpointformats_len;
  1062. } else {
  1063. *pformats = ecformats_default;
  1064. /* For Suite B we don't support char2 fields */
  1065. if (tls1_suiteb(s))
  1066. *num_formats = sizeof(ecformats_default) - 1;
  1067. else
  1068. *num_formats = sizeof(ecformats_default);
  1069. }
  1070. }
  1071. /* Check a key is compatible with compression extension */
  1072. static int tls1_check_pkey_comp(SSL_CONNECTION *s, EVP_PKEY *pkey)
  1073. {
  1074. unsigned char comp_id;
  1075. size_t i;
  1076. int point_conv;
  1077. /* If not an EC key nothing to check */
  1078. if (!EVP_PKEY_is_a(pkey, "EC"))
  1079. return 1;
  1080. /* Get required compression id */
  1081. point_conv = EVP_PKEY_get_ec_point_conv_form(pkey);
  1082. if (point_conv == 0)
  1083. return 0;
  1084. if (point_conv == POINT_CONVERSION_UNCOMPRESSED) {
  1085. comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
  1086. } else if (SSL_CONNECTION_IS_TLS13(s)) {
  1087. /*
  1088. * ec_point_formats extension is not used in TLSv1.3 so we ignore
  1089. * this check.
  1090. */
  1091. return 1;
  1092. } else {
  1093. int field_type = EVP_PKEY_get_field_type(pkey);
  1094. if (field_type == NID_X9_62_prime_field)
  1095. comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
  1096. else if (field_type == NID_X9_62_characteristic_two_field)
  1097. comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
  1098. else
  1099. return 0;
  1100. }
  1101. /*
  1102. * If point formats extension present check it, otherwise everything is
  1103. * supported (see RFC4492).
  1104. */
  1105. if (s->ext.peer_ecpointformats == NULL)
  1106. return 1;
  1107. for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
  1108. if (s->ext.peer_ecpointformats[i] == comp_id)
  1109. return 1;
  1110. }
  1111. return 0;
  1112. }
  1113. /* Return group id of a key */
  1114. static uint16_t tls1_get_group_id(EVP_PKEY *pkey)
  1115. {
  1116. int curve_nid = ssl_get_EC_curve_nid(pkey);
  1117. if (curve_nid == NID_undef)
  1118. return 0;
  1119. return tls1_nid2group_id(curve_nid);
  1120. }
  1121. /*
  1122. * Check cert parameters compatible with extensions: currently just checks EC
  1123. * certificates have compatible curves and compression.
  1124. */
  1125. static int tls1_check_cert_param(SSL_CONNECTION *s, X509 *x, int check_ee_md)
  1126. {
  1127. uint16_t group_id;
  1128. EVP_PKEY *pkey;
  1129. pkey = X509_get0_pubkey(x);
  1130. if (pkey == NULL)
  1131. return 0;
  1132. /* If not EC nothing to do */
  1133. if (!EVP_PKEY_is_a(pkey, "EC"))
  1134. return 1;
  1135. /* Check compression */
  1136. if (!tls1_check_pkey_comp(s, pkey))
  1137. return 0;
  1138. group_id = tls1_get_group_id(pkey);
  1139. /*
  1140. * For a server we allow the certificate to not be in our list of supported
  1141. * groups.
  1142. */
  1143. if (!tls1_check_group_id(s, group_id, !s->server))
  1144. return 0;
  1145. /*
  1146. * Special case for suite B. We *MUST* sign using SHA256+P-256 or
  1147. * SHA384+P-384.
  1148. */
  1149. if (check_ee_md && tls1_suiteb(s)) {
  1150. int check_md;
  1151. size_t i;
  1152. /* Check to see we have necessary signing algorithm */
  1153. if (group_id == OSSL_TLS_GROUP_ID_secp256r1)
  1154. check_md = NID_ecdsa_with_SHA256;
  1155. else if (group_id == OSSL_TLS_GROUP_ID_secp384r1)
  1156. check_md = NID_ecdsa_with_SHA384;
  1157. else
  1158. return 0; /* Should never happen */
  1159. for (i = 0; i < s->shared_sigalgslen; i++) {
  1160. if (check_md == s->shared_sigalgs[i]->sigandhash)
  1161. return 1;
  1162. }
  1163. return 0;
  1164. }
  1165. return 1;
  1166. }
  1167. /*
  1168. * tls1_check_ec_tmp_key - Check EC temporary key compatibility
  1169. * @s: SSL connection
  1170. * @cid: Cipher ID we're considering using
  1171. *
  1172. * Checks that the kECDHE cipher suite we're considering using
  1173. * is compatible with the client extensions.
  1174. *
  1175. * Returns 0 when the cipher can't be used or 1 when it can.
  1176. */
  1177. int tls1_check_ec_tmp_key(SSL_CONNECTION *s, unsigned long cid)
  1178. {
  1179. /* If not Suite B just need a shared group */
  1180. if (!tls1_suiteb(s))
  1181. return tls1_shared_group(s, 0) != 0;
  1182. /*
  1183. * If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384, no other
  1184. * curves permitted.
  1185. */
  1186. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
  1187. return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp256r1, 1);
  1188. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
  1189. return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp384r1, 1);
  1190. return 0;
  1191. }
  1192. /* Default sigalg schemes */
  1193. static const uint16_t tls12_sigalgs[] = {
  1194. TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
  1195. TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
  1196. TLSEXT_SIGALG_ecdsa_secp521r1_sha512,
  1197. TLSEXT_SIGALG_ed25519,
  1198. TLSEXT_SIGALG_ed448,
  1199. TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256,
  1200. TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384,
  1201. TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512,
  1202. TLSEXT_SIGALG_rsa_pss_pss_sha256,
  1203. TLSEXT_SIGALG_rsa_pss_pss_sha384,
  1204. TLSEXT_SIGALG_rsa_pss_pss_sha512,
  1205. TLSEXT_SIGALG_rsa_pss_rsae_sha256,
  1206. TLSEXT_SIGALG_rsa_pss_rsae_sha384,
  1207. TLSEXT_SIGALG_rsa_pss_rsae_sha512,
  1208. TLSEXT_SIGALG_rsa_pkcs1_sha256,
  1209. TLSEXT_SIGALG_rsa_pkcs1_sha384,
  1210. TLSEXT_SIGALG_rsa_pkcs1_sha512,
  1211. TLSEXT_SIGALG_ecdsa_sha224,
  1212. TLSEXT_SIGALG_ecdsa_sha1,
  1213. TLSEXT_SIGALG_rsa_pkcs1_sha224,
  1214. TLSEXT_SIGALG_rsa_pkcs1_sha1,
  1215. TLSEXT_SIGALG_dsa_sha224,
  1216. TLSEXT_SIGALG_dsa_sha1,
  1217. TLSEXT_SIGALG_dsa_sha256,
  1218. TLSEXT_SIGALG_dsa_sha384,
  1219. TLSEXT_SIGALG_dsa_sha512,
  1220. #ifndef OPENSSL_NO_GOST
  1221. TLSEXT_SIGALG_gostr34102012_256_intrinsic,
  1222. TLSEXT_SIGALG_gostr34102012_512_intrinsic,
  1223. TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
  1224. TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
  1225. TLSEXT_SIGALG_gostr34102001_gostr3411,
  1226. #endif
  1227. };
  1228. static const uint16_t suiteb_sigalgs[] = {
  1229. TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
  1230. TLSEXT_SIGALG_ecdsa_secp384r1_sha384
  1231. };
  1232. static const SIGALG_LOOKUP sigalg_lookup_tbl[] = {
  1233. {"ecdsa_secp256r1_sha256", TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
  1234. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1235. NID_ecdsa_with_SHA256, NID_X9_62_prime256v1, 1},
  1236. {"ecdsa_secp384r1_sha384", TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
  1237. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1238. NID_ecdsa_with_SHA384, NID_secp384r1, 1},
  1239. {"ecdsa_secp521r1_sha512", TLSEXT_SIGALG_ecdsa_secp521r1_sha512,
  1240. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1241. NID_ecdsa_with_SHA512, NID_secp521r1, 1},
  1242. {"ed25519", TLSEXT_SIGALG_ed25519,
  1243. NID_undef, -1, EVP_PKEY_ED25519, SSL_PKEY_ED25519,
  1244. NID_undef, NID_undef, 1},
  1245. {"ed448", TLSEXT_SIGALG_ed448,
  1246. NID_undef, -1, EVP_PKEY_ED448, SSL_PKEY_ED448,
  1247. NID_undef, NID_undef, 1},
  1248. {NULL, TLSEXT_SIGALG_ecdsa_sha224,
  1249. NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1250. NID_ecdsa_with_SHA224, NID_undef, 1},
  1251. {NULL, TLSEXT_SIGALG_ecdsa_sha1,
  1252. NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1253. NID_ecdsa_with_SHA1, NID_undef, 1},
  1254. {"ecdsa_brainpoolP256r1_sha256", TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256,
  1255. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1256. NID_ecdsa_with_SHA256, NID_brainpoolP256r1, 1},
  1257. {"ecdsa_brainpoolP384r1_sha384", TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384,
  1258. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1259. NID_ecdsa_with_SHA384, NID_brainpoolP384r1, 1},
  1260. {"ecdsa_brainpoolP512r1_sha512", TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512,
  1261. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1262. NID_ecdsa_with_SHA512, NID_brainpoolP512r1, 1},
  1263. {"rsa_pss_rsae_sha256", TLSEXT_SIGALG_rsa_pss_rsae_sha256,
  1264. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
  1265. NID_undef, NID_undef, 1},
  1266. {"rsa_pss_rsae_sha384", TLSEXT_SIGALG_rsa_pss_rsae_sha384,
  1267. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
  1268. NID_undef, NID_undef, 1},
  1269. {"rsa_pss_rsae_sha512", TLSEXT_SIGALG_rsa_pss_rsae_sha512,
  1270. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
  1271. NID_undef, NID_undef, 1},
  1272. {"rsa_pss_pss_sha256", TLSEXT_SIGALG_rsa_pss_pss_sha256,
  1273. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
  1274. NID_undef, NID_undef, 1},
  1275. {"rsa_pss_pss_sha384", TLSEXT_SIGALG_rsa_pss_pss_sha384,
  1276. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
  1277. NID_undef, NID_undef, 1},
  1278. {"rsa_pss_pss_sha512", TLSEXT_SIGALG_rsa_pss_pss_sha512,
  1279. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
  1280. NID_undef, NID_undef, 1},
  1281. {"rsa_pkcs1_sha256", TLSEXT_SIGALG_rsa_pkcs1_sha256,
  1282. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1283. NID_sha256WithRSAEncryption, NID_undef, 1},
  1284. {"rsa_pkcs1_sha384", TLSEXT_SIGALG_rsa_pkcs1_sha384,
  1285. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1286. NID_sha384WithRSAEncryption, NID_undef, 1},
  1287. {"rsa_pkcs1_sha512", TLSEXT_SIGALG_rsa_pkcs1_sha512,
  1288. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1289. NID_sha512WithRSAEncryption, NID_undef, 1},
  1290. {"rsa_pkcs1_sha224", TLSEXT_SIGALG_rsa_pkcs1_sha224,
  1291. NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1292. NID_sha224WithRSAEncryption, NID_undef, 1},
  1293. {"rsa_pkcs1_sha1", TLSEXT_SIGALG_rsa_pkcs1_sha1,
  1294. NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1295. NID_sha1WithRSAEncryption, NID_undef, 1},
  1296. {NULL, TLSEXT_SIGALG_dsa_sha256,
  1297. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1298. NID_dsa_with_SHA256, NID_undef, 1},
  1299. {NULL, TLSEXT_SIGALG_dsa_sha384,
  1300. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1301. NID_undef, NID_undef, 1},
  1302. {NULL, TLSEXT_SIGALG_dsa_sha512,
  1303. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1304. NID_undef, NID_undef, 1},
  1305. {NULL, TLSEXT_SIGALG_dsa_sha224,
  1306. NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1307. NID_undef, NID_undef, 1},
  1308. {NULL, TLSEXT_SIGALG_dsa_sha1,
  1309. NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1310. NID_dsaWithSHA1, NID_undef, 1},
  1311. #ifndef OPENSSL_NO_GOST
  1312. {NULL, TLSEXT_SIGALG_gostr34102012_256_intrinsic,
  1313. NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX,
  1314. NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256,
  1315. NID_undef, NID_undef, 1},
  1316. {NULL, TLSEXT_SIGALG_gostr34102012_512_intrinsic,
  1317. NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX,
  1318. NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512,
  1319. NID_undef, NID_undef, 1},
  1320. {NULL, TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
  1321. NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX,
  1322. NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256,
  1323. NID_undef, NID_undef, 1},
  1324. {NULL, TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
  1325. NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX,
  1326. NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512,
  1327. NID_undef, NID_undef, 1},
  1328. {NULL, TLSEXT_SIGALG_gostr34102001_gostr3411,
  1329. NID_id_GostR3411_94, SSL_MD_GOST94_IDX,
  1330. NID_id_GostR3410_2001, SSL_PKEY_GOST01,
  1331. NID_undef, NID_undef, 1}
  1332. #endif
  1333. };
  1334. /* Legacy sigalgs for TLS < 1.2 RSA TLS signatures */
  1335. static const SIGALG_LOOKUP legacy_rsa_sigalg = {
  1336. "rsa_pkcs1_md5_sha1", 0,
  1337. NID_md5_sha1, SSL_MD_MD5_SHA1_IDX,
  1338. EVP_PKEY_RSA, SSL_PKEY_RSA,
  1339. NID_undef, NID_undef, 1
  1340. };
  1341. /*
  1342. * Default signature algorithm values used if signature algorithms not present.
  1343. * From RFC5246. Note: order must match certificate index order.
  1344. */
  1345. static const uint16_t tls_default_sigalg[] = {
  1346. TLSEXT_SIGALG_rsa_pkcs1_sha1, /* SSL_PKEY_RSA */
  1347. 0, /* SSL_PKEY_RSA_PSS_SIGN */
  1348. TLSEXT_SIGALG_dsa_sha1, /* SSL_PKEY_DSA_SIGN */
  1349. TLSEXT_SIGALG_ecdsa_sha1, /* SSL_PKEY_ECC */
  1350. TLSEXT_SIGALG_gostr34102001_gostr3411, /* SSL_PKEY_GOST01 */
  1351. TLSEXT_SIGALG_gostr34102012_256_intrinsic, /* SSL_PKEY_GOST12_256 */
  1352. TLSEXT_SIGALG_gostr34102012_512_intrinsic, /* SSL_PKEY_GOST12_512 */
  1353. 0, /* SSL_PKEY_ED25519 */
  1354. 0, /* SSL_PKEY_ED448 */
  1355. };
  1356. int ssl_setup_sigalgs(SSL_CTX *ctx)
  1357. {
  1358. size_t i, cache_idx, sigalgs_len;
  1359. const SIGALG_LOOKUP *lu;
  1360. SIGALG_LOOKUP *cache = NULL;
  1361. uint16_t *tls12_sigalgs_list = NULL;
  1362. EVP_PKEY *tmpkey = EVP_PKEY_new();
  1363. int ret = 0;
  1364. if (ctx == NULL)
  1365. goto err;
  1366. sigalgs_len = OSSL_NELEM(sigalg_lookup_tbl) + ctx->sigalg_list_len;
  1367. cache = OPENSSL_malloc(sizeof(const SIGALG_LOOKUP) * sigalgs_len);
  1368. if (cache == NULL || tmpkey == NULL)
  1369. goto err;
  1370. tls12_sigalgs_list = OPENSSL_malloc(sizeof(uint16_t) * sigalgs_len);
  1371. if (tls12_sigalgs_list == NULL)
  1372. goto err;
  1373. ERR_set_mark();
  1374. /* First fill cache and tls12_sigalgs list from legacy algorithm list */
  1375. for (i = 0, lu = sigalg_lookup_tbl;
  1376. i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
  1377. EVP_PKEY_CTX *pctx;
  1378. cache[i] = *lu;
  1379. tls12_sigalgs_list[i] = tls12_sigalgs[i];
  1380. /*
  1381. * Check hash is available.
  1382. * This test is not perfect. A provider could have support
  1383. * for a signature scheme, but not a particular hash. However the hash
  1384. * could be available from some other loaded provider. In that case it
  1385. * could be that the signature is available, and the hash is available
  1386. * independently - but not as a combination. We ignore this for now.
  1387. */
  1388. if (lu->hash != NID_undef
  1389. && ctx->ssl_digest_methods[lu->hash_idx] == NULL) {
  1390. cache[i].enabled = 0;
  1391. continue;
  1392. }
  1393. if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {
  1394. cache[i].enabled = 0;
  1395. continue;
  1396. }
  1397. pctx = EVP_PKEY_CTX_new_from_pkey(ctx->libctx, tmpkey, ctx->propq);
  1398. /* If unable to create pctx we assume the sig algorithm is unavailable */
  1399. if (pctx == NULL)
  1400. cache[i].enabled = 0;
  1401. EVP_PKEY_CTX_free(pctx);
  1402. }
  1403. /* Now complete cache and tls12_sigalgs list with provider sig information */
  1404. cache_idx = OSSL_NELEM(sigalg_lookup_tbl);
  1405. for (i = 0; i < ctx->sigalg_list_len; i++) {
  1406. TLS_SIGALG_INFO si = ctx->sigalg_list[i];
  1407. cache[cache_idx].name = si.name;
  1408. cache[cache_idx].sigalg = si.code_point;
  1409. tls12_sigalgs_list[cache_idx] = si.code_point;
  1410. cache[cache_idx].hash = si.hash_name?OBJ_txt2nid(si.hash_name):NID_undef;
  1411. cache[cache_idx].hash_idx = ssl_get_md_idx(cache[cache_idx].hash);
  1412. cache[cache_idx].sig = OBJ_txt2nid(si.sigalg_name);
  1413. cache[cache_idx].sig_idx = i + SSL_PKEY_NUM;
  1414. cache[cache_idx].sigandhash = OBJ_txt2nid(si.sigalg_name);
  1415. cache[cache_idx].curve = NID_undef;
  1416. /* all provided sigalgs are enabled by load */
  1417. cache[cache_idx].enabled = 1;
  1418. cache_idx++;
  1419. }
  1420. ERR_pop_to_mark();
  1421. ctx->sigalg_lookup_cache = cache;
  1422. ctx->tls12_sigalgs = tls12_sigalgs_list;
  1423. ctx->tls12_sigalgs_len = sigalgs_len;
  1424. cache = NULL;
  1425. tls12_sigalgs_list = NULL;
  1426. ret = 1;
  1427. err:
  1428. OPENSSL_free(cache);
  1429. OPENSSL_free(tls12_sigalgs_list);
  1430. EVP_PKEY_free(tmpkey);
  1431. return ret;
  1432. }
  1433. /* Lookup TLS signature algorithm */
  1434. static const SIGALG_LOOKUP *tls1_lookup_sigalg(const SSL_CONNECTION *s,
  1435. uint16_t sigalg)
  1436. {
  1437. size_t i;
  1438. const SIGALG_LOOKUP *lu;
  1439. for (i = 0, lu = SSL_CONNECTION_GET_CTX(s)->sigalg_lookup_cache;
  1440. i < SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len;
  1441. lu++, i++) {
  1442. if (lu->sigalg == sigalg) {
  1443. if (!lu->enabled)
  1444. return NULL;
  1445. return lu;
  1446. }
  1447. }
  1448. return NULL;
  1449. }
  1450. /* Lookup hash: return 0 if invalid or not enabled */
  1451. int tls1_lookup_md(SSL_CTX *ctx, const SIGALG_LOOKUP *lu, const EVP_MD **pmd)
  1452. {
  1453. const EVP_MD *md;
  1454. if (lu == NULL)
  1455. return 0;
  1456. /* lu->hash == NID_undef means no associated digest */
  1457. if (lu->hash == NID_undef) {
  1458. md = NULL;
  1459. } else {
  1460. md = ssl_md(ctx, lu->hash_idx);
  1461. if (md == NULL)
  1462. return 0;
  1463. }
  1464. if (pmd)
  1465. *pmd = md;
  1466. return 1;
  1467. }
  1468. /*
  1469. * Check if key is large enough to generate RSA-PSS signature.
  1470. *
  1471. * The key must greater than or equal to 2 * hash length + 2.
  1472. * SHA512 has a hash length of 64 bytes, which is incompatible
  1473. * with a 128 byte (1024 bit) key.
  1474. */
  1475. #define RSA_PSS_MINIMUM_KEY_SIZE(md) (2 * EVP_MD_get_size(md) + 2)
  1476. static int rsa_pss_check_min_key_size(SSL_CTX *ctx, const EVP_PKEY *pkey,
  1477. const SIGALG_LOOKUP *lu)
  1478. {
  1479. const EVP_MD *md;
  1480. if (pkey == NULL)
  1481. return 0;
  1482. if (!tls1_lookup_md(ctx, lu, &md) || md == NULL)
  1483. return 0;
  1484. if (EVP_MD_get_size(md) <= 0)
  1485. return 0;
  1486. if (EVP_PKEY_get_size(pkey) < RSA_PSS_MINIMUM_KEY_SIZE(md))
  1487. return 0;
  1488. return 1;
  1489. }
  1490. /*
  1491. * Returns a signature algorithm when the peer did not send a list of supported
  1492. * signature algorithms. The signature algorithm is fixed for the certificate
  1493. * type. |idx| is a certificate type index (SSL_PKEY_*). When |idx| is -1 the
  1494. * certificate type from |s| will be used.
  1495. * Returns the signature algorithm to use, or NULL on error.
  1496. */
  1497. static const SIGALG_LOOKUP *tls1_get_legacy_sigalg(const SSL_CONNECTION *s,
  1498. int idx)
  1499. {
  1500. if (idx == -1) {
  1501. if (s->server) {
  1502. size_t i;
  1503. /* Work out index corresponding to ciphersuite */
  1504. for (i = 0; i < s->ssl_pkey_num; i++) {
  1505. const SSL_CERT_LOOKUP *clu
  1506. = ssl_cert_lookup_by_idx(i, SSL_CONNECTION_GET_CTX(s));
  1507. if (clu == NULL)
  1508. continue;
  1509. if (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) {
  1510. idx = i;
  1511. break;
  1512. }
  1513. }
  1514. /*
  1515. * Some GOST ciphersuites allow more than one signature algorithms
  1516. * */
  1517. if (idx == SSL_PKEY_GOST01 && s->s3.tmp.new_cipher->algorithm_auth != SSL_aGOST01) {
  1518. int real_idx;
  1519. for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01;
  1520. real_idx--) {
  1521. if (s->cert->pkeys[real_idx].privatekey != NULL) {
  1522. idx = real_idx;
  1523. break;
  1524. }
  1525. }
  1526. }
  1527. /*
  1528. * As both SSL_PKEY_GOST12_512 and SSL_PKEY_GOST12_256 indices can be used
  1529. * with new (aGOST12-only) ciphersuites, we should find out which one is available really.
  1530. */
  1531. else if (idx == SSL_PKEY_GOST12_256) {
  1532. int real_idx;
  1533. for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST12_256;
  1534. real_idx--) {
  1535. if (s->cert->pkeys[real_idx].privatekey != NULL) {
  1536. idx = real_idx;
  1537. break;
  1538. }
  1539. }
  1540. }
  1541. } else {
  1542. idx = s->cert->key - s->cert->pkeys;
  1543. }
  1544. }
  1545. if (idx < 0 || idx >= (int)OSSL_NELEM(tls_default_sigalg))
  1546. return NULL;
  1547. if (SSL_USE_SIGALGS(s) || idx != SSL_PKEY_RSA) {
  1548. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, tls_default_sigalg[idx]);
  1549. if (lu == NULL)
  1550. return NULL;
  1551. if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, NULL))
  1552. return NULL;
  1553. if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu))
  1554. return NULL;
  1555. return lu;
  1556. }
  1557. if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, &legacy_rsa_sigalg))
  1558. return NULL;
  1559. return &legacy_rsa_sigalg;
  1560. }
  1561. /* Set peer sigalg based key type */
  1562. int tls1_set_peer_legacy_sigalg(SSL_CONNECTION *s, const EVP_PKEY *pkey)
  1563. {
  1564. size_t idx;
  1565. const SIGALG_LOOKUP *lu;
  1566. if (ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)) == NULL)
  1567. return 0;
  1568. lu = tls1_get_legacy_sigalg(s, idx);
  1569. if (lu == NULL)
  1570. return 0;
  1571. s->s3.tmp.peer_sigalg = lu;
  1572. return 1;
  1573. }
  1574. size_t tls12_get_psigalgs(SSL_CONNECTION *s, int sent, const uint16_t **psigs)
  1575. {
  1576. /*
  1577. * If Suite B mode use Suite B sigalgs only, ignore any other
  1578. * preferences.
  1579. */
  1580. switch (tls1_suiteb(s)) {
  1581. case SSL_CERT_FLAG_SUITEB_128_LOS:
  1582. *psigs = suiteb_sigalgs;
  1583. return OSSL_NELEM(suiteb_sigalgs);
  1584. case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
  1585. *psigs = suiteb_sigalgs;
  1586. return 1;
  1587. case SSL_CERT_FLAG_SUITEB_192_LOS:
  1588. *psigs = suiteb_sigalgs + 1;
  1589. return 1;
  1590. }
  1591. /*
  1592. * We use client_sigalgs (if not NULL) if we're a server
  1593. * and sending a certificate request or if we're a client and
  1594. * determining which shared algorithm to use.
  1595. */
  1596. if ((s->server == sent) && s->cert->client_sigalgs != NULL) {
  1597. *psigs = s->cert->client_sigalgs;
  1598. return s->cert->client_sigalgslen;
  1599. } else if (s->cert->conf_sigalgs) {
  1600. *psigs = s->cert->conf_sigalgs;
  1601. return s->cert->conf_sigalgslen;
  1602. } else {
  1603. *psigs = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs;
  1604. return SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len;
  1605. }
  1606. }
  1607. /*
  1608. * Called by servers only. Checks that we have a sig alg that supports the
  1609. * specified EC curve.
  1610. */
  1611. int tls_check_sigalg_curve(const SSL_CONNECTION *s, int curve)
  1612. {
  1613. const uint16_t *sigs;
  1614. size_t siglen, i;
  1615. if (s->cert->conf_sigalgs) {
  1616. sigs = s->cert->conf_sigalgs;
  1617. siglen = s->cert->conf_sigalgslen;
  1618. } else {
  1619. sigs = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs;
  1620. siglen = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len;
  1621. }
  1622. for (i = 0; i < siglen; i++) {
  1623. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, sigs[i]);
  1624. if (lu == NULL)
  1625. continue;
  1626. if (lu->sig == EVP_PKEY_EC
  1627. && lu->curve != NID_undef
  1628. && curve == lu->curve)
  1629. return 1;
  1630. }
  1631. return 0;
  1632. }
  1633. /*
  1634. * Return the number of security bits for the signature algorithm, or 0 on
  1635. * error.
  1636. */
  1637. static int sigalg_security_bits(SSL_CTX *ctx, const SIGALG_LOOKUP *lu)
  1638. {
  1639. const EVP_MD *md = NULL;
  1640. int secbits = 0;
  1641. if (!tls1_lookup_md(ctx, lu, &md))
  1642. return 0;
  1643. if (md != NULL)
  1644. {
  1645. int md_type = EVP_MD_get_type(md);
  1646. /* Security bits: half digest bits */
  1647. secbits = EVP_MD_get_size(md) * 4;
  1648. if (secbits <= 0)
  1649. return 0;
  1650. /*
  1651. * SHA1 and MD5 are known to be broken. Reduce security bits so that
  1652. * they're no longer accepted at security level 1. The real values don't
  1653. * really matter as long as they're lower than 80, which is our
  1654. * security level 1.
  1655. * https://eprint.iacr.org/2020/014 puts a chosen-prefix attack for
  1656. * SHA1 at 2^63.4 and MD5+SHA1 at 2^67.2
  1657. * https://documents.epfl.ch/users/l/le/lenstra/public/papers/lat.pdf
  1658. * puts a chosen-prefix attack for MD5 at 2^39.
  1659. */
  1660. if (md_type == NID_sha1)
  1661. secbits = 64;
  1662. else if (md_type == NID_md5_sha1)
  1663. secbits = 67;
  1664. else if (md_type == NID_md5)
  1665. secbits = 39;
  1666. } else {
  1667. /* Values from https://tools.ietf.org/html/rfc8032#section-8.5 */
  1668. if (lu->sigalg == TLSEXT_SIGALG_ed25519)
  1669. secbits = 128;
  1670. else if (lu->sigalg == TLSEXT_SIGALG_ed448)
  1671. secbits = 224;
  1672. }
  1673. /*
  1674. * For provider-based sigalgs we have secbits information available
  1675. * in the (provider-loaded) sigalg_list structure
  1676. */
  1677. if ((secbits == 0) && (lu->sig_idx >= SSL_PKEY_NUM)
  1678. && ((lu->sig_idx - SSL_PKEY_NUM) < (int)ctx->sigalg_list_len)) {
  1679. secbits = ctx->sigalg_list[lu->sig_idx - SSL_PKEY_NUM].secbits;
  1680. }
  1681. return secbits;
  1682. }
  1683. /*
  1684. * Check signature algorithm is consistent with sent supported signature
  1685. * algorithms and if so set relevant digest and signature scheme in
  1686. * s.
  1687. */
  1688. int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey)
  1689. {
  1690. const uint16_t *sent_sigs;
  1691. const EVP_MD *md = NULL;
  1692. char sigalgstr[2];
  1693. size_t sent_sigslen, i, cidx;
  1694. int pkeyid = -1;
  1695. const SIGALG_LOOKUP *lu;
  1696. int secbits = 0;
  1697. pkeyid = EVP_PKEY_get_id(pkey);
  1698. if (SSL_CONNECTION_IS_TLS13(s)) {
  1699. /* Disallow DSA for TLS 1.3 */
  1700. if (pkeyid == EVP_PKEY_DSA) {
  1701. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
  1702. return 0;
  1703. }
  1704. /* Only allow PSS for TLS 1.3 */
  1705. if (pkeyid == EVP_PKEY_RSA)
  1706. pkeyid = EVP_PKEY_RSA_PSS;
  1707. }
  1708. lu = tls1_lookup_sigalg(s, sig);
  1709. /* if this sigalg is loaded, set so far unknown pkeyid to its sig NID */
  1710. if ((pkeyid == EVP_PKEY_KEYMGMT) && (lu != NULL))
  1711. pkeyid = lu->sig;
  1712. /* Should never happen */
  1713. if (pkeyid == -1)
  1714. return -1;
  1715. /*
  1716. * Check sigalgs is known. Disallow SHA1/SHA224 with TLS 1.3. Check key type
  1717. * is consistent with signature: RSA keys can be used for RSA-PSS
  1718. */
  1719. if (lu == NULL
  1720. || (SSL_CONNECTION_IS_TLS13(s)
  1721. && (lu->hash == NID_sha1 || lu->hash == NID_sha224))
  1722. || (pkeyid != lu->sig
  1723. && (lu->sig != EVP_PKEY_RSA_PSS || pkeyid != EVP_PKEY_RSA))) {
  1724. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
  1725. return 0;
  1726. }
  1727. /* Check the sigalg is consistent with the key OID */
  1728. if (!ssl_cert_lookup_by_nid(
  1729. (pkeyid == EVP_PKEY_RSA_PSS) ? EVP_PKEY_get_id(pkey) : pkeyid,
  1730. &cidx, SSL_CONNECTION_GET_CTX(s))
  1731. || lu->sig_idx != (int)cidx) {
  1732. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
  1733. return 0;
  1734. }
  1735. if (pkeyid == EVP_PKEY_EC) {
  1736. /* Check point compression is permitted */
  1737. if (!tls1_check_pkey_comp(s, pkey)) {
  1738. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
  1739. SSL_R_ILLEGAL_POINT_COMPRESSION);
  1740. return 0;
  1741. }
  1742. /* For TLS 1.3 or Suite B check curve matches signature algorithm */
  1743. if (SSL_CONNECTION_IS_TLS13(s) || tls1_suiteb(s)) {
  1744. int curve = ssl_get_EC_curve_nid(pkey);
  1745. if (lu->curve != NID_undef && curve != lu->curve) {
  1746. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
  1747. return 0;
  1748. }
  1749. }
  1750. if (!SSL_CONNECTION_IS_TLS13(s)) {
  1751. /* Check curve matches extensions */
  1752. if (!tls1_check_group_id(s, tls1_get_group_id(pkey), 1)) {
  1753. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
  1754. return 0;
  1755. }
  1756. if (tls1_suiteb(s)) {
  1757. /* Check sigalg matches a permissible Suite B value */
  1758. if (sig != TLSEXT_SIGALG_ecdsa_secp256r1_sha256
  1759. && sig != TLSEXT_SIGALG_ecdsa_secp384r1_sha384) {
  1760. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  1761. SSL_R_WRONG_SIGNATURE_TYPE);
  1762. return 0;
  1763. }
  1764. }
  1765. }
  1766. } else if (tls1_suiteb(s)) {
  1767. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
  1768. return 0;
  1769. }
  1770. /* Check signature matches a type we sent */
  1771. sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
  1772. for (i = 0; i < sent_sigslen; i++, sent_sigs++) {
  1773. if (sig == *sent_sigs)
  1774. break;
  1775. }
  1776. /* Allow fallback to SHA1 if not strict mode */
  1777. if (i == sent_sigslen && (lu->hash != NID_sha1
  1778. || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)) {
  1779. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
  1780. return 0;
  1781. }
  1782. if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, &md)) {
  1783. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST);
  1784. return 0;
  1785. }
  1786. /*
  1787. * Make sure security callback allows algorithm. For historical
  1788. * reasons we have to pass the sigalg as a two byte char array.
  1789. */
  1790. sigalgstr[0] = (sig >> 8) & 0xff;
  1791. sigalgstr[1] = sig & 0xff;
  1792. secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
  1793. if (secbits == 0 ||
  1794. !ssl_security(s, SSL_SECOP_SIGALG_CHECK, secbits,
  1795. md != NULL ? EVP_MD_get_type(md) : NID_undef,
  1796. (void *)sigalgstr)) {
  1797. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
  1798. return 0;
  1799. }
  1800. /* Store the sigalg the peer uses */
  1801. s->s3.tmp.peer_sigalg = lu;
  1802. return 1;
  1803. }
  1804. int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid)
  1805. {
  1806. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  1807. if (sc == NULL)
  1808. return 0;
  1809. if (sc->s3.tmp.peer_sigalg == NULL)
  1810. return 0;
  1811. *pnid = sc->s3.tmp.peer_sigalg->sig;
  1812. return 1;
  1813. }
  1814. int SSL_get_signature_type_nid(const SSL *s, int *pnid)
  1815. {
  1816. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  1817. if (sc == NULL)
  1818. return 0;
  1819. if (sc->s3.tmp.sigalg == NULL)
  1820. return 0;
  1821. *pnid = sc->s3.tmp.sigalg->sig;
  1822. return 1;
  1823. }
  1824. /*
  1825. * Set a mask of disabled algorithms: an algorithm is disabled if it isn't
  1826. * supported, doesn't appear in supported signature algorithms, isn't supported
  1827. * by the enabled protocol versions or by the security level.
  1828. *
  1829. * This function should only be used for checking which ciphers are supported
  1830. * by the client.
  1831. *
  1832. * Call ssl_cipher_disabled() to check that it's enabled or not.
  1833. */
  1834. int ssl_set_client_disabled(SSL_CONNECTION *s)
  1835. {
  1836. s->s3.tmp.mask_a = 0;
  1837. s->s3.tmp.mask_k = 0;
  1838. ssl_set_sig_mask(&s->s3.tmp.mask_a, s, SSL_SECOP_SIGALG_MASK);
  1839. if (ssl_get_min_max_version(s, &s->s3.tmp.min_ver,
  1840. &s->s3.tmp.max_ver, NULL) != 0)
  1841. return 0;
  1842. #ifndef OPENSSL_NO_PSK
  1843. /* with PSK there must be client callback set */
  1844. if (!s->psk_client_callback) {
  1845. s->s3.tmp.mask_a |= SSL_aPSK;
  1846. s->s3.tmp.mask_k |= SSL_PSK;
  1847. }
  1848. #endif /* OPENSSL_NO_PSK */
  1849. #ifndef OPENSSL_NO_SRP
  1850. if (!(s->srp_ctx.srp_Mask & SSL_kSRP)) {
  1851. s->s3.tmp.mask_a |= SSL_aSRP;
  1852. s->s3.tmp.mask_k |= SSL_kSRP;
  1853. }
  1854. #endif
  1855. return 1;
  1856. }
  1857. /*
  1858. * ssl_cipher_disabled - check that a cipher is disabled or not
  1859. * @s: SSL connection that you want to use the cipher on
  1860. * @c: cipher to check
  1861. * @op: Security check that you want to do
  1862. * @ecdhe: If set to 1 then TLSv1 ECDHE ciphers are also allowed in SSLv3
  1863. *
  1864. * Returns 1 when it's disabled, 0 when enabled.
  1865. */
  1866. int ssl_cipher_disabled(const SSL_CONNECTION *s, const SSL_CIPHER *c,
  1867. int op, int ecdhe)
  1868. {
  1869. int minversion = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls;
  1870. int maxversion = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls;
  1871. if (c->algorithm_mkey & s->s3.tmp.mask_k
  1872. || c->algorithm_auth & s->s3.tmp.mask_a)
  1873. return 1;
  1874. if (s->s3.tmp.max_ver == 0)
  1875. return 1;
  1876. if (SSL_IS_QUIC_HANDSHAKE(s))
  1877. /* For QUIC, only allow these ciphersuites. */
  1878. switch (SSL_CIPHER_get_id(c)) {
  1879. case TLS1_3_CK_AES_128_GCM_SHA256:
  1880. case TLS1_3_CK_AES_256_GCM_SHA384:
  1881. case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
  1882. break;
  1883. default:
  1884. return 1;
  1885. }
  1886. /*
  1887. * For historical reasons we will allow ECHDE to be selected by a server
  1888. * in SSLv3 if we are a client
  1889. */
  1890. if (minversion == TLS1_VERSION
  1891. && ecdhe
  1892. && (c->algorithm_mkey & (SSL_kECDHE | SSL_kECDHEPSK)) != 0)
  1893. minversion = SSL3_VERSION;
  1894. if (ssl_version_cmp(s, minversion, s->s3.tmp.max_ver) > 0
  1895. || ssl_version_cmp(s, maxversion, s->s3.tmp.min_ver) < 0)
  1896. return 1;
  1897. return !ssl_security(s, op, c->strength_bits, 0, (void *)c);
  1898. }
  1899. int tls_use_ticket(SSL_CONNECTION *s)
  1900. {
  1901. if ((s->options & SSL_OP_NO_TICKET))
  1902. return 0;
  1903. return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
  1904. }
  1905. int tls1_set_server_sigalgs(SSL_CONNECTION *s)
  1906. {
  1907. size_t i;
  1908. /* Clear any shared signature algorithms */
  1909. OPENSSL_free(s->shared_sigalgs);
  1910. s->shared_sigalgs = NULL;
  1911. s->shared_sigalgslen = 0;
  1912. /* Clear certificate validity flags */
  1913. if (s->s3.tmp.valid_flags)
  1914. memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t));
  1915. else
  1916. s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t));
  1917. if (s->s3.tmp.valid_flags == NULL)
  1918. return 0;
  1919. /*
  1920. * If peer sent no signature algorithms check to see if we support
  1921. * the default algorithm for each certificate type
  1922. */
  1923. if (s->s3.tmp.peer_cert_sigalgs == NULL
  1924. && s->s3.tmp.peer_sigalgs == NULL) {
  1925. const uint16_t *sent_sigs;
  1926. size_t sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
  1927. for (i = 0; i < s->ssl_pkey_num; i++) {
  1928. const SIGALG_LOOKUP *lu = tls1_get_legacy_sigalg(s, i);
  1929. size_t j;
  1930. if (lu == NULL)
  1931. continue;
  1932. /* Check default matches a type we sent */
  1933. for (j = 0; j < sent_sigslen; j++) {
  1934. if (lu->sigalg == sent_sigs[j]) {
  1935. s->s3.tmp.valid_flags[i] = CERT_PKEY_SIGN;
  1936. break;
  1937. }
  1938. }
  1939. }
  1940. return 1;
  1941. }
  1942. if (!tls1_process_sigalgs(s)) {
  1943. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  1944. return 0;
  1945. }
  1946. if (s->shared_sigalgs != NULL)
  1947. return 1;
  1948. /* Fatal error if no shared signature algorithms */
  1949. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  1950. SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS);
  1951. return 0;
  1952. }
  1953. /*-
  1954. * Gets the ticket information supplied by the client if any.
  1955. *
  1956. * hello: The parsed ClientHello data
  1957. * ret: (output) on return, if a ticket was decrypted, then this is set to
  1958. * point to the resulting session.
  1959. */
  1960. SSL_TICKET_STATUS tls_get_ticket_from_client(SSL_CONNECTION *s,
  1961. CLIENTHELLO_MSG *hello,
  1962. SSL_SESSION **ret)
  1963. {
  1964. size_t size;
  1965. RAW_EXTENSION *ticketext;
  1966. *ret = NULL;
  1967. s->ext.ticket_expected = 0;
  1968. /*
  1969. * If tickets disabled or not supported by the protocol version
  1970. * (e.g. TLSv1.3) behave as if no ticket present to permit stateful
  1971. * resumption.
  1972. */
  1973. if (s->version <= SSL3_VERSION || !tls_use_ticket(s))
  1974. return SSL_TICKET_NONE;
  1975. ticketext = &hello->pre_proc_exts[TLSEXT_IDX_session_ticket];
  1976. if (!ticketext->present)
  1977. return SSL_TICKET_NONE;
  1978. size = PACKET_remaining(&ticketext->data);
  1979. return tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size,
  1980. hello->session_id, hello->session_id_len, ret);
  1981. }
  1982. /*-
  1983. * tls_decrypt_ticket attempts to decrypt a session ticket.
  1984. *
  1985. * If s->tls_session_secret_cb is set and we're not doing TLSv1.3 then we are
  1986. * expecting a pre-shared key ciphersuite, in which case we have no use for
  1987. * session tickets and one will never be decrypted, nor will
  1988. * s->ext.ticket_expected be set to 1.
  1989. *
  1990. * Side effects:
  1991. * Sets s->ext.ticket_expected to 1 if the server will have to issue
  1992. * a new session ticket to the client because the client indicated support
  1993. * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
  1994. * a session ticket or we couldn't use the one it gave us, or if
  1995. * s->ctx->ext.ticket_key_cb asked to renew the client's ticket.
  1996. * Otherwise, s->ext.ticket_expected is set to 0.
  1997. *
  1998. * etick: points to the body of the session ticket extension.
  1999. * eticklen: the length of the session tickets extension.
  2000. * sess_id: points at the session ID.
  2001. * sesslen: the length of the session ID.
  2002. * psess: (output) on return, if a ticket was decrypted, then this is set to
  2003. * point to the resulting session.
  2004. */
  2005. SSL_TICKET_STATUS tls_decrypt_ticket(SSL_CONNECTION *s,
  2006. const unsigned char *etick,
  2007. size_t eticklen,
  2008. const unsigned char *sess_id,
  2009. size_t sesslen, SSL_SESSION **psess)
  2010. {
  2011. SSL_SESSION *sess = NULL;
  2012. unsigned char *sdec;
  2013. const unsigned char *p;
  2014. int slen, ivlen, renew_ticket = 0, declen;
  2015. SSL_TICKET_STATUS ret = SSL_TICKET_FATAL_ERR_OTHER;
  2016. size_t mlen;
  2017. unsigned char tick_hmac[EVP_MAX_MD_SIZE];
  2018. SSL_HMAC *hctx = NULL;
  2019. EVP_CIPHER_CTX *ctx = NULL;
  2020. SSL_CTX *tctx = s->session_ctx;
  2021. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  2022. if (eticklen == 0) {
  2023. /*
  2024. * The client will accept a ticket but doesn't currently have
  2025. * one (TLSv1.2 and below), or treated as a fatal error in TLSv1.3
  2026. */
  2027. ret = SSL_TICKET_EMPTY;
  2028. goto end;
  2029. }
  2030. if (!SSL_CONNECTION_IS_TLS13(s) && s->ext.session_secret_cb) {
  2031. /*
  2032. * Indicate that the ticket couldn't be decrypted rather than
  2033. * generating the session from ticket now, trigger
  2034. * abbreviated handshake based on external mechanism to
  2035. * calculate the master secret later.
  2036. */
  2037. ret = SSL_TICKET_NO_DECRYPT;
  2038. goto end;
  2039. }
  2040. /* Need at least keyname + iv */
  2041. if (eticklen < TLSEXT_KEYNAME_LENGTH + EVP_MAX_IV_LENGTH) {
  2042. ret = SSL_TICKET_NO_DECRYPT;
  2043. goto end;
  2044. }
  2045. /* Initialize session ticket encryption and HMAC contexts */
  2046. hctx = ssl_hmac_new(tctx);
  2047. if (hctx == NULL) {
  2048. ret = SSL_TICKET_FATAL_ERR_MALLOC;
  2049. goto end;
  2050. }
  2051. ctx = EVP_CIPHER_CTX_new();
  2052. if (ctx == NULL) {
  2053. ret = SSL_TICKET_FATAL_ERR_MALLOC;
  2054. goto end;
  2055. }
  2056. #ifndef OPENSSL_NO_DEPRECATED_3_0
  2057. if (tctx->ext.ticket_key_evp_cb != NULL || tctx->ext.ticket_key_cb != NULL)
  2058. #else
  2059. if (tctx->ext.ticket_key_evp_cb != NULL)
  2060. #endif
  2061. {
  2062. unsigned char *nctick = (unsigned char *)etick;
  2063. int rv = 0;
  2064. if (tctx->ext.ticket_key_evp_cb != NULL)
  2065. rv = tctx->ext.ticket_key_evp_cb(SSL_CONNECTION_GET_SSL(s), nctick,
  2066. nctick + TLSEXT_KEYNAME_LENGTH,
  2067. ctx,
  2068. ssl_hmac_get0_EVP_MAC_CTX(hctx),
  2069. 0);
  2070. #ifndef OPENSSL_NO_DEPRECATED_3_0
  2071. else if (tctx->ext.ticket_key_cb != NULL)
  2072. /* if 0 is returned, write an empty ticket */
  2073. rv = tctx->ext.ticket_key_cb(SSL_CONNECTION_GET_SSL(s), nctick,
  2074. nctick + TLSEXT_KEYNAME_LENGTH,
  2075. ctx, ssl_hmac_get0_HMAC_CTX(hctx), 0);
  2076. #endif
  2077. if (rv < 0) {
  2078. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2079. goto end;
  2080. }
  2081. if (rv == 0) {
  2082. ret = SSL_TICKET_NO_DECRYPT;
  2083. goto end;
  2084. }
  2085. if (rv == 2)
  2086. renew_ticket = 1;
  2087. } else {
  2088. EVP_CIPHER *aes256cbc = NULL;
  2089. /* Check key name matches */
  2090. if (memcmp(etick, tctx->ext.tick_key_name,
  2091. TLSEXT_KEYNAME_LENGTH) != 0) {
  2092. ret = SSL_TICKET_NO_DECRYPT;
  2093. goto end;
  2094. }
  2095. aes256cbc = EVP_CIPHER_fetch(sctx->libctx, "AES-256-CBC",
  2096. sctx->propq);
  2097. if (aes256cbc == NULL
  2098. || ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key,
  2099. sizeof(tctx->ext.secure->tick_hmac_key),
  2100. "SHA256") <= 0
  2101. || EVP_DecryptInit_ex(ctx, aes256cbc, NULL,
  2102. tctx->ext.secure->tick_aes_key,
  2103. etick + TLSEXT_KEYNAME_LENGTH) <= 0) {
  2104. EVP_CIPHER_free(aes256cbc);
  2105. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2106. goto end;
  2107. }
  2108. EVP_CIPHER_free(aes256cbc);
  2109. if (SSL_CONNECTION_IS_TLS13(s))
  2110. renew_ticket = 1;
  2111. }
  2112. /*
  2113. * Attempt to process session ticket, first conduct sanity and integrity
  2114. * checks on ticket.
  2115. */
  2116. mlen = ssl_hmac_size(hctx);
  2117. if (mlen == 0) {
  2118. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2119. goto end;
  2120. }
  2121. ivlen = EVP_CIPHER_CTX_get_iv_length(ctx);
  2122. if (ivlen < 0) {
  2123. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2124. goto end;
  2125. }
  2126. /* Sanity check ticket length: must exceed keyname + IV + HMAC */
  2127. if (eticklen <= TLSEXT_KEYNAME_LENGTH + ivlen + mlen) {
  2128. ret = SSL_TICKET_NO_DECRYPT;
  2129. goto end;
  2130. }
  2131. eticklen -= mlen;
  2132. /* Check HMAC of encrypted ticket */
  2133. if (ssl_hmac_update(hctx, etick, eticklen) <= 0
  2134. || ssl_hmac_final(hctx, tick_hmac, NULL, sizeof(tick_hmac)) <= 0) {
  2135. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2136. goto end;
  2137. }
  2138. if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) {
  2139. ret = SSL_TICKET_NO_DECRYPT;
  2140. goto end;
  2141. }
  2142. /* Attempt to decrypt session data */
  2143. /* Move p after IV to start of encrypted ticket, update length */
  2144. p = etick + TLSEXT_KEYNAME_LENGTH + ivlen;
  2145. eticklen -= TLSEXT_KEYNAME_LENGTH + ivlen;
  2146. sdec = OPENSSL_malloc(eticklen);
  2147. if (sdec == NULL || EVP_DecryptUpdate(ctx, sdec, &slen, p,
  2148. (int)eticklen) <= 0) {
  2149. OPENSSL_free(sdec);
  2150. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2151. goto end;
  2152. }
  2153. if (EVP_DecryptFinal(ctx, sdec + slen, &declen) <= 0) {
  2154. OPENSSL_free(sdec);
  2155. ret = SSL_TICKET_NO_DECRYPT;
  2156. goto end;
  2157. }
  2158. slen += declen;
  2159. p = sdec;
  2160. sess = d2i_SSL_SESSION_ex(NULL, &p, slen, sctx->libctx, sctx->propq);
  2161. slen -= p - sdec;
  2162. OPENSSL_free(sdec);
  2163. if (sess) {
  2164. /* Some additional consistency checks */
  2165. if (slen != 0) {
  2166. SSL_SESSION_free(sess);
  2167. sess = NULL;
  2168. ret = SSL_TICKET_NO_DECRYPT;
  2169. goto end;
  2170. }
  2171. /*
  2172. * The session ID, if non-empty, is used by some clients to detect
  2173. * that the ticket has been accepted. So we copy it to the session
  2174. * structure. If it is empty set length to zero as required by
  2175. * standard.
  2176. */
  2177. if (sesslen) {
  2178. memcpy(sess->session_id, sess_id, sesslen);
  2179. sess->session_id_length = sesslen;
  2180. }
  2181. if (renew_ticket)
  2182. ret = SSL_TICKET_SUCCESS_RENEW;
  2183. else
  2184. ret = SSL_TICKET_SUCCESS;
  2185. goto end;
  2186. }
  2187. ERR_clear_error();
  2188. /*
  2189. * For session parse failure, indicate that we need to send a new ticket.
  2190. */
  2191. ret = SSL_TICKET_NO_DECRYPT;
  2192. end:
  2193. EVP_CIPHER_CTX_free(ctx);
  2194. ssl_hmac_free(hctx);
  2195. /*
  2196. * If set, the decrypt_ticket_cb() is called unless a fatal error was
  2197. * detected above. The callback is responsible for checking |ret| before it
  2198. * performs any action
  2199. */
  2200. if (s->session_ctx->decrypt_ticket_cb != NULL
  2201. && (ret == SSL_TICKET_EMPTY
  2202. || ret == SSL_TICKET_NO_DECRYPT
  2203. || ret == SSL_TICKET_SUCCESS
  2204. || ret == SSL_TICKET_SUCCESS_RENEW)) {
  2205. size_t keyname_len = eticklen;
  2206. int retcb;
  2207. if (keyname_len > TLSEXT_KEYNAME_LENGTH)
  2208. keyname_len = TLSEXT_KEYNAME_LENGTH;
  2209. retcb = s->session_ctx->decrypt_ticket_cb(SSL_CONNECTION_GET_SSL(s),
  2210. sess, etick, keyname_len,
  2211. ret,
  2212. s->session_ctx->ticket_cb_data);
  2213. switch (retcb) {
  2214. case SSL_TICKET_RETURN_ABORT:
  2215. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2216. break;
  2217. case SSL_TICKET_RETURN_IGNORE:
  2218. ret = SSL_TICKET_NONE;
  2219. SSL_SESSION_free(sess);
  2220. sess = NULL;
  2221. break;
  2222. case SSL_TICKET_RETURN_IGNORE_RENEW:
  2223. if (ret != SSL_TICKET_EMPTY && ret != SSL_TICKET_NO_DECRYPT)
  2224. ret = SSL_TICKET_NO_DECRYPT;
  2225. /* else the value of |ret| will already do the right thing */
  2226. SSL_SESSION_free(sess);
  2227. sess = NULL;
  2228. break;
  2229. case SSL_TICKET_RETURN_USE:
  2230. case SSL_TICKET_RETURN_USE_RENEW:
  2231. if (ret != SSL_TICKET_SUCCESS
  2232. && ret != SSL_TICKET_SUCCESS_RENEW)
  2233. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2234. else if (retcb == SSL_TICKET_RETURN_USE)
  2235. ret = SSL_TICKET_SUCCESS;
  2236. else
  2237. ret = SSL_TICKET_SUCCESS_RENEW;
  2238. break;
  2239. default:
  2240. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2241. }
  2242. }
  2243. if (s->ext.session_secret_cb == NULL || SSL_CONNECTION_IS_TLS13(s)) {
  2244. switch (ret) {
  2245. case SSL_TICKET_NO_DECRYPT:
  2246. case SSL_TICKET_SUCCESS_RENEW:
  2247. case SSL_TICKET_EMPTY:
  2248. s->ext.ticket_expected = 1;
  2249. }
  2250. }
  2251. *psess = sess;
  2252. return ret;
  2253. }
  2254. /* Check to see if a signature algorithm is allowed */
  2255. static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op,
  2256. const SIGALG_LOOKUP *lu)
  2257. {
  2258. unsigned char sigalgstr[2];
  2259. int secbits;
  2260. if (lu == NULL || !lu->enabled)
  2261. return 0;
  2262. /* DSA is not allowed in TLS 1.3 */
  2263. if (SSL_CONNECTION_IS_TLS13(s) && lu->sig == EVP_PKEY_DSA)
  2264. return 0;
  2265. /*
  2266. * At some point we should fully axe DSA/etc. in ClientHello as per TLS 1.3
  2267. * spec
  2268. */
  2269. if (!s->server && !SSL_CONNECTION_IS_DTLS(s)
  2270. && s->s3.tmp.min_ver >= TLS1_3_VERSION
  2271. && (lu->sig == EVP_PKEY_DSA || lu->hash_idx == SSL_MD_SHA1_IDX
  2272. || lu->hash_idx == SSL_MD_MD5_IDX
  2273. || lu->hash_idx == SSL_MD_SHA224_IDX))
  2274. return 0;
  2275. /* See if public key algorithm allowed */
  2276. if (ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), lu->sig_idx))
  2277. return 0;
  2278. if (lu->sig == NID_id_GostR3410_2012_256
  2279. || lu->sig == NID_id_GostR3410_2012_512
  2280. || lu->sig == NID_id_GostR3410_2001) {
  2281. /* We never allow GOST sig algs on the server with TLSv1.3 */
  2282. if (s->server && SSL_CONNECTION_IS_TLS13(s))
  2283. return 0;
  2284. if (!s->server
  2285. && SSL_CONNECTION_GET_SSL(s)->method->version == TLS_ANY_VERSION
  2286. && s->s3.tmp.max_ver >= TLS1_3_VERSION) {
  2287. int i, num;
  2288. STACK_OF(SSL_CIPHER) *sk;
  2289. /*
  2290. * We're a client that could negotiate TLSv1.3. We only allow GOST
  2291. * sig algs if we could negotiate TLSv1.2 or below and we have GOST
  2292. * ciphersuites enabled.
  2293. */
  2294. if (s->s3.tmp.min_ver >= TLS1_3_VERSION)
  2295. return 0;
  2296. sk = SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s));
  2297. num = sk != NULL ? sk_SSL_CIPHER_num(sk) : 0;
  2298. for (i = 0; i < num; i++) {
  2299. const SSL_CIPHER *c;
  2300. c = sk_SSL_CIPHER_value(sk, i);
  2301. /* Skip disabled ciphers */
  2302. if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
  2303. continue;
  2304. if ((c->algorithm_mkey & (SSL_kGOST | SSL_kGOST18)) != 0)
  2305. break;
  2306. }
  2307. if (i == num)
  2308. return 0;
  2309. }
  2310. }
  2311. /* Finally see if security callback allows it */
  2312. secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
  2313. sigalgstr[0] = (lu->sigalg >> 8) & 0xff;
  2314. sigalgstr[1] = lu->sigalg & 0xff;
  2315. return ssl_security(s, op, secbits, lu->hash, (void *)sigalgstr);
  2316. }
  2317. /*
  2318. * Get a mask of disabled public key algorithms based on supported signature
  2319. * algorithms. For example if no signature algorithm supports RSA then RSA is
  2320. * disabled.
  2321. */
  2322. void ssl_set_sig_mask(uint32_t *pmask_a, SSL_CONNECTION *s, int op)
  2323. {
  2324. const uint16_t *sigalgs;
  2325. size_t i, sigalgslen;
  2326. uint32_t disabled_mask = SSL_aRSA | SSL_aDSS | SSL_aECDSA;
  2327. /*
  2328. * Go through all signature algorithms seeing if we support any
  2329. * in disabled_mask.
  2330. */
  2331. sigalgslen = tls12_get_psigalgs(s, 1, &sigalgs);
  2332. for (i = 0; i < sigalgslen; i++, sigalgs++) {
  2333. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *sigalgs);
  2334. const SSL_CERT_LOOKUP *clu;
  2335. if (lu == NULL)
  2336. continue;
  2337. clu = ssl_cert_lookup_by_idx(lu->sig_idx,
  2338. SSL_CONNECTION_GET_CTX(s));
  2339. if (clu == NULL)
  2340. continue;
  2341. /* If algorithm is disabled see if we can enable it */
  2342. if ((clu->amask & disabled_mask) != 0
  2343. && tls12_sigalg_allowed(s, op, lu))
  2344. disabled_mask &= ~clu->amask;
  2345. }
  2346. *pmask_a |= disabled_mask;
  2347. }
  2348. int tls12_copy_sigalgs(SSL_CONNECTION *s, WPACKET *pkt,
  2349. const uint16_t *psig, size_t psiglen)
  2350. {
  2351. size_t i;
  2352. int rv = 0;
  2353. for (i = 0; i < psiglen; i++, psig++) {
  2354. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *psig);
  2355. if (lu == NULL
  2356. || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu))
  2357. continue;
  2358. if (!WPACKET_put_bytes_u16(pkt, *psig))
  2359. return 0;
  2360. /*
  2361. * If TLS 1.3 must have at least one valid TLS 1.3 message
  2362. * signing algorithm: i.e. neither RSA nor SHA1/SHA224
  2363. */
  2364. if (rv == 0 && (!SSL_CONNECTION_IS_TLS13(s)
  2365. || (lu->sig != EVP_PKEY_RSA
  2366. && lu->hash != NID_sha1
  2367. && lu->hash != NID_sha224)))
  2368. rv = 1;
  2369. }
  2370. if (rv == 0)
  2371. ERR_raise(ERR_LIB_SSL, SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  2372. return rv;
  2373. }
  2374. /* Given preference and allowed sigalgs set shared sigalgs */
  2375. static size_t tls12_shared_sigalgs(SSL_CONNECTION *s,
  2376. const SIGALG_LOOKUP **shsig,
  2377. const uint16_t *pref, size_t preflen,
  2378. const uint16_t *allow, size_t allowlen)
  2379. {
  2380. const uint16_t *ptmp, *atmp;
  2381. size_t i, j, nmatch = 0;
  2382. for (i = 0, ptmp = pref; i < preflen; i++, ptmp++) {
  2383. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *ptmp);
  2384. /* Skip disabled hashes or signature algorithms */
  2385. if (lu == NULL
  2386. || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, lu))
  2387. continue;
  2388. for (j = 0, atmp = allow; j < allowlen; j++, atmp++) {
  2389. if (*ptmp == *atmp) {
  2390. nmatch++;
  2391. if (shsig)
  2392. *shsig++ = lu;
  2393. break;
  2394. }
  2395. }
  2396. }
  2397. return nmatch;
  2398. }
  2399. /* Set shared signature algorithms for SSL structures */
  2400. static int tls1_set_shared_sigalgs(SSL_CONNECTION *s)
  2401. {
  2402. const uint16_t *pref, *allow, *conf;
  2403. size_t preflen, allowlen, conflen;
  2404. size_t nmatch;
  2405. const SIGALG_LOOKUP **salgs = NULL;
  2406. CERT *c = s->cert;
  2407. unsigned int is_suiteb = tls1_suiteb(s);
  2408. OPENSSL_free(s->shared_sigalgs);
  2409. s->shared_sigalgs = NULL;
  2410. s->shared_sigalgslen = 0;
  2411. /* If client use client signature algorithms if not NULL */
  2412. if (!s->server && c->client_sigalgs && !is_suiteb) {
  2413. conf = c->client_sigalgs;
  2414. conflen = c->client_sigalgslen;
  2415. } else if (c->conf_sigalgs && !is_suiteb) {
  2416. conf = c->conf_sigalgs;
  2417. conflen = c->conf_sigalgslen;
  2418. } else
  2419. conflen = tls12_get_psigalgs(s, 0, &conf);
  2420. if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb) {
  2421. pref = conf;
  2422. preflen = conflen;
  2423. allow = s->s3.tmp.peer_sigalgs;
  2424. allowlen = s->s3.tmp.peer_sigalgslen;
  2425. } else {
  2426. allow = conf;
  2427. allowlen = conflen;
  2428. pref = s->s3.tmp.peer_sigalgs;
  2429. preflen = s->s3.tmp.peer_sigalgslen;
  2430. }
  2431. nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
  2432. if (nmatch) {
  2433. if ((salgs = OPENSSL_malloc(nmatch * sizeof(*salgs))) == NULL)
  2434. return 0;
  2435. nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
  2436. } else {
  2437. salgs = NULL;
  2438. }
  2439. s->shared_sigalgs = salgs;
  2440. s->shared_sigalgslen = nmatch;
  2441. return 1;
  2442. }
  2443. int tls1_save_u16(PACKET *pkt, uint16_t **pdest, size_t *pdestlen)
  2444. {
  2445. unsigned int stmp;
  2446. size_t size, i;
  2447. uint16_t *buf;
  2448. size = PACKET_remaining(pkt);
  2449. /* Invalid data length */
  2450. if (size == 0 || (size & 1) != 0)
  2451. return 0;
  2452. size >>= 1;
  2453. if ((buf = OPENSSL_malloc(size * sizeof(*buf))) == NULL)
  2454. return 0;
  2455. for (i = 0; i < size && PACKET_get_net_2(pkt, &stmp); i++)
  2456. buf[i] = stmp;
  2457. if (i != size) {
  2458. OPENSSL_free(buf);
  2459. return 0;
  2460. }
  2461. OPENSSL_free(*pdest);
  2462. *pdest = buf;
  2463. *pdestlen = size;
  2464. return 1;
  2465. }
  2466. int tls1_save_sigalgs(SSL_CONNECTION *s, PACKET *pkt, int cert)
  2467. {
  2468. /* Extension ignored for inappropriate versions */
  2469. if (!SSL_USE_SIGALGS(s))
  2470. return 1;
  2471. /* Should never happen */
  2472. if (s->cert == NULL)
  2473. return 0;
  2474. if (cert)
  2475. return tls1_save_u16(pkt, &s->s3.tmp.peer_cert_sigalgs,
  2476. &s->s3.tmp.peer_cert_sigalgslen);
  2477. else
  2478. return tls1_save_u16(pkt, &s->s3.tmp.peer_sigalgs,
  2479. &s->s3.tmp.peer_sigalgslen);
  2480. }
  2481. /* Set preferred digest for each key type */
  2482. int tls1_process_sigalgs(SSL_CONNECTION *s)
  2483. {
  2484. size_t i;
  2485. uint32_t *pvalid = s->s3.tmp.valid_flags;
  2486. if (!tls1_set_shared_sigalgs(s))
  2487. return 0;
  2488. for (i = 0; i < s->ssl_pkey_num; i++)
  2489. pvalid[i] = 0;
  2490. for (i = 0; i < s->shared_sigalgslen; i++) {
  2491. const SIGALG_LOOKUP *sigptr = s->shared_sigalgs[i];
  2492. int idx = sigptr->sig_idx;
  2493. /* Ignore PKCS1 based sig algs in TLSv1.3 */
  2494. if (SSL_CONNECTION_IS_TLS13(s) && sigptr->sig == EVP_PKEY_RSA)
  2495. continue;
  2496. /* If not disabled indicate we can explicitly sign */
  2497. if (pvalid[idx] == 0
  2498. && !ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), idx))
  2499. pvalid[idx] = CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  2500. }
  2501. return 1;
  2502. }
  2503. int SSL_get_sigalgs(SSL *s, int idx,
  2504. int *psign, int *phash, int *psignhash,
  2505. unsigned char *rsig, unsigned char *rhash)
  2506. {
  2507. uint16_t *psig;
  2508. size_t numsigalgs;
  2509. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  2510. if (sc == NULL)
  2511. return 0;
  2512. psig = sc->s3.tmp.peer_sigalgs;
  2513. numsigalgs = sc->s3.tmp.peer_sigalgslen;
  2514. if (psig == NULL || numsigalgs > INT_MAX)
  2515. return 0;
  2516. if (idx >= 0) {
  2517. const SIGALG_LOOKUP *lu;
  2518. if (idx >= (int)numsigalgs)
  2519. return 0;
  2520. psig += idx;
  2521. if (rhash != NULL)
  2522. *rhash = (unsigned char)((*psig >> 8) & 0xff);
  2523. if (rsig != NULL)
  2524. *rsig = (unsigned char)(*psig & 0xff);
  2525. lu = tls1_lookup_sigalg(sc, *psig);
  2526. if (psign != NULL)
  2527. *psign = lu != NULL ? lu->sig : NID_undef;
  2528. if (phash != NULL)
  2529. *phash = lu != NULL ? lu->hash : NID_undef;
  2530. if (psignhash != NULL)
  2531. *psignhash = lu != NULL ? lu->sigandhash : NID_undef;
  2532. }
  2533. return (int)numsigalgs;
  2534. }
  2535. int SSL_get_shared_sigalgs(SSL *s, int idx,
  2536. int *psign, int *phash, int *psignhash,
  2537. unsigned char *rsig, unsigned char *rhash)
  2538. {
  2539. const SIGALG_LOOKUP *shsigalgs;
  2540. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  2541. if (sc == NULL)
  2542. return 0;
  2543. if (sc->shared_sigalgs == NULL
  2544. || idx < 0
  2545. || idx >= (int)sc->shared_sigalgslen
  2546. || sc->shared_sigalgslen > INT_MAX)
  2547. return 0;
  2548. shsigalgs = sc->shared_sigalgs[idx];
  2549. if (phash != NULL)
  2550. *phash = shsigalgs->hash;
  2551. if (psign != NULL)
  2552. *psign = shsigalgs->sig;
  2553. if (psignhash != NULL)
  2554. *psignhash = shsigalgs->sigandhash;
  2555. if (rsig != NULL)
  2556. *rsig = (unsigned char)(shsigalgs->sigalg & 0xff);
  2557. if (rhash != NULL)
  2558. *rhash = (unsigned char)((shsigalgs->sigalg >> 8) & 0xff);
  2559. return (int)sc->shared_sigalgslen;
  2560. }
  2561. /* Maximum possible number of unique entries in sigalgs array */
  2562. #define TLS_MAX_SIGALGCNT (OSSL_NELEM(sigalg_lookup_tbl) * 2)
  2563. typedef struct {
  2564. size_t sigalgcnt;
  2565. /* TLSEXT_SIGALG_XXX values */
  2566. uint16_t sigalgs[TLS_MAX_SIGALGCNT];
  2567. SSL_CTX *ctx;
  2568. } sig_cb_st;
  2569. static void get_sigorhash(int *psig, int *phash, const char *str)
  2570. {
  2571. if (strcmp(str, "RSA") == 0) {
  2572. *psig = EVP_PKEY_RSA;
  2573. } else if (strcmp(str, "RSA-PSS") == 0 || strcmp(str, "PSS") == 0) {
  2574. *psig = EVP_PKEY_RSA_PSS;
  2575. } else if (strcmp(str, "DSA") == 0) {
  2576. *psig = EVP_PKEY_DSA;
  2577. } else if (strcmp(str, "ECDSA") == 0) {
  2578. *psig = EVP_PKEY_EC;
  2579. } else {
  2580. *phash = OBJ_sn2nid(str);
  2581. if (*phash == NID_undef)
  2582. *phash = OBJ_ln2nid(str);
  2583. }
  2584. }
  2585. /* Maximum length of a signature algorithm string component */
  2586. #define TLS_MAX_SIGSTRING_LEN 40
  2587. static int sig_cb(const char *elem, int len, void *arg)
  2588. {
  2589. sig_cb_st *sarg = arg;
  2590. size_t i = 0;
  2591. const SIGALG_LOOKUP *s;
  2592. char etmp[TLS_MAX_SIGSTRING_LEN], *p;
  2593. int sig_alg = NID_undef, hash_alg = NID_undef;
  2594. int ignore_unknown = 0;
  2595. if (elem == NULL)
  2596. return 0;
  2597. if (elem[0] == '?') {
  2598. ignore_unknown = 1;
  2599. ++elem;
  2600. --len;
  2601. }
  2602. if (sarg->sigalgcnt == TLS_MAX_SIGALGCNT)
  2603. return 0;
  2604. if (len > (int)(sizeof(etmp) - 1))
  2605. return 0;
  2606. memcpy(etmp, elem, len);
  2607. etmp[len] = 0;
  2608. p = strchr(etmp, '+');
  2609. /*
  2610. * We only allow SignatureSchemes listed in the sigalg_lookup_tbl;
  2611. * if there's no '+' in the provided name, look for the new-style combined
  2612. * name. If not, match both sig+hash to find the needed SIGALG_LOOKUP.
  2613. * Just sig+hash is not unique since TLS 1.3 adds rsa_pss_pss_* and
  2614. * rsa_pss_rsae_* that differ only by public key OID; in such cases
  2615. * we will pick the _rsae_ variant, by virtue of them appearing earlier
  2616. * in the table.
  2617. */
  2618. if (p == NULL) {
  2619. /* Load provider sigalgs */
  2620. if (sarg->ctx != NULL) {
  2621. /* Check if a provider supports the sigalg */
  2622. for (i = 0; i < sarg->ctx->sigalg_list_len; i++) {
  2623. if (sarg->ctx->sigalg_list[i].sigalg_name != NULL
  2624. && strcmp(etmp,
  2625. sarg->ctx->sigalg_list[i].sigalg_name) == 0) {
  2626. sarg->sigalgs[sarg->sigalgcnt++] =
  2627. sarg->ctx->sigalg_list[i].code_point;
  2628. break;
  2629. }
  2630. }
  2631. }
  2632. /* Check the built-in sigalgs */
  2633. if (sarg->ctx == NULL || i == sarg->ctx->sigalg_list_len) {
  2634. for (i = 0, s = sigalg_lookup_tbl;
  2635. i < OSSL_NELEM(sigalg_lookup_tbl); i++, s++) {
  2636. if (s->name != NULL && strcmp(etmp, s->name) == 0) {
  2637. sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg;
  2638. break;
  2639. }
  2640. }
  2641. if (i == OSSL_NELEM(sigalg_lookup_tbl)) {
  2642. /* Ignore unknown algorithms if ignore_unknown */
  2643. return ignore_unknown;
  2644. }
  2645. }
  2646. } else {
  2647. *p = 0;
  2648. p++;
  2649. if (*p == 0)
  2650. return 0;
  2651. get_sigorhash(&sig_alg, &hash_alg, etmp);
  2652. get_sigorhash(&sig_alg, &hash_alg, p);
  2653. if (sig_alg == NID_undef || hash_alg == NID_undef) {
  2654. /* Ignore unknown algorithms if ignore_unknown */
  2655. return ignore_unknown;
  2656. }
  2657. for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl);
  2658. i++, s++) {
  2659. if (s->hash == hash_alg && s->sig == sig_alg) {
  2660. sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg;
  2661. break;
  2662. }
  2663. }
  2664. if (i == OSSL_NELEM(sigalg_lookup_tbl)) {
  2665. /* Ignore unknown algorithms if ignore_unknown */
  2666. return ignore_unknown;
  2667. }
  2668. }
  2669. /* Ignore duplicates */
  2670. for (i = 0; i < sarg->sigalgcnt - 1; i++) {
  2671. if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt - 1]) {
  2672. sarg->sigalgcnt--;
  2673. return 1;
  2674. }
  2675. }
  2676. return 1;
  2677. }
  2678. /*
  2679. * Set supported signature algorithms based on a colon separated list of the
  2680. * form sig+hash e.g. RSA+SHA512:DSA+SHA512
  2681. */
  2682. int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client)
  2683. {
  2684. sig_cb_st sig;
  2685. sig.sigalgcnt = 0;
  2686. if (ctx != NULL && ssl_load_sigalgs(ctx)) {
  2687. sig.ctx = ctx;
  2688. }
  2689. if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
  2690. return 0;
  2691. if (sig.sigalgcnt == 0) {
  2692. ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT,
  2693. "No valid signature algorithms in '%s'", str);
  2694. return 0;
  2695. }
  2696. if (c == NULL)
  2697. return 1;
  2698. return tls1_set_raw_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
  2699. }
  2700. int tls1_set_raw_sigalgs(CERT *c, const uint16_t *psigs, size_t salglen,
  2701. int client)
  2702. {
  2703. uint16_t *sigalgs;
  2704. if ((sigalgs = OPENSSL_malloc(salglen * sizeof(*sigalgs))) == NULL)
  2705. return 0;
  2706. memcpy(sigalgs, psigs, salglen * sizeof(*sigalgs));
  2707. if (client) {
  2708. OPENSSL_free(c->client_sigalgs);
  2709. c->client_sigalgs = sigalgs;
  2710. c->client_sigalgslen = salglen;
  2711. } else {
  2712. OPENSSL_free(c->conf_sigalgs);
  2713. c->conf_sigalgs = sigalgs;
  2714. c->conf_sigalgslen = salglen;
  2715. }
  2716. return 1;
  2717. }
  2718. int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
  2719. {
  2720. uint16_t *sigalgs, *sptr;
  2721. size_t i;
  2722. if (salglen & 1)
  2723. return 0;
  2724. if ((sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs))) == NULL)
  2725. return 0;
  2726. for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
  2727. size_t j;
  2728. const SIGALG_LOOKUP *curr;
  2729. int md_id = *psig_nids++;
  2730. int sig_id = *psig_nids++;
  2731. for (j = 0, curr = sigalg_lookup_tbl; j < OSSL_NELEM(sigalg_lookup_tbl);
  2732. j++, curr++) {
  2733. if (curr->hash == md_id && curr->sig == sig_id) {
  2734. *sptr++ = curr->sigalg;
  2735. break;
  2736. }
  2737. }
  2738. if (j == OSSL_NELEM(sigalg_lookup_tbl))
  2739. goto err;
  2740. }
  2741. if (client) {
  2742. OPENSSL_free(c->client_sigalgs);
  2743. c->client_sigalgs = sigalgs;
  2744. c->client_sigalgslen = salglen / 2;
  2745. } else {
  2746. OPENSSL_free(c->conf_sigalgs);
  2747. c->conf_sigalgs = sigalgs;
  2748. c->conf_sigalgslen = salglen / 2;
  2749. }
  2750. return 1;
  2751. err:
  2752. OPENSSL_free(sigalgs);
  2753. return 0;
  2754. }
  2755. static int tls1_check_sig_alg(SSL_CONNECTION *s, X509 *x, int default_nid)
  2756. {
  2757. int sig_nid, use_pc_sigalgs = 0;
  2758. size_t i;
  2759. const SIGALG_LOOKUP *sigalg;
  2760. size_t sigalgslen;
  2761. if (default_nid == -1)
  2762. return 1;
  2763. sig_nid = X509_get_signature_nid(x);
  2764. if (default_nid)
  2765. return sig_nid == default_nid ? 1 : 0;
  2766. if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.peer_cert_sigalgs != NULL) {
  2767. /*
  2768. * If we're in TLSv1.3 then we only get here if we're checking the
  2769. * chain. If the peer has specified peer_cert_sigalgs then we use them
  2770. * otherwise we default to normal sigalgs.
  2771. */
  2772. sigalgslen = s->s3.tmp.peer_cert_sigalgslen;
  2773. use_pc_sigalgs = 1;
  2774. } else {
  2775. sigalgslen = s->shared_sigalgslen;
  2776. }
  2777. for (i = 0; i < sigalgslen; i++) {
  2778. sigalg = use_pc_sigalgs
  2779. ? tls1_lookup_sigalg(s, s->s3.tmp.peer_cert_sigalgs[i])
  2780. : s->shared_sigalgs[i];
  2781. if (sigalg != NULL && sig_nid == sigalg->sigandhash)
  2782. return 1;
  2783. }
  2784. return 0;
  2785. }
  2786. /* Check to see if a certificate issuer name matches list of CA names */
  2787. static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
  2788. {
  2789. const X509_NAME *nm;
  2790. int i;
  2791. nm = X509_get_issuer_name(x);
  2792. for (i = 0; i < sk_X509_NAME_num(names); i++) {
  2793. if (!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
  2794. return 1;
  2795. }
  2796. return 0;
  2797. }
  2798. /*
  2799. * Check certificate chain is consistent with TLS extensions and is usable by
  2800. * server. This servers two purposes: it allows users to check chains before
  2801. * passing them to the server and it allows the server to check chains before
  2802. * attempting to use them.
  2803. */
  2804. /* Flags which need to be set for a certificate when strict mode not set */
  2805. #define CERT_PKEY_VALID_FLAGS \
  2806. (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
  2807. /* Strict mode flags */
  2808. #define CERT_PKEY_STRICT_FLAGS \
  2809. (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
  2810. | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  2811. int tls1_check_chain(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pk,
  2812. STACK_OF(X509) *chain, int idx)
  2813. {
  2814. int i;
  2815. int rv = 0;
  2816. int check_flags = 0, strict_mode;
  2817. CERT_PKEY *cpk = NULL;
  2818. CERT *c = s->cert;
  2819. uint32_t *pvalid;
  2820. unsigned int suiteb_flags = tls1_suiteb(s);
  2821. /*
  2822. * Meaning of idx:
  2823. * idx == -1 means SSL_check_chain() invocation
  2824. * idx == -2 means checking client certificate chains
  2825. * idx >= 0 means checking SSL_PKEY index
  2826. *
  2827. * For RPK, where there may be no cert, we ignore -1
  2828. */
  2829. if (idx != -1) {
  2830. if (idx == -2) {
  2831. cpk = c->key;
  2832. idx = (int)(cpk - c->pkeys);
  2833. } else
  2834. cpk = c->pkeys + idx;
  2835. pvalid = s->s3.tmp.valid_flags + idx;
  2836. x = cpk->x509;
  2837. pk = cpk->privatekey;
  2838. chain = cpk->chain;
  2839. strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
  2840. if (tls12_rpk_and_privkey(s, idx)) {
  2841. if (EVP_PKEY_is_a(pk, "EC") && !tls1_check_pkey_comp(s, pk))
  2842. return 0;
  2843. *pvalid = rv = CERT_PKEY_RPK;
  2844. return rv;
  2845. }
  2846. /* If no cert or key, forget it */
  2847. if (x == NULL || pk == NULL)
  2848. goto end;
  2849. } else {
  2850. size_t certidx;
  2851. if (x == NULL || pk == NULL)
  2852. return 0;
  2853. if (ssl_cert_lookup_by_pkey(pk, &certidx,
  2854. SSL_CONNECTION_GET_CTX(s)) == NULL)
  2855. return 0;
  2856. idx = certidx;
  2857. pvalid = s->s3.tmp.valid_flags + idx;
  2858. if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
  2859. check_flags = CERT_PKEY_STRICT_FLAGS;
  2860. else
  2861. check_flags = CERT_PKEY_VALID_FLAGS;
  2862. strict_mode = 1;
  2863. }
  2864. if (suiteb_flags) {
  2865. int ok;
  2866. if (check_flags)
  2867. check_flags |= CERT_PKEY_SUITEB;
  2868. ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
  2869. if (ok == X509_V_OK)
  2870. rv |= CERT_PKEY_SUITEB;
  2871. else if (!check_flags)
  2872. goto end;
  2873. }
  2874. /*
  2875. * Check all signature algorithms are consistent with signature
  2876. * algorithms extension if TLS 1.2 or later and strict mode.
  2877. */
  2878. if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION
  2879. && strict_mode) {
  2880. int default_nid;
  2881. int rsign = 0;
  2882. if (s->s3.tmp.peer_cert_sigalgs != NULL
  2883. || s->s3.tmp.peer_sigalgs != NULL) {
  2884. default_nid = 0;
  2885. /* If no sigalgs extension use defaults from RFC5246 */
  2886. } else {
  2887. switch (idx) {
  2888. case SSL_PKEY_RSA:
  2889. rsign = EVP_PKEY_RSA;
  2890. default_nid = NID_sha1WithRSAEncryption;
  2891. break;
  2892. case SSL_PKEY_DSA_SIGN:
  2893. rsign = EVP_PKEY_DSA;
  2894. default_nid = NID_dsaWithSHA1;
  2895. break;
  2896. case SSL_PKEY_ECC:
  2897. rsign = EVP_PKEY_EC;
  2898. default_nid = NID_ecdsa_with_SHA1;
  2899. break;
  2900. case SSL_PKEY_GOST01:
  2901. rsign = NID_id_GostR3410_2001;
  2902. default_nid = NID_id_GostR3411_94_with_GostR3410_2001;
  2903. break;
  2904. case SSL_PKEY_GOST12_256:
  2905. rsign = NID_id_GostR3410_2012_256;
  2906. default_nid = NID_id_tc26_signwithdigest_gost3410_2012_256;
  2907. break;
  2908. case SSL_PKEY_GOST12_512:
  2909. rsign = NID_id_GostR3410_2012_512;
  2910. default_nid = NID_id_tc26_signwithdigest_gost3410_2012_512;
  2911. break;
  2912. default:
  2913. default_nid = -1;
  2914. break;
  2915. }
  2916. }
  2917. /*
  2918. * If peer sent no signature algorithms extension and we have set
  2919. * preferred signature algorithms check we support sha1.
  2920. */
  2921. if (default_nid > 0 && c->conf_sigalgs) {
  2922. size_t j;
  2923. const uint16_t *p = c->conf_sigalgs;
  2924. for (j = 0; j < c->conf_sigalgslen; j++, p++) {
  2925. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *p);
  2926. if (lu != NULL && lu->hash == NID_sha1 && lu->sig == rsign)
  2927. break;
  2928. }
  2929. if (j == c->conf_sigalgslen) {
  2930. if (check_flags)
  2931. goto skip_sigs;
  2932. else
  2933. goto end;
  2934. }
  2935. }
  2936. /* Check signature algorithm of each cert in chain */
  2937. if (SSL_CONNECTION_IS_TLS13(s)) {
  2938. /*
  2939. * We only get here if the application has called SSL_check_chain(),
  2940. * so check_flags is always set.
  2941. */
  2942. if (find_sig_alg(s, x, pk) != NULL)
  2943. rv |= CERT_PKEY_EE_SIGNATURE;
  2944. } else if (!tls1_check_sig_alg(s, x, default_nid)) {
  2945. if (!check_flags)
  2946. goto end;
  2947. } else
  2948. rv |= CERT_PKEY_EE_SIGNATURE;
  2949. rv |= CERT_PKEY_CA_SIGNATURE;
  2950. for (i = 0; i < sk_X509_num(chain); i++) {
  2951. if (!tls1_check_sig_alg(s, sk_X509_value(chain, i), default_nid)) {
  2952. if (check_flags) {
  2953. rv &= ~CERT_PKEY_CA_SIGNATURE;
  2954. break;
  2955. } else
  2956. goto end;
  2957. }
  2958. }
  2959. }
  2960. /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
  2961. else if (check_flags)
  2962. rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE;
  2963. skip_sigs:
  2964. /* Check cert parameters are consistent */
  2965. if (tls1_check_cert_param(s, x, 1))
  2966. rv |= CERT_PKEY_EE_PARAM;
  2967. else if (!check_flags)
  2968. goto end;
  2969. if (!s->server)
  2970. rv |= CERT_PKEY_CA_PARAM;
  2971. /* In strict mode check rest of chain too */
  2972. else if (strict_mode) {
  2973. rv |= CERT_PKEY_CA_PARAM;
  2974. for (i = 0; i < sk_X509_num(chain); i++) {
  2975. X509 *ca = sk_X509_value(chain, i);
  2976. if (!tls1_check_cert_param(s, ca, 0)) {
  2977. if (check_flags) {
  2978. rv &= ~CERT_PKEY_CA_PARAM;
  2979. break;
  2980. } else
  2981. goto end;
  2982. }
  2983. }
  2984. }
  2985. if (!s->server && strict_mode) {
  2986. STACK_OF(X509_NAME) *ca_dn;
  2987. int check_type = 0;
  2988. if (EVP_PKEY_is_a(pk, "RSA"))
  2989. check_type = TLS_CT_RSA_SIGN;
  2990. else if (EVP_PKEY_is_a(pk, "DSA"))
  2991. check_type = TLS_CT_DSS_SIGN;
  2992. else if (EVP_PKEY_is_a(pk, "EC"))
  2993. check_type = TLS_CT_ECDSA_SIGN;
  2994. if (check_type) {
  2995. const uint8_t *ctypes = s->s3.tmp.ctype;
  2996. size_t j;
  2997. for (j = 0; j < s->s3.tmp.ctype_len; j++, ctypes++) {
  2998. if (*ctypes == check_type) {
  2999. rv |= CERT_PKEY_CERT_TYPE;
  3000. break;
  3001. }
  3002. }
  3003. if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
  3004. goto end;
  3005. } else {
  3006. rv |= CERT_PKEY_CERT_TYPE;
  3007. }
  3008. ca_dn = s->s3.tmp.peer_ca_names;
  3009. if (ca_dn == NULL
  3010. || sk_X509_NAME_num(ca_dn) == 0
  3011. || ssl_check_ca_name(ca_dn, x))
  3012. rv |= CERT_PKEY_ISSUER_NAME;
  3013. else
  3014. for (i = 0; i < sk_X509_num(chain); i++) {
  3015. X509 *xtmp = sk_X509_value(chain, i);
  3016. if (ssl_check_ca_name(ca_dn, xtmp)) {
  3017. rv |= CERT_PKEY_ISSUER_NAME;
  3018. break;
  3019. }
  3020. }
  3021. if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
  3022. goto end;
  3023. } else
  3024. rv |= CERT_PKEY_ISSUER_NAME | CERT_PKEY_CERT_TYPE;
  3025. if (!check_flags || (rv & check_flags) == check_flags)
  3026. rv |= CERT_PKEY_VALID;
  3027. end:
  3028. if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION)
  3029. rv |= *pvalid & (CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN);
  3030. else
  3031. rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN;
  3032. /*
  3033. * When checking a CERT_PKEY structure all flags are irrelevant if the
  3034. * chain is invalid.
  3035. */
  3036. if (!check_flags) {
  3037. if (rv & CERT_PKEY_VALID) {
  3038. *pvalid = rv;
  3039. } else {
  3040. /* Preserve sign and explicit sign flag, clear rest */
  3041. *pvalid &= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  3042. return 0;
  3043. }
  3044. }
  3045. return rv;
  3046. }
  3047. /* Set validity of certificates in an SSL structure */
  3048. void tls1_set_cert_validity(SSL_CONNECTION *s)
  3049. {
  3050. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA);
  3051. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_PSS_SIGN);
  3052. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
  3053. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
  3054. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST01);
  3055. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_256);
  3056. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_512);
  3057. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED25519);
  3058. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED448);
  3059. }
  3060. /* User level utility function to check a chain is suitable */
  3061. int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
  3062. {
  3063. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  3064. if (sc == NULL)
  3065. return 0;
  3066. return tls1_check_chain(sc, x, pk, chain, -1);
  3067. }
  3068. EVP_PKEY *ssl_get_auto_dh(SSL_CONNECTION *s)
  3069. {
  3070. EVP_PKEY *dhp = NULL;
  3071. BIGNUM *p;
  3072. int dh_secbits = 80, sec_level_bits;
  3073. EVP_PKEY_CTX *pctx = NULL;
  3074. OSSL_PARAM_BLD *tmpl = NULL;
  3075. OSSL_PARAM *params = NULL;
  3076. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3077. if (s->cert->dh_tmp_auto != 2) {
  3078. if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
  3079. if (s->s3.tmp.new_cipher->strength_bits == 256)
  3080. dh_secbits = 128;
  3081. else
  3082. dh_secbits = 80;
  3083. } else {
  3084. if (s->s3.tmp.cert == NULL)
  3085. return NULL;
  3086. dh_secbits = EVP_PKEY_get_security_bits(s->s3.tmp.cert->privatekey);
  3087. }
  3088. }
  3089. /* Do not pick a prime that is too weak for the current security level */
  3090. sec_level_bits = ssl_get_security_level_bits(SSL_CONNECTION_GET_SSL(s),
  3091. NULL, NULL);
  3092. if (dh_secbits < sec_level_bits)
  3093. dh_secbits = sec_level_bits;
  3094. if (dh_secbits >= 192)
  3095. p = BN_get_rfc3526_prime_8192(NULL);
  3096. else if (dh_secbits >= 152)
  3097. p = BN_get_rfc3526_prime_4096(NULL);
  3098. else if (dh_secbits >= 128)
  3099. p = BN_get_rfc3526_prime_3072(NULL);
  3100. else if (dh_secbits >= 112)
  3101. p = BN_get_rfc3526_prime_2048(NULL);
  3102. else
  3103. p = BN_get_rfc2409_prime_1024(NULL);
  3104. if (p == NULL)
  3105. goto err;
  3106. pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq);
  3107. if (pctx == NULL
  3108. || EVP_PKEY_fromdata_init(pctx) != 1)
  3109. goto err;
  3110. tmpl = OSSL_PARAM_BLD_new();
  3111. if (tmpl == NULL
  3112. || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)
  3113. || !OSSL_PARAM_BLD_push_uint(tmpl, OSSL_PKEY_PARAM_FFC_G, 2))
  3114. goto err;
  3115. params = OSSL_PARAM_BLD_to_param(tmpl);
  3116. if (params == NULL
  3117. || EVP_PKEY_fromdata(pctx, &dhp, EVP_PKEY_KEY_PARAMETERS, params) != 1)
  3118. goto err;
  3119. err:
  3120. OSSL_PARAM_free(params);
  3121. OSSL_PARAM_BLD_free(tmpl);
  3122. EVP_PKEY_CTX_free(pctx);
  3123. BN_free(p);
  3124. return dhp;
  3125. }
  3126. static int ssl_security_cert_key(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
  3127. int op)
  3128. {
  3129. int secbits = -1;
  3130. EVP_PKEY *pkey = X509_get0_pubkey(x);
  3131. if (pkey) {
  3132. /*
  3133. * If no parameters this will return -1 and fail using the default
  3134. * security callback for any non-zero security level. This will
  3135. * reject keys which omit parameters but this only affects DSA and
  3136. * omission of parameters is never (?) done in practice.
  3137. */
  3138. secbits = EVP_PKEY_get_security_bits(pkey);
  3139. }
  3140. if (s != NULL)
  3141. return ssl_security(s, op, secbits, 0, x);
  3142. else
  3143. return ssl_ctx_security(ctx, op, secbits, 0, x);
  3144. }
  3145. static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
  3146. int op)
  3147. {
  3148. /* Lookup signature algorithm digest */
  3149. int secbits, nid, pknid;
  3150. /* Don't check signature if self signed */
  3151. if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)
  3152. return 1;
  3153. if (!X509_get_signature_info(x, &nid, &pknid, &secbits, NULL))
  3154. secbits = -1;
  3155. /* If digest NID not defined use signature NID */
  3156. if (nid == NID_undef)
  3157. nid = pknid;
  3158. if (s != NULL)
  3159. return ssl_security(s, op, secbits, nid, x);
  3160. else
  3161. return ssl_ctx_security(ctx, op, secbits, nid, x);
  3162. }
  3163. int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy,
  3164. int is_ee)
  3165. {
  3166. if (vfy)
  3167. vfy = SSL_SECOP_PEER;
  3168. if (is_ee) {
  3169. if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
  3170. return SSL_R_EE_KEY_TOO_SMALL;
  3171. } else {
  3172. if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
  3173. return SSL_R_CA_KEY_TOO_SMALL;
  3174. }
  3175. if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
  3176. return SSL_R_CA_MD_TOO_WEAK;
  3177. return 1;
  3178. }
  3179. /*
  3180. * Check security of a chain, if |sk| includes the end entity certificate then
  3181. * |x| is NULL. If |vfy| is 1 then we are verifying a peer chain and not sending
  3182. * one to the peer. Return values: 1 if ok otherwise error code to use
  3183. */
  3184. int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk,
  3185. X509 *x, int vfy)
  3186. {
  3187. int rv, start_idx, i;
  3188. if (x == NULL) {
  3189. x = sk_X509_value(sk, 0);
  3190. if (x == NULL)
  3191. return ERR_R_INTERNAL_ERROR;
  3192. start_idx = 1;
  3193. } else
  3194. start_idx = 0;
  3195. rv = ssl_security_cert(s, NULL, x, vfy, 1);
  3196. if (rv != 1)
  3197. return rv;
  3198. for (i = start_idx; i < sk_X509_num(sk); i++) {
  3199. x = sk_X509_value(sk, i);
  3200. rv = ssl_security_cert(s, NULL, x, vfy, 0);
  3201. if (rv != 1)
  3202. return rv;
  3203. }
  3204. return 1;
  3205. }
  3206. /*
  3207. * For TLS 1.2 servers check if we have a certificate which can be used
  3208. * with the signature algorithm "lu" and return index of certificate.
  3209. */
  3210. static int tls12_get_cert_sigalg_idx(const SSL_CONNECTION *s,
  3211. const SIGALG_LOOKUP *lu)
  3212. {
  3213. int sig_idx = lu->sig_idx;
  3214. const SSL_CERT_LOOKUP *clu = ssl_cert_lookup_by_idx(sig_idx,
  3215. SSL_CONNECTION_GET_CTX(s));
  3216. /* If not recognised or not supported by cipher mask it is not suitable */
  3217. if (clu == NULL
  3218. || (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0
  3219. || (clu->nid == EVP_PKEY_RSA_PSS
  3220. && (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kRSA) != 0))
  3221. return -1;
  3222. /* If doing RPK, the CERT_PKEY won't be "valid" */
  3223. if (tls12_rpk_and_privkey(s, sig_idx))
  3224. return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_RPK ? sig_idx : -1;
  3225. return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_VALID ? sig_idx : -1;
  3226. }
  3227. /*
  3228. * Checks the given cert against signature_algorithm_cert restrictions sent by
  3229. * the peer (if any) as well as whether the hash from the sigalg is usable with
  3230. * the key.
  3231. * Returns true if the cert is usable and false otherwise.
  3232. */
  3233. static int check_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig,
  3234. X509 *x, EVP_PKEY *pkey)
  3235. {
  3236. const SIGALG_LOOKUP *lu;
  3237. int mdnid, pknid, supported;
  3238. size_t i;
  3239. const char *mdname = NULL;
  3240. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3241. /*
  3242. * If the given EVP_PKEY cannot support signing with this digest,
  3243. * the answer is simply 'no'.
  3244. */
  3245. if (sig->hash != NID_undef)
  3246. mdname = OBJ_nid2sn(sig->hash);
  3247. supported = EVP_PKEY_digestsign_supports_digest(pkey, sctx->libctx,
  3248. mdname,
  3249. sctx->propq);
  3250. if (supported <= 0)
  3251. return 0;
  3252. /*
  3253. * The TLS 1.3 signature_algorithms_cert extension places restrictions
  3254. * on the sigalg with which the certificate was signed (by its issuer).
  3255. */
  3256. if (s->s3.tmp.peer_cert_sigalgs != NULL) {
  3257. if (!X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL))
  3258. return 0;
  3259. for (i = 0; i < s->s3.tmp.peer_cert_sigalgslen; i++) {
  3260. lu = tls1_lookup_sigalg(s, s->s3.tmp.peer_cert_sigalgs[i]);
  3261. if (lu == NULL)
  3262. continue;
  3263. /*
  3264. * This does not differentiate between the
  3265. * rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
  3266. * have a chain here that lets us look at the key OID in the
  3267. * signing certificate.
  3268. */
  3269. if (mdnid == lu->hash && pknid == lu->sig)
  3270. return 1;
  3271. }
  3272. return 0;
  3273. }
  3274. /*
  3275. * Without signat_algorithms_cert, any certificate for which we have
  3276. * a viable public key is permitted.
  3277. */
  3278. return 1;
  3279. }
  3280. /*
  3281. * Returns true if |s| has a usable certificate configured for use
  3282. * with signature scheme |sig|.
  3283. * "Usable" includes a check for presence as well as applying
  3284. * the signature_algorithm_cert restrictions sent by the peer (if any).
  3285. * Returns false if no usable certificate is found.
  3286. */
  3287. static int has_usable_cert(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, int idx)
  3288. {
  3289. /* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */
  3290. if (idx == -1)
  3291. idx = sig->sig_idx;
  3292. if (!ssl_has_cert(s, idx))
  3293. return 0;
  3294. return check_cert_usable(s, sig, s->cert->pkeys[idx].x509,
  3295. s->cert->pkeys[idx].privatekey);
  3296. }
  3297. /*
  3298. * Returns true if the supplied cert |x| and key |pkey| is usable with the
  3299. * specified signature scheme |sig|, or false otherwise.
  3300. */
  3301. static int is_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, X509 *x,
  3302. EVP_PKEY *pkey)
  3303. {
  3304. size_t idx;
  3305. if (ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)) == NULL)
  3306. return 0;
  3307. /* Check the key is consistent with the sig alg */
  3308. if ((int)idx != sig->sig_idx)
  3309. return 0;
  3310. return check_cert_usable(s, sig, x, pkey);
  3311. }
  3312. /*
  3313. * Find a signature scheme that works with the supplied certificate |x| and key
  3314. * |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our
  3315. * available certs/keys to find one that works.
  3316. */
  3317. static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x,
  3318. EVP_PKEY *pkey)
  3319. {
  3320. const SIGALG_LOOKUP *lu = NULL;
  3321. size_t i;
  3322. int curve = -1;
  3323. EVP_PKEY *tmppkey;
  3324. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3325. /* Look for a shared sigalgs matching possible certificates */
  3326. for (i = 0; i < s->shared_sigalgslen; i++) {
  3327. lu = s->shared_sigalgs[i];
  3328. /* Skip SHA1, SHA224, DSA and RSA if not PSS */
  3329. if (lu->hash == NID_sha1
  3330. || lu->hash == NID_sha224
  3331. || lu->sig == EVP_PKEY_DSA
  3332. || lu->sig == EVP_PKEY_RSA)
  3333. continue;
  3334. /* Check that we have a cert, and signature_algorithms_cert */
  3335. if (!tls1_lookup_md(sctx, lu, NULL))
  3336. continue;
  3337. if ((pkey == NULL && !has_usable_cert(s, lu, -1))
  3338. || (pkey != NULL && !is_cert_usable(s, lu, x, pkey)))
  3339. continue;
  3340. tmppkey = (pkey != NULL) ? pkey
  3341. : s->cert->pkeys[lu->sig_idx].privatekey;
  3342. if (lu->sig == EVP_PKEY_EC) {
  3343. if (curve == -1)
  3344. curve = ssl_get_EC_curve_nid(tmppkey);
  3345. if (lu->curve != NID_undef && curve != lu->curve)
  3346. continue;
  3347. } else if (lu->sig == EVP_PKEY_RSA_PSS) {
  3348. /* validate that key is large enough for the signature algorithm */
  3349. if (!rsa_pss_check_min_key_size(sctx, tmppkey, lu))
  3350. continue;
  3351. }
  3352. break;
  3353. }
  3354. if (i == s->shared_sigalgslen)
  3355. return NULL;
  3356. return lu;
  3357. }
  3358. /*
  3359. * Choose an appropriate signature algorithm based on available certificates
  3360. * Sets chosen certificate and signature algorithm.
  3361. *
  3362. * For servers if we fail to find a required certificate it is a fatal error,
  3363. * an appropriate error code is set and a TLS alert is sent.
  3364. *
  3365. * For clients fatalerrs is set to 0. If a certificate is not suitable it is not
  3366. * a fatal error: we will either try another certificate or not present one
  3367. * to the server. In this case no error is set.
  3368. */
  3369. int tls_choose_sigalg(SSL_CONNECTION *s, int fatalerrs)
  3370. {
  3371. const SIGALG_LOOKUP *lu = NULL;
  3372. int sig_idx = -1;
  3373. s->s3.tmp.cert = NULL;
  3374. s->s3.tmp.sigalg = NULL;
  3375. if (SSL_CONNECTION_IS_TLS13(s)) {
  3376. lu = find_sig_alg(s, NULL, NULL);
  3377. if (lu == NULL) {
  3378. if (!fatalerrs)
  3379. return 1;
  3380. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3381. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3382. return 0;
  3383. }
  3384. } else {
  3385. /* If ciphersuite doesn't require a cert nothing to do */
  3386. if (!(s->s3.tmp.new_cipher->algorithm_auth & SSL_aCERT))
  3387. return 1;
  3388. if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))
  3389. return 1;
  3390. if (SSL_USE_SIGALGS(s)) {
  3391. size_t i;
  3392. if (s->s3.tmp.peer_sigalgs != NULL) {
  3393. int curve = -1;
  3394. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3395. /* For Suite B need to match signature algorithm to curve */
  3396. if (tls1_suiteb(s))
  3397. curve = ssl_get_EC_curve_nid(s->cert->pkeys[SSL_PKEY_ECC]
  3398. .privatekey);
  3399. /*
  3400. * Find highest preference signature algorithm matching
  3401. * cert type
  3402. */
  3403. for (i = 0; i < s->shared_sigalgslen; i++) {
  3404. lu = s->shared_sigalgs[i];
  3405. if (s->server) {
  3406. if ((sig_idx = tls12_get_cert_sigalg_idx(s, lu)) == -1)
  3407. continue;
  3408. } else {
  3409. int cc_idx = s->cert->key - s->cert->pkeys;
  3410. sig_idx = lu->sig_idx;
  3411. if (cc_idx != sig_idx)
  3412. continue;
  3413. }
  3414. /* Check that we have a cert, and sig_algs_cert */
  3415. if (!has_usable_cert(s, lu, sig_idx))
  3416. continue;
  3417. if (lu->sig == EVP_PKEY_RSA_PSS) {
  3418. /* validate that key is large enough for the signature algorithm */
  3419. EVP_PKEY *pkey = s->cert->pkeys[sig_idx].privatekey;
  3420. if (!rsa_pss_check_min_key_size(sctx, pkey, lu))
  3421. continue;
  3422. }
  3423. if (curve == -1 || lu->curve == curve)
  3424. break;
  3425. }
  3426. #ifndef OPENSSL_NO_GOST
  3427. /*
  3428. * Some Windows-based implementations do not send GOST algorithms indication
  3429. * in supported_algorithms extension, so when we have GOST-based ciphersuite,
  3430. * we have to assume GOST support.
  3431. */
  3432. if (i == s->shared_sigalgslen
  3433. && (s->s3.tmp.new_cipher->algorithm_auth
  3434. & (SSL_aGOST01 | SSL_aGOST12)) != 0) {
  3435. if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
  3436. if (!fatalerrs)
  3437. return 1;
  3438. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3439. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3440. return 0;
  3441. } else {
  3442. i = 0;
  3443. sig_idx = lu->sig_idx;
  3444. }
  3445. }
  3446. #endif
  3447. if (i == s->shared_sigalgslen) {
  3448. if (!fatalerrs)
  3449. return 1;
  3450. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3451. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3452. return 0;
  3453. }
  3454. } else {
  3455. /*
  3456. * If we have no sigalg use defaults
  3457. */
  3458. const uint16_t *sent_sigs;
  3459. size_t sent_sigslen;
  3460. if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
  3461. if (!fatalerrs)
  3462. return 1;
  3463. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3464. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3465. return 0;
  3466. }
  3467. /* Check signature matches a type we sent */
  3468. sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
  3469. for (i = 0; i < sent_sigslen; i++, sent_sigs++) {
  3470. if (lu->sigalg == *sent_sigs
  3471. && has_usable_cert(s, lu, lu->sig_idx))
  3472. break;
  3473. }
  3474. if (i == sent_sigslen) {
  3475. if (!fatalerrs)
  3476. return 1;
  3477. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3478. SSL_R_WRONG_SIGNATURE_TYPE);
  3479. return 0;
  3480. }
  3481. }
  3482. } else {
  3483. if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
  3484. if (!fatalerrs)
  3485. return 1;
  3486. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  3487. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3488. return 0;
  3489. }
  3490. }
  3491. }
  3492. if (sig_idx == -1)
  3493. sig_idx = lu->sig_idx;
  3494. s->s3.tmp.cert = &s->cert->pkeys[sig_idx];
  3495. s->cert->key = s->s3.tmp.cert;
  3496. s->s3.tmp.sigalg = lu;
  3497. return 1;
  3498. }
  3499. int SSL_CTX_set_tlsext_max_fragment_length(SSL_CTX *ctx, uint8_t mode)
  3500. {
  3501. if (mode != TLSEXT_max_fragment_length_DISABLED
  3502. && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) {
  3503. ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
  3504. return 0;
  3505. }
  3506. ctx->ext.max_fragment_len_mode = mode;
  3507. return 1;
  3508. }
  3509. int SSL_set_tlsext_max_fragment_length(SSL *ssl, uint8_t mode)
  3510. {
  3511. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
  3512. if (sc == NULL
  3513. || (IS_QUIC(ssl) && mode != TLSEXT_max_fragment_length_DISABLED))
  3514. return 0;
  3515. if (mode != TLSEXT_max_fragment_length_DISABLED
  3516. && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) {
  3517. ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
  3518. return 0;
  3519. }
  3520. sc->ext.max_fragment_len_mode = mode;
  3521. return 1;
  3522. }
  3523. uint8_t SSL_SESSION_get_max_fragment_length(const SSL_SESSION *session)
  3524. {
  3525. return session->ext.max_fragment_len_mode;
  3526. }
  3527. /*
  3528. * Helper functions for HMAC access with legacy support included.
  3529. */
  3530. SSL_HMAC *ssl_hmac_new(const SSL_CTX *ctx)
  3531. {
  3532. SSL_HMAC *ret = OPENSSL_zalloc(sizeof(*ret));
  3533. EVP_MAC *mac = NULL;
  3534. if (ret == NULL)
  3535. return NULL;
  3536. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3537. if (ctx->ext.ticket_key_evp_cb == NULL
  3538. && ctx->ext.ticket_key_cb != NULL) {
  3539. if (!ssl_hmac_old_new(ret))
  3540. goto err;
  3541. return ret;
  3542. }
  3543. #endif
  3544. mac = EVP_MAC_fetch(ctx->libctx, "HMAC", ctx->propq);
  3545. if (mac == NULL || (ret->ctx = EVP_MAC_CTX_new(mac)) == NULL)
  3546. goto err;
  3547. EVP_MAC_free(mac);
  3548. return ret;
  3549. err:
  3550. EVP_MAC_CTX_free(ret->ctx);
  3551. EVP_MAC_free(mac);
  3552. OPENSSL_free(ret);
  3553. return NULL;
  3554. }
  3555. void ssl_hmac_free(SSL_HMAC *ctx)
  3556. {
  3557. if (ctx != NULL) {
  3558. EVP_MAC_CTX_free(ctx->ctx);
  3559. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3560. ssl_hmac_old_free(ctx);
  3561. #endif
  3562. OPENSSL_free(ctx);
  3563. }
  3564. }
  3565. EVP_MAC_CTX *ssl_hmac_get0_EVP_MAC_CTX(SSL_HMAC *ctx)
  3566. {
  3567. return ctx->ctx;
  3568. }
  3569. int ssl_hmac_init(SSL_HMAC *ctx, void *key, size_t len, char *md)
  3570. {
  3571. OSSL_PARAM params[2], *p = params;
  3572. if (ctx->ctx != NULL) {
  3573. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, md, 0);
  3574. *p = OSSL_PARAM_construct_end();
  3575. if (EVP_MAC_init(ctx->ctx, key, len, params))
  3576. return 1;
  3577. }
  3578. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3579. if (ctx->old_ctx != NULL)
  3580. return ssl_hmac_old_init(ctx, key, len, md);
  3581. #endif
  3582. return 0;
  3583. }
  3584. int ssl_hmac_update(SSL_HMAC *ctx, const unsigned char *data, size_t len)
  3585. {
  3586. if (ctx->ctx != NULL)
  3587. return EVP_MAC_update(ctx->ctx, data, len);
  3588. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3589. if (ctx->old_ctx != NULL)
  3590. return ssl_hmac_old_update(ctx, data, len);
  3591. #endif
  3592. return 0;
  3593. }
  3594. int ssl_hmac_final(SSL_HMAC *ctx, unsigned char *md, size_t *len,
  3595. size_t max_size)
  3596. {
  3597. if (ctx->ctx != NULL)
  3598. return EVP_MAC_final(ctx->ctx, md, len, max_size);
  3599. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3600. if (ctx->old_ctx != NULL)
  3601. return ssl_hmac_old_final(ctx, md, len);
  3602. #endif
  3603. return 0;
  3604. }
  3605. size_t ssl_hmac_size(const SSL_HMAC *ctx)
  3606. {
  3607. if (ctx->ctx != NULL)
  3608. return EVP_MAC_CTX_get_mac_size(ctx->ctx);
  3609. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3610. if (ctx->old_ctx != NULL)
  3611. return ssl_hmac_old_size(ctx);
  3612. #endif
  3613. return 0;
  3614. }
  3615. int ssl_get_EC_curve_nid(const EVP_PKEY *pkey)
  3616. {
  3617. char gname[OSSL_MAX_NAME_SIZE];
  3618. if (EVP_PKEY_get_group_name(pkey, gname, sizeof(gname), NULL) > 0)
  3619. return OBJ_txt2nid(gname);
  3620. return NID_undef;
  3621. }
  3622. __owur int tls13_set_encoded_pub_key(EVP_PKEY *pkey,
  3623. const unsigned char *enckey,
  3624. size_t enckeylen)
  3625. {
  3626. if (EVP_PKEY_is_a(pkey, "DH")) {
  3627. int bits = EVP_PKEY_get_bits(pkey);
  3628. if (bits <= 0 || enckeylen != (size_t)bits / 8)
  3629. /* the encoded key must be padded to the length of the p */
  3630. return 0;
  3631. } else if (EVP_PKEY_is_a(pkey, "EC")) {
  3632. if (enckeylen < 3 /* point format and at least 1 byte for x and y */
  3633. || enckey[0] != 0x04)
  3634. return 0;
  3635. }
  3636. return EVP_PKEY_set1_encoded_public_key(pkey, enckey, enckeylen);
  3637. }