statem_lib.c 74 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287
  1. /*
  2. * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  4. *
  5. * Licensed under the OpenSSL license (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. */
  10. #include <limits.h>
  11. #include <string.h>
  12. #include <stdio.h>
  13. #include "../ssl_locl.h"
  14. #include "statem_locl.h"
  15. #include "internal/cryptlib.h"
  16. #include <openssl/buffer.h>
  17. #include <openssl/objects.h>
  18. #include <openssl/evp.h>
  19. #include <openssl/x509.h>
  20. /*
  21. * Map error codes to TLS/SSL alart types.
  22. */
  23. typedef struct x509err2alert_st {
  24. int x509err;
  25. int alert;
  26. } X509ERR2ALERT;
  27. /* Fixed value used in the ServerHello random field to identify an HRR */
  28. const unsigned char hrrrandom[] = {
  29. 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02,
  30. 0x1e, 0x65, 0xb8, 0x91, 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e,
  31. 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
  32. };
  33. /*
  34. * send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
  35. * SSL3_RT_CHANGE_CIPHER_SPEC)
  36. */
  37. int ssl3_do_write(SSL *s, int type)
  38. {
  39. int ret;
  40. size_t written = 0;
  41. ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
  42. s->init_num, &written);
  43. if (ret < 0)
  44. return -1;
  45. if (type == SSL3_RT_HANDSHAKE)
  46. /*
  47. * should not be done for 'Hello Request's, but in that case we'll
  48. * ignore the result anyway
  49. * TLS1.3 KeyUpdate and NewSessionTicket do not need to be added
  50. */
  51. if (!SSL_IS_TLS13(s) || (s->statem.hand_state != TLS_ST_SW_SESSION_TICKET
  52. && s->statem.hand_state != TLS_ST_CW_KEY_UPDATE
  53. && s->statem.hand_state != TLS_ST_SW_KEY_UPDATE))
  54. if (!ssl3_finish_mac(s,
  55. (unsigned char *)&s->init_buf->data[s->init_off],
  56. written))
  57. return -1;
  58. if (written == s->init_num) {
  59. if (s->msg_callback)
  60. s->msg_callback(1, s->version, type, s->init_buf->data,
  61. (size_t)(s->init_off + s->init_num), s,
  62. s->msg_callback_arg);
  63. return 1;
  64. }
  65. s->init_off += written;
  66. s->init_num -= written;
  67. return 0;
  68. }
  69. int tls_close_construct_packet(SSL *s, WPACKET *pkt, int htype)
  70. {
  71. size_t msglen;
  72. if ((htype != SSL3_MT_CHANGE_CIPHER_SPEC && !WPACKET_close(pkt))
  73. || !WPACKET_get_length(pkt, &msglen)
  74. || msglen > INT_MAX)
  75. return 0;
  76. s->init_num = (int)msglen;
  77. s->init_off = 0;
  78. return 1;
  79. }
  80. int tls_setup_handshake(SSL *s)
  81. {
  82. if (!ssl3_init_finished_mac(s)) {
  83. /* SSLfatal() already called */
  84. return 0;
  85. }
  86. /* Reset any extension flags */
  87. memset(s->ext.extflags, 0, sizeof(s->ext.extflags));
  88. if (s->server) {
  89. STACK_OF(SSL_CIPHER) *ciphers = SSL_get_ciphers(s);
  90. int i, ver_min, ver_max, ok = 0;
  91. /*
  92. * Sanity check that the maximum version we accept has ciphers
  93. * enabled. For clients we do this check during construction of the
  94. * ClientHello.
  95. */
  96. if (ssl_get_min_max_version(s, &ver_min, &ver_max) != 0) {
  97. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_SETUP_HANDSHAKE,
  98. ERR_R_INTERNAL_ERROR);
  99. return 0;
  100. }
  101. for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
  102. const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
  103. if (SSL_IS_DTLS(s)) {
  104. if (DTLS_VERSION_GE(ver_max, c->min_dtls) &&
  105. DTLS_VERSION_LE(ver_max, c->max_dtls))
  106. ok = 1;
  107. } else if (ver_max >= c->min_tls && ver_max <= c->max_tls) {
  108. ok = 1;
  109. }
  110. if (ok)
  111. break;
  112. }
  113. if (!ok) {
  114. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_SETUP_HANDSHAKE,
  115. SSL_R_NO_CIPHERS_AVAILABLE);
  116. ERR_add_error_data(1, "No ciphers enabled for max supported "
  117. "SSL/TLS version");
  118. return 0;
  119. }
  120. if (SSL_IS_FIRST_HANDSHAKE(s)) {
  121. /* N.B. s->session_ctx == s->ctx here */
  122. CRYPTO_atomic_add(&s->session_ctx->stats.sess_accept, 1, &i,
  123. s->session_ctx->lock);
  124. } else {
  125. /* N.B. s->ctx may not equal s->session_ctx */
  126. CRYPTO_atomic_add(&s->ctx->stats.sess_accept_renegotiate, 1, &i,
  127. s->ctx->lock);
  128. s->s3->tmp.cert_request = 0;
  129. }
  130. } else {
  131. int discard;
  132. if (SSL_IS_FIRST_HANDSHAKE(s))
  133. CRYPTO_atomic_add(&s->session_ctx->stats.sess_connect, 1, &discard,
  134. s->session_ctx->lock);
  135. else
  136. CRYPTO_atomic_add(&s->session_ctx->stats.sess_connect_renegotiate,
  137. 1, &discard, s->session_ctx->lock);
  138. /* mark client_random uninitialized */
  139. memset(s->s3->client_random, 0, sizeof(s->s3->client_random));
  140. s->hit = 0;
  141. s->s3->tmp.cert_req = 0;
  142. if (SSL_IS_DTLS(s))
  143. s->statem.use_timer = 1;
  144. }
  145. return 1;
  146. }
  147. /*
  148. * Size of the to-be-signed TLS13 data, without the hash size itself:
  149. * 64 bytes of value 32, 33 context bytes, 1 byte separator
  150. */
  151. #define TLS13_TBS_START_SIZE 64
  152. #define TLS13_TBS_PREAMBLE_SIZE (TLS13_TBS_START_SIZE + 33 + 1)
  153. static int get_cert_verify_tbs_data(SSL *s, unsigned char *tls13tbs,
  154. void **hdata, size_t *hdatalen)
  155. {
  156. static const char *servercontext = "TLS 1.3, server CertificateVerify";
  157. static const char *clientcontext = "TLS 1.3, client CertificateVerify";
  158. if (SSL_IS_TLS13(s)) {
  159. size_t hashlen;
  160. /* Set the first 64 bytes of to-be-signed data to octet 32 */
  161. memset(tls13tbs, 32, TLS13_TBS_START_SIZE);
  162. /* This copies the 33 bytes of context plus the 0 separator byte */
  163. if (s->statem.hand_state == TLS_ST_CR_CERT_VRFY
  164. || s->statem.hand_state == TLS_ST_SW_CERT_VRFY)
  165. strcpy((char *)tls13tbs + TLS13_TBS_START_SIZE, servercontext);
  166. else
  167. strcpy((char *)tls13tbs + TLS13_TBS_START_SIZE, clientcontext);
  168. /*
  169. * If we're currently reading then we need to use the saved handshake
  170. * hash value. We can't use the current handshake hash state because
  171. * that includes the CertVerify itself.
  172. */
  173. if (s->statem.hand_state == TLS_ST_CR_CERT_VRFY
  174. || s->statem.hand_state == TLS_ST_SR_CERT_VRFY) {
  175. memcpy(tls13tbs + TLS13_TBS_PREAMBLE_SIZE, s->cert_verify_hash,
  176. s->cert_verify_hash_len);
  177. hashlen = s->cert_verify_hash_len;
  178. } else if (!ssl_handshake_hash(s, tls13tbs + TLS13_TBS_PREAMBLE_SIZE,
  179. EVP_MAX_MD_SIZE, &hashlen)) {
  180. /* SSLfatal() already called */
  181. return 0;
  182. }
  183. *hdata = tls13tbs;
  184. *hdatalen = TLS13_TBS_PREAMBLE_SIZE + hashlen;
  185. } else {
  186. size_t retlen;
  187. retlen = BIO_get_mem_data(s->s3->handshake_buffer, hdata);
  188. if (retlen <= 0) {
  189. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_GET_CERT_VERIFY_TBS_DATA,
  190. ERR_R_INTERNAL_ERROR);
  191. return 0;
  192. }
  193. *hdatalen = retlen;
  194. }
  195. return 1;
  196. }
  197. int tls_construct_cert_verify(SSL *s, WPACKET *pkt)
  198. {
  199. EVP_PKEY *pkey = NULL;
  200. const EVP_MD *md = NULL;
  201. EVP_MD_CTX *mctx = NULL;
  202. EVP_PKEY_CTX *pctx = NULL;
  203. size_t hdatalen = 0, siglen = 0;
  204. void *hdata;
  205. unsigned char *sig = NULL;
  206. unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];
  207. const SIGALG_LOOKUP *lu = s->s3->tmp.sigalg;
  208. if (lu == NULL || s->s3->tmp.cert == NULL) {
  209. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  210. ERR_R_INTERNAL_ERROR);
  211. goto err;
  212. }
  213. pkey = s->s3->tmp.cert->privatekey;
  214. if (pkey == NULL || !tls1_lookup_md(lu, &md)) {
  215. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  216. ERR_R_INTERNAL_ERROR);
  217. goto err;
  218. }
  219. mctx = EVP_MD_CTX_new();
  220. if (mctx == NULL) {
  221. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  222. ERR_R_MALLOC_FAILURE);
  223. goto err;
  224. }
  225. /* Get the data to be signed */
  226. if (!get_cert_verify_tbs_data(s, tls13tbs, &hdata, &hdatalen)) {
  227. /* SSLfatal() already called */
  228. goto err;
  229. }
  230. if (SSL_USE_SIGALGS(s) && !WPACKET_put_bytes_u16(pkt, lu->sigalg)) {
  231. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  232. ERR_R_INTERNAL_ERROR);
  233. goto err;
  234. }
  235. siglen = EVP_PKEY_size(pkey);
  236. sig = OPENSSL_malloc(siglen);
  237. if (sig == NULL) {
  238. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  239. ERR_R_MALLOC_FAILURE);
  240. goto err;
  241. }
  242. if (EVP_DigestSignInit(mctx, &pctx, md, NULL, pkey) <= 0) {
  243. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  244. ERR_R_EVP_LIB);
  245. goto err;
  246. }
  247. if (lu->sig == EVP_PKEY_RSA_PSS) {
  248. if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
  249. || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx,
  250. RSA_PSS_SALTLEN_DIGEST) <= 0) {
  251. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  252. ERR_R_EVP_LIB);
  253. goto err;
  254. }
  255. }
  256. if (s->version == SSL3_VERSION) {
  257. if (EVP_DigestSignUpdate(mctx, hdata, hdatalen) <= 0
  258. || !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
  259. (int)s->session->master_key_length,
  260. s->session->master_key)
  261. || EVP_DigestSignFinal(mctx, sig, &siglen) <= 0) {
  262. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  263. ERR_R_EVP_LIB);
  264. goto err;
  265. }
  266. } else if (EVP_DigestSign(mctx, sig, &siglen, hdata, hdatalen) <= 0) {
  267. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  268. ERR_R_EVP_LIB);
  269. goto err;
  270. }
  271. #ifndef OPENSSL_NO_GOST
  272. {
  273. int pktype = lu->sig;
  274. if (pktype == NID_id_GostR3410_2001
  275. || pktype == NID_id_GostR3410_2012_256
  276. || pktype == NID_id_GostR3410_2012_512)
  277. BUF_reverse(sig, NULL, siglen);
  278. }
  279. #endif
  280. if (!WPACKET_sub_memcpy_u16(pkt, sig, siglen)) {
  281. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_VERIFY,
  282. ERR_R_INTERNAL_ERROR);
  283. goto err;
  284. }
  285. /* Digest cached records and discard handshake buffer */
  286. if (!ssl3_digest_cached_records(s, 0)) {
  287. /* SSLfatal() already called */
  288. goto err;
  289. }
  290. OPENSSL_free(sig);
  291. EVP_MD_CTX_free(mctx);
  292. return 1;
  293. err:
  294. OPENSSL_free(sig);
  295. EVP_MD_CTX_free(mctx);
  296. return 0;
  297. }
  298. MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
  299. {
  300. EVP_PKEY *pkey = NULL;
  301. const unsigned char *data;
  302. #ifndef OPENSSL_NO_GOST
  303. unsigned char *gost_data = NULL;
  304. #endif
  305. MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR;
  306. int j;
  307. unsigned int len;
  308. X509 *peer;
  309. const EVP_MD *md = NULL;
  310. size_t hdatalen = 0;
  311. void *hdata;
  312. unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];
  313. EVP_MD_CTX *mctx = EVP_MD_CTX_new();
  314. EVP_PKEY_CTX *pctx = NULL;
  315. if (mctx == NULL) {
  316. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  317. ERR_R_MALLOC_FAILURE);
  318. goto err;
  319. }
  320. peer = s->session->peer;
  321. pkey = X509_get0_pubkey(peer);
  322. if (pkey == NULL) {
  323. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  324. ERR_R_INTERNAL_ERROR);
  325. goto err;
  326. }
  327. if (ssl_cert_lookup_by_pkey(pkey, NULL) == NULL) {
  328. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_CERT_VERIFY,
  329. SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
  330. goto err;
  331. }
  332. if (SSL_USE_SIGALGS(s)) {
  333. unsigned int sigalg;
  334. if (!PACKET_get_net_2(pkt, &sigalg)) {
  335. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  336. SSL_R_BAD_PACKET);
  337. goto err;
  338. }
  339. if (tls12_check_peer_sigalg(s, sigalg, pkey) <= 0) {
  340. /* SSLfatal() already called */
  341. goto err;
  342. }
  343. #ifdef SSL_DEBUG
  344. fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
  345. #endif
  346. } else if (!tls1_set_peer_legacy_sigalg(s, pkey)) {
  347. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  348. ERR_R_INTERNAL_ERROR);
  349. goto err;
  350. }
  351. if (!tls1_lookup_md(s->s3->tmp.peer_sigalg, &md)) {
  352. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  353. ERR_R_INTERNAL_ERROR);
  354. goto err;
  355. }
  356. /* Check for broken implementations of GOST ciphersuites */
  357. /*
  358. * If key is GOST and len is exactly 64 or 128, it is signature without
  359. * length field (CryptoPro implementations at least till TLS 1.2)
  360. */
  361. #ifndef OPENSSL_NO_GOST
  362. if (!SSL_USE_SIGALGS(s)
  363. && ((PACKET_remaining(pkt) == 64
  364. && (EVP_PKEY_id(pkey) == NID_id_GostR3410_2001
  365. || EVP_PKEY_id(pkey) == NID_id_GostR3410_2012_256))
  366. || (PACKET_remaining(pkt) == 128
  367. && EVP_PKEY_id(pkey) == NID_id_GostR3410_2012_512))) {
  368. len = PACKET_remaining(pkt);
  369. } else
  370. #endif
  371. if (!PACKET_get_net_2(pkt, &len)) {
  372. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  373. SSL_R_LENGTH_MISMATCH);
  374. goto err;
  375. }
  376. j = EVP_PKEY_size(pkey);
  377. if (((int)len > j) || ((int)PACKET_remaining(pkt) > j)
  378. || (PACKET_remaining(pkt) == 0)) {
  379. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  380. SSL_R_WRONG_SIGNATURE_SIZE);
  381. goto err;
  382. }
  383. if (!PACKET_get_bytes(pkt, &data, len)) {
  384. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  385. SSL_R_LENGTH_MISMATCH);
  386. goto err;
  387. }
  388. if (!get_cert_verify_tbs_data(s, tls13tbs, &hdata, &hdatalen)) {
  389. /* SSLfatal() already called */
  390. goto err;
  391. }
  392. #ifdef SSL_DEBUG
  393. fprintf(stderr, "Using client verify alg %s\n", EVP_MD_name(md));
  394. #endif
  395. if (EVP_DigestVerifyInit(mctx, &pctx, md, NULL, pkey) <= 0) {
  396. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  397. ERR_R_EVP_LIB);
  398. goto err;
  399. }
  400. #ifndef OPENSSL_NO_GOST
  401. {
  402. int pktype = EVP_PKEY_id(pkey);
  403. if (pktype == NID_id_GostR3410_2001
  404. || pktype == NID_id_GostR3410_2012_256
  405. || pktype == NID_id_GostR3410_2012_512) {
  406. if ((gost_data = OPENSSL_malloc(len)) == NULL) {
  407. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  408. SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
  409. goto err;
  410. }
  411. BUF_reverse(gost_data, data, len);
  412. data = gost_data;
  413. }
  414. }
  415. #endif
  416. if (SSL_USE_PSS(s)) {
  417. if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
  418. || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx,
  419. RSA_PSS_SALTLEN_DIGEST) <= 0) {
  420. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  421. ERR_R_EVP_LIB);
  422. goto err;
  423. }
  424. }
  425. if (s->version == SSL3_VERSION) {
  426. if (EVP_DigestVerifyUpdate(mctx, hdata, hdatalen) <= 0
  427. || !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
  428. (int)s->session->master_key_length,
  429. s->session->master_key)) {
  430. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  431. ERR_R_EVP_LIB);
  432. goto err;
  433. }
  434. if (EVP_DigestVerifyFinal(mctx, data, len) <= 0) {
  435. SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  436. SSL_R_BAD_SIGNATURE);
  437. goto err;
  438. }
  439. } else {
  440. j = EVP_DigestVerify(mctx, data, len, hdata, hdatalen);
  441. if (j <= 0) {
  442. SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CERT_VERIFY,
  443. SSL_R_BAD_SIGNATURE);
  444. goto err;
  445. }
  446. }
  447. ret = MSG_PROCESS_CONTINUE_READING;
  448. err:
  449. BIO_free(s->s3->handshake_buffer);
  450. s->s3->handshake_buffer = NULL;
  451. EVP_MD_CTX_free(mctx);
  452. #ifndef OPENSSL_NO_GOST
  453. OPENSSL_free(gost_data);
  454. #endif
  455. return ret;
  456. }
  457. int tls_construct_finished(SSL *s, WPACKET *pkt)
  458. {
  459. size_t finish_md_len;
  460. const char *sender;
  461. size_t slen;
  462. /* This is a real handshake so make sure we clean it up at the end */
  463. if (!s->server && s->post_handshake_auth != SSL_PHA_REQUESTED)
  464. s->statem.cleanuphand = 1;
  465. /*
  466. * We only change the keys if we didn't already do this when we sent the
  467. * client certificate
  468. */
  469. if (SSL_IS_TLS13(s)
  470. && !s->server
  471. && s->s3->tmp.cert_req == 0
  472. && (!s->method->ssl3_enc->change_cipher_state(s,
  473. SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) {;
  474. /* SSLfatal() already called */
  475. return 0;
  476. }
  477. if (s->server) {
  478. sender = s->method->ssl3_enc->server_finished_label;
  479. slen = s->method->ssl3_enc->server_finished_label_len;
  480. } else {
  481. sender = s->method->ssl3_enc->client_finished_label;
  482. slen = s->method->ssl3_enc->client_finished_label_len;
  483. }
  484. finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
  485. sender, slen,
  486. s->s3->tmp.finish_md);
  487. if (finish_md_len == 0) {
  488. /* SSLfatal() already called */
  489. return 0;
  490. }
  491. s->s3->tmp.finish_md_len = finish_md_len;
  492. if (!WPACKET_memcpy(pkt, s->s3->tmp.finish_md, finish_md_len)) {
  493. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_FINISHED,
  494. ERR_R_INTERNAL_ERROR);
  495. return 0;
  496. }
  497. /*
  498. * Log the master secret, if logging is enabled. We don't log it for
  499. * TLSv1.3: there's a different key schedule for that.
  500. */
  501. if (!SSL_IS_TLS13(s) && !ssl_log_secret(s, MASTER_SECRET_LABEL,
  502. s->session->master_key,
  503. s->session->master_key_length)) {
  504. /* SSLfatal() already called */
  505. return 0;
  506. }
  507. /*
  508. * Copy the finished so we can use it for renegotiation checks
  509. */
  510. if (!ossl_assert(finish_md_len <= EVP_MAX_MD_SIZE)) {
  511. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_FINISHED,
  512. ERR_R_INTERNAL_ERROR);
  513. return 0;
  514. }
  515. if (!s->server) {
  516. memcpy(s->s3->previous_client_finished, s->s3->tmp.finish_md,
  517. finish_md_len);
  518. s->s3->previous_client_finished_len = finish_md_len;
  519. } else {
  520. memcpy(s->s3->previous_server_finished, s->s3->tmp.finish_md,
  521. finish_md_len);
  522. s->s3->previous_server_finished_len = finish_md_len;
  523. }
  524. return 1;
  525. }
  526. int tls_construct_key_update(SSL *s, WPACKET *pkt)
  527. {
  528. if (!WPACKET_put_bytes_u8(pkt, s->key_update)) {
  529. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_KEY_UPDATE,
  530. ERR_R_INTERNAL_ERROR);
  531. return 0;
  532. }
  533. s->key_update = SSL_KEY_UPDATE_NONE;
  534. return 1;
  535. }
  536. MSG_PROCESS_RETURN tls_process_key_update(SSL *s, PACKET *pkt)
  537. {
  538. unsigned int updatetype;
  539. s->key_update_count++;
  540. if (s->key_update_count > MAX_KEY_UPDATE_MESSAGES) {
  541. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_KEY_UPDATE,
  542. SSL_R_TOO_MANY_KEY_UPDATES);
  543. return MSG_PROCESS_ERROR;
  544. }
  545. /*
  546. * A KeyUpdate message signals a key change so the end of the message must
  547. * be on a record boundary.
  548. */
  549. if (RECORD_LAYER_processed_read_pending(&s->rlayer)) {
  550. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_KEY_UPDATE,
  551. SSL_R_NOT_ON_RECORD_BOUNDARY);
  552. return MSG_PROCESS_ERROR;
  553. }
  554. if (!PACKET_get_1(pkt, &updatetype)
  555. || PACKET_remaining(pkt) != 0) {
  556. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_UPDATE,
  557. SSL_R_BAD_KEY_UPDATE);
  558. return MSG_PROCESS_ERROR;
  559. }
  560. /*
  561. * There are only two defined key update types. Fail if we get a value we
  562. * didn't recognise.
  563. */
  564. if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
  565. && updatetype != SSL_KEY_UPDATE_REQUESTED) {
  566. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_KEY_UPDATE,
  567. SSL_R_BAD_KEY_UPDATE);
  568. return MSG_PROCESS_ERROR;
  569. }
  570. /*
  571. * If we get a request for us to update our sending keys too then, we need
  572. * to additionally send a KeyUpdate message. However that message should
  573. * not also request an update (otherwise we get into an infinite loop).
  574. */
  575. if (updatetype == SSL_KEY_UPDATE_REQUESTED)
  576. s->key_update = SSL_KEY_UPDATE_NOT_REQUESTED;
  577. if (!tls13_update_key(s, 0)) {
  578. /* SSLfatal() already called */
  579. return MSG_PROCESS_ERROR;
  580. }
  581. return MSG_PROCESS_FINISHED_READING;
  582. }
  583. /*
  584. * ssl3_take_mac calculates the Finished MAC for the handshakes messages seen
  585. * to far.
  586. */
  587. int ssl3_take_mac(SSL *s)
  588. {
  589. const char *sender;
  590. size_t slen;
  591. if (!s->server) {
  592. sender = s->method->ssl3_enc->server_finished_label;
  593. slen = s->method->ssl3_enc->server_finished_label_len;
  594. } else {
  595. sender = s->method->ssl3_enc->client_finished_label;
  596. slen = s->method->ssl3_enc->client_finished_label_len;
  597. }
  598. s->s3->tmp.peer_finish_md_len =
  599. s->method->ssl3_enc->final_finish_mac(s, sender, slen,
  600. s->s3->tmp.peer_finish_md);
  601. if (s->s3->tmp.peer_finish_md_len == 0) {
  602. /* SSLfatal() already called */
  603. return 0;
  604. }
  605. return 1;
  606. }
  607. MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL *s, PACKET *pkt)
  608. {
  609. size_t remain;
  610. remain = PACKET_remaining(pkt);
  611. /*
  612. * 'Change Cipher Spec' is just a single byte, which should already have
  613. * been consumed by ssl_get_message() so there should be no bytes left,
  614. * unless we're using DTLS1_BAD_VER, which has an extra 2 bytes
  615. */
  616. if (SSL_IS_DTLS(s)) {
  617. if ((s->version == DTLS1_BAD_VER
  618. && remain != DTLS1_CCS_HEADER_LENGTH + 1)
  619. || (s->version != DTLS1_BAD_VER
  620. && remain != DTLS1_CCS_HEADER_LENGTH - 1)) {
  621. SSLfatal(s, SSL_AD_DECODE_ERROR,
  622. SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
  623. SSL_R_BAD_CHANGE_CIPHER_SPEC);
  624. return MSG_PROCESS_ERROR;
  625. }
  626. } else {
  627. if (remain != 0) {
  628. SSLfatal(s, SSL_AD_DECODE_ERROR,
  629. SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
  630. SSL_R_BAD_CHANGE_CIPHER_SPEC);
  631. return MSG_PROCESS_ERROR;
  632. }
  633. }
  634. /* Check we have a cipher to change to */
  635. if (s->s3->tmp.new_cipher == NULL) {
  636. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
  637. SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC, SSL_R_CCS_RECEIVED_EARLY);
  638. return MSG_PROCESS_ERROR;
  639. }
  640. s->s3->change_cipher_spec = 1;
  641. if (!ssl3_do_change_cipher_spec(s)) {
  642. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
  643. ERR_R_INTERNAL_ERROR);
  644. return MSG_PROCESS_ERROR;
  645. }
  646. if (SSL_IS_DTLS(s)) {
  647. dtls1_reset_seq_numbers(s, SSL3_CC_READ);
  648. if (s->version == DTLS1_BAD_VER)
  649. s->d1->handshake_read_seq++;
  650. #ifndef OPENSSL_NO_SCTP
  651. /*
  652. * Remember that a CCS has been received, so that an old key of
  653. * SCTP-Auth can be deleted when a CCS is sent. Will be ignored if no
  654. * SCTP is used
  655. */
  656. BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD, 1, NULL);
  657. #endif
  658. }
  659. return MSG_PROCESS_CONTINUE_READING;
  660. }
  661. MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt)
  662. {
  663. size_t md_len;
  664. /* This is a real handshake so make sure we clean it up at the end */
  665. if (s->server) {
  666. if (s->post_handshake_auth != SSL_PHA_REQUESTED)
  667. s->statem.cleanuphand = 1;
  668. if (SSL_IS_TLS13(s) && !tls13_save_handshake_digest_for_pha(s)) {
  669. /* SSLfatal() already called */
  670. return MSG_PROCESS_ERROR;
  671. }
  672. }
  673. /*
  674. * In TLSv1.3 a Finished message signals a key change so the end of the
  675. * message must be on a record boundary.
  676. */
  677. if (SSL_IS_TLS13(s) && RECORD_LAYER_processed_read_pending(&s->rlayer)) {
  678. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_FINISHED,
  679. SSL_R_NOT_ON_RECORD_BOUNDARY);
  680. return MSG_PROCESS_ERROR;
  681. }
  682. /* If this occurs, we have missed a message */
  683. if (!SSL_IS_TLS13(s) && !s->s3->change_cipher_spec) {
  684. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_FINISHED,
  685. SSL_R_GOT_A_FIN_BEFORE_A_CCS);
  686. return MSG_PROCESS_ERROR;
  687. }
  688. s->s3->change_cipher_spec = 0;
  689. md_len = s->s3->tmp.peer_finish_md_len;
  690. if (md_len != PACKET_remaining(pkt)) {
  691. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_FINISHED,
  692. SSL_R_BAD_DIGEST_LENGTH);
  693. return MSG_PROCESS_ERROR;
  694. }
  695. if (CRYPTO_memcmp(PACKET_data(pkt), s->s3->tmp.peer_finish_md,
  696. md_len) != 0) {
  697. SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_FINISHED,
  698. SSL_R_DIGEST_CHECK_FAILED);
  699. return MSG_PROCESS_ERROR;
  700. }
  701. /*
  702. * Copy the finished so we can use it for renegotiation checks
  703. */
  704. if (!ossl_assert(md_len <= EVP_MAX_MD_SIZE)) {
  705. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_FINISHED,
  706. ERR_R_INTERNAL_ERROR);
  707. return MSG_PROCESS_ERROR;
  708. }
  709. if (s->server) {
  710. memcpy(s->s3->previous_client_finished, s->s3->tmp.peer_finish_md,
  711. md_len);
  712. s->s3->previous_client_finished_len = md_len;
  713. } else {
  714. memcpy(s->s3->previous_server_finished, s->s3->tmp.peer_finish_md,
  715. md_len);
  716. s->s3->previous_server_finished_len = md_len;
  717. }
  718. /*
  719. * In TLS1.3 we also have to change cipher state and do any final processing
  720. * of the initial server flight (if we are a client)
  721. */
  722. if (SSL_IS_TLS13(s)) {
  723. if (s->server) {
  724. if (s->post_handshake_auth != SSL_PHA_REQUESTED &&
  725. !s->method->ssl3_enc->change_cipher_state(s,
  726. SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_SERVER_READ)) {
  727. /* SSLfatal() already called */
  728. return MSG_PROCESS_ERROR;
  729. }
  730. } else {
  731. if (!s->method->ssl3_enc->generate_master_secret(s,
  732. s->master_secret, s->handshake_secret, 0,
  733. &s->session->master_key_length)) {
  734. /* SSLfatal() already called */
  735. return MSG_PROCESS_ERROR;
  736. }
  737. if (!s->method->ssl3_enc->change_cipher_state(s,
  738. SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_READ)) {
  739. /* SSLfatal() already called */
  740. return MSG_PROCESS_ERROR;
  741. }
  742. if (!tls_process_initial_server_flight(s)) {
  743. /* SSLfatal() already called */
  744. return MSG_PROCESS_ERROR;
  745. }
  746. }
  747. }
  748. return MSG_PROCESS_FINISHED_READING;
  749. }
  750. int tls_construct_change_cipher_spec(SSL *s, WPACKET *pkt)
  751. {
  752. if (!WPACKET_put_bytes_u8(pkt, SSL3_MT_CCS)) {
  753. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  754. SSL_F_TLS_CONSTRUCT_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
  755. return 0;
  756. }
  757. return 1;
  758. }
  759. /* Add a certificate to the WPACKET */
  760. static int ssl_add_cert_to_wpacket(SSL *s, WPACKET *pkt, X509 *x, int chain)
  761. {
  762. int len;
  763. unsigned char *outbytes;
  764. len = i2d_X509(x, NULL);
  765. if (len < 0) {
  766. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_TO_WPACKET,
  767. ERR_R_BUF_LIB);
  768. return 0;
  769. }
  770. if (!WPACKET_sub_allocate_bytes_u24(pkt, len, &outbytes)
  771. || i2d_X509(x, &outbytes) != len) {
  772. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_TO_WPACKET,
  773. ERR_R_INTERNAL_ERROR);
  774. return 0;
  775. }
  776. if (SSL_IS_TLS13(s)
  777. && !tls_construct_extensions(s, pkt, SSL_EXT_TLS1_3_CERTIFICATE, x,
  778. chain)) {
  779. /* SSLfatal() already called */
  780. return 0;
  781. }
  782. return 1;
  783. }
  784. /* Add certificate chain to provided WPACKET */
  785. static int ssl_add_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
  786. {
  787. int i, chain_count;
  788. X509 *x;
  789. STACK_OF(X509) *extra_certs;
  790. STACK_OF(X509) *chain = NULL;
  791. X509_STORE *chain_store;
  792. if (cpk == NULL || cpk->x509 == NULL)
  793. return 1;
  794. x = cpk->x509;
  795. /*
  796. * If we have a certificate specific chain use it, else use parent ctx.
  797. */
  798. if (cpk->chain != NULL)
  799. extra_certs = cpk->chain;
  800. else
  801. extra_certs = s->ctx->extra_certs;
  802. if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || extra_certs)
  803. chain_store = NULL;
  804. else if (s->cert->chain_store)
  805. chain_store = s->cert->chain_store;
  806. else
  807. chain_store = s->ctx->cert_store;
  808. if (chain_store != NULL) {
  809. X509_STORE_CTX *xs_ctx = X509_STORE_CTX_new();
  810. if (xs_ctx == NULL) {
  811. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_CHAIN,
  812. ERR_R_MALLOC_FAILURE);
  813. return 0;
  814. }
  815. if (!X509_STORE_CTX_init(xs_ctx, chain_store, x, NULL)) {
  816. X509_STORE_CTX_free(xs_ctx);
  817. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_CHAIN,
  818. ERR_R_X509_LIB);
  819. return 0;
  820. }
  821. /*
  822. * It is valid for the chain not to be complete (because normally we
  823. * don't include the root cert in the chain). Therefore we deliberately
  824. * ignore the error return from this call. We're not actually verifying
  825. * the cert - we're just building as much of the chain as we can
  826. */
  827. (void)X509_verify_cert(xs_ctx);
  828. /* Don't leave errors in the queue */
  829. ERR_clear_error();
  830. chain = X509_STORE_CTX_get0_chain(xs_ctx);
  831. i = ssl_security_cert_chain(s, chain, NULL, 0);
  832. if (i != 1) {
  833. #if 0
  834. /* Dummy error calls so mkerr generates them */
  835. SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_EE_KEY_TOO_SMALL);
  836. SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_CA_KEY_TOO_SMALL);
  837. SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_CA_MD_TOO_WEAK);
  838. #endif
  839. X509_STORE_CTX_free(xs_ctx);
  840. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_CHAIN, i);
  841. return 0;
  842. }
  843. chain_count = sk_X509_num(chain);
  844. for (i = 0; i < chain_count; i++) {
  845. x = sk_X509_value(chain, i);
  846. if (!ssl_add_cert_to_wpacket(s, pkt, x, i)) {
  847. /* SSLfatal() already called */
  848. X509_STORE_CTX_free(xs_ctx);
  849. return 0;
  850. }
  851. }
  852. X509_STORE_CTX_free(xs_ctx);
  853. } else {
  854. i = ssl_security_cert_chain(s, extra_certs, x, 0);
  855. if (i != 1) {
  856. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_ADD_CERT_CHAIN, i);
  857. return 0;
  858. }
  859. if (!ssl_add_cert_to_wpacket(s, pkt, x, 0)) {
  860. /* SSLfatal() already called */
  861. return 0;
  862. }
  863. for (i = 0; i < sk_X509_num(extra_certs); i++) {
  864. x = sk_X509_value(extra_certs, i);
  865. if (!ssl_add_cert_to_wpacket(s, pkt, x, i + 1)) {
  866. /* SSLfatal() already called */
  867. return 0;
  868. }
  869. }
  870. }
  871. return 1;
  872. }
  873. unsigned long ssl3_output_cert_chain(SSL *s, WPACKET *pkt, CERT_PKEY *cpk)
  874. {
  875. if (!WPACKET_start_sub_packet_u24(pkt)) {
  876. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_OUTPUT_CERT_CHAIN,
  877. ERR_R_INTERNAL_ERROR);
  878. return 0;
  879. }
  880. if (!ssl_add_cert_chain(s, pkt, cpk))
  881. return 0;
  882. if (!WPACKET_close(pkt)) {
  883. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_OUTPUT_CERT_CHAIN,
  884. ERR_R_INTERNAL_ERROR);
  885. return 0;
  886. }
  887. return 1;
  888. }
  889. /*
  890. * Tidy up after the end of a handshake. In the case of SCTP this may result
  891. * in NBIO events. If |clearbufs| is set then init_buf and the wbio buffer is
  892. * freed up as well.
  893. */
  894. WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst, int clearbufs, int stop)
  895. {
  896. int discard;
  897. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  898. if (clearbufs) {
  899. if (!SSL_IS_DTLS(s)) {
  900. /*
  901. * We don't do this in DTLS because we may still need the init_buf
  902. * in case there are any unexpected retransmits
  903. */
  904. BUF_MEM_free(s->init_buf);
  905. s->init_buf = NULL;
  906. }
  907. if (!ssl_free_wbio_buffer(s)) {
  908. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_FINISH_HANDSHAKE,
  909. ERR_R_INTERNAL_ERROR);
  910. return WORK_ERROR;
  911. }
  912. s->init_num = 0;
  913. }
  914. if (SSL_IS_TLS13(s) && !s->server
  915. && s->post_handshake_auth == SSL_PHA_REQUESTED)
  916. s->post_handshake_auth = SSL_PHA_EXT_SENT;
  917. /*
  918. * Only set if there was a Finished message and this isn't after a TLSv1.3
  919. * post handshake exchange
  920. */
  921. if (s->statem.cleanuphand) {
  922. /* skipped if we just sent a HelloRequest */
  923. s->renegotiate = 0;
  924. s->new_session = 0;
  925. s->statem.cleanuphand = 0;
  926. ssl3_cleanup_key_block(s);
  927. if (s->server) {
  928. /*
  929. * In TLSv1.3 we update the cache as part of constructing the
  930. * NewSessionTicket
  931. */
  932. if (!SSL_IS_TLS13(s))
  933. ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
  934. /* N.B. s->ctx may not equal s->session_ctx */
  935. CRYPTO_atomic_add(&s->ctx->stats.sess_accept_good, 1, &discard,
  936. s->ctx->lock);
  937. s->handshake_func = ossl_statem_accept;
  938. } else {
  939. /*
  940. * In TLSv1.3 we update the cache as part of processing the
  941. * NewSessionTicket
  942. */
  943. if (!SSL_IS_TLS13(s))
  944. ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
  945. if (s->hit)
  946. CRYPTO_atomic_add(&s->session_ctx->stats.sess_hit, 1, &discard,
  947. s->session_ctx->lock);
  948. s->handshake_func = ossl_statem_connect;
  949. CRYPTO_atomic_add(&s->session_ctx->stats.sess_connect_good, 1,
  950. &discard, s->session_ctx->lock);
  951. }
  952. if (SSL_IS_DTLS(s)) {
  953. /* done with handshaking */
  954. s->d1->handshake_read_seq = 0;
  955. s->d1->handshake_write_seq = 0;
  956. s->d1->next_handshake_write_seq = 0;
  957. dtls1_clear_received_buffer(s);
  958. }
  959. }
  960. if (s->info_callback != NULL)
  961. cb = s->info_callback;
  962. else if (s->ctx->info_callback != NULL)
  963. cb = s->ctx->info_callback;
  964. /* The callback may expect us to not be in init at handshake done */
  965. ossl_statem_set_in_init(s, 0);
  966. if (cb != NULL)
  967. cb(s, SSL_CB_HANDSHAKE_DONE, 1);
  968. if (!stop) {
  969. /* If we've got more work to do we go back into init */
  970. ossl_statem_set_in_init(s, 1);
  971. return WORK_FINISHED_CONTINUE;
  972. }
  973. return WORK_FINISHED_STOP;
  974. }
  975. int tls_get_message_header(SSL *s, int *mt)
  976. {
  977. /* s->init_num < SSL3_HM_HEADER_LENGTH */
  978. int skip_message, i, recvd_type;
  979. unsigned char *p;
  980. size_t l, readbytes;
  981. p = (unsigned char *)s->init_buf->data;
  982. do {
  983. while (s->init_num < SSL3_HM_HEADER_LENGTH) {
  984. i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &recvd_type,
  985. &p[s->init_num],
  986. SSL3_HM_HEADER_LENGTH - s->init_num,
  987. 0, &readbytes);
  988. if (i <= 0) {
  989. s->rwstate = SSL_READING;
  990. return 0;
  991. }
  992. if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
  993. /*
  994. * A ChangeCipherSpec must be a single byte and may not occur
  995. * in the middle of a handshake message.
  996. */
  997. if (s->init_num != 0 || readbytes != 1 || p[0] != SSL3_MT_CCS) {
  998. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
  999. SSL_F_TLS_GET_MESSAGE_HEADER,
  1000. SSL_R_BAD_CHANGE_CIPHER_SPEC);
  1001. return 0;
  1002. }
  1003. if (s->statem.hand_state == TLS_ST_BEFORE
  1004. && (s->s3->flags & TLS1_FLAGS_STATELESS) != 0) {
  1005. /*
  1006. * We are stateless and we received a CCS. Probably this is
  1007. * from a client between the first and second ClientHellos.
  1008. * We should ignore this, but return an error because we do
  1009. * not return success until we see the second ClientHello
  1010. * with a valid cookie.
  1011. */
  1012. return 0;
  1013. }
  1014. s->s3->tmp.message_type = *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
  1015. s->init_num = readbytes - 1;
  1016. s->init_msg = s->init_buf->data;
  1017. s->s3->tmp.message_size = readbytes;
  1018. return 1;
  1019. } else if (recvd_type != SSL3_RT_HANDSHAKE) {
  1020. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
  1021. SSL_F_TLS_GET_MESSAGE_HEADER,
  1022. SSL_R_CCS_RECEIVED_EARLY);
  1023. return 0;
  1024. }
  1025. s->init_num += readbytes;
  1026. }
  1027. skip_message = 0;
  1028. if (!s->server)
  1029. if (s->statem.hand_state != TLS_ST_OK
  1030. && p[0] == SSL3_MT_HELLO_REQUEST)
  1031. /*
  1032. * The server may always send 'Hello Request' messages --
  1033. * we are doing a handshake anyway now, so ignore them if
  1034. * their format is correct. Does not count for 'Finished'
  1035. * MAC.
  1036. */
  1037. if (p[1] == 0 && p[2] == 0 && p[3] == 0) {
  1038. s->init_num = 0;
  1039. skip_message = 1;
  1040. if (s->msg_callback)
  1041. s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
  1042. p, SSL3_HM_HEADER_LENGTH, s,
  1043. s->msg_callback_arg);
  1044. }
  1045. } while (skip_message);
  1046. /* s->init_num == SSL3_HM_HEADER_LENGTH */
  1047. *mt = *p;
  1048. s->s3->tmp.message_type = *(p++);
  1049. if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
  1050. /*
  1051. * Only happens with SSLv3+ in an SSLv2 backward compatible
  1052. * ClientHello
  1053. *
  1054. * Total message size is the remaining record bytes to read
  1055. * plus the SSL3_HM_HEADER_LENGTH bytes that we already read
  1056. */
  1057. l = RECORD_LAYER_get_rrec_length(&s->rlayer)
  1058. + SSL3_HM_HEADER_LENGTH;
  1059. s->s3->tmp.message_size = l;
  1060. s->init_msg = s->init_buf->data;
  1061. s->init_num = SSL3_HM_HEADER_LENGTH;
  1062. } else {
  1063. n2l3(p, l);
  1064. /* BUF_MEM_grow takes an 'int' parameter */
  1065. if (l > (INT_MAX - SSL3_HM_HEADER_LENGTH)) {
  1066. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_GET_MESSAGE_HEADER,
  1067. SSL_R_EXCESSIVE_MESSAGE_SIZE);
  1068. return 0;
  1069. }
  1070. s->s3->tmp.message_size = l;
  1071. s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;
  1072. s->init_num = 0;
  1073. }
  1074. return 1;
  1075. }
  1076. int tls_get_message_body(SSL *s, size_t *len)
  1077. {
  1078. size_t n, readbytes;
  1079. unsigned char *p;
  1080. int i;
  1081. if (s->s3->tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {
  1082. /* We've already read everything in */
  1083. *len = (unsigned long)s->init_num;
  1084. return 1;
  1085. }
  1086. p = s->init_msg;
  1087. n = s->s3->tmp.message_size - s->init_num;
  1088. while (n > 0) {
  1089. i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,
  1090. &p[s->init_num], n, 0, &readbytes);
  1091. if (i <= 0) {
  1092. s->rwstate = SSL_READING;
  1093. *len = 0;
  1094. return 0;
  1095. }
  1096. s->init_num += readbytes;
  1097. n -= readbytes;
  1098. }
  1099. /*
  1100. * If receiving Finished, record MAC of prior handshake messages for
  1101. * Finished verification.
  1102. */
  1103. if (*(s->init_buf->data) == SSL3_MT_FINISHED && !ssl3_take_mac(s)) {
  1104. /* SSLfatal() already called */
  1105. *len = 0;
  1106. return 0;
  1107. }
  1108. /* Feed this message into MAC computation. */
  1109. if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
  1110. if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
  1111. s->init_num)) {
  1112. /* SSLfatal() already called */
  1113. *len = 0;
  1114. return 0;
  1115. }
  1116. if (s->msg_callback)
  1117. s->msg_callback(0, SSL2_VERSION, 0, s->init_buf->data,
  1118. (size_t)s->init_num, s, s->msg_callback_arg);
  1119. } else {
  1120. /*
  1121. * We defer feeding in the HRR until later. We'll do it as part of
  1122. * processing the message
  1123. * The TLsv1.3 handshake transcript stops at the ClientFinished
  1124. * message.
  1125. */
  1126. #define SERVER_HELLO_RANDOM_OFFSET (SSL3_HM_HEADER_LENGTH + 2)
  1127. /* KeyUpdate and NewSessionTicket do not need to be added */
  1128. if (!SSL_IS_TLS13(s) || (s->s3->tmp.message_type != SSL3_MT_NEWSESSION_TICKET
  1129. && s->s3->tmp.message_type != SSL3_MT_KEY_UPDATE)) {
  1130. if (s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO
  1131. || s->init_num < SERVER_HELLO_RANDOM_OFFSET + SSL3_RANDOM_SIZE
  1132. || memcmp(hrrrandom,
  1133. s->init_buf->data + SERVER_HELLO_RANDOM_OFFSET,
  1134. SSL3_RANDOM_SIZE) != 0) {
  1135. if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
  1136. s->init_num + SSL3_HM_HEADER_LENGTH)) {
  1137. /* SSLfatal() already called */
  1138. *len = 0;
  1139. return 0;
  1140. }
  1141. }
  1142. }
  1143. if (s->msg_callback)
  1144. s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,
  1145. (size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,
  1146. s->msg_callback_arg);
  1147. }
  1148. *len = s->init_num;
  1149. return 1;
  1150. }
  1151. static const X509ERR2ALERT x509table[] = {
  1152. {X509_V_ERR_APPLICATION_VERIFICATION, SSL_AD_HANDSHAKE_FAILURE},
  1153. {X509_V_ERR_CA_KEY_TOO_SMALL, SSL_AD_BAD_CERTIFICATE},
  1154. {X509_V_ERR_CA_MD_TOO_WEAK, SSL_AD_BAD_CERTIFICATE},
  1155. {X509_V_ERR_CERT_CHAIN_TOO_LONG, SSL_AD_UNKNOWN_CA},
  1156. {X509_V_ERR_CERT_HAS_EXPIRED, SSL_AD_CERTIFICATE_EXPIRED},
  1157. {X509_V_ERR_CERT_NOT_YET_VALID, SSL_AD_BAD_CERTIFICATE},
  1158. {X509_V_ERR_CERT_REJECTED, SSL_AD_BAD_CERTIFICATE},
  1159. {X509_V_ERR_CERT_REVOKED, SSL_AD_CERTIFICATE_REVOKED},
  1160. {X509_V_ERR_CERT_SIGNATURE_FAILURE, SSL_AD_DECRYPT_ERROR},
  1161. {X509_V_ERR_CERT_UNTRUSTED, SSL_AD_BAD_CERTIFICATE},
  1162. {X509_V_ERR_CRL_HAS_EXPIRED, SSL_AD_CERTIFICATE_EXPIRED},
  1163. {X509_V_ERR_CRL_NOT_YET_VALID, SSL_AD_BAD_CERTIFICATE},
  1164. {X509_V_ERR_CRL_SIGNATURE_FAILURE, SSL_AD_DECRYPT_ERROR},
  1165. {X509_V_ERR_DANE_NO_MATCH, SSL_AD_BAD_CERTIFICATE},
  1166. {X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT, SSL_AD_UNKNOWN_CA},
  1167. {X509_V_ERR_EE_KEY_TOO_SMALL, SSL_AD_BAD_CERTIFICATE},
  1168. {X509_V_ERR_EMAIL_MISMATCH, SSL_AD_BAD_CERTIFICATE},
  1169. {X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD, SSL_AD_BAD_CERTIFICATE},
  1170. {X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD, SSL_AD_BAD_CERTIFICATE},
  1171. {X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD, SSL_AD_BAD_CERTIFICATE},
  1172. {X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD, SSL_AD_BAD_CERTIFICATE},
  1173. {X509_V_ERR_HOSTNAME_MISMATCH, SSL_AD_BAD_CERTIFICATE},
  1174. {X509_V_ERR_INVALID_CA, SSL_AD_UNKNOWN_CA},
  1175. {X509_V_ERR_INVALID_CALL, SSL_AD_INTERNAL_ERROR},
  1176. {X509_V_ERR_INVALID_PURPOSE, SSL_AD_UNSUPPORTED_CERTIFICATE},
  1177. {X509_V_ERR_IP_ADDRESS_MISMATCH, SSL_AD_BAD_CERTIFICATE},
  1178. {X509_V_ERR_OUT_OF_MEM, SSL_AD_INTERNAL_ERROR},
  1179. {X509_V_ERR_PATH_LENGTH_EXCEEDED, SSL_AD_UNKNOWN_CA},
  1180. {X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN, SSL_AD_UNKNOWN_CA},
  1181. {X509_V_ERR_STORE_LOOKUP, SSL_AD_INTERNAL_ERROR},
  1182. {X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY, SSL_AD_BAD_CERTIFICATE},
  1183. {X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE, SSL_AD_BAD_CERTIFICATE},
  1184. {X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE, SSL_AD_BAD_CERTIFICATE},
  1185. {X509_V_ERR_UNABLE_TO_GET_CRL, SSL_AD_UNKNOWN_CA},
  1186. {X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER, SSL_AD_UNKNOWN_CA},
  1187. {X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT, SSL_AD_UNKNOWN_CA},
  1188. {X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, SSL_AD_UNKNOWN_CA},
  1189. {X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE, SSL_AD_UNKNOWN_CA},
  1190. {X509_V_ERR_UNSPECIFIED, SSL_AD_INTERNAL_ERROR},
  1191. /* Last entry; return this if we don't find the value above. */
  1192. {X509_V_OK, SSL_AD_CERTIFICATE_UNKNOWN}
  1193. };
  1194. int ssl_x509err2alert(int x509err)
  1195. {
  1196. const X509ERR2ALERT *tp;
  1197. for (tp = x509table; tp->x509err != X509_V_OK; ++tp)
  1198. if (tp->x509err == x509err)
  1199. break;
  1200. return tp->alert;
  1201. }
  1202. int ssl_allow_compression(SSL *s)
  1203. {
  1204. if (s->options & SSL_OP_NO_COMPRESSION)
  1205. return 0;
  1206. return ssl_security(s, SSL_SECOP_COMPRESSION, 0, 0, NULL);
  1207. }
  1208. static int version_cmp(const SSL *s, int a, int b)
  1209. {
  1210. int dtls = SSL_IS_DTLS(s);
  1211. if (a == b)
  1212. return 0;
  1213. if (!dtls)
  1214. return a < b ? -1 : 1;
  1215. return DTLS_VERSION_LT(a, b) ? -1 : 1;
  1216. }
  1217. typedef struct {
  1218. int version;
  1219. const SSL_METHOD *(*cmeth) (void);
  1220. const SSL_METHOD *(*smeth) (void);
  1221. } version_info;
  1222. #if TLS_MAX_VERSION != TLS1_3_VERSION
  1223. # error Code needs update for TLS_method() support beyond TLS1_3_VERSION.
  1224. #endif
  1225. /* Must be in order high to low */
  1226. static const version_info tls_version_table[] = {
  1227. #ifndef OPENSSL_NO_TLS1_3
  1228. {TLS1_3_VERSION, tlsv1_3_client_method, tlsv1_3_server_method},
  1229. #else
  1230. {TLS1_3_VERSION, NULL, NULL},
  1231. #endif
  1232. #ifndef OPENSSL_NO_TLS1_2
  1233. {TLS1_2_VERSION, tlsv1_2_client_method, tlsv1_2_server_method},
  1234. #else
  1235. {TLS1_2_VERSION, NULL, NULL},
  1236. #endif
  1237. #ifndef OPENSSL_NO_TLS1_1
  1238. {TLS1_1_VERSION, tlsv1_1_client_method, tlsv1_1_server_method},
  1239. #else
  1240. {TLS1_1_VERSION, NULL, NULL},
  1241. #endif
  1242. #ifndef OPENSSL_NO_TLS1
  1243. {TLS1_VERSION, tlsv1_client_method, tlsv1_server_method},
  1244. #else
  1245. {TLS1_VERSION, NULL, NULL},
  1246. #endif
  1247. #ifndef OPENSSL_NO_SSL3
  1248. {SSL3_VERSION, sslv3_client_method, sslv3_server_method},
  1249. #else
  1250. {SSL3_VERSION, NULL, NULL},
  1251. #endif
  1252. {0, NULL, NULL},
  1253. };
  1254. #if DTLS_MAX_VERSION != DTLS1_2_VERSION
  1255. # error Code needs update for DTLS_method() support beyond DTLS1_2_VERSION.
  1256. #endif
  1257. /* Must be in order high to low */
  1258. static const version_info dtls_version_table[] = {
  1259. #ifndef OPENSSL_NO_DTLS1_2
  1260. {DTLS1_2_VERSION, dtlsv1_2_client_method, dtlsv1_2_server_method},
  1261. #else
  1262. {DTLS1_2_VERSION, NULL, NULL},
  1263. #endif
  1264. #ifndef OPENSSL_NO_DTLS1
  1265. {DTLS1_VERSION, dtlsv1_client_method, dtlsv1_server_method},
  1266. {DTLS1_BAD_VER, dtls_bad_ver_client_method, NULL},
  1267. #else
  1268. {DTLS1_VERSION, NULL, NULL},
  1269. {DTLS1_BAD_VER, NULL, NULL},
  1270. #endif
  1271. {0, NULL, NULL},
  1272. };
  1273. /*
  1274. * ssl_method_error - Check whether an SSL_METHOD is enabled.
  1275. *
  1276. * @s: The SSL handle for the candidate method
  1277. * @method: the intended method.
  1278. *
  1279. * Returns 0 on success, or an SSL error reason on failure.
  1280. */
  1281. static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
  1282. {
  1283. int version = method->version;
  1284. if ((s->min_proto_version != 0 &&
  1285. version_cmp(s, version, s->min_proto_version) < 0) ||
  1286. ssl_security(s, SSL_SECOP_VERSION, 0, version, NULL) == 0)
  1287. return SSL_R_VERSION_TOO_LOW;
  1288. if (s->max_proto_version != 0 &&
  1289. version_cmp(s, version, s->max_proto_version) > 0)
  1290. return SSL_R_VERSION_TOO_HIGH;
  1291. if ((s->options & method->mask) != 0)
  1292. return SSL_R_UNSUPPORTED_PROTOCOL;
  1293. if ((method->flags & SSL_METHOD_NO_SUITEB) != 0 && tls1_suiteb(s))
  1294. return SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE;
  1295. return 0;
  1296. }
  1297. /*
  1298. * ssl_version_supported - Check that the specified `version` is supported by
  1299. * `SSL *` instance
  1300. *
  1301. * @s: The SSL handle for the candidate method
  1302. * @version: Protocol version to test against
  1303. *
  1304. * Returns 1 when supported, otherwise 0
  1305. */
  1306. int ssl_version_supported(const SSL *s, int version)
  1307. {
  1308. const version_info *vent;
  1309. const version_info *table;
  1310. switch (s->method->version) {
  1311. default:
  1312. /* Version should match method version for non-ANY method */
  1313. return version_cmp(s, version, s->version) == 0;
  1314. case TLS_ANY_VERSION:
  1315. table = tls_version_table;
  1316. break;
  1317. case DTLS_ANY_VERSION:
  1318. table = dtls_version_table;
  1319. break;
  1320. }
  1321. for (vent = table;
  1322. vent->version != 0 && version_cmp(s, version, vent->version) <= 0;
  1323. ++vent) {
  1324. if (vent->cmeth != NULL &&
  1325. version_cmp(s, version, vent->version) == 0 &&
  1326. ssl_method_error(s, vent->cmeth()) == 0) {
  1327. return 1;
  1328. }
  1329. }
  1330. return 0;
  1331. }
  1332. /*
  1333. * ssl_check_version_downgrade - In response to RFC7507 SCSV version
  1334. * fallback indication from a client check whether we're using the highest
  1335. * supported protocol version.
  1336. *
  1337. * @s server SSL handle.
  1338. *
  1339. * Returns 1 when using the highest enabled version, 0 otherwise.
  1340. */
  1341. int ssl_check_version_downgrade(SSL *s)
  1342. {
  1343. const version_info *vent;
  1344. const version_info *table;
  1345. /*
  1346. * Check that the current protocol is the highest enabled version
  1347. * (according to s->ctx->method, as version negotiation may have changed
  1348. * s->method).
  1349. */
  1350. if (s->version == s->ctx->method->version)
  1351. return 1;
  1352. /*
  1353. * Apparently we're using a version-flexible SSL_METHOD (not at its
  1354. * highest protocol version).
  1355. */
  1356. if (s->ctx->method->version == TLS_method()->version)
  1357. table = tls_version_table;
  1358. else if (s->ctx->method->version == DTLS_method()->version)
  1359. table = dtls_version_table;
  1360. else {
  1361. /* Unexpected state; fail closed. */
  1362. return 0;
  1363. }
  1364. for (vent = table; vent->version != 0; ++vent) {
  1365. if (vent->smeth != NULL && ssl_method_error(s, vent->smeth()) == 0)
  1366. return s->version == vent->version;
  1367. }
  1368. return 0;
  1369. }
  1370. /*
  1371. * ssl_set_version_bound - set an upper or lower bound on the supported (D)TLS
  1372. * protocols, provided the initial (D)TLS method is version-flexible. This
  1373. * function sanity-checks the proposed value and makes sure the method is
  1374. * version-flexible, then sets the limit if all is well.
  1375. *
  1376. * @method_version: The version of the current SSL_METHOD.
  1377. * @version: the intended limit.
  1378. * @bound: pointer to limit to be updated.
  1379. *
  1380. * Returns 1 on success, 0 on failure.
  1381. */
  1382. int ssl_set_version_bound(int method_version, int version, int *bound)
  1383. {
  1384. if (version == 0) {
  1385. *bound = version;
  1386. return 1;
  1387. }
  1388. /*-
  1389. * Restrict TLS methods to TLS protocol versions.
  1390. * Restrict DTLS methods to DTLS protocol versions.
  1391. * Note, DTLS version numbers are decreasing, use comparison macros.
  1392. *
  1393. * Note that for both lower-bounds we use explicit versions, not
  1394. * (D)TLS_MIN_VERSION. This is because we don't want to break user
  1395. * configurations. If the MIN (supported) version ever rises, the user's
  1396. * "floor" remains valid even if no longer available. We don't expect the
  1397. * MAX ceiling to ever get lower, so making that variable makes sense.
  1398. */
  1399. switch (method_version) {
  1400. default:
  1401. /*
  1402. * XXX For fixed version methods, should we always fail and not set any
  1403. * bounds, always succeed and not set any bounds, or set the bounds and
  1404. * arrange to fail later if they are not met? At present fixed-version
  1405. * methods are not subject to controls that disable individual protocol
  1406. * versions.
  1407. */
  1408. return 0;
  1409. case TLS_ANY_VERSION:
  1410. if (version < SSL3_VERSION || version > TLS_MAX_VERSION)
  1411. return 0;
  1412. break;
  1413. case DTLS_ANY_VERSION:
  1414. if (DTLS_VERSION_GT(version, DTLS_MAX_VERSION) ||
  1415. DTLS_VERSION_LT(version, DTLS1_BAD_VER))
  1416. return 0;
  1417. break;
  1418. }
  1419. *bound = version;
  1420. return 1;
  1421. }
  1422. static void check_for_downgrade(SSL *s, int vers, DOWNGRADE *dgrd)
  1423. {
  1424. if (vers == TLS1_2_VERSION
  1425. && ssl_version_supported(s, TLS1_3_VERSION)) {
  1426. *dgrd = DOWNGRADE_TO_1_2;
  1427. } else if (!SSL_IS_DTLS(s) && vers < TLS1_2_VERSION
  1428. && (ssl_version_supported(s, TLS1_2_VERSION)
  1429. || ssl_version_supported(s, TLS1_3_VERSION))) {
  1430. *dgrd = DOWNGRADE_TO_1_1;
  1431. } else {
  1432. *dgrd = DOWNGRADE_NONE;
  1433. }
  1434. }
  1435. /*
  1436. * ssl_choose_server_version - Choose server (D)TLS version. Called when the
  1437. * client HELLO is received to select the final server protocol version and
  1438. * the version specific method.
  1439. *
  1440. * @s: server SSL handle.
  1441. *
  1442. * Returns 0 on success or an SSL error reason number on failure.
  1443. */
  1444. int ssl_choose_server_version(SSL *s, CLIENTHELLO_MSG *hello, DOWNGRADE *dgrd)
  1445. {
  1446. /*-
  1447. * With version-flexible methods we have an initial state with:
  1448. *
  1449. * s->method->version == (D)TLS_ANY_VERSION,
  1450. * s->version == (D)TLS_MAX_VERSION.
  1451. *
  1452. * So we detect version-flexible methods via the method version, not the
  1453. * handle version.
  1454. */
  1455. int server_version = s->method->version;
  1456. int client_version = hello->legacy_version;
  1457. const version_info *vent;
  1458. const version_info *table;
  1459. int disabled = 0;
  1460. RAW_EXTENSION *suppversions;
  1461. s->client_version = client_version;
  1462. switch (server_version) {
  1463. default:
  1464. if (!SSL_IS_TLS13(s)) {
  1465. if (version_cmp(s, client_version, s->version) < 0)
  1466. return SSL_R_WRONG_SSL_VERSION;
  1467. *dgrd = DOWNGRADE_NONE;
  1468. /*
  1469. * If this SSL handle is not from a version flexible method we don't
  1470. * (and never did) check min/max FIPS or Suite B constraints. Hope
  1471. * that's OK. It is up to the caller to not choose fixed protocol
  1472. * versions they don't want. If not, then easy to fix, just return
  1473. * ssl_method_error(s, s->method)
  1474. */
  1475. return 0;
  1476. }
  1477. /*
  1478. * Fall through if we are TLSv1.3 already (this means we must be after
  1479. * a HelloRetryRequest
  1480. */
  1481. /* fall thru */
  1482. case TLS_ANY_VERSION:
  1483. table = tls_version_table;
  1484. break;
  1485. case DTLS_ANY_VERSION:
  1486. table = dtls_version_table;
  1487. break;
  1488. }
  1489. suppversions = &hello->pre_proc_exts[TLSEXT_IDX_supported_versions];
  1490. /* If we did an HRR then supported versions is mandatory */
  1491. if (!suppversions->present && s->hello_retry_request != SSL_HRR_NONE)
  1492. return SSL_R_UNSUPPORTED_PROTOCOL;
  1493. if (suppversions->present && !SSL_IS_DTLS(s)) {
  1494. unsigned int candidate_vers = 0;
  1495. unsigned int best_vers = 0;
  1496. const SSL_METHOD *best_method = NULL;
  1497. PACKET versionslist;
  1498. suppversions->parsed = 1;
  1499. if (!PACKET_as_length_prefixed_1(&suppversions->data, &versionslist)) {
  1500. /* Trailing or invalid data? */
  1501. return SSL_R_LENGTH_MISMATCH;
  1502. }
  1503. while (PACKET_get_net_2(&versionslist, &candidate_vers)) {
  1504. /* TODO(TLS1.3): Remove this before release */
  1505. if (candidate_vers == TLS1_3_VERSION_DRAFT)
  1506. candidate_vers = TLS1_3_VERSION;
  1507. /*
  1508. * TODO(TLS1.3): There is some discussion on the TLS list about
  1509. * whether to ignore versions <TLS1.2 in supported_versions. At the
  1510. * moment we honour them if present. To be reviewed later
  1511. */
  1512. if (version_cmp(s, candidate_vers, best_vers) <= 0)
  1513. continue;
  1514. for (vent = table;
  1515. vent->version != 0 && vent->version != (int)candidate_vers;
  1516. ++vent)
  1517. continue;
  1518. if (vent->version != 0 && vent->smeth != NULL) {
  1519. const SSL_METHOD *method;
  1520. method = vent->smeth();
  1521. if (ssl_method_error(s, method) == 0) {
  1522. best_vers = candidate_vers;
  1523. best_method = method;
  1524. }
  1525. }
  1526. }
  1527. if (PACKET_remaining(&versionslist) != 0) {
  1528. /* Trailing data? */
  1529. return SSL_R_LENGTH_MISMATCH;
  1530. }
  1531. if (best_vers > 0) {
  1532. if (s->hello_retry_request != SSL_HRR_NONE) {
  1533. /*
  1534. * This is after a HelloRetryRequest so we better check that we
  1535. * negotiated TLSv1.3
  1536. */
  1537. if (best_vers != TLS1_3_VERSION)
  1538. return SSL_R_UNSUPPORTED_PROTOCOL;
  1539. return 0;
  1540. }
  1541. check_for_downgrade(s, best_vers, dgrd);
  1542. s->version = best_vers;
  1543. s->method = best_method;
  1544. return 0;
  1545. }
  1546. return SSL_R_UNSUPPORTED_PROTOCOL;
  1547. }
  1548. /*
  1549. * If the supported versions extension isn't present, then the highest
  1550. * version we can negotiate is TLSv1.2
  1551. */
  1552. if (version_cmp(s, client_version, TLS1_3_VERSION) >= 0)
  1553. client_version = TLS1_2_VERSION;
  1554. /*
  1555. * No supported versions extension, so we just use the version supplied in
  1556. * the ClientHello.
  1557. */
  1558. for (vent = table; vent->version != 0; ++vent) {
  1559. const SSL_METHOD *method;
  1560. if (vent->smeth == NULL ||
  1561. version_cmp(s, client_version, vent->version) < 0)
  1562. continue;
  1563. method = vent->smeth();
  1564. if (ssl_method_error(s, method) == 0) {
  1565. check_for_downgrade(s, vent->version, dgrd);
  1566. s->version = vent->version;
  1567. s->method = method;
  1568. return 0;
  1569. }
  1570. disabled = 1;
  1571. }
  1572. return disabled ? SSL_R_UNSUPPORTED_PROTOCOL : SSL_R_VERSION_TOO_LOW;
  1573. }
  1574. /*
  1575. * ssl_choose_client_version - Choose client (D)TLS version. Called when the
  1576. * server HELLO is received to select the final client protocol version and
  1577. * the version specific method.
  1578. *
  1579. * @s: client SSL handle.
  1580. * @version: The proposed version from the server's HELLO.
  1581. * @extensions: The extensions received
  1582. *
  1583. * Returns 1 on success or 0 on error.
  1584. */
  1585. int ssl_choose_client_version(SSL *s, int version, RAW_EXTENSION *extensions)
  1586. {
  1587. const version_info *vent;
  1588. const version_info *table;
  1589. int highver = 0;
  1590. int origv;
  1591. origv = s->version;
  1592. s->version = version;
  1593. /* This will overwrite s->version if the extension is present */
  1594. if (!tls_parse_extension(s, TLSEXT_IDX_supported_versions,
  1595. SSL_EXT_TLS1_2_SERVER_HELLO
  1596. | SSL_EXT_TLS1_3_SERVER_HELLO, extensions,
  1597. NULL, 0)) {
  1598. s->version = origv;
  1599. return 0;
  1600. }
  1601. if (s->hello_retry_request != SSL_HRR_NONE
  1602. && s->version != TLS1_3_VERSION) {
  1603. s->version = origv;
  1604. SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_SSL_CHOOSE_CLIENT_VERSION,
  1605. SSL_R_WRONG_SSL_VERSION);
  1606. return 0;
  1607. }
  1608. switch (s->method->version) {
  1609. default:
  1610. if (s->version != s->method->version) {
  1611. s->version = origv;
  1612. SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
  1613. SSL_F_SSL_CHOOSE_CLIENT_VERSION,
  1614. SSL_R_WRONG_SSL_VERSION);
  1615. return 0;
  1616. }
  1617. /*
  1618. * If this SSL handle is not from a version flexible method we don't
  1619. * (and never did) check min/max, FIPS or Suite B constraints. Hope
  1620. * that's OK. It is up to the caller to not choose fixed protocol
  1621. * versions they don't want. If not, then easy to fix, just return
  1622. * ssl_method_error(s, s->method)
  1623. */
  1624. return 1;
  1625. case TLS_ANY_VERSION:
  1626. table = tls_version_table;
  1627. break;
  1628. case DTLS_ANY_VERSION:
  1629. table = dtls_version_table;
  1630. break;
  1631. }
  1632. for (vent = table; vent->version != 0; ++vent) {
  1633. const SSL_METHOD *method;
  1634. int err;
  1635. if (vent->cmeth == NULL)
  1636. continue;
  1637. if (highver != 0 && s->version != vent->version)
  1638. continue;
  1639. method = vent->cmeth();
  1640. err = ssl_method_error(s, method);
  1641. if (err != 0) {
  1642. if (s->version == vent->version) {
  1643. s->version = origv;
  1644. SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
  1645. SSL_F_SSL_CHOOSE_CLIENT_VERSION, err);
  1646. return 0;
  1647. }
  1648. continue;
  1649. }
  1650. if (highver == 0)
  1651. highver = vent->version;
  1652. if (s->version != vent->version)
  1653. continue;
  1654. #ifndef OPENSSL_NO_TLS13DOWNGRADE
  1655. /* Check for downgrades */
  1656. if (s->version == TLS1_2_VERSION && highver > s->version) {
  1657. if (memcmp(tls12downgrade,
  1658. s->s3->server_random + SSL3_RANDOM_SIZE
  1659. - sizeof(tls12downgrade),
  1660. sizeof(tls12downgrade)) == 0) {
  1661. s->version = origv;
  1662. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
  1663. SSL_F_SSL_CHOOSE_CLIENT_VERSION,
  1664. SSL_R_INAPPROPRIATE_FALLBACK);
  1665. return 0;
  1666. }
  1667. } else if (!SSL_IS_DTLS(s)
  1668. && s->version < TLS1_2_VERSION
  1669. && highver > s->version) {
  1670. if (memcmp(tls11downgrade,
  1671. s->s3->server_random + SSL3_RANDOM_SIZE
  1672. - sizeof(tls11downgrade),
  1673. sizeof(tls11downgrade)) == 0) {
  1674. s->version = origv;
  1675. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
  1676. SSL_F_SSL_CHOOSE_CLIENT_VERSION,
  1677. SSL_R_INAPPROPRIATE_FALLBACK);
  1678. return 0;
  1679. }
  1680. }
  1681. #endif
  1682. s->method = method;
  1683. return 1;
  1684. }
  1685. s->version = origv;
  1686. SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_SSL_CHOOSE_CLIENT_VERSION,
  1687. SSL_R_UNSUPPORTED_PROTOCOL);
  1688. return 0;
  1689. }
  1690. /*
  1691. * ssl_get_min_max_version - get minimum and maximum protocol version
  1692. * @s: The SSL connection
  1693. * @min_version: The minimum supported version
  1694. * @max_version: The maximum supported version
  1695. *
  1696. * Work out what version we should be using for the initial ClientHello if the
  1697. * version is initially (D)TLS_ANY_VERSION. We apply any explicit SSL_OP_NO_xxx
  1698. * options, the MinProtocol and MaxProtocol configuration commands, any Suite B
  1699. * constraints and any floor imposed by the security level here,
  1700. * so we don't advertise the wrong protocol version to only reject the outcome later.
  1701. *
  1702. * Computing the right floor matters. If, e.g., TLS 1.0 and 1.2 are enabled,
  1703. * TLS 1.1 is disabled, but the security level, Suite-B and/or MinProtocol
  1704. * only allow TLS 1.2, we want to advertise TLS1.2, *not* TLS1.
  1705. *
  1706. * Returns 0 on success or an SSL error reason number on failure. On failure
  1707. * min_version and max_version will also be set to 0.
  1708. */
  1709. int ssl_get_min_max_version(const SSL *s, int *min_version, int *max_version)
  1710. {
  1711. int version;
  1712. int hole;
  1713. const SSL_METHOD *single = NULL;
  1714. const SSL_METHOD *method;
  1715. const version_info *table;
  1716. const version_info *vent;
  1717. switch (s->method->version) {
  1718. default:
  1719. /*
  1720. * If this SSL handle is not from a version flexible method we don't
  1721. * (and never did) check min/max FIPS or Suite B constraints. Hope
  1722. * that's OK. It is up to the caller to not choose fixed protocol
  1723. * versions they don't want. If not, then easy to fix, just return
  1724. * ssl_method_error(s, s->method)
  1725. */
  1726. *min_version = *max_version = s->version;
  1727. return 0;
  1728. case TLS_ANY_VERSION:
  1729. table = tls_version_table;
  1730. break;
  1731. case DTLS_ANY_VERSION:
  1732. table = dtls_version_table;
  1733. break;
  1734. }
  1735. /*
  1736. * SSL_OP_NO_X disables all protocols above X *if* there are some protocols
  1737. * below X enabled. This is required in order to maintain the "version
  1738. * capability" vector contiguous. Any versions with a NULL client method
  1739. * (protocol version client is disabled at compile-time) is also a "hole".
  1740. *
  1741. * Our initial state is hole == 1, version == 0. That is, versions above
  1742. * the first version in the method table are disabled (a "hole" above
  1743. * the valid protocol entries) and we don't have a selected version yet.
  1744. *
  1745. * Whenever "hole == 1", and we hit an enabled method, its version becomes
  1746. * the selected version, and the method becomes a candidate "single"
  1747. * method. We're no longer in a hole, so "hole" becomes 0.
  1748. *
  1749. * If "hole == 0" and we hit an enabled method, then "single" is cleared,
  1750. * as we support a contiguous range of at least two methods. If we hit
  1751. * a disabled method, then hole becomes true again, but nothing else
  1752. * changes yet, because all the remaining methods may be disabled too.
  1753. * If we again hit an enabled method after the new hole, it becomes
  1754. * selected, as we start from scratch.
  1755. */
  1756. *min_version = version = 0;
  1757. hole = 1;
  1758. for (vent = table; vent->version != 0; ++vent) {
  1759. /*
  1760. * A table entry with a NULL client method is still a hole in the
  1761. * "version capability" vector.
  1762. */
  1763. if (vent->cmeth == NULL) {
  1764. hole = 1;
  1765. continue;
  1766. }
  1767. method = vent->cmeth();
  1768. if (ssl_method_error(s, method) != 0) {
  1769. hole = 1;
  1770. } else if (!hole) {
  1771. single = NULL;
  1772. *min_version = method->version;
  1773. } else {
  1774. version = (single = method)->version;
  1775. *min_version = version;
  1776. hole = 0;
  1777. }
  1778. }
  1779. *max_version = version;
  1780. /* Fail if everything is disabled */
  1781. if (version == 0)
  1782. return SSL_R_NO_PROTOCOLS_AVAILABLE;
  1783. return 0;
  1784. }
  1785. /*
  1786. * ssl_set_client_hello_version - Work out what version we should be using for
  1787. * the initial ClientHello.legacy_version field.
  1788. *
  1789. * @s: client SSL handle.
  1790. *
  1791. * Returns 0 on success or an SSL error reason number on failure.
  1792. */
  1793. int ssl_set_client_hello_version(SSL *s)
  1794. {
  1795. int ver_min, ver_max, ret;
  1796. /*
  1797. * In a renegotiation we always send the same client_version that we sent
  1798. * last time, regardless of which version we eventually negotiated.
  1799. */
  1800. if (!SSL_IS_FIRST_HANDSHAKE(s))
  1801. return 0;
  1802. ret = ssl_get_min_max_version(s, &ver_min, &ver_max);
  1803. if (ret != 0)
  1804. return ret;
  1805. s->version = ver_max;
  1806. /* TLS1.3 always uses TLS1.2 in the legacy_version field */
  1807. if (!SSL_IS_DTLS(s) && ver_max > TLS1_2_VERSION)
  1808. ver_max = TLS1_2_VERSION;
  1809. s->client_version = ver_max;
  1810. return 0;
  1811. }
  1812. /*
  1813. * Checks a list of |groups| to determine if the |group_id| is in it. If it is
  1814. * and |checkallow| is 1 then additionally check if the group is allowed to be
  1815. * used. Returns 1 if the group is in the list (and allowed if |checkallow| is
  1816. * 1) or 0 otherwise.
  1817. */
  1818. #ifndef OPENSSL_NO_EC
  1819. int check_in_list(SSL *s, uint16_t group_id, const uint16_t *groups,
  1820. size_t num_groups, int checkallow)
  1821. {
  1822. size_t i;
  1823. if (groups == NULL || num_groups == 0)
  1824. return 0;
  1825. for (i = 0; i < num_groups; i++) {
  1826. uint16_t group = groups[i];
  1827. if (group_id == group
  1828. && (!checkallow
  1829. || tls_curve_allowed(s, group, SSL_SECOP_CURVE_CHECK))) {
  1830. return 1;
  1831. }
  1832. }
  1833. return 0;
  1834. }
  1835. #endif
  1836. /* Replace ClientHello1 in the transcript hash with a synthetic message */
  1837. int create_synthetic_message_hash(SSL *s, const unsigned char *hashval,
  1838. size_t hashlen, const unsigned char *hrr,
  1839. size_t hrrlen)
  1840. {
  1841. unsigned char hashvaltmp[EVP_MAX_MD_SIZE];
  1842. unsigned char msghdr[SSL3_HM_HEADER_LENGTH];
  1843. memset(msghdr, 0, sizeof(msghdr));
  1844. if (hashval == NULL) {
  1845. hashval = hashvaltmp;
  1846. hashlen = 0;
  1847. /* Get the hash of the initial ClientHello */
  1848. if (!ssl3_digest_cached_records(s, 0)
  1849. || !ssl_handshake_hash(s, hashvaltmp, sizeof(hashvaltmp),
  1850. &hashlen)) {
  1851. /* SSLfatal() already called */
  1852. return 0;
  1853. }
  1854. }
  1855. /* Reinitialise the transcript hash */
  1856. if (!ssl3_init_finished_mac(s)) {
  1857. /* SSLfatal() already called */
  1858. return 0;
  1859. }
  1860. /* Inject the synthetic message_hash message */
  1861. msghdr[0] = SSL3_MT_MESSAGE_HASH;
  1862. msghdr[SSL3_HM_HEADER_LENGTH - 1] = (unsigned char)hashlen;
  1863. if (!ssl3_finish_mac(s, msghdr, SSL3_HM_HEADER_LENGTH)
  1864. || !ssl3_finish_mac(s, hashval, hashlen)) {
  1865. /* SSLfatal() already called */
  1866. return 0;
  1867. }
  1868. /*
  1869. * Now re-inject the HRR and current message if appropriate (we just deleted
  1870. * it when we reinitialised the transcript hash above). Only necessary after
  1871. * receiving a ClientHello2 with a cookie.
  1872. */
  1873. if (hrr != NULL
  1874. && (!ssl3_finish_mac(s, hrr, hrrlen)
  1875. || !ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
  1876. s->s3->tmp.message_size
  1877. + SSL3_HM_HEADER_LENGTH))) {
  1878. /* SSLfatal() already called */
  1879. return 0;
  1880. }
  1881. return 1;
  1882. }
  1883. static int ca_dn_cmp(const X509_NAME *const *a, const X509_NAME *const *b)
  1884. {
  1885. return X509_NAME_cmp(*a, *b);
  1886. }
  1887. int parse_ca_names(SSL *s, PACKET *pkt)
  1888. {
  1889. STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
  1890. X509_NAME *xn = NULL;
  1891. PACKET cadns;
  1892. if (ca_sk == NULL) {
  1893. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_PARSE_CA_NAMES,
  1894. ERR_R_MALLOC_FAILURE);
  1895. goto err;
  1896. }
  1897. /* get the CA RDNs */
  1898. if (!PACKET_get_length_prefixed_2(pkt, &cadns)) {
  1899. SSLfatal(s, SSL_AD_DECODE_ERROR,SSL_F_PARSE_CA_NAMES,
  1900. SSL_R_LENGTH_MISMATCH);
  1901. goto err;
  1902. }
  1903. while (PACKET_remaining(&cadns)) {
  1904. const unsigned char *namestart, *namebytes;
  1905. unsigned int name_len;
  1906. if (!PACKET_get_net_2(&cadns, &name_len)
  1907. || !PACKET_get_bytes(&cadns, &namebytes, name_len)) {
  1908. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_PARSE_CA_NAMES,
  1909. SSL_R_LENGTH_MISMATCH);
  1910. goto err;
  1911. }
  1912. namestart = namebytes;
  1913. if ((xn = d2i_X509_NAME(NULL, &namebytes, name_len)) == NULL) {
  1914. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_PARSE_CA_NAMES,
  1915. ERR_R_ASN1_LIB);
  1916. goto err;
  1917. }
  1918. if (namebytes != (namestart + name_len)) {
  1919. SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_PARSE_CA_NAMES,
  1920. SSL_R_CA_DN_LENGTH_MISMATCH);
  1921. goto err;
  1922. }
  1923. if (!sk_X509_NAME_push(ca_sk, xn)) {
  1924. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_PARSE_CA_NAMES,
  1925. ERR_R_MALLOC_FAILURE);
  1926. goto err;
  1927. }
  1928. xn = NULL;
  1929. }
  1930. sk_X509_NAME_pop_free(s->s3->tmp.peer_ca_names, X509_NAME_free);
  1931. s->s3->tmp.peer_ca_names = ca_sk;
  1932. return 1;
  1933. err:
  1934. sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);
  1935. X509_NAME_free(xn);
  1936. return 0;
  1937. }
  1938. int construct_ca_names(SSL *s, WPACKET *pkt)
  1939. {
  1940. const STACK_OF(X509_NAME) *ca_sk = SSL_get0_CA_list(s);
  1941. /* Start sub-packet for client CA list */
  1942. if (!WPACKET_start_sub_packet_u16(pkt)) {
  1943. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_CA_NAMES,
  1944. ERR_R_INTERNAL_ERROR);
  1945. return 0;
  1946. }
  1947. if (ca_sk != NULL) {
  1948. int i;
  1949. for (i = 0; i < sk_X509_NAME_num(ca_sk); i++) {
  1950. unsigned char *namebytes;
  1951. X509_NAME *name = sk_X509_NAME_value(ca_sk, i);
  1952. int namelen;
  1953. if (name == NULL
  1954. || (namelen = i2d_X509_NAME(name, NULL)) < 0
  1955. || !WPACKET_sub_allocate_bytes_u16(pkt, namelen,
  1956. &namebytes)
  1957. || i2d_X509_NAME(name, &namebytes) != namelen) {
  1958. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_CA_NAMES,
  1959. ERR_R_INTERNAL_ERROR);
  1960. return 0;
  1961. }
  1962. }
  1963. }
  1964. if (!WPACKET_close(pkt)) {
  1965. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_CA_NAMES,
  1966. ERR_R_INTERNAL_ERROR);
  1967. return 0;
  1968. }
  1969. return 1;
  1970. }
  1971. /* Create a buffer containing data to be signed for server key exchange */
  1972. size_t construct_key_exchange_tbs(SSL *s, unsigned char **ptbs,
  1973. const void *param, size_t paramlen)
  1974. {
  1975. size_t tbslen = 2 * SSL3_RANDOM_SIZE + paramlen;
  1976. unsigned char *tbs = OPENSSL_malloc(tbslen);
  1977. if (tbs == NULL) {
  1978. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_KEY_EXCHANGE_TBS,
  1979. ERR_R_MALLOC_FAILURE);
  1980. return 0;
  1981. }
  1982. memcpy(tbs, s->s3->client_random, SSL3_RANDOM_SIZE);
  1983. memcpy(tbs + SSL3_RANDOM_SIZE, s->s3->server_random, SSL3_RANDOM_SIZE);
  1984. memcpy(tbs + SSL3_RANDOM_SIZE * 2, param, paramlen);
  1985. *ptbs = tbs;
  1986. return tbslen;
  1987. }
  1988. /*
  1989. * Saves the current handshake digest for Post-Handshake Auth,
  1990. * Done after ClientFinished is processed, done exactly once
  1991. */
  1992. int tls13_save_handshake_digest_for_pha(SSL *s)
  1993. {
  1994. if (s->pha_dgst == NULL) {
  1995. if (!ssl3_digest_cached_records(s, 1))
  1996. /* SSLfatal() already called */
  1997. return 0;
  1998. s->pha_dgst = EVP_MD_CTX_new();
  1999. if (s->pha_dgst == NULL) {
  2000. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  2001. SSL_F_TLS13_SAVE_HANDSHAKE_DIGEST_FOR_PHA,
  2002. ERR_R_INTERNAL_ERROR);
  2003. return 0;
  2004. }
  2005. if (!EVP_MD_CTX_copy_ex(s->pha_dgst,
  2006. s->s3->handshake_dgst)) {
  2007. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  2008. SSL_F_TLS13_SAVE_HANDSHAKE_DIGEST_FOR_PHA,
  2009. ERR_R_INTERNAL_ERROR);
  2010. return 0;
  2011. }
  2012. }
  2013. return 1;
  2014. }
  2015. /*
  2016. * Restores the Post-Handshake Auth handshake digest
  2017. * Done just before sending/processing the Cert Request
  2018. */
  2019. int tls13_restore_handshake_digest_for_pha(SSL *s)
  2020. {
  2021. if (s->pha_dgst == NULL) {
  2022. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  2023. SSL_F_TLS13_RESTORE_HANDSHAKE_DIGEST_FOR_PHA,
  2024. ERR_R_INTERNAL_ERROR);
  2025. return 0;
  2026. }
  2027. if (!EVP_MD_CTX_copy_ex(s->s3->handshake_dgst,
  2028. s->pha_dgst)) {
  2029. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  2030. SSL_F_TLS13_RESTORE_HANDSHAKE_DIGEST_FOR_PHA,
  2031. ERR_R_INTERNAL_ERROR);
  2032. return 0;
  2033. }
  2034. return 1;
  2035. }