t1_lib.c 129 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012
  1. /*
  2. * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <stdlib.h>
  11. #include <openssl/objects.h>
  12. #include <openssl/evp.h>
  13. #include <openssl/hmac.h>
  14. #include <openssl/core_names.h>
  15. #include <openssl/ocsp.h>
  16. #include <openssl/conf.h>
  17. #include <openssl/x509v3.h>
  18. #include <openssl/dh.h>
  19. #include <openssl/bn.h>
  20. #include <openssl/provider.h>
  21. #include <openssl/param_build.h>
  22. #include "internal/nelem.h"
  23. #include "internal/sizes.h"
  24. #include "internal/tlsgroups.h"
  25. #include "ssl_local.h"
  26. #include "quic/quic_local.h"
  27. #include <openssl/ct.h>
  28. static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pkey);
  29. static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, const SIGALG_LOOKUP *lu);
  30. SSL3_ENC_METHOD const TLSv1_enc_data = {
  31. tls1_setup_key_block,
  32. tls1_generate_master_secret,
  33. tls1_change_cipher_state,
  34. tls1_final_finish_mac,
  35. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  36. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  37. tls1_alert_code,
  38. tls1_export_keying_material,
  39. 0,
  40. ssl3_set_handshake_header,
  41. tls_close_construct_packet,
  42. ssl3_handshake_write
  43. };
  44. SSL3_ENC_METHOD const TLSv1_1_enc_data = {
  45. tls1_setup_key_block,
  46. tls1_generate_master_secret,
  47. tls1_change_cipher_state,
  48. tls1_final_finish_mac,
  49. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  50. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  51. tls1_alert_code,
  52. tls1_export_keying_material,
  53. SSL_ENC_FLAG_EXPLICIT_IV,
  54. ssl3_set_handshake_header,
  55. tls_close_construct_packet,
  56. ssl3_handshake_write
  57. };
  58. SSL3_ENC_METHOD const TLSv1_2_enc_data = {
  59. tls1_setup_key_block,
  60. tls1_generate_master_secret,
  61. tls1_change_cipher_state,
  62. tls1_final_finish_mac,
  63. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  64. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  65. tls1_alert_code,
  66. tls1_export_keying_material,
  67. SSL_ENC_FLAG_EXPLICIT_IV | SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF
  68. | SSL_ENC_FLAG_TLS1_2_CIPHERS,
  69. ssl3_set_handshake_header,
  70. tls_close_construct_packet,
  71. ssl3_handshake_write
  72. };
  73. SSL3_ENC_METHOD const TLSv1_3_enc_data = {
  74. tls13_setup_key_block,
  75. tls13_generate_master_secret,
  76. tls13_change_cipher_state,
  77. tls13_final_finish_mac,
  78. TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
  79. TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  80. tls13_alert_code,
  81. tls13_export_keying_material,
  82. SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF,
  83. ssl3_set_handshake_header,
  84. tls_close_construct_packet,
  85. ssl3_handshake_write
  86. };
  87. OSSL_TIME tls1_default_timeout(void)
  88. {
  89. /*
  90. * 2 hours, the 24 hours mentioned in the TLSv1 spec is way too long for
  91. * http, the cache would over fill
  92. */
  93. return ossl_seconds2time(60 * 60 * 2);
  94. }
  95. int tls1_new(SSL *s)
  96. {
  97. if (!ssl3_new(s))
  98. return 0;
  99. if (!s->method->ssl_clear(s))
  100. return 0;
  101. return 1;
  102. }
  103. void tls1_free(SSL *s)
  104. {
  105. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  106. if (sc == NULL)
  107. return;
  108. OPENSSL_free(sc->ext.session_ticket);
  109. ssl3_free(s);
  110. }
  111. int tls1_clear(SSL *s)
  112. {
  113. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  114. if (sc == NULL)
  115. return 0;
  116. if (!ssl3_clear(s))
  117. return 0;
  118. if (s->method->version == TLS_ANY_VERSION)
  119. sc->version = TLS_MAX_VERSION_INTERNAL;
  120. else
  121. sc->version = s->method->version;
  122. return 1;
  123. }
  124. /* Legacy NID to group_id mapping. Only works for groups we know about */
  125. static struct {
  126. int nid;
  127. uint16_t group_id;
  128. } nid_to_group[] = {
  129. {NID_sect163k1, OSSL_TLS_GROUP_ID_sect163k1},
  130. {NID_sect163r1, OSSL_TLS_GROUP_ID_sect163r1},
  131. {NID_sect163r2, OSSL_TLS_GROUP_ID_sect163r2},
  132. {NID_sect193r1, OSSL_TLS_GROUP_ID_sect193r1},
  133. {NID_sect193r2, OSSL_TLS_GROUP_ID_sect193r2},
  134. {NID_sect233k1, OSSL_TLS_GROUP_ID_sect233k1},
  135. {NID_sect233r1, OSSL_TLS_GROUP_ID_sect233r1},
  136. {NID_sect239k1, OSSL_TLS_GROUP_ID_sect239k1},
  137. {NID_sect283k1, OSSL_TLS_GROUP_ID_sect283k1},
  138. {NID_sect283r1, OSSL_TLS_GROUP_ID_sect283r1},
  139. {NID_sect409k1, OSSL_TLS_GROUP_ID_sect409k1},
  140. {NID_sect409r1, OSSL_TLS_GROUP_ID_sect409r1},
  141. {NID_sect571k1, OSSL_TLS_GROUP_ID_sect571k1},
  142. {NID_sect571r1, OSSL_TLS_GROUP_ID_sect571r1},
  143. {NID_secp160k1, OSSL_TLS_GROUP_ID_secp160k1},
  144. {NID_secp160r1, OSSL_TLS_GROUP_ID_secp160r1},
  145. {NID_secp160r2, OSSL_TLS_GROUP_ID_secp160r2},
  146. {NID_secp192k1, OSSL_TLS_GROUP_ID_secp192k1},
  147. {NID_X9_62_prime192v1, OSSL_TLS_GROUP_ID_secp192r1},
  148. {NID_secp224k1, OSSL_TLS_GROUP_ID_secp224k1},
  149. {NID_secp224r1, OSSL_TLS_GROUP_ID_secp224r1},
  150. {NID_secp256k1, OSSL_TLS_GROUP_ID_secp256k1},
  151. {NID_X9_62_prime256v1, OSSL_TLS_GROUP_ID_secp256r1},
  152. {NID_secp384r1, OSSL_TLS_GROUP_ID_secp384r1},
  153. {NID_secp521r1, OSSL_TLS_GROUP_ID_secp521r1},
  154. {NID_brainpoolP256r1, OSSL_TLS_GROUP_ID_brainpoolP256r1},
  155. {NID_brainpoolP384r1, OSSL_TLS_GROUP_ID_brainpoolP384r1},
  156. {NID_brainpoolP512r1, OSSL_TLS_GROUP_ID_brainpoolP512r1},
  157. {EVP_PKEY_X25519, OSSL_TLS_GROUP_ID_x25519},
  158. {EVP_PKEY_X448, OSSL_TLS_GROUP_ID_x448},
  159. {NID_brainpoolP256r1tls13, OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13},
  160. {NID_brainpoolP384r1tls13, OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13},
  161. {NID_brainpoolP512r1tls13, OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13},
  162. {NID_id_tc26_gost_3410_2012_256_paramSetA, OSSL_TLS_GROUP_ID_gc256A},
  163. {NID_id_tc26_gost_3410_2012_256_paramSetB, OSSL_TLS_GROUP_ID_gc256B},
  164. {NID_id_tc26_gost_3410_2012_256_paramSetC, OSSL_TLS_GROUP_ID_gc256C},
  165. {NID_id_tc26_gost_3410_2012_256_paramSetD, OSSL_TLS_GROUP_ID_gc256D},
  166. {NID_id_tc26_gost_3410_2012_512_paramSetA, OSSL_TLS_GROUP_ID_gc512A},
  167. {NID_id_tc26_gost_3410_2012_512_paramSetB, OSSL_TLS_GROUP_ID_gc512B},
  168. {NID_id_tc26_gost_3410_2012_512_paramSetC, OSSL_TLS_GROUP_ID_gc512C},
  169. {NID_ffdhe2048, OSSL_TLS_GROUP_ID_ffdhe2048},
  170. {NID_ffdhe3072, OSSL_TLS_GROUP_ID_ffdhe3072},
  171. {NID_ffdhe4096, OSSL_TLS_GROUP_ID_ffdhe4096},
  172. {NID_ffdhe6144, OSSL_TLS_GROUP_ID_ffdhe6144},
  173. {NID_ffdhe8192, OSSL_TLS_GROUP_ID_ffdhe8192}
  174. };
  175. static const unsigned char ecformats_default[] = {
  176. TLSEXT_ECPOINTFORMAT_uncompressed,
  177. TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
  178. TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
  179. };
  180. /* The default curves */
  181. static const uint16_t supported_groups_default[] = {
  182. OSSL_TLS_GROUP_ID_x25519, /* X25519 (29) */
  183. OSSL_TLS_GROUP_ID_secp256r1, /* secp256r1 (23) */
  184. OSSL_TLS_GROUP_ID_x448, /* X448 (30) */
  185. OSSL_TLS_GROUP_ID_secp521r1, /* secp521r1 (25) */
  186. OSSL_TLS_GROUP_ID_secp384r1, /* secp384r1 (24) */
  187. OSSL_TLS_GROUP_ID_gc256A, /* GC256A (34) */
  188. OSSL_TLS_GROUP_ID_gc256B, /* GC256B (35) */
  189. OSSL_TLS_GROUP_ID_gc256C, /* GC256C (36) */
  190. OSSL_TLS_GROUP_ID_gc256D, /* GC256D (37) */
  191. OSSL_TLS_GROUP_ID_gc512A, /* GC512A (38) */
  192. OSSL_TLS_GROUP_ID_gc512B, /* GC512B (39) */
  193. OSSL_TLS_GROUP_ID_gc512C, /* GC512C (40) */
  194. OSSL_TLS_GROUP_ID_ffdhe2048, /* ffdhe2048 (0x100) */
  195. OSSL_TLS_GROUP_ID_ffdhe3072, /* ffdhe3072 (0x101) */
  196. OSSL_TLS_GROUP_ID_ffdhe4096, /* ffdhe4096 (0x102) */
  197. OSSL_TLS_GROUP_ID_ffdhe6144, /* ffdhe6144 (0x103) */
  198. OSSL_TLS_GROUP_ID_ffdhe8192, /* ffdhe8192 (0x104) */
  199. };
  200. static const uint16_t suiteb_curves[] = {
  201. OSSL_TLS_GROUP_ID_secp256r1,
  202. OSSL_TLS_GROUP_ID_secp384r1,
  203. };
  204. struct provider_ctx_data_st {
  205. SSL_CTX *ctx;
  206. OSSL_PROVIDER *provider;
  207. };
  208. #define TLS_GROUP_LIST_MALLOC_BLOCK_SIZE 10
  209. static OSSL_CALLBACK add_provider_groups;
  210. static int add_provider_groups(const OSSL_PARAM params[], void *data)
  211. {
  212. struct provider_ctx_data_st *pgd = data;
  213. SSL_CTX *ctx = pgd->ctx;
  214. OSSL_PROVIDER *provider = pgd->provider;
  215. const OSSL_PARAM *p;
  216. TLS_GROUP_INFO *ginf = NULL;
  217. EVP_KEYMGMT *keymgmt;
  218. unsigned int gid;
  219. unsigned int is_kem = 0;
  220. int ret = 0;
  221. if (ctx->group_list_max_len == ctx->group_list_len) {
  222. TLS_GROUP_INFO *tmp = NULL;
  223. if (ctx->group_list_max_len == 0)
  224. tmp = OPENSSL_malloc(sizeof(TLS_GROUP_INFO)
  225. * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE);
  226. else
  227. tmp = OPENSSL_realloc(ctx->group_list,
  228. (ctx->group_list_max_len
  229. + TLS_GROUP_LIST_MALLOC_BLOCK_SIZE)
  230. * sizeof(TLS_GROUP_INFO));
  231. if (tmp == NULL)
  232. return 0;
  233. ctx->group_list = tmp;
  234. memset(tmp + ctx->group_list_max_len,
  235. 0,
  236. sizeof(TLS_GROUP_INFO) * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE);
  237. ctx->group_list_max_len += TLS_GROUP_LIST_MALLOC_BLOCK_SIZE;
  238. }
  239. ginf = &ctx->group_list[ctx->group_list_len];
  240. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME);
  241. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  242. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  243. goto err;
  244. }
  245. ginf->tlsname = OPENSSL_strdup(p->data);
  246. if (ginf->tlsname == NULL)
  247. goto err;
  248. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL);
  249. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  250. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  251. goto err;
  252. }
  253. ginf->realname = OPENSSL_strdup(p->data);
  254. if (ginf->realname == NULL)
  255. goto err;
  256. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ID);
  257. if (p == NULL || !OSSL_PARAM_get_uint(p, &gid) || gid > UINT16_MAX) {
  258. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  259. goto err;
  260. }
  261. ginf->group_id = (uint16_t)gid;
  262. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ALG);
  263. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  264. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  265. goto err;
  266. }
  267. ginf->algorithm = OPENSSL_strdup(p->data);
  268. if (ginf->algorithm == NULL)
  269. goto err;
  270. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS);
  271. if (p == NULL || !OSSL_PARAM_get_uint(p, &ginf->secbits)) {
  272. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  273. goto err;
  274. }
  275. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_IS_KEM);
  276. if (p != NULL && (!OSSL_PARAM_get_uint(p, &is_kem) || is_kem > 1)) {
  277. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  278. goto err;
  279. }
  280. ginf->is_kem = 1 & is_kem;
  281. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_TLS);
  282. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mintls)) {
  283. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  284. goto err;
  285. }
  286. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_TLS);
  287. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxtls)) {
  288. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  289. goto err;
  290. }
  291. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS);
  292. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mindtls)) {
  293. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  294. goto err;
  295. }
  296. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS);
  297. if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxdtls)) {
  298. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  299. goto err;
  300. }
  301. /*
  302. * Now check that the algorithm is actually usable for our property query
  303. * string. Regardless of the result we still return success because we have
  304. * successfully processed this group, even though we may decide not to use
  305. * it.
  306. */
  307. ret = 1;
  308. ERR_set_mark();
  309. keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, ginf->algorithm, ctx->propq);
  310. if (keymgmt != NULL) {
  311. /*
  312. * We have successfully fetched the algorithm - however if the provider
  313. * doesn't match this one then we ignore it.
  314. *
  315. * Note: We're cheating a little here. Technically if the same algorithm
  316. * is available from more than one provider then it is undefined which
  317. * implementation you will get back. Theoretically this could be
  318. * different every time...we assume here that you'll always get the
  319. * same one back if you repeat the exact same fetch. Is this a reasonable
  320. * assumption to make (in which case perhaps we should document this
  321. * behaviour)?
  322. */
  323. if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) {
  324. /* We have a match - so we will use this group */
  325. ctx->group_list_len++;
  326. ginf = NULL;
  327. }
  328. EVP_KEYMGMT_free(keymgmt);
  329. }
  330. ERR_pop_to_mark();
  331. err:
  332. if (ginf != NULL) {
  333. OPENSSL_free(ginf->tlsname);
  334. OPENSSL_free(ginf->realname);
  335. OPENSSL_free(ginf->algorithm);
  336. ginf->algorithm = ginf->tlsname = ginf->realname = NULL;
  337. }
  338. return ret;
  339. }
  340. static int discover_provider_groups(OSSL_PROVIDER *provider, void *vctx)
  341. {
  342. struct provider_ctx_data_st pgd;
  343. pgd.ctx = vctx;
  344. pgd.provider = provider;
  345. return OSSL_PROVIDER_get_capabilities(provider, "TLS-GROUP",
  346. add_provider_groups, &pgd);
  347. }
  348. int ssl_load_groups(SSL_CTX *ctx)
  349. {
  350. size_t i, j, num_deflt_grps = 0;
  351. uint16_t tmp_supp_groups[OSSL_NELEM(supported_groups_default)];
  352. if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_groups, ctx))
  353. return 0;
  354. for (i = 0; i < OSSL_NELEM(supported_groups_default); i++) {
  355. for (j = 0; j < ctx->group_list_len; j++) {
  356. if (ctx->group_list[j].group_id == supported_groups_default[i]) {
  357. tmp_supp_groups[num_deflt_grps++] = ctx->group_list[j].group_id;
  358. break;
  359. }
  360. }
  361. }
  362. if (num_deflt_grps == 0)
  363. return 1;
  364. ctx->ext.supported_groups_default
  365. = OPENSSL_malloc(sizeof(uint16_t) * num_deflt_grps);
  366. if (ctx->ext.supported_groups_default == NULL)
  367. return 0;
  368. memcpy(ctx->ext.supported_groups_default,
  369. tmp_supp_groups,
  370. num_deflt_grps * sizeof(tmp_supp_groups[0]));
  371. ctx->ext.supported_groups_default_len = num_deflt_grps;
  372. return 1;
  373. }
  374. #define TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE 10
  375. static OSSL_CALLBACK add_provider_sigalgs;
  376. static int add_provider_sigalgs(const OSSL_PARAM params[], void *data)
  377. {
  378. struct provider_ctx_data_st *pgd = data;
  379. SSL_CTX *ctx = pgd->ctx;
  380. OSSL_PROVIDER *provider = pgd->provider;
  381. const OSSL_PARAM *p;
  382. TLS_SIGALG_INFO *sinf = NULL;
  383. EVP_KEYMGMT *keymgmt;
  384. const char *keytype;
  385. unsigned int code_point = 0;
  386. int ret = 0;
  387. if (ctx->sigalg_list_max_len == ctx->sigalg_list_len) {
  388. TLS_SIGALG_INFO *tmp = NULL;
  389. if (ctx->sigalg_list_max_len == 0)
  390. tmp = OPENSSL_malloc(sizeof(TLS_SIGALG_INFO)
  391. * TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE);
  392. else
  393. tmp = OPENSSL_realloc(ctx->sigalg_list,
  394. (ctx->sigalg_list_max_len
  395. + TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE)
  396. * sizeof(TLS_SIGALG_INFO));
  397. if (tmp == NULL)
  398. return 0;
  399. ctx->sigalg_list = tmp;
  400. memset(tmp + ctx->sigalg_list_max_len, 0,
  401. sizeof(TLS_SIGALG_INFO) * TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE);
  402. ctx->sigalg_list_max_len += TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE;
  403. }
  404. sinf = &ctx->sigalg_list[ctx->sigalg_list_len];
  405. /* First, mandatory parameters */
  406. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_NAME);
  407. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  408. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  409. goto err;
  410. }
  411. OPENSSL_free(sinf->sigalg_name);
  412. sinf->sigalg_name = OPENSSL_strdup(p->data);
  413. if (sinf->sigalg_name == NULL)
  414. goto err;
  415. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_IANA_NAME);
  416. if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
  417. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  418. goto err;
  419. }
  420. OPENSSL_free(sinf->name);
  421. sinf->name = OPENSSL_strdup(p->data);
  422. if (sinf->name == NULL)
  423. goto err;
  424. p = OSSL_PARAM_locate_const(params,
  425. OSSL_CAPABILITY_TLS_SIGALG_CODE_POINT);
  426. if (p == NULL
  427. || !OSSL_PARAM_get_uint(p, &code_point)
  428. || code_point > UINT16_MAX) {
  429. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  430. goto err;
  431. }
  432. sinf->code_point = (uint16_t)code_point;
  433. p = OSSL_PARAM_locate_const(params,
  434. OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS);
  435. if (p == NULL || !OSSL_PARAM_get_uint(p, &sinf->secbits)) {
  436. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  437. goto err;
  438. }
  439. /* Now, optional parameters */
  440. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_OID);
  441. if (p == NULL) {
  442. sinf->sigalg_oid = NULL;
  443. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  444. goto err;
  445. } else {
  446. OPENSSL_free(sinf->sigalg_oid);
  447. sinf->sigalg_oid = OPENSSL_strdup(p->data);
  448. if (sinf->sigalg_oid == NULL)
  449. goto err;
  450. }
  451. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_SIG_NAME);
  452. if (p == NULL) {
  453. sinf->sig_name = NULL;
  454. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  455. goto err;
  456. } else {
  457. OPENSSL_free(sinf->sig_name);
  458. sinf->sig_name = OPENSSL_strdup(p->data);
  459. if (sinf->sig_name == NULL)
  460. goto err;
  461. }
  462. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_SIG_OID);
  463. if (p == NULL) {
  464. sinf->sig_oid = NULL;
  465. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  466. goto err;
  467. } else {
  468. OPENSSL_free(sinf->sig_oid);
  469. sinf->sig_oid = OPENSSL_strdup(p->data);
  470. if (sinf->sig_oid == NULL)
  471. goto err;
  472. }
  473. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_HASH_NAME);
  474. if (p == NULL) {
  475. sinf->hash_name = NULL;
  476. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  477. goto err;
  478. } else {
  479. OPENSSL_free(sinf->hash_name);
  480. sinf->hash_name = OPENSSL_strdup(p->data);
  481. if (sinf->hash_name == NULL)
  482. goto err;
  483. }
  484. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_HASH_OID);
  485. if (p == NULL) {
  486. sinf->hash_oid = NULL;
  487. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  488. goto err;
  489. } else {
  490. OPENSSL_free(sinf->hash_oid);
  491. sinf->hash_oid = OPENSSL_strdup(p->data);
  492. if (sinf->hash_oid == NULL)
  493. goto err;
  494. }
  495. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_KEYTYPE);
  496. if (p == NULL) {
  497. sinf->keytype = NULL;
  498. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  499. goto err;
  500. } else {
  501. OPENSSL_free(sinf->keytype);
  502. sinf->keytype = OPENSSL_strdup(p->data);
  503. if (sinf->keytype == NULL)
  504. goto err;
  505. }
  506. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_KEYTYPE_OID);
  507. if (p == NULL) {
  508. sinf->keytype_oid = NULL;
  509. } else if (p->data_type != OSSL_PARAM_UTF8_STRING) {
  510. goto err;
  511. } else {
  512. OPENSSL_free(sinf->keytype_oid);
  513. sinf->keytype_oid = OPENSSL_strdup(p->data);
  514. if (sinf->keytype_oid == NULL)
  515. goto err;
  516. }
  517. /* The remaining parameters below are mandatory again */
  518. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MIN_TLS);
  519. if (p == NULL || !OSSL_PARAM_get_int(p, &sinf->mintls)) {
  520. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  521. goto err;
  522. }
  523. if ((sinf->mintls != 0) && (sinf->mintls != -1) &&
  524. ((sinf->mintls < TLS1_3_VERSION))) {
  525. /* ignore this sigalg as this OpenSSL doesn't know how to handle it */
  526. ret = 1;
  527. goto err;
  528. }
  529. p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MAX_TLS);
  530. if (p == NULL || !OSSL_PARAM_get_int(p, &sinf->maxtls)) {
  531. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  532. goto err;
  533. }
  534. if ((sinf->maxtls != 0) && (sinf->maxtls != -1) &&
  535. ((sinf->maxtls < sinf->mintls))) {
  536. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  537. goto err;
  538. }
  539. if ((sinf->maxtls != 0) && (sinf->maxtls != -1) &&
  540. ((sinf->maxtls < TLS1_3_VERSION))) {
  541. /* ignore this sigalg as this OpenSSL doesn't know how to handle it */
  542. ret = 1;
  543. goto err;
  544. }
  545. /*
  546. * Now check that the algorithm is actually usable for our property query
  547. * string. Regardless of the result we still return success because we have
  548. * successfully processed this signature, even though we may decide not to
  549. * use it.
  550. */
  551. ret = 1;
  552. ERR_set_mark();
  553. keytype = (sinf->keytype != NULL
  554. ? sinf->keytype
  555. : (sinf->sig_name != NULL
  556. ? sinf->sig_name
  557. : sinf->sigalg_name));
  558. keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, keytype, ctx->propq);
  559. if (keymgmt != NULL) {
  560. /*
  561. * We have successfully fetched the algorithm - however if the provider
  562. * doesn't match this one then we ignore it.
  563. *
  564. * Note: We're cheating a little here. Technically if the same algorithm
  565. * is available from more than one provider then it is undefined which
  566. * implementation you will get back. Theoretically this could be
  567. * different every time...we assume here that you'll always get the
  568. * same one back if you repeat the exact same fetch. Is this a reasonable
  569. * assumption to make (in which case perhaps we should document this
  570. * behaviour)?
  571. */
  572. if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) {
  573. /*
  574. * We have a match - so we could use this signature;
  575. * Check proper object registration first, though.
  576. * Don't care about return value as this may have been
  577. * done within providers or previous calls to
  578. * add_provider_sigalgs.
  579. */
  580. OBJ_create(sinf->sigalg_oid, sinf->sigalg_name, NULL);
  581. /* sanity check: Without successful registration don't use alg */
  582. if ((OBJ_txt2nid(sinf->sigalg_name) == NID_undef) ||
  583. (OBJ_nid2obj(OBJ_txt2nid(sinf->sigalg_name)) == NULL)) {
  584. ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
  585. goto err;
  586. }
  587. if (sinf->sig_name != NULL)
  588. OBJ_create(sinf->sig_oid, sinf->sig_name, NULL);
  589. if (sinf->keytype != NULL)
  590. OBJ_create(sinf->keytype_oid, sinf->keytype, NULL);
  591. if (sinf->hash_name != NULL)
  592. OBJ_create(sinf->hash_oid, sinf->hash_name, NULL);
  593. OBJ_add_sigid(OBJ_txt2nid(sinf->sigalg_name),
  594. (sinf->hash_name != NULL
  595. ? OBJ_txt2nid(sinf->hash_name)
  596. : NID_undef),
  597. OBJ_txt2nid(keytype));
  598. ctx->sigalg_list_len++;
  599. sinf = NULL;
  600. }
  601. EVP_KEYMGMT_free(keymgmt);
  602. }
  603. ERR_pop_to_mark();
  604. err:
  605. if (sinf != NULL) {
  606. OPENSSL_free(sinf->name);
  607. sinf->name = NULL;
  608. OPENSSL_free(sinf->sigalg_name);
  609. sinf->sigalg_name = NULL;
  610. OPENSSL_free(sinf->sigalg_oid);
  611. sinf->sigalg_oid = NULL;
  612. OPENSSL_free(sinf->sig_name);
  613. sinf->sig_name = NULL;
  614. OPENSSL_free(sinf->sig_oid);
  615. sinf->sig_oid = NULL;
  616. OPENSSL_free(sinf->hash_name);
  617. sinf->hash_name = NULL;
  618. OPENSSL_free(sinf->hash_oid);
  619. sinf->hash_oid = NULL;
  620. OPENSSL_free(sinf->keytype);
  621. sinf->keytype = NULL;
  622. OPENSSL_free(sinf->keytype_oid);
  623. sinf->keytype_oid = NULL;
  624. }
  625. return ret;
  626. }
  627. static int discover_provider_sigalgs(OSSL_PROVIDER *provider, void *vctx)
  628. {
  629. struct provider_ctx_data_st pgd;
  630. pgd.ctx = vctx;
  631. pgd.provider = provider;
  632. OSSL_PROVIDER_get_capabilities(provider, "TLS-SIGALG",
  633. add_provider_sigalgs, &pgd);
  634. /*
  635. * Always OK, even if provider doesn't support the capability:
  636. * Reconsider testing retval when legacy sigalgs are also loaded this way.
  637. */
  638. return 1;
  639. }
  640. int ssl_load_sigalgs(SSL_CTX *ctx)
  641. {
  642. size_t i;
  643. SSL_CERT_LOOKUP lu;
  644. if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_sigalgs, ctx))
  645. return 0;
  646. /* now populate ctx->ssl_cert_info */
  647. if (ctx->sigalg_list_len > 0) {
  648. ctx->ssl_cert_info = OPENSSL_zalloc(sizeof(lu) * ctx->sigalg_list_len);
  649. if (ctx->ssl_cert_info == NULL)
  650. return 0;
  651. for(i = 0; i < ctx->sigalg_list_len; i++) {
  652. ctx->ssl_cert_info[i].nid = OBJ_txt2nid(ctx->sigalg_list[i].sigalg_name);
  653. ctx->ssl_cert_info[i].amask = SSL_aANY;
  654. }
  655. }
  656. /*
  657. * For now, leave it at this: legacy sigalgs stay in their own
  658. * data structures until "legacy cleanup" occurs.
  659. */
  660. return 1;
  661. }
  662. static uint16_t tls1_group_name2id(SSL_CTX *ctx, const char *name)
  663. {
  664. size_t i;
  665. for (i = 0; i < ctx->group_list_len; i++) {
  666. if (strcmp(ctx->group_list[i].tlsname, name) == 0
  667. || strcmp(ctx->group_list[i].realname, name) == 0)
  668. return ctx->group_list[i].group_id;
  669. }
  670. return 0;
  671. }
  672. const TLS_GROUP_INFO *tls1_group_id_lookup(SSL_CTX *ctx, uint16_t group_id)
  673. {
  674. size_t i;
  675. for (i = 0; i < ctx->group_list_len; i++) {
  676. if (ctx->group_list[i].group_id == group_id)
  677. return &ctx->group_list[i];
  678. }
  679. return NULL;
  680. }
  681. const char *tls1_group_id2name(SSL_CTX *ctx, uint16_t group_id)
  682. {
  683. const TLS_GROUP_INFO *tls_group_info = tls1_group_id_lookup(ctx, group_id);
  684. if (tls_group_info == NULL)
  685. return NULL;
  686. return tls_group_info->tlsname;
  687. }
  688. int tls1_group_id2nid(uint16_t group_id, int include_unknown)
  689. {
  690. size_t i;
  691. if (group_id == 0)
  692. return NID_undef;
  693. /*
  694. * Return well known Group NIDs - for backwards compatibility. This won't
  695. * work for groups we don't know about.
  696. */
  697. for (i = 0; i < OSSL_NELEM(nid_to_group); i++)
  698. {
  699. if (nid_to_group[i].group_id == group_id)
  700. return nid_to_group[i].nid;
  701. }
  702. if (!include_unknown)
  703. return NID_undef;
  704. return TLSEXT_nid_unknown | (int)group_id;
  705. }
  706. uint16_t tls1_nid2group_id(int nid)
  707. {
  708. size_t i;
  709. /*
  710. * Return well known Group ids - for backwards compatibility. This won't
  711. * work for groups we don't know about.
  712. */
  713. for (i = 0; i < OSSL_NELEM(nid_to_group); i++)
  714. {
  715. if (nid_to_group[i].nid == nid)
  716. return nid_to_group[i].group_id;
  717. }
  718. return 0;
  719. }
  720. /*
  721. * Set *pgroups to the supported groups list and *pgroupslen to
  722. * the number of groups supported.
  723. */
  724. void tls1_get_supported_groups(SSL_CONNECTION *s, const uint16_t **pgroups,
  725. size_t *pgroupslen)
  726. {
  727. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  728. /* For Suite B mode only include P-256, P-384 */
  729. switch (tls1_suiteb(s)) {
  730. case SSL_CERT_FLAG_SUITEB_128_LOS:
  731. *pgroups = suiteb_curves;
  732. *pgroupslen = OSSL_NELEM(suiteb_curves);
  733. break;
  734. case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
  735. *pgroups = suiteb_curves;
  736. *pgroupslen = 1;
  737. break;
  738. case SSL_CERT_FLAG_SUITEB_192_LOS:
  739. *pgroups = suiteb_curves + 1;
  740. *pgroupslen = 1;
  741. break;
  742. default:
  743. if (s->ext.supportedgroups == NULL) {
  744. *pgroups = sctx->ext.supported_groups_default;
  745. *pgroupslen = sctx->ext.supported_groups_default_len;
  746. } else {
  747. *pgroups = s->ext.supportedgroups;
  748. *pgroupslen = s->ext.supportedgroups_len;
  749. }
  750. break;
  751. }
  752. }
  753. int tls_valid_group(SSL_CONNECTION *s, uint16_t group_id,
  754. int minversion, int maxversion,
  755. int isec, int *okfortls13)
  756. {
  757. const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
  758. group_id);
  759. int ret;
  760. if (okfortls13 != NULL)
  761. *okfortls13 = 0;
  762. if (ginfo == NULL)
  763. return 0;
  764. if (SSL_CONNECTION_IS_DTLS(s)) {
  765. if (ginfo->mindtls < 0 || ginfo->maxdtls < 0)
  766. return 0;
  767. if (ginfo->maxdtls == 0)
  768. ret = 1;
  769. else
  770. ret = DTLS_VERSION_LE(minversion, ginfo->maxdtls);
  771. if (ginfo->mindtls > 0)
  772. ret &= DTLS_VERSION_GE(maxversion, ginfo->mindtls);
  773. } else {
  774. if (ginfo->mintls < 0 || ginfo->maxtls < 0)
  775. return 0;
  776. if (ginfo->maxtls == 0)
  777. ret = 1;
  778. else
  779. ret = (minversion <= ginfo->maxtls);
  780. if (ginfo->mintls > 0)
  781. ret &= (maxversion >= ginfo->mintls);
  782. if (ret && okfortls13 != NULL && maxversion == TLS1_3_VERSION)
  783. *okfortls13 = (ginfo->maxtls == 0)
  784. || (ginfo->maxtls >= TLS1_3_VERSION);
  785. }
  786. ret &= !isec
  787. || strcmp(ginfo->algorithm, "EC") == 0
  788. || strcmp(ginfo->algorithm, "X25519") == 0
  789. || strcmp(ginfo->algorithm, "X448") == 0;
  790. return ret;
  791. }
  792. /* See if group is allowed by security callback */
  793. int tls_group_allowed(SSL_CONNECTION *s, uint16_t group, int op)
  794. {
  795. const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
  796. group);
  797. unsigned char gtmp[2];
  798. if (ginfo == NULL)
  799. return 0;
  800. gtmp[0] = group >> 8;
  801. gtmp[1] = group & 0xff;
  802. return ssl_security(s, op, ginfo->secbits,
  803. tls1_group_id2nid(ginfo->group_id, 0), (void *)gtmp);
  804. }
  805. /* Return 1 if "id" is in "list" */
  806. static int tls1_in_list(uint16_t id, const uint16_t *list, size_t listlen)
  807. {
  808. size_t i;
  809. for (i = 0; i < listlen; i++)
  810. if (list[i] == id)
  811. return 1;
  812. return 0;
  813. }
  814. /*-
  815. * For nmatch >= 0, return the id of the |nmatch|th shared group or 0
  816. * if there is no match.
  817. * For nmatch == -1, return number of matches
  818. * For nmatch == -2, return the id of the group to use for
  819. * a tmp key, or 0 if there is no match.
  820. */
  821. uint16_t tls1_shared_group(SSL_CONNECTION *s, int nmatch)
  822. {
  823. const uint16_t *pref, *supp;
  824. size_t num_pref, num_supp, i;
  825. int k;
  826. SSL_CTX *ctx = SSL_CONNECTION_GET_CTX(s);
  827. /* Can't do anything on client side */
  828. if (s->server == 0)
  829. return 0;
  830. if (nmatch == -2) {
  831. if (tls1_suiteb(s)) {
  832. /*
  833. * For Suite B ciphersuite determines curve: we already know
  834. * these are acceptable due to previous checks.
  835. */
  836. unsigned long cid = s->s3.tmp.new_cipher->id;
  837. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
  838. return OSSL_TLS_GROUP_ID_secp256r1;
  839. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
  840. return OSSL_TLS_GROUP_ID_secp384r1;
  841. /* Should never happen */
  842. return 0;
  843. }
  844. /* If not Suite B just return first preference shared curve */
  845. nmatch = 0;
  846. }
  847. /*
  848. * If server preference set, our groups are the preference order
  849. * otherwise peer decides.
  850. */
  851. if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
  852. tls1_get_supported_groups(s, &pref, &num_pref);
  853. tls1_get_peer_groups(s, &supp, &num_supp);
  854. } else {
  855. tls1_get_peer_groups(s, &pref, &num_pref);
  856. tls1_get_supported_groups(s, &supp, &num_supp);
  857. }
  858. for (k = 0, i = 0; i < num_pref; i++) {
  859. uint16_t id = pref[i];
  860. const TLS_GROUP_INFO *inf;
  861. if (!tls1_in_list(id, supp, num_supp)
  862. || !tls_group_allowed(s, id, SSL_SECOP_CURVE_SHARED))
  863. continue;
  864. inf = tls1_group_id_lookup(ctx, id);
  865. if (!ossl_assert(inf != NULL))
  866. return 0;
  867. if (SSL_CONNECTION_IS_DTLS(s)) {
  868. if (inf->maxdtls == -1)
  869. continue;
  870. if ((inf->mindtls != 0 && DTLS_VERSION_LT(s->version, inf->mindtls))
  871. || (inf->maxdtls != 0
  872. && DTLS_VERSION_GT(s->version, inf->maxdtls)))
  873. continue;
  874. } else {
  875. if (inf->maxtls == -1)
  876. continue;
  877. if ((inf->mintls != 0 && s->version < inf->mintls)
  878. || (inf->maxtls != 0 && s->version > inf->maxtls))
  879. continue;
  880. }
  881. if (nmatch == k)
  882. return id;
  883. k++;
  884. }
  885. if (nmatch == -1)
  886. return k;
  887. /* Out of range (nmatch > k). */
  888. return 0;
  889. }
  890. int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  891. int *groups, size_t ngroups)
  892. {
  893. uint16_t *glist;
  894. size_t i;
  895. /*
  896. * Bitmap of groups included to detect duplicates: two variables are added
  897. * to detect duplicates as some values are more than 32.
  898. */
  899. unsigned long *dup_list = NULL;
  900. unsigned long dup_list_egrp = 0;
  901. unsigned long dup_list_dhgrp = 0;
  902. if (ngroups == 0) {
  903. ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
  904. return 0;
  905. }
  906. if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL)
  907. return 0;
  908. for (i = 0; i < ngroups; i++) {
  909. unsigned long idmask;
  910. uint16_t id;
  911. id = tls1_nid2group_id(groups[i]);
  912. if ((id & 0x00FF) >= (sizeof(unsigned long) * 8))
  913. goto err;
  914. idmask = 1L << (id & 0x00FF);
  915. dup_list = (id < 0x100) ? &dup_list_egrp : &dup_list_dhgrp;
  916. if (!id || ((*dup_list) & idmask))
  917. goto err;
  918. *dup_list |= idmask;
  919. glist[i] = id;
  920. }
  921. OPENSSL_free(*pext);
  922. *pext = glist;
  923. *pextlen = ngroups;
  924. return 1;
  925. err:
  926. OPENSSL_free(glist);
  927. return 0;
  928. }
  929. # define GROUPLIST_INCREMENT 40
  930. # define GROUP_NAME_BUFFER_LENGTH 64
  931. typedef struct {
  932. SSL_CTX *ctx;
  933. size_t gidcnt;
  934. size_t gidmax;
  935. uint16_t *gid_arr;
  936. } gid_cb_st;
  937. static int gid_cb(const char *elem, int len, void *arg)
  938. {
  939. gid_cb_st *garg = arg;
  940. size_t i;
  941. uint16_t gid = 0;
  942. char etmp[GROUP_NAME_BUFFER_LENGTH];
  943. if (elem == NULL)
  944. return 0;
  945. if (garg->gidcnt == garg->gidmax) {
  946. uint16_t *tmp =
  947. OPENSSL_realloc(garg->gid_arr, garg->gidmax + GROUPLIST_INCREMENT);
  948. if (tmp == NULL)
  949. return 0;
  950. garg->gidmax += GROUPLIST_INCREMENT;
  951. garg->gid_arr = tmp;
  952. }
  953. if (len > (int)(sizeof(etmp) - 1))
  954. return 0;
  955. memcpy(etmp, elem, len);
  956. etmp[len] = 0;
  957. gid = tls1_group_name2id(garg->ctx, etmp);
  958. if (gid == 0) {
  959. ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT,
  960. "group '%s' cannot be set", etmp);
  961. return 0;
  962. }
  963. for (i = 0; i < garg->gidcnt; i++)
  964. if (garg->gid_arr[i] == gid)
  965. return 0;
  966. garg->gid_arr[garg->gidcnt++] = gid;
  967. return 1;
  968. }
  969. /* Set groups based on a colon separated list */
  970. int tls1_set_groups_list(SSL_CTX *ctx, uint16_t **pext, size_t *pextlen,
  971. const char *str)
  972. {
  973. gid_cb_st gcb;
  974. uint16_t *tmparr;
  975. int ret = 0;
  976. gcb.gidcnt = 0;
  977. gcb.gidmax = GROUPLIST_INCREMENT;
  978. gcb.gid_arr = OPENSSL_malloc(gcb.gidmax * sizeof(*gcb.gid_arr));
  979. if (gcb.gid_arr == NULL)
  980. return 0;
  981. gcb.ctx = ctx;
  982. if (!CONF_parse_list(str, ':', 1, gid_cb, &gcb))
  983. goto end;
  984. if (pext == NULL) {
  985. ret = 1;
  986. goto end;
  987. }
  988. /*
  989. * gid_cb ensurse there are no duplicates so we can just go ahead and set
  990. * the result
  991. */
  992. tmparr = OPENSSL_memdup(gcb.gid_arr, gcb.gidcnt * sizeof(*tmparr));
  993. if (tmparr == NULL)
  994. goto end;
  995. OPENSSL_free(*pext);
  996. *pext = tmparr;
  997. *pextlen = gcb.gidcnt;
  998. ret = 1;
  999. end:
  1000. OPENSSL_free(gcb.gid_arr);
  1001. return ret;
  1002. }
  1003. /* Check a group id matches preferences */
  1004. int tls1_check_group_id(SSL_CONNECTION *s, uint16_t group_id,
  1005. int check_own_groups)
  1006. {
  1007. const uint16_t *groups;
  1008. size_t groups_len;
  1009. if (group_id == 0)
  1010. return 0;
  1011. /* Check for Suite B compliance */
  1012. if (tls1_suiteb(s) && s->s3.tmp.new_cipher != NULL) {
  1013. unsigned long cid = s->s3.tmp.new_cipher->id;
  1014. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) {
  1015. if (group_id != OSSL_TLS_GROUP_ID_secp256r1)
  1016. return 0;
  1017. } else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) {
  1018. if (group_id != OSSL_TLS_GROUP_ID_secp384r1)
  1019. return 0;
  1020. } else {
  1021. /* Should never happen */
  1022. return 0;
  1023. }
  1024. }
  1025. if (check_own_groups) {
  1026. /* Check group is one of our preferences */
  1027. tls1_get_supported_groups(s, &groups, &groups_len);
  1028. if (!tls1_in_list(group_id, groups, groups_len))
  1029. return 0;
  1030. }
  1031. if (!tls_group_allowed(s, group_id, SSL_SECOP_CURVE_CHECK))
  1032. return 0;
  1033. /* For clients, nothing more to check */
  1034. if (!s->server)
  1035. return 1;
  1036. /* Check group is one of peers preferences */
  1037. tls1_get_peer_groups(s, &groups, &groups_len);
  1038. /*
  1039. * RFC 4492 does not require the supported elliptic curves extension
  1040. * so if it is not sent we can just choose any curve.
  1041. * It is invalid to send an empty list in the supported groups
  1042. * extension, so groups_len == 0 always means no extension.
  1043. */
  1044. if (groups_len == 0)
  1045. return 1;
  1046. return tls1_in_list(group_id, groups, groups_len);
  1047. }
  1048. void tls1_get_formatlist(SSL_CONNECTION *s, const unsigned char **pformats,
  1049. size_t *num_formats)
  1050. {
  1051. /*
  1052. * If we have a custom point format list use it otherwise use default
  1053. */
  1054. if (s->ext.ecpointformats) {
  1055. *pformats = s->ext.ecpointformats;
  1056. *num_formats = s->ext.ecpointformats_len;
  1057. } else {
  1058. *pformats = ecformats_default;
  1059. /* For Suite B we don't support char2 fields */
  1060. if (tls1_suiteb(s))
  1061. *num_formats = sizeof(ecformats_default) - 1;
  1062. else
  1063. *num_formats = sizeof(ecformats_default);
  1064. }
  1065. }
  1066. /* Check a key is compatible with compression extension */
  1067. static int tls1_check_pkey_comp(SSL_CONNECTION *s, EVP_PKEY *pkey)
  1068. {
  1069. unsigned char comp_id;
  1070. size_t i;
  1071. int point_conv;
  1072. /* If not an EC key nothing to check */
  1073. if (!EVP_PKEY_is_a(pkey, "EC"))
  1074. return 1;
  1075. /* Get required compression id */
  1076. point_conv = EVP_PKEY_get_ec_point_conv_form(pkey);
  1077. if (point_conv == 0)
  1078. return 0;
  1079. if (point_conv == POINT_CONVERSION_UNCOMPRESSED) {
  1080. comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
  1081. } else if (SSL_CONNECTION_IS_TLS13(s)) {
  1082. /*
  1083. * ec_point_formats extension is not used in TLSv1.3 so we ignore
  1084. * this check.
  1085. */
  1086. return 1;
  1087. } else {
  1088. int field_type = EVP_PKEY_get_field_type(pkey);
  1089. if (field_type == NID_X9_62_prime_field)
  1090. comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
  1091. else if (field_type == NID_X9_62_characteristic_two_field)
  1092. comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
  1093. else
  1094. return 0;
  1095. }
  1096. /*
  1097. * If point formats extension present check it, otherwise everything is
  1098. * supported (see RFC4492).
  1099. */
  1100. if (s->ext.peer_ecpointformats == NULL)
  1101. return 1;
  1102. for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
  1103. if (s->ext.peer_ecpointformats[i] == comp_id)
  1104. return 1;
  1105. }
  1106. return 0;
  1107. }
  1108. /* Return group id of a key */
  1109. static uint16_t tls1_get_group_id(EVP_PKEY *pkey)
  1110. {
  1111. int curve_nid = ssl_get_EC_curve_nid(pkey);
  1112. if (curve_nid == NID_undef)
  1113. return 0;
  1114. return tls1_nid2group_id(curve_nid);
  1115. }
  1116. /*
  1117. * Check cert parameters compatible with extensions: currently just checks EC
  1118. * certificates have compatible curves and compression.
  1119. */
  1120. static int tls1_check_cert_param(SSL_CONNECTION *s, X509 *x, int check_ee_md)
  1121. {
  1122. uint16_t group_id;
  1123. EVP_PKEY *pkey;
  1124. pkey = X509_get0_pubkey(x);
  1125. if (pkey == NULL)
  1126. return 0;
  1127. /* If not EC nothing to do */
  1128. if (!EVP_PKEY_is_a(pkey, "EC"))
  1129. return 1;
  1130. /* Check compression */
  1131. if (!tls1_check_pkey_comp(s, pkey))
  1132. return 0;
  1133. group_id = tls1_get_group_id(pkey);
  1134. /*
  1135. * For a server we allow the certificate to not be in our list of supported
  1136. * groups.
  1137. */
  1138. if (!tls1_check_group_id(s, group_id, !s->server))
  1139. return 0;
  1140. /*
  1141. * Special case for suite B. We *MUST* sign using SHA256+P-256 or
  1142. * SHA384+P-384.
  1143. */
  1144. if (check_ee_md && tls1_suiteb(s)) {
  1145. int check_md;
  1146. size_t i;
  1147. /* Check to see we have necessary signing algorithm */
  1148. if (group_id == OSSL_TLS_GROUP_ID_secp256r1)
  1149. check_md = NID_ecdsa_with_SHA256;
  1150. else if (group_id == OSSL_TLS_GROUP_ID_secp384r1)
  1151. check_md = NID_ecdsa_with_SHA384;
  1152. else
  1153. return 0; /* Should never happen */
  1154. for (i = 0; i < s->shared_sigalgslen; i++) {
  1155. if (check_md == s->shared_sigalgs[i]->sigandhash)
  1156. return 1;
  1157. }
  1158. return 0;
  1159. }
  1160. return 1;
  1161. }
  1162. /*
  1163. * tls1_check_ec_tmp_key - Check EC temporary key compatibility
  1164. * @s: SSL connection
  1165. * @cid: Cipher ID we're considering using
  1166. *
  1167. * Checks that the kECDHE cipher suite we're considering using
  1168. * is compatible with the client extensions.
  1169. *
  1170. * Returns 0 when the cipher can't be used or 1 when it can.
  1171. */
  1172. int tls1_check_ec_tmp_key(SSL_CONNECTION *s, unsigned long cid)
  1173. {
  1174. /* If not Suite B just need a shared group */
  1175. if (!tls1_suiteb(s))
  1176. return tls1_shared_group(s, 0) != 0;
  1177. /*
  1178. * If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384, no other
  1179. * curves permitted.
  1180. */
  1181. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
  1182. return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp256r1, 1);
  1183. if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
  1184. return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp384r1, 1);
  1185. return 0;
  1186. }
  1187. /* Default sigalg schemes */
  1188. static const uint16_t tls12_sigalgs[] = {
  1189. TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
  1190. TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
  1191. TLSEXT_SIGALG_ecdsa_secp521r1_sha512,
  1192. TLSEXT_SIGALG_ed25519,
  1193. TLSEXT_SIGALG_ed448,
  1194. TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256,
  1195. TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384,
  1196. TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512,
  1197. TLSEXT_SIGALG_rsa_pss_pss_sha256,
  1198. TLSEXT_SIGALG_rsa_pss_pss_sha384,
  1199. TLSEXT_SIGALG_rsa_pss_pss_sha512,
  1200. TLSEXT_SIGALG_rsa_pss_rsae_sha256,
  1201. TLSEXT_SIGALG_rsa_pss_rsae_sha384,
  1202. TLSEXT_SIGALG_rsa_pss_rsae_sha512,
  1203. TLSEXT_SIGALG_rsa_pkcs1_sha256,
  1204. TLSEXT_SIGALG_rsa_pkcs1_sha384,
  1205. TLSEXT_SIGALG_rsa_pkcs1_sha512,
  1206. TLSEXT_SIGALG_ecdsa_sha224,
  1207. TLSEXT_SIGALG_ecdsa_sha1,
  1208. TLSEXT_SIGALG_rsa_pkcs1_sha224,
  1209. TLSEXT_SIGALG_rsa_pkcs1_sha1,
  1210. TLSEXT_SIGALG_dsa_sha224,
  1211. TLSEXT_SIGALG_dsa_sha1,
  1212. TLSEXT_SIGALG_dsa_sha256,
  1213. TLSEXT_SIGALG_dsa_sha384,
  1214. TLSEXT_SIGALG_dsa_sha512,
  1215. #ifndef OPENSSL_NO_GOST
  1216. TLSEXT_SIGALG_gostr34102012_256_intrinsic,
  1217. TLSEXT_SIGALG_gostr34102012_512_intrinsic,
  1218. TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
  1219. TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
  1220. TLSEXT_SIGALG_gostr34102001_gostr3411,
  1221. #endif
  1222. };
  1223. static const uint16_t suiteb_sigalgs[] = {
  1224. TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
  1225. TLSEXT_SIGALG_ecdsa_secp384r1_sha384
  1226. };
  1227. static const SIGALG_LOOKUP sigalg_lookup_tbl[] = {
  1228. {"ecdsa_secp256r1_sha256", TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
  1229. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1230. NID_ecdsa_with_SHA256, NID_X9_62_prime256v1, 1},
  1231. {"ecdsa_secp384r1_sha384", TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
  1232. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1233. NID_ecdsa_with_SHA384, NID_secp384r1, 1},
  1234. {"ecdsa_secp521r1_sha512", TLSEXT_SIGALG_ecdsa_secp521r1_sha512,
  1235. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1236. NID_ecdsa_with_SHA512, NID_secp521r1, 1},
  1237. {"ed25519", TLSEXT_SIGALG_ed25519,
  1238. NID_undef, -1, EVP_PKEY_ED25519, SSL_PKEY_ED25519,
  1239. NID_undef, NID_undef, 1},
  1240. {"ed448", TLSEXT_SIGALG_ed448,
  1241. NID_undef, -1, EVP_PKEY_ED448, SSL_PKEY_ED448,
  1242. NID_undef, NID_undef, 1},
  1243. {NULL, TLSEXT_SIGALG_ecdsa_sha224,
  1244. NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1245. NID_ecdsa_with_SHA224, NID_undef, 1},
  1246. {NULL, TLSEXT_SIGALG_ecdsa_sha1,
  1247. NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1248. NID_ecdsa_with_SHA1, NID_undef, 1},
  1249. {"ecdsa_brainpoolP256r1_sha256", TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256,
  1250. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1251. NID_ecdsa_with_SHA256, NID_brainpoolP256r1, 1},
  1252. {"ecdsa_brainpoolP384r1_sha384", TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384,
  1253. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1254. NID_ecdsa_with_SHA384, NID_brainpoolP384r1, 1},
  1255. {"ecdsa_brainpoolP512r1_sha512", TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512,
  1256. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
  1257. NID_ecdsa_with_SHA512, NID_brainpoolP512r1, 1},
  1258. {"rsa_pss_rsae_sha256", TLSEXT_SIGALG_rsa_pss_rsae_sha256,
  1259. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
  1260. NID_undef, NID_undef, 1},
  1261. {"rsa_pss_rsae_sha384", TLSEXT_SIGALG_rsa_pss_rsae_sha384,
  1262. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
  1263. NID_undef, NID_undef, 1},
  1264. {"rsa_pss_rsae_sha512", TLSEXT_SIGALG_rsa_pss_rsae_sha512,
  1265. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
  1266. NID_undef, NID_undef, 1},
  1267. {"rsa_pss_pss_sha256", TLSEXT_SIGALG_rsa_pss_pss_sha256,
  1268. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
  1269. NID_undef, NID_undef, 1},
  1270. {"rsa_pss_pss_sha384", TLSEXT_SIGALG_rsa_pss_pss_sha384,
  1271. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
  1272. NID_undef, NID_undef, 1},
  1273. {"rsa_pss_pss_sha512", TLSEXT_SIGALG_rsa_pss_pss_sha512,
  1274. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
  1275. NID_undef, NID_undef, 1},
  1276. {"rsa_pkcs1_sha256", TLSEXT_SIGALG_rsa_pkcs1_sha256,
  1277. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1278. NID_sha256WithRSAEncryption, NID_undef, 1},
  1279. {"rsa_pkcs1_sha384", TLSEXT_SIGALG_rsa_pkcs1_sha384,
  1280. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1281. NID_sha384WithRSAEncryption, NID_undef, 1},
  1282. {"rsa_pkcs1_sha512", TLSEXT_SIGALG_rsa_pkcs1_sha512,
  1283. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1284. NID_sha512WithRSAEncryption, NID_undef, 1},
  1285. {"rsa_pkcs1_sha224", TLSEXT_SIGALG_rsa_pkcs1_sha224,
  1286. NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1287. NID_sha224WithRSAEncryption, NID_undef, 1},
  1288. {"rsa_pkcs1_sha1", TLSEXT_SIGALG_rsa_pkcs1_sha1,
  1289. NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
  1290. NID_sha1WithRSAEncryption, NID_undef, 1},
  1291. {NULL, TLSEXT_SIGALG_dsa_sha256,
  1292. NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1293. NID_dsa_with_SHA256, NID_undef, 1},
  1294. {NULL, TLSEXT_SIGALG_dsa_sha384,
  1295. NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1296. NID_undef, NID_undef, 1},
  1297. {NULL, TLSEXT_SIGALG_dsa_sha512,
  1298. NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1299. NID_undef, NID_undef, 1},
  1300. {NULL, TLSEXT_SIGALG_dsa_sha224,
  1301. NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1302. NID_undef, NID_undef, 1},
  1303. {NULL, TLSEXT_SIGALG_dsa_sha1,
  1304. NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
  1305. NID_dsaWithSHA1, NID_undef, 1},
  1306. #ifndef OPENSSL_NO_GOST
  1307. {NULL, TLSEXT_SIGALG_gostr34102012_256_intrinsic,
  1308. NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX,
  1309. NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256,
  1310. NID_undef, NID_undef, 1},
  1311. {NULL, TLSEXT_SIGALG_gostr34102012_512_intrinsic,
  1312. NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX,
  1313. NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512,
  1314. NID_undef, NID_undef, 1},
  1315. {NULL, TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
  1316. NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX,
  1317. NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256,
  1318. NID_undef, NID_undef, 1},
  1319. {NULL, TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
  1320. NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX,
  1321. NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512,
  1322. NID_undef, NID_undef, 1},
  1323. {NULL, TLSEXT_SIGALG_gostr34102001_gostr3411,
  1324. NID_id_GostR3411_94, SSL_MD_GOST94_IDX,
  1325. NID_id_GostR3410_2001, SSL_PKEY_GOST01,
  1326. NID_undef, NID_undef, 1}
  1327. #endif
  1328. };
  1329. /* Legacy sigalgs for TLS < 1.2 RSA TLS signatures */
  1330. static const SIGALG_LOOKUP legacy_rsa_sigalg = {
  1331. "rsa_pkcs1_md5_sha1", 0,
  1332. NID_md5_sha1, SSL_MD_MD5_SHA1_IDX,
  1333. EVP_PKEY_RSA, SSL_PKEY_RSA,
  1334. NID_undef, NID_undef, 1
  1335. };
  1336. /*
  1337. * Default signature algorithm values used if signature algorithms not present.
  1338. * From RFC5246. Note: order must match certificate index order.
  1339. */
  1340. static const uint16_t tls_default_sigalg[] = {
  1341. TLSEXT_SIGALG_rsa_pkcs1_sha1, /* SSL_PKEY_RSA */
  1342. 0, /* SSL_PKEY_RSA_PSS_SIGN */
  1343. TLSEXT_SIGALG_dsa_sha1, /* SSL_PKEY_DSA_SIGN */
  1344. TLSEXT_SIGALG_ecdsa_sha1, /* SSL_PKEY_ECC */
  1345. TLSEXT_SIGALG_gostr34102001_gostr3411, /* SSL_PKEY_GOST01 */
  1346. TLSEXT_SIGALG_gostr34102012_256_intrinsic, /* SSL_PKEY_GOST12_256 */
  1347. TLSEXT_SIGALG_gostr34102012_512_intrinsic, /* SSL_PKEY_GOST12_512 */
  1348. 0, /* SSL_PKEY_ED25519 */
  1349. 0, /* SSL_PKEY_ED448 */
  1350. };
  1351. int ssl_setup_sigalgs(SSL_CTX *ctx)
  1352. {
  1353. size_t i, cache_idx, sigalgs_len;
  1354. const SIGALG_LOOKUP *lu;
  1355. SIGALG_LOOKUP *cache = NULL;
  1356. uint16_t *tls12_sigalgs_list = NULL;
  1357. EVP_PKEY *tmpkey = EVP_PKEY_new();
  1358. int ret = 0;
  1359. if (ctx == NULL)
  1360. goto err;
  1361. sigalgs_len = OSSL_NELEM(sigalg_lookup_tbl) + ctx->sigalg_list_len;
  1362. cache = OPENSSL_malloc(sizeof(const SIGALG_LOOKUP) * sigalgs_len);
  1363. if (cache == NULL || tmpkey == NULL)
  1364. goto err;
  1365. tls12_sigalgs_list = OPENSSL_malloc(sizeof(uint16_t) * sigalgs_len);
  1366. if (tls12_sigalgs_list == NULL)
  1367. goto err;
  1368. ERR_set_mark();
  1369. /* First fill cache and tls12_sigalgs list from legacy algorithm list */
  1370. for (i = 0, lu = sigalg_lookup_tbl;
  1371. i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
  1372. EVP_PKEY_CTX *pctx;
  1373. cache[i] = *lu;
  1374. tls12_sigalgs_list[i] = tls12_sigalgs[i];
  1375. /*
  1376. * Check hash is available.
  1377. * This test is not perfect. A provider could have support
  1378. * for a signature scheme, but not a particular hash. However the hash
  1379. * could be available from some other loaded provider. In that case it
  1380. * could be that the signature is available, and the hash is available
  1381. * independently - but not as a combination. We ignore this for now.
  1382. */
  1383. if (lu->hash != NID_undef
  1384. && ctx->ssl_digest_methods[lu->hash_idx] == NULL) {
  1385. cache[i].enabled = 0;
  1386. continue;
  1387. }
  1388. if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {
  1389. cache[i].enabled = 0;
  1390. continue;
  1391. }
  1392. pctx = EVP_PKEY_CTX_new_from_pkey(ctx->libctx, tmpkey, ctx->propq);
  1393. /* If unable to create pctx we assume the sig algorithm is unavailable */
  1394. if (pctx == NULL)
  1395. cache[i].enabled = 0;
  1396. EVP_PKEY_CTX_free(pctx);
  1397. }
  1398. /* Now complete cache and tls12_sigalgs list with provider sig information */
  1399. cache_idx = OSSL_NELEM(sigalg_lookup_tbl);
  1400. for (i = 0; i < ctx->sigalg_list_len; i++) {
  1401. TLS_SIGALG_INFO si = ctx->sigalg_list[i];
  1402. cache[cache_idx].name = si.name;
  1403. cache[cache_idx].sigalg = si.code_point;
  1404. tls12_sigalgs_list[cache_idx] = si.code_point;
  1405. cache[cache_idx].hash = si.hash_name?OBJ_txt2nid(si.hash_name):NID_undef;
  1406. cache[cache_idx].hash_idx = ssl_get_md_idx(cache[cache_idx].hash);
  1407. cache[cache_idx].sig = OBJ_txt2nid(si.sigalg_name);
  1408. cache[cache_idx].sig_idx = i + SSL_PKEY_NUM;
  1409. cache[cache_idx].sigandhash = OBJ_txt2nid(si.sigalg_name);
  1410. cache[cache_idx].curve = NID_undef;
  1411. /* all provided sigalgs are enabled by load */
  1412. cache[cache_idx].enabled = 1;
  1413. cache_idx++;
  1414. }
  1415. ERR_pop_to_mark();
  1416. ctx->sigalg_lookup_cache = cache;
  1417. ctx->tls12_sigalgs = tls12_sigalgs_list;
  1418. ctx->tls12_sigalgs_len = sigalgs_len;
  1419. cache = NULL;
  1420. tls12_sigalgs_list = NULL;
  1421. ret = 1;
  1422. err:
  1423. OPENSSL_free(cache);
  1424. OPENSSL_free(tls12_sigalgs_list);
  1425. EVP_PKEY_free(tmpkey);
  1426. return ret;
  1427. }
  1428. /* Lookup TLS signature algorithm */
  1429. static const SIGALG_LOOKUP *tls1_lookup_sigalg(const SSL_CONNECTION *s,
  1430. uint16_t sigalg)
  1431. {
  1432. size_t i;
  1433. const SIGALG_LOOKUP *lu;
  1434. for (i = 0, lu = SSL_CONNECTION_GET_CTX(s)->sigalg_lookup_cache;
  1435. i < SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len;
  1436. lu++, i++) {
  1437. if (lu->sigalg == sigalg) {
  1438. if (!lu->enabled)
  1439. return NULL;
  1440. return lu;
  1441. }
  1442. }
  1443. return NULL;
  1444. }
  1445. /* Lookup hash: return 0 if invalid or not enabled */
  1446. int tls1_lookup_md(SSL_CTX *ctx, const SIGALG_LOOKUP *lu, const EVP_MD **pmd)
  1447. {
  1448. const EVP_MD *md;
  1449. if (lu == NULL)
  1450. return 0;
  1451. /* lu->hash == NID_undef means no associated digest */
  1452. if (lu->hash == NID_undef) {
  1453. md = NULL;
  1454. } else {
  1455. md = ssl_md(ctx, lu->hash_idx);
  1456. if (md == NULL)
  1457. return 0;
  1458. }
  1459. if (pmd)
  1460. *pmd = md;
  1461. return 1;
  1462. }
  1463. /*
  1464. * Check if key is large enough to generate RSA-PSS signature.
  1465. *
  1466. * The key must greater than or equal to 2 * hash length + 2.
  1467. * SHA512 has a hash length of 64 bytes, which is incompatible
  1468. * with a 128 byte (1024 bit) key.
  1469. */
  1470. #define RSA_PSS_MINIMUM_KEY_SIZE(md) (2 * EVP_MD_get_size(md) + 2)
  1471. static int rsa_pss_check_min_key_size(SSL_CTX *ctx, const EVP_PKEY *pkey,
  1472. const SIGALG_LOOKUP *lu)
  1473. {
  1474. const EVP_MD *md;
  1475. if (pkey == NULL)
  1476. return 0;
  1477. if (!tls1_lookup_md(ctx, lu, &md) || md == NULL)
  1478. return 0;
  1479. if (EVP_PKEY_get_size(pkey) < RSA_PSS_MINIMUM_KEY_SIZE(md))
  1480. return 0;
  1481. return 1;
  1482. }
  1483. /*
  1484. * Returns a signature algorithm when the peer did not send a list of supported
  1485. * signature algorithms. The signature algorithm is fixed for the certificate
  1486. * type. |idx| is a certificate type index (SSL_PKEY_*). When |idx| is -1 the
  1487. * certificate type from |s| will be used.
  1488. * Returns the signature algorithm to use, or NULL on error.
  1489. */
  1490. static const SIGALG_LOOKUP *tls1_get_legacy_sigalg(const SSL_CONNECTION *s,
  1491. int idx)
  1492. {
  1493. if (idx == -1) {
  1494. if (s->server) {
  1495. size_t i;
  1496. /* Work out index corresponding to ciphersuite */
  1497. for (i = 0; i < s->ssl_pkey_num; i++) {
  1498. const SSL_CERT_LOOKUP *clu
  1499. = ssl_cert_lookup_by_idx(i, SSL_CONNECTION_GET_CTX(s));
  1500. if (clu == NULL)
  1501. continue;
  1502. if (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) {
  1503. idx = i;
  1504. break;
  1505. }
  1506. }
  1507. /*
  1508. * Some GOST ciphersuites allow more than one signature algorithms
  1509. * */
  1510. if (idx == SSL_PKEY_GOST01 && s->s3.tmp.new_cipher->algorithm_auth != SSL_aGOST01) {
  1511. int real_idx;
  1512. for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01;
  1513. real_idx--) {
  1514. if (s->cert->pkeys[real_idx].privatekey != NULL) {
  1515. idx = real_idx;
  1516. break;
  1517. }
  1518. }
  1519. }
  1520. /*
  1521. * As both SSL_PKEY_GOST12_512 and SSL_PKEY_GOST12_256 indices can be used
  1522. * with new (aGOST12-only) ciphersuites, we should find out which one is available really.
  1523. */
  1524. else if (idx == SSL_PKEY_GOST12_256) {
  1525. int real_idx;
  1526. for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST12_256;
  1527. real_idx--) {
  1528. if (s->cert->pkeys[real_idx].privatekey != NULL) {
  1529. idx = real_idx;
  1530. break;
  1531. }
  1532. }
  1533. }
  1534. } else {
  1535. idx = s->cert->key - s->cert->pkeys;
  1536. }
  1537. }
  1538. if (idx < 0 || idx >= (int)OSSL_NELEM(tls_default_sigalg))
  1539. return NULL;
  1540. if (SSL_USE_SIGALGS(s) || idx != SSL_PKEY_RSA) {
  1541. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, tls_default_sigalg[idx]);
  1542. if (lu == NULL)
  1543. return NULL;
  1544. if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, NULL))
  1545. return NULL;
  1546. if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu))
  1547. return NULL;
  1548. return lu;
  1549. }
  1550. if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, &legacy_rsa_sigalg))
  1551. return NULL;
  1552. return &legacy_rsa_sigalg;
  1553. }
  1554. /* Set peer sigalg based key type */
  1555. int tls1_set_peer_legacy_sigalg(SSL_CONNECTION *s, const EVP_PKEY *pkey)
  1556. {
  1557. size_t idx;
  1558. const SIGALG_LOOKUP *lu;
  1559. if (ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)) == NULL)
  1560. return 0;
  1561. lu = tls1_get_legacy_sigalg(s, idx);
  1562. if (lu == NULL)
  1563. return 0;
  1564. s->s3.tmp.peer_sigalg = lu;
  1565. return 1;
  1566. }
  1567. size_t tls12_get_psigalgs(SSL_CONNECTION *s, int sent, const uint16_t **psigs)
  1568. {
  1569. /*
  1570. * If Suite B mode use Suite B sigalgs only, ignore any other
  1571. * preferences.
  1572. */
  1573. switch (tls1_suiteb(s)) {
  1574. case SSL_CERT_FLAG_SUITEB_128_LOS:
  1575. *psigs = suiteb_sigalgs;
  1576. return OSSL_NELEM(suiteb_sigalgs);
  1577. case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
  1578. *psigs = suiteb_sigalgs;
  1579. return 1;
  1580. case SSL_CERT_FLAG_SUITEB_192_LOS:
  1581. *psigs = suiteb_sigalgs + 1;
  1582. return 1;
  1583. }
  1584. /*
  1585. * We use client_sigalgs (if not NULL) if we're a server
  1586. * and sending a certificate request or if we're a client and
  1587. * determining which shared algorithm to use.
  1588. */
  1589. if ((s->server == sent) && s->cert->client_sigalgs != NULL) {
  1590. *psigs = s->cert->client_sigalgs;
  1591. return s->cert->client_sigalgslen;
  1592. } else if (s->cert->conf_sigalgs) {
  1593. *psigs = s->cert->conf_sigalgs;
  1594. return s->cert->conf_sigalgslen;
  1595. } else {
  1596. *psigs = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs;
  1597. return SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len;
  1598. }
  1599. }
  1600. /*
  1601. * Called by servers only. Checks that we have a sig alg that supports the
  1602. * specified EC curve.
  1603. */
  1604. int tls_check_sigalg_curve(const SSL_CONNECTION *s, int curve)
  1605. {
  1606. const uint16_t *sigs;
  1607. size_t siglen, i;
  1608. if (s->cert->conf_sigalgs) {
  1609. sigs = s->cert->conf_sigalgs;
  1610. siglen = s->cert->conf_sigalgslen;
  1611. } else {
  1612. sigs = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs;
  1613. siglen = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len;
  1614. }
  1615. for (i = 0; i < siglen; i++) {
  1616. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, sigs[i]);
  1617. if (lu == NULL)
  1618. continue;
  1619. if (lu->sig == EVP_PKEY_EC
  1620. && lu->curve != NID_undef
  1621. && curve == lu->curve)
  1622. return 1;
  1623. }
  1624. return 0;
  1625. }
  1626. /*
  1627. * Return the number of security bits for the signature algorithm, or 0 on
  1628. * error.
  1629. */
  1630. static int sigalg_security_bits(SSL_CTX *ctx, const SIGALG_LOOKUP *lu)
  1631. {
  1632. const EVP_MD *md = NULL;
  1633. int secbits = 0;
  1634. if (!tls1_lookup_md(ctx, lu, &md))
  1635. return 0;
  1636. if (md != NULL)
  1637. {
  1638. int md_type = EVP_MD_get_type(md);
  1639. /* Security bits: half digest bits */
  1640. secbits = EVP_MD_get_size(md) * 4;
  1641. /*
  1642. * SHA1 and MD5 are known to be broken. Reduce security bits so that
  1643. * they're no longer accepted at security level 1. The real values don't
  1644. * really matter as long as they're lower than 80, which is our
  1645. * security level 1.
  1646. * https://eprint.iacr.org/2020/014 puts a chosen-prefix attack for
  1647. * SHA1 at 2^63.4 and MD5+SHA1 at 2^67.2
  1648. * https://documents.epfl.ch/users/l/le/lenstra/public/papers/lat.pdf
  1649. * puts a chosen-prefix attack for MD5 at 2^39.
  1650. */
  1651. if (md_type == NID_sha1)
  1652. secbits = 64;
  1653. else if (md_type == NID_md5_sha1)
  1654. secbits = 67;
  1655. else if (md_type == NID_md5)
  1656. secbits = 39;
  1657. } else {
  1658. /* Values from https://tools.ietf.org/html/rfc8032#section-8.5 */
  1659. if (lu->sigalg == TLSEXT_SIGALG_ed25519)
  1660. secbits = 128;
  1661. else if (lu->sigalg == TLSEXT_SIGALG_ed448)
  1662. secbits = 224;
  1663. }
  1664. /*
  1665. * For provider-based sigalgs we have secbits information available
  1666. * in the (provider-loaded) sigalg_list structure
  1667. */
  1668. if ((secbits == 0) && (lu->sig_idx >= SSL_PKEY_NUM)
  1669. && ((lu->sig_idx - SSL_PKEY_NUM) < (int)ctx->sigalg_list_len)) {
  1670. secbits = ctx->sigalg_list[lu->sig_idx - SSL_PKEY_NUM].secbits;
  1671. }
  1672. return secbits;
  1673. }
  1674. /*
  1675. * Check signature algorithm is consistent with sent supported signature
  1676. * algorithms and if so set relevant digest and signature scheme in
  1677. * s.
  1678. */
  1679. int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey)
  1680. {
  1681. const uint16_t *sent_sigs;
  1682. const EVP_MD *md = NULL;
  1683. char sigalgstr[2];
  1684. size_t sent_sigslen, i, cidx;
  1685. int pkeyid = -1;
  1686. const SIGALG_LOOKUP *lu;
  1687. int secbits = 0;
  1688. pkeyid = EVP_PKEY_get_id(pkey);
  1689. if (SSL_CONNECTION_IS_TLS13(s)) {
  1690. /* Disallow DSA for TLS 1.3 */
  1691. if (pkeyid == EVP_PKEY_DSA) {
  1692. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
  1693. return 0;
  1694. }
  1695. /* Only allow PSS for TLS 1.3 */
  1696. if (pkeyid == EVP_PKEY_RSA)
  1697. pkeyid = EVP_PKEY_RSA_PSS;
  1698. }
  1699. lu = tls1_lookup_sigalg(s, sig);
  1700. /* if this sigalg is loaded, set so far unknown pkeyid to its sig NID */
  1701. if ((pkeyid == EVP_PKEY_KEYMGMT) && (lu != NULL))
  1702. pkeyid = lu->sig;
  1703. /* Should never happen */
  1704. if (pkeyid == -1)
  1705. return -1;
  1706. /*
  1707. * Check sigalgs is known. Disallow SHA1/SHA224 with TLS 1.3. Check key type
  1708. * is consistent with signature: RSA keys can be used for RSA-PSS
  1709. */
  1710. if (lu == NULL
  1711. || (SSL_CONNECTION_IS_TLS13(s)
  1712. && (lu->hash == NID_sha1 || lu->hash == NID_sha224))
  1713. || (pkeyid != lu->sig
  1714. && (lu->sig != EVP_PKEY_RSA_PSS || pkeyid != EVP_PKEY_RSA))) {
  1715. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
  1716. return 0;
  1717. }
  1718. /* Check the sigalg is consistent with the key OID */
  1719. if (!ssl_cert_lookup_by_nid(
  1720. (pkeyid == EVP_PKEY_RSA_PSS) ? EVP_PKEY_get_id(pkey) : pkeyid,
  1721. &cidx, SSL_CONNECTION_GET_CTX(s))
  1722. || lu->sig_idx != (int)cidx) {
  1723. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
  1724. return 0;
  1725. }
  1726. if (pkeyid == EVP_PKEY_EC) {
  1727. /* Check point compression is permitted */
  1728. if (!tls1_check_pkey_comp(s, pkey)) {
  1729. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
  1730. SSL_R_ILLEGAL_POINT_COMPRESSION);
  1731. return 0;
  1732. }
  1733. /* For TLS 1.3 or Suite B check curve matches signature algorithm */
  1734. if (SSL_CONNECTION_IS_TLS13(s) || tls1_suiteb(s)) {
  1735. int curve = ssl_get_EC_curve_nid(pkey);
  1736. if (lu->curve != NID_undef && curve != lu->curve) {
  1737. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
  1738. return 0;
  1739. }
  1740. }
  1741. if (!SSL_CONNECTION_IS_TLS13(s)) {
  1742. /* Check curve matches extensions */
  1743. if (!tls1_check_group_id(s, tls1_get_group_id(pkey), 1)) {
  1744. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
  1745. return 0;
  1746. }
  1747. if (tls1_suiteb(s)) {
  1748. /* Check sigalg matches a permissible Suite B value */
  1749. if (sig != TLSEXT_SIGALG_ecdsa_secp256r1_sha256
  1750. && sig != TLSEXT_SIGALG_ecdsa_secp384r1_sha384) {
  1751. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  1752. SSL_R_WRONG_SIGNATURE_TYPE);
  1753. return 0;
  1754. }
  1755. }
  1756. }
  1757. } else if (tls1_suiteb(s)) {
  1758. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
  1759. return 0;
  1760. }
  1761. /* Check signature matches a type we sent */
  1762. sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
  1763. for (i = 0; i < sent_sigslen; i++, sent_sigs++) {
  1764. if (sig == *sent_sigs)
  1765. break;
  1766. }
  1767. /* Allow fallback to SHA1 if not strict mode */
  1768. if (i == sent_sigslen && (lu->hash != NID_sha1
  1769. || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)) {
  1770. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
  1771. return 0;
  1772. }
  1773. if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, &md)) {
  1774. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST);
  1775. return 0;
  1776. }
  1777. /*
  1778. * Make sure security callback allows algorithm. For historical
  1779. * reasons we have to pass the sigalg as a two byte char array.
  1780. */
  1781. sigalgstr[0] = (sig >> 8) & 0xff;
  1782. sigalgstr[1] = sig & 0xff;
  1783. secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
  1784. if (secbits == 0 ||
  1785. !ssl_security(s, SSL_SECOP_SIGALG_CHECK, secbits,
  1786. md != NULL ? EVP_MD_get_type(md) : NID_undef,
  1787. (void *)sigalgstr)) {
  1788. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
  1789. return 0;
  1790. }
  1791. /* Store the sigalg the peer uses */
  1792. s->s3.tmp.peer_sigalg = lu;
  1793. return 1;
  1794. }
  1795. int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid)
  1796. {
  1797. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  1798. if (sc == NULL)
  1799. return 0;
  1800. if (sc->s3.tmp.peer_sigalg == NULL)
  1801. return 0;
  1802. *pnid = sc->s3.tmp.peer_sigalg->sig;
  1803. return 1;
  1804. }
  1805. int SSL_get_signature_type_nid(const SSL *s, int *pnid)
  1806. {
  1807. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  1808. if (sc == NULL)
  1809. return 0;
  1810. if (sc->s3.tmp.sigalg == NULL)
  1811. return 0;
  1812. *pnid = sc->s3.tmp.sigalg->sig;
  1813. return 1;
  1814. }
  1815. /*
  1816. * Set a mask of disabled algorithms: an algorithm is disabled if it isn't
  1817. * supported, doesn't appear in supported signature algorithms, isn't supported
  1818. * by the enabled protocol versions or by the security level.
  1819. *
  1820. * This function should only be used for checking which ciphers are supported
  1821. * by the client.
  1822. *
  1823. * Call ssl_cipher_disabled() to check that it's enabled or not.
  1824. */
  1825. int ssl_set_client_disabled(SSL_CONNECTION *s)
  1826. {
  1827. s->s3.tmp.mask_a = 0;
  1828. s->s3.tmp.mask_k = 0;
  1829. ssl_set_sig_mask(&s->s3.tmp.mask_a, s, SSL_SECOP_SIGALG_MASK);
  1830. if (ssl_get_min_max_version(s, &s->s3.tmp.min_ver,
  1831. &s->s3.tmp.max_ver, NULL) != 0)
  1832. return 0;
  1833. #ifndef OPENSSL_NO_PSK
  1834. /* with PSK there must be client callback set */
  1835. if (!s->psk_client_callback) {
  1836. s->s3.tmp.mask_a |= SSL_aPSK;
  1837. s->s3.tmp.mask_k |= SSL_PSK;
  1838. }
  1839. #endif /* OPENSSL_NO_PSK */
  1840. #ifndef OPENSSL_NO_SRP
  1841. if (!(s->srp_ctx.srp_Mask & SSL_kSRP)) {
  1842. s->s3.tmp.mask_a |= SSL_aSRP;
  1843. s->s3.tmp.mask_k |= SSL_kSRP;
  1844. }
  1845. #endif
  1846. return 1;
  1847. }
  1848. /*
  1849. * ssl_cipher_disabled - check that a cipher is disabled or not
  1850. * @s: SSL connection that you want to use the cipher on
  1851. * @c: cipher to check
  1852. * @op: Security check that you want to do
  1853. * @ecdhe: If set to 1 then TLSv1 ECDHE ciphers are also allowed in SSLv3
  1854. *
  1855. * Returns 1 when it's disabled, 0 when enabled.
  1856. */
  1857. int ssl_cipher_disabled(const SSL_CONNECTION *s, const SSL_CIPHER *c,
  1858. int op, int ecdhe)
  1859. {
  1860. if (c->algorithm_mkey & s->s3.tmp.mask_k
  1861. || c->algorithm_auth & s->s3.tmp.mask_a)
  1862. return 1;
  1863. if (s->s3.tmp.max_ver == 0)
  1864. return 1;
  1865. if (SSL_IS_QUIC_HANDSHAKE(s))
  1866. /* For QUIC, only allow these ciphersuites. */
  1867. switch (SSL_CIPHER_get_id(c)) {
  1868. case TLS1_3_CK_AES_128_GCM_SHA256:
  1869. case TLS1_3_CK_AES_256_GCM_SHA384:
  1870. case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
  1871. break;
  1872. default:
  1873. return 1;
  1874. }
  1875. if (!SSL_CONNECTION_IS_DTLS(s)) {
  1876. int min_tls = c->min_tls;
  1877. /*
  1878. * For historical reasons we will allow ECHDE to be selected by a server
  1879. * in SSLv3 if we are a client
  1880. */
  1881. if (min_tls == TLS1_VERSION && ecdhe
  1882. && (c->algorithm_mkey & (SSL_kECDHE | SSL_kECDHEPSK)) != 0)
  1883. min_tls = SSL3_VERSION;
  1884. if ((min_tls > s->s3.tmp.max_ver) || (c->max_tls < s->s3.tmp.min_ver))
  1885. return 1;
  1886. }
  1887. if (SSL_CONNECTION_IS_DTLS(s)
  1888. && (DTLS_VERSION_GT(c->min_dtls, s->s3.tmp.max_ver)
  1889. || DTLS_VERSION_LT(c->max_dtls, s->s3.tmp.min_ver)))
  1890. return 1;
  1891. return !ssl_security(s, op, c->strength_bits, 0, (void *)c);
  1892. }
  1893. int tls_use_ticket(SSL_CONNECTION *s)
  1894. {
  1895. if ((s->options & SSL_OP_NO_TICKET))
  1896. return 0;
  1897. return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
  1898. }
  1899. int tls1_set_server_sigalgs(SSL_CONNECTION *s)
  1900. {
  1901. size_t i;
  1902. /* Clear any shared signature algorithms */
  1903. OPENSSL_free(s->shared_sigalgs);
  1904. s->shared_sigalgs = NULL;
  1905. s->shared_sigalgslen = 0;
  1906. /* Clear certificate validity flags */
  1907. if (s->s3.tmp.valid_flags)
  1908. memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t));
  1909. else
  1910. s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t));
  1911. if (s->s3.tmp.valid_flags == NULL)
  1912. return 0;
  1913. /*
  1914. * If peer sent no signature algorithms check to see if we support
  1915. * the default algorithm for each certificate type
  1916. */
  1917. if (s->s3.tmp.peer_cert_sigalgs == NULL
  1918. && s->s3.tmp.peer_sigalgs == NULL) {
  1919. const uint16_t *sent_sigs;
  1920. size_t sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
  1921. for (i = 0; i < s->ssl_pkey_num; i++) {
  1922. const SIGALG_LOOKUP *lu = tls1_get_legacy_sigalg(s, i);
  1923. size_t j;
  1924. if (lu == NULL)
  1925. continue;
  1926. /* Check default matches a type we sent */
  1927. for (j = 0; j < sent_sigslen; j++) {
  1928. if (lu->sigalg == sent_sigs[j]) {
  1929. s->s3.tmp.valid_flags[i] = CERT_PKEY_SIGN;
  1930. break;
  1931. }
  1932. }
  1933. }
  1934. return 1;
  1935. }
  1936. if (!tls1_process_sigalgs(s)) {
  1937. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  1938. return 0;
  1939. }
  1940. if (s->shared_sigalgs != NULL)
  1941. return 1;
  1942. /* Fatal error if no shared signature algorithms */
  1943. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  1944. SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS);
  1945. return 0;
  1946. }
  1947. /*-
  1948. * Gets the ticket information supplied by the client if any.
  1949. *
  1950. * hello: The parsed ClientHello data
  1951. * ret: (output) on return, if a ticket was decrypted, then this is set to
  1952. * point to the resulting session.
  1953. */
  1954. SSL_TICKET_STATUS tls_get_ticket_from_client(SSL_CONNECTION *s,
  1955. CLIENTHELLO_MSG *hello,
  1956. SSL_SESSION **ret)
  1957. {
  1958. size_t size;
  1959. RAW_EXTENSION *ticketext;
  1960. *ret = NULL;
  1961. s->ext.ticket_expected = 0;
  1962. /*
  1963. * If tickets disabled or not supported by the protocol version
  1964. * (e.g. TLSv1.3) behave as if no ticket present to permit stateful
  1965. * resumption.
  1966. */
  1967. if (s->version <= SSL3_VERSION || !tls_use_ticket(s))
  1968. return SSL_TICKET_NONE;
  1969. ticketext = &hello->pre_proc_exts[TLSEXT_IDX_session_ticket];
  1970. if (!ticketext->present)
  1971. return SSL_TICKET_NONE;
  1972. size = PACKET_remaining(&ticketext->data);
  1973. return tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size,
  1974. hello->session_id, hello->session_id_len, ret);
  1975. }
  1976. /*-
  1977. * tls_decrypt_ticket attempts to decrypt a session ticket.
  1978. *
  1979. * If s->tls_session_secret_cb is set and we're not doing TLSv1.3 then we are
  1980. * expecting a pre-shared key ciphersuite, in which case we have no use for
  1981. * session tickets and one will never be decrypted, nor will
  1982. * s->ext.ticket_expected be set to 1.
  1983. *
  1984. * Side effects:
  1985. * Sets s->ext.ticket_expected to 1 if the server will have to issue
  1986. * a new session ticket to the client because the client indicated support
  1987. * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
  1988. * a session ticket or we couldn't use the one it gave us, or if
  1989. * s->ctx->ext.ticket_key_cb asked to renew the client's ticket.
  1990. * Otherwise, s->ext.ticket_expected is set to 0.
  1991. *
  1992. * etick: points to the body of the session ticket extension.
  1993. * eticklen: the length of the session tickets extension.
  1994. * sess_id: points at the session ID.
  1995. * sesslen: the length of the session ID.
  1996. * psess: (output) on return, if a ticket was decrypted, then this is set to
  1997. * point to the resulting session.
  1998. */
  1999. SSL_TICKET_STATUS tls_decrypt_ticket(SSL_CONNECTION *s,
  2000. const unsigned char *etick,
  2001. size_t eticklen,
  2002. const unsigned char *sess_id,
  2003. size_t sesslen, SSL_SESSION **psess)
  2004. {
  2005. SSL_SESSION *sess = NULL;
  2006. unsigned char *sdec;
  2007. const unsigned char *p;
  2008. int slen, ivlen, renew_ticket = 0, declen;
  2009. SSL_TICKET_STATUS ret = SSL_TICKET_FATAL_ERR_OTHER;
  2010. size_t mlen;
  2011. unsigned char tick_hmac[EVP_MAX_MD_SIZE];
  2012. SSL_HMAC *hctx = NULL;
  2013. EVP_CIPHER_CTX *ctx = NULL;
  2014. SSL_CTX *tctx = s->session_ctx;
  2015. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  2016. if (eticklen == 0) {
  2017. /*
  2018. * The client will accept a ticket but doesn't currently have
  2019. * one (TLSv1.2 and below), or treated as a fatal error in TLSv1.3
  2020. */
  2021. ret = SSL_TICKET_EMPTY;
  2022. goto end;
  2023. }
  2024. if (!SSL_CONNECTION_IS_TLS13(s) && s->ext.session_secret_cb) {
  2025. /*
  2026. * Indicate that the ticket couldn't be decrypted rather than
  2027. * generating the session from ticket now, trigger
  2028. * abbreviated handshake based on external mechanism to
  2029. * calculate the master secret later.
  2030. */
  2031. ret = SSL_TICKET_NO_DECRYPT;
  2032. goto end;
  2033. }
  2034. /* Need at least keyname + iv */
  2035. if (eticklen < TLSEXT_KEYNAME_LENGTH + EVP_MAX_IV_LENGTH) {
  2036. ret = SSL_TICKET_NO_DECRYPT;
  2037. goto end;
  2038. }
  2039. /* Initialize session ticket encryption and HMAC contexts */
  2040. hctx = ssl_hmac_new(tctx);
  2041. if (hctx == NULL) {
  2042. ret = SSL_TICKET_FATAL_ERR_MALLOC;
  2043. goto end;
  2044. }
  2045. ctx = EVP_CIPHER_CTX_new();
  2046. if (ctx == NULL) {
  2047. ret = SSL_TICKET_FATAL_ERR_MALLOC;
  2048. goto end;
  2049. }
  2050. #ifndef OPENSSL_NO_DEPRECATED_3_0
  2051. if (tctx->ext.ticket_key_evp_cb != NULL || tctx->ext.ticket_key_cb != NULL)
  2052. #else
  2053. if (tctx->ext.ticket_key_evp_cb != NULL)
  2054. #endif
  2055. {
  2056. unsigned char *nctick = (unsigned char *)etick;
  2057. int rv = 0;
  2058. if (tctx->ext.ticket_key_evp_cb != NULL)
  2059. rv = tctx->ext.ticket_key_evp_cb(SSL_CONNECTION_GET_SSL(s), nctick,
  2060. nctick + TLSEXT_KEYNAME_LENGTH,
  2061. ctx,
  2062. ssl_hmac_get0_EVP_MAC_CTX(hctx),
  2063. 0);
  2064. #ifndef OPENSSL_NO_DEPRECATED_3_0
  2065. else if (tctx->ext.ticket_key_cb != NULL)
  2066. /* if 0 is returned, write an empty ticket */
  2067. rv = tctx->ext.ticket_key_cb(SSL_CONNECTION_GET_SSL(s), nctick,
  2068. nctick + TLSEXT_KEYNAME_LENGTH,
  2069. ctx, ssl_hmac_get0_HMAC_CTX(hctx), 0);
  2070. #endif
  2071. if (rv < 0) {
  2072. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2073. goto end;
  2074. }
  2075. if (rv == 0) {
  2076. ret = SSL_TICKET_NO_DECRYPT;
  2077. goto end;
  2078. }
  2079. if (rv == 2)
  2080. renew_ticket = 1;
  2081. } else {
  2082. EVP_CIPHER *aes256cbc = NULL;
  2083. /* Check key name matches */
  2084. if (memcmp(etick, tctx->ext.tick_key_name,
  2085. TLSEXT_KEYNAME_LENGTH) != 0) {
  2086. ret = SSL_TICKET_NO_DECRYPT;
  2087. goto end;
  2088. }
  2089. aes256cbc = EVP_CIPHER_fetch(sctx->libctx, "AES-256-CBC",
  2090. sctx->propq);
  2091. if (aes256cbc == NULL
  2092. || ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key,
  2093. sizeof(tctx->ext.secure->tick_hmac_key),
  2094. "SHA256") <= 0
  2095. || EVP_DecryptInit_ex(ctx, aes256cbc, NULL,
  2096. tctx->ext.secure->tick_aes_key,
  2097. etick + TLSEXT_KEYNAME_LENGTH) <= 0) {
  2098. EVP_CIPHER_free(aes256cbc);
  2099. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2100. goto end;
  2101. }
  2102. EVP_CIPHER_free(aes256cbc);
  2103. if (SSL_CONNECTION_IS_TLS13(s))
  2104. renew_ticket = 1;
  2105. }
  2106. /*
  2107. * Attempt to process session ticket, first conduct sanity and integrity
  2108. * checks on ticket.
  2109. */
  2110. mlen = ssl_hmac_size(hctx);
  2111. if (mlen == 0) {
  2112. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2113. goto end;
  2114. }
  2115. ivlen = EVP_CIPHER_CTX_get_iv_length(ctx);
  2116. if (ivlen < 0) {
  2117. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2118. goto end;
  2119. }
  2120. /* Sanity check ticket length: must exceed keyname + IV + HMAC */
  2121. if (eticklen <= TLSEXT_KEYNAME_LENGTH + ivlen + mlen) {
  2122. ret = SSL_TICKET_NO_DECRYPT;
  2123. goto end;
  2124. }
  2125. eticklen -= mlen;
  2126. /* Check HMAC of encrypted ticket */
  2127. if (ssl_hmac_update(hctx, etick, eticklen) <= 0
  2128. || ssl_hmac_final(hctx, tick_hmac, NULL, sizeof(tick_hmac)) <= 0) {
  2129. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2130. goto end;
  2131. }
  2132. if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) {
  2133. ret = SSL_TICKET_NO_DECRYPT;
  2134. goto end;
  2135. }
  2136. /* Attempt to decrypt session data */
  2137. /* Move p after IV to start of encrypted ticket, update length */
  2138. p = etick + TLSEXT_KEYNAME_LENGTH + ivlen;
  2139. eticklen -= TLSEXT_KEYNAME_LENGTH + ivlen;
  2140. sdec = OPENSSL_malloc(eticklen);
  2141. if (sdec == NULL || EVP_DecryptUpdate(ctx, sdec, &slen, p,
  2142. (int)eticklen) <= 0) {
  2143. OPENSSL_free(sdec);
  2144. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2145. goto end;
  2146. }
  2147. if (EVP_DecryptFinal(ctx, sdec + slen, &declen) <= 0) {
  2148. OPENSSL_free(sdec);
  2149. ret = SSL_TICKET_NO_DECRYPT;
  2150. goto end;
  2151. }
  2152. slen += declen;
  2153. p = sdec;
  2154. sess = d2i_SSL_SESSION_ex(NULL, &p, slen, sctx->libctx, sctx->propq);
  2155. slen -= p - sdec;
  2156. OPENSSL_free(sdec);
  2157. if (sess) {
  2158. /* Some additional consistency checks */
  2159. if (slen != 0) {
  2160. SSL_SESSION_free(sess);
  2161. sess = NULL;
  2162. ret = SSL_TICKET_NO_DECRYPT;
  2163. goto end;
  2164. }
  2165. /*
  2166. * The session ID, if non-empty, is used by some clients to detect
  2167. * that the ticket has been accepted. So we copy it to the session
  2168. * structure. If it is empty set length to zero as required by
  2169. * standard.
  2170. */
  2171. if (sesslen) {
  2172. memcpy(sess->session_id, sess_id, sesslen);
  2173. sess->session_id_length = sesslen;
  2174. }
  2175. if (renew_ticket)
  2176. ret = SSL_TICKET_SUCCESS_RENEW;
  2177. else
  2178. ret = SSL_TICKET_SUCCESS;
  2179. goto end;
  2180. }
  2181. ERR_clear_error();
  2182. /*
  2183. * For session parse failure, indicate that we need to send a new ticket.
  2184. */
  2185. ret = SSL_TICKET_NO_DECRYPT;
  2186. end:
  2187. EVP_CIPHER_CTX_free(ctx);
  2188. ssl_hmac_free(hctx);
  2189. /*
  2190. * If set, the decrypt_ticket_cb() is called unless a fatal error was
  2191. * detected above. The callback is responsible for checking |ret| before it
  2192. * performs any action
  2193. */
  2194. if (s->session_ctx->decrypt_ticket_cb != NULL
  2195. && (ret == SSL_TICKET_EMPTY
  2196. || ret == SSL_TICKET_NO_DECRYPT
  2197. || ret == SSL_TICKET_SUCCESS
  2198. || ret == SSL_TICKET_SUCCESS_RENEW)) {
  2199. size_t keyname_len = eticklen;
  2200. int retcb;
  2201. if (keyname_len > TLSEXT_KEYNAME_LENGTH)
  2202. keyname_len = TLSEXT_KEYNAME_LENGTH;
  2203. retcb = s->session_ctx->decrypt_ticket_cb(SSL_CONNECTION_GET_SSL(s),
  2204. sess, etick, keyname_len,
  2205. ret,
  2206. s->session_ctx->ticket_cb_data);
  2207. switch (retcb) {
  2208. case SSL_TICKET_RETURN_ABORT:
  2209. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2210. break;
  2211. case SSL_TICKET_RETURN_IGNORE:
  2212. ret = SSL_TICKET_NONE;
  2213. SSL_SESSION_free(sess);
  2214. sess = NULL;
  2215. break;
  2216. case SSL_TICKET_RETURN_IGNORE_RENEW:
  2217. if (ret != SSL_TICKET_EMPTY && ret != SSL_TICKET_NO_DECRYPT)
  2218. ret = SSL_TICKET_NO_DECRYPT;
  2219. /* else the value of |ret| will already do the right thing */
  2220. SSL_SESSION_free(sess);
  2221. sess = NULL;
  2222. break;
  2223. case SSL_TICKET_RETURN_USE:
  2224. case SSL_TICKET_RETURN_USE_RENEW:
  2225. if (ret != SSL_TICKET_SUCCESS
  2226. && ret != SSL_TICKET_SUCCESS_RENEW)
  2227. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2228. else if (retcb == SSL_TICKET_RETURN_USE)
  2229. ret = SSL_TICKET_SUCCESS;
  2230. else
  2231. ret = SSL_TICKET_SUCCESS_RENEW;
  2232. break;
  2233. default:
  2234. ret = SSL_TICKET_FATAL_ERR_OTHER;
  2235. }
  2236. }
  2237. if (s->ext.session_secret_cb == NULL || SSL_CONNECTION_IS_TLS13(s)) {
  2238. switch (ret) {
  2239. case SSL_TICKET_NO_DECRYPT:
  2240. case SSL_TICKET_SUCCESS_RENEW:
  2241. case SSL_TICKET_EMPTY:
  2242. s->ext.ticket_expected = 1;
  2243. }
  2244. }
  2245. *psess = sess;
  2246. return ret;
  2247. }
  2248. /* Check to see if a signature algorithm is allowed */
  2249. static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op,
  2250. const SIGALG_LOOKUP *lu)
  2251. {
  2252. unsigned char sigalgstr[2];
  2253. int secbits;
  2254. if (lu == NULL || !lu->enabled)
  2255. return 0;
  2256. /* DSA is not allowed in TLS 1.3 */
  2257. if (SSL_CONNECTION_IS_TLS13(s) && lu->sig == EVP_PKEY_DSA)
  2258. return 0;
  2259. /*
  2260. * At some point we should fully axe DSA/etc. in ClientHello as per TLS 1.3
  2261. * spec
  2262. */
  2263. if (!s->server && !SSL_CONNECTION_IS_DTLS(s)
  2264. && s->s3.tmp.min_ver >= TLS1_3_VERSION
  2265. && (lu->sig == EVP_PKEY_DSA || lu->hash_idx == SSL_MD_SHA1_IDX
  2266. || lu->hash_idx == SSL_MD_MD5_IDX
  2267. || lu->hash_idx == SSL_MD_SHA224_IDX))
  2268. return 0;
  2269. /* See if public key algorithm allowed */
  2270. if (ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), lu->sig_idx))
  2271. return 0;
  2272. if (lu->sig == NID_id_GostR3410_2012_256
  2273. || lu->sig == NID_id_GostR3410_2012_512
  2274. || lu->sig == NID_id_GostR3410_2001) {
  2275. /* We never allow GOST sig algs on the server with TLSv1.3 */
  2276. if (s->server && SSL_CONNECTION_IS_TLS13(s))
  2277. return 0;
  2278. if (!s->server
  2279. && SSL_CONNECTION_GET_SSL(s)->method->version == TLS_ANY_VERSION
  2280. && s->s3.tmp.max_ver >= TLS1_3_VERSION) {
  2281. int i, num;
  2282. STACK_OF(SSL_CIPHER) *sk;
  2283. /*
  2284. * We're a client that could negotiate TLSv1.3. We only allow GOST
  2285. * sig algs if we could negotiate TLSv1.2 or below and we have GOST
  2286. * ciphersuites enabled.
  2287. */
  2288. if (s->s3.tmp.min_ver >= TLS1_3_VERSION)
  2289. return 0;
  2290. sk = SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s));
  2291. num = sk != NULL ? sk_SSL_CIPHER_num(sk) : 0;
  2292. for (i = 0; i < num; i++) {
  2293. const SSL_CIPHER *c;
  2294. c = sk_SSL_CIPHER_value(sk, i);
  2295. /* Skip disabled ciphers */
  2296. if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
  2297. continue;
  2298. if ((c->algorithm_mkey & (SSL_kGOST | SSL_kGOST18)) != 0)
  2299. break;
  2300. }
  2301. if (i == num)
  2302. return 0;
  2303. }
  2304. }
  2305. /* Finally see if security callback allows it */
  2306. secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
  2307. sigalgstr[0] = (lu->sigalg >> 8) & 0xff;
  2308. sigalgstr[1] = lu->sigalg & 0xff;
  2309. return ssl_security(s, op, secbits, lu->hash, (void *)sigalgstr);
  2310. }
  2311. /*
  2312. * Get a mask of disabled public key algorithms based on supported signature
  2313. * algorithms. For example if no signature algorithm supports RSA then RSA is
  2314. * disabled.
  2315. */
  2316. void ssl_set_sig_mask(uint32_t *pmask_a, SSL_CONNECTION *s, int op)
  2317. {
  2318. const uint16_t *sigalgs;
  2319. size_t i, sigalgslen;
  2320. uint32_t disabled_mask = SSL_aRSA | SSL_aDSS | SSL_aECDSA;
  2321. /*
  2322. * Go through all signature algorithms seeing if we support any
  2323. * in disabled_mask.
  2324. */
  2325. sigalgslen = tls12_get_psigalgs(s, 1, &sigalgs);
  2326. for (i = 0; i < sigalgslen; i++, sigalgs++) {
  2327. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *sigalgs);
  2328. const SSL_CERT_LOOKUP *clu;
  2329. if (lu == NULL)
  2330. continue;
  2331. clu = ssl_cert_lookup_by_idx(lu->sig_idx,
  2332. SSL_CONNECTION_GET_CTX(s));
  2333. if (clu == NULL)
  2334. continue;
  2335. /* If algorithm is disabled see if we can enable it */
  2336. if ((clu->amask & disabled_mask) != 0
  2337. && tls12_sigalg_allowed(s, op, lu))
  2338. disabled_mask &= ~clu->amask;
  2339. }
  2340. *pmask_a |= disabled_mask;
  2341. }
  2342. int tls12_copy_sigalgs(SSL_CONNECTION *s, WPACKET *pkt,
  2343. const uint16_t *psig, size_t psiglen)
  2344. {
  2345. size_t i;
  2346. int rv = 0;
  2347. for (i = 0; i < psiglen; i++, psig++) {
  2348. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *psig);
  2349. if (lu == NULL
  2350. || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu))
  2351. continue;
  2352. if (!WPACKET_put_bytes_u16(pkt, *psig))
  2353. return 0;
  2354. /*
  2355. * If TLS 1.3 must have at least one valid TLS 1.3 message
  2356. * signing algorithm: i.e. neither RSA nor SHA1/SHA224
  2357. */
  2358. if (rv == 0 && (!SSL_CONNECTION_IS_TLS13(s)
  2359. || (lu->sig != EVP_PKEY_RSA
  2360. && lu->hash != NID_sha1
  2361. && lu->hash != NID_sha224)))
  2362. rv = 1;
  2363. }
  2364. if (rv == 0)
  2365. ERR_raise(ERR_LIB_SSL, SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  2366. return rv;
  2367. }
  2368. /* Given preference and allowed sigalgs set shared sigalgs */
  2369. static size_t tls12_shared_sigalgs(SSL_CONNECTION *s,
  2370. const SIGALG_LOOKUP **shsig,
  2371. const uint16_t *pref, size_t preflen,
  2372. const uint16_t *allow, size_t allowlen)
  2373. {
  2374. const uint16_t *ptmp, *atmp;
  2375. size_t i, j, nmatch = 0;
  2376. for (i = 0, ptmp = pref; i < preflen; i++, ptmp++) {
  2377. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *ptmp);
  2378. /* Skip disabled hashes or signature algorithms */
  2379. if (lu == NULL
  2380. || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, lu))
  2381. continue;
  2382. for (j = 0, atmp = allow; j < allowlen; j++, atmp++) {
  2383. if (*ptmp == *atmp) {
  2384. nmatch++;
  2385. if (shsig)
  2386. *shsig++ = lu;
  2387. break;
  2388. }
  2389. }
  2390. }
  2391. return nmatch;
  2392. }
  2393. /* Set shared signature algorithms for SSL structures */
  2394. static int tls1_set_shared_sigalgs(SSL_CONNECTION *s)
  2395. {
  2396. const uint16_t *pref, *allow, *conf;
  2397. size_t preflen, allowlen, conflen;
  2398. size_t nmatch;
  2399. const SIGALG_LOOKUP **salgs = NULL;
  2400. CERT *c = s->cert;
  2401. unsigned int is_suiteb = tls1_suiteb(s);
  2402. OPENSSL_free(s->shared_sigalgs);
  2403. s->shared_sigalgs = NULL;
  2404. s->shared_sigalgslen = 0;
  2405. /* If client use client signature algorithms if not NULL */
  2406. if (!s->server && c->client_sigalgs && !is_suiteb) {
  2407. conf = c->client_sigalgs;
  2408. conflen = c->client_sigalgslen;
  2409. } else if (c->conf_sigalgs && !is_suiteb) {
  2410. conf = c->conf_sigalgs;
  2411. conflen = c->conf_sigalgslen;
  2412. } else
  2413. conflen = tls12_get_psigalgs(s, 0, &conf);
  2414. if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb) {
  2415. pref = conf;
  2416. preflen = conflen;
  2417. allow = s->s3.tmp.peer_sigalgs;
  2418. allowlen = s->s3.tmp.peer_sigalgslen;
  2419. } else {
  2420. allow = conf;
  2421. allowlen = conflen;
  2422. pref = s->s3.tmp.peer_sigalgs;
  2423. preflen = s->s3.tmp.peer_sigalgslen;
  2424. }
  2425. nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
  2426. if (nmatch) {
  2427. if ((salgs = OPENSSL_malloc(nmatch * sizeof(*salgs))) == NULL)
  2428. return 0;
  2429. nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
  2430. } else {
  2431. salgs = NULL;
  2432. }
  2433. s->shared_sigalgs = salgs;
  2434. s->shared_sigalgslen = nmatch;
  2435. return 1;
  2436. }
  2437. int tls1_save_u16(PACKET *pkt, uint16_t **pdest, size_t *pdestlen)
  2438. {
  2439. unsigned int stmp;
  2440. size_t size, i;
  2441. uint16_t *buf;
  2442. size = PACKET_remaining(pkt);
  2443. /* Invalid data length */
  2444. if (size == 0 || (size & 1) != 0)
  2445. return 0;
  2446. size >>= 1;
  2447. if ((buf = OPENSSL_malloc(size * sizeof(*buf))) == NULL)
  2448. return 0;
  2449. for (i = 0; i < size && PACKET_get_net_2(pkt, &stmp); i++)
  2450. buf[i] = stmp;
  2451. if (i != size) {
  2452. OPENSSL_free(buf);
  2453. return 0;
  2454. }
  2455. OPENSSL_free(*pdest);
  2456. *pdest = buf;
  2457. *pdestlen = size;
  2458. return 1;
  2459. }
  2460. int tls1_save_sigalgs(SSL_CONNECTION *s, PACKET *pkt, int cert)
  2461. {
  2462. /* Extension ignored for inappropriate versions */
  2463. if (!SSL_USE_SIGALGS(s))
  2464. return 1;
  2465. /* Should never happen */
  2466. if (s->cert == NULL)
  2467. return 0;
  2468. if (cert)
  2469. return tls1_save_u16(pkt, &s->s3.tmp.peer_cert_sigalgs,
  2470. &s->s3.tmp.peer_cert_sigalgslen);
  2471. else
  2472. return tls1_save_u16(pkt, &s->s3.tmp.peer_sigalgs,
  2473. &s->s3.tmp.peer_sigalgslen);
  2474. }
  2475. /* Set preferred digest for each key type */
  2476. int tls1_process_sigalgs(SSL_CONNECTION *s)
  2477. {
  2478. size_t i;
  2479. uint32_t *pvalid = s->s3.tmp.valid_flags;
  2480. if (!tls1_set_shared_sigalgs(s))
  2481. return 0;
  2482. for (i = 0; i < s->ssl_pkey_num; i++)
  2483. pvalid[i] = 0;
  2484. for (i = 0; i < s->shared_sigalgslen; i++) {
  2485. const SIGALG_LOOKUP *sigptr = s->shared_sigalgs[i];
  2486. int idx = sigptr->sig_idx;
  2487. /* Ignore PKCS1 based sig algs in TLSv1.3 */
  2488. if (SSL_CONNECTION_IS_TLS13(s) && sigptr->sig == EVP_PKEY_RSA)
  2489. continue;
  2490. /* If not disabled indicate we can explicitly sign */
  2491. if (pvalid[idx] == 0
  2492. && !ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), idx))
  2493. pvalid[idx] = CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  2494. }
  2495. return 1;
  2496. }
  2497. int SSL_get_sigalgs(SSL *s, int idx,
  2498. int *psign, int *phash, int *psignhash,
  2499. unsigned char *rsig, unsigned char *rhash)
  2500. {
  2501. uint16_t *psig;
  2502. size_t numsigalgs;
  2503. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  2504. if (sc == NULL)
  2505. return 0;
  2506. psig = sc->s3.tmp.peer_sigalgs;
  2507. numsigalgs = sc->s3.tmp.peer_sigalgslen;
  2508. if (psig == NULL || numsigalgs > INT_MAX)
  2509. return 0;
  2510. if (idx >= 0) {
  2511. const SIGALG_LOOKUP *lu;
  2512. if (idx >= (int)numsigalgs)
  2513. return 0;
  2514. psig += idx;
  2515. if (rhash != NULL)
  2516. *rhash = (unsigned char)((*psig >> 8) & 0xff);
  2517. if (rsig != NULL)
  2518. *rsig = (unsigned char)(*psig & 0xff);
  2519. lu = tls1_lookup_sigalg(sc, *psig);
  2520. if (psign != NULL)
  2521. *psign = lu != NULL ? lu->sig : NID_undef;
  2522. if (phash != NULL)
  2523. *phash = lu != NULL ? lu->hash : NID_undef;
  2524. if (psignhash != NULL)
  2525. *psignhash = lu != NULL ? lu->sigandhash : NID_undef;
  2526. }
  2527. return (int)numsigalgs;
  2528. }
  2529. int SSL_get_shared_sigalgs(SSL *s, int idx,
  2530. int *psign, int *phash, int *psignhash,
  2531. unsigned char *rsig, unsigned char *rhash)
  2532. {
  2533. const SIGALG_LOOKUP *shsigalgs;
  2534. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  2535. if (sc == NULL)
  2536. return 0;
  2537. if (sc->shared_sigalgs == NULL
  2538. || idx < 0
  2539. || idx >= (int)sc->shared_sigalgslen
  2540. || sc->shared_sigalgslen > INT_MAX)
  2541. return 0;
  2542. shsigalgs = sc->shared_sigalgs[idx];
  2543. if (phash != NULL)
  2544. *phash = shsigalgs->hash;
  2545. if (psign != NULL)
  2546. *psign = shsigalgs->sig;
  2547. if (psignhash != NULL)
  2548. *psignhash = shsigalgs->sigandhash;
  2549. if (rsig != NULL)
  2550. *rsig = (unsigned char)(shsigalgs->sigalg & 0xff);
  2551. if (rhash != NULL)
  2552. *rhash = (unsigned char)((shsigalgs->sigalg >> 8) & 0xff);
  2553. return (int)sc->shared_sigalgslen;
  2554. }
  2555. /* Maximum possible number of unique entries in sigalgs array */
  2556. #define TLS_MAX_SIGALGCNT (OSSL_NELEM(sigalg_lookup_tbl) * 2)
  2557. typedef struct {
  2558. size_t sigalgcnt;
  2559. /* TLSEXT_SIGALG_XXX values */
  2560. uint16_t sigalgs[TLS_MAX_SIGALGCNT];
  2561. } sig_cb_st;
  2562. static void get_sigorhash(int *psig, int *phash, const char *str)
  2563. {
  2564. if (strcmp(str, "RSA") == 0) {
  2565. *psig = EVP_PKEY_RSA;
  2566. } else if (strcmp(str, "RSA-PSS") == 0 || strcmp(str, "PSS") == 0) {
  2567. *psig = EVP_PKEY_RSA_PSS;
  2568. } else if (strcmp(str, "DSA") == 0) {
  2569. *psig = EVP_PKEY_DSA;
  2570. } else if (strcmp(str, "ECDSA") == 0) {
  2571. *psig = EVP_PKEY_EC;
  2572. } else {
  2573. *phash = OBJ_sn2nid(str);
  2574. if (*phash == NID_undef)
  2575. *phash = OBJ_ln2nid(str);
  2576. }
  2577. }
  2578. /* Maximum length of a signature algorithm string component */
  2579. #define TLS_MAX_SIGSTRING_LEN 40
  2580. static int sig_cb(const char *elem, int len, void *arg)
  2581. {
  2582. sig_cb_st *sarg = arg;
  2583. size_t i;
  2584. const SIGALG_LOOKUP *s;
  2585. char etmp[TLS_MAX_SIGSTRING_LEN], *p;
  2586. int sig_alg = NID_undef, hash_alg = NID_undef;
  2587. if (elem == NULL)
  2588. return 0;
  2589. if (sarg->sigalgcnt == TLS_MAX_SIGALGCNT)
  2590. return 0;
  2591. if (len > (int)(sizeof(etmp) - 1))
  2592. return 0;
  2593. memcpy(etmp, elem, len);
  2594. etmp[len] = 0;
  2595. p = strchr(etmp, '+');
  2596. /*
  2597. * We only allow SignatureSchemes listed in the sigalg_lookup_tbl;
  2598. * if there's no '+' in the provided name, look for the new-style combined
  2599. * name. If not, match both sig+hash to find the needed SIGALG_LOOKUP.
  2600. * Just sig+hash is not unique since TLS 1.3 adds rsa_pss_pss_* and
  2601. * rsa_pss_rsae_* that differ only by public key OID; in such cases
  2602. * we will pick the _rsae_ variant, by virtue of them appearing earlier
  2603. * in the table.
  2604. */
  2605. if (p == NULL) {
  2606. for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl);
  2607. i++, s++) {
  2608. if (s->name != NULL && strcmp(etmp, s->name) == 0) {
  2609. sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg;
  2610. break;
  2611. }
  2612. }
  2613. if (i == OSSL_NELEM(sigalg_lookup_tbl))
  2614. return 0;
  2615. } else {
  2616. *p = 0;
  2617. p++;
  2618. if (*p == 0)
  2619. return 0;
  2620. get_sigorhash(&sig_alg, &hash_alg, etmp);
  2621. get_sigorhash(&sig_alg, &hash_alg, p);
  2622. if (sig_alg == NID_undef || hash_alg == NID_undef)
  2623. return 0;
  2624. for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl);
  2625. i++, s++) {
  2626. if (s->hash == hash_alg && s->sig == sig_alg) {
  2627. sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg;
  2628. break;
  2629. }
  2630. }
  2631. if (i == OSSL_NELEM(sigalg_lookup_tbl))
  2632. return 0;
  2633. }
  2634. /* Reject duplicates */
  2635. for (i = 0; i < sarg->sigalgcnt - 1; i++) {
  2636. if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt - 1]) {
  2637. sarg->sigalgcnt--;
  2638. return 0;
  2639. }
  2640. }
  2641. return 1;
  2642. }
  2643. /*
  2644. * Set supported signature algorithms based on a colon separated list of the
  2645. * form sig+hash e.g. RSA+SHA512:DSA+SHA512
  2646. */
  2647. int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
  2648. {
  2649. sig_cb_st sig;
  2650. sig.sigalgcnt = 0;
  2651. if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
  2652. return 0;
  2653. if (c == NULL)
  2654. return 1;
  2655. return tls1_set_raw_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
  2656. }
  2657. int tls1_set_raw_sigalgs(CERT *c, const uint16_t *psigs, size_t salglen,
  2658. int client)
  2659. {
  2660. uint16_t *sigalgs;
  2661. if ((sigalgs = OPENSSL_malloc(salglen * sizeof(*sigalgs))) == NULL)
  2662. return 0;
  2663. memcpy(sigalgs, psigs, salglen * sizeof(*sigalgs));
  2664. if (client) {
  2665. OPENSSL_free(c->client_sigalgs);
  2666. c->client_sigalgs = sigalgs;
  2667. c->client_sigalgslen = salglen;
  2668. } else {
  2669. OPENSSL_free(c->conf_sigalgs);
  2670. c->conf_sigalgs = sigalgs;
  2671. c->conf_sigalgslen = salglen;
  2672. }
  2673. return 1;
  2674. }
  2675. int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
  2676. {
  2677. uint16_t *sigalgs, *sptr;
  2678. size_t i;
  2679. if (salglen & 1)
  2680. return 0;
  2681. if ((sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs))) == NULL)
  2682. return 0;
  2683. for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
  2684. size_t j;
  2685. const SIGALG_LOOKUP *curr;
  2686. int md_id = *psig_nids++;
  2687. int sig_id = *psig_nids++;
  2688. for (j = 0, curr = sigalg_lookup_tbl; j < OSSL_NELEM(sigalg_lookup_tbl);
  2689. j++, curr++) {
  2690. if (curr->hash == md_id && curr->sig == sig_id) {
  2691. *sptr++ = curr->sigalg;
  2692. break;
  2693. }
  2694. }
  2695. if (j == OSSL_NELEM(sigalg_lookup_tbl))
  2696. goto err;
  2697. }
  2698. if (client) {
  2699. OPENSSL_free(c->client_sigalgs);
  2700. c->client_sigalgs = sigalgs;
  2701. c->client_sigalgslen = salglen / 2;
  2702. } else {
  2703. OPENSSL_free(c->conf_sigalgs);
  2704. c->conf_sigalgs = sigalgs;
  2705. c->conf_sigalgslen = salglen / 2;
  2706. }
  2707. return 1;
  2708. err:
  2709. OPENSSL_free(sigalgs);
  2710. return 0;
  2711. }
  2712. static int tls1_check_sig_alg(SSL_CONNECTION *s, X509 *x, int default_nid)
  2713. {
  2714. int sig_nid, use_pc_sigalgs = 0;
  2715. size_t i;
  2716. const SIGALG_LOOKUP *sigalg;
  2717. size_t sigalgslen;
  2718. if (default_nid == -1)
  2719. return 1;
  2720. sig_nid = X509_get_signature_nid(x);
  2721. if (default_nid)
  2722. return sig_nid == default_nid ? 1 : 0;
  2723. if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.peer_cert_sigalgs != NULL) {
  2724. /*
  2725. * If we're in TLSv1.3 then we only get here if we're checking the
  2726. * chain. If the peer has specified peer_cert_sigalgs then we use them
  2727. * otherwise we default to normal sigalgs.
  2728. */
  2729. sigalgslen = s->s3.tmp.peer_cert_sigalgslen;
  2730. use_pc_sigalgs = 1;
  2731. } else {
  2732. sigalgslen = s->shared_sigalgslen;
  2733. }
  2734. for (i = 0; i < sigalgslen; i++) {
  2735. sigalg = use_pc_sigalgs
  2736. ? tls1_lookup_sigalg(s, s->s3.tmp.peer_cert_sigalgs[i])
  2737. : s->shared_sigalgs[i];
  2738. if (sigalg != NULL && sig_nid == sigalg->sigandhash)
  2739. return 1;
  2740. }
  2741. return 0;
  2742. }
  2743. /* Check to see if a certificate issuer name matches list of CA names */
  2744. static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
  2745. {
  2746. const X509_NAME *nm;
  2747. int i;
  2748. nm = X509_get_issuer_name(x);
  2749. for (i = 0; i < sk_X509_NAME_num(names); i++) {
  2750. if (!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
  2751. return 1;
  2752. }
  2753. return 0;
  2754. }
  2755. /*
  2756. * Check certificate chain is consistent with TLS extensions and is usable by
  2757. * server. This servers two purposes: it allows users to check chains before
  2758. * passing them to the server and it allows the server to check chains before
  2759. * attempting to use them.
  2760. */
  2761. /* Flags which need to be set for a certificate when strict mode not set */
  2762. #define CERT_PKEY_VALID_FLAGS \
  2763. (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
  2764. /* Strict mode flags */
  2765. #define CERT_PKEY_STRICT_FLAGS \
  2766. (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
  2767. | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  2768. int tls1_check_chain(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pk,
  2769. STACK_OF(X509) *chain, int idx)
  2770. {
  2771. int i;
  2772. int rv = 0;
  2773. int check_flags = 0, strict_mode;
  2774. CERT_PKEY *cpk = NULL;
  2775. CERT *c = s->cert;
  2776. uint32_t *pvalid;
  2777. unsigned int suiteb_flags = tls1_suiteb(s);
  2778. /*
  2779. * Meaning of idx:
  2780. * idx == -1 means SSL_check_chain() invocation
  2781. * idx == -2 means checking client certificate chains
  2782. * idx >= 0 means checking SSL_PKEY index
  2783. *
  2784. * For RPK, where there may be no cert, we ignore -1
  2785. */
  2786. if (idx != -1) {
  2787. if (idx == -2) {
  2788. cpk = c->key;
  2789. idx = (int)(cpk - c->pkeys);
  2790. } else
  2791. cpk = c->pkeys + idx;
  2792. pvalid = s->s3.tmp.valid_flags + idx;
  2793. x = cpk->x509;
  2794. pk = cpk->privatekey;
  2795. chain = cpk->chain;
  2796. strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
  2797. if (tls12_rpk_and_privkey(s, idx)) {
  2798. if (EVP_PKEY_is_a(pk, "EC") && !tls1_check_pkey_comp(s, pk))
  2799. return 0;
  2800. *pvalid = rv = CERT_PKEY_RPK;
  2801. return rv;
  2802. }
  2803. /* If no cert or key, forget it */
  2804. if (x == NULL || pk == NULL)
  2805. goto end;
  2806. } else {
  2807. size_t certidx;
  2808. if (x == NULL || pk == NULL)
  2809. return 0;
  2810. if (ssl_cert_lookup_by_pkey(pk, &certidx,
  2811. SSL_CONNECTION_GET_CTX(s)) == NULL)
  2812. return 0;
  2813. idx = certidx;
  2814. pvalid = s->s3.tmp.valid_flags + idx;
  2815. if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
  2816. check_flags = CERT_PKEY_STRICT_FLAGS;
  2817. else
  2818. check_flags = CERT_PKEY_VALID_FLAGS;
  2819. strict_mode = 1;
  2820. }
  2821. if (suiteb_flags) {
  2822. int ok;
  2823. if (check_flags)
  2824. check_flags |= CERT_PKEY_SUITEB;
  2825. ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
  2826. if (ok == X509_V_OK)
  2827. rv |= CERT_PKEY_SUITEB;
  2828. else if (!check_flags)
  2829. goto end;
  2830. }
  2831. /*
  2832. * Check all signature algorithms are consistent with signature
  2833. * algorithms extension if TLS 1.2 or later and strict mode.
  2834. */
  2835. if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION
  2836. && strict_mode) {
  2837. int default_nid;
  2838. int rsign = 0;
  2839. if (s->s3.tmp.peer_cert_sigalgs != NULL
  2840. || s->s3.tmp.peer_sigalgs != NULL) {
  2841. default_nid = 0;
  2842. /* If no sigalgs extension use defaults from RFC5246 */
  2843. } else {
  2844. switch (idx) {
  2845. case SSL_PKEY_RSA:
  2846. rsign = EVP_PKEY_RSA;
  2847. default_nid = NID_sha1WithRSAEncryption;
  2848. break;
  2849. case SSL_PKEY_DSA_SIGN:
  2850. rsign = EVP_PKEY_DSA;
  2851. default_nid = NID_dsaWithSHA1;
  2852. break;
  2853. case SSL_PKEY_ECC:
  2854. rsign = EVP_PKEY_EC;
  2855. default_nid = NID_ecdsa_with_SHA1;
  2856. break;
  2857. case SSL_PKEY_GOST01:
  2858. rsign = NID_id_GostR3410_2001;
  2859. default_nid = NID_id_GostR3411_94_with_GostR3410_2001;
  2860. break;
  2861. case SSL_PKEY_GOST12_256:
  2862. rsign = NID_id_GostR3410_2012_256;
  2863. default_nid = NID_id_tc26_signwithdigest_gost3410_2012_256;
  2864. break;
  2865. case SSL_PKEY_GOST12_512:
  2866. rsign = NID_id_GostR3410_2012_512;
  2867. default_nid = NID_id_tc26_signwithdigest_gost3410_2012_512;
  2868. break;
  2869. default:
  2870. default_nid = -1;
  2871. break;
  2872. }
  2873. }
  2874. /*
  2875. * If peer sent no signature algorithms extension and we have set
  2876. * preferred signature algorithms check we support sha1.
  2877. */
  2878. if (default_nid > 0 && c->conf_sigalgs) {
  2879. size_t j;
  2880. const uint16_t *p = c->conf_sigalgs;
  2881. for (j = 0; j < c->conf_sigalgslen; j++, p++) {
  2882. const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *p);
  2883. if (lu != NULL && lu->hash == NID_sha1 && lu->sig == rsign)
  2884. break;
  2885. }
  2886. if (j == c->conf_sigalgslen) {
  2887. if (check_flags)
  2888. goto skip_sigs;
  2889. else
  2890. goto end;
  2891. }
  2892. }
  2893. /* Check signature algorithm of each cert in chain */
  2894. if (SSL_CONNECTION_IS_TLS13(s)) {
  2895. /*
  2896. * We only get here if the application has called SSL_check_chain(),
  2897. * so check_flags is always set.
  2898. */
  2899. if (find_sig_alg(s, x, pk) != NULL)
  2900. rv |= CERT_PKEY_EE_SIGNATURE;
  2901. } else if (!tls1_check_sig_alg(s, x, default_nid)) {
  2902. if (!check_flags)
  2903. goto end;
  2904. } else
  2905. rv |= CERT_PKEY_EE_SIGNATURE;
  2906. rv |= CERT_PKEY_CA_SIGNATURE;
  2907. for (i = 0; i < sk_X509_num(chain); i++) {
  2908. if (!tls1_check_sig_alg(s, sk_X509_value(chain, i), default_nid)) {
  2909. if (check_flags) {
  2910. rv &= ~CERT_PKEY_CA_SIGNATURE;
  2911. break;
  2912. } else
  2913. goto end;
  2914. }
  2915. }
  2916. }
  2917. /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
  2918. else if (check_flags)
  2919. rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE;
  2920. skip_sigs:
  2921. /* Check cert parameters are consistent */
  2922. if (tls1_check_cert_param(s, x, 1))
  2923. rv |= CERT_PKEY_EE_PARAM;
  2924. else if (!check_flags)
  2925. goto end;
  2926. if (!s->server)
  2927. rv |= CERT_PKEY_CA_PARAM;
  2928. /* In strict mode check rest of chain too */
  2929. else if (strict_mode) {
  2930. rv |= CERT_PKEY_CA_PARAM;
  2931. for (i = 0; i < sk_X509_num(chain); i++) {
  2932. X509 *ca = sk_X509_value(chain, i);
  2933. if (!tls1_check_cert_param(s, ca, 0)) {
  2934. if (check_flags) {
  2935. rv &= ~CERT_PKEY_CA_PARAM;
  2936. break;
  2937. } else
  2938. goto end;
  2939. }
  2940. }
  2941. }
  2942. if (!s->server && strict_mode) {
  2943. STACK_OF(X509_NAME) *ca_dn;
  2944. int check_type = 0;
  2945. if (EVP_PKEY_is_a(pk, "RSA"))
  2946. check_type = TLS_CT_RSA_SIGN;
  2947. else if (EVP_PKEY_is_a(pk, "DSA"))
  2948. check_type = TLS_CT_DSS_SIGN;
  2949. else if (EVP_PKEY_is_a(pk, "EC"))
  2950. check_type = TLS_CT_ECDSA_SIGN;
  2951. if (check_type) {
  2952. const uint8_t *ctypes = s->s3.tmp.ctype;
  2953. size_t j;
  2954. for (j = 0; j < s->s3.tmp.ctype_len; j++, ctypes++) {
  2955. if (*ctypes == check_type) {
  2956. rv |= CERT_PKEY_CERT_TYPE;
  2957. break;
  2958. }
  2959. }
  2960. if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
  2961. goto end;
  2962. } else {
  2963. rv |= CERT_PKEY_CERT_TYPE;
  2964. }
  2965. ca_dn = s->s3.tmp.peer_ca_names;
  2966. if (ca_dn == NULL
  2967. || sk_X509_NAME_num(ca_dn) == 0
  2968. || ssl_check_ca_name(ca_dn, x))
  2969. rv |= CERT_PKEY_ISSUER_NAME;
  2970. else
  2971. for (i = 0; i < sk_X509_num(chain); i++) {
  2972. X509 *xtmp = sk_X509_value(chain, i);
  2973. if (ssl_check_ca_name(ca_dn, xtmp)) {
  2974. rv |= CERT_PKEY_ISSUER_NAME;
  2975. break;
  2976. }
  2977. }
  2978. if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
  2979. goto end;
  2980. } else
  2981. rv |= CERT_PKEY_ISSUER_NAME | CERT_PKEY_CERT_TYPE;
  2982. if (!check_flags || (rv & check_flags) == check_flags)
  2983. rv |= CERT_PKEY_VALID;
  2984. end:
  2985. if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION)
  2986. rv |= *pvalid & (CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN);
  2987. else
  2988. rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN;
  2989. /*
  2990. * When checking a CERT_PKEY structure all flags are irrelevant if the
  2991. * chain is invalid.
  2992. */
  2993. if (!check_flags) {
  2994. if (rv & CERT_PKEY_VALID) {
  2995. *pvalid = rv;
  2996. } else {
  2997. /* Preserve sign and explicit sign flag, clear rest */
  2998. *pvalid &= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  2999. return 0;
  3000. }
  3001. }
  3002. return rv;
  3003. }
  3004. /* Set validity of certificates in an SSL structure */
  3005. void tls1_set_cert_validity(SSL_CONNECTION *s)
  3006. {
  3007. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA);
  3008. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_PSS_SIGN);
  3009. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
  3010. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
  3011. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST01);
  3012. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_256);
  3013. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_512);
  3014. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED25519);
  3015. tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED448);
  3016. }
  3017. /* User level utility function to check a chain is suitable */
  3018. int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
  3019. {
  3020. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  3021. if (sc == NULL)
  3022. return 0;
  3023. return tls1_check_chain(sc, x, pk, chain, -1);
  3024. }
  3025. EVP_PKEY *ssl_get_auto_dh(SSL_CONNECTION *s)
  3026. {
  3027. EVP_PKEY *dhp = NULL;
  3028. BIGNUM *p;
  3029. int dh_secbits = 80, sec_level_bits;
  3030. EVP_PKEY_CTX *pctx = NULL;
  3031. OSSL_PARAM_BLD *tmpl = NULL;
  3032. OSSL_PARAM *params = NULL;
  3033. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3034. if (s->cert->dh_tmp_auto != 2) {
  3035. if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
  3036. if (s->s3.tmp.new_cipher->strength_bits == 256)
  3037. dh_secbits = 128;
  3038. else
  3039. dh_secbits = 80;
  3040. } else {
  3041. if (s->s3.tmp.cert == NULL)
  3042. return NULL;
  3043. dh_secbits = EVP_PKEY_get_security_bits(s->s3.tmp.cert->privatekey);
  3044. }
  3045. }
  3046. /* Do not pick a prime that is too weak for the current security level */
  3047. sec_level_bits = ssl_get_security_level_bits(SSL_CONNECTION_GET_SSL(s),
  3048. NULL, NULL);
  3049. if (dh_secbits < sec_level_bits)
  3050. dh_secbits = sec_level_bits;
  3051. if (dh_secbits >= 192)
  3052. p = BN_get_rfc3526_prime_8192(NULL);
  3053. else if (dh_secbits >= 152)
  3054. p = BN_get_rfc3526_prime_4096(NULL);
  3055. else if (dh_secbits >= 128)
  3056. p = BN_get_rfc3526_prime_3072(NULL);
  3057. else if (dh_secbits >= 112)
  3058. p = BN_get_rfc3526_prime_2048(NULL);
  3059. else
  3060. p = BN_get_rfc2409_prime_1024(NULL);
  3061. if (p == NULL)
  3062. goto err;
  3063. pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq);
  3064. if (pctx == NULL
  3065. || EVP_PKEY_fromdata_init(pctx) != 1)
  3066. goto err;
  3067. tmpl = OSSL_PARAM_BLD_new();
  3068. if (tmpl == NULL
  3069. || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)
  3070. || !OSSL_PARAM_BLD_push_uint(tmpl, OSSL_PKEY_PARAM_FFC_G, 2))
  3071. goto err;
  3072. params = OSSL_PARAM_BLD_to_param(tmpl);
  3073. if (params == NULL
  3074. || EVP_PKEY_fromdata(pctx, &dhp, EVP_PKEY_KEY_PARAMETERS, params) != 1)
  3075. goto err;
  3076. err:
  3077. OSSL_PARAM_free(params);
  3078. OSSL_PARAM_BLD_free(tmpl);
  3079. EVP_PKEY_CTX_free(pctx);
  3080. BN_free(p);
  3081. return dhp;
  3082. }
  3083. static int ssl_security_cert_key(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
  3084. int op)
  3085. {
  3086. int secbits = -1;
  3087. EVP_PKEY *pkey = X509_get0_pubkey(x);
  3088. if (pkey) {
  3089. /*
  3090. * If no parameters this will return -1 and fail using the default
  3091. * security callback for any non-zero security level. This will
  3092. * reject keys which omit parameters but this only affects DSA and
  3093. * omission of parameters is never (?) done in practice.
  3094. */
  3095. secbits = EVP_PKEY_get_security_bits(pkey);
  3096. }
  3097. if (s != NULL)
  3098. return ssl_security(s, op, secbits, 0, x);
  3099. else
  3100. return ssl_ctx_security(ctx, op, secbits, 0, x);
  3101. }
  3102. static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
  3103. int op)
  3104. {
  3105. /* Lookup signature algorithm digest */
  3106. int secbits, nid, pknid;
  3107. /* Don't check signature if self signed */
  3108. if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)
  3109. return 1;
  3110. if (!X509_get_signature_info(x, &nid, &pknid, &secbits, NULL))
  3111. secbits = -1;
  3112. /* If digest NID not defined use signature NID */
  3113. if (nid == NID_undef)
  3114. nid = pknid;
  3115. if (s != NULL)
  3116. return ssl_security(s, op, secbits, nid, x);
  3117. else
  3118. return ssl_ctx_security(ctx, op, secbits, nid, x);
  3119. }
  3120. int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy,
  3121. int is_ee)
  3122. {
  3123. if (vfy)
  3124. vfy = SSL_SECOP_PEER;
  3125. if (is_ee) {
  3126. if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
  3127. return SSL_R_EE_KEY_TOO_SMALL;
  3128. } else {
  3129. if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
  3130. return SSL_R_CA_KEY_TOO_SMALL;
  3131. }
  3132. if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
  3133. return SSL_R_CA_MD_TOO_WEAK;
  3134. return 1;
  3135. }
  3136. /*
  3137. * Check security of a chain, if |sk| includes the end entity certificate then
  3138. * |x| is NULL. If |vfy| is 1 then we are verifying a peer chain and not sending
  3139. * one to the peer. Return values: 1 if ok otherwise error code to use
  3140. */
  3141. int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk,
  3142. X509 *x, int vfy)
  3143. {
  3144. int rv, start_idx, i;
  3145. if (x == NULL) {
  3146. x = sk_X509_value(sk, 0);
  3147. if (x == NULL)
  3148. return ERR_R_INTERNAL_ERROR;
  3149. start_idx = 1;
  3150. } else
  3151. start_idx = 0;
  3152. rv = ssl_security_cert(s, NULL, x, vfy, 1);
  3153. if (rv != 1)
  3154. return rv;
  3155. for (i = start_idx; i < sk_X509_num(sk); i++) {
  3156. x = sk_X509_value(sk, i);
  3157. rv = ssl_security_cert(s, NULL, x, vfy, 0);
  3158. if (rv != 1)
  3159. return rv;
  3160. }
  3161. return 1;
  3162. }
  3163. /*
  3164. * For TLS 1.2 servers check if we have a certificate which can be used
  3165. * with the signature algorithm "lu" and return index of certificate.
  3166. */
  3167. static int tls12_get_cert_sigalg_idx(const SSL_CONNECTION *s,
  3168. const SIGALG_LOOKUP *lu)
  3169. {
  3170. int sig_idx = lu->sig_idx;
  3171. const SSL_CERT_LOOKUP *clu = ssl_cert_lookup_by_idx(sig_idx,
  3172. SSL_CONNECTION_GET_CTX(s));
  3173. /* If not recognised or not supported by cipher mask it is not suitable */
  3174. if (clu == NULL
  3175. || (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0
  3176. || (clu->nid == EVP_PKEY_RSA_PSS
  3177. && (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kRSA) != 0))
  3178. return -1;
  3179. /* If doing RPK, the CERT_PKEY won't be "valid" */
  3180. if (tls12_rpk_and_privkey(s, sig_idx))
  3181. return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_RPK ? sig_idx : -1;
  3182. return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_VALID ? sig_idx : -1;
  3183. }
  3184. /*
  3185. * Checks the given cert against signature_algorithm_cert restrictions sent by
  3186. * the peer (if any) as well as whether the hash from the sigalg is usable with
  3187. * the key.
  3188. * Returns true if the cert is usable and false otherwise.
  3189. */
  3190. static int check_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig,
  3191. X509 *x, EVP_PKEY *pkey)
  3192. {
  3193. const SIGALG_LOOKUP *lu;
  3194. int mdnid, pknid, supported;
  3195. size_t i;
  3196. const char *mdname = NULL;
  3197. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3198. /*
  3199. * If the given EVP_PKEY cannot support signing with this digest,
  3200. * the answer is simply 'no'.
  3201. */
  3202. if (sig->hash != NID_undef)
  3203. mdname = OBJ_nid2sn(sig->hash);
  3204. supported = EVP_PKEY_digestsign_supports_digest(pkey, sctx->libctx,
  3205. mdname,
  3206. sctx->propq);
  3207. if (supported <= 0)
  3208. return 0;
  3209. /*
  3210. * The TLS 1.3 signature_algorithms_cert extension places restrictions
  3211. * on the sigalg with which the certificate was signed (by its issuer).
  3212. */
  3213. if (s->s3.tmp.peer_cert_sigalgs != NULL) {
  3214. if (!X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL))
  3215. return 0;
  3216. for (i = 0; i < s->s3.tmp.peer_cert_sigalgslen; i++) {
  3217. lu = tls1_lookup_sigalg(s, s->s3.tmp.peer_cert_sigalgs[i]);
  3218. if (lu == NULL)
  3219. continue;
  3220. /*
  3221. * This does not differentiate between the
  3222. * rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
  3223. * have a chain here that lets us look at the key OID in the
  3224. * signing certificate.
  3225. */
  3226. if (mdnid == lu->hash && pknid == lu->sig)
  3227. return 1;
  3228. }
  3229. return 0;
  3230. }
  3231. /*
  3232. * Without signat_algorithms_cert, any certificate for which we have
  3233. * a viable public key is permitted.
  3234. */
  3235. return 1;
  3236. }
  3237. /*
  3238. * Returns true if |s| has a usable certificate configured for use
  3239. * with signature scheme |sig|.
  3240. * "Usable" includes a check for presence as well as applying
  3241. * the signature_algorithm_cert restrictions sent by the peer (if any).
  3242. * Returns false if no usable certificate is found.
  3243. */
  3244. static int has_usable_cert(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, int idx)
  3245. {
  3246. /* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */
  3247. if (idx == -1)
  3248. idx = sig->sig_idx;
  3249. if (!ssl_has_cert(s, idx))
  3250. return 0;
  3251. return check_cert_usable(s, sig, s->cert->pkeys[idx].x509,
  3252. s->cert->pkeys[idx].privatekey);
  3253. }
  3254. /*
  3255. * Returns true if the supplied cert |x| and key |pkey| is usable with the
  3256. * specified signature scheme |sig|, or false otherwise.
  3257. */
  3258. static int is_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, X509 *x,
  3259. EVP_PKEY *pkey)
  3260. {
  3261. size_t idx;
  3262. if (ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)) == NULL)
  3263. return 0;
  3264. /* Check the key is consistent with the sig alg */
  3265. if ((int)idx != sig->sig_idx)
  3266. return 0;
  3267. return check_cert_usable(s, sig, x, pkey);
  3268. }
  3269. /*
  3270. * Find a signature scheme that works with the supplied certificate |x| and key
  3271. * |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our
  3272. * available certs/keys to find one that works.
  3273. */
  3274. static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x,
  3275. EVP_PKEY *pkey)
  3276. {
  3277. const SIGALG_LOOKUP *lu = NULL;
  3278. size_t i;
  3279. int curve = -1;
  3280. EVP_PKEY *tmppkey;
  3281. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3282. /* Look for a shared sigalgs matching possible certificates */
  3283. for (i = 0; i < s->shared_sigalgslen; i++) {
  3284. lu = s->shared_sigalgs[i];
  3285. /* Skip SHA1, SHA224, DSA and RSA if not PSS */
  3286. if (lu->hash == NID_sha1
  3287. || lu->hash == NID_sha224
  3288. || lu->sig == EVP_PKEY_DSA
  3289. || lu->sig == EVP_PKEY_RSA)
  3290. continue;
  3291. /* Check that we have a cert, and signature_algorithms_cert */
  3292. if (!tls1_lookup_md(sctx, lu, NULL))
  3293. continue;
  3294. if ((pkey == NULL && !has_usable_cert(s, lu, -1))
  3295. || (pkey != NULL && !is_cert_usable(s, lu, x, pkey)))
  3296. continue;
  3297. tmppkey = (pkey != NULL) ? pkey
  3298. : s->cert->pkeys[lu->sig_idx].privatekey;
  3299. if (lu->sig == EVP_PKEY_EC) {
  3300. if (curve == -1)
  3301. curve = ssl_get_EC_curve_nid(tmppkey);
  3302. if (lu->curve != NID_undef && curve != lu->curve)
  3303. continue;
  3304. } else if (lu->sig == EVP_PKEY_RSA_PSS) {
  3305. /* validate that key is large enough for the signature algorithm */
  3306. if (!rsa_pss_check_min_key_size(sctx, tmppkey, lu))
  3307. continue;
  3308. }
  3309. break;
  3310. }
  3311. if (i == s->shared_sigalgslen)
  3312. return NULL;
  3313. return lu;
  3314. }
  3315. /*
  3316. * Choose an appropriate signature algorithm based on available certificates
  3317. * Sets chosen certificate and signature algorithm.
  3318. *
  3319. * For servers if we fail to find a required certificate it is a fatal error,
  3320. * an appropriate error code is set and a TLS alert is sent.
  3321. *
  3322. * For clients fatalerrs is set to 0. If a certificate is not suitable it is not
  3323. * a fatal error: we will either try another certificate or not present one
  3324. * to the server. In this case no error is set.
  3325. */
  3326. int tls_choose_sigalg(SSL_CONNECTION *s, int fatalerrs)
  3327. {
  3328. const SIGALG_LOOKUP *lu = NULL;
  3329. int sig_idx = -1;
  3330. s->s3.tmp.cert = NULL;
  3331. s->s3.tmp.sigalg = NULL;
  3332. if (SSL_CONNECTION_IS_TLS13(s)) {
  3333. lu = find_sig_alg(s, NULL, NULL);
  3334. if (lu == NULL) {
  3335. if (!fatalerrs)
  3336. return 1;
  3337. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3338. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3339. return 0;
  3340. }
  3341. } else {
  3342. /* If ciphersuite doesn't require a cert nothing to do */
  3343. if (!(s->s3.tmp.new_cipher->algorithm_auth & SSL_aCERT))
  3344. return 1;
  3345. if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))
  3346. return 1;
  3347. if (SSL_USE_SIGALGS(s)) {
  3348. size_t i;
  3349. if (s->s3.tmp.peer_sigalgs != NULL) {
  3350. int curve = -1;
  3351. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  3352. /* For Suite B need to match signature algorithm to curve */
  3353. if (tls1_suiteb(s))
  3354. curve = ssl_get_EC_curve_nid(s->cert->pkeys[SSL_PKEY_ECC]
  3355. .privatekey);
  3356. /*
  3357. * Find highest preference signature algorithm matching
  3358. * cert type
  3359. */
  3360. for (i = 0; i < s->shared_sigalgslen; i++) {
  3361. lu = s->shared_sigalgs[i];
  3362. if (s->server) {
  3363. if ((sig_idx = tls12_get_cert_sigalg_idx(s, lu)) == -1)
  3364. continue;
  3365. } else {
  3366. int cc_idx = s->cert->key - s->cert->pkeys;
  3367. sig_idx = lu->sig_idx;
  3368. if (cc_idx != sig_idx)
  3369. continue;
  3370. }
  3371. /* Check that we have a cert, and sig_algs_cert */
  3372. if (!has_usable_cert(s, lu, sig_idx))
  3373. continue;
  3374. if (lu->sig == EVP_PKEY_RSA_PSS) {
  3375. /* validate that key is large enough for the signature algorithm */
  3376. EVP_PKEY *pkey = s->cert->pkeys[sig_idx].privatekey;
  3377. if (!rsa_pss_check_min_key_size(sctx, pkey, lu))
  3378. continue;
  3379. }
  3380. if (curve == -1 || lu->curve == curve)
  3381. break;
  3382. }
  3383. #ifndef OPENSSL_NO_GOST
  3384. /*
  3385. * Some Windows-based implementations do not send GOST algorithms indication
  3386. * in supported_algorithms extension, so when we have GOST-based ciphersuite,
  3387. * we have to assume GOST support.
  3388. */
  3389. if (i == s->shared_sigalgslen
  3390. && (s->s3.tmp.new_cipher->algorithm_auth
  3391. & (SSL_aGOST01 | SSL_aGOST12)) != 0) {
  3392. if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
  3393. if (!fatalerrs)
  3394. return 1;
  3395. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3396. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3397. return 0;
  3398. } else {
  3399. i = 0;
  3400. sig_idx = lu->sig_idx;
  3401. }
  3402. }
  3403. #endif
  3404. if (i == s->shared_sigalgslen) {
  3405. if (!fatalerrs)
  3406. return 1;
  3407. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3408. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3409. return 0;
  3410. }
  3411. } else {
  3412. /*
  3413. * If we have no sigalg use defaults
  3414. */
  3415. const uint16_t *sent_sigs;
  3416. size_t sent_sigslen;
  3417. if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
  3418. if (!fatalerrs)
  3419. return 1;
  3420. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3421. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3422. return 0;
  3423. }
  3424. /* Check signature matches a type we sent */
  3425. sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
  3426. for (i = 0; i < sent_sigslen; i++, sent_sigs++) {
  3427. if (lu->sigalg == *sent_sigs
  3428. && has_usable_cert(s, lu, lu->sig_idx))
  3429. break;
  3430. }
  3431. if (i == sent_sigslen) {
  3432. if (!fatalerrs)
  3433. return 1;
  3434. SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
  3435. SSL_R_WRONG_SIGNATURE_TYPE);
  3436. return 0;
  3437. }
  3438. }
  3439. } else {
  3440. if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
  3441. if (!fatalerrs)
  3442. return 1;
  3443. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  3444. SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
  3445. return 0;
  3446. }
  3447. }
  3448. }
  3449. if (sig_idx == -1)
  3450. sig_idx = lu->sig_idx;
  3451. s->s3.tmp.cert = &s->cert->pkeys[sig_idx];
  3452. s->cert->key = s->s3.tmp.cert;
  3453. s->s3.tmp.sigalg = lu;
  3454. return 1;
  3455. }
  3456. int SSL_CTX_set_tlsext_max_fragment_length(SSL_CTX *ctx, uint8_t mode)
  3457. {
  3458. if (mode != TLSEXT_max_fragment_length_DISABLED
  3459. && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) {
  3460. ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
  3461. return 0;
  3462. }
  3463. ctx->ext.max_fragment_len_mode = mode;
  3464. return 1;
  3465. }
  3466. int SSL_set_tlsext_max_fragment_length(SSL *ssl, uint8_t mode)
  3467. {
  3468. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
  3469. if (sc == NULL
  3470. || (IS_QUIC(ssl) && mode != TLSEXT_max_fragment_length_DISABLED))
  3471. return 0;
  3472. if (mode != TLSEXT_max_fragment_length_DISABLED
  3473. && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) {
  3474. ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
  3475. return 0;
  3476. }
  3477. sc->ext.max_fragment_len_mode = mode;
  3478. return 1;
  3479. }
  3480. uint8_t SSL_SESSION_get_max_fragment_length(const SSL_SESSION *session)
  3481. {
  3482. return session->ext.max_fragment_len_mode;
  3483. }
  3484. /*
  3485. * Helper functions for HMAC access with legacy support included.
  3486. */
  3487. SSL_HMAC *ssl_hmac_new(const SSL_CTX *ctx)
  3488. {
  3489. SSL_HMAC *ret = OPENSSL_zalloc(sizeof(*ret));
  3490. EVP_MAC *mac = NULL;
  3491. if (ret == NULL)
  3492. return NULL;
  3493. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3494. if (ctx->ext.ticket_key_evp_cb == NULL
  3495. && ctx->ext.ticket_key_cb != NULL) {
  3496. if (!ssl_hmac_old_new(ret))
  3497. goto err;
  3498. return ret;
  3499. }
  3500. #endif
  3501. mac = EVP_MAC_fetch(ctx->libctx, "HMAC", ctx->propq);
  3502. if (mac == NULL || (ret->ctx = EVP_MAC_CTX_new(mac)) == NULL)
  3503. goto err;
  3504. EVP_MAC_free(mac);
  3505. return ret;
  3506. err:
  3507. EVP_MAC_CTX_free(ret->ctx);
  3508. EVP_MAC_free(mac);
  3509. OPENSSL_free(ret);
  3510. return NULL;
  3511. }
  3512. void ssl_hmac_free(SSL_HMAC *ctx)
  3513. {
  3514. if (ctx != NULL) {
  3515. EVP_MAC_CTX_free(ctx->ctx);
  3516. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3517. ssl_hmac_old_free(ctx);
  3518. #endif
  3519. OPENSSL_free(ctx);
  3520. }
  3521. }
  3522. EVP_MAC_CTX *ssl_hmac_get0_EVP_MAC_CTX(SSL_HMAC *ctx)
  3523. {
  3524. return ctx->ctx;
  3525. }
  3526. int ssl_hmac_init(SSL_HMAC *ctx, void *key, size_t len, char *md)
  3527. {
  3528. OSSL_PARAM params[2], *p = params;
  3529. if (ctx->ctx != NULL) {
  3530. *p++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, md, 0);
  3531. *p = OSSL_PARAM_construct_end();
  3532. if (EVP_MAC_init(ctx->ctx, key, len, params))
  3533. return 1;
  3534. }
  3535. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3536. if (ctx->old_ctx != NULL)
  3537. return ssl_hmac_old_init(ctx, key, len, md);
  3538. #endif
  3539. return 0;
  3540. }
  3541. int ssl_hmac_update(SSL_HMAC *ctx, const unsigned char *data, size_t len)
  3542. {
  3543. if (ctx->ctx != NULL)
  3544. return EVP_MAC_update(ctx->ctx, data, len);
  3545. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3546. if (ctx->old_ctx != NULL)
  3547. return ssl_hmac_old_update(ctx, data, len);
  3548. #endif
  3549. return 0;
  3550. }
  3551. int ssl_hmac_final(SSL_HMAC *ctx, unsigned char *md, size_t *len,
  3552. size_t max_size)
  3553. {
  3554. if (ctx->ctx != NULL)
  3555. return EVP_MAC_final(ctx->ctx, md, len, max_size);
  3556. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3557. if (ctx->old_ctx != NULL)
  3558. return ssl_hmac_old_final(ctx, md, len);
  3559. #endif
  3560. return 0;
  3561. }
  3562. size_t ssl_hmac_size(const SSL_HMAC *ctx)
  3563. {
  3564. if (ctx->ctx != NULL)
  3565. return EVP_MAC_CTX_get_mac_size(ctx->ctx);
  3566. #ifndef OPENSSL_NO_DEPRECATED_3_0
  3567. if (ctx->old_ctx != NULL)
  3568. return ssl_hmac_old_size(ctx);
  3569. #endif
  3570. return 0;
  3571. }
  3572. int ssl_get_EC_curve_nid(const EVP_PKEY *pkey)
  3573. {
  3574. char gname[OSSL_MAX_NAME_SIZE];
  3575. if (EVP_PKEY_get_group_name(pkey, gname, sizeof(gname), NULL) > 0)
  3576. return OBJ_txt2nid(gname);
  3577. return NID_undef;
  3578. }
  3579. __owur int tls13_set_encoded_pub_key(EVP_PKEY *pkey,
  3580. const unsigned char *enckey,
  3581. size_t enckeylen)
  3582. {
  3583. if (EVP_PKEY_is_a(pkey, "DH")) {
  3584. int bits = EVP_PKEY_get_bits(pkey);
  3585. if (bits <= 0 || enckeylen != (size_t)bits / 8)
  3586. /* the encoded key must be padded to the length of the p */
  3587. return 0;
  3588. } else if (EVP_PKEY_is_a(pkey, "EC")) {
  3589. if (enckeylen < 3 /* point format and at least 1 byte for x and y */
  3590. || enckey[0] != 0x04)
  3591. return 0;
  3592. }
  3593. return EVP_PKEY_set1_encoded_public_key(pkey, enckey, enckeylen);
  3594. }