2
0

s3_enc.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502
  1. /*
  2. * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
  3. * Copyright 2005 Nokia. All rights reserved.
  4. *
  5. * Licensed under the Apache License 2.0 (the "License"). You may not use
  6. * this file except in compliance with the License. You can obtain a copy
  7. * in the file LICENSE in the source distribution or at
  8. * https://www.openssl.org/source/license.html
  9. */
  10. #include <stdio.h>
  11. #include "ssl_local.h"
  12. #include <openssl/evp.h>
  13. #include <openssl/md5.h>
  14. #include <openssl/core_names.h>
  15. #include "internal/cryptlib.h"
  16. static int ssl3_generate_key_block(SSL_CONNECTION *s, unsigned char *km, int num)
  17. {
  18. const EVP_MD *md5 = NULL, *sha1 = NULL;
  19. EVP_MD_CTX *m5;
  20. EVP_MD_CTX *s1;
  21. unsigned char buf[16], smd[SHA_DIGEST_LENGTH];
  22. unsigned char c = 'A';
  23. unsigned int i, k;
  24. int ret = 0;
  25. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  26. #ifdef CHARSET_EBCDIC
  27. c = os_toascii[c]; /* 'A' in ASCII */
  28. #endif
  29. k = 0;
  30. md5 = ssl_evp_md_fetch(sctx->libctx, NID_md5, sctx->propq);
  31. sha1 = ssl_evp_md_fetch(sctx->libctx, NID_sha1, sctx->propq);
  32. m5 = EVP_MD_CTX_new();
  33. s1 = EVP_MD_CTX_new();
  34. if (md5 == NULL || sha1 == NULL || m5 == NULL || s1 == NULL) {
  35. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
  36. goto err;
  37. }
  38. for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
  39. k++;
  40. if (k > sizeof(buf)) {
  41. /* bug: 'buf' is too small for this ciphersuite */
  42. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  43. goto err;
  44. }
  45. memset(buf, c, k);
  46. c++;
  47. if (!EVP_DigestInit_ex(s1, sha1, NULL)
  48. || !EVP_DigestUpdate(s1, buf, k)
  49. || !EVP_DigestUpdate(s1, s->session->master_key,
  50. s->session->master_key_length)
  51. || !EVP_DigestUpdate(s1, s->s3.server_random, SSL3_RANDOM_SIZE)
  52. || !EVP_DigestUpdate(s1, s->s3.client_random, SSL3_RANDOM_SIZE)
  53. || !EVP_DigestFinal_ex(s1, smd, NULL)
  54. || !EVP_DigestInit_ex(m5, md5, NULL)
  55. || !EVP_DigestUpdate(m5, s->session->master_key,
  56. s->session->master_key_length)
  57. || !EVP_DigestUpdate(m5, smd, SHA_DIGEST_LENGTH)) {
  58. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  59. goto err;
  60. }
  61. if ((int)(i + MD5_DIGEST_LENGTH) > num) {
  62. if (!EVP_DigestFinal_ex(m5, smd, NULL)) {
  63. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  64. goto err;
  65. }
  66. memcpy(km, smd, (num - i));
  67. } else {
  68. if (!EVP_DigestFinal_ex(m5, km, NULL)) {
  69. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  70. goto err;
  71. }
  72. }
  73. km += MD5_DIGEST_LENGTH;
  74. }
  75. OPENSSL_cleanse(smd, sizeof(smd));
  76. ret = 1;
  77. err:
  78. EVP_MD_CTX_free(m5);
  79. EVP_MD_CTX_free(s1);
  80. ssl_evp_md_free(md5);
  81. ssl_evp_md_free(sha1);
  82. return ret;
  83. }
  84. int ssl3_change_cipher_state(SSL_CONNECTION *s, int which)
  85. {
  86. unsigned char *p, *mac_secret;
  87. size_t md_len;
  88. unsigned char *key, *iv;
  89. const EVP_CIPHER *ciph;
  90. const SSL_COMP *comp = NULL;
  91. const EVP_MD *md;
  92. int mdi;
  93. size_t n, iv_len, key_len;
  94. int direction = (which & SSL3_CC_READ) != 0 ? OSSL_RECORD_DIRECTION_READ
  95. : OSSL_RECORD_DIRECTION_WRITE;
  96. ciph = s->s3.tmp.new_sym_enc;
  97. md = s->s3.tmp.new_hash;
  98. /* m == NULL will lead to a crash later */
  99. if (!ossl_assert(md != NULL)) {
  100. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  101. goto err;
  102. }
  103. #ifndef OPENSSL_NO_COMP
  104. comp = s->s3.tmp.new_compression;
  105. #endif
  106. p = s->s3.tmp.key_block;
  107. mdi = EVP_MD_get_size(md);
  108. if (mdi < 0) {
  109. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  110. goto err;
  111. }
  112. md_len = (size_t)mdi;
  113. key_len = EVP_CIPHER_get_key_length(ciph);
  114. iv_len = EVP_CIPHER_get_iv_length(ciph);
  115. if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
  116. (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
  117. mac_secret = &(p[0]);
  118. n = md_len + md_len;
  119. key = &(p[n]);
  120. n += key_len + key_len;
  121. iv = &(p[n]);
  122. n += iv_len + iv_len;
  123. } else {
  124. n = md_len;
  125. mac_secret = &(p[n]);
  126. n += md_len + key_len;
  127. key = &(p[n]);
  128. n += key_len + iv_len;
  129. iv = &(p[n]);
  130. n += iv_len;
  131. }
  132. if (n > s->s3.tmp.key_block_length) {
  133. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  134. goto err;
  135. }
  136. if (!ssl_set_new_record_layer(s, SSL3_VERSION,
  137. direction,
  138. OSSL_RECORD_PROTECTION_LEVEL_APPLICATION,
  139. NULL, 0, key, key_len, iv, iv_len, mac_secret,
  140. md_len, ciph, 0, NID_undef, md, comp, NULL)) {
  141. /* SSLfatal already called */
  142. goto err;
  143. }
  144. return 1;
  145. err:
  146. return 0;
  147. }
  148. int ssl3_setup_key_block(SSL_CONNECTION *s)
  149. {
  150. unsigned char *p;
  151. const EVP_CIPHER *c;
  152. const EVP_MD *hash;
  153. int num;
  154. int ret = 0;
  155. SSL_COMP *comp;
  156. if (s->s3.tmp.key_block_length != 0)
  157. return 1;
  158. if (!ssl_cipher_get_evp(SSL_CONNECTION_GET_CTX(s), s->session, &c, &hash,
  159. NULL, NULL, &comp, 0)) {
  160. /* Error is already recorded */
  161. SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR);
  162. return 0;
  163. }
  164. ssl_evp_cipher_free(s->s3.tmp.new_sym_enc);
  165. s->s3.tmp.new_sym_enc = c;
  166. ssl_evp_md_free(s->s3.tmp.new_hash);
  167. s->s3.tmp.new_hash = hash;
  168. #ifdef OPENSSL_NO_COMP
  169. s->s3.tmp.new_compression = NULL;
  170. #else
  171. s->s3.tmp.new_compression = comp;
  172. #endif
  173. num = EVP_MD_get_size(hash);
  174. if (num < 0)
  175. return 0;
  176. num = EVP_CIPHER_get_key_length(c) + num + EVP_CIPHER_get_iv_length(c);
  177. num *= 2;
  178. ssl3_cleanup_key_block(s);
  179. if ((p = OPENSSL_malloc(num)) == NULL) {
  180. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
  181. return 0;
  182. }
  183. s->s3.tmp.key_block_length = num;
  184. s->s3.tmp.key_block = p;
  185. /* Calls SSLfatal() as required */
  186. ret = ssl3_generate_key_block(s, p, num);
  187. return ret;
  188. }
  189. void ssl3_cleanup_key_block(SSL_CONNECTION *s)
  190. {
  191. OPENSSL_clear_free(s->s3.tmp.key_block, s->s3.tmp.key_block_length);
  192. s->s3.tmp.key_block = NULL;
  193. s->s3.tmp.key_block_length = 0;
  194. }
  195. int ssl3_init_finished_mac(SSL_CONNECTION *s)
  196. {
  197. BIO *buf = BIO_new(BIO_s_mem());
  198. if (buf == NULL) {
  199. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BIO_LIB);
  200. return 0;
  201. }
  202. ssl3_free_digest_list(s);
  203. s->s3.handshake_buffer = buf;
  204. (void)BIO_set_close(s->s3.handshake_buffer, BIO_CLOSE);
  205. return 1;
  206. }
  207. /*
  208. * Free digest list. Also frees handshake buffer since they are always freed
  209. * together.
  210. */
  211. void ssl3_free_digest_list(SSL_CONNECTION *s)
  212. {
  213. BIO_free(s->s3.handshake_buffer);
  214. s->s3.handshake_buffer = NULL;
  215. EVP_MD_CTX_free(s->s3.handshake_dgst);
  216. s->s3.handshake_dgst = NULL;
  217. }
  218. int ssl3_finish_mac(SSL_CONNECTION *s, const unsigned char *buf, size_t len)
  219. {
  220. int ret;
  221. if (s->s3.handshake_dgst == NULL) {
  222. /* Note: this writes to a memory BIO so a failure is a fatal error */
  223. if (len > INT_MAX) {
  224. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_OVERFLOW_ERROR);
  225. return 0;
  226. }
  227. ret = BIO_write(s->s3.handshake_buffer, (void *)buf, (int)len);
  228. if (ret <= 0 || ret != (int)len) {
  229. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  230. return 0;
  231. }
  232. } else {
  233. ret = EVP_DigestUpdate(s->s3.handshake_dgst, buf, len);
  234. if (!ret) {
  235. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  236. return 0;
  237. }
  238. }
  239. return 1;
  240. }
  241. int ssl3_digest_cached_records(SSL_CONNECTION *s, int keep)
  242. {
  243. const EVP_MD *md;
  244. long hdatalen;
  245. void *hdata;
  246. if (s->s3.handshake_dgst == NULL) {
  247. hdatalen = BIO_get_mem_data(s->s3.handshake_buffer, &hdata);
  248. if (hdatalen <= 0) {
  249. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_LENGTH);
  250. return 0;
  251. }
  252. s->s3.handshake_dgst = EVP_MD_CTX_new();
  253. if (s->s3.handshake_dgst == NULL) {
  254. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
  255. return 0;
  256. }
  257. md = ssl_handshake_md(s);
  258. if (md == NULL) {
  259. SSLfatal(s, SSL_AD_INTERNAL_ERROR,
  260. SSL_R_NO_SUITABLE_DIGEST_ALGORITHM);
  261. return 0;
  262. }
  263. if (!EVP_DigestInit_ex(s->s3.handshake_dgst, md, NULL)
  264. || !EVP_DigestUpdate(s->s3.handshake_dgst, hdata, hdatalen)) {
  265. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  266. return 0;
  267. }
  268. }
  269. if (keep == 0) {
  270. BIO_free(s->s3.handshake_buffer);
  271. s->s3.handshake_buffer = NULL;
  272. }
  273. return 1;
  274. }
  275. void ssl3_digest_master_key_set_params(const SSL_SESSION *session,
  276. OSSL_PARAM params[])
  277. {
  278. int n = 0;
  279. params[n++] = OSSL_PARAM_construct_octet_string(OSSL_DIGEST_PARAM_SSL3_MS,
  280. (void *)session->master_key,
  281. session->master_key_length);
  282. params[n++] = OSSL_PARAM_construct_end();
  283. }
  284. size_t ssl3_final_finish_mac(SSL_CONNECTION *s, const char *sender, size_t len,
  285. unsigned char *p)
  286. {
  287. int ret;
  288. EVP_MD_CTX *ctx = NULL;
  289. if (!ssl3_digest_cached_records(s, 0)) {
  290. /* SSLfatal() already called */
  291. return 0;
  292. }
  293. if (EVP_MD_CTX_get_type(s->s3.handshake_dgst) != NID_md5_sha1) {
  294. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_REQUIRED_DIGEST);
  295. return 0;
  296. }
  297. ctx = EVP_MD_CTX_new();
  298. if (ctx == NULL) {
  299. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
  300. return 0;
  301. }
  302. if (!EVP_MD_CTX_copy_ex(ctx, s->s3.handshake_dgst)) {
  303. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  304. ret = 0;
  305. goto err;
  306. }
  307. ret = EVP_MD_CTX_get_size(ctx);
  308. if (ret < 0) {
  309. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  310. ret = 0;
  311. goto err;
  312. }
  313. if (sender != NULL) {
  314. OSSL_PARAM digest_cmd_params[3];
  315. ssl3_digest_master_key_set_params(s->session, digest_cmd_params);
  316. if (EVP_DigestUpdate(ctx, sender, len) <= 0
  317. || EVP_MD_CTX_set_params(ctx, digest_cmd_params) <= 0
  318. || EVP_DigestFinal_ex(ctx, p, NULL) <= 0) {
  319. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  320. ret = 0;
  321. }
  322. }
  323. err:
  324. EVP_MD_CTX_free(ctx);
  325. return ret;
  326. }
  327. int ssl3_generate_master_secret(SSL_CONNECTION *s, unsigned char *out,
  328. unsigned char *p,
  329. size_t len, size_t *secret_size)
  330. {
  331. static const unsigned char *const salt[3] = {
  332. #ifndef CHARSET_EBCDIC
  333. (const unsigned char *)"A",
  334. (const unsigned char *)"BB",
  335. (const unsigned char *)"CCC",
  336. #else
  337. (const unsigned char *)"\x41",
  338. (const unsigned char *)"\x42\x42",
  339. (const unsigned char *)"\x43\x43\x43",
  340. #endif
  341. };
  342. unsigned char buf[EVP_MAX_MD_SIZE];
  343. EVP_MD_CTX *ctx = EVP_MD_CTX_new();
  344. int i, ret = 1;
  345. unsigned int n;
  346. size_t ret_secret_size = 0;
  347. if (ctx == NULL) {
  348. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
  349. return 0;
  350. }
  351. for (i = 0; i < 3; i++) {
  352. if (EVP_DigestInit_ex(ctx, SSL_CONNECTION_GET_CTX(s)->sha1, NULL) <= 0
  353. || EVP_DigestUpdate(ctx, salt[i],
  354. strlen((const char *)salt[i])) <= 0
  355. || EVP_DigestUpdate(ctx, p, len) <= 0
  356. || EVP_DigestUpdate(ctx, &(s->s3.client_random[0]),
  357. SSL3_RANDOM_SIZE) <= 0
  358. || EVP_DigestUpdate(ctx, &(s->s3.server_random[0]),
  359. SSL3_RANDOM_SIZE) <= 0
  360. || EVP_DigestFinal_ex(ctx, buf, &n) <= 0
  361. || EVP_DigestInit_ex(ctx, SSL_CONNECTION_GET_CTX(s)->md5, NULL) <= 0
  362. || EVP_DigestUpdate(ctx, p, len) <= 0
  363. || EVP_DigestUpdate(ctx, buf, n) <= 0
  364. || EVP_DigestFinal_ex(ctx, out, &n) <= 0) {
  365. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  366. ret = 0;
  367. break;
  368. }
  369. out += n;
  370. ret_secret_size += n;
  371. }
  372. EVP_MD_CTX_free(ctx);
  373. OPENSSL_cleanse(buf, sizeof(buf));
  374. if (ret)
  375. *secret_size = ret_secret_size;
  376. return ret;
  377. }
  378. int ssl3_alert_code(int code)
  379. {
  380. switch (code) {
  381. case SSL_AD_CLOSE_NOTIFY:
  382. return SSL3_AD_CLOSE_NOTIFY;
  383. case SSL_AD_UNEXPECTED_MESSAGE:
  384. return SSL3_AD_UNEXPECTED_MESSAGE;
  385. case SSL_AD_BAD_RECORD_MAC:
  386. return SSL3_AD_BAD_RECORD_MAC;
  387. case SSL_AD_DECRYPTION_FAILED:
  388. return SSL3_AD_BAD_RECORD_MAC;
  389. case SSL_AD_RECORD_OVERFLOW:
  390. return SSL3_AD_BAD_RECORD_MAC;
  391. case SSL_AD_DECOMPRESSION_FAILURE:
  392. return SSL3_AD_DECOMPRESSION_FAILURE;
  393. case SSL_AD_HANDSHAKE_FAILURE:
  394. return SSL3_AD_HANDSHAKE_FAILURE;
  395. case SSL_AD_NO_CERTIFICATE:
  396. return SSL3_AD_NO_CERTIFICATE;
  397. case SSL_AD_BAD_CERTIFICATE:
  398. return SSL3_AD_BAD_CERTIFICATE;
  399. case SSL_AD_UNSUPPORTED_CERTIFICATE:
  400. return SSL3_AD_UNSUPPORTED_CERTIFICATE;
  401. case SSL_AD_CERTIFICATE_REVOKED:
  402. return SSL3_AD_CERTIFICATE_REVOKED;
  403. case SSL_AD_CERTIFICATE_EXPIRED:
  404. return SSL3_AD_CERTIFICATE_EXPIRED;
  405. case SSL_AD_CERTIFICATE_UNKNOWN:
  406. return SSL3_AD_CERTIFICATE_UNKNOWN;
  407. case SSL_AD_ILLEGAL_PARAMETER:
  408. return SSL3_AD_ILLEGAL_PARAMETER;
  409. case SSL_AD_UNKNOWN_CA:
  410. return SSL3_AD_BAD_CERTIFICATE;
  411. case SSL_AD_ACCESS_DENIED:
  412. return SSL3_AD_HANDSHAKE_FAILURE;
  413. case SSL_AD_DECODE_ERROR:
  414. return SSL3_AD_HANDSHAKE_FAILURE;
  415. case SSL_AD_DECRYPT_ERROR:
  416. return SSL3_AD_HANDSHAKE_FAILURE;
  417. case SSL_AD_EXPORT_RESTRICTION:
  418. return SSL3_AD_HANDSHAKE_FAILURE;
  419. case SSL_AD_PROTOCOL_VERSION:
  420. return SSL3_AD_HANDSHAKE_FAILURE;
  421. case SSL_AD_INSUFFICIENT_SECURITY:
  422. return SSL3_AD_HANDSHAKE_FAILURE;
  423. case SSL_AD_INTERNAL_ERROR:
  424. return SSL3_AD_HANDSHAKE_FAILURE;
  425. case SSL_AD_USER_CANCELLED:
  426. return SSL3_AD_HANDSHAKE_FAILURE;
  427. case SSL_AD_NO_RENEGOTIATION:
  428. return -1; /* Don't send it :-) */
  429. case SSL_AD_UNSUPPORTED_EXTENSION:
  430. return SSL3_AD_HANDSHAKE_FAILURE;
  431. case SSL_AD_CERTIFICATE_UNOBTAINABLE:
  432. return SSL3_AD_HANDSHAKE_FAILURE;
  433. case SSL_AD_UNRECOGNIZED_NAME:
  434. return SSL3_AD_HANDSHAKE_FAILURE;
  435. case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
  436. return SSL3_AD_HANDSHAKE_FAILURE;
  437. case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
  438. return SSL3_AD_HANDSHAKE_FAILURE;
  439. case SSL_AD_UNKNOWN_PSK_IDENTITY:
  440. return TLS1_AD_UNKNOWN_PSK_IDENTITY;
  441. case SSL_AD_INAPPROPRIATE_FALLBACK:
  442. return TLS1_AD_INAPPROPRIATE_FALLBACK;
  443. case SSL_AD_NO_APPLICATION_PROTOCOL:
  444. return TLS1_AD_NO_APPLICATION_PROTOCOL;
  445. case SSL_AD_CERTIFICATE_REQUIRED:
  446. return SSL_AD_HANDSHAKE_FAILURE;
  447. case TLS13_AD_MISSING_EXTENSION:
  448. return SSL_AD_HANDSHAKE_FAILURE;
  449. default:
  450. return -1;
  451. }
  452. }