1 /* 2 * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/ocsp.h> 11 #include "../ssl_local.h" 12 #include "statem_local.h" 13 #include "internal/cryptlib.h" 14 #include "internal/ssl_unwrap.h" 15 16 #define COOKIE_STATE_FORMAT_VERSION 1 17 18 /* 19 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for 20 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for 21 * key_share present flag, 8 bytes for timestamp, 2 bytes for the hashlen, 22 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie 23 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing. 24 */ 25 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 8 + 2 + EVP_MAX_MD_SIZE + 1 \ 26 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH) 27 28 /* 29 * Message header + 2 bytes for protocol version + number of random bytes + 30 * + 1 byte for legacy session id length + number of bytes in legacy session id 31 * + 2 bytes for ciphersuite + 1 byte for legacy compression 32 * + 2 bytes for extension block length + 6 bytes for key_share extension 33 * + 4 bytes for cookie extension header + the number of bytes in the cookie 34 */ 35 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \ 36 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \ 37 + MAX_COOKIE_SIZE) 38 39 /* 40 * Parse the client's renegotiation binding and abort if it's not right 41 */ 42 int tls_parse_ctos_renegotiate(SSL_CONNECTION *s, PACKET *pkt, 43 unsigned int context, 44 X509 *x, size_t chainidx) 45 { 46 unsigned int ilen; 47 const unsigned char *data; 48 int ok; 49 50 /* Parse the length byte */ 51 if (!PACKET_get_1(pkt, &ilen) 52 || !PACKET_get_bytes(pkt, &data, ilen)) { 53 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR); 54 return 0; 55 } 56 57 /* Check that the extension matches */ 58 if (ilen != s->s3.previous_client_finished_len) { 59 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_RENEGOTIATION_MISMATCH); 60 return 0; 61 } 62 63 ok = memcmp(data, s->s3.previous_client_finished, 64 s->s3.previous_client_finished_len); 65 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION 66 if (ok) { 67 if ((data[0] ^ s->s3.previous_client_finished[0]) != 0xFF) { 68 ok = 0; 69 } 70 } 71 #endif 72 if (ok) { 73 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_RENEGOTIATION_MISMATCH); 74 return 0; 75 } 76 77 s->s3.send_connection_binding = 1; 78 79 return 1; 80 } 81 82 /*- 83 * The servername extension is treated as follows: 84 * 85 * - Only the hostname type is supported with a maximum length of 255. 86 * - The servername is rejected if too long or if it contains zeros, 87 * in which case an fatal alert is generated. 88 * - The servername field is maintained together with the session cache. 89 * - When a session is resumed, the servername call back invoked in order 90 * to allow the application to position itself to the right context. 91 * - The servername is acknowledged if it is new for a session or when 92 * it is identical to a previously used for the same session. 93 * Applications can control the behaviour. They can at any time 94 * set a 'desirable' servername for a new SSL object. This can be the 95 * case for example with HTTPS when a Host: header field is received and 96 * a renegotiation is requested. In this case, a possible servername 97 * presented in the new client hello is only acknowledged if it matches 98 * the value of the Host: field. 99 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 100 * if they provide for changing an explicit servername context for the 101 * session, i.e. when the session has been established with a servername 102 * extension. 103 * - On session reconnect, the servername extension may be absent. 104 */ 105 int tls_parse_ctos_server_name(SSL_CONNECTION *s, PACKET *pkt, 106 unsigned int context, X509 *x, size_t chainidx) 107 { 108 unsigned int servname_type; 109 PACKET sni, hostname; 110 111 if (!PACKET_as_length_prefixed_2(pkt, &sni) 112 /* ServerNameList must be at least 1 byte long. */ 113 || PACKET_remaining(&sni) == 0) { 114 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 115 return 0; 116 } 117 118 /* 119 * Although the intent was for server_name to be extensible, RFC 4366 120 * was not clear about it; and so OpenSSL among other implementations, 121 * always and only allows a 'host_name' name types. 122 * RFC 6066 corrected the mistake but adding new name types 123 * is nevertheless no longer feasible, so act as if no other 124 * SNI types can exist, to simplify parsing. 125 * 126 * Also note that the RFC permits only one SNI value per type, 127 * i.e., we can only have a single hostname. 128 */ 129 if (!PACKET_get_1(&sni, &servname_type) 130 || servname_type != TLSEXT_NAMETYPE_host_name 131 || !PACKET_as_length_prefixed_2(&sni, &hostname)) { 132 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 133 return 0; 134 } 135 136 /* 137 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3 138 * we always use the SNI value from the handshake. 139 */ 140 if (!s->hit || SSL_CONNECTION_IS_TLS13(s)) { 141 if (PACKET_remaining(&hostname) > TLSEXT_MAXLEN_host_name) { 142 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME, SSL_R_BAD_EXTENSION); 143 return 0; 144 } 145 146 if (PACKET_contains_zero_byte(&hostname)) { 147 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME, SSL_R_BAD_EXTENSION); 148 return 0; 149 } 150 151 /* 152 * Store the requested SNI in the SSL as temporary storage. 153 * If we accept it, it will get stored in the SSL_SESSION as well. 154 */ 155 OPENSSL_free(s->ext.hostname); 156 s->ext.hostname = NULL; 157 if (!PACKET_strndup(&hostname, &s->ext.hostname)) { 158 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 159 return 0; 160 } 161 162 s->servername_done = 1; 163 } else { 164 /* 165 * In TLSv1.2 and below we should check if the SNI is consistent between 166 * the initial handshake and the resumption. In TLSv1.3 SNI is not 167 * associated with the session. 168 */ 169 s->servername_done = (s->session->ext.hostname != NULL) 170 && PACKET_equal(&hostname, s->session->ext.hostname, 171 strlen(s->session->ext.hostname)); 172 } 173 174 return 1; 175 } 176 177 int tls_parse_ctos_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt, 178 unsigned int context, 179 X509 *x, size_t chainidx) 180 { 181 unsigned int value; 182 183 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { 184 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 185 return 0; 186 } 187 188 /* Received |value| should be a valid max-fragment-length code. */ 189 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { 190 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 191 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 192 return 0; 193 } 194 195 /* 196 * When doing a full handshake or a renegotiation max_fragment_len_mode will 197 * be TLSEXT_max_fragment_length_UNSPECIFIED 198 * 199 * In case of a resumption max_fragment_len_mode will be one of 200 * TLSEXT_max_fragment_length_DISABLED, TLSEXT_max_fragment_length_512, 201 * TLSEXT_max_fragment_length_1024, TLSEXT_max_fragment_length_2048. 202 * TLSEXT_max_fragment_length_4096 203 * 204 * RFC 6066: The negotiated length applies for the duration of the session 205 * including session resumptions. 206 * 207 * So we only set the value in case it is unspecified. 208 */ 209 if (s->session->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_UNSPECIFIED) 210 /* 211 * Store it in session, so it'll become binding for us 212 * and we'll include it in a next Server Hello. 213 */ 214 s->session->ext.max_fragment_len_mode = value; 215 216 return 1; 217 } 218 219 #ifndef OPENSSL_NO_SRP 220 int tls_parse_ctos_srp(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 221 X509 *x, size_t chainidx) 222 { 223 PACKET srp_I; 224 225 if (!PACKET_as_length_prefixed_1(pkt, &srp_I) 226 || PACKET_contains_zero_byte(&srp_I)) { 227 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 228 return 0; 229 } 230 231 if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) { 232 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 233 return 0; 234 } 235 236 return 1; 237 } 238 #endif 239 240 int tls_parse_ctos_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt, 241 unsigned int context, 242 X509 *x, size_t chainidx) 243 { 244 PACKET ec_point_format_list; 245 246 if (!PACKET_as_length_prefixed_1(pkt, &ec_point_format_list) 247 || PACKET_remaining(&ec_point_format_list) == 0) { 248 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 249 return 0; 250 } 251 252 if (!s->hit) { 253 if (!PACKET_memdup(&ec_point_format_list, 254 &s->ext.peer_ecpointformats, 255 &s->ext.peer_ecpointformats_len)) { 256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 257 return 0; 258 } 259 } 260 261 return 1; 262 } 263 264 int tls_parse_ctos_session_ticket(SSL_CONNECTION *s, PACKET *pkt, 265 unsigned int context, 266 X509 *x, size_t chainidx) 267 { 268 if (s->ext.session_ticket_cb && !s->ext.session_ticket_cb(SSL_CONNECTION_GET_USER_SSL(s), PACKET_data(pkt), PACKET_remaining(pkt), s->ext.session_ticket_cb_arg)) { 269 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 270 return 0; 271 } 272 273 return 1; 274 } 275 276 int tls_parse_ctos_sig_algs_cert(SSL_CONNECTION *s, PACKET *pkt, 277 ossl_unused unsigned int context, 278 ossl_unused X509 *x, 279 ossl_unused size_t chainidx) 280 { 281 PACKET supported_sig_algs; 282 283 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs) 284 || PACKET_remaining(&supported_sig_algs) == 0) { 285 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 286 return 0; 287 } 288 289 /* 290 * We use this routine on both clients and servers, and when clients 291 * get asked for PHA we need to always save the sigalgs regardless 292 * of whether it was a resumption or not. 293 */ 294 if ((!s->server || (s->server && !s->hit)) 295 && !tls1_save_sigalgs(s, &supported_sig_algs, 1)) { 296 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 297 return 0; 298 } 299 300 return 1; 301 } 302 303 int tls_parse_ctos_sig_algs(SSL_CONNECTION *s, PACKET *pkt, 304 unsigned int context, X509 *x, size_t chainidx) 305 { 306 PACKET supported_sig_algs; 307 308 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs) 309 || PACKET_remaining(&supported_sig_algs) == 0) { 310 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 311 return 0; 312 } 313 314 /* 315 * We use this routine on both clients and servers, and when clients 316 * get asked for PHA we need to always save the sigalgs regardless 317 * of whether it was a resumption or not. 318 */ 319 if ((!s->server || (s->server && !s->hit)) 320 && !tls1_save_sigalgs(s, &supported_sig_algs, 0)) { 321 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 322 return 0; 323 } 324 325 return 1; 326 } 327 328 #ifndef OPENSSL_NO_OCSP 329 int tls_parse_ctos_status_request(SSL_CONNECTION *s, PACKET *pkt, 330 unsigned int context, 331 X509 *x, size_t chainidx) 332 { 333 PACKET responder_id_list, exts; 334 335 /* We ignore this in a resumption handshake */ 336 if (s->hit) 337 return 1; 338 339 /* Not defined if we get one of these in a client Certificate */ 340 if (x != NULL) 341 return 1; 342 343 if (!PACKET_get_1(pkt, (unsigned int *)&s->ext.status_type)) { 344 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 345 return 0; 346 } 347 348 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { 349 /* 350 * We don't know what to do with any other type so ignore it. 351 */ 352 s->ext.status_type = TLSEXT_STATUSTYPE_nothing; 353 return 1; 354 } 355 356 if (!PACKET_get_length_prefixed_2(pkt, &responder_id_list)) { 357 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 358 return 0; 359 } 360 361 /* 362 * We remove any OCSP_RESPIDs from a previous handshake 363 * to prevent unbounded memory growth - CVE-2016-6304 364 */ 365 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free); 366 if (PACKET_remaining(&responder_id_list) > 0) { 367 s->ext.ocsp.ids = sk_OCSP_RESPID_new_null(); 368 if (s->ext.ocsp.ids == NULL) { 369 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 370 return 0; 371 } 372 } else { 373 s->ext.ocsp.ids = NULL; 374 } 375 376 while (PACKET_remaining(&responder_id_list) > 0) { 377 OCSP_RESPID *id; 378 PACKET responder_id; 379 const unsigned char *id_data; 380 381 if (!PACKET_get_length_prefixed_2(&responder_id_list, &responder_id) 382 || PACKET_remaining(&responder_id) == 0) { 383 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 384 return 0; 385 } 386 387 id_data = PACKET_data(&responder_id); 388 id = d2i_OCSP_RESPID(NULL, &id_data, 389 (int)PACKET_remaining(&responder_id)); 390 if (id == NULL) { 391 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 392 return 0; 393 } 394 395 if (id_data != PACKET_end(&responder_id)) { 396 OCSP_RESPID_free(id); 397 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 398 399 return 0; 400 } 401 402 if (!sk_OCSP_RESPID_push(s->ext.ocsp.ids, id)) { 403 OCSP_RESPID_free(id); 404 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 405 406 return 0; 407 } 408 } 409 410 /* Read in request_extensions */ 411 if (!PACKET_as_length_prefixed_2(pkt, &exts)) { 412 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 413 return 0; 414 } 415 416 if (PACKET_remaining(&exts) > 0) { 417 const unsigned char *ext_data = PACKET_data(&exts); 418 419 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, 420 X509_EXTENSION_free); 421 s->ext.ocsp.exts = d2i_X509_EXTENSIONS(NULL, &ext_data, (int)PACKET_remaining(&exts)); 422 if (s->ext.ocsp.exts == NULL || ext_data != PACKET_end(&exts)) { 423 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 424 return 0; 425 } 426 } 427 428 return 1; 429 } 430 #endif 431 432 #ifndef OPENSSL_NO_NEXTPROTONEG 433 int tls_parse_ctos_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 434 X509 *x, size_t chainidx) 435 { 436 /* 437 * We shouldn't accept this extension on a 438 * renegotiation. 439 */ 440 if (SSL_IS_FIRST_HANDSHAKE(s)) 441 s->s3.npn_seen = 1; 442 443 return 1; 444 } 445 #endif 446 447 /* 448 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN 449 * extension, not including type and length. Returns: 1 on success, 0 on error. 450 */ 451 int tls_parse_ctos_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 452 X509 *x, size_t chainidx) 453 { 454 PACKET protocol_list, save_protocol_list, protocol; 455 456 if (!SSL_IS_FIRST_HANDSHAKE(s)) 457 return 1; 458 459 if (!PACKET_as_length_prefixed_2(pkt, &protocol_list) 460 || PACKET_remaining(&protocol_list) < 2) { 461 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 462 return 0; 463 } 464 465 save_protocol_list = protocol_list; 466 do { 467 /* Protocol names can't be empty. */ 468 if (!PACKET_get_length_prefixed_1(&protocol_list, &protocol) 469 || PACKET_remaining(&protocol) == 0) { 470 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 471 return 0; 472 } 473 } while (PACKET_remaining(&protocol_list) != 0); 474 475 OPENSSL_free(s->s3.alpn_proposed); 476 s->s3.alpn_proposed = NULL; 477 s->s3.alpn_proposed_len = 0; 478 if (!PACKET_memdup(&save_protocol_list, 479 &s->s3.alpn_proposed, &s->s3.alpn_proposed_len)) { 480 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 481 return 0; 482 } 483 484 return 1; 485 } 486 487 #ifndef OPENSSL_NO_SRTP 488 int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt, 489 unsigned int context, X509 *x, size_t chainidx) 490 { 491 STACK_OF(SRTP_PROTECTION_PROFILE) *srvr; 492 unsigned int ct, mki_len, id; 493 int i, srtp_pref; 494 PACKET subpkt; 495 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 496 497 /* Ignore this if we have no SRTP profiles */ 498 if (SSL_get_srtp_profiles(ssl) == NULL) 499 return 1; 500 501 /* Pull off the length of the cipher suite list and check it is even */ 502 if (!PACKET_get_net_2(pkt, &ct) || (ct & 1) != 0 503 || !PACKET_get_sub_packet(pkt, &subpkt, ct)) { 504 SSLfatal(s, SSL_AD_DECODE_ERROR, 505 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 506 return 0; 507 } 508 509 srvr = SSL_get_srtp_profiles(ssl); 510 s->srtp_profile = NULL; 511 /* Search all profiles for a match initially */ 512 srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr); 513 514 while (PACKET_remaining(&subpkt)) { 515 if (!PACKET_get_net_2(&subpkt, &id)) { 516 SSLfatal(s, SSL_AD_DECODE_ERROR, 517 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 518 return 0; 519 } 520 521 /* 522 * Only look for match in profiles of higher preference than 523 * current match. 524 * If no profiles have been have been configured then this 525 * does nothing. 526 */ 527 for (i = 0; i < srtp_pref; i++) { 528 SRTP_PROTECTION_PROFILE *sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i); 529 530 if (sprof->id == id) { 531 s->srtp_profile = sprof; 532 srtp_pref = i; 533 break; 534 } 535 } 536 } 537 538 /* Now extract the MKI value as a sanity check, but discard it for now */ 539 if (!PACKET_get_1(pkt, &mki_len)) { 540 SSLfatal(s, SSL_AD_DECODE_ERROR, 541 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 542 return 0; 543 } 544 545 if (!PACKET_forward(pkt, mki_len) 546 || PACKET_remaining(pkt)) { 547 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_SRTP_MKI_VALUE); 548 return 0; 549 } 550 551 return 1; 552 } 553 #endif 554 555 int tls_parse_ctos_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 556 X509 *x, size_t chainidx) 557 { 558 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)) 559 s->ext.use_etm = 1; 560 561 return 1; 562 } 563 564 /* 565 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains 566 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure. 567 */ 568 int tls_parse_ctos_psk_kex_modes(SSL_CONNECTION *s, PACKET *pkt, 569 unsigned int context, 570 X509 *x, size_t chainidx) 571 { 572 #ifndef OPENSSL_NO_TLS1_3 573 PACKET psk_kex_modes; 574 unsigned int mode; 575 576 if (!PACKET_as_length_prefixed_1(pkt, &psk_kex_modes) 577 || PACKET_remaining(&psk_kex_modes) == 0) { 578 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 579 return 0; 580 } 581 582 while (PACKET_get_1(&psk_kex_modes, &mode)) { 583 if (mode == TLSEXT_KEX_MODE_KE_DHE) 584 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE_DHE; 585 else if (mode == TLSEXT_KEX_MODE_KE 586 && (s->options & SSL_OP_ALLOW_NO_DHE_KEX) != 0) 587 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; 588 } 589 590 if (((s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) != 0) 591 && (s->options & SSL_OP_PREFER_NO_DHE_KEX) != 0) { 592 593 /* 594 * If NO_DHE is supported and preferred, then we only remember this 595 * mode. DHE PSK will not be used for sure, because in any case where 596 * it would be supported (i.e. if a key share is present), NO_DHE would 597 * be supported as well. As the latter is preferred it would be 598 * chosen. By removing DHE PSK here, we don't have to deal with the 599 * SSL_OP_PREFER_NO_DHE_KEX option in any other place. 600 */ 601 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE; 602 } 603 604 #endif 605 606 return 1; 607 } 608 609 /* 610 * Use function tls_parse_ctos_key_share with helper functions extract_keyshares, 611 * check_overlap and tls_accept_ksgroup to parse the key_share extension(s) 612 * received in the ClientHello and to select the group used of the key exchange 613 */ 614 615 #ifndef OPENSSL_NO_TLS1_3 616 /* 617 * Accept a key share group by setting the related variables in s->s3 and 618 * by generating a pubkey for this group 619 */ 620 static int tls_accept_ksgroup(SSL_CONNECTION *s, uint16_t ksgroup, PACKET *encoded_pubkey) 621 { 622 /* Accept the key share group */ 623 s->s3.group_id = ksgroup; 624 s->s3.group_id_candidate = ksgroup; 625 /* Cache the selected group ID in the SSL_SESSION */ 626 s->session->kex_group = ksgroup; 627 if ((s->s3.peer_tmp = ssl_generate_param_group(s, ksgroup)) == NULL) { 628 SSLfatal(s, 629 SSL_AD_INTERNAL_ERROR, 630 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); 631 return 0; 632 } 633 if (tls13_set_encoded_pub_key(s->s3.peer_tmp, 634 PACKET_data(encoded_pubkey), 635 PACKET_remaining(encoded_pubkey)) 636 <= 0) { 637 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT); 638 return 0; 639 } 640 return 1; 641 } 642 643 #define GROUPLIST_INCREMENT 32 /* Memory allocation chunk size (nominally 64 Bytes chunks) */ 644 645 typedef enum KS_EXTRACTION_RESULT { 646 EXTRACTION_FAILURE, 647 EXTRACTION_SUCCESS, 648 EXTRACTION_SUCCESS_HRR 649 } KS_EXTRACTION_RESULT; 650 651 static KS_EXTRACTION_RESULT extract_keyshares(SSL_CONNECTION *s, PACKET *key_share_list, 652 const uint16_t *clntgroups, size_t clnt_num_groups, 653 const uint16_t *srvrgroups, size_t srvr_num_groups, 654 uint16_t **keyshares_arr, PACKET **encoded_pubkey_arr, 655 size_t *keyshares_cnt, size_t *keyshares_max) 656 { 657 PACKET encoded_pubkey; 658 size_t key_share_pos = 0; 659 size_t previous_key_share_pos = 0; 660 unsigned int group_id = 0; 661 662 /* Prepare memory to hold the extracted key share groups and related pubkeys */ 663 *keyshares_arr = OPENSSL_malloc(*keyshares_max * sizeof(**keyshares_arr)); 664 if (*keyshares_arr == NULL) { 665 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 666 goto failure; 667 } 668 *encoded_pubkey_arr = OPENSSL_malloc(*keyshares_max * sizeof(**encoded_pubkey_arr)); 669 if (*encoded_pubkey_arr == NULL) { 670 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 671 goto failure; 672 } 673 674 while (PACKET_remaining(key_share_list) > 0) { 675 /* Get the group_id for the current share and its encoded_pubkey */ 676 if (!PACKET_get_net_2(key_share_list, &group_id) 677 || !PACKET_get_length_prefixed_2(key_share_list, &encoded_pubkey) 678 || PACKET_remaining(&encoded_pubkey) == 0) { 679 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 680 goto failure; 681 } 682 683 /* 684 * If we sent an HRR then the key_share sent back MUST be for the group 685 * we requested, and must be the only key_share sent. 686 */ 687 if (s->s3.group_id != 0 688 && (group_id != s->s3.group_id 689 || PACKET_remaining(key_share_list) != 0)) { 690 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE); 691 goto failure; 692 } 693 694 /* 695 * Check if this share is in supported_groups sent from client 696 * RFC 8446 also mandates that clients send keyshares in the same 697 * order as listed in the supported groups extension, but its not 698 * required that the server check that, and some clients violate this 699 * so instead of failing the connection when that occurs, log a trace 700 * message indicating the client discrepancy. 701 */ 702 if (!check_in_list(s, group_id, clntgroups, clnt_num_groups, 0, &key_share_pos)) { 703 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE); 704 goto failure; 705 } 706 707 if (key_share_pos < previous_key_share_pos) 708 OSSL_TRACE1(TLS, "key share group id %d is out of RFC 8446 order\n", group_id); 709 710 previous_key_share_pos = key_share_pos; 711 712 if (s->s3.group_id != 0) { 713 /* 714 * We have sent a HRR, and the key share we got back is 715 * the one we expected and is the only key share and is 716 * in the list of supported_groups (checked 717 * above already), hence we accept this key share group 718 */ 719 if (!tls_accept_ksgroup(s, s->s3.group_id, &encoded_pubkey)) 720 goto failure; /* SSLfatal already called */ 721 /* We have selected a key share group via HRR, hence we're done here */ 722 return EXTRACTION_SUCCESS_HRR; 723 } 724 725 /* 726 * We tolerate but ignore a group id that we don't think is 727 * suitable for TLSv1.3 or which is not supported by the server 728 */ 729 if (!check_in_list(s, group_id, srvrgroups, srvr_num_groups, 1, NULL) 730 || !tls_group_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED) 731 || !tls_valid_group(s, group_id, TLS1_3_VERSION, TLS1_3_VERSION, 732 0, NULL)) { 733 /* Share not suitable or not supported, check next share */ 734 continue; 735 } 736 737 /* Memorize this key share group ID and its encoded point */ 738 (*keyshares_arr)[*keyshares_cnt] = group_id; 739 (*encoded_pubkey_arr)[(*keyshares_cnt)++] = encoded_pubkey; 740 741 /* 742 * Memory management (remark: While limiting the client to only allow 743 * a maximum of OPENSSL_CLIENT_MAX_KEY_SHARES to be sent, the server can 744 * handle any number of key shares) 745 */ 746 if (*keyshares_cnt == *keyshares_max) { 747 PACKET *tmp_pkt; 748 uint16_t *tmp = OPENSSL_realloc(*keyshares_arr, 749 (*keyshares_max + GROUPLIST_INCREMENT) * sizeof(**keyshares_arr)); 750 751 if (tmp == NULL) { 752 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 753 goto failure; 754 } 755 756 *keyshares_arr = tmp; 757 tmp_pkt = OPENSSL_realloc(*encoded_pubkey_arr, 758 (*keyshares_max + GROUPLIST_INCREMENT) * sizeof(**encoded_pubkey_arr)); 759 if (tmp_pkt == NULL) { 760 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 761 goto failure; 762 } 763 764 *encoded_pubkey_arr = tmp_pkt; 765 *keyshares_max += GROUPLIST_INCREMENT; 766 } 767 } 768 769 return EXTRACTION_SUCCESS; 770 771 failure: 772 /* Fatal error -> free any allocated memory and return 0 */ 773 OPENSSL_free(*keyshares_arr); 774 OPENSSL_free(*encoded_pubkey_arr); 775 return EXTRACTION_FAILURE; 776 } 777 #endif 778 779 /* 780 * For each group in the priority list of groups, check if that group is 781 * also present in the secondary list; if so, select the first overlap and 782 * assign to selected_group and also set the related index in the candidate group list, 783 * or set selected_group to 0 if no overlap 784 */ 785 #ifndef OPENSSL_NO_TLS1_3 786 static void check_overlap(SSL_CONNECTION *s, 787 const uint16_t *prio_groups, size_t prio_num_groups, 788 const uint16_t *candidate_groups, size_t candidate_num_groups, 789 int *prio_group_idx, int *candidate_group_idx, 790 uint16_t *selected_group) 791 { 792 uint16_t current_group; 793 size_t group_idx = prio_num_groups; 794 size_t new_group_idx = 0; 795 796 *candidate_group_idx = 0; 797 *prio_group_idx = 0; 798 *selected_group = 0; 799 800 for (current_group = 0; current_group < candidate_num_groups; current_group++) { 801 if (!check_in_list(s, candidate_groups[current_group], prio_groups, 802 prio_num_groups, 1, &new_group_idx) 803 || !tls_group_allowed(s, candidate_groups[current_group], 804 SSL_SECOP_CURVE_SUPPORTED) 805 || !tls_valid_group(s, candidate_groups[current_group], TLS1_3_VERSION, 806 TLS1_3_VERSION, 0, NULL)) 807 /* No overlap or group not suitable, check next group */ 808 continue; 809 810 /* 811 * is the found new_group_idx earlier in the priority list than 812 * initial or last group_idx? 813 */ 814 if (new_group_idx < group_idx) { 815 group_idx = new_group_idx; 816 *candidate_group_idx = current_group; 817 *prio_group_idx = group_idx; 818 *selected_group = prio_groups[group_idx]; 819 } 820 } 821 } 822 #endif 823 824 int tls_parse_ctos_key_share(SSL_CONNECTION *s, PACKET *pkt, 825 unsigned int context, X509 *x, size_t chainidx) 826 { 827 #ifndef OPENSSL_NO_TLS1_3 828 PACKET key_share_list; 829 const uint16_t *clntgroups, *srvrgroups; 830 const size_t *srvrtuples; 831 uint16_t *first_group_in_tuple; 832 size_t clnt_num_groups, srvr_num_groups, srvr_num_tuples; 833 PACKET *encoded_pubkey_arr = NULL; 834 uint16_t *keyshares_arr = NULL; 835 size_t keyshares_cnt = 0; 836 size_t keyshares_max = GROUPLIST_INCREMENT; 837 /* We conservatively assume that we did not find a suitable group */ 838 uint16_t group_id_candidate = 0; 839 KS_EXTRACTION_RESULT ks_extraction_result; 840 size_t current_tuple; 841 int ret = 0; 842 843 s->s3.group_id_candidate = 0; 844 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0) 845 return 1; 846 847 /* Sanity check */ 848 if (s->s3.peer_tmp != NULL) { 849 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 850 return 0; 851 } 852 853 if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) { 854 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 855 return 0; 856 } 857 858 /* Get list of server supported groups and the group tuples */ 859 tls1_get_supported_groups(s, &srvrgroups, &srvr_num_groups); 860 tls1_get_group_tuples(s, &srvrtuples, &srvr_num_tuples); 861 /* Get the clients list of supported groups. */ 862 tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups); 863 864 if (clnt_num_groups == 0) { 865 /* 866 * This can only happen if the supported_groups extension was not sent, 867 * because we verify that the length is non-zero when we process that 868 * extension. 869 */ 870 SSLfatal(s, SSL_AD_MISSING_EXTENSION, 871 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION); 872 return 0; 873 } 874 875 if (s->s3.group_id != 0 && PACKET_remaining(&key_share_list) == 0) { 876 /* 877 * If we set a group_id already, then we must have sent an HRR 878 * requesting a new key_share. If we haven't got one then that is an 879 * error 880 */ 881 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE); 882 return 0; 883 } 884 885 /* We parse the key share extension and memorize the entries (after some checks) */ 886 ks_extraction_result = extract_keyshares(s, 887 &key_share_list, 888 clntgroups, clnt_num_groups, 889 srvrgroups, srvr_num_groups, 890 &keyshares_arr, &encoded_pubkey_arr, 891 &keyshares_cnt, &keyshares_max); 892 893 if (ks_extraction_result == EXTRACTION_FAILURE) /* Fatal error during tests */ 894 return 0; /* Memory already freed and SSLfatal already called */ 895 if (ks_extraction_result == EXTRACTION_SUCCESS_HRR) /* Successful HRR */ 896 goto end; 897 898 /* 899 * We now have the following lists available to make a decision for 900 * which group the server should use for key exchange : 901 * From client: clntgroups[clnt_num_groups], 902 * keyshares_arr[keyshares_cnt], encoded_pubkey_arr[keyshares_cnt] 903 * From server: srvrgroups[srvr_num_groups], srvrtuples[srvr_num_tuples] 904 * 905 * Group selection algorithm: 906 * For all tuples do: 907 * key share group(s) overlapping with current tuple? 908 * --> Yes: accept group_id for SH 909 * --> No: is any of the client supported_groups overlapping with current tuple? 910 * --> Yes: memorize group_id for HRR, break 911 * --> No: continue to check next tuple 912 * 913 * Remark: Selection priority different for client- or server-preference 914 */ 915 first_group_in_tuple = (uint16_t *)srvrgroups; 916 for (current_tuple = 0; current_tuple < srvr_num_tuples; current_tuple++) { 917 size_t number_of_groups_in_tuple = srvrtuples[current_tuple]; 918 int prio_group_idx = 0, candidate_group_idx = 0; 919 920 /* Server or client preference ? */ 921 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) { 922 /* Server preference */ 923 /* Is there overlap with a key share group? */ 924 check_overlap(s, 925 first_group_in_tuple, number_of_groups_in_tuple, 926 keyshares_arr, keyshares_cnt, 927 &prio_group_idx, &candidate_group_idx, 928 &group_id_candidate); 929 if (group_id_candidate > 0) { /* Overlap found -> accept the key share group */ 930 if (!tls_accept_ksgroup(s, group_id_candidate, 931 &encoded_pubkey_arr[candidate_group_idx])) 932 goto err; /* SSLfatal already called */ 933 /* We have all info for a SH, hence we're done here */ 934 goto end; 935 } else { 936 /* 937 * There's no overlap with a key share, but is there at least a client 938 * supported_group overlapping with the current tuple? 939 */ 940 check_overlap(s, 941 first_group_in_tuple, number_of_groups_in_tuple, 942 clntgroups, clnt_num_groups, 943 &prio_group_idx, &candidate_group_idx, 944 &group_id_candidate); 945 if (group_id_candidate > 0) { 946 /* 947 * We did not have a key share overlap, but at least the supported 948 * groups overlap hence we can stop searching 949 * (and report group_id_candidate 'upward' for HRR) 950 */ 951 s->s3.group_id_candidate = group_id_candidate; 952 goto end; 953 } else { 954 /* 955 * Neither key share nor supported_groups overlap current 956 * tuple, hence we try the next tuple 957 */ 958 first_group_in_tuple = &first_group_in_tuple[number_of_groups_in_tuple]; 959 continue; 960 } 961 } 962 963 } else { /* We have client preference */ 964 check_overlap(s, 965 keyshares_arr, keyshares_cnt, 966 first_group_in_tuple, number_of_groups_in_tuple, 967 &prio_group_idx, &candidate_group_idx, 968 &group_id_candidate); 969 if (group_id_candidate > 0) { 970 if (!tls_accept_ksgroup(s, group_id_candidate, &encoded_pubkey_arr[prio_group_idx])) 971 goto err; 972 goto end; 973 } else { 974 check_overlap(s, 975 clntgroups, clnt_num_groups, 976 first_group_in_tuple, number_of_groups_in_tuple, 977 &prio_group_idx, &candidate_group_idx, 978 &group_id_candidate); 979 if (group_id_candidate > 0) { 980 s->s3.group_id_candidate = group_id_candidate; 981 goto end; 982 } else { 983 first_group_in_tuple = &first_group_in_tuple[number_of_groups_in_tuple]; 984 continue; 985 } 986 } 987 } 988 } 989 990 end: 991 ret = 1; 992 993 err: 994 OPENSSL_free(keyshares_arr); 995 OPENSSL_free(encoded_pubkey_arr); 996 return ret; 997 998 #endif 999 1000 return 1; 1001 } 1002 1003 int tls_parse_ctos_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 1004 X509 *x, size_t chainidx) 1005 { 1006 #ifndef OPENSSL_NO_TLS1_3 1007 unsigned int format, version, key_share, group_id; 1008 EVP_MD_CTX *hctx; 1009 EVP_PKEY *pkey; 1010 PACKET cookie, raw, chhash, appcookie; 1011 WPACKET hrrpkt; 1012 const unsigned char *data, *mdin, *ciphdata; 1013 unsigned char hmac[SHA256_DIGEST_LENGTH]; 1014 unsigned char hrr[MAX_HRR_SIZE]; 1015 size_t rawlen, hmaclen, hrrlen, ciphlen; 1016 uint64_t tm, now; 1017 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 1018 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 1019 1020 /* Ignore any cookie if we're not set up to verify it */ 1021 if (sctx->verify_stateless_cookie_cb == NULL 1022 || (s->s3.flags & TLS1_FLAGS_STATELESS) == 0) 1023 return 1; 1024 1025 if (!PACKET_as_length_prefixed_2(pkt, &cookie)) { 1026 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1027 return 0; 1028 } 1029 1030 raw = cookie; 1031 data = PACKET_data(&raw); 1032 rawlen = PACKET_remaining(&raw); 1033 if (rawlen < SHA256_DIGEST_LENGTH 1034 || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) { 1035 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1036 return 0; 1037 } 1038 mdin = PACKET_data(&raw); 1039 1040 /* Verify the HMAC of the cookie */ 1041 hctx = EVP_MD_CTX_create(); 1042 pkey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC", 1043 sctx->propq, 1044 s->session_ctx->ext.cookie_hmac_key, 1045 sizeof(s->session_ctx->ext.cookie_hmac_key)); 1046 if (hctx == NULL || pkey == NULL) { 1047 EVP_MD_CTX_free(hctx); 1048 EVP_PKEY_free(pkey); 1049 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 1050 return 0; 1051 } 1052 1053 hmaclen = SHA256_DIGEST_LENGTH; 1054 if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", sctx->libctx, 1055 sctx->propq, pkey, NULL) 1056 <= 0 1057 || EVP_DigestSign(hctx, hmac, &hmaclen, data, 1058 rawlen - SHA256_DIGEST_LENGTH) 1059 <= 0 1060 || hmaclen != SHA256_DIGEST_LENGTH) { 1061 EVP_MD_CTX_free(hctx); 1062 EVP_PKEY_free(pkey); 1063 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1064 return 0; 1065 } 1066 1067 EVP_MD_CTX_free(hctx); 1068 EVP_PKEY_free(pkey); 1069 1070 if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) { 1071 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COOKIE_MISMATCH); 1072 return 0; 1073 } 1074 1075 if (!PACKET_get_net_2(&cookie, &format)) { 1076 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1077 return 0; 1078 } 1079 /* Check the cookie format is something we recognise. Ignore it if not */ 1080 if (format != COOKIE_STATE_FORMAT_VERSION) 1081 return 1; 1082 1083 /* 1084 * The rest of these checks really shouldn't fail since we have verified the 1085 * HMAC above. 1086 */ 1087 1088 /* Check the version number is sane */ 1089 if (!PACKET_get_net_2(&cookie, &version)) { 1090 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1091 return 0; 1092 } 1093 if (version != TLS1_3_VERSION) { 1094 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1095 SSL_R_BAD_PROTOCOL_VERSION_NUMBER); 1096 return 0; 1097 } 1098 1099 if (!PACKET_get_net_2(&cookie, &group_id)) { 1100 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1101 return 0; 1102 } 1103 1104 ciphdata = PACKET_data(&cookie); 1105 if (!PACKET_forward(&cookie, 2)) { 1106 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1107 return 0; 1108 } 1109 if (group_id != s->s3.group_id 1110 || s->s3.tmp.new_cipher 1111 != ssl_get_cipher_by_char(s, ciphdata, 0)) { 1112 /* 1113 * We chose a different cipher or group id this time around to what is 1114 * in the cookie. Something must have changed. 1115 */ 1116 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_CIPHER); 1117 return 0; 1118 } 1119 1120 if (!PACKET_get_1(&cookie, &key_share) 1121 || !PACKET_get_net_8(&cookie, &tm) 1122 || !PACKET_get_length_prefixed_2(&cookie, &chhash) 1123 || !PACKET_get_length_prefixed_1(&cookie, &appcookie) 1124 || PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) { 1125 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1126 return 0; 1127 } 1128 1129 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */ 1130 now = time(NULL); 1131 if (tm > now || (now - tm) > 600) { 1132 /* Cookie is stale. Ignore it */ 1133 return 1; 1134 } 1135 1136 /* Verify the app cookie */ 1137 if (sctx->verify_stateless_cookie_cb(SSL_CONNECTION_GET_USER_SSL(s), 1138 PACKET_data(&appcookie), 1139 PACKET_remaining(&appcookie)) 1140 == 0) { 1141 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COOKIE_MISMATCH); 1142 return 0; 1143 } 1144 1145 /* 1146 * Reconstruct the HRR that we would have sent in response to the original 1147 * ClientHello so we can add it to the transcript hash. 1148 * Note: This won't work with custom HRR extensions 1149 */ 1150 if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) { 1151 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1152 return 0; 1153 } 1154 if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO) 1155 || !WPACKET_start_sub_packet_u24(&hrrpkt) 1156 || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION) 1157 || !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE) 1158 || !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id, 1159 s->tmp_session_id_len) 1160 || !ssl->method->put_cipher_by_char(s->s3.tmp.new_cipher, &hrrpkt, 1161 &ciphlen) 1162 || !WPACKET_put_bytes_u8(&hrrpkt, 0) 1163 || !WPACKET_start_sub_packet_u16(&hrrpkt)) { 1164 WPACKET_cleanup(&hrrpkt); 1165 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1166 return 0; 1167 } 1168 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions) 1169 || !WPACKET_start_sub_packet_u16(&hrrpkt) 1170 || !WPACKET_put_bytes_u16(&hrrpkt, s->version) 1171 || !WPACKET_close(&hrrpkt)) { 1172 WPACKET_cleanup(&hrrpkt); 1173 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1174 return 0; 1175 } 1176 if (key_share) { 1177 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share) 1178 || !WPACKET_start_sub_packet_u16(&hrrpkt) 1179 || !WPACKET_put_bytes_u16(&hrrpkt, s->s3.group_id) 1180 || !WPACKET_close(&hrrpkt)) { 1181 WPACKET_cleanup(&hrrpkt); 1182 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1183 return 0; 1184 } 1185 } 1186 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie) 1187 || !WPACKET_start_sub_packet_u16(&hrrpkt) 1188 || !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen) 1189 || !WPACKET_close(&hrrpkt) /* cookie extension */ 1190 || !WPACKET_close(&hrrpkt) /* extension block */ 1191 || !WPACKET_close(&hrrpkt) /* message */ 1192 || !WPACKET_get_total_written(&hrrpkt, &hrrlen) 1193 || !WPACKET_finish(&hrrpkt)) { 1194 WPACKET_cleanup(&hrrpkt); 1195 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1196 return 0; 1197 } 1198 1199 /* Reconstruct the transcript hash */ 1200 if (!create_synthetic_message_hash(s, PACKET_data(&chhash), 1201 PACKET_remaining(&chhash), hrr, 1202 hrrlen)) { 1203 /* SSLfatal() already called */ 1204 return 0; 1205 } 1206 1207 /* Act as if this ClientHello came after a HelloRetryRequest */ 1208 s->hello_retry_request = SSL_HRR_PENDING; 1209 1210 s->ext.cookieok = 1; 1211 #endif 1212 1213 return 1; 1214 } 1215 1216 int tls_parse_ctos_supported_groups(SSL_CONNECTION *s, PACKET *pkt, 1217 unsigned int context, 1218 X509 *x, size_t chainidx) 1219 { 1220 PACKET supported_groups_list; 1221 1222 /* Each group is 2 bytes and we must have at least 1. */ 1223 if (!PACKET_as_length_prefixed_2(pkt, &supported_groups_list) 1224 || PACKET_remaining(&supported_groups_list) == 0 1225 || (PACKET_remaining(&supported_groups_list) % 2) != 0) { 1226 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1227 return 0; 1228 } 1229 1230 if (!s->hit || SSL_CONNECTION_IS_TLS13(s)) { 1231 OPENSSL_free(s->ext.peer_supportedgroups); 1232 s->ext.peer_supportedgroups = NULL; 1233 s->ext.peer_supportedgroups_len = 0; 1234 if (!tls1_save_u16(&supported_groups_list, 1235 &s->ext.peer_supportedgroups, 1236 &s->ext.peer_supportedgroups_len)) { 1237 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1238 return 0; 1239 } 1240 } 1241 1242 return 1; 1243 } 1244 1245 int tls_parse_ctos_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 1246 X509 *x, size_t chainidx) 1247 { 1248 /* The extension must always be empty */ 1249 if (PACKET_remaining(pkt) != 0) { 1250 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1251 return 0; 1252 } 1253 1254 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET) 1255 return 1; 1256 1257 s->s3.flags |= TLS1_FLAGS_RECEIVED_EXTMS; 1258 1259 return 1; 1260 } 1261 1262 int tls_parse_ctos_early_data(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 1263 X509 *x, size_t chainidx) 1264 { 1265 if (PACKET_remaining(pkt) != 0) { 1266 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1267 return 0; 1268 } 1269 1270 if (s->hello_retry_request != SSL_HRR_NONE) { 1271 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION); 1272 return 0; 1273 } 1274 1275 return 1; 1276 } 1277 1278 static SSL_TICKET_STATUS tls_get_stateful_ticket(SSL_CONNECTION *s, PACKET *tick, 1279 SSL_SESSION **sess) 1280 { 1281 SSL_SESSION *tmpsess = NULL; 1282 1283 s->ext.ticket_expected = 1; 1284 1285 switch (PACKET_remaining(tick)) { 1286 case 0: 1287 return SSL_TICKET_EMPTY; 1288 1289 case SSL_MAX_SSL_SESSION_ID_LENGTH: 1290 break; 1291 1292 default: 1293 return SSL_TICKET_NO_DECRYPT; 1294 } 1295 1296 tmpsess = lookup_sess_in_cache(s, PACKET_data(tick), 1297 SSL_MAX_SSL_SESSION_ID_LENGTH); 1298 1299 if (tmpsess == NULL) 1300 return SSL_TICKET_NO_DECRYPT; 1301 1302 *sess = tmpsess; 1303 return SSL_TICKET_SUCCESS; 1304 } 1305 1306 int tls_parse_ctos_psk(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, 1307 X509 *x, size_t chainidx) 1308 { 1309 PACKET identities, binders, binder; 1310 size_t binderoffset; 1311 int hashsize; 1312 SSL_SESSION *sess = NULL; 1313 unsigned int id, i, ext = 0; 1314 const EVP_MD *md = NULL; 1315 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 1316 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s); 1317 1318 /* 1319 * If we have no PSK kex mode that we recognise then we can't resume so 1320 * ignore this extension 1321 */ 1322 if ((s->ext.psk_kex_mode 1323 & (TLSEXT_KEX_MODE_FLAG_KE | TLSEXT_KEX_MODE_FLAG_KE_DHE)) 1324 == 0) 1325 return 1; 1326 1327 if (!PACKET_get_length_prefixed_2(pkt, &identities)) { 1328 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1329 return 0; 1330 } 1331 1332 s->ext.ticket_expected = 0; 1333 for (id = 0; PACKET_remaining(&identities) != 0; id++) { 1334 PACKET identity; 1335 unsigned long ticket_agel; 1336 size_t idlen; 1337 1338 if (!PACKET_get_length_prefixed_2(&identities, &identity) 1339 || !PACKET_get_net_4(&identities, &ticket_agel)) { 1340 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1341 return 0; 1342 } 1343 1344 idlen = PACKET_remaining(&identity); 1345 if (idlen == 0) { 1346 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1347 return 0; 1348 } 1349 if (s->psk_find_session_cb != NULL 1350 && !s->psk_find_session_cb(ussl, PACKET_data(&identity), idlen, 1351 &sess)) { 1352 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_EXTENSION); 1353 return 0; 1354 } 1355 1356 #ifndef OPENSSL_NO_PSK 1357 if (sess == NULL 1358 && s->psk_server_callback != NULL 1359 && idlen <= PSK_MAX_IDENTITY_LEN) { 1360 char *pskid = NULL; 1361 unsigned char pskdata[PSK_MAX_PSK_LEN]; 1362 unsigned int pskdatalen; 1363 1364 if (!PACKET_strndup(&identity, &pskid)) { 1365 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1366 return 0; 1367 } 1368 pskdatalen = s->psk_server_callback(ussl, pskid, pskdata, 1369 sizeof(pskdata)); 1370 OPENSSL_free(pskid); 1371 if (pskdatalen > PSK_MAX_PSK_LEN) { 1372 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1373 return 0; 1374 } else if (pskdatalen > 0) { 1375 const SSL_CIPHER *cipher; 1376 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; 1377 1378 /* 1379 * We found a PSK using an old style callback. We don't know 1380 * the digest so we default to SHA256 as per the TLSv1.3 spec 1381 */ 1382 cipher = SSL_CIPHER_find(SSL_CONNECTION_GET_SSL(s), 1383 tls13_aes128gcmsha256_id); 1384 if (cipher == NULL) { 1385 OPENSSL_cleanse(pskdata, pskdatalen); 1386 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1387 return 0; 1388 } 1389 1390 sess = SSL_SESSION_new(); 1391 if (sess == NULL 1392 || !SSL_SESSION_set1_master_key(sess, pskdata, 1393 pskdatalen) 1394 || !SSL_SESSION_set_cipher(sess, cipher) 1395 || !SSL_SESSION_set_protocol_version(sess, 1396 TLS1_3_VERSION)) { 1397 OPENSSL_cleanse(pskdata, pskdatalen); 1398 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1399 goto err; 1400 } 1401 OPENSSL_cleanse(pskdata, pskdatalen); 1402 } 1403 } 1404 #endif /* OPENSSL_NO_PSK */ 1405 1406 if (sess != NULL) { 1407 /* We found a PSK */ 1408 SSL_SESSION *sesstmp = ssl_session_dup(sess, 0); 1409 1410 if (sesstmp == NULL) { 1411 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1412 goto err; 1413 } 1414 SSL_SESSION_free(sess); 1415 sess = sesstmp; 1416 1417 /* 1418 * We've just been told to use this session for this context so 1419 * make sure the sid_ctx matches up. 1420 */ 1421 memcpy(sess->sid_ctx, s->sid_ctx, s->sid_ctx_length); 1422 sess->sid_ctx_length = s->sid_ctx_length; 1423 ext = 1; 1424 if (id == 0) 1425 s->ext.early_data_ok = 1; 1426 s->ext.ticket_expected = 1; 1427 } else { 1428 OSSL_TIME t, age, expire; 1429 int ret; 1430 1431 /* 1432 * If we are using anti-replay protection then we behave as if 1433 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there 1434 * is no point in using full stateless tickets. 1435 */ 1436 if ((s->options & SSL_OP_NO_TICKET) != 0 1437 || (s->max_early_data > 0 1438 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)) 1439 ret = tls_get_stateful_ticket(s, &identity, &sess); 1440 else 1441 ret = tls_decrypt_ticket(s, PACKET_data(&identity), 1442 PACKET_remaining(&identity), NULL, 0, 1443 &sess); 1444 1445 if (ret == SSL_TICKET_EMPTY) { 1446 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1447 goto err; 1448 } 1449 1450 if (ret == SSL_TICKET_FATAL_ERR_MALLOC 1451 || ret == SSL_TICKET_FATAL_ERR_OTHER) { 1452 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1453 goto err; 1454 } 1455 if (ret == SSL_TICKET_NONE || ret == SSL_TICKET_NO_DECRYPT) 1456 continue; 1457 1458 /* Check for replay */ 1459 if (s->max_early_data > 0 1460 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0 1461 && !SSL_CTX_remove_session(s->session_ctx, sess)) { 1462 SSL_SESSION_free(sess); 1463 sess = NULL; 1464 continue; 1465 } 1466 1467 age = ossl_time_subtract(ossl_ms2time(ticket_agel), 1468 ossl_ms2time(sess->ext.tick_age_add)); 1469 t = ossl_time_subtract(ossl_time_now(), sess->time); 1470 1471 /* 1472 * Although internally we use OSS_TIME which has ns granularity, 1473 * when SSL_SESSION structures are serialised/deserialised we use 1474 * second granularity for the sess->time field. Therefore it could 1475 * appear that the client's ticket age is longer than ours (our 1476 * ticket age calculation should always be slightly longer than the 1477 * client's due to the network latency). Therefore we add 1000ms to 1478 * our age calculation to adjust for rounding errors. 1479 */ 1480 expire = ossl_time_add(t, ossl_ms2time(1000)); 1481 1482 if (id == 0 1483 && ossl_time_compare(sess->timeout, t) >= 0 1484 && ossl_time_compare(age, expire) <= 0 1485 && ossl_time_compare(ossl_time_add(age, TICKET_AGE_ALLOWANCE), 1486 expire) 1487 >= 0) { 1488 /* 1489 * Ticket age is within tolerance and not expired. We allow it 1490 * for early data 1491 */ 1492 s->ext.early_data_ok = 1; 1493 } 1494 } 1495 1496 md = ssl_md(sctx, sess->cipher->algorithm2); 1497 if (md == NULL) { 1498 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1499 goto err; 1500 } 1501 if (!EVP_MD_is_a(md, 1502 EVP_MD_get0_name(ssl_md(sctx, 1503 s->s3.tmp.new_cipher->algorithm2)))) { 1504 /* The ciphersuite is not compatible with this session. */ 1505 SSL_SESSION_free(sess); 1506 sess = NULL; 1507 s->ext.early_data_ok = 0; 1508 /* 1509 * We fall back to a full handshake. The new session ticket will be 1510 * issued to the client with the newly negotiated ciphersuite, 1511 * allowing successful resumption on future connections. 1512 */ 1513 s->ext.ticket_expected = 1; 1514 continue; 1515 } 1516 break; 1517 } 1518 1519 if (sess == NULL) 1520 return 1; 1521 1522 binderoffset = PACKET_data(pkt) - (const unsigned char *)s->init_buf->data; 1523 hashsize = EVP_MD_get_size(md); 1524 if (hashsize <= 0) 1525 goto err; 1526 1527 if (!PACKET_get_length_prefixed_2(pkt, &binders)) { 1528 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1529 goto err; 1530 } 1531 1532 for (i = 0; i <= id; i++) { 1533 if (!PACKET_get_length_prefixed_1(&binders, &binder)) { 1534 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1535 goto err; 1536 } 1537 } 1538 1539 if (PACKET_remaining(&binder) != (size_t)hashsize) { 1540 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 1541 goto err; 1542 } 1543 if (tls_psk_do_binder(s, md, (const unsigned char *)s->init_buf->data, 1544 binderoffset, PACKET_data(&binder), NULL, sess, 0, 1545 ext) 1546 != 1) { 1547 /* SSLfatal() already called */ 1548 goto err; 1549 } 1550 1551 s->ext.tick_identity = id; 1552 1553 SSL_SESSION_free(s->session); 1554 s->session = sess; 1555 return 1; 1556 err: 1557 SSL_SESSION_free(sess); 1558 return 0; 1559 } 1560 1561 int tls_parse_ctos_post_handshake_auth(SSL_CONNECTION *s, PACKET *pkt, 1562 ossl_unused unsigned int context, 1563 ossl_unused X509 *x, 1564 ossl_unused size_t chainidx) 1565 { 1566 if (PACKET_remaining(pkt) != 0) { 1567 SSLfatal(s, SSL_AD_DECODE_ERROR, 1568 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR); 1569 return 0; 1570 } 1571 1572 s->post_handshake_auth = SSL_PHA_EXT_RECEIVED; 1573 1574 return 1; 1575 } 1576 1577 /* 1578 * Add the server's renegotiation binding 1579 */ 1580 EXT_RETURN tls_construct_stoc_renegotiate(SSL_CONNECTION *s, WPACKET *pkt, 1581 unsigned int context, X509 *x, 1582 size_t chainidx) 1583 { 1584 if (!s->s3.send_connection_binding) 1585 return EXT_RETURN_NOT_SENT; 1586 1587 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */ 1588 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) 1589 || !WPACKET_start_sub_packet_u16(pkt) 1590 || !WPACKET_start_sub_packet_u8(pkt) 1591 || !WPACKET_memcpy(pkt, s->s3.previous_client_finished, 1592 s->s3.previous_client_finished_len) 1593 || !WPACKET_memcpy(pkt, s->s3.previous_server_finished, 1594 s->s3.previous_server_finished_len) 1595 || !WPACKET_close(pkt) 1596 || !WPACKET_close(pkt)) { 1597 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1598 return EXT_RETURN_FAIL; 1599 } 1600 1601 return EXT_RETURN_SENT; 1602 } 1603 1604 EXT_RETURN tls_construct_stoc_server_name(SSL_CONNECTION *s, WPACKET *pkt, 1605 unsigned int context, X509 *x, 1606 size_t chainidx) 1607 { 1608 if (s->servername_done != 1) 1609 return EXT_RETURN_NOT_SENT; 1610 1611 /* 1612 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming. 1613 * We just use the servername from the initial handshake. 1614 */ 1615 if (s->hit && !SSL_CONNECTION_IS_TLS13(s)) 1616 return EXT_RETURN_NOT_SENT; 1617 1618 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) 1619 || !WPACKET_put_bytes_u16(pkt, 0)) { 1620 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1621 return EXT_RETURN_FAIL; 1622 } 1623 1624 return EXT_RETURN_SENT; 1625 } 1626 1627 /* Add/include the server's max fragment len extension into ServerHello */ 1628 EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt, 1629 unsigned int context, X509 *x, 1630 size_t chainidx) 1631 { 1632 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s->session)) 1633 return EXT_RETURN_NOT_SENT; 1634 1635 /*- 1636 * 4 bytes for this extension type and extension length 1637 * 1 byte for the Max Fragment Length code value. 1638 */ 1639 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) 1640 || !WPACKET_start_sub_packet_u16(pkt) 1641 || !WPACKET_put_bytes_u8(pkt, s->session->ext.max_fragment_len_mode) 1642 || !WPACKET_close(pkt)) { 1643 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1644 return EXT_RETURN_FAIL; 1645 } 1646 1647 return EXT_RETURN_SENT; 1648 } 1649 1650 EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt, 1651 unsigned int context, X509 *x, 1652 size_t chainidx) 1653 { 1654 unsigned long alg_k = s->s3.tmp.new_cipher->algorithm_mkey; 1655 unsigned long alg_a = s->s3.tmp.new_cipher->algorithm_auth; 1656 int using_ecc = ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA)) 1657 && (s->ext.peer_ecpointformats != NULL); 1658 const unsigned char *plist; 1659 size_t plistlen; 1660 1661 if (!using_ecc) 1662 return EXT_RETURN_NOT_SENT; 1663 1664 tls1_get_formatlist(s, &plist, &plistlen); 1665 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) 1666 || !WPACKET_start_sub_packet_u16(pkt) 1667 || !WPACKET_sub_memcpy_u8(pkt, plist, plistlen) 1668 || !WPACKET_close(pkt)) { 1669 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1670 return EXT_RETURN_FAIL; 1671 } 1672 1673 return EXT_RETURN_SENT; 1674 } 1675 1676 EXT_RETURN tls_construct_stoc_supported_groups(SSL_CONNECTION *s, WPACKET *pkt, 1677 unsigned int context, X509 *x, 1678 size_t chainidx) 1679 { 1680 const uint16_t *groups; 1681 size_t numgroups, i, first = 1; 1682 int version; 1683 1684 /* s->s3.group_id is non zero if we accepted a key_share */ 1685 if (s->s3.group_id == 0) 1686 return EXT_RETURN_NOT_SENT; 1687 1688 /* Get our list of supported groups */ 1689 tls1_get_supported_groups(s, &groups, &numgroups); 1690 if (numgroups == 0) { 1691 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1692 return EXT_RETURN_FAIL; 1693 } 1694 1695 /* Copy group ID if supported */ 1696 version = SSL_version(SSL_CONNECTION_GET_SSL(s)); 1697 for (i = 0; i < numgroups; i++) { 1698 uint16_t group = groups[i]; 1699 1700 if (tls_valid_group(s, group, version, version, 0, NULL) 1701 && tls_group_allowed(s, group, SSL_SECOP_CURVE_SUPPORTED)) { 1702 if (first) { 1703 /* 1704 * Check if the client is already using our preferred group. If 1705 * so we don't need to add this extension 1706 */ 1707 if (s->s3.group_id == group) 1708 return EXT_RETURN_NOT_SENT; 1709 1710 /* Add extension header */ 1711 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) 1712 /* Sub-packet for supported_groups extension */ 1713 || !WPACKET_start_sub_packet_u16(pkt) 1714 || !WPACKET_start_sub_packet_u16(pkt)) { 1715 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1716 return EXT_RETURN_FAIL; 1717 } 1718 1719 first = 0; 1720 } 1721 if (!WPACKET_put_bytes_u16(pkt, group)) { 1722 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1723 return EXT_RETURN_FAIL; 1724 } 1725 } 1726 } 1727 1728 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 1729 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1730 return EXT_RETURN_FAIL; 1731 } 1732 1733 return EXT_RETURN_SENT; 1734 } 1735 1736 EXT_RETURN tls_construct_stoc_session_ticket(SSL_CONNECTION *s, WPACKET *pkt, 1737 unsigned int context, X509 *x, 1738 size_t chainidx) 1739 { 1740 if (!s->ext.ticket_expected || !tls_use_ticket(s)) { 1741 s->ext.ticket_expected = 0; 1742 return EXT_RETURN_NOT_SENT; 1743 } 1744 1745 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) 1746 || !WPACKET_put_bytes_u16(pkt, 0)) { 1747 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1748 return EXT_RETURN_FAIL; 1749 } 1750 1751 return EXT_RETURN_SENT; 1752 } 1753 1754 #ifndef OPENSSL_NO_OCSP 1755 EXT_RETURN tls_construct_stoc_status_request(SSL_CONNECTION *s, WPACKET *pkt, 1756 unsigned int context, X509 *x, 1757 size_t chainidx) 1758 { 1759 /* We don't currently support this extension inside a CertificateRequest */ 1760 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) 1761 return EXT_RETURN_NOT_SENT; 1762 1763 if (!s->ext.status_expected) 1764 return EXT_RETURN_NOT_SENT; 1765 1766 if (SSL_CONNECTION_IS_TLS13(s) && chainidx != 0) 1767 return EXT_RETURN_NOT_SENT; 1768 1769 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) 1770 || !WPACKET_start_sub_packet_u16(pkt)) { 1771 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1772 return EXT_RETURN_FAIL; 1773 } 1774 1775 /* 1776 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we 1777 * send back an empty extension, with the certificate status appearing as a 1778 * separate message 1779 */ 1780 if (SSL_CONNECTION_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt)) { 1781 /* SSLfatal() already called */ 1782 return EXT_RETURN_FAIL; 1783 } 1784 if (!WPACKET_close(pkt)) { 1785 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1786 return EXT_RETURN_FAIL; 1787 } 1788 1789 return EXT_RETURN_SENT; 1790 } 1791 #endif 1792 1793 #ifndef OPENSSL_NO_NEXTPROTONEG 1794 EXT_RETURN tls_construct_stoc_next_proto_neg(SSL_CONNECTION *s, WPACKET *pkt, 1795 unsigned int context, X509 *x, 1796 size_t chainidx) 1797 { 1798 const unsigned char *npa; 1799 unsigned int npalen; 1800 int ret; 1801 int npn_seen = s->s3.npn_seen; 1802 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 1803 1804 s->s3.npn_seen = 0; 1805 if (!npn_seen || sctx->ext.npn_advertised_cb == NULL) 1806 return EXT_RETURN_NOT_SENT; 1807 1808 ret = sctx->ext.npn_advertised_cb(SSL_CONNECTION_GET_USER_SSL(s), &npa, 1809 &npalen, sctx->ext.npn_advertised_cb_arg); 1810 if (ret == SSL_TLSEXT_ERR_OK) { 1811 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) 1812 || !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) { 1813 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1814 return EXT_RETURN_FAIL; 1815 } 1816 s->s3.npn_seen = 1; 1817 return EXT_RETURN_SENT; 1818 } 1819 1820 return EXT_RETURN_NOT_SENT; 1821 } 1822 #endif 1823 1824 EXT_RETURN tls_construct_stoc_alpn(SSL_CONNECTION *s, WPACKET *pkt, unsigned int context, 1825 X509 *x, size_t chainidx) 1826 { 1827 if (s->s3.alpn_selected == NULL) 1828 return EXT_RETURN_NOT_SENT; 1829 1830 if (!WPACKET_put_bytes_u16(pkt, 1831 TLSEXT_TYPE_application_layer_protocol_negotiation) 1832 || !WPACKET_start_sub_packet_u16(pkt) 1833 || !WPACKET_start_sub_packet_u16(pkt) 1834 || !WPACKET_sub_memcpy_u8(pkt, s->s3.alpn_selected, 1835 s->s3.alpn_selected_len) 1836 || !WPACKET_close(pkt) 1837 || !WPACKET_close(pkt)) { 1838 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1839 return EXT_RETURN_FAIL; 1840 } 1841 1842 return EXT_RETURN_SENT; 1843 } 1844 1845 #ifndef OPENSSL_NO_SRTP 1846 EXT_RETURN tls_construct_stoc_use_srtp(SSL_CONNECTION *s, WPACKET *pkt, 1847 unsigned int context, X509 *x, 1848 size_t chainidx) 1849 { 1850 if (s->srtp_profile == NULL) 1851 return EXT_RETURN_NOT_SENT; 1852 1853 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) 1854 || !WPACKET_start_sub_packet_u16(pkt) 1855 || !WPACKET_put_bytes_u16(pkt, 2) 1856 || !WPACKET_put_bytes_u16(pkt, s->srtp_profile->id) 1857 || !WPACKET_put_bytes_u8(pkt, 0) 1858 || !WPACKET_close(pkt)) { 1859 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1860 return EXT_RETURN_FAIL; 1861 } 1862 1863 return EXT_RETURN_SENT; 1864 } 1865 #endif 1866 1867 EXT_RETURN tls_construct_stoc_etm(SSL_CONNECTION *s, WPACKET *pkt, 1868 unsigned int context, 1869 X509 *x, size_t chainidx) 1870 { 1871 if (!s->ext.use_etm) 1872 return EXT_RETURN_NOT_SENT; 1873 1874 /* 1875 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable 1876 * for other cases too. 1877 */ 1878 if (s->s3.tmp.new_cipher->algorithm_mac == SSL_AEAD 1879 || s->s3.tmp.new_cipher->algorithm_enc == SSL_RC4 1880 || s->s3.tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT 1881 || s->s3.tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12 1882 || s->s3.tmp.new_cipher->algorithm_enc == SSL_MAGMA 1883 || s->s3.tmp.new_cipher->algorithm_enc == SSL_KUZNYECHIK) { 1884 s->ext.use_etm = 0; 1885 return EXT_RETURN_NOT_SENT; 1886 } 1887 1888 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) 1889 || !WPACKET_put_bytes_u16(pkt, 0)) { 1890 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1891 return EXT_RETURN_FAIL; 1892 } 1893 1894 return EXT_RETURN_SENT; 1895 } 1896 1897 EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt, 1898 unsigned int context, 1899 X509 *x, size_t chainidx) 1900 { 1901 if ((s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0) 1902 return EXT_RETURN_NOT_SENT; 1903 1904 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) 1905 || !WPACKET_put_bytes_u16(pkt, 0)) { 1906 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1907 return EXT_RETURN_FAIL; 1908 } 1909 1910 return EXT_RETURN_SENT; 1911 } 1912 1913 EXT_RETURN tls_construct_stoc_supported_versions(SSL_CONNECTION *s, WPACKET *pkt, 1914 unsigned int context, X509 *x, 1915 size_t chainidx) 1916 { 1917 if (!ossl_assert(SSL_CONNECTION_IS_TLS13(s))) { 1918 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1919 return EXT_RETURN_FAIL; 1920 } 1921 1922 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) 1923 || !WPACKET_start_sub_packet_u16(pkt) 1924 || !WPACKET_put_bytes_u16(pkt, s->version) 1925 || !WPACKET_close(pkt)) { 1926 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1927 return EXT_RETURN_FAIL; 1928 } 1929 1930 return EXT_RETURN_SENT; 1931 } 1932 1933 EXT_RETURN tls_construct_stoc_key_share(SSL_CONNECTION *s, WPACKET *pkt, 1934 unsigned int context, X509 *x, 1935 size_t chainidx) 1936 { 1937 #ifndef OPENSSL_NO_TLS1_3 1938 unsigned char *encoded_pubkey; 1939 size_t encoded_pubkey_len = 0; 1940 EVP_PKEY *ckey = s->s3.peer_tmp, *skey = NULL; 1941 const TLS_GROUP_INFO *ginf = NULL; 1942 1943 if (s->hello_retry_request == SSL_HRR_PENDING) { 1944 if (ckey != NULL) { 1945 /* Original key_share was acceptable so don't ask for another one */ 1946 return EXT_RETURN_NOT_SENT; 1947 } 1948 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 1949 || !WPACKET_start_sub_packet_u16(pkt) 1950 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id) 1951 || !WPACKET_close(pkt)) { 1952 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1953 return EXT_RETURN_FAIL; 1954 } 1955 1956 return EXT_RETURN_SENT; 1957 } 1958 1959 if (ckey == NULL) { 1960 /* No key_share received from client - must be resuming */ 1961 if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) { 1962 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1963 return EXT_RETURN_FAIL; 1964 } 1965 return EXT_RETURN_NOT_SENT; 1966 } 1967 1968 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0) { 1969 /* 1970 * PSK ('hit') and explicitly not doing DHE. If the client sent the 1971 * DHE option, we take it by default, except if non-DHE would be 1972 * preferred by config, but this case would have been handled in 1973 * tls_parse_ctos_psk_kex_modes(). 1974 */ 1975 return EXT_RETURN_NOT_SENT; 1976 } 1977 1978 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 1979 || !WPACKET_start_sub_packet_u16(pkt) 1980 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)) { 1981 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1982 return EXT_RETURN_FAIL; 1983 } 1984 1985 if ((ginf = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s), 1986 s->s3.group_id)) 1987 == NULL) { 1988 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1989 return EXT_RETURN_FAIL; 1990 } 1991 1992 if (!ginf->is_kem) { 1993 /* Regular KEX */ 1994 skey = ssl_generate_pkey(s, ckey); 1995 if (skey == NULL) { 1996 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); 1997 return EXT_RETURN_FAIL; 1998 } 1999 2000 /* Generate encoding of server key */ 2001 encoded_pubkey_len = EVP_PKEY_get1_encoded_public_key(skey, &encoded_pubkey); 2002 if (encoded_pubkey_len == 0) { 2003 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB); 2004 EVP_PKEY_free(skey); 2005 return EXT_RETURN_FAIL; 2006 } 2007 2008 if (!WPACKET_sub_memcpy_u16(pkt, encoded_pubkey, encoded_pubkey_len) 2009 || !WPACKET_close(pkt)) { 2010 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2011 EVP_PKEY_free(skey); 2012 OPENSSL_free(encoded_pubkey); 2013 return EXT_RETURN_FAIL; 2014 } 2015 OPENSSL_free(encoded_pubkey); 2016 2017 /* 2018 * This causes the crypto state to be updated based on the derived keys 2019 */ 2020 s->s3.tmp.pkey = skey; 2021 if (ssl_derive(s, skey, ckey, 1) == 0) { 2022 /* SSLfatal() already called */ 2023 return EXT_RETURN_FAIL; 2024 } 2025 } else { 2026 /* KEM mode */ 2027 unsigned char *ct = NULL; 2028 size_t ctlen = 0; 2029 2030 /* 2031 * This does not update the crypto state. 2032 * 2033 * The generated pms is stored in `s->s3.tmp.pms` to be later used via 2034 * ssl_gensecret(). 2035 */ 2036 if (ssl_encapsulate(s, ckey, &ct, &ctlen, 0) == 0) { 2037 /* SSLfatal() already called */ 2038 return EXT_RETURN_FAIL; 2039 } 2040 2041 if (ctlen == 0) { 2042 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2043 OPENSSL_free(ct); 2044 return EXT_RETURN_FAIL; 2045 } 2046 2047 if (!WPACKET_sub_memcpy_u16(pkt, ct, ctlen) 2048 || !WPACKET_close(pkt)) { 2049 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2050 OPENSSL_free(ct); 2051 return EXT_RETURN_FAIL; 2052 } 2053 OPENSSL_free(ct); 2054 2055 /* 2056 * This causes the crypto state to be updated based on the generated pms 2057 */ 2058 if (ssl_gensecret(s, s->s3.tmp.pms, s->s3.tmp.pmslen) == 0) { 2059 /* SSLfatal() already called */ 2060 return EXT_RETURN_FAIL; 2061 } 2062 } 2063 s->s3.did_kex = 1; 2064 return EXT_RETURN_SENT; 2065 #else 2066 return EXT_RETURN_FAIL; 2067 #endif 2068 } 2069 2070 EXT_RETURN tls_construct_stoc_cookie(SSL_CONNECTION *s, WPACKET *pkt, 2071 unsigned int context, 2072 X509 *x, size_t chainidx) 2073 { 2074 #ifndef OPENSSL_NO_TLS1_3 2075 unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie; 2076 unsigned char *hmac, *hmac2; 2077 size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen; 2078 EVP_MD_CTX *hctx; 2079 EVP_PKEY *pkey; 2080 int ret = EXT_RETURN_FAIL; 2081 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 2082 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 2083 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s); 2084 2085 if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0) 2086 return EXT_RETURN_NOT_SENT; 2087 2088 if (sctx->gen_stateless_cookie_cb == NULL) { 2089 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_COOKIE_CALLBACK_SET); 2090 return EXT_RETURN_FAIL; 2091 } 2092 2093 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) 2094 || !WPACKET_start_sub_packet_u16(pkt) 2095 || !WPACKET_start_sub_packet_u16(pkt) 2096 || !WPACKET_get_total_written(pkt, &startlen) 2097 || !WPACKET_reserve_bytes(pkt, MAX_COOKIE_SIZE, &cookie) 2098 || !WPACKET_put_bytes_u16(pkt, COOKIE_STATE_FORMAT_VERSION) 2099 || !WPACKET_put_bytes_u16(pkt, TLS1_3_VERSION) 2100 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id) 2101 || !ssl->method->put_cipher_by_char(s->s3.tmp.new_cipher, pkt, 2102 &ciphlen) 2103 /* Is there a key_share extension present in this HRR? */ 2104 || !WPACKET_put_bytes_u8(pkt, s->s3.peer_tmp == NULL) 2105 || !WPACKET_put_bytes_u64(pkt, time(NULL)) 2106 || !WPACKET_start_sub_packet_u16(pkt) 2107 || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &hashval1)) { 2108 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2109 return EXT_RETURN_FAIL; 2110 } 2111 2112 /* 2113 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates 2114 * on raw buffers, so we first reserve sufficient bytes (above) and then 2115 * subsequently allocate them (below) 2116 */ 2117 if (!ssl3_digest_cached_records(s, 0) 2118 || !ssl_handshake_hash(s, hashval1, EVP_MAX_MD_SIZE, &hashlen)) { 2119 /* SSLfatal() already called */ 2120 return EXT_RETURN_FAIL; 2121 } 2122 2123 if (!WPACKET_allocate_bytes(pkt, hashlen, &hashval2) 2124 || !ossl_assert(hashval1 == hashval2) 2125 || !WPACKET_close(pkt) 2126 || !WPACKET_start_sub_packet_u8(pkt) 2127 || !WPACKET_reserve_bytes(pkt, SSL_COOKIE_LENGTH, &appcookie1)) { 2128 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2129 return EXT_RETURN_FAIL; 2130 } 2131 2132 /* Generate the application cookie */ 2133 if (sctx->gen_stateless_cookie_cb(ussl, appcookie1, 2134 &appcookielen) 2135 == 0) { 2136 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_COOKIE_GEN_CALLBACK_FAILURE); 2137 return EXT_RETURN_FAIL; 2138 } 2139 2140 if (!WPACKET_allocate_bytes(pkt, appcookielen, &appcookie2) 2141 || !ossl_assert(appcookie1 == appcookie2) 2142 || !WPACKET_close(pkt) 2143 || !WPACKET_get_total_written(pkt, &totcookielen) 2144 || !WPACKET_reserve_bytes(pkt, SHA256_DIGEST_LENGTH, &hmac)) { 2145 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2146 return EXT_RETURN_FAIL; 2147 } 2148 hmaclen = SHA256_DIGEST_LENGTH; 2149 2150 totcookielen -= startlen; 2151 if (!ossl_assert(totcookielen <= MAX_COOKIE_SIZE - SHA256_DIGEST_LENGTH)) { 2152 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2153 return EXT_RETURN_FAIL; 2154 } 2155 2156 /* HMAC the cookie */ 2157 hctx = EVP_MD_CTX_create(); 2158 pkey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC", 2159 sctx->propq, 2160 s->session_ctx->ext.cookie_hmac_key, 2161 sizeof(s->session_ctx->ext.cookie_hmac_key)); 2162 if (hctx == NULL || pkey == NULL) { 2163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 2164 goto err; 2165 } 2166 2167 if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", sctx->libctx, 2168 sctx->propq, pkey, NULL) 2169 <= 0 2170 || EVP_DigestSign(hctx, hmac, &hmaclen, cookie, 2171 totcookielen) 2172 <= 0) { 2173 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2174 goto err; 2175 } 2176 2177 if (!ossl_assert(totcookielen + hmaclen <= MAX_COOKIE_SIZE)) { 2178 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2179 goto err; 2180 } 2181 2182 if (!WPACKET_allocate_bytes(pkt, hmaclen, &hmac2) 2183 || !ossl_assert(hmac == hmac2) 2184 || !ossl_assert(cookie == hmac - totcookielen) 2185 || !WPACKET_close(pkt) 2186 || !WPACKET_close(pkt)) { 2187 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2188 goto err; 2189 } 2190 2191 ret = EXT_RETURN_SENT; 2192 2193 err: 2194 EVP_MD_CTX_free(hctx); 2195 EVP_PKEY_free(pkey); 2196 return ret; 2197 #else 2198 return EXT_RETURN_FAIL; 2199 #endif 2200 } 2201 2202 EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL_CONNECTION *s, WPACKET *pkt, 2203 unsigned int context, X509 *x, 2204 size_t chainidx) 2205 { 2206 const unsigned char cryptopro_ext[36] = { 2207 0xfd, 0xe8, /* 65000 */ 2208 0x00, 0x20, /* 32 bytes length */ 2209 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85, 2210 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06, 2211 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08, 2212 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17 2213 }; 2214 2215 if (((s->s3.tmp.new_cipher->id & 0xFFFF) != 0x80 2216 && (s->s3.tmp.new_cipher->id & 0xFFFF) != 0x81) 2217 || (SSL_get_options(SSL_CONNECTION_GET_SSL(s)) 2218 & SSL_OP_CRYPTOPRO_TLSEXT_BUG) 2219 == 0) 2220 return EXT_RETURN_NOT_SENT; 2221 2222 if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) { 2223 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2224 return EXT_RETURN_FAIL; 2225 } 2226 2227 return EXT_RETURN_SENT; 2228 } 2229 2230 EXT_RETURN tls_construct_stoc_early_data(SSL_CONNECTION *s, WPACKET *pkt, 2231 unsigned int context, X509 *x, 2232 size_t chainidx) 2233 { 2234 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { 2235 if (s->max_early_data == 0) 2236 return EXT_RETURN_NOT_SENT; 2237 2238 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 2239 || !WPACKET_start_sub_packet_u16(pkt) 2240 || !WPACKET_put_bytes_u32(pkt, s->max_early_data) 2241 || !WPACKET_close(pkt)) { 2242 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2243 return EXT_RETURN_FAIL; 2244 } 2245 2246 return EXT_RETURN_SENT; 2247 } 2248 2249 if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED) 2250 return EXT_RETURN_NOT_SENT; 2251 2252 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 2253 || !WPACKET_start_sub_packet_u16(pkt) 2254 || !WPACKET_close(pkt)) { 2255 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2256 return EXT_RETURN_FAIL; 2257 } 2258 2259 return EXT_RETURN_SENT; 2260 } 2261 2262 EXT_RETURN tls_construct_stoc_psk(SSL_CONNECTION *s, WPACKET *pkt, 2263 unsigned int context, 2264 X509 *x, size_t chainidx) 2265 { 2266 if (!s->hit) 2267 return EXT_RETURN_NOT_SENT; 2268 2269 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) 2270 || !WPACKET_start_sub_packet_u16(pkt) 2271 || !WPACKET_put_bytes_u16(pkt, s->ext.tick_identity) 2272 || !WPACKET_close(pkt)) { 2273 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2274 return EXT_RETURN_FAIL; 2275 } 2276 2277 return EXT_RETURN_SENT; 2278 } 2279 2280 EXT_RETURN tls_construct_stoc_client_cert_type(SSL_CONNECTION *sc, WPACKET *pkt, 2281 unsigned int context, 2282 X509 *x, size_t chainidx) 2283 { 2284 if (sc->ext.client_cert_type_ctos == OSSL_CERT_TYPE_CTOS_ERROR 2285 && (send_certificate_request(sc) 2286 || sc->post_handshake_auth == SSL_PHA_EXT_RECEIVED)) { 2287 /* Did not receive an acceptable cert type - and doing client auth */ 2288 SSLfatal(sc, SSL_AD_UNSUPPORTED_CERTIFICATE, SSL_R_BAD_EXTENSION); 2289 return EXT_RETURN_FAIL; 2290 } 2291 2292 if (sc->ext.client_cert_type == TLSEXT_cert_type_x509) { 2293 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; 2294 return EXT_RETURN_NOT_SENT; 2295 } 2296 2297 /* 2298 * Note: only supposed to send this if we are going to do a cert request, 2299 * but TLSv1.3 could do a PHA request if the client supports it 2300 */ 2301 if ((!send_certificate_request(sc) && sc->post_handshake_auth != SSL_PHA_EXT_RECEIVED) 2302 || sc->ext.client_cert_type_ctos != OSSL_CERT_TYPE_CTOS_GOOD 2303 || sc->client_cert_type == NULL) { 2304 /* if we don't send it, reset to TLSEXT_cert_type_x509 */ 2305 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; 2306 sc->ext.client_cert_type = TLSEXT_cert_type_x509; 2307 return EXT_RETURN_NOT_SENT; 2308 } 2309 2310 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_client_cert_type) 2311 || !WPACKET_start_sub_packet_u16(pkt) 2312 || !WPACKET_put_bytes_u8(pkt, sc->ext.client_cert_type) 2313 || !WPACKET_close(pkt)) { 2314 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2315 return EXT_RETURN_FAIL; 2316 } 2317 return EXT_RETURN_SENT; 2318 } 2319 2320 /* One of |pref|, |other| is configured and the values are sanitized */ 2321 static int reconcile_cert_type(const unsigned char *pref, size_t pref_len, 2322 const unsigned char *other, size_t other_len, 2323 uint8_t *chosen_cert_type) 2324 { 2325 size_t i; 2326 2327 for (i = 0; i < pref_len; i++) { 2328 if (memchr(other, pref[i], other_len) != NULL) { 2329 *chosen_cert_type = pref[i]; 2330 return OSSL_CERT_TYPE_CTOS_GOOD; 2331 } 2332 } 2333 return OSSL_CERT_TYPE_CTOS_ERROR; 2334 } 2335 2336 int tls_parse_ctos_client_cert_type(SSL_CONNECTION *sc, PACKET *pkt, 2337 unsigned int context, 2338 X509 *x, size_t chainidx) 2339 { 2340 PACKET supported_cert_types; 2341 const unsigned char *data; 2342 size_t len; 2343 2344 /* Ignore the extension */ 2345 if (sc->client_cert_type == NULL) { 2346 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; 2347 sc->ext.client_cert_type = TLSEXT_cert_type_x509; 2348 return 1; 2349 } 2350 2351 if (!PACKET_as_length_prefixed_1(pkt, &supported_cert_types)) { 2352 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR; 2353 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 2354 return 0; 2355 } 2356 if ((len = PACKET_remaining(&supported_cert_types)) == 0) { 2357 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR; 2358 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 2359 return 0; 2360 } 2361 if (!PACKET_get_bytes(&supported_cert_types, &data, len)) { 2362 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR; 2363 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 2364 return 0; 2365 } 2366 /* client_cert_type: client (peer) has priority */ 2367 sc->ext.client_cert_type_ctos = reconcile_cert_type(data, len, 2368 sc->client_cert_type, sc->client_cert_type_len, 2369 &sc->ext.client_cert_type); 2370 2371 /* Ignore the error until sending - so we can check cert auth*/ 2372 return 1; 2373 } 2374 2375 EXT_RETURN tls_construct_stoc_server_cert_type(SSL_CONNECTION *sc, WPACKET *pkt, 2376 unsigned int context, 2377 X509 *x, size_t chainidx) 2378 { 2379 if (sc->ext.server_cert_type == TLSEXT_cert_type_x509) { 2380 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; 2381 return EXT_RETURN_NOT_SENT; 2382 } 2383 if (sc->ext.server_cert_type_ctos != OSSL_CERT_TYPE_CTOS_GOOD 2384 || sc->server_cert_type == NULL) { 2385 /* if we don't send it, reset to TLSEXT_cert_type_x509 */ 2386 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; 2387 sc->ext.server_cert_type = TLSEXT_cert_type_x509; 2388 return EXT_RETURN_NOT_SENT; 2389 } 2390 2391 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_cert_type) 2392 || !WPACKET_start_sub_packet_u16(pkt) 2393 || !WPACKET_put_bytes_u8(pkt, sc->ext.server_cert_type) 2394 || !WPACKET_close(pkt)) { 2395 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2396 return EXT_RETURN_FAIL; 2397 } 2398 return EXT_RETURN_SENT; 2399 } 2400 2401 int tls_parse_ctos_server_cert_type(SSL_CONNECTION *sc, PACKET *pkt, 2402 unsigned int context, 2403 X509 *x, size_t chainidx) 2404 { 2405 PACKET supported_cert_types; 2406 const unsigned char *data; 2407 size_t len; 2408 2409 /* Ignore the extension */ 2410 if (sc->server_cert_type == NULL) { 2411 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; 2412 sc->ext.server_cert_type = TLSEXT_cert_type_x509; 2413 return 1; 2414 } 2415 2416 if (!PACKET_as_length_prefixed_1(pkt, &supported_cert_types)) { 2417 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 2418 return 0; 2419 } 2420 2421 if ((len = PACKET_remaining(&supported_cert_types)) == 0) { 2422 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 2423 return 0; 2424 } 2425 if (!PACKET_get_bytes(&supported_cert_types, &data, len)) { 2426 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); 2427 return 0; 2428 } 2429 /* server_cert_type: server (this) has priority */ 2430 sc->ext.server_cert_type_ctos = reconcile_cert_type(sc->server_cert_type, sc->server_cert_type_len, 2431 data, len, 2432 &sc->ext.server_cert_type); 2433 if (sc->ext.server_cert_type_ctos == OSSL_CERT_TYPE_CTOS_GOOD) 2434 return 1; 2435 2436 /* Did not receive an acceptable cert type */ 2437 SSLfatal(sc, SSL_AD_UNSUPPORTED_CERTIFICATE, SSL_R_BAD_EXTENSION); 2438 return 0; 2439 } 2440