1 /* 2 * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/ocsp.h> 11 #include "../ssl_locl.h" 12 #include "internal/cryptlib.h" 13 #include "statem_locl.h" 14 15 EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, 16 unsigned int context, X509 *x, 17 size_t chainidx) 18 { 19 /* Add RI if renegotiating */ 20 if (!s->renegotiate) 21 return EXT_RETURN_NOT_SENT; 22 23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) 24 || !WPACKET_start_sub_packet_u16(pkt) 25 || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished, 26 s->s3->previous_client_finished_len) 27 || !WPACKET_close(pkt)) { 28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, 29 ERR_R_INTERNAL_ERROR); 30 return EXT_RETURN_FAIL; 31 } 32 33 return EXT_RETURN_SENT; 34 } 35 36 EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, 37 unsigned int context, X509 *x, 38 size_t chainidx) 39 { 40 if (s->ext.hostname == NULL) 41 return EXT_RETURN_NOT_SENT; 42 43 /* Add TLS extension servername to the Client Hello message */ 44 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) 45 /* Sub-packet for server_name extension */ 46 || !WPACKET_start_sub_packet_u16(pkt) 47 /* Sub-packet for servername list (always 1 hostname)*/ 48 || !WPACKET_start_sub_packet_u16(pkt) 49 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name) 50 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname, 51 strlen(s->ext.hostname)) 52 || !WPACKET_close(pkt) 53 || !WPACKET_close(pkt)) { 54 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, 55 ERR_R_INTERNAL_ERROR); 56 return EXT_RETURN_FAIL; 57 } 58 59 return EXT_RETURN_SENT; 60 } 61 62 /* Push a Max Fragment Len extension into ClientHello */ 63 EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, 64 unsigned int context, X509 *x, 65 size_t chainidx) 66 { 67 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED) 68 return EXT_RETURN_NOT_SENT; 69 70 /* Add Max Fragment Length extension if client enabled it. */ 71 /*- 72 * 4 bytes for this extension type and extension length 73 * 1 byte for the Max Fragment Length code value. 74 */ 75 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) 76 /* Sub-packet for Max Fragment Length extension (1 byte) */ 77 || !WPACKET_start_sub_packet_u16(pkt) 78 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode) 79 || !WPACKET_close(pkt)) { 80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 81 SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR); 82 return EXT_RETURN_FAIL; 83 } 84 85 return EXT_RETURN_SENT; 86 } 87 88 #ifndef OPENSSL_NO_SRP 89 EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, 90 X509 *x, size_t chainidx) 91 { 92 /* Add SRP username if there is one */ 93 if (s->srp_ctx.login == NULL) 94 return EXT_RETURN_NOT_SENT; 95 96 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp) 97 /* Sub-packet for SRP extension */ 98 || !WPACKET_start_sub_packet_u16(pkt) 99 || !WPACKET_start_sub_packet_u8(pkt) 100 /* login must not be zero...internal error if so */ 101 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) 102 || !WPACKET_memcpy(pkt, s->srp_ctx.login, 103 strlen(s->srp_ctx.login)) 104 || !WPACKET_close(pkt) 105 || !WPACKET_close(pkt)) { 106 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP, 107 ERR_R_INTERNAL_ERROR); 108 return EXT_RETURN_FAIL; 109 } 110 111 return EXT_RETURN_SENT; 112 } 113 #endif 114 115 #ifndef OPENSSL_NO_EC 116 static int use_ecc(SSL *s) 117 { 118 int i, end; 119 unsigned long alg_k, alg_a; 120 STACK_OF(SSL_CIPHER) *cipher_stack = NULL; 121 122 /* See if we support any ECC ciphersuites */ 123 if (s->version == SSL3_VERSION) 124 return 0; 125 126 cipher_stack = SSL_get_ciphers(s); 127 end = sk_SSL_CIPHER_num(cipher_stack); 128 for (i = 0; i < end; i++) { 129 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); 130 131 alg_k = c->algorithm_mkey; 132 alg_a = c->algorithm_auth; 133 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) 134 || (alg_a & SSL_aECDSA) 135 || c->min_tls >= TLS1_3_VERSION) 136 return 1; 137 } 138 139 return 0; 140 } 141 142 EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, 143 unsigned int context, X509 *x, 144 size_t chainidx) 145 { 146 const unsigned char *pformats; 147 size_t num_formats; 148 149 if (!use_ecc(s)) 150 return EXT_RETURN_NOT_SENT; 151 152 /* Add TLS extension ECPointFormats to the ClientHello message */ 153 tls1_get_formatlist(s, &pformats, &num_formats); 154 155 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) 156 /* Sub-packet for formats extension */ 157 || !WPACKET_start_sub_packet_u16(pkt) 158 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats) 159 || !WPACKET_close(pkt)) { 160 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 161 SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 162 return EXT_RETURN_FAIL; 163 } 164 165 return EXT_RETURN_SENT; 166 } 167 168 EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, 169 unsigned int context, X509 *x, 170 size_t chainidx) 171 { 172 const uint16_t *pgroups = NULL; 173 size_t num_groups = 0, i; 174 175 if (!use_ecc(s)) 176 return EXT_RETURN_NOT_SENT; 177 178 /* 179 * Add TLS extension supported_groups to the ClientHello message 180 */ 181 /* TODO(TLS1.3): Add support for DHE groups */ 182 tls1_get_supported_groups(s, &pgroups, &num_groups); 183 184 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) 185 /* Sub-packet for supported_groups extension */ 186 || !WPACKET_start_sub_packet_u16(pkt) 187 || !WPACKET_start_sub_packet_u16(pkt)) { 188 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 189 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 190 ERR_R_INTERNAL_ERROR); 191 return EXT_RETURN_FAIL; 192 } 193 /* Copy curve ID if supported */ 194 for (i = 0; i < num_groups; i++) { 195 uint16_t ctmp = pgroups[i]; 196 197 if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) { 198 if (!WPACKET_put_bytes_u16(pkt, ctmp)) { 199 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 200 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 201 ERR_R_INTERNAL_ERROR); 202 return EXT_RETURN_FAIL; 203 } 204 } 205 } 206 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 207 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 208 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 209 ERR_R_INTERNAL_ERROR); 210 return EXT_RETURN_FAIL; 211 } 212 213 return EXT_RETURN_SENT; 214 } 215 #endif 216 217 EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, 218 unsigned int context, X509 *x, 219 size_t chainidx) 220 { 221 size_t ticklen; 222 223 if (!tls_use_ticket(s)) 224 return EXT_RETURN_NOT_SENT; 225 226 if (!s->new_session && s->session != NULL 227 && s->session->ext.tick != NULL 228 && s->session->ssl_version != TLS1_3_VERSION) { 229 ticklen = s->session->ext.ticklen; 230 } else if (s->session && s->ext.session_ticket != NULL 231 && s->ext.session_ticket->data != NULL) { 232 ticklen = s->ext.session_ticket->length; 233 s->session->ext.tick = OPENSSL_malloc(ticklen); 234 if (s->session->ext.tick == NULL) { 235 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 236 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, 237 ERR_R_INTERNAL_ERROR); 238 return EXT_RETURN_FAIL; 239 } 240 memcpy(s->session->ext.tick, 241 s->ext.session_ticket->data, ticklen); 242 s->session->ext.ticklen = ticklen; 243 } else { 244 ticklen = 0; 245 } 246 247 if (ticklen == 0 && s->ext.session_ticket != NULL && 248 s->ext.session_ticket->data == NULL) 249 return EXT_RETURN_NOT_SENT; 250 251 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) 252 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) { 253 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 254 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); 255 return EXT_RETURN_FAIL; 256 } 257 258 return EXT_RETURN_SENT; 259 } 260 261 EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, 262 unsigned int context, X509 *x, 263 size_t chainidx) 264 { 265 size_t salglen; 266 const uint16_t *salg; 267 268 if (!SSL_CLIENT_USE_SIGALGS(s)) 269 return EXT_RETURN_NOT_SENT; 270 271 salglen = tls12_get_psigalgs(s, 1, &salg); 272 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms) 273 /* Sub-packet for sig-algs extension */ 274 || !WPACKET_start_sub_packet_u16(pkt) 275 /* Sub-packet for the actual list */ 276 || !WPACKET_start_sub_packet_u16(pkt) 277 || !tls12_copy_sigalgs(s, pkt, salg, salglen) 278 || !WPACKET_close(pkt) 279 || !WPACKET_close(pkt)) { 280 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, 281 ERR_R_INTERNAL_ERROR); 282 return EXT_RETURN_FAIL; 283 } 284 285 return EXT_RETURN_SENT; 286 } 287 288 #ifndef OPENSSL_NO_OCSP 289 EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, 290 unsigned int context, X509 *x, 291 size_t chainidx) 292 { 293 int i; 294 295 /* This extension isn't defined for client Certificates */ 296 if (x != NULL) 297 return EXT_RETURN_NOT_SENT; 298 299 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) 300 return EXT_RETURN_NOT_SENT; 301 302 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) 303 /* Sub-packet for status request extension */ 304 || !WPACKET_start_sub_packet_u16(pkt) 305 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp) 306 /* Sub-packet for the ids */ 307 || !WPACKET_start_sub_packet_u16(pkt)) { 308 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 309 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 310 return EXT_RETURN_FAIL; 311 } 312 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) { 313 unsigned char *idbytes; 314 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i); 315 int idlen = i2d_OCSP_RESPID(id, NULL); 316 317 if (idlen <= 0 318 /* Sub-packet for an individual id */ 319 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes) 320 || i2d_OCSP_RESPID(id, &idbytes) != idlen) { 321 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 322 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 323 ERR_R_INTERNAL_ERROR); 324 return EXT_RETURN_FAIL; 325 } 326 } 327 if (!WPACKET_close(pkt) 328 || !WPACKET_start_sub_packet_u16(pkt)) { 329 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 330 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 331 return EXT_RETURN_FAIL; 332 } 333 if (s->ext.ocsp.exts) { 334 unsigned char *extbytes; 335 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL); 336 337 if (extlen < 0) { 338 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 339 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 340 ERR_R_INTERNAL_ERROR); 341 return EXT_RETURN_FAIL; 342 } 343 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes) 344 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes) 345 != extlen) { 346 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 347 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 348 ERR_R_INTERNAL_ERROR); 349 return EXT_RETURN_FAIL; 350 } 351 } 352 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 353 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 354 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 355 return EXT_RETURN_FAIL; 356 } 357 358 return EXT_RETURN_SENT; 359 } 360 #endif 361 362 #ifndef OPENSSL_NO_NEXTPROTONEG 363 EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, 364 X509 *x, size_t chainidx) 365 { 366 if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 367 return EXT_RETURN_NOT_SENT; 368 369 /* 370 * The client advertises an empty extension to indicate its support 371 * for Next Protocol Negotiation 372 */ 373 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) 374 || !WPACKET_put_bytes_u16(pkt, 0)) { 375 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN, 376 ERR_R_INTERNAL_ERROR); 377 return EXT_RETURN_FAIL; 378 } 379 380 return EXT_RETURN_SENT; 381 } 382 #endif 383 384 EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, 385 X509 *x, size_t chainidx) 386 { 387 s->s3->alpn_sent = 0; 388 389 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 390 return EXT_RETURN_NOT_SENT; 391 392 if (!WPACKET_put_bytes_u16(pkt, 393 TLSEXT_TYPE_application_layer_protocol_negotiation) 394 /* Sub-packet ALPN extension */ 395 || !WPACKET_start_sub_packet_u16(pkt) 396 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len) 397 || !WPACKET_close(pkt)) { 398 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, 399 ERR_R_INTERNAL_ERROR); 400 return EXT_RETURN_FAIL; 401 } 402 s->s3->alpn_sent = 1; 403 404 return EXT_RETURN_SENT; 405 } 406 407 408 #ifndef OPENSSL_NO_SRTP 409 EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, 410 unsigned int context, X509 *x, 411 size_t chainidx) 412 { 413 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s); 414 int i, end; 415 416 if (clnt == NULL) 417 return EXT_RETURN_NOT_SENT; 418 419 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) 420 /* Sub-packet for SRTP extension */ 421 || !WPACKET_start_sub_packet_u16(pkt) 422 /* Sub-packet for the protection profile list */ 423 || !WPACKET_start_sub_packet_u16(pkt)) { 424 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 425 ERR_R_INTERNAL_ERROR); 426 return EXT_RETURN_FAIL; 427 } 428 429 end = sk_SRTP_PROTECTION_PROFILE_num(clnt); 430 for (i = 0; i < end; i++) { 431 const SRTP_PROTECTION_PROFILE *prof = 432 sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 433 434 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) { 435 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 436 SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); 437 return EXT_RETURN_FAIL; 438 } 439 } 440 if (!WPACKET_close(pkt) 441 /* Add an empty use_mki value */ 442 || !WPACKET_put_bytes_u8(pkt, 0) 443 || !WPACKET_close(pkt)) { 444 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 445 ERR_R_INTERNAL_ERROR); 446 return EXT_RETURN_FAIL; 447 } 448 449 return EXT_RETURN_SENT; 450 } 451 #endif 452 453 EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, 454 X509 *x, size_t chainidx) 455 { 456 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 457 return EXT_RETURN_NOT_SENT; 458 459 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) 460 || !WPACKET_put_bytes_u16(pkt, 0)) { 461 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM, 462 ERR_R_INTERNAL_ERROR); 463 return EXT_RETURN_FAIL; 464 } 465 466 return EXT_RETURN_SENT; 467 } 468 469 #ifndef OPENSSL_NO_CT 470 EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, 471 X509 *x, size_t chainidx) 472 { 473 if (s->ct_validation_callback == NULL) 474 return EXT_RETURN_NOT_SENT; 475 476 /* Not defined for client Certificates */ 477 if (x != NULL) 478 return EXT_RETURN_NOT_SENT; 479 480 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp) 481 || !WPACKET_put_bytes_u16(pkt, 0)) { 482 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT, 483 ERR_R_INTERNAL_ERROR); 484 return EXT_RETURN_FAIL; 485 } 486 487 return EXT_RETURN_SENT; 488 } 489 #endif 490 491 EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, 492 X509 *x, size_t chainidx) 493 { 494 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) 495 || !WPACKET_put_bytes_u16(pkt, 0)) { 496 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS, 497 ERR_R_INTERNAL_ERROR); 498 return EXT_RETURN_FAIL; 499 } 500 501 return EXT_RETURN_SENT; 502 } 503 504 EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, 505 unsigned int context, X509 *x, 506 size_t chainidx) 507 { 508 int currv, min_version, max_version, reason; 509 510 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); 511 if (reason != 0) { 512 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 513 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); 514 return EXT_RETURN_FAIL; 515 } 516 517 /* 518 * Don't include this if we can't negotiate TLSv1.3. We can do a straight 519 * comparison here because we will never be called in DTLS. 520 */ 521 if (max_version < TLS1_3_VERSION) 522 return EXT_RETURN_NOT_SENT; 523 524 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) 525 || !WPACKET_start_sub_packet_u16(pkt) 526 || !WPACKET_start_sub_packet_u8(pkt)) { 527 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 528 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 529 ERR_R_INTERNAL_ERROR); 530 return EXT_RETURN_FAIL; 531 } 532 533 for (currv = max_version; currv >= min_version; currv--) { 534 if (!WPACKET_put_bytes_u16(pkt, currv)) { 535 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 536 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 537 ERR_R_INTERNAL_ERROR); 538 return EXT_RETURN_FAIL; 539 } 540 } 541 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 542 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 543 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 544 ERR_R_INTERNAL_ERROR); 545 return EXT_RETURN_FAIL; 546 } 547 548 return EXT_RETURN_SENT; 549 } 550 551 /* 552 * Construct a psk_kex_modes extension. 553 */ 554 EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, 555 unsigned int context, X509 *x, 556 size_t chainidx) 557 { 558 #ifndef OPENSSL_NO_TLS1_3 559 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX; 560 561 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes) 562 || !WPACKET_start_sub_packet_u16(pkt) 563 || !WPACKET_start_sub_packet_u8(pkt) 564 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE) 565 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE)) 566 || !WPACKET_close(pkt) 567 || !WPACKET_close(pkt)) { 568 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 569 SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR); 570 return EXT_RETURN_FAIL; 571 } 572 573 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE; 574 if (nodhe) 575 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; 576 #endif 577 578 return EXT_RETURN_SENT; 579 } 580 581 #ifndef OPENSSL_NO_TLS1_3 582 static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id) 583 { 584 unsigned char *encoded_point = NULL; 585 EVP_PKEY *key_share_key = NULL; 586 size_t encodedlen; 587 588 if (s->s3->tmp.pkey != NULL) { 589 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) { 590 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 591 ERR_R_INTERNAL_ERROR); 592 return 0; 593 } 594 /* 595 * Could happen if we got an HRR that wasn't requesting a new key_share 596 */ 597 key_share_key = s->s3->tmp.pkey; 598 } else { 599 key_share_key = ssl_generate_pkey_group(s, curve_id); 600 if (key_share_key == NULL) { 601 /* SSLfatal() already called */ 602 return 0; 603 } 604 } 605 606 /* Encode the public key. */ 607 encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key, 608 &encoded_point); 609 if (encodedlen == 0) { 610 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB); 611 goto err; 612 } 613 614 /* Create KeyShareEntry */ 615 if (!WPACKET_put_bytes_u16(pkt, curve_id) 616 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) { 617 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 618 ERR_R_INTERNAL_ERROR); 619 goto err; 620 } 621 622 /* 623 * TODO(TLS1.3): When changing to send more than one key_share we're 624 * going to need to be able to save more than one EVP_PKEY. For now 625 * we reuse the existing tmp.pkey 626 */ 627 s->s3->tmp.pkey = key_share_key; 628 s->s3->group_id = curve_id; 629 OPENSSL_free(encoded_point); 630 631 return 1; 632 err: 633 if (s->s3->tmp.pkey == NULL) 634 EVP_PKEY_free(key_share_key); 635 OPENSSL_free(encoded_point); 636 return 0; 637 } 638 #endif 639 640 EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, 641 unsigned int context, X509 *x, 642 size_t chainidx) 643 { 644 #ifndef OPENSSL_NO_TLS1_3 645 size_t i, num_groups = 0; 646 const uint16_t *pgroups = NULL; 647 uint16_t curve_id = 0; 648 649 /* key_share extension */ 650 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 651 /* Extension data sub-packet */ 652 || !WPACKET_start_sub_packet_u16(pkt) 653 /* KeyShare list sub-packet */ 654 || !WPACKET_start_sub_packet_u16(pkt)) { 655 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 656 ERR_R_INTERNAL_ERROR); 657 return EXT_RETURN_FAIL; 658 } 659 660 tls1_get_supported_groups(s, &pgroups, &num_groups); 661 662 /* 663 * TODO(TLS1.3): Make the number of key_shares sent configurable. For 664 * now, just send one 665 */ 666 if (s->s3->group_id != 0) { 667 curve_id = s->s3->group_id; 668 } else { 669 for (i = 0; i < num_groups; i++) { 670 671 if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED)) 672 continue; 673 674 curve_id = pgroups[i]; 675 break; 676 } 677 } 678 679 if (curve_id == 0) { 680 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 681 SSL_R_NO_SUITABLE_KEY_SHARE); 682 return EXT_RETURN_FAIL; 683 } 684 685 if (!add_key_share(s, pkt, curve_id)) { 686 /* SSLfatal() already called */ 687 return EXT_RETURN_FAIL; 688 } 689 690 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 691 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 692 ERR_R_INTERNAL_ERROR); 693 return EXT_RETURN_FAIL; 694 } 695 return EXT_RETURN_SENT; 696 #else 697 return EXT_RETURN_NOT_SENT; 698 #endif 699 } 700 701 EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, 702 X509 *x, size_t chainidx) 703 { 704 EXT_RETURN ret = EXT_RETURN_FAIL; 705 706 /* Should only be set if we've had an HRR */ 707 if (s->ext.tls13_cookie_len == 0) 708 return EXT_RETURN_NOT_SENT; 709 710 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) 711 /* Extension data sub-packet */ 712 || !WPACKET_start_sub_packet_u16(pkt) 713 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie, 714 s->ext.tls13_cookie_len) 715 || !WPACKET_close(pkt)) { 716 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, 717 ERR_R_INTERNAL_ERROR); 718 goto end; 719 } 720 721 ret = EXT_RETURN_SENT; 722 end: 723 OPENSSL_free(s->ext.tls13_cookie); 724 s->ext.tls13_cookie = NULL; 725 s->ext.tls13_cookie_len = 0; 726 727 return ret; 728 } 729 730 EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, 731 unsigned int context, X509 *x, 732 size_t chainidx) 733 { 734 #ifndef OPENSSL_NO_PSK 735 char identity[PSK_MAX_IDENTITY_LEN + 1]; 736 #endif /* OPENSSL_NO_PSK */ 737 const unsigned char *id = NULL; 738 size_t idlen = 0; 739 SSL_SESSION *psksess = NULL; 740 SSL_SESSION *edsess = NULL; 741 const EVP_MD *handmd = NULL; 742 743 if (s->hello_retry_request == SSL_HRR_PENDING) 744 handmd = ssl_handshake_md(s); 745 746 if (s->psk_use_session_cb != NULL 747 && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess) 748 || (psksess != NULL 749 && psksess->ssl_version != TLS1_3_VERSION))) { 750 SSL_SESSION_free(psksess); 751 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 752 SSL_R_BAD_PSK); 753 return EXT_RETURN_FAIL; 754 } 755 756 #ifndef OPENSSL_NO_PSK 757 if (psksess == NULL && s->psk_client_callback != NULL) { 758 unsigned char psk[PSK_MAX_PSK_LEN]; 759 size_t psklen = 0; 760 761 memset(identity, 0, sizeof(identity)); 762 psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, 763 psk, sizeof(psk)); 764 765 if (psklen > PSK_MAX_PSK_LEN) { 766 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 767 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 768 return EXT_RETURN_FAIL; 769 } else if (psklen > 0) { 770 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; 771 const SSL_CIPHER *cipher; 772 773 idlen = strlen(identity); 774 if (idlen > PSK_MAX_IDENTITY_LEN) { 775 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 776 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 777 ERR_R_INTERNAL_ERROR); 778 return EXT_RETURN_FAIL; 779 } 780 id = (unsigned char *)identity; 781 782 /* 783 * We found a PSK using an old style callback. We don't know 784 * the digest so we default to SHA256 as per the TLSv1.3 spec 785 */ 786 cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); 787 if (cipher == NULL) { 788 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 789 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 790 ERR_R_INTERNAL_ERROR); 791 return EXT_RETURN_FAIL; 792 } 793 794 psksess = SSL_SESSION_new(); 795 if (psksess == NULL 796 || !SSL_SESSION_set1_master_key(psksess, psk, psklen) 797 || !SSL_SESSION_set_cipher(psksess, cipher) 798 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { 799 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 800 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 801 ERR_R_INTERNAL_ERROR); 802 OPENSSL_cleanse(psk, psklen); 803 return EXT_RETURN_FAIL; 804 } 805 OPENSSL_cleanse(psk, psklen); 806 } 807 } 808 #endif /* OPENSSL_NO_PSK */ 809 810 SSL_SESSION_free(s->psksession); 811 s->psksession = psksess; 812 if (psksess != NULL) { 813 OPENSSL_free(s->psksession_id); 814 s->psksession_id = OPENSSL_memdup(id, idlen); 815 if (s->psksession_id == NULL) { 816 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 817 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 818 return EXT_RETURN_FAIL; 819 } 820 s->psksession_id_len = idlen; 821 } 822 823 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING 824 || (s->session->ext.max_early_data == 0 825 && (psksess == NULL || psksess->ext.max_early_data == 0))) { 826 s->max_early_data = 0; 827 return EXT_RETURN_NOT_SENT; 828 } 829 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess; 830 s->max_early_data = edsess->ext.max_early_data; 831 832 if (edsess->ext.hostname != NULL) { 833 if (s->ext.hostname == NULL 834 || (s->ext.hostname != NULL 835 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) { 836 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 837 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 838 SSL_R_INCONSISTENT_EARLY_DATA_SNI); 839 return EXT_RETURN_FAIL; 840 } 841 } 842 843 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) { 844 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 845 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 846 return EXT_RETURN_FAIL; 847 } 848 849 /* 850 * Verify that we are offering an ALPN protocol consistent with the early 851 * data. 852 */ 853 if (edsess->ext.alpn_selected != NULL) { 854 PACKET prots, alpnpkt; 855 int found = 0; 856 857 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) { 858 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 859 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 860 return EXT_RETURN_FAIL; 861 } 862 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) { 863 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected, 864 edsess->ext.alpn_selected_len)) { 865 found = 1; 866 break; 867 } 868 } 869 if (!found) { 870 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 871 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 872 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 873 return EXT_RETURN_FAIL; 874 } 875 } 876 877 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 878 || !WPACKET_start_sub_packet_u16(pkt) 879 || !WPACKET_close(pkt)) { 880 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 881 ERR_R_INTERNAL_ERROR); 882 return EXT_RETURN_FAIL; 883 } 884 885 /* 886 * We set this to rejected here. Later, if the server acknowledges the 887 * extension, we set it to accepted. 888 */ 889 s->ext.early_data = SSL_EARLY_DATA_REJECTED; 890 s->ext.early_data_ok = 1; 891 892 return EXT_RETURN_SENT; 893 } 894 895 #define F5_WORKAROUND_MIN_MSG_LEN 0xff 896 #define F5_WORKAROUND_MAX_MSG_LEN 0x200 897 898 /* 899 * PSK pre binder overhead = 900 * 2 bytes for TLSEXT_TYPE_psk 901 * 2 bytes for extension length 902 * 2 bytes for identities list length 903 * 2 bytes for identity length 904 * 4 bytes for obfuscated_ticket_age 905 * 2 bytes for binder list length 906 * 1 byte for binder length 907 * The above excludes the number of bytes for the identity itself and the 908 * subsequent binder bytes 909 */ 910 #define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1) 911 912 EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt, 913 unsigned int context, X509 *x, 914 size_t chainidx) 915 { 916 unsigned char *padbytes; 917 size_t hlen; 918 919 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0) 920 return EXT_RETURN_NOT_SENT; 921 922 /* 923 * Add padding to workaround bugs in F5 terminators. See RFC7685. 924 * This code calculates the length of all extensions added so far but 925 * excludes the PSK extension (because that MUST be written last). Therefore 926 * this extension MUST always appear second to last. 927 */ 928 if (!WPACKET_get_total_written(pkt, &hlen)) { 929 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 930 ERR_R_INTERNAL_ERROR); 931 return EXT_RETURN_FAIL; 932 } 933 934 /* 935 * If we're going to send a PSK then that will be written out after this 936 * extension, so we need to calculate how long it is going to be. 937 */ 938 if (s->session->ssl_version == TLS1_3_VERSION 939 && s->session->ext.ticklen != 0 940 && s->session->cipher != NULL) { 941 const EVP_MD *md = ssl_md(s->session->cipher->algorithm2); 942 943 if (md != NULL) { 944 /* 945 * Add the fixed PSK overhead, the identity length and the binder 946 * length. 947 */ 948 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen 949 + EVP_MD_size(md); 950 } 951 } 952 953 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) { 954 /* Calculate the amount of padding we need to add */ 955 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen; 956 957 /* 958 * Take off the size of extension header itself (2 bytes for type and 959 * 2 bytes for length bytes), but ensure that the extension is at least 960 * 1 byte long so as not to have an empty extension last (WebSphere 7.x, 961 * 8.x are intolerant of that condition) 962 */ 963 if (hlen > 4) 964 hlen -= 4; 965 else 966 hlen = 1; 967 968 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding) 969 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) { 970 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 971 ERR_R_INTERNAL_ERROR); 972 return EXT_RETURN_FAIL; 973 } 974 memset(padbytes, 0, hlen); 975 } 976 977 return EXT_RETURN_SENT; 978 } 979 980 /* 981 * Construct the pre_shared_key extension 982 */ 983 EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, 984 X509 *x, size_t chainidx) 985 { 986 #ifndef OPENSSL_NO_TLS1_3 987 uint32_t now, agesec, agems = 0; 988 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen; 989 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL; 990 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL; 991 int dores = 0; 992 993 s->session->ext.tick_identity = TLSEXT_PSK_BAD_IDENTITY; 994 995 /* 996 * Note: At this stage of the code we only support adding a single 997 * resumption PSK. If we add support for multiple PSKs then the length 998 * calculations in the padding extension will need to be adjusted. 999 */ 1000 1001 /* 1002 * If this is an incompatible or new session then we have nothing to resume 1003 * so don't add this extension. 1004 */ 1005 if (s->session->ssl_version != TLS1_3_VERSION 1006 || (s->session->ext.ticklen == 0 && s->psksession == NULL)) 1007 return EXT_RETURN_NOT_SENT; 1008 1009 if (s->hello_retry_request == SSL_HRR_PENDING) 1010 handmd = ssl_handshake_md(s); 1011 1012 if (s->session->ext.ticklen != 0) { 1013 /* Get the digest associated with the ciphersuite in the session */ 1014 if (s->session->cipher == NULL) { 1015 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1016 ERR_R_INTERNAL_ERROR); 1017 return EXT_RETURN_FAIL; 1018 } 1019 mdres = ssl_md(s->session->cipher->algorithm2); 1020 if (mdres == NULL) { 1021 /* 1022 * Don't recognize this cipher so we can't use the session. 1023 * Ignore it 1024 */ 1025 goto dopsksess; 1026 } 1027 1028 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) { 1029 /* 1030 * Selected ciphersuite hash does not match the hash for the session 1031 * so we can't use it. 1032 */ 1033 goto dopsksess; 1034 } 1035 1036 /* 1037 * Technically the C standard just says time() returns a time_t and says 1038 * nothing about the encoding of that type. In practice most 1039 * implementations follow POSIX which holds it as an integral type in 1040 * seconds since epoch. We've already made the assumption that we can do 1041 * this in multiple places in the code, so portability shouldn't be an 1042 * issue. 1043 */ 1044 now = (uint32_t)time(NULL); 1045 agesec = now - (uint32_t)s->session->time; 1046 /* 1047 * We calculate the age in seconds but the server may work in ms. Due to 1048 * rounding errors we could overestimate the age by up to 1s. It is 1049 * better to underestimate it. Otherwise, if the RTT is very short, when 1050 * the server calculates the age reported by the client it could be 1051 * bigger than the age calculated on the server - which should never 1052 * happen. 1053 */ 1054 if (agesec > 0) 1055 agesec--; 1056 1057 if (s->session->ext.tick_lifetime_hint < agesec) { 1058 /* Ticket is too old. Ignore it. */ 1059 goto dopsksess; 1060 } 1061 1062 /* 1063 * Calculate age in ms. We're just doing it to nearest second. Should be 1064 * good enough. 1065 */ 1066 agems = agesec * (uint32_t)1000; 1067 1068 if (agesec != 0 && agems / (uint32_t)1000 != agesec) { 1069 /* 1070 * Overflow. Shouldn't happen unless this is a *really* old session. 1071 * If so we just ignore it. 1072 */ 1073 goto dopsksess; 1074 } 1075 1076 /* 1077 * Obfuscate the age. Overflow here is fine, this addition is supposed 1078 * to be mod 2^32. 1079 */ 1080 agems += s->session->ext.tick_age_add; 1081 1082 reshashsize = EVP_MD_size(mdres); 1083 dores = 1; 1084 } 1085 1086 dopsksess: 1087 if (!dores && s->psksession == NULL) 1088 return EXT_RETURN_NOT_SENT; 1089 1090 if (s->psksession != NULL) { 1091 mdpsk = ssl_md(s->psksession->cipher->algorithm2); 1092 if (mdpsk == NULL) { 1093 /* 1094 * Don't recognize this cipher so we can't use the session. 1095 * If this happens it's an application bug. 1096 */ 1097 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1098 SSL_R_BAD_PSK); 1099 return EXT_RETURN_FAIL; 1100 } 1101 1102 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) { 1103 /* 1104 * Selected ciphersuite hash does not match the hash for the PSK 1105 * session. This is an application bug. 1106 */ 1107 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1108 SSL_R_BAD_PSK); 1109 return EXT_RETURN_FAIL; 1110 } 1111 1112 pskhashsize = EVP_MD_size(mdpsk); 1113 } 1114 1115 /* Create the extension, but skip over the binder for now */ 1116 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) 1117 || !WPACKET_start_sub_packet_u16(pkt) 1118 || !WPACKET_start_sub_packet_u16(pkt)) { 1119 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1120 ERR_R_INTERNAL_ERROR); 1121 return EXT_RETURN_FAIL; 1122 } 1123 1124 if (dores) { 1125 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, 1126 s->session->ext.ticklen) 1127 || !WPACKET_put_bytes_u32(pkt, agems)) { 1128 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1129 ERR_R_INTERNAL_ERROR); 1130 return EXT_RETURN_FAIL; 1131 } 1132 } 1133 1134 if (s->psksession != NULL) { 1135 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id, 1136 s->psksession_id_len) 1137 || !WPACKET_put_bytes_u32(pkt, 0)) { 1138 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1139 ERR_R_INTERNAL_ERROR); 1140 return EXT_RETURN_FAIL; 1141 } 1142 } 1143 1144 if (!WPACKET_close(pkt) 1145 || !WPACKET_get_total_written(pkt, &binderoffset) 1146 || !WPACKET_start_sub_packet_u16(pkt) 1147 || (dores 1148 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder)) 1149 || (s->psksession != NULL 1150 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder)) 1151 || !WPACKET_close(pkt) 1152 || !WPACKET_close(pkt) 1153 || !WPACKET_get_total_written(pkt, &msglen) 1154 /* 1155 * We need to fill in all the sub-packet lengths now so we can 1156 * calculate the HMAC of the message up to the binders 1157 */ 1158 || !WPACKET_fill_lengths(pkt)) { 1159 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1160 ERR_R_INTERNAL_ERROR); 1161 return EXT_RETURN_FAIL; 1162 } 1163 1164 msgstart = WPACKET_get_curr(pkt) - msglen; 1165 1166 if (dores 1167 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL, 1168 resbinder, s->session, 1, 0) != 1) { 1169 /* SSLfatal() already called */ 1170 return EXT_RETURN_FAIL; 1171 } 1172 1173 if (s->psksession != NULL 1174 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL, 1175 pskbinder, s->psksession, 1, 1) != 1) { 1176 /* SSLfatal() already called */ 1177 return EXT_RETURN_FAIL; 1178 } 1179 1180 if (dores) 1181 s->session->ext.tick_identity = 0; 1182 if (s->psksession != NULL) 1183 s->psksession->ext.tick_identity = (dores ? 1 : 0); 1184 1185 return EXT_RETURN_SENT; 1186 #else 1187 return EXT_RETURN_NOT_SENT; 1188 #endif 1189 } 1190 1191 EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, 1192 unsigned int context, 1193 X509 *x, size_t chainidx) 1194 { 1195 #ifndef OPENSSL_NO_TLS1_3 1196 if (!s->pha_enabled) 1197 return EXT_RETURN_NOT_SENT; 1198 1199 /* construct extension - 0 length, no contents */ 1200 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) 1201 || !WPACKET_start_sub_packet_u16(pkt) 1202 || !WPACKET_close(pkt)) { 1203 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1204 SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, 1205 ERR_R_INTERNAL_ERROR); 1206 return EXT_RETURN_FAIL; 1207 } 1208 1209 s->post_handshake_auth = SSL_PHA_EXT_SENT; 1210 1211 return EXT_RETURN_SENT; 1212 #else 1213 return EXT_RETURN_NOT_SENT; 1214 #endif 1215 } 1216 1217 1218 /* 1219 * Parse the server's renegotiation binding and abort if it's not right 1220 */ 1221 int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context, 1222 X509 *x, size_t chainidx) 1223 { 1224 size_t expected_len = s->s3->previous_client_finished_len 1225 + s->s3->previous_server_finished_len; 1226 size_t ilen; 1227 const unsigned char *data; 1228 1229 /* Check for logic errors */ 1230 if (!ossl_assert(expected_len == 0 1231 || s->s3->previous_client_finished_len != 0) 1232 || !ossl_assert(expected_len == 0 1233 || s->s3->previous_server_finished_len != 0)) { 1234 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1235 ERR_R_INTERNAL_ERROR); 1236 return 0; 1237 } 1238 1239 /* Parse the length byte */ 1240 if (!PACKET_get_1_len(pkt, &ilen)) { 1241 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1242 SSL_R_RENEGOTIATION_ENCODING_ERR); 1243 return 0; 1244 } 1245 1246 /* Consistency check */ 1247 if (PACKET_remaining(pkt) != ilen) { 1248 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1249 SSL_R_RENEGOTIATION_ENCODING_ERR); 1250 return 0; 1251 } 1252 1253 /* Check that the extension matches */ 1254 if (ilen != expected_len) { 1255 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1256 SSL_R_RENEGOTIATION_MISMATCH); 1257 return 0; 1258 } 1259 1260 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len) 1261 || memcmp(data, s->s3->previous_client_finished, 1262 s->s3->previous_client_finished_len) != 0) { 1263 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1264 SSL_R_RENEGOTIATION_MISMATCH); 1265 return 0; 1266 } 1267 1268 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len) 1269 || memcmp(data, s->s3->previous_server_finished, 1270 s->s3->previous_server_finished_len) != 0) { 1271 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1272 SSL_R_RENEGOTIATION_MISMATCH); 1273 return 0; 1274 } 1275 s->s3->send_connection_binding = 1; 1276 1277 return 1; 1278 } 1279 1280 /* Parse the server's max fragment len extension packet */ 1281 int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context, 1282 X509 *x, size_t chainidx) 1283 { 1284 unsigned int value; 1285 1286 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { 1287 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1288 SSL_R_BAD_EXTENSION); 1289 return 0; 1290 } 1291 1292 /* |value| should contains a valid max-fragment-length code. */ 1293 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { 1294 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1295 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1296 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1297 return 0; 1298 } 1299 1300 /* Must be the same value as client-configured one who was sent to server */ 1301 /*- 1302 * RFC 6066: if a client receives a maximum fragment length negotiation 1303 * response that differs from the length it requested, ... 1304 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert 1305 */ 1306 if (value != s->ext.max_fragment_len_mode) { 1307 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1308 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1309 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1310 return 0; 1311 } 1312 1313 /* 1314 * Maximum Fragment Length Negotiation succeeded. 1315 * The negotiated Maximum Fragment Length is binding now. 1316 */ 1317 s->session->ext.max_fragment_len_mode = value; 1318 1319 return 1; 1320 } 1321 1322 int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context, 1323 X509 *x, size_t chainidx) 1324 { 1325 if (s->ext.hostname == NULL) { 1326 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1327 ERR_R_INTERNAL_ERROR); 1328 return 0; 1329 } 1330 1331 if (PACKET_remaining(pkt) > 0) { 1332 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1333 SSL_R_BAD_EXTENSION); 1334 return 0; 1335 } 1336 1337 if (!s->hit) { 1338 if (s->session->ext.hostname != NULL) { 1339 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1340 ERR_R_INTERNAL_ERROR); 1341 return 0; 1342 } 1343 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); 1344 if (s->session->ext.hostname == NULL) { 1345 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1346 ERR_R_INTERNAL_ERROR); 1347 return 0; 1348 } 1349 } 1350 1351 return 1; 1352 } 1353 1354 #ifndef OPENSSL_NO_EC 1355 int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, 1356 X509 *x, size_t chainidx) 1357 { 1358 size_t ecpointformats_len; 1359 PACKET ecptformatlist; 1360 1361 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) { 1362 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, 1363 SSL_R_BAD_EXTENSION); 1364 return 0; 1365 } 1366 if (!s->hit) { 1367 ecpointformats_len = PACKET_remaining(&ecptformatlist); 1368 if (ecpointformats_len == 0) { 1369 SSLfatal(s, SSL_AD_DECODE_ERROR, 1370 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_LENGTH); 1371 return 0; 1372 } 1373 1374 s->session->ext.ecpointformats_len = 0; 1375 OPENSSL_free(s->session->ext.ecpointformats); 1376 s->session->ext.ecpointformats = OPENSSL_malloc(ecpointformats_len); 1377 if (s->session->ext.ecpointformats == NULL) { 1378 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1379 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1380 return 0; 1381 } 1382 1383 s->session->ext.ecpointformats_len = ecpointformats_len; 1384 1385 if (!PACKET_copy_bytes(&ecptformatlist, 1386 s->session->ext.ecpointformats, 1387 ecpointformats_len)) { 1388 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1389 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1390 return 0; 1391 } 1392 } 1393 1394 return 1; 1395 } 1396 #endif 1397 1398 int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, 1399 X509 *x, size_t chainidx) 1400 { 1401 if (s->ext.session_ticket_cb != NULL && 1402 !s->ext.session_ticket_cb(s, PACKET_data(pkt), 1403 PACKET_remaining(pkt), 1404 s->ext.session_ticket_cb_arg)) { 1405 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 1406 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1407 return 0; 1408 } 1409 1410 if (!tls_use_ticket(s)) { 1411 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1412 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1413 return 0; 1414 } 1415 if (PACKET_remaining(pkt) > 0) { 1416 SSLfatal(s, SSL_AD_DECODE_ERROR, 1417 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1418 return 0; 1419 } 1420 1421 s->ext.ticket_expected = 1; 1422 1423 return 1; 1424 } 1425 1426 #ifndef OPENSSL_NO_OCSP 1427 int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, 1428 X509 *x, size_t chainidx) 1429 { 1430 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1431 /* We ignore this if the server sends a CertificateRequest */ 1432 /* TODO(TLS1.3): Add support for this */ 1433 return 1; 1434 } 1435 1436 /* 1437 * MUST only be sent if we've requested a status 1438 * request message. In TLS <= 1.2 it must also be empty. 1439 */ 1440 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { 1441 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1442 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1443 return 0; 1444 } 1445 if (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0) { 1446 SSLfatal(s, SSL_AD_DECODE_ERROR, 1447 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1448 return 0; 1449 } 1450 1451 if (SSL_IS_TLS13(s)) { 1452 /* We only know how to handle this if it's for the first Certificate in 1453 * the chain. We ignore any other responses. 1454 */ 1455 if (chainidx != 0) 1456 return 1; 1457 1458 /* SSLfatal() already called */ 1459 return tls_process_cert_status_body(s, pkt); 1460 } 1461 1462 /* Set flag to expect CertificateStatus message */ 1463 s->ext.status_expected = 1; 1464 1465 return 1; 1466 } 1467 #endif 1468 1469 1470 #ifndef OPENSSL_NO_CT 1471 int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1472 size_t chainidx) 1473 { 1474 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1475 /* We ignore this if the server sends it in a CertificateRequest */ 1476 /* TODO(TLS1.3): Add support for this */ 1477 return 1; 1478 } 1479 1480 /* 1481 * Only take it if we asked for it - i.e if there is no CT validation 1482 * callback set, then a custom extension MAY be processing it, so we 1483 * need to let control continue to flow to that. 1484 */ 1485 if (s->ct_validation_callback != NULL) { 1486 size_t size = PACKET_remaining(pkt); 1487 1488 /* Simply copy it off for later processing */ 1489 OPENSSL_free(s->ext.scts); 1490 s->ext.scts = NULL; 1491 1492 s->ext.scts_len = (uint16_t)size; 1493 if (size > 0) { 1494 s->ext.scts = OPENSSL_malloc(size); 1495 if (s->ext.scts == NULL 1496 || !PACKET_copy_bytes(pkt, s->ext.scts, size)) { 1497 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1498 ERR_R_INTERNAL_ERROR); 1499 return 0; 1500 } 1501 } 1502 } else { 1503 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 1504 ? ENDPOINT_CLIENT : ENDPOINT_BOTH; 1505 1506 /* 1507 * If we didn't ask for it then there must be a custom extension, 1508 * otherwise this is unsolicited. 1509 */ 1510 if (custom_ext_find(&s->cert->custext, role, 1511 TLSEXT_TYPE_signed_certificate_timestamp, 1512 NULL) == NULL) { 1513 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SCT, 1514 SSL_R_BAD_EXTENSION); 1515 return 0; 1516 } 1517 1518 if (!custom_ext_parse(s, context, 1519 TLSEXT_TYPE_signed_certificate_timestamp, 1520 PACKET_data(pkt), PACKET_remaining(pkt), 1521 x, chainidx)) { 1522 /* SSLfatal already called */ 1523 return 0; 1524 } 1525 } 1526 1527 return 1; 1528 } 1529 #endif 1530 1531 1532 #ifndef OPENSSL_NO_NEXTPROTONEG 1533 /* 1534 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1535 * elements of zero length are allowed and the set of elements must exactly 1536 * fill the length of the block. Returns 1 on success or 0 on failure. 1537 */ 1538 static int ssl_next_proto_validate(SSL *s, PACKET *pkt) 1539 { 1540 PACKET tmp_protocol; 1541 1542 while (PACKET_remaining(pkt)) { 1543 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol) 1544 || PACKET_remaining(&tmp_protocol) == 0) { 1545 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_NEXT_PROTO_VALIDATE, 1546 SSL_R_BAD_EXTENSION); 1547 return 0; 1548 } 1549 } 1550 1551 return 1; 1552 } 1553 1554 int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1555 size_t chainidx) 1556 { 1557 unsigned char *selected; 1558 unsigned char selected_len; 1559 PACKET tmppkt; 1560 1561 /* Check if we are in a renegotiation. If so ignore this extension */ 1562 if (!SSL_IS_FIRST_HANDSHAKE(s)) 1563 return 1; 1564 1565 /* We must have requested it. */ 1566 if (s->ctx->ext.npn_select_cb == NULL) { 1567 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_NPN, 1568 SSL_R_BAD_EXTENSION); 1569 return 0; 1570 } 1571 1572 /* The data must be valid */ 1573 tmppkt = *pkt; 1574 if (!ssl_next_proto_validate(s, &tmppkt)) { 1575 /* SSLfatal() already called */ 1576 return 0; 1577 } 1578 if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len, 1579 PACKET_data(pkt), 1580 PACKET_remaining(pkt), 1581 s->ctx->ext.npn_select_cb_arg) != 1582 SSL_TLSEXT_ERR_OK) { 1583 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_NPN, 1584 SSL_R_BAD_EXTENSION); 1585 return 0; 1586 } 1587 1588 /* 1589 * Could be non-NULL if server has sent multiple NPN extensions in 1590 * a single Serverhello 1591 */ 1592 OPENSSL_free(s->ext.npn); 1593 s->ext.npn = OPENSSL_malloc(selected_len); 1594 if (s->ext.npn == NULL) { 1595 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_NPN, 1596 ERR_R_INTERNAL_ERROR); 1597 return 0; 1598 } 1599 1600 memcpy(s->ext.npn, selected, selected_len); 1601 s->ext.npn_len = selected_len; 1602 s->s3->npn_seen = 1; 1603 1604 return 1; 1605 } 1606 #endif 1607 1608 int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1609 size_t chainidx) 1610 { 1611 size_t len; 1612 1613 /* We must have requested it. */ 1614 if (!s->s3->alpn_sent) { 1615 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_ALPN, 1616 SSL_R_BAD_EXTENSION); 1617 return 0; 1618 } 1619 /*- 1620 * The extension data consists of: 1621 * uint16 list_length 1622 * uint8 proto_length; 1623 * uint8 proto[proto_length]; 1624 */ 1625 if (!PACKET_get_net_2_len(pkt, &len) 1626 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len) 1627 || PACKET_remaining(pkt) != len) { 1628 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1629 SSL_R_BAD_EXTENSION); 1630 return 0; 1631 } 1632 OPENSSL_free(s->s3->alpn_selected); 1633 s->s3->alpn_selected = OPENSSL_malloc(len); 1634 if (s->s3->alpn_selected == NULL) { 1635 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1636 ERR_R_INTERNAL_ERROR); 1637 return 0; 1638 } 1639 if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) { 1640 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1641 SSL_R_BAD_EXTENSION); 1642 return 0; 1643 } 1644 s->s3->alpn_selected_len = len; 1645 1646 if (s->session->ext.alpn_selected == NULL 1647 || s->session->ext.alpn_selected_len != len 1648 || memcmp(s->session->ext.alpn_selected, s->s3->alpn_selected, len) 1649 != 0) { 1650 /* ALPN not consistent with the old session so cannot use early_data */ 1651 s->ext.early_data_ok = 0; 1652 } 1653 if (!s->hit) { 1654 /* 1655 * This is a new session and so alpn_selected should have been 1656 * initialised to NULL. We should update it with the selected ALPN. 1657 */ 1658 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { 1659 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1660 ERR_R_INTERNAL_ERROR); 1661 return 0; 1662 } 1663 s->session->ext.alpn_selected = 1664 OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); 1665 if (s->session->ext.alpn_selected == NULL) { 1666 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1667 ERR_R_INTERNAL_ERROR); 1668 return 0; 1669 } 1670 s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; 1671 } 1672 1673 return 1; 1674 } 1675 1676 #ifndef OPENSSL_NO_SRTP 1677 int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1678 size_t chainidx) 1679 { 1680 unsigned int id, ct, mki; 1681 int i; 1682 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1683 SRTP_PROTECTION_PROFILE *prof; 1684 1685 if (!PACKET_get_net_2(pkt, &ct) || ct != 2 1686 || !PACKET_get_net_2(pkt, &id) 1687 || !PACKET_get_1(pkt, &mki) 1688 || PACKET_remaining(pkt) != 0) { 1689 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1690 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1691 return 0; 1692 } 1693 1694 if (mki != 0) { 1695 /* Must be no MKI, since we never offer one */ 1696 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1697 SSL_R_BAD_SRTP_MKI_VALUE); 1698 return 0; 1699 } 1700 1701 /* Throw an error if the server gave us an unsolicited extension */ 1702 clnt = SSL_get_srtp_profiles(s); 1703 if (clnt == NULL) { 1704 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1705 SSL_R_NO_SRTP_PROFILES); 1706 return 0; 1707 } 1708 1709 /* 1710 * Check to see if the server gave us something we support (and 1711 * presumably offered) 1712 */ 1713 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) { 1714 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 1715 1716 if (prof->id == id) { 1717 s->srtp_profile = prof; 1718 return 1; 1719 } 1720 } 1721 1722 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1723 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1724 return 0; 1725 } 1726 #endif 1727 1728 int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1729 size_t chainidx) 1730 { 1731 /* Ignore if inappropriate ciphersuite */ 1732 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 1733 && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD 1734 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4) 1735 s->ext.use_etm = 1; 1736 1737 return 1; 1738 } 1739 1740 int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1741 size_t chainidx) 1742 { 1743 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS; 1744 if (!s->hit) 1745 s->session->flags |= SSL_SESS_FLAG_EXTMS; 1746 1747 return 1; 1748 } 1749 1750 int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context, 1751 X509 *x, size_t chainidx) 1752 { 1753 unsigned int version; 1754 1755 if (!PACKET_get_net_2(pkt, &version) 1756 || PACKET_remaining(pkt) != 0) { 1757 SSLfatal(s, SSL_AD_DECODE_ERROR, 1758 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1759 SSL_R_LENGTH_MISMATCH); 1760 return 0; 1761 } 1762 1763 /* 1764 * The only protocol version we support which is valid in this extension in 1765 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else. 1766 */ 1767 if (version != TLS1_3_VERSION) { 1768 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1769 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1770 SSL_R_BAD_PROTOCOL_VERSION_NUMBER); 1771 return 0; 1772 } 1773 1774 /* We ignore this extension for HRRs except to sanity check it */ 1775 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) 1776 return 1; 1777 1778 /* We just set it here. We validate it in ssl_choose_client_version */ 1779 s->version = version; 1780 1781 return 1; 1782 } 1783 1784 int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1785 size_t chainidx) 1786 { 1787 #ifndef OPENSSL_NO_TLS1_3 1788 unsigned int group_id; 1789 PACKET encoded_pt; 1790 EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL; 1791 1792 /* Sanity check */ 1793 if (ckey == NULL || s->s3->peer_tmp != NULL) { 1794 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1795 ERR_R_INTERNAL_ERROR); 1796 return 0; 1797 } 1798 1799 if (!PACKET_get_net_2(pkt, &group_id)) { 1800 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1801 SSL_R_LENGTH_MISMATCH); 1802 return 0; 1803 } 1804 1805 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) { 1806 const uint16_t *pgroups = NULL; 1807 size_t i, num_groups; 1808 1809 if (PACKET_remaining(pkt) != 0) { 1810 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1811 SSL_R_LENGTH_MISMATCH); 1812 return 0; 1813 } 1814 1815 /* 1816 * It is an error if the HelloRetryRequest wants a key_share that we 1817 * already sent in the first ClientHello 1818 */ 1819 if (group_id == s->s3->group_id) { 1820 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1821 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1822 return 0; 1823 } 1824 1825 /* Validate the selected group is one we support */ 1826 tls1_get_supported_groups(s, &pgroups, &num_groups); 1827 for (i = 0; i < num_groups; i++) { 1828 if (group_id == pgroups[i]) 1829 break; 1830 } 1831 if (i >= num_groups 1832 || !tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) { 1833 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1834 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1835 return 0; 1836 } 1837 1838 s->s3->group_id = group_id; 1839 EVP_PKEY_free(s->s3->tmp.pkey); 1840 s->s3->tmp.pkey = NULL; 1841 return 1; 1842 } 1843 1844 if (group_id != s->s3->group_id) { 1845 /* 1846 * This isn't for the group that we sent in the original 1847 * key_share! 1848 */ 1849 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1850 SSL_R_BAD_KEY_SHARE); 1851 return 0; 1852 } 1853 1854 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt) 1855 || PACKET_remaining(&encoded_pt) == 0) { 1856 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1857 SSL_R_LENGTH_MISMATCH); 1858 return 0; 1859 } 1860 1861 skey = ssl_generate_pkey(ckey); 1862 if (skey == NULL) { 1863 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1864 ERR_R_MALLOC_FAILURE); 1865 return 0; 1866 } 1867 if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), 1868 PACKET_remaining(&encoded_pt))) { 1869 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1870 SSL_R_BAD_ECPOINT); 1871 EVP_PKEY_free(skey); 1872 return 0; 1873 } 1874 1875 if (ssl_derive(s, ckey, skey, 1) == 0) { 1876 /* SSLfatal() already called */ 1877 EVP_PKEY_free(skey); 1878 return 0; 1879 } 1880 s->s3->peer_tmp = skey; 1881 #endif 1882 1883 return 1; 1884 } 1885 1886 int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1887 size_t chainidx) 1888 { 1889 PACKET cookie; 1890 1891 if (!PACKET_as_length_prefixed_2(pkt, &cookie) 1892 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie, 1893 &s->ext.tls13_cookie_len)) { 1894 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_COOKIE, 1895 SSL_R_LENGTH_MISMATCH); 1896 return 0; 1897 } 1898 1899 return 1; 1900 } 1901 1902 int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context, 1903 X509 *x, size_t chainidx) 1904 { 1905 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { 1906 unsigned long max_early_data; 1907 1908 if (!PACKET_get_net_4(pkt, &max_early_data) 1909 || PACKET_remaining(pkt) != 0) { 1910 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1911 SSL_R_INVALID_MAX_EARLY_DATA); 1912 return 0; 1913 } 1914 1915 s->session->ext.max_early_data = max_early_data; 1916 1917 return 1; 1918 } 1919 1920 if (PACKET_remaining(pkt) != 0) { 1921 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1922 SSL_R_BAD_EXTENSION); 1923 return 0; 1924 } 1925 1926 if (!s->ext.early_data_ok 1927 || !s->hit 1928 || s->session->ext.tick_identity != 0) { 1929 /* 1930 * If we get here then we didn't send early data, or we didn't resume 1931 * using the first identity, or the SNI/ALPN is not consistent so the 1932 * server should not be accepting it. 1933 */ 1934 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1935 SSL_R_BAD_EXTENSION); 1936 return 0; 1937 } 1938 1939 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; 1940 1941 return 1; 1942 } 1943 1944 int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1945 size_t chainidx) 1946 { 1947 #ifndef OPENSSL_NO_TLS1_3 1948 unsigned int identity; 1949 1950 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) { 1951 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1952 SSL_R_LENGTH_MISMATCH); 1953 return 0; 1954 } 1955 1956 if (s->session->ext.tick_identity == (int)identity) { 1957 s->hit = 1; 1958 SSL_SESSION_free(s->psksession); 1959 s->psksession = NULL; 1960 return 1; 1961 } 1962 1963 if (s->psksession == NULL 1964 || s->psksession->ext.tick_identity != (int)identity) { 1965 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, 1966 SSL_R_BAD_PSK_IDENTITY); 1967 return 0; 1968 } 1969 1970 /* 1971 * If we used the external PSK for sending early_data then s->early_secret 1972 * is already set up, so don't overwrite it. Otherwise we copy the 1973 * early_secret across that we generated earlier. 1974 */ 1975 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 1976 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 1977 || s->session->ext.max_early_data > 0 1978 || s->psksession->ext.max_early_data == 0) 1979 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE); 1980 1981 SSL_SESSION_free(s->session); 1982 s->session = s->psksession; 1983 s->psksession = NULL; 1984 s->hit = 1; 1985 #endif 1986 1987 return 1; 1988 } 1989