1 /* 2 * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/ocsp.h> 11 #include "../ssl_local.h" 12 #include "internal/cryptlib.h" 13 #include "statem_local.h" 14 15 EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, 16 unsigned int context, X509 *x, 17 size_t chainidx) 18 { 19 /* Add RI if renegotiating */ 20 if (!s->renegotiate) 21 return EXT_RETURN_NOT_SENT; 22 23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) 24 || !WPACKET_start_sub_packet_u16(pkt) 25 || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished, 26 s->s3->previous_client_finished_len) 27 || !WPACKET_close(pkt)) { 28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, 29 ERR_R_INTERNAL_ERROR); 30 return EXT_RETURN_FAIL; 31 } 32 33 return EXT_RETURN_SENT; 34 } 35 36 EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, 37 unsigned int context, X509 *x, 38 size_t chainidx) 39 { 40 if (s->ext.hostname == NULL) 41 return EXT_RETURN_NOT_SENT; 42 43 /* Add TLS extension servername to the Client Hello message */ 44 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) 45 /* Sub-packet for server_name extension */ 46 || !WPACKET_start_sub_packet_u16(pkt) 47 /* Sub-packet for servername list (always 1 hostname)*/ 48 || !WPACKET_start_sub_packet_u16(pkt) 49 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name) 50 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname, 51 strlen(s->ext.hostname)) 52 || !WPACKET_close(pkt) 53 || !WPACKET_close(pkt)) { 54 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, 55 ERR_R_INTERNAL_ERROR); 56 return EXT_RETURN_FAIL; 57 } 58 59 return EXT_RETURN_SENT; 60 } 61 62 /* Push a Max Fragment Len extension into ClientHello */ 63 EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, 64 unsigned int context, X509 *x, 65 size_t chainidx) 66 { 67 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED) 68 return EXT_RETURN_NOT_SENT; 69 70 /* Add Max Fragment Length extension if client enabled it. */ 71 /*- 72 * 4 bytes for this extension type and extension length 73 * 1 byte for the Max Fragment Length code value. 74 */ 75 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) 76 /* Sub-packet for Max Fragment Length extension (1 byte) */ 77 || !WPACKET_start_sub_packet_u16(pkt) 78 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode) 79 || !WPACKET_close(pkt)) { 80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 81 SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR); 82 return EXT_RETURN_FAIL; 83 } 84 85 return EXT_RETURN_SENT; 86 } 87 88 #ifndef OPENSSL_NO_SRP 89 EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, 90 X509 *x, size_t chainidx) 91 { 92 /* Add SRP username if there is one */ 93 if (s->srp_ctx.login == NULL) 94 return EXT_RETURN_NOT_SENT; 95 96 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp) 97 /* Sub-packet for SRP extension */ 98 || !WPACKET_start_sub_packet_u16(pkt) 99 || !WPACKET_start_sub_packet_u8(pkt) 100 /* login must not be zero...internal error if so */ 101 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) 102 || !WPACKET_memcpy(pkt, s->srp_ctx.login, 103 strlen(s->srp_ctx.login)) 104 || !WPACKET_close(pkt) 105 || !WPACKET_close(pkt)) { 106 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP, 107 ERR_R_INTERNAL_ERROR); 108 return EXT_RETURN_FAIL; 109 } 110 111 return EXT_RETURN_SENT; 112 } 113 #endif 114 115 #ifndef OPENSSL_NO_EC 116 static int use_ecc(SSL *s) 117 { 118 int i, end, ret = 0; 119 unsigned long alg_k, alg_a; 120 STACK_OF(SSL_CIPHER) *cipher_stack = NULL; 121 122 /* See if we support any ECC ciphersuites */ 123 if (s->version == SSL3_VERSION) 124 return 0; 125 126 cipher_stack = SSL_get1_supported_ciphers(s); 127 end = sk_SSL_CIPHER_num(cipher_stack); 128 for (i = 0; i < end; i++) { 129 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); 130 131 alg_k = c->algorithm_mkey; 132 alg_a = c->algorithm_auth; 133 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) 134 || (alg_a & SSL_aECDSA) 135 || c->min_tls >= TLS1_3_VERSION) { 136 ret = 1; 137 break; 138 } 139 } 140 141 sk_SSL_CIPHER_free(cipher_stack); 142 return ret; 143 } 144 145 EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, 146 unsigned int context, X509 *x, 147 size_t chainidx) 148 { 149 const unsigned char *pformats; 150 size_t num_formats; 151 152 if (!use_ecc(s)) 153 return EXT_RETURN_NOT_SENT; 154 155 /* Add TLS extension ECPointFormats to the ClientHello message */ 156 tls1_get_formatlist(s, &pformats, &num_formats); 157 158 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) 159 /* Sub-packet for formats extension */ 160 || !WPACKET_start_sub_packet_u16(pkt) 161 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats) 162 || !WPACKET_close(pkt)) { 163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 164 SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 165 return EXT_RETURN_FAIL; 166 } 167 168 return EXT_RETURN_SENT; 169 } 170 171 EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, 172 unsigned int context, X509 *x, 173 size_t chainidx) 174 { 175 const uint16_t *pgroups = NULL; 176 size_t num_groups = 0, i; 177 178 if (!use_ecc(s)) 179 return EXT_RETURN_NOT_SENT; 180 181 /* 182 * Add TLS extension supported_groups to the ClientHello message 183 */ 184 /* TODO(TLS1.3): Add support for DHE groups */ 185 tls1_get_supported_groups(s, &pgroups, &num_groups); 186 187 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) 188 /* Sub-packet for supported_groups extension */ 189 || !WPACKET_start_sub_packet_u16(pkt) 190 || !WPACKET_start_sub_packet_u16(pkt)) { 191 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 192 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 193 ERR_R_INTERNAL_ERROR); 194 return EXT_RETURN_FAIL; 195 } 196 /* Copy curve ID if supported */ 197 for (i = 0; i < num_groups; i++) { 198 uint16_t ctmp = pgroups[i]; 199 200 if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) { 201 if (!WPACKET_put_bytes_u16(pkt, ctmp)) { 202 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 203 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 204 ERR_R_INTERNAL_ERROR); 205 return EXT_RETURN_FAIL; 206 } 207 } 208 } 209 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 210 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 211 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 212 ERR_R_INTERNAL_ERROR); 213 return EXT_RETURN_FAIL; 214 } 215 216 return EXT_RETURN_SENT; 217 } 218 #endif 219 220 EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, 221 unsigned int context, X509 *x, 222 size_t chainidx) 223 { 224 size_t ticklen; 225 226 if (!tls_use_ticket(s)) 227 return EXT_RETURN_NOT_SENT; 228 229 if (!s->new_session && s->session != NULL 230 && s->session->ext.tick != NULL 231 && s->session->ssl_version != TLS1_3_VERSION) { 232 ticklen = s->session->ext.ticklen; 233 } else if (s->session && s->ext.session_ticket != NULL 234 && s->ext.session_ticket->data != NULL) { 235 ticklen = s->ext.session_ticket->length; 236 s->session->ext.tick = OPENSSL_malloc(ticklen); 237 if (s->session->ext.tick == NULL) { 238 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 239 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, 240 ERR_R_INTERNAL_ERROR); 241 return EXT_RETURN_FAIL; 242 } 243 memcpy(s->session->ext.tick, 244 s->ext.session_ticket->data, ticklen); 245 s->session->ext.ticklen = ticklen; 246 } else { 247 ticklen = 0; 248 } 249 250 if (ticklen == 0 && s->ext.session_ticket != NULL && 251 s->ext.session_ticket->data == NULL) 252 return EXT_RETURN_NOT_SENT; 253 254 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) 255 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) { 256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 257 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); 258 return EXT_RETURN_FAIL; 259 } 260 261 return EXT_RETURN_SENT; 262 } 263 264 EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, 265 unsigned int context, X509 *x, 266 size_t chainidx) 267 { 268 size_t salglen; 269 const uint16_t *salg; 270 271 if (!SSL_CLIENT_USE_SIGALGS(s)) 272 return EXT_RETURN_NOT_SENT; 273 274 salglen = tls12_get_psigalgs(s, 1, &salg); 275 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms) 276 /* Sub-packet for sig-algs extension */ 277 || !WPACKET_start_sub_packet_u16(pkt) 278 /* Sub-packet for the actual list */ 279 || !WPACKET_start_sub_packet_u16(pkt) 280 || !tls12_copy_sigalgs(s, pkt, salg, salglen) 281 || !WPACKET_close(pkt) 282 || !WPACKET_close(pkt)) { 283 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, 284 ERR_R_INTERNAL_ERROR); 285 return EXT_RETURN_FAIL; 286 } 287 288 return EXT_RETURN_SENT; 289 } 290 291 #ifndef OPENSSL_NO_OCSP 292 EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, 293 unsigned int context, X509 *x, 294 size_t chainidx) 295 { 296 int i; 297 298 /* This extension isn't defined for client Certificates */ 299 if (x != NULL) 300 return EXT_RETURN_NOT_SENT; 301 302 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) 303 return EXT_RETURN_NOT_SENT; 304 305 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) 306 /* Sub-packet for status request extension */ 307 || !WPACKET_start_sub_packet_u16(pkt) 308 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp) 309 /* Sub-packet for the ids */ 310 || !WPACKET_start_sub_packet_u16(pkt)) { 311 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 312 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 313 return EXT_RETURN_FAIL; 314 } 315 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) { 316 unsigned char *idbytes; 317 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i); 318 int idlen = i2d_OCSP_RESPID(id, NULL); 319 320 if (idlen <= 0 321 /* Sub-packet for an individual id */ 322 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes) 323 || i2d_OCSP_RESPID(id, &idbytes) != idlen) { 324 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 325 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 326 ERR_R_INTERNAL_ERROR); 327 return EXT_RETURN_FAIL; 328 } 329 } 330 if (!WPACKET_close(pkt) 331 || !WPACKET_start_sub_packet_u16(pkt)) { 332 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 333 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 334 return EXT_RETURN_FAIL; 335 } 336 if (s->ext.ocsp.exts) { 337 unsigned char *extbytes; 338 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL); 339 340 if (extlen < 0) { 341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 342 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 343 ERR_R_INTERNAL_ERROR); 344 return EXT_RETURN_FAIL; 345 } 346 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes) 347 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes) 348 != extlen) { 349 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 350 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 351 ERR_R_INTERNAL_ERROR); 352 return EXT_RETURN_FAIL; 353 } 354 } 355 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 356 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 357 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 358 return EXT_RETURN_FAIL; 359 } 360 361 return EXT_RETURN_SENT; 362 } 363 #endif 364 365 #ifndef OPENSSL_NO_NEXTPROTONEG 366 EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, 367 X509 *x, size_t chainidx) 368 { 369 if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 370 return EXT_RETURN_NOT_SENT; 371 372 /* 373 * The client advertises an empty extension to indicate its support 374 * for Next Protocol Negotiation 375 */ 376 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) 377 || !WPACKET_put_bytes_u16(pkt, 0)) { 378 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN, 379 ERR_R_INTERNAL_ERROR); 380 return EXT_RETURN_FAIL; 381 } 382 383 return EXT_RETURN_SENT; 384 } 385 #endif 386 387 EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, 388 X509 *x, size_t chainidx) 389 { 390 s->s3->alpn_sent = 0; 391 392 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 393 return EXT_RETURN_NOT_SENT; 394 395 if (!WPACKET_put_bytes_u16(pkt, 396 TLSEXT_TYPE_application_layer_protocol_negotiation) 397 /* Sub-packet ALPN extension */ 398 || !WPACKET_start_sub_packet_u16(pkt) 399 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len) 400 || !WPACKET_close(pkt)) { 401 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, 402 ERR_R_INTERNAL_ERROR); 403 return EXT_RETURN_FAIL; 404 } 405 s->s3->alpn_sent = 1; 406 407 return EXT_RETURN_SENT; 408 } 409 410 411 #ifndef OPENSSL_NO_SRTP 412 EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, 413 unsigned int context, X509 *x, 414 size_t chainidx) 415 { 416 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s); 417 int i, end; 418 419 if (clnt == NULL) 420 return EXT_RETURN_NOT_SENT; 421 422 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) 423 /* Sub-packet for SRTP extension */ 424 || !WPACKET_start_sub_packet_u16(pkt) 425 /* Sub-packet for the protection profile list */ 426 || !WPACKET_start_sub_packet_u16(pkt)) { 427 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 428 ERR_R_INTERNAL_ERROR); 429 return EXT_RETURN_FAIL; 430 } 431 432 end = sk_SRTP_PROTECTION_PROFILE_num(clnt); 433 for (i = 0; i < end; i++) { 434 const SRTP_PROTECTION_PROFILE *prof = 435 sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 436 437 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) { 438 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 439 SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); 440 return EXT_RETURN_FAIL; 441 } 442 } 443 if (!WPACKET_close(pkt) 444 /* Add an empty use_mki value */ 445 || !WPACKET_put_bytes_u8(pkt, 0) 446 || !WPACKET_close(pkt)) { 447 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 448 ERR_R_INTERNAL_ERROR); 449 return EXT_RETURN_FAIL; 450 } 451 452 return EXT_RETURN_SENT; 453 } 454 #endif 455 456 EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, 457 X509 *x, size_t chainidx) 458 { 459 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 460 return EXT_RETURN_NOT_SENT; 461 462 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) 463 || !WPACKET_put_bytes_u16(pkt, 0)) { 464 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM, 465 ERR_R_INTERNAL_ERROR); 466 return EXT_RETURN_FAIL; 467 } 468 469 return EXT_RETURN_SENT; 470 } 471 472 #ifndef OPENSSL_NO_CT 473 EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, 474 X509 *x, size_t chainidx) 475 { 476 if (s->ct_validation_callback == NULL) 477 return EXT_RETURN_NOT_SENT; 478 479 /* Not defined for client Certificates */ 480 if (x != NULL) 481 return EXT_RETURN_NOT_SENT; 482 483 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp) 484 || !WPACKET_put_bytes_u16(pkt, 0)) { 485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT, 486 ERR_R_INTERNAL_ERROR); 487 return EXT_RETURN_FAIL; 488 } 489 490 return EXT_RETURN_SENT; 491 } 492 #endif 493 494 EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, 495 X509 *x, size_t chainidx) 496 { 497 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) 498 || !WPACKET_put_bytes_u16(pkt, 0)) { 499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS, 500 ERR_R_INTERNAL_ERROR); 501 return EXT_RETURN_FAIL; 502 } 503 504 return EXT_RETURN_SENT; 505 } 506 507 EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, 508 unsigned int context, X509 *x, 509 size_t chainidx) 510 { 511 int currv, min_version, max_version, reason; 512 513 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); 514 if (reason != 0) { 515 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 516 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); 517 return EXT_RETURN_FAIL; 518 } 519 520 /* 521 * Don't include this if we can't negotiate TLSv1.3. We can do a straight 522 * comparison here because we will never be called in DTLS. 523 */ 524 if (max_version < TLS1_3_VERSION) 525 return EXT_RETURN_NOT_SENT; 526 527 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) 528 || !WPACKET_start_sub_packet_u16(pkt) 529 || !WPACKET_start_sub_packet_u8(pkt)) { 530 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 531 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 532 ERR_R_INTERNAL_ERROR); 533 return EXT_RETURN_FAIL; 534 } 535 536 for (currv = max_version; currv >= min_version; currv--) { 537 if (!WPACKET_put_bytes_u16(pkt, currv)) { 538 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 539 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 540 ERR_R_INTERNAL_ERROR); 541 return EXT_RETURN_FAIL; 542 } 543 } 544 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 545 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 546 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 547 ERR_R_INTERNAL_ERROR); 548 return EXT_RETURN_FAIL; 549 } 550 551 return EXT_RETURN_SENT; 552 } 553 554 /* 555 * Construct a psk_kex_modes extension. 556 */ 557 EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, 558 unsigned int context, X509 *x, 559 size_t chainidx) 560 { 561 #ifndef OPENSSL_NO_TLS1_3 562 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX; 563 564 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes) 565 || !WPACKET_start_sub_packet_u16(pkt) 566 || !WPACKET_start_sub_packet_u8(pkt) 567 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE) 568 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE)) 569 || !WPACKET_close(pkt) 570 || !WPACKET_close(pkt)) { 571 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 572 SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR); 573 return EXT_RETURN_FAIL; 574 } 575 576 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE; 577 if (nodhe) 578 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; 579 #endif 580 581 return EXT_RETURN_SENT; 582 } 583 584 #ifndef OPENSSL_NO_TLS1_3 585 static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id) 586 { 587 unsigned char *encoded_point = NULL; 588 EVP_PKEY *key_share_key = NULL; 589 size_t encodedlen; 590 591 if (s->s3->tmp.pkey != NULL) { 592 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) { 593 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 594 ERR_R_INTERNAL_ERROR); 595 return 0; 596 } 597 /* 598 * Could happen if we got an HRR that wasn't requesting a new key_share 599 */ 600 key_share_key = s->s3->tmp.pkey; 601 } else { 602 key_share_key = ssl_generate_pkey_group(s, curve_id); 603 if (key_share_key == NULL) { 604 /* SSLfatal() already called */ 605 return 0; 606 } 607 } 608 609 /* Encode the public key. */ 610 encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key, 611 &encoded_point); 612 if (encodedlen == 0) { 613 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB); 614 goto err; 615 } 616 617 /* Create KeyShareEntry */ 618 if (!WPACKET_put_bytes_u16(pkt, curve_id) 619 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) { 620 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 621 ERR_R_INTERNAL_ERROR); 622 goto err; 623 } 624 625 /* 626 * TODO(TLS1.3): When changing to send more than one key_share we're 627 * going to need to be able to save more than one EVP_PKEY. For now 628 * we reuse the existing tmp.pkey 629 */ 630 s->s3->tmp.pkey = key_share_key; 631 s->s3->group_id = curve_id; 632 OPENSSL_free(encoded_point); 633 634 return 1; 635 err: 636 if (s->s3->tmp.pkey == NULL) 637 EVP_PKEY_free(key_share_key); 638 OPENSSL_free(encoded_point); 639 return 0; 640 } 641 #endif 642 643 EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, 644 unsigned int context, X509 *x, 645 size_t chainidx) 646 { 647 #ifndef OPENSSL_NO_TLS1_3 648 size_t i, num_groups = 0; 649 const uint16_t *pgroups = NULL; 650 uint16_t curve_id = 0; 651 652 /* key_share extension */ 653 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 654 /* Extension data sub-packet */ 655 || !WPACKET_start_sub_packet_u16(pkt) 656 /* KeyShare list sub-packet */ 657 || !WPACKET_start_sub_packet_u16(pkt)) { 658 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 659 ERR_R_INTERNAL_ERROR); 660 return EXT_RETURN_FAIL; 661 } 662 663 tls1_get_supported_groups(s, &pgroups, &num_groups); 664 665 /* 666 * TODO(TLS1.3): Make the number of key_shares sent configurable. For 667 * now, just send one 668 */ 669 if (s->s3->group_id != 0) { 670 curve_id = s->s3->group_id; 671 } else { 672 for (i = 0; i < num_groups; i++) { 673 674 if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED)) 675 continue; 676 677 curve_id = pgroups[i]; 678 break; 679 } 680 } 681 682 if (curve_id == 0) { 683 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 684 SSL_R_NO_SUITABLE_KEY_SHARE); 685 return EXT_RETURN_FAIL; 686 } 687 688 if (!add_key_share(s, pkt, curve_id)) { 689 /* SSLfatal() already called */ 690 return EXT_RETURN_FAIL; 691 } 692 693 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 694 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 695 ERR_R_INTERNAL_ERROR); 696 return EXT_RETURN_FAIL; 697 } 698 return EXT_RETURN_SENT; 699 #else 700 return EXT_RETURN_NOT_SENT; 701 #endif 702 } 703 704 EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, 705 X509 *x, size_t chainidx) 706 { 707 EXT_RETURN ret = EXT_RETURN_FAIL; 708 709 /* Should only be set if we've had an HRR */ 710 if (s->ext.tls13_cookie_len == 0) 711 return EXT_RETURN_NOT_SENT; 712 713 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) 714 /* Extension data sub-packet */ 715 || !WPACKET_start_sub_packet_u16(pkt) 716 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie, 717 s->ext.tls13_cookie_len) 718 || !WPACKET_close(pkt)) { 719 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, 720 ERR_R_INTERNAL_ERROR); 721 goto end; 722 } 723 724 ret = EXT_RETURN_SENT; 725 end: 726 OPENSSL_free(s->ext.tls13_cookie); 727 s->ext.tls13_cookie = NULL; 728 s->ext.tls13_cookie_len = 0; 729 730 return ret; 731 } 732 733 EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, 734 unsigned int context, X509 *x, 735 size_t chainidx) 736 { 737 #ifndef OPENSSL_NO_PSK 738 char identity[PSK_MAX_IDENTITY_LEN + 1]; 739 #endif /* OPENSSL_NO_PSK */ 740 const unsigned char *id = NULL; 741 size_t idlen = 0; 742 SSL_SESSION *psksess = NULL; 743 SSL_SESSION *edsess = NULL; 744 const EVP_MD *handmd = NULL; 745 746 if (s->hello_retry_request == SSL_HRR_PENDING) 747 handmd = ssl_handshake_md(s); 748 749 if (s->psk_use_session_cb != NULL 750 && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess) 751 || (psksess != NULL 752 && psksess->ssl_version != TLS1_3_VERSION))) { 753 SSL_SESSION_free(psksess); 754 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 755 SSL_R_BAD_PSK); 756 return EXT_RETURN_FAIL; 757 } 758 759 #ifndef OPENSSL_NO_PSK 760 if (psksess == NULL && s->psk_client_callback != NULL) { 761 unsigned char psk[PSK_MAX_PSK_LEN]; 762 size_t psklen = 0; 763 764 memset(identity, 0, sizeof(identity)); 765 psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, 766 psk, sizeof(psk)); 767 768 if (psklen > PSK_MAX_PSK_LEN) { 769 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 770 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 771 return EXT_RETURN_FAIL; 772 } else if (psklen > 0) { 773 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; 774 const SSL_CIPHER *cipher; 775 776 idlen = strlen(identity); 777 if (idlen > PSK_MAX_IDENTITY_LEN) { 778 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 779 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 780 ERR_R_INTERNAL_ERROR); 781 return EXT_RETURN_FAIL; 782 } 783 id = (unsigned char *)identity; 784 785 /* 786 * We found a PSK using an old style callback. We don't know 787 * the digest so we default to SHA256 as per the TLSv1.3 spec 788 */ 789 cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); 790 if (cipher == NULL) { 791 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 792 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 793 ERR_R_INTERNAL_ERROR); 794 return EXT_RETURN_FAIL; 795 } 796 797 psksess = SSL_SESSION_new(); 798 if (psksess == NULL 799 || !SSL_SESSION_set1_master_key(psksess, psk, psklen) 800 || !SSL_SESSION_set_cipher(psksess, cipher) 801 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { 802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 803 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 804 ERR_R_INTERNAL_ERROR); 805 OPENSSL_cleanse(psk, psklen); 806 return EXT_RETURN_FAIL; 807 } 808 OPENSSL_cleanse(psk, psklen); 809 } 810 } 811 #endif /* OPENSSL_NO_PSK */ 812 813 SSL_SESSION_free(s->psksession); 814 s->psksession = psksess; 815 if (psksess != NULL) { 816 OPENSSL_free(s->psksession_id); 817 s->psksession_id = OPENSSL_memdup(id, idlen); 818 if (s->psksession_id == NULL) { 819 s->psksession_id_len = 0; 820 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 821 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 822 return EXT_RETURN_FAIL; 823 } 824 s->psksession_id_len = idlen; 825 } 826 827 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING 828 || (s->session->ext.max_early_data == 0 829 && (psksess == NULL || psksess->ext.max_early_data == 0))) { 830 s->max_early_data = 0; 831 return EXT_RETURN_NOT_SENT; 832 } 833 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess; 834 s->max_early_data = edsess->ext.max_early_data; 835 836 if (edsess->ext.hostname != NULL) { 837 if (s->ext.hostname == NULL 838 || (s->ext.hostname != NULL 839 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) { 840 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 841 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 842 SSL_R_INCONSISTENT_EARLY_DATA_SNI); 843 return EXT_RETURN_FAIL; 844 } 845 } 846 847 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) { 848 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 849 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 850 return EXT_RETURN_FAIL; 851 } 852 853 /* 854 * Verify that we are offering an ALPN protocol consistent with the early 855 * data. 856 */ 857 if (edsess->ext.alpn_selected != NULL) { 858 PACKET prots, alpnpkt; 859 int found = 0; 860 861 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) { 862 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 863 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 864 return EXT_RETURN_FAIL; 865 } 866 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) { 867 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected, 868 edsess->ext.alpn_selected_len)) { 869 found = 1; 870 break; 871 } 872 } 873 if (!found) { 874 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 875 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 876 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 877 return EXT_RETURN_FAIL; 878 } 879 } 880 881 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 882 || !WPACKET_start_sub_packet_u16(pkt) 883 || !WPACKET_close(pkt)) { 884 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 885 ERR_R_INTERNAL_ERROR); 886 return EXT_RETURN_FAIL; 887 } 888 889 /* 890 * We set this to rejected here. Later, if the server acknowledges the 891 * extension, we set it to accepted. 892 */ 893 s->ext.early_data = SSL_EARLY_DATA_REJECTED; 894 s->ext.early_data_ok = 1; 895 896 return EXT_RETURN_SENT; 897 } 898 899 #define F5_WORKAROUND_MIN_MSG_LEN 0xff 900 #define F5_WORKAROUND_MAX_MSG_LEN 0x200 901 902 /* 903 * PSK pre binder overhead = 904 * 2 bytes for TLSEXT_TYPE_psk 905 * 2 bytes for extension length 906 * 2 bytes for identities list length 907 * 2 bytes for identity length 908 * 4 bytes for obfuscated_ticket_age 909 * 2 bytes for binder list length 910 * 1 byte for binder length 911 * The above excludes the number of bytes for the identity itself and the 912 * subsequent binder bytes 913 */ 914 #define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1) 915 916 EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt, 917 unsigned int context, X509 *x, 918 size_t chainidx) 919 { 920 unsigned char *padbytes; 921 size_t hlen; 922 923 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0) 924 return EXT_RETURN_NOT_SENT; 925 926 /* 927 * Add padding to workaround bugs in F5 terminators. See RFC7685. 928 * This code calculates the length of all extensions added so far but 929 * excludes the PSK extension (because that MUST be written last). Therefore 930 * this extension MUST always appear second to last. 931 */ 932 if (!WPACKET_get_total_written(pkt, &hlen)) { 933 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 934 ERR_R_INTERNAL_ERROR); 935 return EXT_RETURN_FAIL; 936 } 937 938 /* 939 * If we're going to send a PSK then that will be written out after this 940 * extension, so we need to calculate how long it is going to be. 941 */ 942 if (s->session->ssl_version == TLS1_3_VERSION 943 && s->session->ext.ticklen != 0 944 && s->session->cipher != NULL) { 945 const EVP_MD *md = ssl_md(s->session->cipher->algorithm2); 946 947 if (md != NULL) { 948 /* 949 * Add the fixed PSK overhead, the identity length and the binder 950 * length. 951 */ 952 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen 953 + EVP_MD_size(md); 954 } 955 } 956 957 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) { 958 /* Calculate the amount of padding we need to add */ 959 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen; 960 961 /* 962 * Take off the size of extension header itself (2 bytes for type and 963 * 2 bytes for length bytes), but ensure that the extension is at least 964 * 1 byte long so as not to have an empty extension last (WebSphere 7.x, 965 * 8.x are intolerant of that condition) 966 */ 967 if (hlen > 4) 968 hlen -= 4; 969 else 970 hlen = 1; 971 972 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding) 973 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) { 974 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 975 ERR_R_INTERNAL_ERROR); 976 return EXT_RETURN_FAIL; 977 } 978 memset(padbytes, 0, hlen); 979 } 980 981 return EXT_RETURN_SENT; 982 } 983 984 /* 985 * Construct the pre_shared_key extension 986 */ 987 EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, 988 X509 *x, size_t chainidx) 989 { 990 #ifndef OPENSSL_NO_TLS1_3 991 uint32_t now, agesec, agems = 0; 992 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen; 993 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL; 994 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL; 995 int dores = 0; 996 997 s->ext.tick_identity = 0; 998 999 /* 1000 * Note: At this stage of the code we only support adding a single 1001 * resumption PSK. If we add support for multiple PSKs then the length 1002 * calculations in the padding extension will need to be adjusted. 1003 */ 1004 1005 /* 1006 * If this is an incompatible or new session then we have nothing to resume 1007 * so don't add this extension. 1008 */ 1009 if (s->session->ssl_version != TLS1_3_VERSION 1010 || (s->session->ext.ticklen == 0 && s->psksession == NULL)) 1011 return EXT_RETURN_NOT_SENT; 1012 1013 if (s->hello_retry_request == SSL_HRR_PENDING) 1014 handmd = ssl_handshake_md(s); 1015 1016 if (s->session->ext.ticklen != 0) { 1017 /* Get the digest associated with the ciphersuite in the session */ 1018 if (s->session->cipher == NULL) { 1019 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1020 ERR_R_INTERNAL_ERROR); 1021 return EXT_RETURN_FAIL; 1022 } 1023 mdres = ssl_md(s->session->cipher->algorithm2); 1024 if (mdres == NULL) { 1025 /* 1026 * Don't recognize this cipher so we can't use the session. 1027 * Ignore it 1028 */ 1029 goto dopsksess; 1030 } 1031 1032 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) { 1033 /* 1034 * Selected ciphersuite hash does not match the hash for the session 1035 * so we can't use it. 1036 */ 1037 goto dopsksess; 1038 } 1039 1040 /* 1041 * Technically the C standard just says time() returns a time_t and says 1042 * nothing about the encoding of that type. In practice most 1043 * implementations follow POSIX which holds it as an integral type in 1044 * seconds since epoch. We've already made the assumption that we can do 1045 * this in multiple places in the code, so portability shouldn't be an 1046 * issue. 1047 */ 1048 now = (uint32_t)time(NULL); 1049 agesec = now - (uint32_t)s->session->time; 1050 /* 1051 * We calculate the age in seconds but the server may work in ms. Due to 1052 * rounding errors we could overestimate the age by up to 1s. It is 1053 * better to underestimate it. Otherwise, if the RTT is very short, when 1054 * the server calculates the age reported by the client it could be 1055 * bigger than the age calculated on the server - which should never 1056 * happen. 1057 */ 1058 if (agesec > 0) 1059 agesec--; 1060 1061 if (s->session->ext.tick_lifetime_hint < agesec) { 1062 /* Ticket is too old. Ignore it. */ 1063 goto dopsksess; 1064 } 1065 1066 /* 1067 * Calculate age in ms. We're just doing it to nearest second. Should be 1068 * good enough. 1069 */ 1070 agems = agesec * (uint32_t)1000; 1071 1072 if (agesec != 0 && agems / (uint32_t)1000 != agesec) { 1073 /* 1074 * Overflow. Shouldn't happen unless this is a *really* old session. 1075 * If so we just ignore it. 1076 */ 1077 goto dopsksess; 1078 } 1079 1080 /* 1081 * Obfuscate the age. Overflow here is fine, this addition is supposed 1082 * to be mod 2^32. 1083 */ 1084 agems += s->session->ext.tick_age_add; 1085 1086 reshashsize = EVP_MD_size(mdres); 1087 s->ext.tick_identity++; 1088 dores = 1; 1089 } 1090 1091 dopsksess: 1092 if (!dores && s->psksession == NULL) 1093 return EXT_RETURN_NOT_SENT; 1094 1095 if (s->psksession != NULL) { 1096 mdpsk = ssl_md(s->psksession->cipher->algorithm2); 1097 if (mdpsk == NULL) { 1098 /* 1099 * Don't recognize this cipher so we can't use the session. 1100 * If this happens it's an application bug. 1101 */ 1102 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1103 SSL_R_BAD_PSK); 1104 return EXT_RETURN_FAIL; 1105 } 1106 1107 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) { 1108 /* 1109 * Selected ciphersuite hash does not match the hash for the PSK 1110 * session. This is an application bug. 1111 */ 1112 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1113 SSL_R_BAD_PSK); 1114 return EXT_RETURN_FAIL; 1115 } 1116 1117 pskhashsize = EVP_MD_size(mdpsk); 1118 } 1119 1120 /* Create the extension, but skip over the binder for now */ 1121 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) 1122 || !WPACKET_start_sub_packet_u16(pkt) 1123 || !WPACKET_start_sub_packet_u16(pkt)) { 1124 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1125 ERR_R_INTERNAL_ERROR); 1126 return EXT_RETURN_FAIL; 1127 } 1128 1129 if (dores) { 1130 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, 1131 s->session->ext.ticklen) 1132 || !WPACKET_put_bytes_u32(pkt, agems)) { 1133 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1134 ERR_R_INTERNAL_ERROR); 1135 return EXT_RETURN_FAIL; 1136 } 1137 } 1138 1139 if (s->psksession != NULL) { 1140 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id, 1141 s->psksession_id_len) 1142 || !WPACKET_put_bytes_u32(pkt, 0)) { 1143 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1144 ERR_R_INTERNAL_ERROR); 1145 return EXT_RETURN_FAIL; 1146 } 1147 s->ext.tick_identity++; 1148 } 1149 1150 if (!WPACKET_close(pkt) 1151 || !WPACKET_get_total_written(pkt, &binderoffset) 1152 || !WPACKET_start_sub_packet_u16(pkt) 1153 || (dores 1154 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder)) 1155 || (s->psksession != NULL 1156 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder)) 1157 || !WPACKET_close(pkt) 1158 || !WPACKET_close(pkt) 1159 || !WPACKET_get_total_written(pkt, &msglen) 1160 /* 1161 * We need to fill in all the sub-packet lengths now so we can 1162 * calculate the HMAC of the message up to the binders 1163 */ 1164 || !WPACKET_fill_lengths(pkt)) { 1165 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1166 ERR_R_INTERNAL_ERROR); 1167 return EXT_RETURN_FAIL; 1168 } 1169 1170 msgstart = WPACKET_get_curr(pkt) - msglen; 1171 1172 if (dores 1173 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL, 1174 resbinder, s->session, 1, 0) != 1) { 1175 /* SSLfatal() already called */ 1176 return EXT_RETURN_FAIL; 1177 } 1178 1179 if (s->psksession != NULL 1180 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL, 1181 pskbinder, s->psksession, 1, 1) != 1) { 1182 /* SSLfatal() already called */ 1183 return EXT_RETURN_FAIL; 1184 } 1185 1186 return EXT_RETURN_SENT; 1187 #else 1188 return EXT_RETURN_NOT_SENT; 1189 #endif 1190 } 1191 1192 EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, 1193 unsigned int context, 1194 X509 *x, size_t chainidx) 1195 { 1196 #ifndef OPENSSL_NO_TLS1_3 1197 if (!s->pha_enabled) 1198 return EXT_RETURN_NOT_SENT; 1199 1200 /* construct extension - 0 length, no contents */ 1201 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) 1202 || !WPACKET_start_sub_packet_u16(pkt) 1203 || !WPACKET_close(pkt)) { 1204 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1205 SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, 1206 ERR_R_INTERNAL_ERROR); 1207 return EXT_RETURN_FAIL; 1208 } 1209 1210 s->post_handshake_auth = SSL_PHA_EXT_SENT; 1211 1212 return EXT_RETURN_SENT; 1213 #else 1214 return EXT_RETURN_NOT_SENT; 1215 #endif 1216 } 1217 1218 1219 /* 1220 * Parse the server's renegotiation binding and abort if it's not right 1221 */ 1222 int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context, 1223 X509 *x, size_t chainidx) 1224 { 1225 size_t expected_len = s->s3->previous_client_finished_len 1226 + s->s3->previous_server_finished_len; 1227 size_t ilen; 1228 const unsigned char *data; 1229 1230 /* Check for logic errors */ 1231 if (!ossl_assert(expected_len == 0 1232 || s->s3->previous_client_finished_len != 0) 1233 || !ossl_assert(expected_len == 0 1234 || s->s3->previous_server_finished_len != 0)) { 1235 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1236 ERR_R_INTERNAL_ERROR); 1237 return 0; 1238 } 1239 1240 /* Parse the length byte */ 1241 if (!PACKET_get_1_len(pkt, &ilen)) { 1242 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1243 SSL_R_RENEGOTIATION_ENCODING_ERR); 1244 return 0; 1245 } 1246 1247 /* Consistency check */ 1248 if (PACKET_remaining(pkt) != ilen) { 1249 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1250 SSL_R_RENEGOTIATION_ENCODING_ERR); 1251 return 0; 1252 } 1253 1254 /* Check that the extension matches */ 1255 if (ilen != expected_len) { 1256 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1257 SSL_R_RENEGOTIATION_MISMATCH); 1258 return 0; 1259 } 1260 1261 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len) 1262 || memcmp(data, s->s3->previous_client_finished, 1263 s->s3->previous_client_finished_len) != 0) { 1264 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1265 SSL_R_RENEGOTIATION_MISMATCH); 1266 return 0; 1267 } 1268 1269 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len) 1270 || memcmp(data, s->s3->previous_server_finished, 1271 s->s3->previous_server_finished_len) != 0) { 1272 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1273 SSL_R_RENEGOTIATION_MISMATCH); 1274 return 0; 1275 } 1276 s->s3->send_connection_binding = 1; 1277 1278 return 1; 1279 } 1280 1281 /* Parse the server's max fragment len extension packet */ 1282 int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context, 1283 X509 *x, size_t chainidx) 1284 { 1285 unsigned int value; 1286 1287 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { 1288 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1289 SSL_R_BAD_EXTENSION); 1290 return 0; 1291 } 1292 1293 /* |value| should contains a valid max-fragment-length code. */ 1294 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { 1295 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1296 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1297 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1298 return 0; 1299 } 1300 1301 /* Must be the same value as client-configured one who was sent to server */ 1302 /*- 1303 * RFC 6066: if a client receives a maximum fragment length negotiation 1304 * response that differs from the length it requested, ... 1305 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert 1306 */ 1307 if (value != s->ext.max_fragment_len_mode) { 1308 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1309 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1310 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1311 return 0; 1312 } 1313 1314 /* 1315 * Maximum Fragment Length Negotiation succeeded. 1316 * The negotiated Maximum Fragment Length is binding now. 1317 */ 1318 s->session->ext.max_fragment_len_mode = value; 1319 1320 return 1; 1321 } 1322 1323 int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context, 1324 X509 *x, size_t chainidx) 1325 { 1326 if (s->ext.hostname == NULL) { 1327 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1328 ERR_R_INTERNAL_ERROR); 1329 return 0; 1330 } 1331 1332 if (PACKET_remaining(pkt) > 0) { 1333 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1334 SSL_R_BAD_EXTENSION); 1335 return 0; 1336 } 1337 1338 if (!s->hit) { 1339 if (s->session->ext.hostname != NULL) { 1340 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1341 ERR_R_INTERNAL_ERROR); 1342 return 0; 1343 } 1344 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); 1345 if (s->session->ext.hostname == NULL) { 1346 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1347 ERR_R_INTERNAL_ERROR); 1348 return 0; 1349 } 1350 } 1351 1352 return 1; 1353 } 1354 1355 #ifndef OPENSSL_NO_EC 1356 int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, 1357 X509 *x, size_t chainidx) 1358 { 1359 size_t ecpointformats_len; 1360 PACKET ecptformatlist; 1361 1362 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) { 1363 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, 1364 SSL_R_BAD_EXTENSION); 1365 return 0; 1366 } 1367 if (!s->hit) { 1368 ecpointformats_len = PACKET_remaining(&ecptformatlist); 1369 if (ecpointformats_len == 0) { 1370 SSLfatal(s, SSL_AD_DECODE_ERROR, 1371 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_LENGTH); 1372 return 0; 1373 } 1374 1375 s->ext.peer_ecpointformats_len = 0; 1376 OPENSSL_free(s->ext.peer_ecpointformats); 1377 s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len); 1378 if (s->ext.peer_ecpointformats == NULL) { 1379 s->ext.peer_ecpointformats_len = 0; 1380 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1381 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1382 return 0; 1383 } 1384 1385 s->ext.peer_ecpointformats_len = ecpointformats_len; 1386 1387 if (!PACKET_copy_bytes(&ecptformatlist, 1388 s->ext.peer_ecpointformats, 1389 ecpointformats_len)) { 1390 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1391 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1392 return 0; 1393 } 1394 } 1395 1396 return 1; 1397 } 1398 #endif 1399 1400 int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, 1401 X509 *x, size_t chainidx) 1402 { 1403 if (s->ext.session_ticket_cb != NULL && 1404 !s->ext.session_ticket_cb(s, PACKET_data(pkt), 1405 PACKET_remaining(pkt), 1406 s->ext.session_ticket_cb_arg)) { 1407 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 1408 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1409 return 0; 1410 } 1411 1412 if (!tls_use_ticket(s)) { 1413 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1414 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1415 return 0; 1416 } 1417 if (PACKET_remaining(pkt) > 0) { 1418 SSLfatal(s, SSL_AD_DECODE_ERROR, 1419 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1420 return 0; 1421 } 1422 1423 s->ext.ticket_expected = 1; 1424 1425 return 1; 1426 } 1427 1428 #ifndef OPENSSL_NO_OCSP 1429 int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, 1430 X509 *x, size_t chainidx) 1431 { 1432 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1433 /* We ignore this if the server sends a CertificateRequest */ 1434 /* TODO(TLS1.3): Add support for this */ 1435 return 1; 1436 } 1437 1438 /* 1439 * MUST only be sent if we've requested a status 1440 * request message. In TLS <= 1.2 it must also be empty. 1441 */ 1442 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { 1443 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1444 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1445 return 0; 1446 } 1447 if (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0) { 1448 SSLfatal(s, SSL_AD_DECODE_ERROR, 1449 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1450 return 0; 1451 } 1452 1453 if (SSL_IS_TLS13(s)) { 1454 /* We only know how to handle this if it's for the first Certificate in 1455 * the chain. We ignore any other responses. 1456 */ 1457 if (chainidx != 0) 1458 return 1; 1459 1460 /* SSLfatal() already called */ 1461 return tls_process_cert_status_body(s, pkt); 1462 } 1463 1464 /* Set flag to expect CertificateStatus message */ 1465 s->ext.status_expected = 1; 1466 1467 return 1; 1468 } 1469 #endif 1470 1471 1472 #ifndef OPENSSL_NO_CT 1473 int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1474 size_t chainidx) 1475 { 1476 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1477 /* We ignore this if the server sends it in a CertificateRequest */ 1478 /* TODO(TLS1.3): Add support for this */ 1479 return 1; 1480 } 1481 1482 /* 1483 * Only take it if we asked for it - i.e if there is no CT validation 1484 * callback set, then a custom extension MAY be processing it, so we 1485 * need to let control continue to flow to that. 1486 */ 1487 if (s->ct_validation_callback != NULL) { 1488 size_t size = PACKET_remaining(pkt); 1489 1490 /* Simply copy it off for later processing */ 1491 OPENSSL_free(s->ext.scts); 1492 s->ext.scts = NULL; 1493 1494 s->ext.scts_len = (uint16_t)size; 1495 if (size > 0) { 1496 s->ext.scts = OPENSSL_malloc(size); 1497 if (s->ext.scts == NULL) { 1498 s->ext.scts_len = 0; 1499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1500 ERR_R_MALLOC_FAILURE); 1501 return 0; 1502 } 1503 if (!PACKET_copy_bytes(pkt, s->ext.scts, size)) { 1504 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1505 ERR_R_INTERNAL_ERROR); 1506 return 0; 1507 } 1508 } 1509 } else { 1510 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 1511 ? ENDPOINT_CLIENT : ENDPOINT_BOTH; 1512 1513 /* 1514 * If we didn't ask for it then there must be a custom extension, 1515 * otherwise this is unsolicited. 1516 */ 1517 if (custom_ext_find(&s->cert->custext, role, 1518 TLSEXT_TYPE_signed_certificate_timestamp, 1519 NULL) == NULL) { 1520 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SCT, 1521 SSL_R_BAD_EXTENSION); 1522 return 0; 1523 } 1524 1525 if (!custom_ext_parse(s, context, 1526 TLSEXT_TYPE_signed_certificate_timestamp, 1527 PACKET_data(pkt), PACKET_remaining(pkt), 1528 x, chainidx)) { 1529 /* SSLfatal already called */ 1530 return 0; 1531 } 1532 } 1533 1534 return 1; 1535 } 1536 #endif 1537 1538 1539 #ifndef OPENSSL_NO_NEXTPROTONEG 1540 /* 1541 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1542 * elements of zero length are allowed and the set of elements must exactly 1543 * fill the length of the block. Returns 1 on success or 0 on failure. 1544 */ 1545 static int ssl_next_proto_validate(SSL *s, PACKET *pkt) 1546 { 1547 PACKET tmp_protocol; 1548 1549 while (PACKET_remaining(pkt)) { 1550 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol) 1551 || PACKET_remaining(&tmp_protocol) == 0) { 1552 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_NEXT_PROTO_VALIDATE, 1553 SSL_R_BAD_EXTENSION); 1554 return 0; 1555 } 1556 } 1557 1558 return 1; 1559 } 1560 1561 int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1562 size_t chainidx) 1563 { 1564 unsigned char *selected; 1565 unsigned char selected_len; 1566 PACKET tmppkt; 1567 1568 /* Check if we are in a renegotiation. If so ignore this extension */ 1569 if (!SSL_IS_FIRST_HANDSHAKE(s)) 1570 return 1; 1571 1572 /* We must have requested it. */ 1573 if (s->ctx->ext.npn_select_cb == NULL) { 1574 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_NPN, 1575 SSL_R_BAD_EXTENSION); 1576 return 0; 1577 } 1578 1579 /* The data must be valid */ 1580 tmppkt = *pkt; 1581 if (!ssl_next_proto_validate(s, &tmppkt)) { 1582 /* SSLfatal() already called */ 1583 return 0; 1584 } 1585 if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len, 1586 PACKET_data(pkt), 1587 PACKET_remaining(pkt), 1588 s->ctx->ext.npn_select_cb_arg) != 1589 SSL_TLSEXT_ERR_OK) { 1590 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_NPN, 1591 SSL_R_BAD_EXTENSION); 1592 return 0; 1593 } 1594 1595 /* 1596 * Could be non-NULL if server has sent multiple NPN extensions in 1597 * a single Serverhello 1598 */ 1599 OPENSSL_free(s->ext.npn); 1600 s->ext.npn = OPENSSL_malloc(selected_len); 1601 if (s->ext.npn == NULL) { 1602 s->ext.npn_len = 0; 1603 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_NPN, 1604 ERR_R_INTERNAL_ERROR); 1605 return 0; 1606 } 1607 1608 memcpy(s->ext.npn, selected, selected_len); 1609 s->ext.npn_len = selected_len; 1610 s->s3->npn_seen = 1; 1611 1612 return 1; 1613 } 1614 #endif 1615 1616 int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1617 size_t chainidx) 1618 { 1619 size_t len; 1620 1621 /* We must have requested it. */ 1622 if (!s->s3->alpn_sent) { 1623 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_ALPN, 1624 SSL_R_BAD_EXTENSION); 1625 return 0; 1626 } 1627 /*- 1628 * The extension data consists of: 1629 * uint16 list_length 1630 * uint8 proto_length; 1631 * uint8 proto[proto_length]; 1632 */ 1633 if (!PACKET_get_net_2_len(pkt, &len) 1634 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len) 1635 || PACKET_remaining(pkt) != len) { 1636 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1637 SSL_R_BAD_EXTENSION); 1638 return 0; 1639 } 1640 OPENSSL_free(s->s3->alpn_selected); 1641 s->s3->alpn_selected = OPENSSL_malloc(len); 1642 if (s->s3->alpn_selected == NULL) { 1643 s->s3->alpn_selected_len = 0; 1644 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1645 ERR_R_INTERNAL_ERROR); 1646 return 0; 1647 } 1648 if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) { 1649 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1650 SSL_R_BAD_EXTENSION); 1651 return 0; 1652 } 1653 s->s3->alpn_selected_len = len; 1654 1655 if (s->session->ext.alpn_selected == NULL 1656 || s->session->ext.alpn_selected_len != len 1657 || memcmp(s->session->ext.alpn_selected, s->s3->alpn_selected, len) 1658 != 0) { 1659 /* ALPN not consistent with the old session so cannot use early_data */ 1660 s->ext.early_data_ok = 0; 1661 } 1662 if (!s->hit) { 1663 /* 1664 * This is a new session and so alpn_selected should have been 1665 * initialised to NULL. We should update it with the selected ALPN. 1666 */ 1667 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { 1668 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1669 ERR_R_INTERNAL_ERROR); 1670 return 0; 1671 } 1672 s->session->ext.alpn_selected = 1673 OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); 1674 if (s->session->ext.alpn_selected == NULL) { 1675 s->session->ext.alpn_selected_len = 0; 1676 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1677 ERR_R_INTERNAL_ERROR); 1678 return 0; 1679 } 1680 s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; 1681 } 1682 1683 return 1; 1684 } 1685 1686 #ifndef OPENSSL_NO_SRTP 1687 int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1688 size_t chainidx) 1689 { 1690 unsigned int id, ct, mki; 1691 int i; 1692 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1693 SRTP_PROTECTION_PROFILE *prof; 1694 1695 if (!PACKET_get_net_2(pkt, &ct) || ct != 2 1696 || !PACKET_get_net_2(pkt, &id) 1697 || !PACKET_get_1(pkt, &mki) 1698 || PACKET_remaining(pkt) != 0) { 1699 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1700 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1701 return 0; 1702 } 1703 1704 if (mki != 0) { 1705 /* Must be no MKI, since we never offer one */ 1706 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1707 SSL_R_BAD_SRTP_MKI_VALUE); 1708 return 0; 1709 } 1710 1711 /* Throw an error if the server gave us an unsolicited extension */ 1712 clnt = SSL_get_srtp_profiles(s); 1713 if (clnt == NULL) { 1714 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1715 SSL_R_NO_SRTP_PROFILES); 1716 return 0; 1717 } 1718 1719 /* 1720 * Check to see if the server gave us something we support (and 1721 * presumably offered) 1722 */ 1723 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) { 1724 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 1725 1726 if (prof->id == id) { 1727 s->srtp_profile = prof; 1728 return 1; 1729 } 1730 } 1731 1732 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1733 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1734 return 0; 1735 } 1736 #endif 1737 1738 int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1739 size_t chainidx) 1740 { 1741 /* Ignore if inappropriate ciphersuite */ 1742 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 1743 && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD 1744 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4 1745 && s->s3->tmp.new_cipher->algorithm_enc != SSL_eGOST2814789CNT 1746 && s->s3->tmp.new_cipher->algorithm_enc != SSL_eGOST2814789CNT12) 1747 s->ext.use_etm = 1; 1748 1749 return 1; 1750 } 1751 1752 int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1753 size_t chainidx) 1754 { 1755 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS; 1756 if (!s->hit) 1757 s->session->flags |= SSL_SESS_FLAG_EXTMS; 1758 1759 return 1; 1760 } 1761 1762 int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context, 1763 X509 *x, size_t chainidx) 1764 { 1765 unsigned int version; 1766 1767 if (!PACKET_get_net_2(pkt, &version) 1768 || PACKET_remaining(pkt) != 0) { 1769 SSLfatal(s, SSL_AD_DECODE_ERROR, 1770 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1771 SSL_R_LENGTH_MISMATCH); 1772 return 0; 1773 } 1774 1775 /* 1776 * The only protocol version we support which is valid in this extension in 1777 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else. 1778 */ 1779 if (version != TLS1_3_VERSION) { 1780 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1781 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1782 SSL_R_BAD_PROTOCOL_VERSION_NUMBER); 1783 return 0; 1784 } 1785 1786 /* We ignore this extension for HRRs except to sanity check it */ 1787 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) 1788 return 1; 1789 1790 /* We just set it here. We validate it in ssl_choose_client_version */ 1791 s->version = version; 1792 1793 return 1; 1794 } 1795 1796 int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1797 size_t chainidx) 1798 { 1799 #ifndef OPENSSL_NO_TLS1_3 1800 unsigned int group_id; 1801 PACKET encoded_pt; 1802 EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL; 1803 1804 /* Sanity check */ 1805 if (ckey == NULL || s->s3->peer_tmp != NULL) { 1806 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1807 ERR_R_INTERNAL_ERROR); 1808 return 0; 1809 } 1810 1811 if (!PACKET_get_net_2(pkt, &group_id)) { 1812 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1813 SSL_R_LENGTH_MISMATCH); 1814 return 0; 1815 } 1816 1817 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) { 1818 const uint16_t *pgroups = NULL; 1819 size_t i, num_groups; 1820 1821 if (PACKET_remaining(pkt) != 0) { 1822 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1823 SSL_R_LENGTH_MISMATCH); 1824 return 0; 1825 } 1826 1827 /* 1828 * It is an error if the HelloRetryRequest wants a key_share that we 1829 * already sent in the first ClientHello 1830 */ 1831 if (group_id == s->s3->group_id) { 1832 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1833 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1834 return 0; 1835 } 1836 1837 /* Validate the selected group is one we support */ 1838 tls1_get_supported_groups(s, &pgroups, &num_groups); 1839 for (i = 0; i < num_groups; i++) { 1840 if (group_id == pgroups[i]) 1841 break; 1842 } 1843 if (i >= num_groups 1844 || !tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) { 1845 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1846 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1847 return 0; 1848 } 1849 1850 s->s3->group_id = group_id; 1851 EVP_PKEY_free(s->s3->tmp.pkey); 1852 s->s3->tmp.pkey = NULL; 1853 return 1; 1854 } 1855 1856 if (group_id != s->s3->group_id) { 1857 /* 1858 * This isn't for the group that we sent in the original 1859 * key_share! 1860 */ 1861 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1862 SSL_R_BAD_KEY_SHARE); 1863 return 0; 1864 } 1865 1866 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt) 1867 || PACKET_remaining(&encoded_pt) == 0) { 1868 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1869 SSL_R_LENGTH_MISMATCH); 1870 return 0; 1871 } 1872 1873 skey = EVP_PKEY_new(); 1874 if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) { 1875 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1876 ERR_R_MALLOC_FAILURE); 1877 EVP_PKEY_free(skey); 1878 return 0; 1879 } 1880 if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), 1881 PACKET_remaining(&encoded_pt))) { 1882 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1883 SSL_R_BAD_ECPOINT); 1884 EVP_PKEY_free(skey); 1885 return 0; 1886 } 1887 1888 if (ssl_derive(s, ckey, skey, 1) == 0) { 1889 /* SSLfatal() already called */ 1890 EVP_PKEY_free(skey); 1891 return 0; 1892 } 1893 s->s3->peer_tmp = skey; 1894 #endif 1895 1896 return 1; 1897 } 1898 1899 int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1900 size_t chainidx) 1901 { 1902 PACKET cookie; 1903 1904 if (!PACKET_as_length_prefixed_2(pkt, &cookie) 1905 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie, 1906 &s->ext.tls13_cookie_len)) { 1907 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_COOKIE, 1908 SSL_R_LENGTH_MISMATCH); 1909 return 0; 1910 } 1911 1912 return 1; 1913 } 1914 1915 int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context, 1916 X509 *x, size_t chainidx) 1917 { 1918 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { 1919 unsigned long max_early_data; 1920 1921 if (!PACKET_get_net_4(pkt, &max_early_data) 1922 || PACKET_remaining(pkt) != 0) { 1923 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1924 SSL_R_INVALID_MAX_EARLY_DATA); 1925 return 0; 1926 } 1927 1928 s->session->ext.max_early_data = max_early_data; 1929 1930 return 1; 1931 } 1932 1933 if (PACKET_remaining(pkt) != 0) { 1934 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1935 SSL_R_BAD_EXTENSION); 1936 return 0; 1937 } 1938 1939 if (!s->ext.early_data_ok 1940 || !s->hit) { 1941 /* 1942 * If we get here then we didn't send early data, or we didn't resume 1943 * using the first identity, or the SNI/ALPN is not consistent so the 1944 * server should not be accepting it. 1945 */ 1946 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1947 SSL_R_BAD_EXTENSION); 1948 return 0; 1949 } 1950 1951 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; 1952 1953 return 1; 1954 } 1955 1956 int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1957 size_t chainidx) 1958 { 1959 #ifndef OPENSSL_NO_TLS1_3 1960 unsigned int identity; 1961 1962 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) { 1963 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1964 SSL_R_LENGTH_MISMATCH); 1965 return 0; 1966 } 1967 1968 if (identity >= (unsigned int)s->ext.tick_identity) { 1969 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, 1970 SSL_R_BAD_PSK_IDENTITY); 1971 return 0; 1972 } 1973 1974 /* 1975 * Session resumption tickets are always sent before PSK tickets. If the 1976 * ticket index is 0 then it must be for a session resumption ticket if we 1977 * sent two tickets, or if we didn't send a PSK ticket. 1978 */ 1979 if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) { 1980 s->hit = 1; 1981 SSL_SESSION_free(s->psksession); 1982 s->psksession = NULL; 1983 return 1; 1984 } 1985 1986 if (s->psksession == NULL) { 1987 /* Should never happen */ 1988 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1989 ERR_R_INTERNAL_ERROR); 1990 return 0; 1991 } 1992 1993 /* 1994 * If we used the external PSK for sending early_data then s->early_secret 1995 * is already set up, so don't overwrite it. Otherwise we copy the 1996 * early_secret across that we generated earlier. 1997 */ 1998 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 1999 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 2000 || s->session->ext.max_early_data > 0 2001 || s->psksession->ext.max_early_data == 0) 2002 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE); 2003 2004 SSL_SESSION_free(s->session); 2005 s->session = s->psksession; 2006 s->psksession = NULL; 2007 s->hit = 1; 2008 /* Early data is only allowed if we used the first ticket */ 2009 if (identity != 0) 2010 s->ext.early_data_ok = 0; 2011 #endif 2012 2013 return 1; 2014 } 2015