1 /* 2 * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/ocsp.h> 11 #include "../ssl_locl.h" 12 #include "internal/cryptlib.h" 13 #include "statem_locl.h" 14 15 EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, 16 unsigned int context, X509 *x, 17 size_t chainidx) 18 { 19 /* Add RI if renegotiating */ 20 if (!s->renegotiate) 21 return EXT_RETURN_NOT_SENT; 22 23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) 24 || !WPACKET_start_sub_packet_u16(pkt) 25 || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished, 26 s->s3->previous_client_finished_len) 27 || !WPACKET_close(pkt)) { 28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, 29 ERR_R_INTERNAL_ERROR); 30 return EXT_RETURN_FAIL; 31 } 32 33 return EXT_RETURN_SENT; 34 } 35 36 EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, 37 unsigned int context, X509 *x, 38 size_t chainidx) 39 { 40 if (s->ext.hostname == NULL) 41 return EXT_RETURN_NOT_SENT; 42 43 /* Add TLS extension servername to the Client Hello message */ 44 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) 45 /* Sub-packet for server_name extension */ 46 || !WPACKET_start_sub_packet_u16(pkt) 47 /* Sub-packet for servername list (always 1 hostname)*/ 48 || !WPACKET_start_sub_packet_u16(pkt) 49 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name) 50 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname, 51 strlen(s->ext.hostname)) 52 || !WPACKET_close(pkt) 53 || !WPACKET_close(pkt)) { 54 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, 55 ERR_R_INTERNAL_ERROR); 56 return EXT_RETURN_FAIL; 57 } 58 59 return EXT_RETURN_SENT; 60 } 61 62 /* Push a Max Fragment Len extension into ClientHello */ 63 EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, 64 unsigned int context, X509 *x, 65 size_t chainidx) 66 { 67 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED) 68 return EXT_RETURN_NOT_SENT; 69 70 /* Add Max Fragment Length extension if client enabled it. */ 71 /*- 72 * 4 bytes for this extension type and extension length 73 * 1 byte for the Max Fragment Length code value. 74 */ 75 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) 76 /* Sub-packet for Max Fragment Length extension (1 byte) */ 77 || !WPACKET_start_sub_packet_u16(pkt) 78 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode) 79 || !WPACKET_close(pkt)) { 80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 81 SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR); 82 return EXT_RETURN_FAIL; 83 } 84 85 return EXT_RETURN_SENT; 86 } 87 88 #ifndef OPENSSL_NO_SRP 89 EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, 90 X509 *x, size_t chainidx) 91 { 92 /* Add SRP username if there is one */ 93 if (s->srp_ctx.login == NULL) 94 return EXT_RETURN_NOT_SENT; 95 96 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp) 97 /* Sub-packet for SRP extension */ 98 || !WPACKET_start_sub_packet_u16(pkt) 99 || !WPACKET_start_sub_packet_u8(pkt) 100 /* login must not be zero...internal error if so */ 101 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) 102 || !WPACKET_memcpy(pkt, s->srp_ctx.login, 103 strlen(s->srp_ctx.login)) 104 || !WPACKET_close(pkt) 105 || !WPACKET_close(pkt)) { 106 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP, 107 ERR_R_INTERNAL_ERROR); 108 return EXT_RETURN_FAIL; 109 } 110 111 return EXT_RETURN_SENT; 112 } 113 #endif 114 115 #ifndef OPENSSL_NO_EC 116 static int use_ecc(SSL *s) 117 { 118 int i, end, ret = 0; 119 unsigned long alg_k, alg_a; 120 STACK_OF(SSL_CIPHER) *cipher_stack = NULL; 121 122 /* See if we support any ECC ciphersuites */ 123 if (s->version == SSL3_VERSION) 124 return 0; 125 126 cipher_stack = SSL_get1_supported_ciphers(s); 127 end = sk_SSL_CIPHER_num(cipher_stack); 128 for (i = 0; i < end; i++) { 129 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); 130 131 alg_k = c->algorithm_mkey; 132 alg_a = c->algorithm_auth; 133 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) 134 || (alg_a & SSL_aECDSA) 135 || c->min_tls >= TLS1_3_VERSION) { 136 ret = 1; 137 break; 138 } 139 } 140 141 sk_SSL_CIPHER_free(cipher_stack); 142 return ret; 143 } 144 145 EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, 146 unsigned int context, X509 *x, 147 size_t chainidx) 148 { 149 const unsigned char *pformats; 150 size_t num_formats; 151 152 if (!use_ecc(s)) 153 return EXT_RETURN_NOT_SENT; 154 155 /* Add TLS extension ECPointFormats to the ClientHello message */ 156 tls1_get_formatlist(s, &pformats, &num_formats); 157 158 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) 159 /* Sub-packet for formats extension */ 160 || !WPACKET_start_sub_packet_u16(pkt) 161 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats) 162 || !WPACKET_close(pkt)) { 163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 164 SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 165 return EXT_RETURN_FAIL; 166 } 167 168 return EXT_RETURN_SENT; 169 } 170 171 EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, 172 unsigned int context, X509 *x, 173 size_t chainidx) 174 { 175 const uint16_t *pgroups = NULL; 176 size_t num_groups = 0, i; 177 178 if (!use_ecc(s)) 179 return EXT_RETURN_NOT_SENT; 180 181 /* 182 * Add TLS extension supported_groups to the ClientHello message 183 */ 184 /* TODO(TLS1.3): Add support for DHE groups */ 185 tls1_get_supported_groups(s, &pgroups, &num_groups); 186 187 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) 188 /* Sub-packet for supported_groups extension */ 189 || !WPACKET_start_sub_packet_u16(pkt) 190 || !WPACKET_start_sub_packet_u16(pkt)) { 191 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 192 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 193 ERR_R_INTERNAL_ERROR); 194 return EXT_RETURN_FAIL; 195 } 196 /* Copy curve ID if supported */ 197 for (i = 0; i < num_groups; i++) { 198 uint16_t ctmp = pgroups[i]; 199 200 if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) { 201 if (!WPACKET_put_bytes_u16(pkt, ctmp)) { 202 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 203 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 204 ERR_R_INTERNAL_ERROR); 205 return EXT_RETURN_FAIL; 206 } 207 } 208 } 209 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 210 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 211 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 212 ERR_R_INTERNAL_ERROR); 213 return EXT_RETURN_FAIL; 214 } 215 216 return EXT_RETURN_SENT; 217 } 218 #endif 219 220 EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, 221 unsigned int context, X509 *x, 222 size_t chainidx) 223 { 224 size_t ticklen; 225 226 if (!tls_use_ticket(s)) 227 return EXT_RETURN_NOT_SENT; 228 229 if (!s->new_session && s->session != NULL 230 && s->session->ext.tick != NULL 231 && s->session->ssl_version != TLS1_3_VERSION) { 232 ticklen = s->session->ext.ticklen; 233 } else if (s->session && s->ext.session_ticket != NULL 234 && s->ext.session_ticket->data != NULL) { 235 ticklen = s->ext.session_ticket->length; 236 s->session->ext.tick = OPENSSL_malloc(ticklen); 237 if (s->session->ext.tick == NULL) { 238 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 239 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, 240 ERR_R_INTERNAL_ERROR); 241 return EXT_RETURN_FAIL; 242 } 243 memcpy(s->session->ext.tick, 244 s->ext.session_ticket->data, ticklen); 245 s->session->ext.ticklen = ticklen; 246 } else { 247 ticklen = 0; 248 } 249 250 if (ticklen == 0 && s->ext.session_ticket != NULL && 251 s->ext.session_ticket->data == NULL) 252 return EXT_RETURN_NOT_SENT; 253 254 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) 255 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) { 256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 257 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); 258 return EXT_RETURN_FAIL; 259 } 260 261 return EXT_RETURN_SENT; 262 } 263 264 EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, 265 unsigned int context, X509 *x, 266 size_t chainidx) 267 { 268 size_t salglen; 269 const uint16_t *salg; 270 271 if (!SSL_CLIENT_USE_SIGALGS(s)) 272 return EXT_RETURN_NOT_SENT; 273 274 salglen = tls12_get_psigalgs(s, 1, &salg); 275 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms) 276 /* Sub-packet for sig-algs extension */ 277 || !WPACKET_start_sub_packet_u16(pkt) 278 /* Sub-packet for the actual list */ 279 || !WPACKET_start_sub_packet_u16(pkt) 280 || !tls12_copy_sigalgs(s, pkt, salg, salglen) 281 || !WPACKET_close(pkt) 282 || !WPACKET_close(pkt)) { 283 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, 284 ERR_R_INTERNAL_ERROR); 285 return EXT_RETURN_FAIL; 286 } 287 288 return EXT_RETURN_SENT; 289 } 290 291 #ifndef OPENSSL_NO_OCSP 292 EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, 293 unsigned int context, X509 *x, 294 size_t chainidx) 295 { 296 int i; 297 298 /* This extension isn't defined for client Certificates */ 299 if (x != NULL) 300 return EXT_RETURN_NOT_SENT; 301 302 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) 303 return EXT_RETURN_NOT_SENT; 304 305 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) 306 /* Sub-packet for status request extension */ 307 || !WPACKET_start_sub_packet_u16(pkt) 308 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp) 309 /* Sub-packet for the ids */ 310 || !WPACKET_start_sub_packet_u16(pkt)) { 311 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 312 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 313 return EXT_RETURN_FAIL; 314 } 315 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) { 316 unsigned char *idbytes; 317 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i); 318 int idlen = i2d_OCSP_RESPID(id, NULL); 319 320 if (idlen <= 0 321 /* Sub-packet for an individual id */ 322 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes) 323 || i2d_OCSP_RESPID(id, &idbytes) != idlen) { 324 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 325 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 326 ERR_R_INTERNAL_ERROR); 327 return EXT_RETURN_FAIL; 328 } 329 } 330 if (!WPACKET_close(pkt) 331 || !WPACKET_start_sub_packet_u16(pkt)) { 332 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 333 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 334 return EXT_RETURN_FAIL; 335 } 336 if (s->ext.ocsp.exts) { 337 unsigned char *extbytes; 338 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL); 339 340 if (extlen < 0) { 341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 342 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 343 ERR_R_INTERNAL_ERROR); 344 return EXT_RETURN_FAIL; 345 } 346 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes) 347 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes) 348 != extlen) { 349 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 350 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 351 ERR_R_INTERNAL_ERROR); 352 return EXT_RETURN_FAIL; 353 } 354 } 355 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 356 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 357 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 358 return EXT_RETURN_FAIL; 359 } 360 361 return EXT_RETURN_SENT; 362 } 363 #endif 364 365 #ifndef OPENSSL_NO_NEXTPROTONEG 366 EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, 367 X509 *x, size_t chainidx) 368 { 369 if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 370 return EXT_RETURN_NOT_SENT; 371 372 /* 373 * The client advertises an empty extension to indicate its support 374 * for Next Protocol Negotiation 375 */ 376 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) 377 || !WPACKET_put_bytes_u16(pkt, 0)) { 378 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN, 379 ERR_R_INTERNAL_ERROR); 380 return EXT_RETURN_FAIL; 381 } 382 383 return EXT_RETURN_SENT; 384 } 385 #endif 386 387 EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, 388 X509 *x, size_t chainidx) 389 { 390 s->s3->alpn_sent = 0; 391 392 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 393 return EXT_RETURN_NOT_SENT; 394 395 if (!WPACKET_put_bytes_u16(pkt, 396 TLSEXT_TYPE_application_layer_protocol_negotiation) 397 /* Sub-packet ALPN extension */ 398 || !WPACKET_start_sub_packet_u16(pkt) 399 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len) 400 || !WPACKET_close(pkt)) { 401 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, 402 ERR_R_INTERNAL_ERROR); 403 return EXT_RETURN_FAIL; 404 } 405 s->s3->alpn_sent = 1; 406 407 return EXT_RETURN_SENT; 408 } 409 410 411 #ifndef OPENSSL_NO_SRTP 412 EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, 413 unsigned int context, X509 *x, 414 size_t chainidx) 415 { 416 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s); 417 int i, end; 418 419 if (clnt == NULL) 420 return EXT_RETURN_NOT_SENT; 421 422 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) 423 /* Sub-packet for SRTP extension */ 424 || !WPACKET_start_sub_packet_u16(pkt) 425 /* Sub-packet for the protection profile list */ 426 || !WPACKET_start_sub_packet_u16(pkt)) { 427 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 428 ERR_R_INTERNAL_ERROR); 429 return EXT_RETURN_FAIL; 430 } 431 432 end = sk_SRTP_PROTECTION_PROFILE_num(clnt); 433 for (i = 0; i < end; i++) { 434 const SRTP_PROTECTION_PROFILE *prof = 435 sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 436 437 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) { 438 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 439 SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); 440 return EXT_RETURN_FAIL; 441 } 442 } 443 if (!WPACKET_close(pkt) 444 /* Add an empty use_mki value */ 445 || !WPACKET_put_bytes_u8(pkt, 0) 446 || !WPACKET_close(pkt)) { 447 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 448 ERR_R_INTERNAL_ERROR); 449 return EXT_RETURN_FAIL; 450 } 451 452 return EXT_RETURN_SENT; 453 } 454 #endif 455 456 EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, 457 X509 *x, size_t chainidx) 458 { 459 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 460 return EXT_RETURN_NOT_SENT; 461 462 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) 463 || !WPACKET_put_bytes_u16(pkt, 0)) { 464 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM, 465 ERR_R_INTERNAL_ERROR); 466 return EXT_RETURN_FAIL; 467 } 468 469 return EXT_RETURN_SENT; 470 } 471 472 #ifndef OPENSSL_NO_CT 473 EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, 474 X509 *x, size_t chainidx) 475 { 476 if (s->ct_validation_callback == NULL) 477 return EXT_RETURN_NOT_SENT; 478 479 /* Not defined for client Certificates */ 480 if (x != NULL) 481 return EXT_RETURN_NOT_SENT; 482 483 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp) 484 || !WPACKET_put_bytes_u16(pkt, 0)) { 485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT, 486 ERR_R_INTERNAL_ERROR); 487 return EXT_RETURN_FAIL; 488 } 489 490 return EXT_RETURN_SENT; 491 } 492 #endif 493 494 EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, 495 X509 *x, size_t chainidx) 496 { 497 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) 498 || !WPACKET_put_bytes_u16(pkt, 0)) { 499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS, 500 ERR_R_INTERNAL_ERROR); 501 return EXT_RETURN_FAIL; 502 } 503 504 return EXT_RETURN_SENT; 505 } 506 507 EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, 508 unsigned int context, X509 *x, 509 size_t chainidx) 510 { 511 int currv, min_version, max_version, reason; 512 513 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); 514 if (reason != 0) { 515 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 516 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); 517 return EXT_RETURN_FAIL; 518 } 519 520 /* 521 * Don't include this if we can't negotiate TLSv1.3. We can do a straight 522 * comparison here because we will never be called in DTLS. 523 */ 524 if (max_version < TLS1_3_VERSION) 525 return EXT_RETURN_NOT_SENT; 526 527 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) 528 || !WPACKET_start_sub_packet_u16(pkt) 529 || !WPACKET_start_sub_packet_u8(pkt)) { 530 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 531 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 532 ERR_R_INTERNAL_ERROR); 533 return EXT_RETURN_FAIL; 534 } 535 536 for (currv = max_version; currv >= min_version; currv--) { 537 if (!WPACKET_put_bytes_u16(pkt, currv)) { 538 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 539 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 540 ERR_R_INTERNAL_ERROR); 541 return EXT_RETURN_FAIL; 542 } 543 } 544 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 545 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 546 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 547 ERR_R_INTERNAL_ERROR); 548 return EXT_RETURN_FAIL; 549 } 550 551 return EXT_RETURN_SENT; 552 } 553 554 /* 555 * Construct a psk_kex_modes extension. 556 */ 557 EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, 558 unsigned int context, X509 *x, 559 size_t chainidx) 560 { 561 #ifndef OPENSSL_NO_TLS1_3 562 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX; 563 564 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes) 565 || !WPACKET_start_sub_packet_u16(pkt) 566 || !WPACKET_start_sub_packet_u8(pkt) 567 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE) 568 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE)) 569 || !WPACKET_close(pkt) 570 || !WPACKET_close(pkt)) { 571 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 572 SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR); 573 return EXT_RETURN_FAIL; 574 } 575 576 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE; 577 if (nodhe) 578 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; 579 #endif 580 581 return EXT_RETURN_SENT; 582 } 583 584 #ifndef OPENSSL_NO_TLS1_3 585 static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id) 586 { 587 unsigned char *encoded_point = NULL; 588 EVP_PKEY *key_share_key = NULL; 589 size_t encodedlen; 590 591 if (s->s3->tmp.pkey != NULL) { 592 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) { 593 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 594 ERR_R_INTERNAL_ERROR); 595 return 0; 596 } 597 /* 598 * Could happen if we got an HRR that wasn't requesting a new key_share 599 */ 600 key_share_key = s->s3->tmp.pkey; 601 } else { 602 key_share_key = ssl_generate_pkey_group(s, curve_id); 603 if (key_share_key == NULL) { 604 /* SSLfatal() already called */ 605 return 0; 606 } 607 } 608 609 /* Encode the public key. */ 610 encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key, 611 &encoded_point); 612 if (encodedlen == 0) { 613 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB); 614 goto err; 615 } 616 617 /* Create KeyShareEntry */ 618 if (!WPACKET_put_bytes_u16(pkt, curve_id) 619 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) { 620 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 621 ERR_R_INTERNAL_ERROR); 622 goto err; 623 } 624 625 /* 626 * TODO(TLS1.3): When changing to send more than one key_share we're 627 * going to need to be able to save more than one EVP_PKEY. For now 628 * we reuse the existing tmp.pkey 629 */ 630 s->s3->tmp.pkey = key_share_key; 631 s->s3->group_id = curve_id; 632 OPENSSL_free(encoded_point); 633 634 return 1; 635 err: 636 if (s->s3->tmp.pkey == NULL) 637 EVP_PKEY_free(key_share_key); 638 OPENSSL_free(encoded_point); 639 return 0; 640 } 641 #endif 642 643 EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, 644 unsigned int context, X509 *x, 645 size_t chainidx) 646 { 647 #ifndef OPENSSL_NO_TLS1_3 648 size_t i, num_groups = 0; 649 const uint16_t *pgroups = NULL; 650 uint16_t curve_id = 0; 651 652 /* key_share extension */ 653 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 654 /* Extension data sub-packet */ 655 || !WPACKET_start_sub_packet_u16(pkt) 656 /* KeyShare list sub-packet */ 657 || !WPACKET_start_sub_packet_u16(pkt)) { 658 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 659 ERR_R_INTERNAL_ERROR); 660 return EXT_RETURN_FAIL; 661 } 662 663 tls1_get_supported_groups(s, &pgroups, &num_groups); 664 665 /* 666 * TODO(TLS1.3): Make the number of key_shares sent configurable. For 667 * now, just send one 668 */ 669 if (s->s3->group_id != 0) { 670 curve_id = s->s3->group_id; 671 } else { 672 for (i = 0; i < num_groups; i++) { 673 674 if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED)) 675 continue; 676 677 curve_id = pgroups[i]; 678 break; 679 } 680 } 681 682 if (curve_id == 0) { 683 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 684 SSL_R_NO_SUITABLE_KEY_SHARE); 685 return EXT_RETURN_FAIL; 686 } 687 688 if (!add_key_share(s, pkt, curve_id)) { 689 /* SSLfatal() already called */ 690 return EXT_RETURN_FAIL; 691 } 692 693 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 694 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 695 ERR_R_INTERNAL_ERROR); 696 return EXT_RETURN_FAIL; 697 } 698 return EXT_RETURN_SENT; 699 #else 700 return EXT_RETURN_NOT_SENT; 701 #endif 702 } 703 704 EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, 705 X509 *x, size_t chainidx) 706 { 707 EXT_RETURN ret = EXT_RETURN_FAIL; 708 709 /* Should only be set if we've had an HRR */ 710 if (s->ext.tls13_cookie_len == 0) 711 return EXT_RETURN_NOT_SENT; 712 713 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) 714 /* Extension data sub-packet */ 715 || !WPACKET_start_sub_packet_u16(pkt) 716 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie, 717 s->ext.tls13_cookie_len) 718 || !WPACKET_close(pkt)) { 719 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, 720 ERR_R_INTERNAL_ERROR); 721 goto end; 722 } 723 724 ret = EXT_RETURN_SENT; 725 end: 726 OPENSSL_free(s->ext.tls13_cookie); 727 s->ext.tls13_cookie = NULL; 728 s->ext.tls13_cookie_len = 0; 729 730 return ret; 731 } 732 733 EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, 734 unsigned int context, X509 *x, 735 size_t chainidx) 736 { 737 #ifndef OPENSSL_NO_PSK 738 char identity[PSK_MAX_IDENTITY_LEN + 1]; 739 #endif /* OPENSSL_NO_PSK */ 740 const unsigned char *id = NULL; 741 size_t idlen = 0; 742 SSL_SESSION *psksess = NULL; 743 SSL_SESSION *edsess = NULL; 744 const EVP_MD *handmd = NULL; 745 746 if (s->hello_retry_request == SSL_HRR_PENDING) 747 handmd = ssl_handshake_md(s); 748 749 if (s->psk_use_session_cb != NULL 750 && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess) 751 || (psksess != NULL 752 && psksess->ssl_version != TLS1_3_VERSION))) { 753 SSL_SESSION_free(psksess); 754 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 755 SSL_R_BAD_PSK); 756 return EXT_RETURN_FAIL; 757 } 758 759 #ifndef OPENSSL_NO_PSK 760 if (psksess == NULL && s->psk_client_callback != NULL) { 761 unsigned char psk[PSK_MAX_PSK_LEN]; 762 size_t psklen = 0; 763 764 memset(identity, 0, sizeof(identity)); 765 psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, 766 psk, sizeof(psk)); 767 768 if (psklen > PSK_MAX_PSK_LEN) { 769 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 770 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 771 return EXT_RETURN_FAIL; 772 } else if (psklen > 0) { 773 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; 774 const SSL_CIPHER *cipher; 775 776 idlen = strlen(identity); 777 if (idlen > PSK_MAX_IDENTITY_LEN) { 778 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 779 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 780 ERR_R_INTERNAL_ERROR); 781 return EXT_RETURN_FAIL; 782 } 783 id = (unsigned char *)identity; 784 785 /* 786 * We found a PSK using an old style callback. We don't know 787 * the digest so we default to SHA256 as per the TLSv1.3 spec 788 */ 789 cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); 790 if (cipher == NULL) { 791 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 792 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 793 ERR_R_INTERNAL_ERROR); 794 return EXT_RETURN_FAIL; 795 } 796 797 psksess = SSL_SESSION_new(); 798 if (psksess == NULL 799 || !SSL_SESSION_set1_master_key(psksess, psk, psklen) 800 || !SSL_SESSION_set_cipher(psksess, cipher) 801 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { 802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 803 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 804 ERR_R_INTERNAL_ERROR); 805 OPENSSL_cleanse(psk, psklen); 806 return EXT_RETURN_FAIL; 807 } 808 OPENSSL_cleanse(psk, psklen); 809 } 810 } 811 #endif /* OPENSSL_NO_PSK */ 812 813 SSL_SESSION_free(s->psksession); 814 s->psksession = psksess; 815 if (psksess != NULL) { 816 OPENSSL_free(s->psksession_id); 817 s->psksession_id = OPENSSL_memdup(id, idlen); 818 if (s->psksession_id == NULL) { 819 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 820 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 821 return EXT_RETURN_FAIL; 822 } 823 s->psksession_id_len = idlen; 824 } 825 826 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING 827 || (s->session->ext.max_early_data == 0 828 && (psksess == NULL || psksess->ext.max_early_data == 0))) { 829 s->max_early_data = 0; 830 return EXT_RETURN_NOT_SENT; 831 } 832 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess; 833 s->max_early_data = edsess->ext.max_early_data; 834 835 if (edsess->ext.hostname != NULL) { 836 if (s->ext.hostname == NULL 837 || (s->ext.hostname != NULL 838 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) { 839 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 840 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 841 SSL_R_INCONSISTENT_EARLY_DATA_SNI); 842 return EXT_RETURN_FAIL; 843 } 844 } 845 846 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) { 847 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 848 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 849 return EXT_RETURN_FAIL; 850 } 851 852 /* 853 * Verify that we are offering an ALPN protocol consistent with the early 854 * data. 855 */ 856 if (edsess->ext.alpn_selected != NULL) { 857 PACKET prots, alpnpkt; 858 int found = 0; 859 860 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) { 861 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 862 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 863 return EXT_RETURN_FAIL; 864 } 865 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) { 866 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected, 867 edsess->ext.alpn_selected_len)) { 868 found = 1; 869 break; 870 } 871 } 872 if (!found) { 873 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 874 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 875 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 876 return EXT_RETURN_FAIL; 877 } 878 } 879 880 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 881 || !WPACKET_start_sub_packet_u16(pkt) 882 || !WPACKET_close(pkt)) { 883 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 884 ERR_R_INTERNAL_ERROR); 885 return EXT_RETURN_FAIL; 886 } 887 888 /* 889 * We set this to rejected here. Later, if the server acknowledges the 890 * extension, we set it to accepted. 891 */ 892 s->ext.early_data = SSL_EARLY_DATA_REJECTED; 893 s->ext.early_data_ok = 1; 894 895 return EXT_RETURN_SENT; 896 } 897 898 #define F5_WORKAROUND_MIN_MSG_LEN 0xff 899 #define F5_WORKAROUND_MAX_MSG_LEN 0x200 900 901 /* 902 * PSK pre binder overhead = 903 * 2 bytes for TLSEXT_TYPE_psk 904 * 2 bytes for extension length 905 * 2 bytes for identities list length 906 * 2 bytes for identity length 907 * 4 bytes for obfuscated_ticket_age 908 * 2 bytes for binder list length 909 * 1 byte for binder length 910 * The above excludes the number of bytes for the identity itself and the 911 * subsequent binder bytes 912 */ 913 #define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1) 914 915 EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt, 916 unsigned int context, X509 *x, 917 size_t chainidx) 918 { 919 unsigned char *padbytes; 920 size_t hlen; 921 922 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0) 923 return EXT_RETURN_NOT_SENT; 924 925 /* 926 * Add padding to workaround bugs in F5 terminators. See RFC7685. 927 * This code calculates the length of all extensions added so far but 928 * excludes the PSK extension (because that MUST be written last). Therefore 929 * this extension MUST always appear second to last. 930 */ 931 if (!WPACKET_get_total_written(pkt, &hlen)) { 932 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 933 ERR_R_INTERNAL_ERROR); 934 return EXT_RETURN_FAIL; 935 } 936 937 /* 938 * If we're going to send a PSK then that will be written out after this 939 * extension, so we need to calculate how long it is going to be. 940 */ 941 if (s->session->ssl_version == TLS1_3_VERSION 942 && s->session->ext.ticklen != 0 943 && s->session->cipher != NULL) { 944 const EVP_MD *md = ssl_md(s->session->cipher->algorithm2); 945 946 if (md != NULL) { 947 /* 948 * Add the fixed PSK overhead, the identity length and the binder 949 * length. 950 */ 951 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen 952 + EVP_MD_size(md); 953 } 954 } 955 956 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) { 957 /* Calculate the amount of padding we need to add */ 958 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen; 959 960 /* 961 * Take off the size of extension header itself (2 bytes for type and 962 * 2 bytes for length bytes), but ensure that the extension is at least 963 * 1 byte long so as not to have an empty extension last (WebSphere 7.x, 964 * 8.x are intolerant of that condition) 965 */ 966 if (hlen > 4) 967 hlen -= 4; 968 else 969 hlen = 1; 970 971 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding) 972 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) { 973 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 974 ERR_R_INTERNAL_ERROR); 975 return EXT_RETURN_FAIL; 976 } 977 memset(padbytes, 0, hlen); 978 } 979 980 return EXT_RETURN_SENT; 981 } 982 983 /* 984 * Construct the pre_shared_key extension 985 */ 986 EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, 987 X509 *x, size_t chainidx) 988 { 989 #ifndef OPENSSL_NO_TLS1_3 990 uint32_t now, agesec, agems = 0; 991 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen; 992 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL; 993 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL; 994 int dores = 0; 995 996 s->session->ext.tick_identity = TLSEXT_PSK_BAD_IDENTITY; 997 998 /* 999 * Note: At this stage of the code we only support adding a single 1000 * resumption PSK. If we add support for multiple PSKs then the length 1001 * calculations in the padding extension will need to be adjusted. 1002 */ 1003 1004 /* 1005 * If this is an incompatible or new session then we have nothing to resume 1006 * so don't add this extension. 1007 */ 1008 if (s->session->ssl_version != TLS1_3_VERSION 1009 || (s->session->ext.ticklen == 0 && s->psksession == NULL)) 1010 return EXT_RETURN_NOT_SENT; 1011 1012 if (s->hello_retry_request == SSL_HRR_PENDING) 1013 handmd = ssl_handshake_md(s); 1014 1015 if (s->session->ext.ticklen != 0) { 1016 /* Get the digest associated with the ciphersuite in the session */ 1017 if (s->session->cipher == NULL) { 1018 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1019 ERR_R_INTERNAL_ERROR); 1020 return EXT_RETURN_FAIL; 1021 } 1022 mdres = ssl_md(s->session->cipher->algorithm2); 1023 if (mdres == NULL) { 1024 /* 1025 * Don't recognize this cipher so we can't use the session. 1026 * Ignore it 1027 */ 1028 goto dopsksess; 1029 } 1030 1031 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) { 1032 /* 1033 * Selected ciphersuite hash does not match the hash for the session 1034 * so we can't use it. 1035 */ 1036 goto dopsksess; 1037 } 1038 1039 /* 1040 * Technically the C standard just says time() returns a time_t and says 1041 * nothing about the encoding of that type. In practice most 1042 * implementations follow POSIX which holds it as an integral type in 1043 * seconds since epoch. We've already made the assumption that we can do 1044 * this in multiple places in the code, so portability shouldn't be an 1045 * issue. 1046 */ 1047 now = (uint32_t)time(NULL); 1048 agesec = now - (uint32_t)s->session->time; 1049 /* 1050 * We calculate the age in seconds but the server may work in ms. Due to 1051 * rounding errors we could overestimate the age by up to 1s. It is 1052 * better to underestimate it. Otherwise, if the RTT is very short, when 1053 * the server calculates the age reported by the client it could be 1054 * bigger than the age calculated on the server - which should never 1055 * happen. 1056 */ 1057 if (agesec > 0) 1058 agesec--; 1059 1060 if (s->session->ext.tick_lifetime_hint < agesec) { 1061 /* Ticket is too old. Ignore it. */ 1062 goto dopsksess; 1063 } 1064 1065 /* 1066 * Calculate age in ms. We're just doing it to nearest second. Should be 1067 * good enough. 1068 */ 1069 agems = agesec * (uint32_t)1000; 1070 1071 if (agesec != 0 && agems / (uint32_t)1000 != agesec) { 1072 /* 1073 * Overflow. Shouldn't happen unless this is a *really* old session. 1074 * If so we just ignore it. 1075 */ 1076 goto dopsksess; 1077 } 1078 1079 /* 1080 * Obfuscate the age. Overflow here is fine, this addition is supposed 1081 * to be mod 2^32. 1082 */ 1083 agems += s->session->ext.tick_age_add; 1084 1085 reshashsize = EVP_MD_size(mdres); 1086 dores = 1; 1087 } 1088 1089 dopsksess: 1090 if (!dores && s->psksession == NULL) 1091 return EXT_RETURN_NOT_SENT; 1092 1093 if (s->psksession != NULL) { 1094 mdpsk = ssl_md(s->psksession->cipher->algorithm2); 1095 if (mdpsk == NULL) { 1096 /* 1097 * Don't recognize this cipher so we can't use the session. 1098 * If this happens it's an application bug. 1099 */ 1100 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1101 SSL_R_BAD_PSK); 1102 return EXT_RETURN_FAIL; 1103 } 1104 1105 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) { 1106 /* 1107 * Selected ciphersuite hash does not match the hash for the PSK 1108 * session. This is an application bug. 1109 */ 1110 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1111 SSL_R_BAD_PSK); 1112 return EXT_RETURN_FAIL; 1113 } 1114 1115 pskhashsize = EVP_MD_size(mdpsk); 1116 } 1117 1118 /* Create the extension, but skip over the binder for now */ 1119 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) 1120 || !WPACKET_start_sub_packet_u16(pkt) 1121 || !WPACKET_start_sub_packet_u16(pkt)) { 1122 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1123 ERR_R_INTERNAL_ERROR); 1124 return EXT_RETURN_FAIL; 1125 } 1126 1127 if (dores) { 1128 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, 1129 s->session->ext.ticklen) 1130 || !WPACKET_put_bytes_u32(pkt, agems)) { 1131 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1132 ERR_R_INTERNAL_ERROR); 1133 return EXT_RETURN_FAIL; 1134 } 1135 } 1136 1137 if (s->psksession != NULL) { 1138 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id, 1139 s->psksession_id_len) 1140 || !WPACKET_put_bytes_u32(pkt, 0)) { 1141 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1142 ERR_R_INTERNAL_ERROR); 1143 return EXT_RETURN_FAIL; 1144 } 1145 } 1146 1147 if (!WPACKET_close(pkt) 1148 || !WPACKET_get_total_written(pkt, &binderoffset) 1149 || !WPACKET_start_sub_packet_u16(pkt) 1150 || (dores 1151 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder)) 1152 || (s->psksession != NULL 1153 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder)) 1154 || !WPACKET_close(pkt) 1155 || !WPACKET_close(pkt) 1156 || !WPACKET_get_total_written(pkt, &msglen) 1157 /* 1158 * We need to fill in all the sub-packet lengths now so we can 1159 * calculate the HMAC of the message up to the binders 1160 */ 1161 || !WPACKET_fill_lengths(pkt)) { 1162 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1163 ERR_R_INTERNAL_ERROR); 1164 return EXT_RETURN_FAIL; 1165 } 1166 1167 msgstart = WPACKET_get_curr(pkt) - msglen; 1168 1169 if (dores 1170 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL, 1171 resbinder, s->session, 1, 0) != 1) { 1172 /* SSLfatal() already called */ 1173 return EXT_RETURN_FAIL; 1174 } 1175 1176 if (s->psksession != NULL 1177 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL, 1178 pskbinder, s->psksession, 1, 1) != 1) { 1179 /* SSLfatal() already called */ 1180 return EXT_RETURN_FAIL; 1181 } 1182 1183 if (dores) 1184 s->session->ext.tick_identity = 0; 1185 if (s->psksession != NULL) 1186 s->psksession->ext.tick_identity = (dores ? 1 : 0); 1187 1188 return EXT_RETURN_SENT; 1189 #else 1190 return EXT_RETURN_NOT_SENT; 1191 #endif 1192 } 1193 1194 EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, 1195 unsigned int context, 1196 X509 *x, size_t chainidx) 1197 { 1198 #ifndef OPENSSL_NO_TLS1_3 1199 if (!s->pha_enabled) 1200 return EXT_RETURN_NOT_SENT; 1201 1202 /* construct extension - 0 length, no contents */ 1203 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) 1204 || !WPACKET_start_sub_packet_u16(pkt) 1205 || !WPACKET_close(pkt)) { 1206 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1207 SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, 1208 ERR_R_INTERNAL_ERROR); 1209 return EXT_RETURN_FAIL; 1210 } 1211 1212 s->post_handshake_auth = SSL_PHA_EXT_SENT; 1213 1214 return EXT_RETURN_SENT; 1215 #else 1216 return EXT_RETURN_NOT_SENT; 1217 #endif 1218 } 1219 1220 1221 /* 1222 * Parse the server's renegotiation binding and abort if it's not right 1223 */ 1224 int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context, 1225 X509 *x, size_t chainidx) 1226 { 1227 size_t expected_len = s->s3->previous_client_finished_len 1228 + s->s3->previous_server_finished_len; 1229 size_t ilen; 1230 const unsigned char *data; 1231 1232 /* Check for logic errors */ 1233 if (!ossl_assert(expected_len == 0 1234 || s->s3->previous_client_finished_len != 0) 1235 || !ossl_assert(expected_len == 0 1236 || s->s3->previous_server_finished_len != 0)) { 1237 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1238 ERR_R_INTERNAL_ERROR); 1239 return 0; 1240 } 1241 1242 /* Parse the length byte */ 1243 if (!PACKET_get_1_len(pkt, &ilen)) { 1244 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1245 SSL_R_RENEGOTIATION_ENCODING_ERR); 1246 return 0; 1247 } 1248 1249 /* Consistency check */ 1250 if (PACKET_remaining(pkt) != ilen) { 1251 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1252 SSL_R_RENEGOTIATION_ENCODING_ERR); 1253 return 0; 1254 } 1255 1256 /* Check that the extension matches */ 1257 if (ilen != expected_len) { 1258 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1259 SSL_R_RENEGOTIATION_MISMATCH); 1260 return 0; 1261 } 1262 1263 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len) 1264 || memcmp(data, s->s3->previous_client_finished, 1265 s->s3->previous_client_finished_len) != 0) { 1266 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1267 SSL_R_RENEGOTIATION_MISMATCH); 1268 return 0; 1269 } 1270 1271 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len) 1272 || memcmp(data, s->s3->previous_server_finished, 1273 s->s3->previous_server_finished_len) != 0) { 1274 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1275 SSL_R_RENEGOTIATION_MISMATCH); 1276 return 0; 1277 } 1278 s->s3->send_connection_binding = 1; 1279 1280 return 1; 1281 } 1282 1283 /* Parse the server's max fragment len extension packet */ 1284 int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context, 1285 X509 *x, size_t chainidx) 1286 { 1287 unsigned int value; 1288 1289 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { 1290 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1291 SSL_R_BAD_EXTENSION); 1292 return 0; 1293 } 1294 1295 /* |value| should contains a valid max-fragment-length code. */ 1296 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { 1297 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1298 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1299 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1300 return 0; 1301 } 1302 1303 /* Must be the same value as client-configured one who was sent to server */ 1304 /*- 1305 * RFC 6066: if a client receives a maximum fragment length negotiation 1306 * response that differs from the length it requested, ... 1307 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert 1308 */ 1309 if (value != s->ext.max_fragment_len_mode) { 1310 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1311 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1312 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1313 return 0; 1314 } 1315 1316 /* 1317 * Maximum Fragment Length Negotiation succeeded. 1318 * The negotiated Maximum Fragment Length is binding now. 1319 */ 1320 s->session->ext.max_fragment_len_mode = value; 1321 1322 return 1; 1323 } 1324 1325 int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context, 1326 X509 *x, size_t chainidx) 1327 { 1328 if (s->ext.hostname == NULL) { 1329 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1330 ERR_R_INTERNAL_ERROR); 1331 return 0; 1332 } 1333 1334 if (PACKET_remaining(pkt) > 0) { 1335 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1336 SSL_R_BAD_EXTENSION); 1337 return 0; 1338 } 1339 1340 if (!s->hit) { 1341 if (s->session->ext.hostname != NULL) { 1342 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1343 ERR_R_INTERNAL_ERROR); 1344 return 0; 1345 } 1346 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); 1347 if (s->session->ext.hostname == NULL) { 1348 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1349 ERR_R_INTERNAL_ERROR); 1350 return 0; 1351 } 1352 } 1353 1354 return 1; 1355 } 1356 1357 #ifndef OPENSSL_NO_EC 1358 int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, 1359 X509 *x, size_t chainidx) 1360 { 1361 size_t ecpointformats_len; 1362 PACKET ecptformatlist; 1363 1364 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) { 1365 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, 1366 SSL_R_BAD_EXTENSION); 1367 return 0; 1368 } 1369 if (!s->hit) { 1370 ecpointformats_len = PACKET_remaining(&ecptformatlist); 1371 if (ecpointformats_len == 0) { 1372 SSLfatal(s, SSL_AD_DECODE_ERROR, 1373 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_LENGTH); 1374 return 0; 1375 } 1376 1377 s->session->ext.ecpointformats_len = 0; 1378 OPENSSL_free(s->session->ext.ecpointformats); 1379 s->session->ext.ecpointformats = OPENSSL_malloc(ecpointformats_len); 1380 if (s->session->ext.ecpointformats == NULL) { 1381 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1382 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1383 return 0; 1384 } 1385 1386 s->session->ext.ecpointformats_len = ecpointformats_len; 1387 1388 if (!PACKET_copy_bytes(&ecptformatlist, 1389 s->session->ext.ecpointformats, 1390 ecpointformats_len)) { 1391 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1392 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1393 return 0; 1394 } 1395 } 1396 1397 return 1; 1398 } 1399 #endif 1400 1401 int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, 1402 X509 *x, size_t chainidx) 1403 { 1404 if (s->ext.session_ticket_cb != NULL && 1405 !s->ext.session_ticket_cb(s, PACKET_data(pkt), 1406 PACKET_remaining(pkt), 1407 s->ext.session_ticket_cb_arg)) { 1408 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 1409 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1410 return 0; 1411 } 1412 1413 if (!tls_use_ticket(s)) { 1414 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1415 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1416 return 0; 1417 } 1418 if (PACKET_remaining(pkt) > 0) { 1419 SSLfatal(s, SSL_AD_DECODE_ERROR, 1420 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1421 return 0; 1422 } 1423 1424 s->ext.ticket_expected = 1; 1425 1426 return 1; 1427 } 1428 1429 #ifndef OPENSSL_NO_OCSP 1430 int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, 1431 X509 *x, size_t chainidx) 1432 { 1433 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1434 /* We ignore this if the server sends a CertificateRequest */ 1435 /* TODO(TLS1.3): Add support for this */ 1436 return 1; 1437 } 1438 1439 /* 1440 * MUST only be sent if we've requested a status 1441 * request message. In TLS <= 1.2 it must also be empty. 1442 */ 1443 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { 1444 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1445 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1446 return 0; 1447 } 1448 if (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0) { 1449 SSLfatal(s, SSL_AD_DECODE_ERROR, 1450 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1451 return 0; 1452 } 1453 1454 if (SSL_IS_TLS13(s)) { 1455 /* We only know how to handle this if it's for the first Certificate in 1456 * the chain. We ignore any other responses. 1457 */ 1458 if (chainidx != 0) 1459 return 1; 1460 1461 /* SSLfatal() already called */ 1462 return tls_process_cert_status_body(s, pkt); 1463 } 1464 1465 /* Set flag to expect CertificateStatus message */ 1466 s->ext.status_expected = 1; 1467 1468 return 1; 1469 } 1470 #endif 1471 1472 1473 #ifndef OPENSSL_NO_CT 1474 int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1475 size_t chainidx) 1476 { 1477 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1478 /* We ignore this if the server sends it in a CertificateRequest */ 1479 /* TODO(TLS1.3): Add support for this */ 1480 return 1; 1481 } 1482 1483 /* 1484 * Only take it if we asked for it - i.e if there is no CT validation 1485 * callback set, then a custom extension MAY be processing it, so we 1486 * need to let control continue to flow to that. 1487 */ 1488 if (s->ct_validation_callback != NULL) { 1489 size_t size = PACKET_remaining(pkt); 1490 1491 /* Simply copy it off for later processing */ 1492 OPENSSL_free(s->ext.scts); 1493 s->ext.scts = NULL; 1494 1495 s->ext.scts_len = (uint16_t)size; 1496 if (size > 0) { 1497 s->ext.scts = OPENSSL_malloc(size); 1498 if (s->ext.scts == NULL 1499 || !PACKET_copy_bytes(pkt, s->ext.scts, size)) { 1500 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1501 ERR_R_INTERNAL_ERROR); 1502 return 0; 1503 } 1504 } 1505 } else { 1506 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 1507 ? ENDPOINT_CLIENT : ENDPOINT_BOTH; 1508 1509 /* 1510 * If we didn't ask for it then there must be a custom extension, 1511 * otherwise this is unsolicited. 1512 */ 1513 if (custom_ext_find(&s->cert->custext, role, 1514 TLSEXT_TYPE_signed_certificate_timestamp, 1515 NULL) == NULL) { 1516 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SCT, 1517 SSL_R_BAD_EXTENSION); 1518 return 0; 1519 } 1520 1521 if (!custom_ext_parse(s, context, 1522 TLSEXT_TYPE_signed_certificate_timestamp, 1523 PACKET_data(pkt), PACKET_remaining(pkt), 1524 x, chainidx)) { 1525 /* SSLfatal already called */ 1526 return 0; 1527 } 1528 } 1529 1530 return 1; 1531 } 1532 #endif 1533 1534 1535 #ifndef OPENSSL_NO_NEXTPROTONEG 1536 /* 1537 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1538 * elements of zero length are allowed and the set of elements must exactly 1539 * fill the length of the block. Returns 1 on success or 0 on failure. 1540 */ 1541 static int ssl_next_proto_validate(SSL *s, PACKET *pkt) 1542 { 1543 PACKET tmp_protocol; 1544 1545 while (PACKET_remaining(pkt)) { 1546 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol) 1547 || PACKET_remaining(&tmp_protocol) == 0) { 1548 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_NEXT_PROTO_VALIDATE, 1549 SSL_R_BAD_EXTENSION); 1550 return 0; 1551 } 1552 } 1553 1554 return 1; 1555 } 1556 1557 int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1558 size_t chainidx) 1559 { 1560 unsigned char *selected; 1561 unsigned char selected_len; 1562 PACKET tmppkt; 1563 1564 /* Check if we are in a renegotiation. If so ignore this extension */ 1565 if (!SSL_IS_FIRST_HANDSHAKE(s)) 1566 return 1; 1567 1568 /* We must have requested it. */ 1569 if (s->ctx->ext.npn_select_cb == NULL) { 1570 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_NPN, 1571 SSL_R_BAD_EXTENSION); 1572 return 0; 1573 } 1574 1575 /* The data must be valid */ 1576 tmppkt = *pkt; 1577 if (!ssl_next_proto_validate(s, &tmppkt)) { 1578 /* SSLfatal() already called */ 1579 return 0; 1580 } 1581 if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len, 1582 PACKET_data(pkt), 1583 PACKET_remaining(pkt), 1584 s->ctx->ext.npn_select_cb_arg) != 1585 SSL_TLSEXT_ERR_OK) { 1586 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_NPN, 1587 SSL_R_BAD_EXTENSION); 1588 return 0; 1589 } 1590 1591 /* 1592 * Could be non-NULL if server has sent multiple NPN extensions in 1593 * a single Serverhello 1594 */ 1595 OPENSSL_free(s->ext.npn); 1596 s->ext.npn = OPENSSL_malloc(selected_len); 1597 if (s->ext.npn == NULL) { 1598 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_NPN, 1599 ERR_R_INTERNAL_ERROR); 1600 return 0; 1601 } 1602 1603 memcpy(s->ext.npn, selected, selected_len); 1604 s->ext.npn_len = selected_len; 1605 s->s3->npn_seen = 1; 1606 1607 return 1; 1608 } 1609 #endif 1610 1611 int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1612 size_t chainidx) 1613 { 1614 size_t len; 1615 1616 /* We must have requested it. */ 1617 if (!s->s3->alpn_sent) { 1618 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_ALPN, 1619 SSL_R_BAD_EXTENSION); 1620 return 0; 1621 } 1622 /*- 1623 * The extension data consists of: 1624 * uint16 list_length 1625 * uint8 proto_length; 1626 * uint8 proto[proto_length]; 1627 */ 1628 if (!PACKET_get_net_2_len(pkt, &len) 1629 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len) 1630 || PACKET_remaining(pkt) != len) { 1631 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1632 SSL_R_BAD_EXTENSION); 1633 return 0; 1634 } 1635 OPENSSL_free(s->s3->alpn_selected); 1636 s->s3->alpn_selected = OPENSSL_malloc(len); 1637 if (s->s3->alpn_selected == NULL) { 1638 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1639 ERR_R_INTERNAL_ERROR); 1640 return 0; 1641 } 1642 if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) { 1643 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1644 SSL_R_BAD_EXTENSION); 1645 return 0; 1646 } 1647 s->s3->alpn_selected_len = len; 1648 1649 if (s->session->ext.alpn_selected == NULL 1650 || s->session->ext.alpn_selected_len != len 1651 || memcmp(s->session->ext.alpn_selected, s->s3->alpn_selected, len) 1652 != 0) { 1653 /* ALPN not consistent with the old session so cannot use early_data */ 1654 s->ext.early_data_ok = 0; 1655 } 1656 if (!s->hit) { 1657 /* 1658 * This is a new session and so alpn_selected should have been 1659 * initialised to NULL. We should update it with the selected ALPN. 1660 */ 1661 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { 1662 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1663 ERR_R_INTERNAL_ERROR); 1664 return 0; 1665 } 1666 s->session->ext.alpn_selected = 1667 OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); 1668 if (s->session->ext.alpn_selected == NULL) { 1669 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1670 ERR_R_INTERNAL_ERROR); 1671 return 0; 1672 } 1673 s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; 1674 } 1675 1676 return 1; 1677 } 1678 1679 #ifndef OPENSSL_NO_SRTP 1680 int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1681 size_t chainidx) 1682 { 1683 unsigned int id, ct, mki; 1684 int i; 1685 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1686 SRTP_PROTECTION_PROFILE *prof; 1687 1688 if (!PACKET_get_net_2(pkt, &ct) || ct != 2 1689 || !PACKET_get_net_2(pkt, &id) 1690 || !PACKET_get_1(pkt, &mki) 1691 || PACKET_remaining(pkt) != 0) { 1692 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1693 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1694 return 0; 1695 } 1696 1697 if (mki != 0) { 1698 /* Must be no MKI, since we never offer one */ 1699 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1700 SSL_R_BAD_SRTP_MKI_VALUE); 1701 return 0; 1702 } 1703 1704 /* Throw an error if the server gave us an unsolicited extension */ 1705 clnt = SSL_get_srtp_profiles(s); 1706 if (clnt == NULL) { 1707 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1708 SSL_R_NO_SRTP_PROFILES); 1709 return 0; 1710 } 1711 1712 /* 1713 * Check to see if the server gave us something we support (and 1714 * presumably offered) 1715 */ 1716 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) { 1717 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 1718 1719 if (prof->id == id) { 1720 s->srtp_profile = prof; 1721 return 1; 1722 } 1723 } 1724 1725 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1726 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1727 return 0; 1728 } 1729 #endif 1730 1731 int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1732 size_t chainidx) 1733 { 1734 /* Ignore if inappropriate ciphersuite */ 1735 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 1736 && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD 1737 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4) 1738 s->ext.use_etm = 1; 1739 1740 return 1; 1741 } 1742 1743 int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1744 size_t chainidx) 1745 { 1746 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS; 1747 if (!s->hit) 1748 s->session->flags |= SSL_SESS_FLAG_EXTMS; 1749 1750 return 1; 1751 } 1752 1753 int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context, 1754 X509 *x, size_t chainidx) 1755 { 1756 unsigned int version; 1757 1758 if (!PACKET_get_net_2(pkt, &version) 1759 || PACKET_remaining(pkt) != 0) { 1760 SSLfatal(s, SSL_AD_DECODE_ERROR, 1761 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1762 SSL_R_LENGTH_MISMATCH); 1763 return 0; 1764 } 1765 1766 /* 1767 * The only protocol version we support which is valid in this extension in 1768 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else. 1769 */ 1770 if (version != TLS1_3_VERSION) { 1771 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1772 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1773 SSL_R_BAD_PROTOCOL_VERSION_NUMBER); 1774 return 0; 1775 } 1776 1777 /* We ignore this extension for HRRs except to sanity check it */ 1778 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) 1779 return 1; 1780 1781 /* We just set it here. We validate it in ssl_choose_client_version */ 1782 s->version = version; 1783 1784 return 1; 1785 } 1786 1787 int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1788 size_t chainidx) 1789 { 1790 #ifndef OPENSSL_NO_TLS1_3 1791 unsigned int group_id; 1792 PACKET encoded_pt; 1793 EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL; 1794 1795 /* Sanity check */ 1796 if (ckey == NULL || s->s3->peer_tmp != NULL) { 1797 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1798 ERR_R_INTERNAL_ERROR); 1799 return 0; 1800 } 1801 1802 if (!PACKET_get_net_2(pkt, &group_id)) { 1803 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1804 SSL_R_LENGTH_MISMATCH); 1805 return 0; 1806 } 1807 1808 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) { 1809 const uint16_t *pgroups = NULL; 1810 size_t i, num_groups; 1811 1812 if (PACKET_remaining(pkt) != 0) { 1813 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1814 SSL_R_LENGTH_MISMATCH); 1815 return 0; 1816 } 1817 1818 /* 1819 * It is an error if the HelloRetryRequest wants a key_share that we 1820 * already sent in the first ClientHello 1821 */ 1822 if (group_id == s->s3->group_id) { 1823 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1824 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1825 return 0; 1826 } 1827 1828 /* Validate the selected group is one we support */ 1829 tls1_get_supported_groups(s, &pgroups, &num_groups); 1830 for (i = 0; i < num_groups; i++) { 1831 if (group_id == pgroups[i]) 1832 break; 1833 } 1834 if (i >= num_groups 1835 || !tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) { 1836 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1837 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1838 return 0; 1839 } 1840 1841 s->s3->group_id = group_id; 1842 EVP_PKEY_free(s->s3->tmp.pkey); 1843 s->s3->tmp.pkey = NULL; 1844 return 1; 1845 } 1846 1847 if (group_id != s->s3->group_id) { 1848 /* 1849 * This isn't for the group that we sent in the original 1850 * key_share! 1851 */ 1852 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1853 SSL_R_BAD_KEY_SHARE); 1854 return 0; 1855 } 1856 1857 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt) 1858 || PACKET_remaining(&encoded_pt) == 0) { 1859 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1860 SSL_R_LENGTH_MISMATCH); 1861 return 0; 1862 } 1863 1864 skey = ssl_generate_pkey(ckey); 1865 if (skey == NULL) { 1866 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1867 ERR_R_MALLOC_FAILURE); 1868 return 0; 1869 } 1870 if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), 1871 PACKET_remaining(&encoded_pt))) { 1872 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1873 SSL_R_BAD_ECPOINT); 1874 EVP_PKEY_free(skey); 1875 return 0; 1876 } 1877 1878 if (ssl_derive(s, ckey, skey, 1) == 0) { 1879 /* SSLfatal() already called */ 1880 EVP_PKEY_free(skey); 1881 return 0; 1882 } 1883 s->s3->peer_tmp = skey; 1884 #endif 1885 1886 return 1; 1887 } 1888 1889 int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1890 size_t chainidx) 1891 { 1892 PACKET cookie; 1893 1894 if (!PACKET_as_length_prefixed_2(pkt, &cookie) 1895 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie, 1896 &s->ext.tls13_cookie_len)) { 1897 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_COOKIE, 1898 SSL_R_LENGTH_MISMATCH); 1899 return 0; 1900 } 1901 1902 return 1; 1903 } 1904 1905 int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context, 1906 X509 *x, size_t chainidx) 1907 { 1908 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { 1909 unsigned long max_early_data; 1910 1911 if (!PACKET_get_net_4(pkt, &max_early_data) 1912 || PACKET_remaining(pkt) != 0) { 1913 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1914 SSL_R_INVALID_MAX_EARLY_DATA); 1915 return 0; 1916 } 1917 1918 s->session->ext.max_early_data = max_early_data; 1919 1920 return 1; 1921 } 1922 1923 if (PACKET_remaining(pkt) != 0) { 1924 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1925 SSL_R_BAD_EXTENSION); 1926 return 0; 1927 } 1928 1929 if (!s->ext.early_data_ok 1930 || !s->hit 1931 || s->session->ext.tick_identity != 0) { 1932 /* 1933 * If we get here then we didn't send early data, or we didn't resume 1934 * using the first identity, or the SNI/ALPN is not consistent so the 1935 * server should not be accepting it. 1936 */ 1937 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1938 SSL_R_BAD_EXTENSION); 1939 return 0; 1940 } 1941 1942 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; 1943 1944 return 1; 1945 } 1946 1947 int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1948 size_t chainidx) 1949 { 1950 #ifndef OPENSSL_NO_TLS1_3 1951 unsigned int identity; 1952 1953 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) { 1954 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1955 SSL_R_LENGTH_MISMATCH); 1956 return 0; 1957 } 1958 1959 if (s->session->ext.tick_identity == (int)identity) { 1960 s->hit = 1; 1961 SSL_SESSION_free(s->psksession); 1962 s->psksession = NULL; 1963 return 1; 1964 } 1965 1966 if (s->psksession == NULL 1967 || s->psksession->ext.tick_identity != (int)identity) { 1968 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, 1969 SSL_R_BAD_PSK_IDENTITY); 1970 return 0; 1971 } 1972 1973 /* 1974 * If we used the external PSK for sending early_data then s->early_secret 1975 * is already set up, so don't overwrite it. Otherwise we copy the 1976 * early_secret across that we generated earlier. 1977 */ 1978 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 1979 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 1980 || s->session->ext.max_early_data > 0 1981 || s->psksession->ext.max_early_data == 0) 1982 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE); 1983 1984 SSL_SESSION_free(s->session); 1985 s->session = s->psksession; 1986 s->psksession = NULL; 1987 s->hit = 1; 1988 #endif 1989 1990 return 1; 1991 } 1992