1 /* 2 * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/ocsp.h> 11 #include "../ssl_local.h" 12 #include "internal/cryptlib.h" 13 #include "statem_local.h" 14 15 EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, 16 unsigned int context, X509 *x, 17 size_t chainidx) 18 { 19 /* Add RI if renegotiating */ 20 if (!s->renegotiate) 21 return EXT_RETURN_NOT_SENT; 22 23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) 24 || !WPACKET_start_sub_packet_u16(pkt) 25 || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished, 26 s->s3->previous_client_finished_len) 27 || !WPACKET_close(pkt)) { 28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, 29 ERR_R_INTERNAL_ERROR); 30 return EXT_RETURN_FAIL; 31 } 32 33 return EXT_RETURN_SENT; 34 } 35 36 EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, 37 unsigned int context, X509 *x, 38 size_t chainidx) 39 { 40 if (s->ext.hostname == NULL) 41 return EXT_RETURN_NOT_SENT; 42 43 /* Add TLS extension servername to the Client Hello message */ 44 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) 45 /* Sub-packet for server_name extension */ 46 || !WPACKET_start_sub_packet_u16(pkt) 47 /* Sub-packet for servername list (always 1 hostname)*/ 48 || !WPACKET_start_sub_packet_u16(pkt) 49 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name) 50 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname, 51 strlen(s->ext.hostname)) 52 || !WPACKET_close(pkt) 53 || !WPACKET_close(pkt)) { 54 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, 55 ERR_R_INTERNAL_ERROR); 56 return EXT_RETURN_FAIL; 57 } 58 59 return EXT_RETURN_SENT; 60 } 61 62 /* Push a Max Fragment Len extension into ClientHello */ 63 EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, 64 unsigned int context, X509 *x, 65 size_t chainidx) 66 { 67 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED) 68 return EXT_RETURN_NOT_SENT; 69 70 /* Add Max Fragment Length extension if client enabled it. */ 71 /*- 72 * 4 bytes for this extension type and extension length 73 * 1 byte for the Max Fragment Length code value. 74 */ 75 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) 76 /* Sub-packet for Max Fragment Length extension (1 byte) */ 77 || !WPACKET_start_sub_packet_u16(pkt) 78 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode) 79 || !WPACKET_close(pkt)) { 80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 81 SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR); 82 return EXT_RETURN_FAIL; 83 } 84 85 return EXT_RETURN_SENT; 86 } 87 88 #ifndef OPENSSL_NO_SRP 89 EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, 90 X509 *x, size_t chainidx) 91 { 92 /* Add SRP username if there is one */ 93 if (s->srp_ctx.login == NULL) 94 return EXT_RETURN_NOT_SENT; 95 96 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp) 97 /* Sub-packet for SRP extension */ 98 || !WPACKET_start_sub_packet_u16(pkt) 99 || !WPACKET_start_sub_packet_u8(pkt) 100 /* login must not be zero...internal error if so */ 101 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) 102 || !WPACKET_memcpy(pkt, s->srp_ctx.login, 103 strlen(s->srp_ctx.login)) 104 || !WPACKET_close(pkt) 105 || !WPACKET_close(pkt)) { 106 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP, 107 ERR_R_INTERNAL_ERROR); 108 return EXT_RETURN_FAIL; 109 } 110 111 return EXT_RETURN_SENT; 112 } 113 #endif 114 115 #ifndef OPENSSL_NO_EC 116 static int use_ecc(SSL *s) 117 { 118 int i, end, ret = 0; 119 unsigned long alg_k, alg_a; 120 STACK_OF(SSL_CIPHER) *cipher_stack = NULL; 121 122 /* See if we support any ECC ciphersuites */ 123 if (s->version == SSL3_VERSION) 124 return 0; 125 126 cipher_stack = SSL_get1_supported_ciphers(s); 127 end = sk_SSL_CIPHER_num(cipher_stack); 128 for (i = 0; i < end; i++) { 129 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); 130 131 alg_k = c->algorithm_mkey; 132 alg_a = c->algorithm_auth; 133 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) 134 || (alg_a & SSL_aECDSA) 135 || c->min_tls >= TLS1_3_VERSION) { 136 ret = 1; 137 break; 138 } 139 } 140 141 sk_SSL_CIPHER_free(cipher_stack); 142 return ret; 143 } 144 145 EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, 146 unsigned int context, X509 *x, 147 size_t chainidx) 148 { 149 const unsigned char *pformats; 150 size_t num_formats; 151 152 if (!use_ecc(s)) 153 return EXT_RETURN_NOT_SENT; 154 155 /* Add TLS extension ECPointFormats to the ClientHello message */ 156 tls1_get_formatlist(s, &pformats, &num_formats); 157 158 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) 159 /* Sub-packet for formats extension */ 160 || !WPACKET_start_sub_packet_u16(pkt) 161 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats) 162 || !WPACKET_close(pkt)) { 163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 164 SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 165 return EXT_RETURN_FAIL; 166 } 167 168 return EXT_RETURN_SENT; 169 } 170 171 EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, 172 unsigned int context, X509 *x, 173 size_t chainidx) 174 { 175 const uint16_t *pgroups = NULL; 176 size_t num_groups = 0, i; 177 178 if (!use_ecc(s)) 179 return EXT_RETURN_NOT_SENT; 180 181 /* 182 * Add TLS extension supported_groups to the ClientHello message 183 */ 184 /* TODO(TLS1.3): Add support for DHE groups */ 185 tls1_get_supported_groups(s, &pgroups, &num_groups); 186 187 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) 188 /* Sub-packet for supported_groups extension */ 189 || !WPACKET_start_sub_packet_u16(pkt) 190 || !WPACKET_start_sub_packet_u16(pkt)) { 191 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 192 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 193 ERR_R_INTERNAL_ERROR); 194 return EXT_RETURN_FAIL; 195 } 196 /* Copy curve ID if supported */ 197 for (i = 0; i < num_groups; i++) { 198 uint16_t ctmp = pgroups[i]; 199 200 if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) { 201 if (!WPACKET_put_bytes_u16(pkt, ctmp)) { 202 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 203 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 204 ERR_R_INTERNAL_ERROR); 205 return EXT_RETURN_FAIL; 206 } 207 } 208 } 209 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 210 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 211 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 212 ERR_R_INTERNAL_ERROR); 213 return EXT_RETURN_FAIL; 214 } 215 216 return EXT_RETURN_SENT; 217 } 218 #endif 219 220 EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, 221 unsigned int context, X509 *x, 222 size_t chainidx) 223 { 224 size_t ticklen; 225 226 if (!tls_use_ticket(s)) 227 return EXT_RETURN_NOT_SENT; 228 229 if (!s->new_session && s->session != NULL 230 && s->session->ext.tick != NULL 231 && s->session->ssl_version != TLS1_3_VERSION) { 232 ticklen = s->session->ext.ticklen; 233 } else if (s->session && s->ext.session_ticket != NULL 234 && s->ext.session_ticket->data != NULL) { 235 ticklen = s->ext.session_ticket->length; 236 s->session->ext.tick = OPENSSL_malloc(ticklen); 237 if (s->session->ext.tick == NULL) { 238 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 239 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, 240 ERR_R_INTERNAL_ERROR); 241 return EXT_RETURN_FAIL; 242 } 243 memcpy(s->session->ext.tick, 244 s->ext.session_ticket->data, ticklen); 245 s->session->ext.ticklen = ticklen; 246 } else { 247 ticklen = 0; 248 } 249 250 if (ticklen == 0 && s->ext.session_ticket != NULL && 251 s->ext.session_ticket->data == NULL) 252 return EXT_RETURN_NOT_SENT; 253 254 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) 255 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) { 256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 257 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); 258 return EXT_RETURN_FAIL; 259 } 260 261 return EXT_RETURN_SENT; 262 } 263 264 EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, 265 unsigned int context, X509 *x, 266 size_t chainidx) 267 { 268 size_t salglen; 269 const uint16_t *salg; 270 271 if (!SSL_CLIENT_USE_SIGALGS(s)) 272 return EXT_RETURN_NOT_SENT; 273 274 salglen = tls12_get_psigalgs(s, 1, &salg); 275 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms) 276 /* Sub-packet for sig-algs extension */ 277 || !WPACKET_start_sub_packet_u16(pkt) 278 /* Sub-packet for the actual list */ 279 || !WPACKET_start_sub_packet_u16(pkt) 280 || !tls12_copy_sigalgs(s, pkt, salg, salglen) 281 || !WPACKET_close(pkt) 282 || !WPACKET_close(pkt)) { 283 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, 284 ERR_R_INTERNAL_ERROR); 285 return EXT_RETURN_FAIL; 286 } 287 288 return EXT_RETURN_SENT; 289 } 290 291 #ifndef OPENSSL_NO_OCSP 292 EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, 293 unsigned int context, X509 *x, 294 size_t chainidx) 295 { 296 int i; 297 298 /* This extension isn't defined for client Certificates */ 299 if (x != NULL) 300 return EXT_RETURN_NOT_SENT; 301 302 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) 303 return EXT_RETURN_NOT_SENT; 304 305 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) 306 /* Sub-packet for status request extension */ 307 || !WPACKET_start_sub_packet_u16(pkt) 308 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp) 309 /* Sub-packet for the ids */ 310 || !WPACKET_start_sub_packet_u16(pkt)) { 311 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 312 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 313 return EXT_RETURN_FAIL; 314 } 315 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) { 316 unsigned char *idbytes; 317 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i); 318 int idlen = i2d_OCSP_RESPID(id, NULL); 319 320 if (idlen <= 0 321 /* Sub-packet for an individual id */ 322 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes) 323 || i2d_OCSP_RESPID(id, &idbytes) != idlen) { 324 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 325 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 326 ERR_R_INTERNAL_ERROR); 327 return EXT_RETURN_FAIL; 328 } 329 } 330 if (!WPACKET_close(pkt) 331 || !WPACKET_start_sub_packet_u16(pkt)) { 332 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 333 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 334 return EXT_RETURN_FAIL; 335 } 336 if (s->ext.ocsp.exts) { 337 unsigned char *extbytes; 338 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL); 339 340 if (extlen < 0) { 341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 342 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 343 ERR_R_INTERNAL_ERROR); 344 return EXT_RETURN_FAIL; 345 } 346 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes) 347 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes) 348 != extlen) { 349 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 350 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 351 ERR_R_INTERNAL_ERROR); 352 return EXT_RETURN_FAIL; 353 } 354 } 355 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 356 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 357 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 358 return EXT_RETURN_FAIL; 359 } 360 361 return EXT_RETURN_SENT; 362 } 363 #endif 364 365 #ifndef OPENSSL_NO_NEXTPROTONEG 366 EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, 367 X509 *x, size_t chainidx) 368 { 369 if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 370 return EXT_RETURN_NOT_SENT; 371 372 /* 373 * The client advertises an empty extension to indicate its support 374 * for Next Protocol Negotiation 375 */ 376 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) 377 || !WPACKET_put_bytes_u16(pkt, 0)) { 378 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN, 379 ERR_R_INTERNAL_ERROR); 380 return EXT_RETURN_FAIL; 381 } 382 383 return EXT_RETURN_SENT; 384 } 385 #endif 386 387 EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, 388 X509 *x, size_t chainidx) 389 { 390 s->s3->alpn_sent = 0; 391 392 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 393 return EXT_RETURN_NOT_SENT; 394 395 if (!WPACKET_put_bytes_u16(pkt, 396 TLSEXT_TYPE_application_layer_protocol_negotiation) 397 /* Sub-packet ALPN extension */ 398 || !WPACKET_start_sub_packet_u16(pkt) 399 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len) 400 || !WPACKET_close(pkt)) { 401 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, 402 ERR_R_INTERNAL_ERROR); 403 return EXT_RETURN_FAIL; 404 } 405 s->s3->alpn_sent = 1; 406 407 return EXT_RETURN_SENT; 408 } 409 410 411 #ifndef OPENSSL_NO_SRTP 412 EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, 413 unsigned int context, X509 *x, 414 size_t chainidx) 415 { 416 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s); 417 int i, end; 418 419 if (clnt == NULL) 420 return EXT_RETURN_NOT_SENT; 421 422 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) 423 /* Sub-packet for SRTP extension */ 424 || !WPACKET_start_sub_packet_u16(pkt) 425 /* Sub-packet for the protection profile list */ 426 || !WPACKET_start_sub_packet_u16(pkt)) { 427 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 428 ERR_R_INTERNAL_ERROR); 429 return EXT_RETURN_FAIL; 430 } 431 432 end = sk_SRTP_PROTECTION_PROFILE_num(clnt); 433 for (i = 0; i < end; i++) { 434 const SRTP_PROTECTION_PROFILE *prof = 435 sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 436 437 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) { 438 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 439 SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); 440 return EXT_RETURN_FAIL; 441 } 442 } 443 if (!WPACKET_close(pkt) 444 /* Add an empty use_mki value */ 445 || !WPACKET_put_bytes_u8(pkt, 0) 446 || !WPACKET_close(pkt)) { 447 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 448 ERR_R_INTERNAL_ERROR); 449 return EXT_RETURN_FAIL; 450 } 451 452 return EXT_RETURN_SENT; 453 } 454 #endif 455 456 EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, 457 X509 *x, size_t chainidx) 458 { 459 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 460 return EXT_RETURN_NOT_SENT; 461 462 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) 463 || !WPACKET_put_bytes_u16(pkt, 0)) { 464 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM, 465 ERR_R_INTERNAL_ERROR); 466 return EXT_RETURN_FAIL; 467 } 468 469 return EXT_RETURN_SENT; 470 } 471 472 #ifndef OPENSSL_NO_CT 473 EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, 474 X509 *x, size_t chainidx) 475 { 476 if (s->ct_validation_callback == NULL) 477 return EXT_RETURN_NOT_SENT; 478 479 /* Not defined for client Certificates */ 480 if (x != NULL) 481 return EXT_RETURN_NOT_SENT; 482 483 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp) 484 || !WPACKET_put_bytes_u16(pkt, 0)) { 485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT, 486 ERR_R_INTERNAL_ERROR); 487 return EXT_RETURN_FAIL; 488 } 489 490 return EXT_RETURN_SENT; 491 } 492 #endif 493 494 EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, 495 X509 *x, size_t chainidx) 496 { 497 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) 498 || !WPACKET_put_bytes_u16(pkt, 0)) { 499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS, 500 ERR_R_INTERNAL_ERROR); 501 return EXT_RETURN_FAIL; 502 } 503 504 return EXT_RETURN_SENT; 505 } 506 507 EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, 508 unsigned int context, X509 *x, 509 size_t chainidx) 510 { 511 int currv, min_version, max_version, reason; 512 513 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); 514 if (reason != 0) { 515 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 516 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); 517 return EXT_RETURN_FAIL; 518 } 519 520 /* 521 * Don't include this if we can't negotiate TLSv1.3. We can do a straight 522 * comparison here because we will never be called in DTLS. 523 */ 524 if (max_version < TLS1_3_VERSION) 525 return EXT_RETURN_NOT_SENT; 526 527 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) 528 || !WPACKET_start_sub_packet_u16(pkt) 529 || !WPACKET_start_sub_packet_u8(pkt)) { 530 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 531 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 532 ERR_R_INTERNAL_ERROR); 533 return EXT_RETURN_FAIL; 534 } 535 536 for (currv = max_version; currv >= min_version; currv--) { 537 if (!WPACKET_put_bytes_u16(pkt, currv)) { 538 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 539 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 540 ERR_R_INTERNAL_ERROR); 541 return EXT_RETURN_FAIL; 542 } 543 } 544 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 545 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 546 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 547 ERR_R_INTERNAL_ERROR); 548 return EXT_RETURN_FAIL; 549 } 550 551 return EXT_RETURN_SENT; 552 } 553 554 /* 555 * Construct a psk_kex_modes extension. 556 */ 557 EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, 558 unsigned int context, X509 *x, 559 size_t chainidx) 560 { 561 #ifndef OPENSSL_NO_TLS1_3 562 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX; 563 564 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes) 565 || !WPACKET_start_sub_packet_u16(pkt) 566 || !WPACKET_start_sub_packet_u8(pkt) 567 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE) 568 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE)) 569 || !WPACKET_close(pkt) 570 || !WPACKET_close(pkt)) { 571 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 572 SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR); 573 return EXT_RETURN_FAIL; 574 } 575 576 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE; 577 if (nodhe) 578 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; 579 #endif 580 581 return EXT_RETURN_SENT; 582 } 583 584 #ifndef OPENSSL_NO_TLS1_3 585 static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id) 586 { 587 unsigned char *encoded_point = NULL; 588 EVP_PKEY *key_share_key = NULL; 589 size_t encodedlen; 590 591 if (s->s3->tmp.pkey != NULL) { 592 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) { 593 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 594 ERR_R_INTERNAL_ERROR); 595 return 0; 596 } 597 /* 598 * Could happen if we got an HRR that wasn't requesting a new key_share 599 */ 600 key_share_key = s->s3->tmp.pkey; 601 } else { 602 key_share_key = ssl_generate_pkey_group(s, curve_id); 603 if (key_share_key == NULL) { 604 /* SSLfatal() already called */ 605 return 0; 606 } 607 } 608 609 /* Encode the public key. */ 610 encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key, 611 &encoded_point); 612 if (encodedlen == 0) { 613 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB); 614 goto err; 615 } 616 617 /* Create KeyShareEntry */ 618 if (!WPACKET_put_bytes_u16(pkt, curve_id) 619 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) { 620 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 621 ERR_R_INTERNAL_ERROR); 622 goto err; 623 } 624 625 /* 626 * TODO(TLS1.3): When changing to send more than one key_share we're 627 * going to need to be able to save more than one EVP_PKEY. For now 628 * we reuse the existing tmp.pkey 629 */ 630 s->s3->tmp.pkey = key_share_key; 631 s->s3->group_id = curve_id; 632 OPENSSL_free(encoded_point); 633 634 return 1; 635 err: 636 if (s->s3->tmp.pkey == NULL) 637 EVP_PKEY_free(key_share_key); 638 OPENSSL_free(encoded_point); 639 return 0; 640 } 641 #endif 642 643 EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, 644 unsigned int context, X509 *x, 645 size_t chainidx) 646 { 647 #ifndef OPENSSL_NO_TLS1_3 648 size_t i, num_groups = 0; 649 const uint16_t *pgroups = NULL; 650 uint16_t curve_id = 0; 651 652 /* key_share extension */ 653 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 654 /* Extension data sub-packet */ 655 || !WPACKET_start_sub_packet_u16(pkt) 656 /* KeyShare list sub-packet */ 657 || !WPACKET_start_sub_packet_u16(pkt)) { 658 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 659 ERR_R_INTERNAL_ERROR); 660 return EXT_RETURN_FAIL; 661 } 662 663 tls1_get_supported_groups(s, &pgroups, &num_groups); 664 665 /* 666 * TODO(TLS1.3): Make the number of key_shares sent configurable. For 667 * now, just send one 668 */ 669 if (s->s3->group_id != 0) { 670 curve_id = s->s3->group_id; 671 } else { 672 for (i = 0; i < num_groups; i++) { 673 674 if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED)) 675 continue; 676 677 curve_id = pgroups[i]; 678 break; 679 } 680 } 681 682 if (curve_id == 0) { 683 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 684 SSL_R_NO_SUITABLE_KEY_SHARE); 685 return EXT_RETURN_FAIL; 686 } 687 688 if (!add_key_share(s, pkt, curve_id)) { 689 /* SSLfatal() already called */ 690 return EXT_RETURN_FAIL; 691 } 692 693 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 694 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 695 ERR_R_INTERNAL_ERROR); 696 return EXT_RETURN_FAIL; 697 } 698 return EXT_RETURN_SENT; 699 #else 700 return EXT_RETURN_NOT_SENT; 701 #endif 702 } 703 704 EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, 705 X509 *x, size_t chainidx) 706 { 707 EXT_RETURN ret = EXT_RETURN_FAIL; 708 709 /* Should only be set if we've had an HRR */ 710 if (s->ext.tls13_cookie_len == 0) 711 return EXT_RETURN_NOT_SENT; 712 713 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) 714 /* Extension data sub-packet */ 715 || !WPACKET_start_sub_packet_u16(pkt) 716 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie, 717 s->ext.tls13_cookie_len) 718 || !WPACKET_close(pkt)) { 719 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, 720 ERR_R_INTERNAL_ERROR); 721 goto end; 722 } 723 724 ret = EXT_RETURN_SENT; 725 end: 726 OPENSSL_free(s->ext.tls13_cookie); 727 s->ext.tls13_cookie = NULL; 728 s->ext.tls13_cookie_len = 0; 729 730 return ret; 731 } 732 733 EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, 734 unsigned int context, X509 *x, 735 size_t chainidx) 736 { 737 #ifndef OPENSSL_NO_PSK 738 char identity[PSK_MAX_IDENTITY_LEN + 1]; 739 #endif /* OPENSSL_NO_PSK */ 740 const unsigned char *id = NULL; 741 size_t idlen = 0; 742 SSL_SESSION *psksess = NULL; 743 SSL_SESSION *edsess = NULL; 744 const EVP_MD *handmd = NULL; 745 746 if (s->hello_retry_request == SSL_HRR_PENDING) 747 handmd = ssl_handshake_md(s); 748 749 if (s->psk_use_session_cb != NULL 750 && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess) 751 || (psksess != NULL 752 && psksess->ssl_version != TLS1_3_VERSION))) { 753 SSL_SESSION_free(psksess); 754 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 755 SSL_R_BAD_PSK); 756 return EXT_RETURN_FAIL; 757 } 758 759 #ifndef OPENSSL_NO_PSK 760 if (psksess == NULL && s->psk_client_callback != NULL) { 761 unsigned char psk[PSK_MAX_PSK_LEN]; 762 size_t psklen = 0; 763 764 memset(identity, 0, sizeof(identity)); 765 psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, 766 psk, sizeof(psk)); 767 768 if (psklen > PSK_MAX_PSK_LEN) { 769 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 770 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 771 return EXT_RETURN_FAIL; 772 } else if (psklen > 0) { 773 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; 774 const SSL_CIPHER *cipher; 775 776 idlen = strlen(identity); 777 if (idlen > PSK_MAX_IDENTITY_LEN) { 778 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 779 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 780 ERR_R_INTERNAL_ERROR); 781 return EXT_RETURN_FAIL; 782 } 783 id = (unsigned char *)identity; 784 785 /* 786 * We found a PSK using an old style callback. We don't know 787 * the digest so we default to SHA256 as per the TLSv1.3 spec 788 */ 789 cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); 790 if (cipher == NULL) { 791 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 792 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 793 ERR_R_INTERNAL_ERROR); 794 return EXT_RETURN_FAIL; 795 } 796 797 psksess = SSL_SESSION_new(); 798 if (psksess == NULL 799 || !SSL_SESSION_set1_master_key(psksess, psk, psklen) 800 || !SSL_SESSION_set_cipher(psksess, cipher) 801 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { 802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 803 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 804 ERR_R_INTERNAL_ERROR); 805 OPENSSL_cleanse(psk, psklen); 806 return EXT_RETURN_FAIL; 807 } 808 OPENSSL_cleanse(psk, psklen); 809 } 810 } 811 #endif /* OPENSSL_NO_PSK */ 812 813 SSL_SESSION_free(s->psksession); 814 s->psksession = psksess; 815 if (psksess != NULL) { 816 OPENSSL_free(s->psksession_id); 817 s->psksession_id = OPENSSL_memdup(id, idlen); 818 if (s->psksession_id == NULL) { 819 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 820 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 821 return EXT_RETURN_FAIL; 822 } 823 s->psksession_id_len = idlen; 824 } 825 826 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING 827 || (s->session->ext.max_early_data == 0 828 && (psksess == NULL || psksess->ext.max_early_data == 0))) { 829 s->max_early_data = 0; 830 return EXT_RETURN_NOT_SENT; 831 } 832 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess; 833 s->max_early_data = edsess->ext.max_early_data; 834 835 if (edsess->ext.hostname != NULL) { 836 if (s->ext.hostname == NULL 837 || (s->ext.hostname != NULL 838 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) { 839 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 840 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 841 SSL_R_INCONSISTENT_EARLY_DATA_SNI); 842 return EXT_RETURN_FAIL; 843 } 844 } 845 846 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) { 847 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 848 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 849 return EXT_RETURN_FAIL; 850 } 851 852 /* 853 * Verify that we are offering an ALPN protocol consistent with the early 854 * data. 855 */ 856 if (edsess->ext.alpn_selected != NULL) { 857 PACKET prots, alpnpkt; 858 int found = 0; 859 860 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) { 861 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 862 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 863 return EXT_RETURN_FAIL; 864 } 865 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) { 866 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected, 867 edsess->ext.alpn_selected_len)) { 868 found = 1; 869 break; 870 } 871 } 872 if (!found) { 873 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 874 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 875 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 876 return EXT_RETURN_FAIL; 877 } 878 } 879 880 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 881 || !WPACKET_start_sub_packet_u16(pkt) 882 || !WPACKET_close(pkt)) { 883 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 884 ERR_R_INTERNAL_ERROR); 885 return EXT_RETURN_FAIL; 886 } 887 888 /* 889 * We set this to rejected here. Later, if the server acknowledges the 890 * extension, we set it to accepted. 891 */ 892 s->ext.early_data = SSL_EARLY_DATA_REJECTED; 893 s->ext.early_data_ok = 1; 894 895 return EXT_RETURN_SENT; 896 } 897 898 #define F5_WORKAROUND_MIN_MSG_LEN 0xff 899 #define F5_WORKAROUND_MAX_MSG_LEN 0x200 900 901 /* 902 * PSK pre binder overhead = 903 * 2 bytes for TLSEXT_TYPE_psk 904 * 2 bytes for extension length 905 * 2 bytes for identities list length 906 * 2 bytes for identity length 907 * 4 bytes for obfuscated_ticket_age 908 * 2 bytes for binder list length 909 * 1 byte for binder length 910 * The above excludes the number of bytes for the identity itself and the 911 * subsequent binder bytes 912 */ 913 #define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1) 914 915 EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt, 916 unsigned int context, X509 *x, 917 size_t chainidx) 918 { 919 unsigned char *padbytes; 920 size_t hlen; 921 922 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0) 923 return EXT_RETURN_NOT_SENT; 924 925 /* 926 * Add padding to workaround bugs in F5 terminators. See RFC7685. 927 * This code calculates the length of all extensions added so far but 928 * excludes the PSK extension (because that MUST be written last). Therefore 929 * this extension MUST always appear second to last. 930 */ 931 if (!WPACKET_get_total_written(pkt, &hlen)) { 932 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 933 ERR_R_INTERNAL_ERROR); 934 return EXT_RETURN_FAIL; 935 } 936 937 /* 938 * If we're going to send a PSK then that will be written out after this 939 * extension, so we need to calculate how long it is going to be. 940 */ 941 if (s->session->ssl_version == TLS1_3_VERSION 942 && s->session->ext.ticklen != 0 943 && s->session->cipher != NULL) { 944 const EVP_MD *md = ssl_md(s->session->cipher->algorithm2); 945 946 if (md != NULL) { 947 /* 948 * Add the fixed PSK overhead, the identity length and the binder 949 * length. 950 */ 951 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen 952 + EVP_MD_size(md); 953 } 954 } 955 956 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) { 957 /* Calculate the amount of padding we need to add */ 958 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen; 959 960 /* 961 * Take off the size of extension header itself (2 bytes for type and 962 * 2 bytes for length bytes), but ensure that the extension is at least 963 * 1 byte long so as not to have an empty extension last (WebSphere 7.x, 964 * 8.x are intolerant of that condition) 965 */ 966 if (hlen > 4) 967 hlen -= 4; 968 else 969 hlen = 1; 970 971 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding) 972 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) { 973 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 974 ERR_R_INTERNAL_ERROR); 975 return EXT_RETURN_FAIL; 976 } 977 memset(padbytes, 0, hlen); 978 } 979 980 return EXT_RETURN_SENT; 981 } 982 983 /* 984 * Construct the pre_shared_key extension 985 */ 986 EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, 987 X509 *x, size_t chainidx) 988 { 989 #ifndef OPENSSL_NO_TLS1_3 990 uint32_t now, agesec, agems = 0; 991 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen; 992 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL; 993 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL; 994 int dores = 0; 995 996 s->ext.tick_identity = 0; 997 998 /* 999 * Note: At this stage of the code we only support adding a single 1000 * resumption PSK. If we add support for multiple PSKs then the length 1001 * calculations in the padding extension will need to be adjusted. 1002 */ 1003 1004 /* 1005 * If this is an incompatible or new session then we have nothing to resume 1006 * so don't add this extension. 1007 */ 1008 if (s->session->ssl_version != TLS1_3_VERSION 1009 || (s->session->ext.ticklen == 0 && s->psksession == NULL)) 1010 return EXT_RETURN_NOT_SENT; 1011 1012 if (s->hello_retry_request == SSL_HRR_PENDING) 1013 handmd = ssl_handshake_md(s); 1014 1015 if (s->session->ext.ticklen != 0) { 1016 /* Get the digest associated with the ciphersuite in the session */ 1017 if (s->session->cipher == NULL) { 1018 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1019 ERR_R_INTERNAL_ERROR); 1020 return EXT_RETURN_FAIL; 1021 } 1022 mdres = ssl_md(s->session->cipher->algorithm2); 1023 if (mdres == NULL) { 1024 /* 1025 * Don't recognize this cipher so we can't use the session. 1026 * Ignore it 1027 */ 1028 goto dopsksess; 1029 } 1030 1031 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) { 1032 /* 1033 * Selected ciphersuite hash does not match the hash for the session 1034 * so we can't use it. 1035 */ 1036 goto dopsksess; 1037 } 1038 1039 /* 1040 * Technically the C standard just says time() returns a time_t and says 1041 * nothing about the encoding of that type. In practice most 1042 * implementations follow POSIX which holds it as an integral type in 1043 * seconds since epoch. We've already made the assumption that we can do 1044 * this in multiple places in the code, so portability shouldn't be an 1045 * issue. 1046 */ 1047 now = (uint32_t)time(NULL); 1048 agesec = now - (uint32_t)s->session->time; 1049 /* 1050 * We calculate the age in seconds but the server may work in ms. Due to 1051 * rounding errors we could overestimate the age by up to 1s. It is 1052 * better to underestimate it. Otherwise, if the RTT is very short, when 1053 * the server calculates the age reported by the client it could be 1054 * bigger than the age calculated on the server - which should never 1055 * happen. 1056 */ 1057 if (agesec > 0) 1058 agesec--; 1059 1060 if (s->session->ext.tick_lifetime_hint < agesec) { 1061 /* Ticket is too old. Ignore it. */ 1062 goto dopsksess; 1063 } 1064 1065 /* 1066 * Calculate age in ms. We're just doing it to nearest second. Should be 1067 * good enough. 1068 */ 1069 agems = agesec * (uint32_t)1000; 1070 1071 if (agesec != 0 && agems / (uint32_t)1000 != agesec) { 1072 /* 1073 * Overflow. Shouldn't happen unless this is a *really* old session. 1074 * If so we just ignore it. 1075 */ 1076 goto dopsksess; 1077 } 1078 1079 /* 1080 * Obfuscate the age. Overflow here is fine, this addition is supposed 1081 * to be mod 2^32. 1082 */ 1083 agems += s->session->ext.tick_age_add; 1084 1085 reshashsize = EVP_MD_size(mdres); 1086 s->ext.tick_identity++; 1087 dores = 1; 1088 } 1089 1090 dopsksess: 1091 if (!dores && s->psksession == NULL) 1092 return EXT_RETURN_NOT_SENT; 1093 1094 if (s->psksession != NULL) { 1095 mdpsk = ssl_md(s->psksession->cipher->algorithm2); 1096 if (mdpsk == NULL) { 1097 /* 1098 * Don't recognize this cipher so we can't use the session. 1099 * If this happens it's an application bug. 1100 */ 1101 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1102 SSL_R_BAD_PSK); 1103 return EXT_RETURN_FAIL; 1104 } 1105 1106 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) { 1107 /* 1108 * Selected ciphersuite hash does not match the hash for the PSK 1109 * session. This is an application bug. 1110 */ 1111 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1112 SSL_R_BAD_PSK); 1113 return EXT_RETURN_FAIL; 1114 } 1115 1116 pskhashsize = EVP_MD_size(mdpsk); 1117 } 1118 1119 /* Create the extension, but skip over the binder for now */ 1120 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) 1121 || !WPACKET_start_sub_packet_u16(pkt) 1122 || !WPACKET_start_sub_packet_u16(pkt)) { 1123 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1124 ERR_R_INTERNAL_ERROR); 1125 return EXT_RETURN_FAIL; 1126 } 1127 1128 if (dores) { 1129 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, 1130 s->session->ext.ticklen) 1131 || !WPACKET_put_bytes_u32(pkt, agems)) { 1132 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1133 ERR_R_INTERNAL_ERROR); 1134 return EXT_RETURN_FAIL; 1135 } 1136 } 1137 1138 if (s->psksession != NULL) { 1139 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id, 1140 s->psksession_id_len) 1141 || !WPACKET_put_bytes_u32(pkt, 0)) { 1142 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1143 ERR_R_INTERNAL_ERROR); 1144 return EXT_RETURN_FAIL; 1145 } 1146 s->ext.tick_identity++; 1147 } 1148 1149 if (!WPACKET_close(pkt) 1150 || !WPACKET_get_total_written(pkt, &binderoffset) 1151 || !WPACKET_start_sub_packet_u16(pkt) 1152 || (dores 1153 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder)) 1154 || (s->psksession != NULL 1155 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder)) 1156 || !WPACKET_close(pkt) 1157 || !WPACKET_close(pkt) 1158 || !WPACKET_get_total_written(pkt, &msglen) 1159 /* 1160 * We need to fill in all the sub-packet lengths now so we can 1161 * calculate the HMAC of the message up to the binders 1162 */ 1163 || !WPACKET_fill_lengths(pkt)) { 1164 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1165 ERR_R_INTERNAL_ERROR); 1166 return EXT_RETURN_FAIL; 1167 } 1168 1169 msgstart = WPACKET_get_curr(pkt) - msglen; 1170 1171 if (dores 1172 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL, 1173 resbinder, s->session, 1, 0) != 1) { 1174 /* SSLfatal() already called */ 1175 return EXT_RETURN_FAIL; 1176 } 1177 1178 if (s->psksession != NULL 1179 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL, 1180 pskbinder, s->psksession, 1, 1) != 1) { 1181 /* SSLfatal() already called */ 1182 return EXT_RETURN_FAIL; 1183 } 1184 1185 return EXT_RETURN_SENT; 1186 #else 1187 return EXT_RETURN_NOT_SENT; 1188 #endif 1189 } 1190 1191 EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, 1192 unsigned int context, 1193 X509 *x, size_t chainidx) 1194 { 1195 #ifndef OPENSSL_NO_TLS1_3 1196 if (!s->pha_enabled) 1197 return EXT_RETURN_NOT_SENT; 1198 1199 /* construct extension - 0 length, no contents */ 1200 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) 1201 || !WPACKET_start_sub_packet_u16(pkt) 1202 || !WPACKET_close(pkt)) { 1203 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1204 SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, 1205 ERR_R_INTERNAL_ERROR); 1206 return EXT_RETURN_FAIL; 1207 } 1208 1209 s->post_handshake_auth = SSL_PHA_EXT_SENT; 1210 1211 return EXT_RETURN_SENT; 1212 #else 1213 return EXT_RETURN_NOT_SENT; 1214 #endif 1215 } 1216 1217 1218 /* 1219 * Parse the server's renegotiation binding and abort if it's not right 1220 */ 1221 int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context, 1222 X509 *x, size_t chainidx) 1223 { 1224 size_t expected_len = s->s3->previous_client_finished_len 1225 + s->s3->previous_server_finished_len; 1226 size_t ilen; 1227 const unsigned char *data; 1228 1229 /* Check for logic errors */ 1230 if (!ossl_assert(expected_len == 0 1231 || s->s3->previous_client_finished_len != 0) 1232 || !ossl_assert(expected_len == 0 1233 || s->s3->previous_server_finished_len != 0)) { 1234 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1235 ERR_R_INTERNAL_ERROR); 1236 return 0; 1237 } 1238 1239 /* Parse the length byte */ 1240 if (!PACKET_get_1_len(pkt, &ilen)) { 1241 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1242 SSL_R_RENEGOTIATION_ENCODING_ERR); 1243 return 0; 1244 } 1245 1246 /* Consistency check */ 1247 if (PACKET_remaining(pkt) != ilen) { 1248 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1249 SSL_R_RENEGOTIATION_ENCODING_ERR); 1250 return 0; 1251 } 1252 1253 /* Check that the extension matches */ 1254 if (ilen != expected_len) { 1255 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1256 SSL_R_RENEGOTIATION_MISMATCH); 1257 return 0; 1258 } 1259 1260 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len) 1261 || memcmp(data, s->s3->previous_client_finished, 1262 s->s3->previous_client_finished_len) != 0) { 1263 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1264 SSL_R_RENEGOTIATION_MISMATCH); 1265 return 0; 1266 } 1267 1268 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len) 1269 || memcmp(data, s->s3->previous_server_finished, 1270 s->s3->previous_server_finished_len) != 0) { 1271 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1272 SSL_R_RENEGOTIATION_MISMATCH); 1273 return 0; 1274 } 1275 s->s3->send_connection_binding = 1; 1276 1277 return 1; 1278 } 1279 1280 /* Parse the server's max fragment len extension packet */ 1281 int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context, 1282 X509 *x, size_t chainidx) 1283 { 1284 unsigned int value; 1285 1286 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { 1287 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1288 SSL_R_BAD_EXTENSION); 1289 return 0; 1290 } 1291 1292 /* |value| should contains a valid max-fragment-length code. */ 1293 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { 1294 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1295 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1296 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1297 return 0; 1298 } 1299 1300 /* Must be the same value as client-configured one who was sent to server */ 1301 /*- 1302 * RFC 6066: if a client receives a maximum fragment length negotiation 1303 * response that differs from the length it requested, ... 1304 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert 1305 */ 1306 if (value != s->ext.max_fragment_len_mode) { 1307 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1308 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1309 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1310 return 0; 1311 } 1312 1313 /* 1314 * Maximum Fragment Length Negotiation succeeded. 1315 * The negotiated Maximum Fragment Length is binding now. 1316 */ 1317 s->session->ext.max_fragment_len_mode = value; 1318 1319 return 1; 1320 } 1321 1322 int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context, 1323 X509 *x, size_t chainidx) 1324 { 1325 if (s->ext.hostname == NULL) { 1326 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1327 ERR_R_INTERNAL_ERROR); 1328 return 0; 1329 } 1330 1331 if (PACKET_remaining(pkt) > 0) { 1332 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1333 SSL_R_BAD_EXTENSION); 1334 return 0; 1335 } 1336 1337 if (!s->hit) { 1338 if (s->session->ext.hostname != NULL) { 1339 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1340 ERR_R_INTERNAL_ERROR); 1341 return 0; 1342 } 1343 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); 1344 if (s->session->ext.hostname == NULL) { 1345 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1346 ERR_R_INTERNAL_ERROR); 1347 return 0; 1348 } 1349 } 1350 1351 return 1; 1352 } 1353 1354 #ifndef OPENSSL_NO_EC 1355 int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, 1356 X509 *x, size_t chainidx) 1357 { 1358 size_t ecpointformats_len; 1359 PACKET ecptformatlist; 1360 1361 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) { 1362 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, 1363 SSL_R_BAD_EXTENSION); 1364 return 0; 1365 } 1366 if (!s->hit) { 1367 ecpointformats_len = PACKET_remaining(&ecptformatlist); 1368 if (ecpointformats_len == 0) { 1369 SSLfatal(s, SSL_AD_DECODE_ERROR, 1370 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_LENGTH); 1371 return 0; 1372 } 1373 1374 s->ext.peer_ecpointformats_len = 0; 1375 OPENSSL_free(s->ext.peer_ecpointformats); 1376 s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len); 1377 if (s->ext.peer_ecpointformats == NULL) { 1378 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1379 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1380 return 0; 1381 } 1382 1383 s->ext.peer_ecpointformats_len = ecpointformats_len; 1384 1385 if (!PACKET_copy_bytes(&ecptformatlist, 1386 s->ext.peer_ecpointformats, 1387 ecpointformats_len)) { 1388 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1389 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1390 return 0; 1391 } 1392 } 1393 1394 return 1; 1395 } 1396 #endif 1397 1398 int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, 1399 X509 *x, size_t chainidx) 1400 { 1401 if (s->ext.session_ticket_cb != NULL && 1402 !s->ext.session_ticket_cb(s, PACKET_data(pkt), 1403 PACKET_remaining(pkt), 1404 s->ext.session_ticket_cb_arg)) { 1405 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 1406 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1407 return 0; 1408 } 1409 1410 if (!tls_use_ticket(s)) { 1411 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1412 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1413 return 0; 1414 } 1415 if (PACKET_remaining(pkt) > 0) { 1416 SSLfatal(s, SSL_AD_DECODE_ERROR, 1417 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1418 return 0; 1419 } 1420 1421 s->ext.ticket_expected = 1; 1422 1423 return 1; 1424 } 1425 1426 #ifndef OPENSSL_NO_OCSP 1427 int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, 1428 X509 *x, size_t chainidx) 1429 { 1430 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1431 /* We ignore this if the server sends a CertificateRequest */ 1432 /* TODO(TLS1.3): Add support for this */ 1433 return 1; 1434 } 1435 1436 /* 1437 * MUST only be sent if we've requested a status 1438 * request message. In TLS <= 1.2 it must also be empty. 1439 */ 1440 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { 1441 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1442 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1443 return 0; 1444 } 1445 if (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0) { 1446 SSLfatal(s, SSL_AD_DECODE_ERROR, 1447 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1448 return 0; 1449 } 1450 1451 if (SSL_IS_TLS13(s)) { 1452 /* We only know how to handle this if it's for the first Certificate in 1453 * the chain. We ignore any other responses. 1454 */ 1455 if (chainidx != 0) 1456 return 1; 1457 1458 /* SSLfatal() already called */ 1459 return tls_process_cert_status_body(s, pkt); 1460 } 1461 1462 /* Set flag to expect CertificateStatus message */ 1463 s->ext.status_expected = 1; 1464 1465 return 1; 1466 } 1467 #endif 1468 1469 1470 #ifndef OPENSSL_NO_CT 1471 int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1472 size_t chainidx) 1473 { 1474 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1475 /* We ignore this if the server sends it in a CertificateRequest */ 1476 /* TODO(TLS1.3): Add support for this */ 1477 return 1; 1478 } 1479 1480 /* 1481 * Only take it if we asked for it - i.e if there is no CT validation 1482 * callback set, then a custom extension MAY be processing it, so we 1483 * need to let control continue to flow to that. 1484 */ 1485 if (s->ct_validation_callback != NULL) { 1486 size_t size = PACKET_remaining(pkt); 1487 1488 /* Simply copy it off for later processing */ 1489 OPENSSL_free(s->ext.scts); 1490 s->ext.scts = NULL; 1491 1492 s->ext.scts_len = (uint16_t)size; 1493 if (size > 0) { 1494 s->ext.scts = OPENSSL_malloc(size); 1495 if (s->ext.scts == NULL 1496 || !PACKET_copy_bytes(pkt, s->ext.scts, size)) { 1497 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1498 ERR_R_INTERNAL_ERROR); 1499 return 0; 1500 } 1501 } 1502 } else { 1503 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 1504 ? ENDPOINT_CLIENT : ENDPOINT_BOTH; 1505 1506 /* 1507 * If we didn't ask for it then there must be a custom extension, 1508 * otherwise this is unsolicited. 1509 */ 1510 if (custom_ext_find(&s->cert->custext, role, 1511 TLSEXT_TYPE_signed_certificate_timestamp, 1512 NULL) == NULL) { 1513 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SCT, 1514 SSL_R_BAD_EXTENSION); 1515 return 0; 1516 } 1517 1518 if (!custom_ext_parse(s, context, 1519 TLSEXT_TYPE_signed_certificate_timestamp, 1520 PACKET_data(pkt), PACKET_remaining(pkt), 1521 x, chainidx)) { 1522 /* SSLfatal already called */ 1523 return 0; 1524 } 1525 } 1526 1527 return 1; 1528 } 1529 #endif 1530 1531 1532 #ifndef OPENSSL_NO_NEXTPROTONEG 1533 /* 1534 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1535 * elements of zero length are allowed and the set of elements must exactly 1536 * fill the length of the block. Returns 1 on success or 0 on failure. 1537 */ 1538 static int ssl_next_proto_validate(SSL *s, PACKET *pkt) 1539 { 1540 PACKET tmp_protocol; 1541 1542 while (PACKET_remaining(pkt)) { 1543 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol) 1544 || PACKET_remaining(&tmp_protocol) == 0) { 1545 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_NEXT_PROTO_VALIDATE, 1546 SSL_R_BAD_EXTENSION); 1547 return 0; 1548 } 1549 } 1550 1551 return 1; 1552 } 1553 1554 int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1555 size_t chainidx) 1556 { 1557 unsigned char *selected; 1558 unsigned char selected_len; 1559 PACKET tmppkt; 1560 1561 /* Check if we are in a renegotiation. If so ignore this extension */ 1562 if (!SSL_IS_FIRST_HANDSHAKE(s)) 1563 return 1; 1564 1565 /* We must have requested it. */ 1566 if (s->ctx->ext.npn_select_cb == NULL) { 1567 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_NPN, 1568 SSL_R_BAD_EXTENSION); 1569 return 0; 1570 } 1571 1572 /* The data must be valid */ 1573 tmppkt = *pkt; 1574 if (!ssl_next_proto_validate(s, &tmppkt)) { 1575 /* SSLfatal() already called */ 1576 return 0; 1577 } 1578 if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len, 1579 PACKET_data(pkt), 1580 PACKET_remaining(pkt), 1581 s->ctx->ext.npn_select_cb_arg) != 1582 SSL_TLSEXT_ERR_OK) { 1583 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_NPN, 1584 SSL_R_BAD_EXTENSION); 1585 return 0; 1586 } 1587 1588 /* 1589 * Could be non-NULL if server has sent multiple NPN extensions in 1590 * a single Serverhello 1591 */ 1592 OPENSSL_free(s->ext.npn); 1593 s->ext.npn = OPENSSL_malloc(selected_len); 1594 if (s->ext.npn == NULL) { 1595 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_NPN, 1596 ERR_R_INTERNAL_ERROR); 1597 return 0; 1598 } 1599 1600 memcpy(s->ext.npn, selected, selected_len); 1601 s->ext.npn_len = selected_len; 1602 s->s3->npn_seen = 1; 1603 1604 return 1; 1605 } 1606 #endif 1607 1608 int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1609 size_t chainidx) 1610 { 1611 size_t len; 1612 1613 /* We must have requested it. */ 1614 if (!s->s3->alpn_sent) { 1615 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_ALPN, 1616 SSL_R_BAD_EXTENSION); 1617 return 0; 1618 } 1619 /*- 1620 * The extension data consists of: 1621 * uint16 list_length 1622 * uint8 proto_length; 1623 * uint8 proto[proto_length]; 1624 */ 1625 if (!PACKET_get_net_2_len(pkt, &len) 1626 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len) 1627 || PACKET_remaining(pkt) != len) { 1628 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1629 SSL_R_BAD_EXTENSION); 1630 return 0; 1631 } 1632 OPENSSL_free(s->s3->alpn_selected); 1633 s->s3->alpn_selected = OPENSSL_malloc(len); 1634 if (s->s3->alpn_selected == NULL) { 1635 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1636 ERR_R_INTERNAL_ERROR); 1637 return 0; 1638 } 1639 if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) { 1640 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1641 SSL_R_BAD_EXTENSION); 1642 return 0; 1643 } 1644 s->s3->alpn_selected_len = len; 1645 1646 if (s->session->ext.alpn_selected == NULL 1647 || s->session->ext.alpn_selected_len != len 1648 || memcmp(s->session->ext.alpn_selected, s->s3->alpn_selected, len) 1649 != 0) { 1650 /* ALPN not consistent with the old session so cannot use early_data */ 1651 s->ext.early_data_ok = 0; 1652 } 1653 if (!s->hit) { 1654 /* 1655 * This is a new session and so alpn_selected should have been 1656 * initialised to NULL. We should update it with the selected ALPN. 1657 */ 1658 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { 1659 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1660 ERR_R_INTERNAL_ERROR); 1661 return 0; 1662 } 1663 s->session->ext.alpn_selected = 1664 OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); 1665 if (s->session->ext.alpn_selected == NULL) { 1666 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1667 ERR_R_INTERNAL_ERROR); 1668 return 0; 1669 } 1670 s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; 1671 } 1672 1673 return 1; 1674 } 1675 1676 #ifndef OPENSSL_NO_SRTP 1677 int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1678 size_t chainidx) 1679 { 1680 unsigned int id, ct, mki; 1681 int i; 1682 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1683 SRTP_PROTECTION_PROFILE *prof; 1684 1685 if (!PACKET_get_net_2(pkt, &ct) || ct != 2 1686 || !PACKET_get_net_2(pkt, &id) 1687 || !PACKET_get_1(pkt, &mki) 1688 || PACKET_remaining(pkt) != 0) { 1689 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1690 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1691 return 0; 1692 } 1693 1694 if (mki != 0) { 1695 /* Must be no MKI, since we never offer one */ 1696 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1697 SSL_R_BAD_SRTP_MKI_VALUE); 1698 return 0; 1699 } 1700 1701 /* Throw an error if the server gave us an unsolicited extension */ 1702 clnt = SSL_get_srtp_profiles(s); 1703 if (clnt == NULL) { 1704 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1705 SSL_R_NO_SRTP_PROFILES); 1706 return 0; 1707 } 1708 1709 /* 1710 * Check to see if the server gave us something we support (and 1711 * presumably offered) 1712 */ 1713 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) { 1714 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 1715 1716 if (prof->id == id) { 1717 s->srtp_profile = prof; 1718 return 1; 1719 } 1720 } 1721 1722 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1723 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1724 return 0; 1725 } 1726 #endif 1727 1728 int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1729 size_t chainidx) 1730 { 1731 /* Ignore if inappropriate ciphersuite */ 1732 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 1733 && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD 1734 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4) 1735 s->ext.use_etm = 1; 1736 1737 return 1; 1738 } 1739 1740 int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1741 size_t chainidx) 1742 { 1743 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS; 1744 if (!s->hit) 1745 s->session->flags |= SSL_SESS_FLAG_EXTMS; 1746 1747 return 1; 1748 } 1749 1750 int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context, 1751 X509 *x, size_t chainidx) 1752 { 1753 unsigned int version; 1754 1755 if (!PACKET_get_net_2(pkt, &version) 1756 || PACKET_remaining(pkt) != 0) { 1757 SSLfatal(s, SSL_AD_DECODE_ERROR, 1758 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1759 SSL_R_LENGTH_MISMATCH); 1760 return 0; 1761 } 1762 1763 /* 1764 * The only protocol version we support which is valid in this extension in 1765 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else. 1766 */ 1767 if (version != TLS1_3_VERSION) { 1768 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1769 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1770 SSL_R_BAD_PROTOCOL_VERSION_NUMBER); 1771 return 0; 1772 } 1773 1774 /* We ignore this extension for HRRs except to sanity check it */ 1775 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) 1776 return 1; 1777 1778 /* We just set it here. We validate it in ssl_choose_client_version */ 1779 s->version = version; 1780 1781 return 1; 1782 } 1783 1784 int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1785 size_t chainidx) 1786 { 1787 #ifndef OPENSSL_NO_TLS1_3 1788 unsigned int group_id; 1789 PACKET encoded_pt; 1790 EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL; 1791 1792 /* Sanity check */ 1793 if (ckey == NULL || s->s3->peer_tmp != NULL) { 1794 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1795 ERR_R_INTERNAL_ERROR); 1796 return 0; 1797 } 1798 1799 if (!PACKET_get_net_2(pkt, &group_id)) { 1800 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1801 SSL_R_LENGTH_MISMATCH); 1802 return 0; 1803 } 1804 1805 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) { 1806 const uint16_t *pgroups = NULL; 1807 size_t i, num_groups; 1808 1809 if (PACKET_remaining(pkt) != 0) { 1810 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1811 SSL_R_LENGTH_MISMATCH); 1812 return 0; 1813 } 1814 1815 /* 1816 * It is an error if the HelloRetryRequest wants a key_share that we 1817 * already sent in the first ClientHello 1818 */ 1819 if (group_id == s->s3->group_id) { 1820 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1821 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1822 return 0; 1823 } 1824 1825 /* Validate the selected group is one we support */ 1826 tls1_get_supported_groups(s, &pgroups, &num_groups); 1827 for (i = 0; i < num_groups; i++) { 1828 if (group_id == pgroups[i]) 1829 break; 1830 } 1831 if (i >= num_groups 1832 || !tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) { 1833 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1834 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1835 return 0; 1836 } 1837 1838 s->s3->group_id = group_id; 1839 EVP_PKEY_free(s->s3->tmp.pkey); 1840 s->s3->tmp.pkey = NULL; 1841 return 1; 1842 } 1843 1844 if (group_id != s->s3->group_id) { 1845 /* 1846 * This isn't for the group that we sent in the original 1847 * key_share! 1848 */ 1849 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1850 SSL_R_BAD_KEY_SHARE); 1851 return 0; 1852 } 1853 1854 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt) 1855 || PACKET_remaining(&encoded_pt) == 0) { 1856 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1857 SSL_R_LENGTH_MISMATCH); 1858 return 0; 1859 } 1860 1861 skey = EVP_PKEY_new(); 1862 if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) { 1863 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1864 ERR_R_MALLOC_FAILURE); 1865 return 0; 1866 } 1867 if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), 1868 PACKET_remaining(&encoded_pt))) { 1869 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1870 SSL_R_BAD_ECPOINT); 1871 EVP_PKEY_free(skey); 1872 return 0; 1873 } 1874 1875 if (ssl_derive(s, ckey, skey, 1) == 0) { 1876 /* SSLfatal() already called */ 1877 EVP_PKEY_free(skey); 1878 return 0; 1879 } 1880 s->s3->peer_tmp = skey; 1881 #endif 1882 1883 return 1; 1884 } 1885 1886 int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1887 size_t chainidx) 1888 { 1889 PACKET cookie; 1890 1891 if (!PACKET_as_length_prefixed_2(pkt, &cookie) 1892 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie, 1893 &s->ext.tls13_cookie_len)) { 1894 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_COOKIE, 1895 SSL_R_LENGTH_MISMATCH); 1896 return 0; 1897 } 1898 1899 return 1; 1900 } 1901 1902 int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context, 1903 X509 *x, size_t chainidx) 1904 { 1905 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { 1906 unsigned long max_early_data; 1907 1908 if (!PACKET_get_net_4(pkt, &max_early_data) 1909 || PACKET_remaining(pkt) != 0) { 1910 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1911 SSL_R_INVALID_MAX_EARLY_DATA); 1912 return 0; 1913 } 1914 1915 s->session->ext.max_early_data = max_early_data; 1916 1917 return 1; 1918 } 1919 1920 if (PACKET_remaining(pkt) != 0) { 1921 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1922 SSL_R_BAD_EXTENSION); 1923 return 0; 1924 } 1925 1926 if (!s->ext.early_data_ok 1927 || !s->hit) { 1928 /* 1929 * If we get here then we didn't send early data, or we didn't resume 1930 * using the first identity, or the SNI/ALPN is not consistent so the 1931 * server should not be accepting it. 1932 */ 1933 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1934 SSL_R_BAD_EXTENSION); 1935 return 0; 1936 } 1937 1938 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; 1939 1940 return 1; 1941 } 1942 1943 int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1944 size_t chainidx) 1945 { 1946 #ifndef OPENSSL_NO_TLS1_3 1947 unsigned int identity; 1948 1949 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) { 1950 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1951 SSL_R_LENGTH_MISMATCH); 1952 return 0; 1953 } 1954 1955 if (identity >= (unsigned int)s->ext.tick_identity) { 1956 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, 1957 SSL_R_BAD_PSK_IDENTITY); 1958 return 0; 1959 } 1960 1961 /* 1962 * Session resumption tickets are always sent before PSK tickets. If the 1963 * ticket index is 0 then it must be for a session resumption ticket if we 1964 * sent two tickets, or if we didn't send a PSK ticket. 1965 */ 1966 if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) { 1967 s->hit = 1; 1968 SSL_SESSION_free(s->psksession); 1969 s->psksession = NULL; 1970 return 1; 1971 } 1972 1973 if (s->psksession == NULL) { 1974 /* Should never happen */ 1975 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1976 ERR_R_INTERNAL_ERROR); 1977 return 0; 1978 } 1979 1980 /* 1981 * If we used the external PSK for sending early_data then s->early_secret 1982 * is already set up, so don't overwrite it. Otherwise we copy the 1983 * early_secret across that we generated earlier. 1984 */ 1985 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 1986 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 1987 || s->session->ext.max_early_data > 0 1988 || s->psksession->ext.max_early_data == 0) 1989 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE); 1990 1991 SSL_SESSION_free(s->session); 1992 s->session = s->psksession; 1993 s->psksession = NULL; 1994 s->hit = 1; 1995 /* Early data is only allowed if we used the first ticket */ 1996 if (identity != 0) 1997 s->ext.early_data_ok = 0; 1998 #endif 1999 2000 return 1; 2001 } 2002