1 /* 2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved 4 * Copyright 2005 Nokia. All rights reserved. 5 * 6 * Licensed under the OpenSSL license (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include <stdio.h> 13 #include <time.h> 14 #include <assert.h> 15 #include "../ssl_local.h" 16 #include "statem_local.h" 17 #include <openssl/buffer.h> 18 #include <openssl/rand.h> 19 #include <openssl/objects.h> 20 #include <openssl/evp.h> 21 #include <openssl/md5.h> 22 #include <openssl/dh.h> 23 #include <openssl/bn.h> 24 #include <openssl/engine.h> 25 #include <internal/cryptlib.h> 26 27 static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt); 28 static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt); 29 30 static ossl_inline int cert_req_allowed(SSL *s); 31 static int key_exchange_expected(SSL *s); 32 static int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, 33 WPACKET *pkt); 34 35 /* 36 * Is a CertificateRequest message allowed at the moment or not? 37 * 38 * Return values are: 39 * 1: Yes 40 * 0: No 41 */ 42 static ossl_inline int cert_req_allowed(SSL *s) 43 { 44 /* TLS does not like anon-DH with client cert */ 45 if ((s->version > SSL3_VERSION 46 && (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)) 47 || (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK))) 48 return 0; 49 50 return 1; 51 } 52 53 /* 54 * Should we expect the ServerKeyExchange message or not? 55 * 56 * Return values are: 57 * 1: Yes 58 * 0: No 59 */ 60 static int key_exchange_expected(SSL *s) 61 { 62 long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 63 64 /* 65 * Can't skip server key exchange if this is an ephemeral 66 * ciphersuite or for SRP 67 */ 68 if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK 69 | SSL_kSRP)) { 70 return 1; 71 } 72 73 return 0; 74 } 75 76 /* 77 * ossl_statem_client_read_transition() encapsulates the logic for the allowed 78 * handshake state transitions when a TLS1.3 client is reading messages from the 79 * server. The message type that the server has sent is provided in |mt|. The 80 * current state is in |s->statem.hand_state|. 81 * 82 * Return values are 1 for success (transition allowed) and 0 on error 83 * (transition not allowed) 84 */ 85 static int ossl_statem_client13_read_transition(SSL *s, int mt) 86 { 87 OSSL_STATEM *st = &s->statem; 88 89 /* 90 * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't 91 * yet negotiated TLSv1.3 at that point so that is handled by 92 * ossl_statem_client_read_transition() 93 */ 94 95 switch (st->hand_state) { 96 default: 97 break; 98 99 case TLS_ST_CW_CLNT_HELLO: 100 /* 101 * This must a ClientHello following a HelloRetryRequest, so the only 102 * thing we can get now is a ServerHello. 103 */ 104 if (mt == SSL3_MT_SERVER_HELLO) { 105 st->hand_state = TLS_ST_CR_SRVR_HELLO; 106 return 1; 107 } 108 break; 109 110 case TLS_ST_CR_SRVR_HELLO: 111 if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) { 112 st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS; 113 return 1; 114 } 115 break; 116 117 case TLS_ST_CR_ENCRYPTED_EXTENSIONS: 118 if (s->hit) { 119 if (mt == SSL3_MT_FINISHED) { 120 st->hand_state = TLS_ST_CR_FINISHED; 121 return 1; 122 } 123 } else { 124 if (mt == SSL3_MT_CERTIFICATE_REQUEST) { 125 st->hand_state = TLS_ST_CR_CERT_REQ; 126 return 1; 127 } 128 if (mt == SSL3_MT_CERTIFICATE) { 129 st->hand_state = TLS_ST_CR_CERT; 130 return 1; 131 } 132 } 133 break; 134 135 case TLS_ST_CR_CERT_REQ: 136 if (mt == SSL3_MT_CERTIFICATE) { 137 st->hand_state = TLS_ST_CR_CERT; 138 return 1; 139 } 140 break; 141 142 case TLS_ST_CR_CERT: 143 if (mt == SSL3_MT_CERTIFICATE_VERIFY) { 144 st->hand_state = TLS_ST_CR_CERT_VRFY; 145 return 1; 146 } 147 break; 148 149 case TLS_ST_CR_CERT_VRFY: 150 if (mt == SSL3_MT_FINISHED) { 151 st->hand_state = TLS_ST_CR_FINISHED; 152 return 1; 153 } 154 break; 155 156 case TLS_ST_OK: 157 if (mt == SSL3_MT_NEWSESSION_TICKET) { 158 st->hand_state = TLS_ST_CR_SESSION_TICKET; 159 return 1; 160 } 161 if (mt == SSL3_MT_KEY_UPDATE) { 162 st->hand_state = TLS_ST_CR_KEY_UPDATE; 163 return 1; 164 } 165 if (mt == SSL3_MT_CERTIFICATE_REQUEST) { 166 #if DTLS_MAX_VERSION != DTLS1_2_VERSION 167 # error TODO(DTLS1.3): Restore digest for PHA before adding message. 168 #endif 169 if (!SSL_IS_DTLS(s) && s->post_handshake_auth == SSL_PHA_EXT_SENT) { 170 s->post_handshake_auth = SSL_PHA_REQUESTED; 171 /* 172 * In TLS, this is called before the message is added to the 173 * digest. In DTLS, this is expected to be called after adding 174 * to the digest. Either move the digest restore, or add the 175 * message here after the swap, or do it after the clientFinished? 176 */ 177 if (!tls13_restore_handshake_digest_for_pha(s)) { 178 /* SSLfatal() already called */ 179 return 0; 180 } 181 st->hand_state = TLS_ST_CR_CERT_REQ; 182 return 1; 183 } 184 } 185 break; 186 } 187 188 /* No valid transition found */ 189 return 0; 190 } 191 192 /* 193 * ossl_statem_client_read_transition() encapsulates the logic for the allowed 194 * handshake state transitions when the client is reading messages from the 195 * server. The message type that the server has sent is provided in |mt|. The 196 * current state is in |s->statem.hand_state|. 197 * 198 * Return values are 1 for success (transition allowed) and 0 on error 199 * (transition not allowed) 200 */ 201 int ossl_statem_client_read_transition(SSL *s, int mt) 202 { 203 OSSL_STATEM *st = &s->statem; 204 int ske_expected; 205 206 /* 207 * Note that after writing the first ClientHello we don't know what version 208 * we are going to negotiate yet, so we don't take this branch until later. 209 */ 210 if (SSL_IS_TLS13(s)) { 211 if (!ossl_statem_client13_read_transition(s, mt)) 212 goto err; 213 return 1; 214 } 215 216 switch (st->hand_state) { 217 default: 218 break; 219 220 case TLS_ST_CW_CLNT_HELLO: 221 if (mt == SSL3_MT_SERVER_HELLO) { 222 st->hand_state = TLS_ST_CR_SRVR_HELLO; 223 return 1; 224 } 225 226 if (SSL_IS_DTLS(s)) { 227 if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { 228 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; 229 return 1; 230 } 231 } 232 break; 233 234 case TLS_ST_EARLY_DATA: 235 /* 236 * We've not actually selected TLSv1.3 yet, but we have sent early 237 * data. The only thing allowed now is a ServerHello or a 238 * HelloRetryRequest. 239 */ 240 if (mt == SSL3_MT_SERVER_HELLO) { 241 st->hand_state = TLS_ST_CR_SRVR_HELLO; 242 return 1; 243 } 244 break; 245 246 case TLS_ST_CR_SRVR_HELLO: 247 if (s->hit) { 248 if (s->ext.ticket_expected) { 249 if (mt == SSL3_MT_NEWSESSION_TICKET) { 250 st->hand_state = TLS_ST_CR_SESSION_TICKET; 251 return 1; 252 } 253 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 254 st->hand_state = TLS_ST_CR_CHANGE; 255 return 1; 256 } 257 } else { 258 if (SSL_IS_DTLS(s) && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { 259 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; 260 return 1; 261 } else if (s->version >= TLS1_VERSION 262 && s->ext.session_secret_cb != NULL 263 && s->session->ext.tick != NULL 264 && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 265 /* 266 * Normally, we can tell if the server is resuming the session 267 * from the session ID. EAP-FAST (RFC 4851), however, relies on 268 * the next server message after the ServerHello to determine if 269 * the server is resuming. 270 */ 271 s->hit = 1; 272 st->hand_state = TLS_ST_CR_CHANGE; 273 return 1; 274 } else if (!(s->s3->tmp.new_cipher->algorithm_auth 275 & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) { 276 if (mt == SSL3_MT_CERTIFICATE) { 277 st->hand_state = TLS_ST_CR_CERT; 278 return 1; 279 } 280 } else { 281 ske_expected = key_exchange_expected(s); 282 /* SKE is optional for some PSK ciphersuites */ 283 if (ske_expected 284 || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK) 285 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) { 286 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) { 287 st->hand_state = TLS_ST_CR_KEY_EXCH; 288 return 1; 289 } 290 } else if (mt == SSL3_MT_CERTIFICATE_REQUEST 291 && cert_req_allowed(s)) { 292 st->hand_state = TLS_ST_CR_CERT_REQ; 293 return 1; 294 } else if (mt == SSL3_MT_SERVER_DONE) { 295 st->hand_state = TLS_ST_CR_SRVR_DONE; 296 return 1; 297 } 298 } 299 } 300 break; 301 302 case TLS_ST_CR_CERT: 303 /* 304 * The CertificateStatus message is optional even if 305 * |ext.status_expected| is set 306 */ 307 if (s->ext.status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) { 308 st->hand_state = TLS_ST_CR_CERT_STATUS; 309 return 1; 310 } 311 /* Fall through */ 312 313 case TLS_ST_CR_CERT_STATUS: 314 ske_expected = key_exchange_expected(s); 315 /* SKE is optional for some PSK ciphersuites */ 316 if (ske_expected || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK) 317 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) { 318 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) { 319 st->hand_state = TLS_ST_CR_KEY_EXCH; 320 return 1; 321 } 322 goto err; 323 } 324 /* Fall through */ 325 326 case TLS_ST_CR_KEY_EXCH: 327 if (mt == SSL3_MT_CERTIFICATE_REQUEST) { 328 if (cert_req_allowed(s)) { 329 st->hand_state = TLS_ST_CR_CERT_REQ; 330 return 1; 331 } 332 goto err; 333 } 334 /* Fall through */ 335 336 case TLS_ST_CR_CERT_REQ: 337 if (mt == SSL3_MT_SERVER_DONE) { 338 st->hand_state = TLS_ST_CR_SRVR_DONE; 339 return 1; 340 } 341 break; 342 343 case TLS_ST_CW_FINISHED: 344 if (s->ext.ticket_expected) { 345 if (mt == SSL3_MT_NEWSESSION_TICKET) { 346 st->hand_state = TLS_ST_CR_SESSION_TICKET; 347 return 1; 348 } 349 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 350 st->hand_state = TLS_ST_CR_CHANGE; 351 return 1; 352 } 353 break; 354 355 case TLS_ST_CR_SESSION_TICKET: 356 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 357 st->hand_state = TLS_ST_CR_CHANGE; 358 return 1; 359 } 360 break; 361 362 case TLS_ST_CR_CHANGE: 363 if (mt == SSL3_MT_FINISHED) { 364 st->hand_state = TLS_ST_CR_FINISHED; 365 return 1; 366 } 367 break; 368 369 case TLS_ST_OK: 370 if (mt == SSL3_MT_HELLO_REQUEST) { 371 st->hand_state = TLS_ST_CR_HELLO_REQ; 372 return 1; 373 } 374 break; 375 } 376 377 err: 378 /* No valid transition found */ 379 if (SSL_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 380 BIO *rbio; 381 382 /* 383 * CCS messages don't have a message sequence number so this is probably 384 * because of an out-of-order CCS. We'll just drop it. 385 */ 386 s->init_num = 0; 387 s->rwstate = SSL_READING; 388 rbio = SSL_get_rbio(s); 389 BIO_clear_retry_flags(rbio); 390 BIO_set_retry_read(rbio); 391 return 0; 392 } 393 SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE, 394 SSL_F_OSSL_STATEM_CLIENT_READ_TRANSITION, 395 SSL_R_UNEXPECTED_MESSAGE); 396 return 0; 397 } 398 399 /* 400 * ossl_statem_client13_write_transition() works out what handshake state to 401 * move to next when the TLSv1.3 client is writing messages to be sent to the 402 * server. 403 */ 404 static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) 405 { 406 OSSL_STATEM *st = &s->statem; 407 408 /* 409 * Note: There are no cases for TLS_ST_BEFORE because we haven't negotiated 410 * TLSv1.3 yet at that point. They are handled by 411 * ossl_statem_client_write_transition(). 412 */ 413 switch (st->hand_state) { 414 default: 415 /* Shouldn't happen */ 416 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 417 SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION, 418 ERR_R_INTERNAL_ERROR); 419 return WRITE_TRAN_ERROR; 420 421 case TLS_ST_CR_CERT_REQ: 422 if (s->post_handshake_auth == SSL_PHA_REQUESTED) { 423 st->hand_state = TLS_ST_CW_CERT; 424 return WRITE_TRAN_CONTINUE; 425 } 426 /* 427 * We should only get here if we received a CertificateRequest after 428 * we already sent close_notify 429 */ 430 if (!ossl_assert((s->shutdown & SSL_SENT_SHUTDOWN) != 0)) { 431 /* Shouldn't happen - same as default case */ 432 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 433 SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION, 434 ERR_R_INTERNAL_ERROR); 435 return WRITE_TRAN_ERROR; 436 } 437 st->hand_state = TLS_ST_OK; 438 return WRITE_TRAN_CONTINUE; 439 440 case TLS_ST_CR_FINISHED: 441 if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY 442 || s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING) 443 st->hand_state = TLS_ST_PENDING_EARLY_DATA_END; 444 else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 445 && s->hello_retry_request == SSL_HRR_NONE) 446 st->hand_state = TLS_ST_CW_CHANGE; 447 else 448 st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT 449 : TLS_ST_CW_FINISHED; 450 return WRITE_TRAN_CONTINUE; 451 452 case TLS_ST_PENDING_EARLY_DATA_END: 453 if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { 454 st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA; 455 return WRITE_TRAN_CONTINUE; 456 } 457 /* Fall through */ 458 459 case TLS_ST_CW_END_OF_EARLY_DATA: 460 case TLS_ST_CW_CHANGE: 461 st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT 462 : TLS_ST_CW_FINISHED; 463 return WRITE_TRAN_CONTINUE; 464 465 case TLS_ST_CW_CERT: 466 /* If a non-empty Certificate we also send CertificateVerify */ 467 st->hand_state = (s->s3->tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY 468 : TLS_ST_CW_FINISHED; 469 return WRITE_TRAN_CONTINUE; 470 471 case TLS_ST_CW_CERT_VRFY: 472 st->hand_state = TLS_ST_CW_FINISHED; 473 return WRITE_TRAN_CONTINUE; 474 475 case TLS_ST_CR_KEY_UPDATE: 476 case TLS_ST_CW_KEY_UPDATE: 477 case TLS_ST_CR_SESSION_TICKET: 478 case TLS_ST_CW_FINISHED: 479 st->hand_state = TLS_ST_OK; 480 return WRITE_TRAN_CONTINUE; 481 482 case TLS_ST_OK: 483 if (s->key_update != SSL_KEY_UPDATE_NONE) { 484 st->hand_state = TLS_ST_CW_KEY_UPDATE; 485 return WRITE_TRAN_CONTINUE; 486 } 487 488 /* Try to read from the server instead */ 489 return WRITE_TRAN_FINISHED; 490 } 491 } 492 493 /* 494 * ossl_statem_client_write_transition() works out what handshake state to 495 * move to next when the client is writing messages to be sent to the server. 496 */ 497 WRITE_TRAN ossl_statem_client_write_transition(SSL *s) 498 { 499 OSSL_STATEM *st = &s->statem; 500 501 /* 502 * Note that immediately before/after a ClientHello we don't know what 503 * version we are going to negotiate yet, so we don't take this branch until 504 * later 505 */ 506 if (SSL_IS_TLS13(s)) 507 return ossl_statem_client13_write_transition(s); 508 509 switch (st->hand_state) { 510 default: 511 /* Shouldn't happen */ 512 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 513 SSL_F_OSSL_STATEM_CLIENT_WRITE_TRANSITION, 514 ERR_R_INTERNAL_ERROR); 515 return WRITE_TRAN_ERROR; 516 517 case TLS_ST_OK: 518 if (!s->renegotiate) { 519 /* 520 * We haven't requested a renegotiation ourselves so we must have 521 * received a message from the server. Better read it. 522 */ 523 return WRITE_TRAN_FINISHED; 524 } 525 /* Renegotiation */ 526 /* fall thru */ 527 case TLS_ST_BEFORE: 528 st->hand_state = TLS_ST_CW_CLNT_HELLO; 529 return WRITE_TRAN_CONTINUE; 530 531 case TLS_ST_CW_CLNT_HELLO: 532 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) { 533 /* 534 * We are assuming this is a TLSv1.3 connection, although we haven't 535 * actually selected a version yet. 536 */ 537 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) 538 st->hand_state = TLS_ST_CW_CHANGE; 539 else 540 st->hand_state = TLS_ST_EARLY_DATA; 541 return WRITE_TRAN_CONTINUE; 542 } 543 /* 544 * No transition at the end of writing because we don't know what 545 * we will be sent 546 */ 547 return WRITE_TRAN_FINISHED; 548 549 case TLS_ST_CR_SRVR_HELLO: 550 /* 551 * We only get here in TLSv1.3. We just received an HRR, so issue a 552 * CCS unless middlebox compat mode is off, or we already issued one 553 * because we did early data. 554 */ 555 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 556 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 557 st->hand_state = TLS_ST_CW_CHANGE; 558 else 559 st->hand_state = TLS_ST_CW_CLNT_HELLO; 560 return WRITE_TRAN_CONTINUE; 561 562 case TLS_ST_EARLY_DATA: 563 return WRITE_TRAN_FINISHED; 564 565 case DTLS_ST_CR_HELLO_VERIFY_REQUEST: 566 st->hand_state = TLS_ST_CW_CLNT_HELLO; 567 return WRITE_TRAN_CONTINUE; 568 569 case TLS_ST_CR_SRVR_DONE: 570 if (s->s3->tmp.cert_req) 571 st->hand_state = TLS_ST_CW_CERT; 572 else 573 st->hand_state = TLS_ST_CW_KEY_EXCH; 574 return WRITE_TRAN_CONTINUE; 575 576 case TLS_ST_CW_CERT: 577 st->hand_state = TLS_ST_CW_KEY_EXCH; 578 return WRITE_TRAN_CONTINUE; 579 580 case TLS_ST_CW_KEY_EXCH: 581 /* 582 * For TLS, cert_req is set to 2, so a cert chain of nothing is 583 * sent, but no verify packet is sent 584 */ 585 /* 586 * XXX: For now, we do not support client authentication in ECDH 587 * cipher suites with ECDH (rather than ECDSA) certificates. We 588 * need to skip the certificate verify message when client's 589 * ECDH public key is sent inside the client certificate. 590 */ 591 if (s->s3->tmp.cert_req == 1) { 592 st->hand_state = TLS_ST_CW_CERT_VRFY; 593 } else { 594 st->hand_state = TLS_ST_CW_CHANGE; 595 } 596 if (s->s3->flags & TLS1_FLAGS_SKIP_CERT_VERIFY) { 597 st->hand_state = TLS_ST_CW_CHANGE; 598 } 599 return WRITE_TRAN_CONTINUE; 600 601 case TLS_ST_CW_CERT_VRFY: 602 st->hand_state = TLS_ST_CW_CHANGE; 603 return WRITE_TRAN_CONTINUE; 604 605 case TLS_ST_CW_CHANGE: 606 if (s->hello_retry_request == SSL_HRR_PENDING) { 607 st->hand_state = TLS_ST_CW_CLNT_HELLO; 608 } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) { 609 st->hand_state = TLS_ST_EARLY_DATA; 610 } else { 611 #if defined(OPENSSL_NO_NEXTPROTONEG) 612 st->hand_state = TLS_ST_CW_FINISHED; 613 #else 614 if (!SSL_IS_DTLS(s) && s->s3->npn_seen) 615 st->hand_state = TLS_ST_CW_NEXT_PROTO; 616 else 617 st->hand_state = TLS_ST_CW_FINISHED; 618 #endif 619 } 620 return WRITE_TRAN_CONTINUE; 621 622 #if !defined(OPENSSL_NO_NEXTPROTONEG) 623 case TLS_ST_CW_NEXT_PROTO: 624 st->hand_state = TLS_ST_CW_FINISHED; 625 return WRITE_TRAN_CONTINUE; 626 #endif 627 628 case TLS_ST_CW_FINISHED: 629 if (s->hit) { 630 st->hand_state = TLS_ST_OK; 631 return WRITE_TRAN_CONTINUE; 632 } else { 633 return WRITE_TRAN_FINISHED; 634 } 635 636 case TLS_ST_CR_FINISHED: 637 if (s->hit) { 638 st->hand_state = TLS_ST_CW_CHANGE; 639 return WRITE_TRAN_CONTINUE; 640 } else { 641 st->hand_state = TLS_ST_OK; 642 return WRITE_TRAN_CONTINUE; 643 } 644 645 case TLS_ST_CR_HELLO_REQ: 646 /* 647 * If we can renegotiate now then do so, otherwise wait for a more 648 * convenient time. 649 */ 650 if (ssl3_renegotiate_check(s, 1)) { 651 if (!tls_setup_handshake(s)) { 652 /* SSLfatal() already called */ 653 return WRITE_TRAN_ERROR; 654 } 655 st->hand_state = TLS_ST_CW_CLNT_HELLO; 656 return WRITE_TRAN_CONTINUE; 657 } 658 st->hand_state = TLS_ST_OK; 659 return WRITE_TRAN_CONTINUE; 660 } 661 } 662 663 /* 664 * Perform any pre work that needs to be done prior to sending a message from 665 * the client to the server. 666 */ 667 WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst) 668 { 669 OSSL_STATEM *st = &s->statem; 670 671 switch (st->hand_state) { 672 default: 673 /* No pre work to be done */ 674 break; 675 676 case TLS_ST_CW_CLNT_HELLO: 677 s->shutdown = 0; 678 if (SSL_IS_DTLS(s)) { 679 /* every DTLS ClientHello resets Finished MAC */ 680 if (!ssl3_init_finished_mac(s)) { 681 /* SSLfatal() already called */ 682 return WORK_ERROR; 683 } 684 } 685 break; 686 687 case TLS_ST_CW_CHANGE: 688 if (SSL_IS_DTLS(s)) { 689 if (s->hit) { 690 /* 691 * We're into the last flight so we don't retransmit these 692 * messages unless we need to. 693 */ 694 st->use_timer = 0; 695 } 696 #ifndef OPENSSL_NO_SCTP 697 if (BIO_dgram_is_sctp(SSL_get_wbio(s))) { 698 /* Calls SSLfatal() as required */ 699 return dtls_wait_for_dry(s); 700 } 701 #endif 702 } 703 break; 704 705 case TLS_ST_PENDING_EARLY_DATA_END: 706 /* 707 * If we've been called by SSL_do_handshake()/SSL_write(), or we did not 708 * attempt to write early data before calling SSL_read() then we press 709 * on with the handshake. Otherwise we pause here. 710 */ 711 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING 712 || s->early_data_state == SSL_EARLY_DATA_NONE) 713 return WORK_FINISHED_CONTINUE; 714 /* Fall through */ 715 716 case TLS_ST_EARLY_DATA: 717 return tls_finish_handshake(s, wst, 0, 1); 718 719 case TLS_ST_OK: 720 /* Calls SSLfatal() as required */ 721 return tls_finish_handshake(s, wst, 1, 1); 722 } 723 724 return WORK_FINISHED_CONTINUE; 725 } 726 727 /* 728 * Perform any work that needs to be done after sending a message from the 729 * client to the server. 730 */ 731 WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) 732 { 733 OSSL_STATEM *st = &s->statem; 734 735 s->init_num = 0; 736 737 switch (st->hand_state) { 738 default: 739 /* No post work to be done */ 740 break; 741 742 case TLS_ST_CW_CLNT_HELLO: 743 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING 744 && s->max_early_data > 0) { 745 /* 746 * We haven't selected TLSv1.3 yet so we don't call the change 747 * cipher state function associated with the SSL_METHOD. Instead 748 * we call tls13_change_cipher_state() directly. 749 */ 750 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0) { 751 if (!tls13_change_cipher_state(s, 752 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 753 /* SSLfatal() already called */ 754 return WORK_ERROR; 755 } 756 } 757 /* else we're in compat mode so we delay flushing until after CCS */ 758 } else if (!statem_flush(s)) { 759 return WORK_MORE_A; 760 } 761 762 if (SSL_IS_DTLS(s)) { 763 /* Treat the next message as the first packet */ 764 s->first_packet = 1; 765 } 766 break; 767 768 case TLS_ST_CW_END_OF_EARLY_DATA: 769 /* 770 * We set the enc_write_ctx back to NULL because we may end up writing 771 * in cleartext again if we get a HelloRetryRequest from the server. 772 */ 773 EVP_CIPHER_CTX_free(s->enc_write_ctx); 774 s->enc_write_ctx = NULL; 775 break; 776 777 case TLS_ST_CW_KEY_EXCH: 778 if (tls_client_key_exchange_post_work(s) == 0) { 779 /* SSLfatal() already called */ 780 return WORK_ERROR; 781 } 782 break; 783 784 case TLS_ST_CW_CHANGE: 785 if (SSL_IS_TLS13(s) || s->hello_retry_request == SSL_HRR_PENDING) 786 break; 787 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING 788 && s->max_early_data > 0) { 789 /* 790 * We haven't selected TLSv1.3 yet so we don't call the change 791 * cipher state function associated with the SSL_METHOD. Instead 792 * we call tls13_change_cipher_state() directly. 793 */ 794 if (!tls13_change_cipher_state(s, 795 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) 796 return WORK_ERROR; 797 break; 798 } 799 s->session->cipher = s->s3->tmp.new_cipher; 800 #ifdef OPENSSL_NO_COMP 801 s->session->compress_meth = 0; 802 #else 803 if (s->s3->tmp.new_compression == NULL) 804 s->session->compress_meth = 0; 805 else 806 s->session->compress_meth = s->s3->tmp.new_compression->id; 807 #endif 808 if (!s->method->ssl3_enc->setup_key_block(s)) { 809 /* SSLfatal() already called */ 810 return WORK_ERROR; 811 } 812 813 if (!s->method->ssl3_enc->change_cipher_state(s, 814 SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 815 /* SSLfatal() already called */ 816 return WORK_ERROR; 817 } 818 819 if (SSL_IS_DTLS(s)) { 820 #ifndef OPENSSL_NO_SCTP 821 if (s->hit) { 822 /* 823 * Change to new shared key of SCTP-Auth, will be ignored if 824 * no SCTP used. 825 */ 826 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 827 0, NULL); 828 } 829 #endif 830 831 dtls1_reset_seq_numbers(s, SSL3_CC_WRITE); 832 } 833 break; 834 835 case TLS_ST_CW_FINISHED: 836 #ifndef OPENSSL_NO_SCTP 837 if (wst == WORK_MORE_A && SSL_IS_DTLS(s) && s->hit == 0) { 838 /* 839 * Change to new shared key of SCTP-Auth, will be ignored if 840 * no SCTP used. 841 */ 842 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 843 0, NULL); 844 } 845 #endif 846 if (statem_flush(s) != 1) 847 return WORK_MORE_B; 848 849 if (SSL_IS_TLS13(s)) { 850 if (!tls13_save_handshake_digest_for_pha(s)) { 851 /* SSLfatal() already called */ 852 return WORK_ERROR; 853 } 854 if (s->post_handshake_auth != SSL_PHA_REQUESTED) { 855 if (!s->method->ssl3_enc->change_cipher_state(s, 856 SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 857 /* SSLfatal() already called */ 858 return WORK_ERROR; 859 } 860 } 861 } 862 break; 863 864 case TLS_ST_CW_KEY_UPDATE: 865 if (statem_flush(s) != 1) 866 return WORK_MORE_A; 867 if (!tls13_update_key(s, 1)) { 868 /* SSLfatal() already called */ 869 return WORK_ERROR; 870 } 871 break; 872 } 873 874 return WORK_FINISHED_CONTINUE; 875 } 876 877 /* 878 * Get the message construction function and message type for sending from the 879 * client 880 * 881 * Valid return values are: 882 * 1: Success 883 * 0: Error 884 */ 885 int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt, 886 confunc_f *confunc, int *mt) 887 { 888 OSSL_STATEM *st = &s->statem; 889 890 switch (st->hand_state) { 891 default: 892 /* Shouldn't happen */ 893 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 894 SSL_F_OSSL_STATEM_CLIENT_CONSTRUCT_MESSAGE, 895 SSL_R_BAD_HANDSHAKE_STATE); 896 return 0; 897 898 case TLS_ST_CW_CHANGE: 899 if (SSL_IS_DTLS(s)) 900 *confunc = dtls_construct_change_cipher_spec; 901 else 902 *confunc = tls_construct_change_cipher_spec; 903 *mt = SSL3_MT_CHANGE_CIPHER_SPEC; 904 break; 905 906 case TLS_ST_CW_CLNT_HELLO: 907 *confunc = tls_construct_client_hello; 908 *mt = SSL3_MT_CLIENT_HELLO; 909 break; 910 911 case TLS_ST_CW_END_OF_EARLY_DATA: 912 *confunc = tls_construct_end_of_early_data; 913 *mt = SSL3_MT_END_OF_EARLY_DATA; 914 break; 915 916 case TLS_ST_PENDING_EARLY_DATA_END: 917 *confunc = NULL; 918 *mt = SSL3_MT_DUMMY; 919 break; 920 921 case TLS_ST_CW_CERT: 922 *confunc = tls_construct_client_certificate; 923 *mt = SSL3_MT_CERTIFICATE; 924 break; 925 926 case TLS_ST_CW_KEY_EXCH: 927 *confunc = tls_construct_client_key_exchange; 928 *mt = SSL3_MT_CLIENT_KEY_EXCHANGE; 929 break; 930 931 case TLS_ST_CW_CERT_VRFY: 932 *confunc = tls_construct_cert_verify; 933 *mt = SSL3_MT_CERTIFICATE_VERIFY; 934 break; 935 936 #if !defined(OPENSSL_NO_NEXTPROTONEG) 937 case TLS_ST_CW_NEXT_PROTO: 938 *confunc = tls_construct_next_proto; 939 *mt = SSL3_MT_NEXT_PROTO; 940 break; 941 #endif 942 case TLS_ST_CW_FINISHED: 943 *confunc = tls_construct_finished; 944 *mt = SSL3_MT_FINISHED; 945 break; 946 947 case TLS_ST_CW_KEY_UPDATE: 948 *confunc = tls_construct_key_update; 949 *mt = SSL3_MT_KEY_UPDATE; 950 break; 951 } 952 953 return 1; 954 } 955 956 /* 957 * Returns the maximum allowed length for the current message that we are 958 * reading. Excludes the message header. 959 */ 960 size_t ossl_statem_client_max_message_size(SSL *s) 961 { 962 OSSL_STATEM *st = &s->statem; 963 964 switch (st->hand_state) { 965 default: 966 /* Shouldn't happen */ 967 return 0; 968 969 case TLS_ST_CR_SRVR_HELLO: 970 return SERVER_HELLO_MAX_LENGTH; 971 972 case DTLS_ST_CR_HELLO_VERIFY_REQUEST: 973 return HELLO_VERIFY_REQUEST_MAX_LENGTH; 974 975 case TLS_ST_CR_CERT: 976 return s->max_cert_list; 977 978 case TLS_ST_CR_CERT_VRFY: 979 return SSL3_RT_MAX_PLAIN_LENGTH; 980 981 case TLS_ST_CR_CERT_STATUS: 982 return SSL3_RT_MAX_PLAIN_LENGTH; 983 984 case TLS_ST_CR_KEY_EXCH: 985 return SERVER_KEY_EXCH_MAX_LENGTH; 986 987 case TLS_ST_CR_CERT_REQ: 988 /* 989 * Set to s->max_cert_list for compatibility with previous releases. In 990 * practice these messages can get quite long if servers are configured 991 * to provide a long list of acceptable CAs 992 */ 993 return s->max_cert_list; 994 995 case TLS_ST_CR_SRVR_DONE: 996 return SERVER_HELLO_DONE_MAX_LENGTH; 997 998 case TLS_ST_CR_CHANGE: 999 if (s->version == DTLS1_BAD_VER) 1000 return 3; 1001 return CCS_MAX_LENGTH; 1002 1003 case TLS_ST_CR_SESSION_TICKET: 1004 return (SSL_IS_TLS13(s)) ? SESSION_TICKET_MAX_LENGTH_TLS13 1005 : SESSION_TICKET_MAX_LENGTH_TLS12; 1006 1007 case TLS_ST_CR_FINISHED: 1008 return FINISHED_MAX_LENGTH; 1009 1010 case TLS_ST_CR_ENCRYPTED_EXTENSIONS: 1011 return ENCRYPTED_EXTENSIONS_MAX_LENGTH; 1012 1013 case TLS_ST_CR_KEY_UPDATE: 1014 return KEY_UPDATE_MAX_LENGTH; 1015 } 1016 } 1017 1018 /* 1019 * Process a message that the client has been received from the server. 1020 */ 1021 MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt) 1022 { 1023 OSSL_STATEM *st = &s->statem; 1024 1025 switch (st->hand_state) { 1026 default: 1027 /* Shouldn't happen */ 1028 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1029 SSL_F_OSSL_STATEM_CLIENT_PROCESS_MESSAGE, 1030 ERR_R_INTERNAL_ERROR); 1031 return MSG_PROCESS_ERROR; 1032 1033 case TLS_ST_CR_SRVR_HELLO: 1034 return tls_process_server_hello(s, pkt); 1035 1036 case DTLS_ST_CR_HELLO_VERIFY_REQUEST: 1037 return dtls_process_hello_verify(s, pkt); 1038 1039 case TLS_ST_CR_CERT: 1040 return tls_process_server_certificate(s, pkt); 1041 1042 case TLS_ST_CR_CERT_VRFY: 1043 return tls_process_cert_verify(s, pkt); 1044 1045 case TLS_ST_CR_CERT_STATUS: 1046 return tls_process_cert_status(s, pkt); 1047 1048 case TLS_ST_CR_KEY_EXCH: 1049 return tls_process_key_exchange(s, pkt); 1050 1051 case TLS_ST_CR_CERT_REQ: 1052 return tls_process_certificate_request(s, pkt); 1053 1054 case TLS_ST_CR_SRVR_DONE: 1055 return tls_process_server_done(s, pkt); 1056 1057 case TLS_ST_CR_CHANGE: 1058 return tls_process_change_cipher_spec(s, pkt); 1059 1060 case TLS_ST_CR_SESSION_TICKET: 1061 return tls_process_new_session_ticket(s, pkt); 1062 1063 case TLS_ST_CR_FINISHED: 1064 return tls_process_finished(s, pkt); 1065 1066 case TLS_ST_CR_HELLO_REQ: 1067 return tls_process_hello_req(s, pkt); 1068 1069 case TLS_ST_CR_ENCRYPTED_EXTENSIONS: 1070 return tls_process_encrypted_extensions(s, pkt); 1071 1072 case TLS_ST_CR_KEY_UPDATE: 1073 return tls_process_key_update(s, pkt); 1074 } 1075 } 1076 1077 /* 1078 * Perform any further processing required following the receipt of a message 1079 * from the server 1080 */ 1081 WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst) 1082 { 1083 OSSL_STATEM *st = &s->statem; 1084 1085 switch (st->hand_state) { 1086 default: 1087 /* Shouldn't happen */ 1088 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1089 SSL_F_OSSL_STATEM_CLIENT_POST_PROCESS_MESSAGE, 1090 ERR_R_INTERNAL_ERROR); 1091 return WORK_ERROR; 1092 1093 case TLS_ST_CR_CERT_VRFY: 1094 case TLS_ST_CR_CERT_REQ: 1095 return tls_prepare_client_certificate(s, wst); 1096 } 1097 } 1098 1099 int tls_construct_client_hello(SSL *s, WPACKET *pkt) 1100 { 1101 unsigned char *p; 1102 size_t sess_id_len; 1103 int i, protverr; 1104 #ifndef OPENSSL_NO_COMP 1105 SSL_COMP *comp; 1106 #endif 1107 SSL_SESSION *sess = s->session; 1108 unsigned char *session_id; 1109 1110 /* Work out what SSL/TLS/DTLS version to use */ 1111 protverr = ssl_set_client_hello_version(s); 1112 if (protverr != 0) { 1113 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1114 protverr); 1115 return 0; 1116 } 1117 1118 if (sess == NULL 1119 || !ssl_version_supported(s, sess->ssl_version, NULL) 1120 || !SSL_SESSION_is_resumable(sess)) { 1121 if (s->hello_retry_request == SSL_HRR_NONE 1122 && !ssl_get_new_session(s, 0)) { 1123 /* SSLfatal() already called */ 1124 return 0; 1125 } 1126 } 1127 /* else use the pre-loaded session */ 1128 1129 p = s->s3->client_random; 1130 1131 /* 1132 * for DTLS if client_random is initialized, reuse it, we are 1133 * required to use same upon reply to HelloVerify 1134 */ 1135 if (SSL_IS_DTLS(s)) { 1136 size_t idx; 1137 i = 1; 1138 for (idx = 0; idx < sizeof(s->s3->client_random); idx++) { 1139 if (p[idx]) { 1140 i = 0; 1141 break; 1142 } 1143 } 1144 } else { 1145 i = (s->hello_retry_request == SSL_HRR_NONE); 1146 } 1147 1148 if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3->client_random), 1149 DOWNGRADE_NONE) <= 0) { 1150 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1151 ERR_R_INTERNAL_ERROR); 1152 return 0; 1153 } 1154 1155 /*- 1156 * version indicates the negotiated version: for example from 1157 * an SSLv2/v3 compatible client hello). The client_version 1158 * field is the maximum version we permit and it is also 1159 * used in RSA encrypted premaster secrets. Some servers can 1160 * choke if we initially report a higher version then 1161 * renegotiate to a lower one in the premaster secret. This 1162 * didn't happen with TLS 1.0 as most servers supported it 1163 * but it can with TLS 1.1 or later if the server only supports 1164 * 1.0. 1165 * 1166 * Possible scenario with previous logic: 1167 * 1. Client hello indicates TLS 1.2 1168 * 2. Server hello says TLS 1.0 1169 * 3. RSA encrypted premaster secret uses 1.2. 1170 * 4. Handshake proceeds using TLS 1.0. 1171 * 5. Server sends hello request to renegotiate. 1172 * 6. Client hello indicates TLS v1.0 as we now 1173 * know that is maximum server supports. 1174 * 7. Server chokes on RSA encrypted premaster secret 1175 * containing version 1.0. 1176 * 1177 * For interoperability it should be OK to always use the 1178 * maximum version we support in client hello and then rely 1179 * on the checking of version to ensure the servers isn't 1180 * being inconsistent: for example initially negotiating with 1181 * TLS 1.0 and renegotiating with TLS 1.2. We do this by using 1182 * client_version in client hello and not resetting it to 1183 * the negotiated version. 1184 * 1185 * For TLS 1.3 we always set the ClientHello version to 1.2 and rely on the 1186 * supported_versions extension for the real supported versions. 1187 */ 1188 if (!WPACKET_put_bytes_u16(pkt, s->client_version) 1189 || !WPACKET_memcpy(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)) { 1190 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1191 ERR_R_INTERNAL_ERROR); 1192 return 0; 1193 } 1194 1195 /* Session ID */ 1196 session_id = s->session->session_id; 1197 if (s->new_session || s->session->ssl_version == TLS1_3_VERSION) { 1198 if (s->version == TLS1_3_VERSION 1199 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) { 1200 sess_id_len = sizeof(s->tmp_session_id); 1201 s->tmp_session_id_len = sess_id_len; 1202 session_id = s->tmp_session_id; 1203 if (s->hello_retry_request == SSL_HRR_NONE 1204 && RAND_bytes(s->tmp_session_id, sess_id_len) <= 0) { 1205 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1206 SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1207 ERR_R_INTERNAL_ERROR); 1208 return 0; 1209 } 1210 } else { 1211 sess_id_len = 0; 1212 } 1213 } else { 1214 assert(s->session->session_id_length <= sizeof(s->session->session_id)); 1215 sess_id_len = s->session->session_id_length; 1216 if (s->version == TLS1_3_VERSION) { 1217 s->tmp_session_id_len = sess_id_len; 1218 memcpy(s->tmp_session_id, s->session->session_id, sess_id_len); 1219 } 1220 } 1221 if (!WPACKET_start_sub_packet_u8(pkt) 1222 || (sess_id_len != 0 && !WPACKET_memcpy(pkt, session_id, 1223 sess_id_len)) 1224 || !WPACKET_close(pkt)) { 1225 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1226 ERR_R_INTERNAL_ERROR); 1227 return 0; 1228 } 1229 1230 /* cookie stuff for DTLS */ 1231 if (SSL_IS_DTLS(s)) { 1232 if (s->d1->cookie_len > sizeof(s->d1->cookie) 1233 || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie, 1234 s->d1->cookie_len)) { 1235 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1236 ERR_R_INTERNAL_ERROR); 1237 return 0; 1238 } 1239 } 1240 1241 /* Ciphers supported */ 1242 if (!WPACKET_start_sub_packet_u16(pkt)) { 1243 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1244 ERR_R_INTERNAL_ERROR); 1245 return 0; 1246 } 1247 1248 if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), pkt)) { 1249 /* SSLfatal() already called */ 1250 return 0; 1251 } 1252 if (!WPACKET_close(pkt)) { 1253 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1254 ERR_R_INTERNAL_ERROR); 1255 return 0; 1256 } 1257 1258 /* COMPRESSION */ 1259 if (!WPACKET_start_sub_packet_u8(pkt)) { 1260 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1261 ERR_R_INTERNAL_ERROR); 1262 return 0; 1263 } 1264 #ifndef OPENSSL_NO_COMP 1265 if (ssl_allow_compression(s) 1266 && s->ctx->comp_methods 1267 && (SSL_IS_DTLS(s) || s->s3->tmp.max_ver < TLS1_3_VERSION)) { 1268 int compnum = sk_SSL_COMP_num(s->ctx->comp_methods); 1269 for (i = 0; i < compnum; i++) { 1270 comp = sk_SSL_COMP_value(s->ctx->comp_methods, i); 1271 if (!WPACKET_put_bytes_u8(pkt, comp->id)) { 1272 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1273 SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1274 ERR_R_INTERNAL_ERROR); 1275 return 0; 1276 } 1277 } 1278 } 1279 #endif 1280 /* Add the NULL method */ 1281 if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) { 1282 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, 1283 ERR_R_INTERNAL_ERROR); 1284 return 0; 1285 } 1286 1287 /* TLS extensions */ 1288 if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0)) { 1289 /* SSLfatal() already called */ 1290 return 0; 1291 } 1292 1293 return 1; 1294 } 1295 1296 MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt) 1297 { 1298 size_t cookie_len; 1299 PACKET cookiepkt; 1300 1301 if (!PACKET_forward(pkt, 2) 1302 || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) { 1303 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_DTLS_PROCESS_HELLO_VERIFY, 1304 SSL_R_LENGTH_MISMATCH); 1305 return MSG_PROCESS_ERROR; 1306 } 1307 1308 cookie_len = PACKET_remaining(&cookiepkt); 1309 if (cookie_len > sizeof(s->d1->cookie)) { 1310 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_DTLS_PROCESS_HELLO_VERIFY, 1311 SSL_R_LENGTH_TOO_LONG); 1312 return MSG_PROCESS_ERROR; 1313 } 1314 1315 if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) { 1316 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_DTLS_PROCESS_HELLO_VERIFY, 1317 SSL_R_LENGTH_MISMATCH); 1318 return MSG_PROCESS_ERROR; 1319 } 1320 s->d1->cookie_len = cookie_len; 1321 1322 return MSG_PROCESS_FINISHED_READING; 1323 } 1324 1325 static int set_client_ciphersuite(SSL *s, const unsigned char *cipherchars) 1326 { 1327 STACK_OF(SSL_CIPHER) *sk; 1328 const SSL_CIPHER *c; 1329 int i; 1330 1331 c = ssl_get_cipher_by_char(s, cipherchars, 0); 1332 if (c == NULL) { 1333 /* unknown cipher */ 1334 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, 1335 SSL_R_UNKNOWN_CIPHER_RETURNED); 1336 return 0; 1337 } 1338 /* 1339 * If it is a disabled cipher we either didn't send it in client hello, 1340 * or it's not allowed for the selected protocol. So we return an error. 1341 */ 1342 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK, 1)) { 1343 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, 1344 SSL_R_WRONG_CIPHER_RETURNED); 1345 return 0; 1346 } 1347 1348 sk = ssl_get_ciphers_by_id(s); 1349 i = sk_SSL_CIPHER_find(sk, c); 1350 if (i < 0) { 1351 /* we did not say we would use this cipher */ 1352 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, 1353 SSL_R_WRONG_CIPHER_RETURNED); 1354 return 0; 1355 } 1356 1357 if (SSL_IS_TLS13(s) && s->s3->tmp.new_cipher != NULL 1358 && s->s3->tmp.new_cipher->id != c->id) { 1359 /* ServerHello selected a different ciphersuite to that in the HRR */ 1360 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, 1361 SSL_R_WRONG_CIPHER_RETURNED); 1362 return 0; 1363 } 1364 1365 /* 1366 * Depending on the session caching (internal/external), the cipher 1367 * and/or cipher_id values may not be set. Make sure that cipher_id is 1368 * set and use it for comparison. 1369 */ 1370 if (s->session->cipher != NULL) 1371 s->session->cipher_id = s->session->cipher->id; 1372 if (s->hit && (s->session->cipher_id != c->id)) { 1373 if (SSL_IS_TLS13(s)) { 1374 /* 1375 * In TLSv1.3 it is valid for the server to select a different 1376 * ciphersuite as long as the hash is the same. 1377 */ 1378 if (ssl_md(c->algorithm2) 1379 != ssl_md(s->session->cipher->algorithm2)) { 1380 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1381 SSL_F_SET_CLIENT_CIPHERSUITE, 1382 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED); 1383 return 0; 1384 } 1385 } else { 1386 /* 1387 * Prior to TLSv1.3 resuming a session always meant using the same 1388 * ciphersuite. 1389 */ 1390 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, 1391 SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); 1392 return 0; 1393 } 1394 } 1395 s->s3->tmp.new_cipher = c; 1396 1397 return 1; 1398 } 1399 1400 MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) 1401 { 1402 PACKET session_id, extpkt; 1403 size_t session_id_len; 1404 const unsigned char *cipherchars; 1405 int hrr = 0; 1406 unsigned int compression; 1407 unsigned int sversion; 1408 unsigned int context; 1409 RAW_EXTENSION *extensions = NULL; 1410 #ifndef OPENSSL_NO_COMP 1411 SSL_COMP *comp; 1412 #endif 1413 1414 if (!PACKET_get_net_2(pkt, &sversion)) { 1415 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1416 SSL_R_LENGTH_MISMATCH); 1417 goto err; 1418 } 1419 1420 /* load the server random */ 1421 if (s->version == TLS1_3_VERSION 1422 && sversion == TLS1_2_VERSION 1423 && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE 1424 && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) { 1425 s->hello_retry_request = SSL_HRR_PENDING; 1426 hrr = 1; 1427 if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) { 1428 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1429 SSL_R_LENGTH_MISMATCH); 1430 goto err; 1431 } 1432 } else { 1433 if (!PACKET_copy_bytes(pkt, s->s3->server_random, SSL3_RANDOM_SIZE)) { 1434 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1435 SSL_R_LENGTH_MISMATCH); 1436 goto err; 1437 } 1438 } 1439 1440 /* Get the session-id. */ 1441 if (!PACKET_get_length_prefixed_1(pkt, &session_id)) { 1442 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1443 SSL_R_LENGTH_MISMATCH); 1444 goto err; 1445 } 1446 session_id_len = PACKET_remaining(&session_id); 1447 if (session_id_len > sizeof(s->session->session_id) 1448 || session_id_len > SSL3_SESSION_ID_SIZE) { 1449 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, 1450 SSL_R_SSL3_SESSION_ID_TOO_LONG); 1451 goto err; 1452 } 1453 1454 if (!PACKET_get_bytes(pkt, &cipherchars, TLS_CIPHER_LEN)) { 1455 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1456 SSL_R_LENGTH_MISMATCH); 1457 goto err; 1458 } 1459 1460 if (!PACKET_get_1(pkt, &compression)) { 1461 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1462 SSL_R_LENGTH_MISMATCH); 1463 goto err; 1464 } 1465 1466 /* TLS extensions */ 1467 if (PACKET_remaining(pkt) == 0 && !hrr) { 1468 PACKET_null_init(&extpkt); 1469 } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt) 1470 || PACKET_remaining(pkt) != 0) { 1471 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1472 SSL_R_BAD_LENGTH); 1473 goto err; 1474 } 1475 1476 if (!hrr) { 1477 if (!tls_collect_extensions(s, &extpkt, 1478 SSL_EXT_TLS1_2_SERVER_HELLO 1479 | SSL_EXT_TLS1_3_SERVER_HELLO, 1480 &extensions, NULL, 1)) { 1481 /* SSLfatal() already called */ 1482 goto err; 1483 } 1484 1485 if (!ssl_choose_client_version(s, sversion, extensions)) { 1486 /* SSLfatal() already called */ 1487 goto err; 1488 } 1489 } 1490 1491 if (SSL_IS_TLS13(s) || hrr) { 1492 if (compression != 0) { 1493 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1494 SSL_F_TLS_PROCESS_SERVER_HELLO, 1495 SSL_R_INVALID_COMPRESSION_ALGORITHM); 1496 goto err; 1497 } 1498 1499 if (session_id_len != s->tmp_session_id_len 1500 || memcmp(PACKET_data(&session_id), s->tmp_session_id, 1501 session_id_len) != 0) { 1502 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1503 SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_INVALID_SESSION_ID); 1504 goto err; 1505 } 1506 } 1507 1508 if (hrr) { 1509 if (!set_client_ciphersuite(s, cipherchars)) { 1510 /* SSLfatal() already called */ 1511 goto err; 1512 } 1513 1514 return tls_process_as_hello_retry_request(s, &extpkt); 1515 } 1516 1517 /* 1518 * Now we have chosen the version we need to check again that the extensions 1519 * are appropriate for this version. 1520 */ 1521 context = SSL_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO 1522 : SSL_EXT_TLS1_2_SERVER_HELLO; 1523 if (!tls_validate_all_contexts(s, context, extensions)) { 1524 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, 1525 SSL_R_BAD_EXTENSION); 1526 goto err; 1527 } 1528 1529 s->hit = 0; 1530 1531 if (SSL_IS_TLS13(s)) { 1532 /* 1533 * In TLSv1.3 a ServerHello message signals a key change so the end of 1534 * the message must be on a record boundary. 1535 */ 1536 if (RECORD_LAYER_processed_read_pending(&s->rlayer)) { 1537 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, 1538 SSL_F_TLS_PROCESS_SERVER_HELLO, 1539 SSL_R_NOT_ON_RECORD_BOUNDARY); 1540 goto err; 1541 } 1542 1543 /* This will set s->hit if we are resuming */ 1544 if (!tls_parse_extension(s, TLSEXT_IDX_psk, 1545 SSL_EXT_TLS1_3_SERVER_HELLO, 1546 extensions, NULL, 0)) { 1547 /* SSLfatal() already called */ 1548 goto err; 1549 } 1550 } else { 1551 /* 1552 * Check if we can resume the session based on external pre-shared 1553 * secret. EAP-FAST (RFC 4851) supports two types of session resumption. 1554 * Resumption based on server-side state works with session IDs. 1555 * Resumption based on pre-shared Protected Access Credentials (PACs) 1556 * works by overriding the SessionTicket extension at the application 1557 * layer, and does not send a session ID. (We do not know whether 1558 * EAP-FAST servers would honour the session ID.) Therefore, the session 1559 * ID alone is not a reliable indicator of session resumption, so we 1560 * first check if we can resume, and later peek at the next handshake 1561 * message to see if the server wants to resume. 1562 */ 1563 if (s->version >= TLS1_VERSION 1564 && s->ext.session_secret_cb != NULL && s->session->ext.tick) { 1565 const SSL_CIPHER *pref_cipher = NULL; 1566 /* 1567 * s->session->master_key_length is a size_t, but this is an int for 1568 * backwards compat reasons 1569 */ 1570 int master_key_length; 1571 master_key_length = sizeof(s->session->master_key); 1572 if (s->ext.session_secret_cb(s, s->session->master_key, 1573 &master_key_length, 1574 NULL, &pref_cipher, 1575 s->ext.session_secret_cb_arg) 1576 && master_key_length > 0) { 1577 s->session->master_key_length = master_key_length; 1578 s->session->cipher = pref_cipher ? 1579 pref_cipher : ssl_get_cipher_by_char(s, cipherchars, 0); 1580 } else { 1581 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1582 SSL_F_TLS_PROCESS_SERVER_HELLO, ERR_R_INTERNAL_ERROR); 1583 goto err; 1584 } 1585 } 1586 1587 if (session_id_len != 0 1588 && session_id_len == s->session->session_id_length 1589 && memcmp(PACKET_data(&session_id), s->session->session_id, 1590 session_id_len) == 0) 1591 s->hit = 1; 1592 } 1593 1594 if (s->hit) { 1595 if (s->sid_ctx_length != s->session->sid_ctx_length 1596 || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) { 1597 /* actually a client application bug */ 1598 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1599 SSL_F_TLS_PROCESS_SERVER_HELLO, 1600 SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 1601 goto err; 1602 } 1603 } else { 1604 /* 1605 * If we were trying for session-id reuse but the server 1606 * didn't resume, make a new SSL_SESSION. 1607 * In the case of EAP-FAST and PAC, we do not send a session ID, 1608 * so the PAC-based session secret is always preserved. It'll be 1609 * overwritten if the server refuses resumption. 1610 */ 1611 if (s->session->session_id_length > 0) { 1612 tsan_counter(&s->session_ctx->stats.sess_miss); 1613 if (!ssl_get_new_session(s, 0)) { 1614 /* SSLfatal() already called */ 1615 goto err; 1616 } 1617 } 1618 1619 s->session->ssl_version = s->version; 1620 /* 1621 * In TLSv1.2 and below we save the session id we were sent so we can 1622 * resume it later. In TLSv1.3 the session id we were sent is just an 1623 * echo of what we originally sent in the ClientHello and should not be 1624 * used for resumption. 1625 */ 1626 if (!SSL_IS_TLS13(s)) { 1627 s->session->session_id_length = session_id_len; 1628 /* session_id_len could be 0 */ 1629 if (session_id_len > 0) 1630 memcpy(s->session->session_id, PACKET_data(&session_id), 1631 session_id_len); 1632 } 1633 } 1634 1635 /* Session version and negotiated protocol version should match */ 1636 if (s->version != s->session->ssl_version) { 1637 SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_TLS_PROCESS_SERVER_HELLO, 1638 SSL_R_SSL_SESSION_VERSION_MISMATCH); 1639 goto err; 1640 } 1641 /* 1642 * Now that we know the version, update the check to see if it's an allowed 1643 * version. 1644 */ 1645 s->s3->tmp.min_ver = s->version; 1646 s->s3->tmp.max_ver = s->version; 1647 1648 if (!set_client_ciphersuite(s, cipherchars)) { 1649 /* SSLfatal() already called */ 1650 goto err; 1651 } 1652 1653 #ifdef OPENSSL_NO_COMP 1654 if (compression != 0) { 1655 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, 1656 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 1657 goto err; 1658 } 1659 /* 1660 * If compression is disabled we'd better not try to resume a session 1661 * using compression. 1662 */ 1663 if (s->session->compress_meth != 0) { 1664 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SERVER_HELLO, 1665 SSL_R_INCONSISTENT_COMPRESSION); 1666 goto err; 1667 } 1668 #else 1669 if (s->hit && compression != s->session->compress_meth) { 1670 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, 1671 SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED); 1672 goto err; 1673 } 1674 if (compression == 0) 1675 comp = NULL; 1676 else if (!ssl_allow_compression(s)) { 1677 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, 1678 SSL_R_COMPRESSION_DISABLED); 1679 goto err; 1680 } else { 1681 comp = ssl3_comp_find(s->ctx->comp_methods, compression); 1682 } 1683 1684 if (compression != 0 && comp == NULL) { 1685 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, 1686 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 1687 goto err; 1688 } else { 1689 s->s3->tmp.new_compression = comp; 1690 } 1691 #endif 1692 1693 if (!tls_parse_all_extensions(s, context, extensions, NULL, 0, 1)) { 1694 /* SSLfatal() already called */ 1695 goto err; 1696 } 1697 1698 #ifndef OPENSSL_NO_SCTP 1699 if (SSL_IS_DTLS(s) && s->hit) { 1700 unsigned char sctpauthkey[64]; 1701 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; 1702 size_t labellen; 1703 1704 /* 1705 * Add new shared key for SCTP-Auth, will be ignored if 1706 * no SCTP used. 1707 */ 1708 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, 1709 sizeof(DTLS1_SCTP_AUTH_LABEL)); 1710 1711 /* Don't include the terminating zero. */ 1712 labellen = sizeof(labelbuffer) - 1; 1713 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) 1714 labellen += 1; 1715 1716 if (SSL_export_keying_material(s, sctpauthkey, 1717 sizeof(sctpauthkey), 1718 labelbuffer, 1719 labellen, NULL, 0, 0) <= 0) { 1720 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, 1721 ERR_R_INTERNAL_ERROR); 1722 goto err; 1723 } 1724 1725 BIO_ctrl(SSL_get_wbio(s), 1726 BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, 1727 sizeof(sctpauthkey), sctpauthkey); 1728 } 1729 #endif 1730 1731 /* 1732 * In TLSv1.3 we have some post-processing to change cipher state, otherwise 1733 * we're done with this message 1734 */ 1735 if (SSL_IS_TLS13(s) 1736 && (!s->method->ssl3_enc->setup_key_block(s) 1737 || !s->method->ssl3_enc->change_cipher_state(s, 1738 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ))) { 1739 /* SSLfatal() already called */ 1740 goto err; 1741 } 1742 1743 OPENSSL_free(extensions); 1744 return MSG_PROCESS_CONTINUE_READING; 1745 err: 1746 OPENSSL_free(extensions); 1747 return MSG_PROCESS_ERROR; 1748 } 1749 1750 static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, 1751 PACKET *extpkt) 1752 { 1753 RAW_EXTENSION *extensions = NULL; 1754 1755 /* 1756 * If we were sending early_data then the enc_write_ctx is now invalid and 1757 * should not be used. 1758 */ 1759 EVP_CIPHER_CTX_free(s->enc_write_ctx); 1760 s->enc_write_ctx = NULL; 1761 1762 if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, 1763 &extensions, NULL, 1) 1764 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, 1765 extensions, NULL, 0, 1)) { 1766 /* SSLfatal() already called */ 1767 goto err; 1768 } 1769 1770 OPENSSL_free(extensions); 1771 extensions = NULL; 1772 1773 if (s->ext.tls13_cookie_len == 0 1774 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) 1775 && s->s3->tmp.pkey != NULL 1776 #endif 1777 ) { 1778 /* 1779 * We didn't receive a cookie or a new key_share so the next 1780 * ClientHello will not change 1781 */ 1782 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1783 SSL_F_TLS_PROCESS_AS_HELLO_RETRY_REQUEST, 1784 SSL_R_NO_CHANGE_FOLLOWING_HRR); 1785 goto err; 1786 } 1787 1788 /* 1789 * Re-initialise the Transcript Hash. We're going to prepopulate it with 1790 * a synthetic message_hash in place of ClientHello1. 1791 */ 1792 if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) { 1793 /* SSLfatal() already called */ 1794 goto err; 1795 } 1796 1797 /* 1798 * Add this message to the Transcript Hash. Normally this is done 1799 * automatically prior to the message processing stage. However due to the 1800 * need to create the synthetic message hash, we defer that step until now 1801 * for HRR messages. 1802 */ 1803 if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 1804 s->init_num + SSL3_HM_HEADER_LENGTH)) { 1805 /* SSLfatal() already called */ 1806 goto err; 1807 } 1808 1809 return MSG_PROCESS_FINISHED_READING; 1810 err: 1811 OPENSSL_free(extensions); 1812 return MSG_PROCESS_ERROR; 1813 } 1814 1815 MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) 1816 { 1817 int i; 1818 MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR; 1819 unsigned long cert_list_len, cert_len; 1820 X509 *x = NULL; 1821 const unsigned char *certstart, *certbytes; 1822 STACK_OF(X509) *sk = NULL; 1823 EVP_PKEY *pkey = NULL; 1824 size_t chainidx, certidx; 1825 unsigned int context = 0; 1826 const SSL_CERT_LOOKUP *clu; 1827 1828 if ((sk = sk_X509_new_null()) == NULL) { 1829 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1830 ERR_R_MALLOC_FAILURE); 1831 goto err; 1832 } 1833 1834 if ((SSL_IS_TLS13(s) && !PACKET_get_1(pkt, &context)) 1835 || context != 0 1836 || !PACKET_get_net_3(pkt, &cert_list_len) 1837 || PACKET_remaining(pkt) != cert_list_len 1838 || PACKET_remaining(pkt) == 0) { 1839 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1840 SSL_R_LENGTH_MISMATCH); 1841 goto err; 1842 } 1843 for (chainidx = 0; PACKET_remaining(pkt); chainidx++) { 1844 if (!PACKET_get_net_3(pkt, &cert_len) 1845 || !PACKET_get_bytes(pkt, &certbytes, cert_len)) { 1846 SSLfatal(s, SSL_AD_DECODE_ERROR, 1847 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1848 SSL_R_CERT_LENGTH_MISMATCH); 1849 goto err; 1850 } 1851 1852 certstart = certbytes; 1853 x = d2i_X509(NULL, (const unsigned char **)&certbytes, cert_len); 1854 if (x == NULL) { 1855 SSLfatal(s, SSL_AD_BAD_CERTIFICATE, 1856 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_ASN1_LIB); 1857 goto err; 1858 } 1859 if (certbytes != (certstart + cert_len)) { 1860 SSLfatal(s, SSL_AD_DECODE_ERROR, 1861 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1862 SSL_R_CERT_LENGTH_MISMATCH); 1863 goto err; 1864 } 1865 1866 if (SSL_IS_TLS13(s)) { 1867 RAW_EXTENSION *rawexts = NULL; 1868 PACKET extensions; 1869 1870 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) { 1871 SSLfatal(s, SSL_AD_DECODE_ERROR, 1872 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1873 SSL_R_BAD_LENGTH); 1874 goto err; 1875 } 1876 if (!tls_collect_extensions(s, &extensions, 1877 SSL_EXT_TLS1_3_CERTIFICATE, &rawexts, 1878 NULL, chainidx == 0) 1879 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE, 1880 rawexts, x, chainidx, 1881 PACKET_remaining(pkt) == 0)) { 1882 OPENSSL_free(rawexts); 1883 /* SSLfatal already called */ 1884 goto err; 1885 } 1886 OPENSSL_free(rawexts); 1887 } 1888 1889 if (!sk_X509_push(sk, x)) { 1890 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1891 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1892 ERR_R_MALLOC_FAILURE); 1893 goto err; 1894 } 1895 x = NULL; 1896 } 1897 1898 i = ssl_verify_cert_chain(s, sk); 1899 /* 1900 * The documented interface is that SSL_VERIFY_PEER should be set in order 1901 * for client side verification of the server certificate to take place. 1902 * However, historically the code has only checked that *any* flag is set 1903 * to cause server verification to take place. Use of the other flags makes 1904 * no sense in client mode. An attempt to clean up the semantics was 1905 * reverted because at least one application *only* set 1906 * SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Prior to the clean up this still caused 1907 * server verification to take place, after the clean up it silently did 1908 * nothing. SSL_CTX_set_verify()/SSL_set_verify() cannot validate the flags 1909 * sent to them because they are void functions. Therefore, we now use the 1910 * (less clean) historic behaviour of performing validation if any flag is 1911 * set. The *documented* interface remains the same. 1912 */ 1913 if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) { 1914 SSLfatal(s, ssl_x509err2alert(s->verify_result), 1915 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1916 SSL_R_CERTIFICATE_VERIFY_FAILED); 1917 goto err; 1918 } 1919 ERR_clear_error(); /* but we keep s->verify_result */ 1920 if (i > 1) { 1921 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 1922 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, i); 1923 goto err; 1924 } 1925 1926 s->session->peer_chain = sk; 1927 /* 1928 * Inconsistency alert: cert_chain does include the peer's certificate, 1929 * which we don't include in statem_srvr.c 1930 */ 1931 x = sk_X509_value(sk, 0); 1932 sk = NULL; 1933 1934 pkey = X509_get0_pubkey(x); 1935 1936 if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) { 1937 x = NULL; 1938 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1939 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); 1940 goto err; 1941 } 1942 1943 if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx)) == NULL) { 1944 x = NULL; 1945 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1946 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1947 SSL_R_UNKNOWN_CERTIFICATE_TYPE); 1948 goto err; 1949 } 1950 /* 1951 * Check certificate type is consistent with ciphersuite. For TLS 1.3 1952 * skip check since TLS 1.3 ciphersuites can be used with any certificate 1953 * type. 1954 */ 1955 if (!SSL_IS_TLS13(s)) { 1956 if ((clu->amask & s->s3->tmp.new_cipher->algorithm_auth) == 0) { 1957 x = NULL; 1958 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1959 SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, 1960 SSL_R_WRONG_CERTIFICATE_TYPE); 1961 goto err; 1962 } 1963 } 1964 1965 X509_free(s->session->peer); 1966 X509_up_ref(x); 1967 s->session->peer = x; 1968 s->session->verify_result = s->verify_result; 1969 x = NULL; 1970 1971 /* Save the current hash state for when we receive the CertificateVerify */ 1972 if (SSL_IS_TLS13(s) 1973 && !ssl_handshake_hash(s, s->cert_verify_hash, 1974 sizeof(s->cert_verify_hash), 1975 &s->cert_verify_hash_len)) { 1976 /* SSLfatal() already called */; 1977 goto err; 1978 } 1979 1980 ret = MSG_PROCESS_CONTINUE_READING; 1981 1982 err: 1983 X509_free(x); 1984 sk_X509_pop_free(sk, X509_free); 1985 return ret; 1986 } 1987 1988 static int tls_process_ske_psk_preamble(SSL *s, PACKET *pkt) 1989 { 1990 #ifndef OPENSSL_NO_PSK 1991 PACKET psk_identity_hint; 1992 1993 /* PSK ciphersuites are preceded by an identity hint */ 1994 1995 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity_hint)) { 1996 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, 1997 SSL_R_LENGTH_MISMATCH); 1998 return 0; 1999 } 2000 2001 /* 2002 * Store PSK identity hint for later use, hint is used in 2003 * tls_construct_client_key_exchange. Assume that the maximum length of 2004 * a PSK identity hint can be as long as the maximum length of a PSK 2005 * identity. 2006 */ 2007 if (PACKET_remaining(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN) { 2008 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 2009 SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, 2010 SSL_R_DATA_LENGTH_TOO_LONG); 2011 return 0; 2012 } 2013 2014 if (PACKET_remaining(&psk_identity_hint) == 0) { 2015 OPENSSL_free(s->session->psk_identity_hint); 2016 s->session->psk_identity_hint = NULL; 2017 } else if (!PACKET_strndup(&psk_identity_hint, 2018 &s->session->psk_identity_hint)) { 2019 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, 2020 ERR_R_INTERNAL_ERROR); 2021 return 0; 2022 } 2023 2024 return 1; 2025 #else 2026 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, 2027 ERR_R_INTERNAL_ERROR); 2028 return 0; 2029 #endif 2030 } 2031 2032 static int tls_process_ske_srp(SSL *s, PACKET *pkt, EVP_PKEY **pkey) 2033 { 2034 #ifndef OPENSSL_NO_SRP 2035 PACKET prime, generator, salt, server_pub; 2036 2037 if (!PACKET_get_length_prefixed_2(pkt, &prime) 2038 || !PACKET_get_length_prefixed_2(pkt, &generator) 2039 || !PACKET_get_length_prefixed_1(pkt, &salt) 2040 || !PACKET_get_length_prefixed_2(pkt, &server_pub)) { 2041 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_SRP, 2042 SSL_R_LENGTH_MISMATCH); 2043 return 0; 2044 } 2045 2046 /* TODO(size_t): Convert BN_bin2bn() calls */ 2047 if ((s->srp_ctx.N = 2048 BN_bin2bn(PACKET_data(&prime), 2049 (int)PACKET_remaining(&prime), NULL)) == NULL 2050 || (s->srp_ctx.g = 2051 BN_bin2bn(PACKET_data(&generator), 2052 (int)PACKET_remaining(&generator), NULL)) == NULL 2053 || (s->srp_ctx.s = 2054 BN_bin2bn(PACKET_data(&salt), 2055 (int)PACKET_remaining(&salt), NULL)) == NULL 2056 || (s->srp_ctx.B = 2057 BN_bin2bn(PACKET_data(&server_pub), 2058 (int)PACKET_remaining(&server_pub), NULL)) == NULL) { 2059 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_SRP, 2060 ERR_R_BN_LIB); 2061 return 0; 2062 } 2063 2064 if (!srp_verify_server_param(s)) { 2065 /* SSLfatal() already called */ 2066 return 0; 2067 } 2068 2069 /* We must check if there is a certificate */ 2070 if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) 2071 *pkey = X509_get0_pubkey(s->session->peer); 2072 2073 return 1; 2074 #else 2075 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_SRP, 2076 ERR_R_INTERNAL_ERROR); 2077 return 0; 2078 #endif 2079 } 2080 2081 static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) 2082 { 2083 #ifndef OPENSSL_NO_DH 2084 PACKET prime, generator, pub_key; 2085 EVP_PKEY *peer_tmp = NULL; 2086 2087 DH *dh = NULL; 2088 BIGNUM *p = NULL, *g = NULL, *bnpub_key = NULL; 2089 2090 int check_bits = 0; 2091 2092 if (!PACKET_get_length_prefixed_2(pkt, &prime) 2093 || !PACKET_get_length_prefixed_2(pkt, &generator) 2094 || !PACKET_get_length_prefixed_2(pkt, &pub_key)) { 2095 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2096 SSL_R_LENGTH_MISMATCH); 2097 return 0; 2098 } 2099 2100 peer_tmp = EVP_PKEY_new(); 2101 dh = DH_new(); 2102 2103 if (peer_tmp == NULL || dh == NULL) { 2104 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2105 ERR_R_MALLOC_FAILURE); 2106 goto err; 2107 } 2108 2109 /* TODO(size_t): Convert these calls */ 2110 p = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL); 2111 g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator), 2112 NULL); 2113 bnpub_key = BN_bin2bn(PACKET_data(&pub_key), 2114 (int)PACKET_remaining(&pub_key), NULL); 2115 if (p == NULL || g == NULL || bnpub_key == NULL) { 2116 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2117 ERR_R_BN_LIB); 2118 goto err; 2119 } 2120 2121 /* test non-zero pubkey */ 2122 if (BN_is_zero(bnpub_key)) { 2123 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_DHE, 2124 SSL_R_BAD_DH_VALUE); 2125 goto err; 2126 } 2127 2128 if (!DH_set0_pqg(dh, p, NULL, g)) { 2129 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2130 ERR_R_BN_LIB); 2131 goto err; 2132 } 2133 p = g = NULL; 2134 2135 if (DH_check_params(dh, &check_bits) == 0 || check_bits != 0) { 2136 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_DHE, 2137 SSL_R_BAD_DH_VALUE); 2138 goto err; 2139 } 2140 2141 if (!DH_set0_key(dh, bnpub_key, NULL)) { 2142 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2143 ERR_R_BN_LIB); 2144 goto err; 2145 } 2146 bnpub_key = NULL; 2147 2148 if (EVP_PKEY_assign_DH(peer_tmp, dh) == 0) { 2149 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2150 ERR_R_EVP_LIB); 2151 goto err; 2152 } 2153 dh = NULL; 2154 2155 if (!ssl_security(s, SSL_SECOP_TMP_DH, EVP_PKEY_security_bits(peer_tmp), 2156 0, peer_tmp)) { 2157 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SKE_DHE, 2158 SSL_R_DH_KEY_TOO_SMALL); 2159 goto err; 2160 } 2161 2162 s->s3->peer_tmp = peer_tmp; 2163 2164 /* 2165 * FIXME: This makes assumptions about which ciphersuites come with 2166 * public keys. We should have a less ad-hoc way of doing this 2167 */ 2168 if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) 2169 *pkey = X509_get0_pubkey(s->session->peer); 2170 /* else anonymous DH, so no certificate or pkey. */ 2171 2172 return 1; 2173 2174 err: 2175 BN_free(p); 2176 BN_free(g); 2177 BN_free(bnpub_key); 2178 DH_free(dh); 2179 EVP_PKEY_free(peer_tmp); 2180 2181 return 0; 2182 #else 2183 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, 2184 ERR_R_INTERNAL_ERROR); 2185 return 0; 2186 #endif 2187 } 2188 2189 static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) 2190 { 2191 #ifndef OPENSSL_NO_EC 2192 PACKET encoded_pt; 2193 unsigned int curve_type, curve_id; 2194 2195 /* 2196 * Extract elliptic curve parameters and the server's ephemeral ECDH 2197 * public key. We only support named (not generic) curves and 2198 * ECParameters in this case is just three bytes. 2199 */ 2200 if (!PACKET_get_1(pkt, &curve_type) || !PACKET_get_net_2(pkt, &curve_id)) { 2201 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, 2202 SSL_R_LENGTH_TOO_SHORT); 2203 return 0; 2204 } 2205 /* 2206 * Check curve is named curve type and one of our preferences, if not 2207 * server has sent an invalid curve. 2208 */ 2209 if (curve_type != NAMED_CURVE_TYPE 2210 || !tls1_check_group_id(s, curve_id, 1)) { 2211 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_ECDHE, 2212 SSL_R_WRONG_CURVE); 2213 return 0; 2214 } 2215 2216 if ((s->s3->peer_tmp = ssl_generate_param_group(curve_id)) == NULL) { 2217 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, 2218 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); 2219 return 0; 2220 } 2221 2222 if (!PACKET_get_length_prefixed_1(pkt, &encoded_pt)) { 2223 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, 2224 SSL_R_LENGTH_MISMATCH); 2225 return 0; 2226 } 2227 2228 if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp, 2229 PACKET_data(&encoded_pt), 2230 PACKET_remaining(&encoded_pt))) { 2231 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_ECDHE, 2232 SSL_R_BAD_ECPOINT); 2233 return 0; 2234 } 2235 2236 /* 2237 * The ECC/TLS specification does not mention the use of DSA to sign 2238 * ECParameters in the server key exchange message. We do support RSA 2239 * and ECDSA. 2240 */ 2241 if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA) 2242 *pkey = X509_get0_pubkey(s->session->peer); 2243 else if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aRSA) 2244 *pkey = X509_get0_pubkey(s->session->peer); 2245 /* else anonymous ECDH, so no certificate or pkey. */ 2246 2247 return 1; 2248 #else 2249 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, 2250 ERR_R_INTERNAL_ERROR); 2251 return 0; 2252 #endif 2253 } 2254 2255 MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) 2256 { 2257 long alg_k; 2258 EVP_PKEY *pkey = NULL; 2259 EVP_MD_CTX *md_ctx = NULL; 2260 EVP_PKEY_CTX *pctx = NULL; 2261 PACKET save_param_start, signature; 2262 2263 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 2264 2265 save_param_start = *pkt; 2266 2267 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) 2268 EVP_PKEY_free(s->s3->peer_tmp); 2269 s->s3->peer_tmp = NULL; 2270 #endif 2271 2272 if (alg_k & SSL_PSK) { 2273 if (!tls_process_ske_psk_preamble(s, pkt)) { 2274 /* SSLfatal() already called */ 2275 goto err; 2276 } 2277 } 2278 2279 /* Nothing else to do for plain PSK or RSAPSK */ 2280 if (alg_k & (SSL_kPSK | SSL_kRSAPSK)) { 2281 } else if (alg_k & SSL_kSRP) { 2282 if (!tls_process_ske_srp(s, pkt, &pkey)) { 2283 /* SSLfatal() already called */ 2284 goto err; 2285 } 2286 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { 2287 if (!tls_process_ske_dhe(s, pkt, &pkey)) { 2288 /* SSLfatal() already called */ 2289 goto err; 2290 } 2291 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { 2292 if (!tls_process_ske_ecdhe(s, pkt, &pkey)) { 2293 /* SSLfatal() already called */ 2294 goto err; 2295 } 2296 } else if (alg_k) { 2297 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2298 SSL_R_UNEXPECTED_MESSAGE); 2299 goto err; 2300 } 2301 2302 /* if it was signed, check the signature */ 2303 if (pkey != NULL) { 2304 PACKET params; 2305 int maxsig; 2306 const EVP_MD *md = NULL; 2307 unsigned char *tbs; 2308 size_t tbslen; 2309 int rv; 2310 2311 /* 2312 * |pkt| now points to the beginning of the signature, so the difference 2313 * equals the length of the parameters. 2314 */ 2315 if (!PACKET_get_sub_packet(&save_param_start, ¶ms, 2316 PACKET_remaining(&save_param_start) - 2317 PACKET_remaining(pkt))) { 2318 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2319 ERR_R_INTERNAL_ERROR); 2320 goto err; 2321 } 2322 2323 if (SSL_USE_SIGALGS(s)) { 2324 unsigned int sigalg; 2325 2326 if (!PACKET_get_net_2(pkt, &sigalg)) { 2327 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2328 SSL_R_LENGTH_TOO_SHORT); 2329 goto err; 2330 } 2331 if (tls12_check_peer_sigalg(s, sigalg, pkey) <=0) { 2332 /* SSLfatal() already called */ 2333 goto err; 2334 } 2335 } else if (!tls1_set_peer_legacy_sigalg(s, pkey)) { 2336 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2337 ERR_R_INTERNAL_ERROR); 2338 goto err; 2339 } 2340 2341 if (!tls1_lookup_md(s->s3->tmp.peer_sigalg, &md)) { 2342 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2343 ERR_R_INTERNAL_ERROR); 2344 goto err; 2345 } 2346 #ifdef SSL_DEBUG 2347 if (SSL_USE_SIGALGS(s)) 2348 fprintf(stderr, "USING TLSv1.2 HASH %s\n", 2349 md == NULL ? "n/a" : EVP_MD_name(md)); 2350 #endif 2351 2352 if (!PACKET_get_length_prefixed_2(pkt, &signature) 2353 || PACKET_remaining(pkt) != 0) { 2354 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2355 SSL_R_LENGTH_MISMATCH); 2356 goto err; 2357 } 2358 maxsig = EVP_PKEY_size(pkey); 2359 if (maxsig < 0) { 2360 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2361 ERR_R_INTERNAL_ERROR); 2362 goto err; 2363 } 2364 2365 /* 2366 * Check signature length 2367 */ 2368 if (PACKET_remaining(&signature) > (size_t)maxsig) { 2369 /* wrong packet length */ 2370 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2371 SSL_R_WRONG_SIGNATURE_LENGTH); 2372 goto err; 2373 } 2374 2375 md_ctx = EVP_MD_CTX_new(); 2376 if (md_ctx == NULL) { 2377 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2378 ERR_R_MALLOC_FAILURE); 2379 goto err; 2380 } 2381 2382 if (EVP_DigestVerifyInit(md_ctx, &pctx, md, NULL, pkey) <= 0) { 2383 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2384 ERR_R_EVP_LIB); 2385 goto err; 2386 } 2387 if (SSL_USE_PSS(s)) { 2388 if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0 2389 || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, 2390 RSA_PSS_SALTLEN_DIGEST) <= 0) { 2391 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2392 SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_EVP_LIB); 2393 goto err; 2394 } 2395 } 2396 tbslen = construct_key_exchange_tbs(s, &tbs, PACKET_data(¶ms), 2397 PACKET_remaining(¶ms)); 2398 if (tbslen == 0) { 2399 /* SSLfatal() already called */ 2400 goto err; 2401 } 2402 2403 rv = EVP_DigestVerify(md_ctx, PACKET_data(&signature), 2404 PACKET_remaining(&signature), tbs, tbslen); 2405 OPENSSL_free(tbs); 2406 if (rv <= 0) { 2407 SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2408 SSL_R_BAD_SIGNATURE); 2409 goto err; 2410 } 2411 EVP_MD_CTX_free(md_ctx); 2412 md_ctx = NULL; 2413 } else { 2414 /* aNULL, aSRP or PSK do not need public keys */ 2415 if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP)) 2416 && !(alg_k & SSL_PSK)) { 2417 /* Might be wrong key type, check it */ 2418 if (ssl3_check_cert_and_algorithm(s)) { 2419 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2420 SSL_R_BAD_DATA); 2421 } 2422 /* else this shouldn't happen, SSLfatal() already called */ 2423 goto err; 2424 } 2425 /* still data left over */ 2426 if (PACKET_remaining(pkt) != 0) { 2427 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, 2428 SSL_R_EXTRA_DATA_IN_MESSAGE); 2429 goto err; 2430 } 2431 } 2432 2433 return MSG_PROCESS_CONTINUE_READING; 2434 err: 2435 EVP_MD_CTX_free(md_ctx); 2436 return MSG_PROCESS_ERROR; 2437 } 2438 2439 MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt) 2440 { 2441 size_t i; 2442 2443 /* Clear certificate validity flags */ 2444 for (i = 0; i < SSL_PKEY_NUM; i++) 2445 s->s3->tmp.valid_flags[i] = 0; 2446 2447 if (SSL_IS_TLS13(s)) { 2448 PACKET reqctx, extensions; 2449 RAW_EXTENSION *rawexts = NULL; 2450 2451 if ((s->shutdown & SSL_SENT_SHUTDOWN) != 0) { 2452 /* 2453 * We already sent close_notify. This can only happen in TLSv1.3 2454 * post-handshake messages. We can't reasonably respond to this, so 2455 * we just ignore it 2456 */ 2457 return MSG_PROCESS_FINISHED_READING; 2458 } 2459 2460 /* Free and zero certificate types: it is not present in TLS 1.3 */ 2461 OPENSSL_free(s->s3->tmp.ctype); 2462 s->s3->tmp.ctype = NULL; 2463 s->s3->tmp.ctype_len = 0; 2464 OPENSSL_free(s->pha_context); 2465 s->pha_context = NULL; 2466 s->pha_context_len = 0; 2467 2468 if (!PACKET_get_length_prefixed_1(pkt, &reqctx) || 2469 !PACKET_memdup(&reqctx, &s->pha_context, &s->pha_context_len)) { 2470 SSLfatal(s, SSL_AD_DECODE_ERROR, 2471 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2472 SSL_R_LENGTH_MISMATCH); 2473 return MSG_PROCESS_ERROR; 2474 } 2475 2476 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) { 2477 SSLfatal(s, SSL_AD_DECODE_ERROR, 2478 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2479 SSL_R_BAD_LENGTH); 2480 return MSG_PROCESS_ERROR; 2481 } 2482 if (!tls_collect_extensions(s, &extensions, 2483 SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, 2484 &rawexts, NULL, 1) 2485 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, 2486 rawexts, NULL, 0, 1)) { 2487 /* SSLfatal() already called */ 2488 OPENSSL_free(rawexts); 2489 return MSG_PROCESS_ERROR; 2490 } 2491 OPENSSL_free(rawexts); 2492 if (!tls1_process_sigalgs(s)) { 2493 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2494 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2495 SSL_R_BAD_LENGTH); 2496 return MSG_PROCESS_ERROR; 2497 } 2498 } else { 2499 PACKET ctypes; 2500 2501 /* get the certificate types */ 2502 if (!PACKET_get_length_prefixed_1(pkt, &ctypes)) { 2503 SSLfatal(s, SSL_AD_DECODE_ERROR, 2504 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2505 SSL_R_LENGTH_MISMATCH); 2506 return MSG_PROCESS_ERROR; 2507 } 2508 2509 if (!PACKET_memdup(&ctypes, &s->s3->tmp.ctype, &s->s3->tmp.ctype_len)) { 2510 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2511 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2512 ERR_R_INTERNAL_ERROR); 2513 return MSG_PROCESS_ERROR; 2514 } 2515 2516 if (SSL_USE_SIGALGS(s)) { 2517 PACKET sigalgs; 2518 2519 if (!PACKET_get_length_prefixed_2(pkt, &sigalgs)) { 2520 SSLfatal(s, SSL_AD_DECODE_ERROR, 2521 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2522 SSL_R_LENGTH_MISMATCH); 2523 return MSG_PROCESS_ERROR; 2524 } 2525 2526 /* 2527 * Despite this being for certificates, preserve compatibility 2528 * with pre-TLS 1.3 and use the regular sigalgs field. 2529 */ 2530 if (!tls1_save_sigalgs(s, &sigalgs, 0)) { 2531 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2532 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2533 SSL_R_SIGNATURE_ALGORITHMS_ERROR); 2534 return MSG_PROCESS_ERROR; 2535 } 2536 if (!tls1_process_sigalgs(s)) { 2537 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2538 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2539 ERR_R_MALLOC_FAILURE); 2540 return MSG_PROCESS_ERROR; 2541 } 2542 } 2543 2544 /* get the CA RDNs */ 2545 if (!parse_ca_names(s, pkt)) { 2546 /* SSLfatal() already called */ 2547 return MSG_PROCESS_ERROR; 2548 } 2549 } 2550 2551 if (PACKET_remaining(pkt) != 0) { 2552 SSLfatal(s, SSL_AD_DECODE_ERROR, 2553 SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, 2554 SSL_R_LENGTH_MISMATCH); 2555 return MSG_PROCESS_ERROR; 2556 } 2557 2558 /* we should setup a certificate to return.... */ 2559 s->s3->tmp.cert_req = 1; 2560 2561 /* 2562 * In TLSv1.3 we don't prepare the client certificate yet. We wait until 2563 * after the CertificateVerify message has been received. This is because 2564 * in TLSv1.3 the CertificateRequest arrives before the Certificate message 2565 * but in TLSv1.2 it is the other way around. We want to make sure that 2566 * SSL_get_peer_certificate() returns something sensible in 2567 * client_cert_cb. 2568 */ 2569 if (SSL_IS_TLS13(s) && s->post_handshake_auth != SSL_PHA_REQUESTED) 2570 return MSG_PROCESS_CONTINUE_READING; 2571 2572 return MSG_PROCESS_CONTINUE_PROCESSING; 2573 } 2574 2575 MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) 2576 { 2577 unsigned int ticklen; 2578 unsigned long ticket_lifetime_hint, age_add = 0; 2579 unsigned int sess_len; 2580 RAW_EXTENSION *exts = NULL; 2581 PACKET nonce; 2582 2583 PACKET_null_init(&nonce); 2584 2585 if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint) 2586 || (SSL_IS_TLS13(s) 2587 && (!PACKET_get_net_4(pkt, &age_add) 2588 || !PACKET_get_length_prefixed_1(pkt, &nonce))) 2589 || !PACKET_get_net_2(pkt, &ticklen) 2590 || (SSL_IS_TLS13(s) ? (ticklen == 0 || PACKET_remaining(pkt) < ticklen) 2591 : PACKET_remaining(pkt) != ticklen)) { 2592 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2593 SSL_R_LENGTH_MISMATCH); 2594 goto err; 2595 } 2596 2597 /* 2598 * Server is allowed to change its mind (in <=TLSv1.2) and send an empty 2599 * ticket. We already checked this TLSv1.3 case above, so it should never 2600 * be 0 here in that instance 2601 */ 2602 if (ticklen == 0) 2603 return MSG_PROCESS_CONTINUE_READING; 2604 2605 /* 2606 * Sessions must be immutable once they go into the session cache. Otherwise 2607 * we can get multi-thread problems. Therefore we don't "update" sessions, 2608 * we replace them with a duplicate. In TLSv1.3 we need to do this every 2609 * time a NewSessionTicket arrives because those messages arrive 2610 * post-handshake and the session may have already gone into the session 2611 * cache. 2612 */ 2613 if (SSL_IS_TLS13(s) || s->session->session_id_length > 0) { 2614 SSL_SESSION *new_sess; 2615 2616 /* 2617 * We reused an existing session, so we need to replace it with a new 2618 * one 2619 */ 2620 if ((new_sess = ssl_session_dup(s->session, 0)) == 0) { 2621 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2622 SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2623 ERR_R_MALLOC_FAILURE); 2624 goto err; 2625 } 2626 2627 if ((s->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) != 0 2628 && !SSL_IS_TLS13(s)) { 2629 /* 2630 * In TLSv1.2 and below the arrival of a new tickets signals that 2631 * any old ticket we were using is now out of date, so we remove the 2632 * old session from the cache. We carry on if this fails 2633 */ 2634 SSL_CTX_remove_session(s->session_ctx, s->session); 2635 } 2636 2637 SSL_SESSION_free(s->session); 2638 s->session = new_sess; 2639 } 2640 2641 /* 2642 * Technically the cast to long here is not guaranteed by the C standard - 2643 * but we use it elsewhere, so this should be ok. 2644 */ 2645 s->session->time = (long)time(NULL); 2646 2647 OPENSSL_free(s->session->ext.tick); 2648 s->session->ext.tick = NULL; 2649 s->session->ext.ticklen = 0; 2650 2651 s->session->ext.tick = OPENSSL_malloc(ticklen); 2652 if (s->session->ext.tick == NULL) { 2653 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2654 ERR_R_MALLOC_FAILURE); 2655 goto err; 2656 } 2657 if (!PACKET_copy_bytes(pkt, s->session->ext.tick, ticklen)) { 2658 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2659 SSL_R_LENGTH_MISMATCH); 2660 goto err; 2661 } 2662 2663 s->session->ext.tick_lifetime_hint = ticket_lifetime_hint; 2664 s->session->ext.tick_age_add = age_add; 2665 s->session->ext.ticklen = ticklen; 2666 2667 if (SSL_IS_TLS13(s)) { 2668 PACKET extpkt; 2669 2670 if (!PACKET_as_length_prefixed_2(pkt, &extpkt) 2671 || PACKET_remaining(pkt) != 0) { 2672 SSLfatal(s, SSL_AD_DECODE_ERROR, 2673 SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2674 SSL_R_LENGTH_MISMATCH); 2675 goto err; 2676 } 2677 2678 if (!tls_collect_extensions(s, &extpkt, 2679 SSL_EXT_TLS1_3_NEW_SESSION_TICKET, &exts, 2680 NULL, 1) 2681 || !tls_parse_all_extensions(s, 2682 SSL_EXT_TLS1_3_NEW_SESSION_TICKET, 2683 exts, NULL, 0, 1)) { 2684 /* SSLfatal() already called */ 2685 goto err; 2686 } 2687 } 2688 2689 /* 2690 * There are two ways to detect a resumed ticket session. One is to set 2691 * an appropriate session ID and then the server must return a match in 2692 * ServerHello. This allows the normal client session ID matching to work 2693 * and we know much earlier that the ticket has been accepted. The 2694 * other way is to set zero length session ID when the ticket is 2695 * presented and rely on the handshake to determine session resumption. 2696 * We choose the former approach because this fits in with assumptions 2697 * elsewhere in OpenSSL. The session ID is set to the SHA256 (or SHA1 is 2698 * SHA256 is disabled) hash of the ticket. 2699 */ 2700 /* 2701 * TODO(size_t): we use sess_len here because EVP_Digest expects an int 2702 * but s->session->session_id_length is a size_t 2703 */ 2704 if (!EVP_Digest(s->session->ext.tick, ticklen, 2705 s->session->session_id, &sess_len, 2706 EVP_sha256(), NULL)) { 2707 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2708 ERR_R_EVP_LIB); 2709 goto err; 2710 } 2711 s->session->session_id_length = sess_len; 2712 s->session->not_resumable = 0; 2713 2714 /* This is a standalone message in TLSv1.3, so there is no more to read */ 2715 if (SSL_IS_TLS13(s)) { 2716 const EVP_MD *md = ssl_handshake_md(s); 2717 int hashleni = EVP_MD_size(md); 2718 size_t hashlen; 2719 static const unsigned char nonce_label[] = "resumption"; 2720 2721 /* Ensure cast to size_t is safe */ 2722 if (!ossl_assert(hashleni >= 0)) { 2723 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2724 SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, 2725 ERR_R_INTERNAL_ERROR); 2726 goto err; 2727 } 2728 hashlen = (size_t)hashleni; 2729 2730 if (!tls13_hkdf_expand(s, md, s->resumption_master_secret, 2731 nonce_label, 2732 sizeof(nonce_label) - 1, 2733 PACKET_data(&nonce), 2734 PACKET_remaining(&nonce), 2735 s->session->master_key, 2736 hashlen, 1)) { 2737 /* SSLfatal() already called */ 2738 goto err; 2739 } 2740 s->session->master_key_length = hashlen; 2741 2742 OPENSSL_free(exts); 2743 ssl_update_cache(s, SSL_SESS_CACHE_CLIENT); 2744 return MSG_PROCESS_FINISHED_READING; 2745 } 2746 2747 return MSG_PROCESS_CONTINUE_READING; 2748 err: 2749 OPENSSL_free(exts); 2750 return MSG_PROCESS_ERROR; 2751 } 2752 2753 /* 2754 * In TLSv1.3 this is called from the extensions code, otherwise it is used to 2755 * parse a separate message. Returns 1 on success or 0 on failure 2756 */ 2757 int tls_process_cert_status_body(SSL *s, PACKET *pkt) 2758 { 2759 size_t resplen; 2760 unsigned int type; 2761 2762 if (!PACKET_get_1(pkt, &type) 2763 || type != TLSEXT_STATUSTYPE_ocsp) { 2764 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, 2765 SSL_R_UNSUPPORTED_STATUS_TYPE); 2766 return 0; 2767 } 2768 if (!PACKET_get_net_3_len(pkt, &resplen) 2769 || PACKET_remaining(pkt) != resplen) { 2770 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, 2771 SSL_R_LENGTH_MISMATCH); 2772 return 0; 2773 } 2774 s->ext.ocsp.resp = OPENSSL_malloc(resplen); 2775 if (s->ext.ocsp.resp == NULL) { 2776 s->ext.ocsp.resp_len = 0; 2777 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, 2778 ERR_R_MALLOC_FAILURE); 2779 return 0; 2780 } 2781 s->ext.ocsp.resp_len = resplen; 2782 if (!PACKET_copy_bytes(pkt, s->ext.ocsp.resp, resplen)) { 2783 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, 2784 SSL_R_LENGTH_MISMATCH); 2785 return 0; 2786 } 2787 2788 return 1; 2789 } 2790 2791 2792 MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt) 2793 { 2794 if (!tls_process_cert_status_body(s, pkt)) { 2795 /* SSLfatal() already called */ 2796 return MSG_PROCESS_ERROR; 2797 } 2798 2799 return MSG_PROCESS_CONTINUE_READING; 2800 } 2801 2802 /* 2803 * Perform miscellaneous checks and processing after we have received the 2804 * server's initial flight. In TLS1.3 this is after the Server Finished message. 2805 * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0 2806 * on failure. 2807 */ 2808 int tls_process_initial_server_flight(SSL *s) 2809 { 2810 /* 2811 * at this point we check that we have the required stuff from 2812 * the server 2813 */ 2814 if (!ssl3_check_cert_and_algorithm(s)) { 2815 /* SSLfatal() already called */ 2816 return 0; 2817 } 2818 2819 /* 2820 * Call the ocsp status callback if needed. The |ext.ocsp.resp| and 2821 * |ext.ocsp.resp_len| values will be set if we actually received a status 2822 * message, or NULL and -1 otherwise 2823 */ 2824 if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing 2825 && s->ctx->ext.status_cb != NULL) { 2826 int ret = s->ctx->ext.status_cb(s, s->ctx->ext.status_arg); 2827 2828 if (ret == 0) { 2829 SSLfatal(s, SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE, 2830 SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT, 2831 SSL_R_INVALID_STATUS_RESPONSE); 2832 return 0; 2833 } 2834 if (ret < 0) { 2835 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2836 SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT, 2837 SSL_R_OCSP_CALLBACK_FAILURE); 2838 return 0; 2839 } 2840 } 2841 #ifndef OPENSSL_NO_CT 2842 if (s->ct_validation_callback != NULL) { 2843 /* Note we validate the SCTs whether or not we abort on error */ 2844 if (!ssl_validate_ct(s) && (s->verify_mode & SSL_VERIFY_PEER)) { 2845 /* SSLfatal() already called */ 2846 return 0; 2847 } 2848 } 2849 #endif 2850 2851 return 1; 2852 } 2853 2854 MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt) 2855 { 2856 if (PACKET_remaining(pkt) > 0) { 2857 /* should contain no data */ 2858 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_DONE, 2859 SSL_R_LENGTH_MISMATCH); 2860 return MSG_PROCESS_ERROR; 2861 } 2862 #ifndef OPENSSL_NO_SRP 2863 if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) { 2864 if (SRP_Calc_A_param(s) <= 0) { 2865 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_DONE, 2866 SSL_R_SRP_A_CALC); 2867 return MSG_PROCESS_ERROR; 2868 } 2869 } 2870 #endif 2871 2872 if (!tls_process_initial_server_flight(s)) { 2873 /* SSLfatal() already called */ 2874 return MSG_PROCESS_ERROR; 2875 } 2876 2877 return MSG_PROCESS_FINISHED_READING; 2878 } 2879 2880 static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt) 2881 { 2882 #ifndef OPENSSL_NO_PSK 2883 int ret = 0; 2884 /* 2885 * The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes to return a 2886 * \0-terminated identity. The last byte is for us for simulating 2887 * strnlen. 2888 */ 2889 char identity[PSK_MAX_IDENTITY_LEN + 1]; 2890 size_t identitylen = 0; 2891 unsigned char psk[PSK_MAX_PSK_LEN]; 2892 unsigned char *tmppsk = NULL; 2893 char *tmpidentity = NULL; 2894 size_t psklen = 0; 2895 2896 if (s->psk_client_callback == NULL) { 2897 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 2898 SSL_R_PSK_NO_CLIENT_CB); 2899 goto err; 2900 } 2901 2902 memset(identity, 0, sizeof(identity)); 2903 2904 psklen = s->psk_client_callback(s, s->session->psk_identity_hint, 2905 identity, sizeof(identity) - 1, 2906 psk, sizeof(psk)); 2907 2908 if (psklen > PSK_MAX_PSK_LEN) { 2909 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 2910 SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); 2911 psklen = PSK_MAX_PSK_LEN; /* Avoid overrunning the array on cleanse */ 2912 goto err; 2913 } else if (psklen == 0) { 2914 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 2915 SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 2916 SSL_R_PSK_IDENTITY_NOT_FOUND); 2917 goto err; 2918 } 2919 2920 identitylen = strlen(identity); 2921 if (identitylen > PSK_MAX_IDENTITY_LEN) { 2922 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 2923 ERR_R_INTERNAL_ERROR); 2924 goto err; 2925 } 2926 2927 tmppsk = OPENSSL_memdup(psk, psklen); 2928 tmpidentity = OPENSSL_strdup(identity); 2929 if (tmppsk == NULL || tmpidentity == NULL) { 2930 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 2931 ERR_R_MALLOC_FAILURE); 2932 goto err; 2933 } 2934 2935 OPENSSL_free(s->s3->tmp.psk); 2936 s->s3->tmp.psk = tmppsk; 2937 s->s3->tmp.psklen = psklen; 2938 tmppsk = NULL; 2939 OPENSSL_free(s->session->psk_identity); 2940 s->session->psk_identity = tmpidentity; 2941 tmpidentity = NULL; 2942 2943 if (!WPACKET_sub_memcpy_u16(pkt, identity, identitylen)) { 2944 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 2945 ERR_R_INTERNAL_ERROR); 2946 goto err; 2947 } 2948 2949 ret = 1; 2950 2951 err: 2952 OPENSSL_cleanse(psk, psklen); 2953 OPENSSL_cleanse(identity, sizeof(identity)); 2954 OPENSSL_clear_free(tmppsk, psklen); 2955 OPENSSL_clear_free(tmpidentity, identitylen); 2956 2957 return ret; 2958 #else 2959 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, 2960 ERR_R_INTERNAL_ERROR); 2961 return 0; 2962 #endif 2963 } 2964 2965 static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) 2966 { 2967 #ifndef OPENSSL_NO_RSA 2968 unsigned char *encdata = NULL; 2969 EVP_PKEY *pkey = NULL; 2970 EVP_PKEY_CTX *pctx = NULL; 2971 size_t enclen; 2972 unsigned char *pms = NULL; 2973 size_t pmslen = 0; 2974 2975 if (s->session->peer == NULL) { 2976 /* 2977 * We should always have a server certificate with SSL_kRSA. 2978 */ 2979 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 2980 ERR_R_INTERNAL_ERROR); 2981 return 0; 2982 } 2983 2984 pkey = X509_get0_pubkey(s->session->peer); 2985 if (EVP_PKEY_get0_RSA(pkey) == NULL) { 2986 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 2987 ERR_R_INTERNAL_ERROR); 2988 return 0; 2989 } 2990 2991 pmslen = SSL_MAX_MASTER_KEY_LENGTH; 2992 pms = OPENSSL_malloc(pmslen); 2993 if (pms == NULL) { 2994 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 2995 ERR_R_MALLOC_FAILURE); 2996 return 0; 2997 } 2998 2999 pms[0] = s->client_version >> 8; 3000 pms[1] = s->client_version & 0xff; 3001 /* TODO(size_t): Convert this function */ 3002 if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) { 3003 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 3004 ERR_R_MALLOC_FAILURE); 3005 goto err; 3006 } 3007 3008 /* Fix buf for TLS and beyond */ 3009 if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) { 3010 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 3011 ERR_R_INTERNAL_ERROR); 3012 goto err; 3013 } 3014 pctx = EVP_PKEY_CTX_new(pkey, NULL); 3015 if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0 3016 || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) { 3017 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 3018 ERR_R_EVP_LIB); 3019 goto err; 3020 } 3021 if (!WPACKET_allocate_bytes(pkt, enclen, &encdata) 3022 || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) { 3023 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 3024 SSL_R_BAD_RSA_ENCRYPT); 3025 goto err; 3026 } 3027 EVP_PKEY_CTX_free(pctx); 3028 pctx = NULL; 3029 3030 /* Fix buf for TLS and beyond */ 3031 if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) { 3032 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 3033 ERR_R_INTERNAL_ERROR); 3034 goto err; 3035 } 3036 3037 /* Log the premaster secret, if logging is enabled. */ 3038 if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) { 3039 /* SSLfatal() already called */ 3040 goto err; 3041 } 3042 3043 s->s3->tmp.pms = pms; 3044 s->s3->tmp.pmslen = pmslen; 3045 3046 return 1; 3047 err: 3048 OPENSSL_clear_free(pms, pmslen); 3049 EVP_PKEY_CTX_free(pctx); 3050 3051 return 0; 3052 #else 3053 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, 3054 ERR_R_INTERNAL_ERROR); 3055 return 0; 3056 #endif 3057 } 3058 3059 static int tls_construct_cke_dhe(SSL *s, WPACKET *pkt) 3060 { 3061 #ifndef OPENSSL_NO_DH 3062 DH *dh_clnt = NULL; 3063 const BIGNUM *pub_key; 3064 EVP_PKEY *ckey = NULL, *skey = NULL; 3065 unsigned char *keybytes = NULL; 3066 3067 skey = s->s3->peer_tmp; 3068 if (skey == NULL) { 3069 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, 3070 ERR_R_INTERNAL_ERROR); 3071 goto err; 3072 } 3073 3074 ckey = ssl_generate_pkey(skey); 3075 if (ckey == NULL) { 3076 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, 3077 ERR_R_INTERNAL_ERROR); 3078 goto err; 3079 } 3080 3081 dh_clnt = EVP_PKEY_get0_DH(ckey); 3082 3083 if (dh_clnt == NULL) { 3084 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, 3085 ERR_R_INTERNAL_ERROR); 3086 goto err; 3087 } 3088 3089 if (ssl_derive(s, ckey, skey, 0) == 0) { 3090 /* SSLfatal() already called */ 3091 goto err; 3092 } 3093 3094 /* send off the data */ 3095 DH_get0_key(dh_clnt, &pub_key, NULL); 3096 if (!WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(pub_key), 3097 &keybytes)) { 3098 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, 3099 ERR_R_INTERNAL_ERROR); 3100 goto err; 3101 } 3102 3103 BN_bn2bin(pub_key, keybytes); 3104 EVP_PKEY_free(ckey); 3105 3106 return 1; 3107 err: 3108 EVP_PKEY_free(ckey); 3109 return 0; 3110 #else 3111 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, 3112 ERR_R_INTERNAL_ERROR); 3113 return 0; 3114 #endif 3115 } 3116 3117 static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) 3118 { 3119 #ifndef OPENSSL_NO_EC 3120 unsigned char *encodedPoint = NULL; 3121 size_t encoded_pt_len = 0; 3122 EVP_PKEY *ckey = NULL, *skey = NULL; 3123 int ret = 0; 3124 3125 skey = s->s3->peer_tmp; 3126 if (skey == NULL) { 3127 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, 3128 ERR_R_INTERNAL_ERROR); 3129 return 0; 3130 } 3131 3132 ckey = ssl_generate_pkey(skey); 3133 if (ckey == NULL) { 3134 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, 3135 ERR_R_MALLOC_FAILURE); 3136 goto err; 3137 } 3138 3139 if (ssl_derive(s, ckey, skey, 0) == 0) { 3140 /* SSLfatal() already called */ 3141 goto err; 3142 } 3143 3144 /* Generate encoding of client key */ 3145 encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(ckey, &encodedPoint); 3146 3147 if (encoded_pt_len == 0) { 3148 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, 3149 ERR_R_EC_LIB); 3150 goto err; 3151 } 3152 3153 if (!WPACKET_sub_memcpy_u8(pkt, encodedPoint, encoded_pt_len)) { 3154 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, 3155 ERR_R_INTERNAL_ERROR); 3156 goto err; 3157 } 3158 3159 ret = 1; 3160 err: 3161 OPENSSL_free(encodedPoint); 3162 EVP_PKEY_free(ckey); 3163 return ret; 3164 #else 3165 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, 3166 ERR_R_INTERNAL_ERROR); 3167 return 0; 3168 #endif 3169 } 3170 3171 static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) 3172 { 3173 #ifndef OPENSSL_NO_GOST 3174 /* GOST key exchange message creation */ 3175 EVP_PKEY_CTX *pkey_ctx = NULL; 3176 X509 *peer_cert; 3177 size_t msglen; 3178 unsigned int md_len; 3179 unsigned char shared_ukm[32], tmp[256]; 3180 EVP_MD_CTX *ukm_hash = NULL; 3181 int dgst_nid = NID_id_GostR3411_94; 3182 unsigned char *pms = NULL; 3183 size_t pmslen = 0; 3184 3185 if ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0) 3186 dgst_nid = NID_id_GostR3411_2012_256; 3187 3188 /* 3189 * Get server certificate PKEY and create ctx from it 3190 */ 3191 peer_cert = s->session->peer; 3192 if (!peer_cert) { 3193 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3194 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); 3195 return 0; 3196 } 3197 3198 pkey_ctx = EVP_PKEY_CTX_new(X509_get0_pubkey(peer_cert), NULL); 3199 if (pkey_ctx == NULL) { 3200 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3201 ERR_R_MALLOC_FAILURE); 3202 return 0; 3203 } 3204 /* 3205 * If we have send a certificate, and certificate key 3206 * parameters match those of server certificate, use 3207 * certificate key for key exchange 3208 */ 3209 3210 /* Otherwise, generate ephemeral key pair */ 3211 pmslen = 32; 3212 pms = OPENSSL_malloc(pmslen); 3213 if (pms == NULL) { 3214 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3215 ERR_R_MALLOC_FAILURE); 3216 goto err; 3217 } 3218 3219 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0 3220 /* Generate session key 3221 * TODO(size_t): Convert this function 3222 */ 3223 || RAND_bytes(pms, (int)pmslen) <= 0) { 3224 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3225 ERR_R_INTERNAL_ERROR); 3226 goto err; 3227 }; 3228 /* 3229 * Compute shared IV and store it in algorithm-specific context 3230 * data 3231 */ 3232 ukm_hash = EVP_MD_CTX_new(); 3233 if (ukm_hash == NULL 3234 || EVP_DigestInit(ukm_hash, EVP_get_digestbynid(dgst_nid)) <= 0 3235 || EVP_DigestUpdate(ukm_hash, s->s3->client_random, 3236 SSL3_RANDOM_SIZE) <= 0 3237 || EVP_DigestUpdate(ukm_hash, s->s3->server_random, 3238 SSL3_RANDOM_SIZE) <= 0 3239 || EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len) <= 0) { 3240 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3241 ERR_R_INTERNAL_ERROR); 3242 goto err; 3243 } 3244 EVP_MD_CTX_free(ukm_hash); 3245 ukm_hash = NULL; 3246 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, 3247 EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) < 0) { 3248 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3249 SSL_R_LIBRARY_BUG); 3250 goto err; 3251 } 3252 /* Make GOST keytransport blob message */ 3253 /* 3254 * Encapsulate it into sequence 3255 */ 3256 msglen = 255; 3257 if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, pms, pmslen) <= 0) { 3258 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3259 SSL_R_LIBRARY_BUG); 3260 goto err; 3261 } 3262 3263 if (!WPACKET_put_bytes_u8(pkt, V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED) 3264 || (msglen >= 0x80 && !WPACKET_put_bytes_u8(pkt, 0x81)) 3265 || !WPACKET_sub_memcpy_u8(pkt, tmp, msglen)) { 3266 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3267 ERR_R_INTERNAL_ERROR); 3268 goto err; 3269 } 3270 3271 EVP_PKEY_CTX_free(pkey_ctx); 3272 s->s3->tmp.pms = pms; 3273 s->s3->tmp.pmslen = pmslen; 3274 3275 return 1; 3276 err: 3277 EVP_PKEY_CTX_free(pkey_ctx); 3278 OPENSSL_clear_free(pms, pmslen); 3279 EVP_MD_CTX_free(ukm_hash); 3280 return 0; 3281 #else 3282 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, 3283 ERR_R_INTERNAL_ERROR); 3284 return 0; 3285 #endif 3286 } 3287 3288 static int tls_construct_cke_srp(SSL *s, WPACKET *pkt) 3289 { 3290 #ifndef OPENSSL_NO_SRP 3291 unsigned char *abytes = NULL; 3292 3293 if (s->srp_ctx.A == NULL 3294 || !WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(s->srp_ctx.A), 3295 &abytes)) { 3296 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_SRP, 3297 ERR_R_INTERNAL_ERROR); 3298 return 0; 3299 } 3300 BN_bn2bin(s->srp_ctx.A, abytes); 3301 3302 OPENSSL_free(s->session->srp_username); 3303 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login); 3304 if (s->session->srp_username == NULL) { 3305 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_SRP, 3306 ERR_R_MALLOC_FAILURE); 3307 return 0; 3308 } 3309 3310 return 1; 3311 #else 3312 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_SRP, 3313 ERR_R_INTERNAL_ERROR); 3314 return 0; 3315 #endif 3316 } 3317 3318 int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) 3319 { 3320 unsigned long alg_k; 3321 3322 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 3323 3324 /* 3325 * All of the construct functions below call SSLfatal() if necessary so 3326 * no need to do so here. 3327 */ 3328 if ((alg_k & SSL_PSK) 3329 && !tls_construct_cke_psk_preamble(s, pkt)) 3330 goto err; 3331 3332 if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) { 3333 if (!tls_construct_cke_rsa(s, pkt)) 3334 goto err; 3335 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { 3336 if (!tls_construct_cke_dhe(s, pkt)) 3337 goto err; 3338 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { 3339 if (!tls_construct_cke_ecdhe(s, pkt)) 3340 goto err; 3341 } else if (alg_k & SSL_kGOST) { 3342 if (!tls_construct_cke_gost(s, pkt)) 3343 goto err; 3344 } else if (alg_k & SSL_kSRP) { 3345 if (!tls_construct_cke_srp(s, pkt)) 3346 goto err; 3347 } else if (!(alg_k & SSL_kPSK)) { 3348 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3349 SSL_F_TLS_CONSTRUCT_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); 3350 goto err; 3351 } 3352 3353 return 1; 3354 err: 3355 OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen); 3356 s->s3->tmp.pms = NULL; 3357 s->s3->tmp.pmslen = 0; 3358 #ifndef OPENSSL_NO_PSK 3359 OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen); 3360 s->s3->tmp.psk = NULL; 3361 s->s3->tmp.psklen = 0; 3362 #endif 3363 return 0; 3364 } 3365 3366 int tls_client_key_exchange_post_work(SSL *s) 3367 { 3368 unsigned char *pms = NULL; 3369 size_t pmslen = 0; 3370 3371 pms = s->s3->tmp.pms; 3372 pmslen = s->s3->tmp.pmslen; 3373 3374 #ifndef OPENSSL_NO_SRP 3375 /* Check for SRP */ 3376 if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) { 3377 if (!srp_generate_client_master_secret(s)) { 3378 /* SSLfatal() already called */ 3379 goto err; 3380 } 3381 return 1; 3382 } 3383 #endif 3384 3385 if (pms == NULL && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) { 3386 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3387 SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, ERR_R_MALLOC_FAILURE); 3388 goto err; 3389 } 3390 if (!ssl_generate_master_secret(s, pms, pmslen, 1)) { 3391 /* SSLfatal() already called */ 3392 /* ssl_generate_master_secret frees the pms even on error */ 3393 pms = NULL; 3394 pmslen = 0; 3395 goto err; 3396 } 3397 pms = NULL; 3398 pmslen = 0; 3399 3400 #ifndef OPENSSL_NO_SCTP 3401 if (SSL_IS_DTLS(s)) { 3402 unsigned char sctpauthkey[64]; 3403 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; 3404 size_t labellen; 3405 3406 /* 3407 * Add new shared key for SCTP-Auth, will be ignored if no SCTP 3408 * used. 3409 */ 3410 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, 3411 sizeof(DTLS1_SCTP_AUTH_LABEL)); 3412 3413 /* Don't include the terminating zero. */ 3414 labellen = sizeof(labelbuffer) - 1; 3415 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) 3416 labellen += 1; 3417 3418 if (SSL_export_keying_material(s, sctpauthkey, 3419 sizeof(sctpauthkey), labelbuffer, 3420 labellen, NULL, 0, 0) <= 0) { 3421 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3422 SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, 3423 ERR_R_INTERNAL_ERROR); 3424 goto err; 3425 } 3426 3427 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, 3428 sizeof(sctpauthkey), sctpauthkey); 3429 } 3430 #endif 3431 3432 return 1; 3433 err: 3434 OPENSSL_clear_free(pms, pmslen); 3435 s->s3->tmp.pms = NULL; 3436 s->s3->tmp.pmslen = 0; 3437 return 0; 3438 } 3439 3440 /* 3441 * Check a certificate can be used for client authentication. Currently check 3442 * cert exists, if we have a suitable digest for TLS 1.2 if static DH client 3443 * certificates can be used and optionally checks suitability for Suite B. 3444 */ 3445 static int ssl3_check_client_certificate(SSL *s) 3446 { 3447 /* If no suitable signature algorithm can't use certificate */ 3448 if (!tls_choose_sigalg(s, 0) || s->s3->tmp.sigalg == NULL) 3449 return 0; 3450 /* 3451 * If strict mode check suitability of chain before using it. This also 3452 * adjusts suite B digest if necessary. 3453 */ 3454 if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT && 3455 !tls1_check_chain(s, NULL, NULL, NULL, -2)) 3456 return 0; 3457 return 1; 3458 } 3459 3460 WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) 3461 { 3462 X509 *x509 = NULL; 3463 EVP_PKEY *pkey = NULL; 3464 int i; 3465 3466 if (wst == WORK_MORE_A) { 3467 /* Let cert callback update client certificates if required */ 3468 if (s->cert->cert_cb) { 3469 i = s->cert->cert_cb(s, s->cert->cert_cb_arg); 3470 if (i < 0) { 3471 s->rwstate = SSL_X509_LOOKUP; 3472 return WORK_MORE_A; 3473 } 3474 if (i == 0) { 3475 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3476 SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, 3477 SSL_R_CALLBACK_FAILED); 3478 return WORK_ERROR; 3479 } 3480 s->rwstate = SSL_NOTHING; 3481 } 3482 if (ssl3_check_client_certificate(s)) { 3483 if (s->post_handshake_auth == SSL_PHA_REQUESTED) { 3484 return WORK_FINISHED_STOP; 3485 } 3486 return WORK_FINISHED_CONTINUE; 3487 } 3488 3489 /* Fall through to WORK_MORE_B */ 3490 wst = WORK_MORE_B; 3491 } 3492 3493 /* We need to get a client cert */ 3494 if (wst == WORK_MORE_B) { 3495 /* 3496 * If we get an error, we need to ssl->rwstate=SSL_X509_LOOKUP; 3497 * return(-1); We then get retied later 3498 */ 3499 i = ssl_do_client_cert_cb(s, &x509, &pkey); 3500 if (i < 0) { 3501 s->rwstate = SSL_X509_LOOKUP; 3502 return WORK_MORE_B; 3503 } 3504 s->rwstate = SSL_NOTHING; 3505 if ((i == 1) && (pkey != NULL) && (x509 != NULL)) { 3506 if (!SSL_use_certificate(s, x509) || !SSL_use_PrivateKey(s, pkey)) 3507 i = 0; 3508 } else if (i == 1) { 3509 i = 0; 3510 SSLerr(SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, 3511 SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); 3512 } 3513 3514 X509_free(x509); 3515 EVP_PKEY_free(pkey); 3516 if (i && !ssl3_check_client_certificate(s)) 3517 i = 0; 3518 if (i == 0) { 3519 if (s->version == SSL3_VERSION) { 3520 s->s3->tmp.cert_req = 0; 3521 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE); 3522 return WORK_FINISHED_CONTINUE; 3523 } else { 3524 s->s3->tmp.cert_req = 2; 3525 if (!ssl3_digest_cached_records(s, 0)) { 3526 /* SSLfatal() already called */ 3527 return WORK_ERROR; 3528 } 3529 } 3530 } 3531 3532 if (s->post_handshake_auth == SSL_PHA_REQUESTED) 3533 return WORK_FINISHED_STOP; 3534 return WORK_FINISHED_CONTINUE; 3535 } 3536 3537 /* Shouldn't ever get here */ 3538 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, 3539 ERR_R_INTERNAL_ERROR); 3540 return WORK_ERROR; 3541 } 3542 3543 int tls_construct_client_certificate(SSL *s, WPACKET *pkt) 3544 { 3545 if (SSL_IS_TLS13(s)) { 3546 if (s->pha_context == NULL) { 3547 /* no context available, add 0-length context */ 3548 if (!WPACKET_put_bytes_u8(pkt, 0)) { 3549 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3550 SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR); 3551 return 0; 3552 } 3553 } else if (!WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) { 3554 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3555 SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR); 3556 return 0; 3557 } 3558 } 3559 if (!ssl3_output_cert_chain(s, pkt, 3560 (s->s3->tmp.cert_req == 2) ? NULL 3561 : s->cert->key)) { 3562 /* SSLfatal() already called */ 3563 return 0; 3564 } 3565 3566 if (SSL_IS_TLS13(s) 3567 && SSL_IS_FIRST_HANDSHAKE(s) 3568 && (!s->method->ssl3_enc->change_cipher_state(s, 3569 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) { 3570 /* 3571 * This is a fatal error, which leaves enc_write_ctx in an inconsistent 3572 * state and thus ssl3_send_alert may crash. 3573 */ 3574 SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, 3575 SSL_R_CANNOT_CHANGE_CIPHER); 3576 return 0; 3577 } 3578 3579 return 1; 3580 } 3581 3582 int ssl3_check_cert_and_algorithm(SSL *s) 3583 { 3584 const SSL_CERT_LOOKUP *clu; 3585 size_t idx; 3586 long alg_k, alg_a; 3587 3588 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 3589 alg_a = s->s3->tmp.new_cipher->algorithm_auth; 3590 3591 /* we don't have a certificate */ 3592 if (!(alg_a & SSL_aCERT)) 3593 return 1; 3594 3595 /* This is the passed certificate */ 3596 clu = ssl_cert_lookup_by_pkey(X509_get0_pubkey(s->session->peer), &idx); 3597 3598 /* Check certificate is recognised and suitable for cipher */ 3599 if (clu == NULL || (alg_a & clu->amask) == 0) { 3600 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 3601 SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 3602 SSL_R_MISSING_SIGNING_CERT); 3603 return 0; 3604 } 3605 3606 #ifndef OPENSSL_NO_EC 3607 if (clu->amask & SSL_aECDSA) { 3608 if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s)) 3609 return 1; 3610 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 3611 SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_BAD_ECC_CERT); 3612 return 0; 3613 } 3614 #endif 3615 #ifndef OPENSSL_NO_RSA 3616 if (alg_k & (SSL_kRSA | SSL_kRSAPSK) && idx != SSL_PKEY_RSA) { 3617 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 3618 SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 3619 SSL_R_MISSING_RSA_ENCRYPTING_CERT); 3620 return 0; 3621 } 3622 #endif 3623 #ifndef OPENSSL_NO_DH 3624 if ((alg_k & SSL_kDHE) && (s->s3->peer_tmp == NULL)) { 3625 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 3626 ERR_R_INTERNAL_ERROR); 3627 return 0; 3628 } 3629 #endif 3630 3631 return 1; 3632 } 3633 3634 #ifndef OPENSSL_NO_NEXTPROTONEG 3635 int tls_construct_next_proto(SSL *s, WPACKET *pkt) 3636 { 3637 size_t len, padding_len; 3638 unsigned char *padding = NULL; 3639 3640 len = s->ext.npn_len; 3641 padding_len = 32 - ((len + 2) % 32); 3642 3643 if (!WPACKET_sub_memcpy_u8(pkt, s->ext.npn, len) 3644 || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) { 3645 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_NEXT_PROTO, 3646 ERR_R_INTERNAL_ERROR); 3647 return 0; 3648 } 3649 3650 memset(padding, 0, padding_len); 3651 3652 return 1; 3653 } 3654 #endif 3655 3656 MSG_PROCESS_RETURN tls_process_hello_req(SSL *s, PACKET *pkt) 3657 { 3658 if (PACKET_remaining(pkt) > 0) { 3659 /* should contain no data */ 3660 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_HELLO_REQ, 3661 SSL_R_LENGTH_MISMATCH); 3662 return MSG_PROCESS_ERROR; 3663 } 3664 3665 if ((s->options & SSL_OP_NO_RENEGOTIATION)) { 3666 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION); 3667 return MSG_PROCESS_FINISHED_READING; 3668 } 3669 3670 /* 3671 * This is a historical discrepancy (not in the RFC) maintained for 3672 * compatibility reasons. If a TLS client receives a HelloRequest it will 3673 * attempt an abbreviated handshake. However if a DTLS client receives a 3674 * HelloRequest it will do a full handshake. Either behaviour is reasonable 3675 * but doing one for TLS and another for DTLS is odd. 3676 */ 3677 if (SSL_IS_DTLS(s)) 3678 SSL_renegotiate(s); 3679 else 3680 SSL_renegotiate_abbreviated(s); 3681 3682 return MSG_PROCESS_FINISHED_READING; 3683 } 3684 3685 static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt) 3686 { 3687 PACKET extensions; 3688 RAW_EXTENSION *rawexts = NULL; 3689 3690 if (!PACKET_as_length_prefixed_2(pkt, &extensions) 3691 || PACKET_remaining(pkt) != 0) { 3692 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS, 3693 SSL_R_LENGTH_MISMATCH); 3694 goto err; 3695 } 3696 3697 if (!tls_collect_extensions(s, &extensions, 3698 SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, &rawexts, 3699 NULL, 1) 3700 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, 3701 rawexts, NULL, 0, 1)) { 3702 /* SSLfatal() already called */ 3703 goto err; 3704 } 3705 3706 OPENSSL_free(rawexts); 3707 return MSG_PROCESS_CONTINUE_READING; 3708 3709 err: 3710 OPENSSL_free(rawexts); 3711 return MSG_PROCESS_ERROR; 3712 } 3713 3714 int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey) 3715 { 3716 int i = 0; 3717 #ifndef OPENSSL_NO_ENGINE 3718 if (s->ctx->client_cert_engine) { 3719 i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s, 3720 SSL_get_client_CA_list(s), 3721 px509, ppkey, NULL, NULL, NULL); 3722 if (i != 0) 3723 return i; 3724 } 3725 #endif 3726 if (s->ctx->client_cert_cb) 3727 i = s->ctx->client_cert_cb(s, px509, ppkey); 3728 return i; 3729 } 3730 3731 int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) 3732 { 3733 int i; 3734 size_t totlen = 0, len, maxlen, maxverok = 0; 3735 int empty_reneg_info_scsv = !s->renegotiate; 3736 3737 /* Set disabled masks for this session */ 3738 if (!ssl_set_client_disabled(s)) { 3739 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, 3740 SSL_R_NO_PROTOCOLS_AVAILABLE); 3741 return 0; 3742 } 3743 3744 if (sk == NULL) { 3745 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, 3746 ERR_R_INTERNAL_ERROR); 3747 return 0; 3748 } 3749 3750 #ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH 3751 # if OPENSSL_MAX_TLS1_2_CIPHER_LENGTH < 6 3752 # error Max cipher length too short 3753 # endif 3754 /* 3755 * Some servers hang if client hello > 256 bytes as hack workaround 3756 * chop number of supported ciphers to keep it well below this if we 3757 * use TLS v1.2 3758 */ 3759 if (TLS1_get_version(s) >= TLS1_2_VERSION) 3760 maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1; 3761 else 3762 #endif 3763 /* Maximum length that can be stored in 2 bytes. Length must be even */ 3764 maxlen = 0xfffe; 3765 3766 if (empty_reneg_info_scsv) 3767 maxlen -= 2; 3768 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) 3769 maxlen -= 2; 3770 3771 for (i = 0; i < sk_SSL_CIPHER_num(sk) && totlen < maxlen; i++) { 3772 const SSL_CIPHER *c; 3773 3774 c = sk_SSL_CIPHER_value(sk, i); 3775 /* Skip disabled ciphers */ 3776 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) 3777 continue; 3778 3779 if (!s->method->put_cipher_by_char(c, pkt, &len)) { 3780 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, 3781 ERR_R_INTERNAL_ERROR); 3782 return 0; 3783 } 3784 3785 /* Sanity check that the maximum version we offer has ciphers enabled */ 3786 if (!maxverok) { 3787 if (SSL_IS_DTLS(s)) { 3788 if (DTLS_VERSION_GE(c->max_dtls, s->s3->tmp.max_ver) 3789 && DTLS_VERSION_LE(c->min_dtls, s->s3->tmp.max_ver)) 3790 maxverok = 1; 3791 } else { 3792 if (c->max_tls >= s->s3->tmp.max_ver 3793 && c->min_tls <= s->s3->tmp.max_ver) 3794 maxverok = 1; 3795 } 3796 } 3797 3798 totlen += len; 3799 } 3800 3801 if (totlen == 0 || !maxverok) { 3802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, 3803 SSL_R_NO_CIPHERS_AVAILABLE); 3804 3805 if (!maxverok) 3806 ERR_add_error_data(1, "No ciphers enabled for max supported " 3807 "SSL/TLS version"); 3808 3809 return 0; 3810 } 3811 3812 if (totlen != 0) { 3813 if (empty_reneg_info_scsv) { 3814 static SSL_CIPHER scsv = { 3815 0, NULL, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 3816 }; 3817 if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) { 3818 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3819 SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR); 3820 return 0; 3821 } 3822 } 3823 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) { 3824 static SSL_CIPHER scsv = { 3825 0, NULL, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 3826 }; 3827 if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) { 3828 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3829 SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR); 3830 return 0; 3831 } 3832 } 3833 } 3834 3835 return 1; 3836 } 3837 3838 int tls_construct_end_of_early_data(SSL *s, WPACKET *pkt) 3839 { 3840 if (s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 3841 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) { 3842 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 3843 SSL_F_TLS_CONSTRUCT_END_OF_EARLY_DATA, 3844 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 3845 return 0; 3846 } 3847 3848 s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING; 3849 return 1; 3850 } 3851