1 /* 2 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved 4 * Copyright 2005 Nokia. All rights reserved. 5 * 6 * Licensed under the Apache License 2.0 (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include <stdio.h> 13 #include <time.h> 14 #include <assert.h> 15 #include "../ssl_local.h" 16 #include "statem_local.h" 17 #include <openssl/buffer.h> 18 #include <openssl/rand.h> 19 #include <openssl/objects.h> 20 #include <openssl/evp.h> 21 #include <openssl/md5.h> 22 #include <openssl/dh.h> 23 #include <openssl/rsa.h> 24 #include <openssl/bn.h> 25 #include <openssl/engine.h> 26 #include <openssl/trace.h> 27 #include <openssl/core_names.h> 28 #include <openssl/param_build.h> 29 #include "internal/cryptlib.h" 30 #include "internal/comp.h" 31 #include "internal/ssl_unwrap.h" 32 33 static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s, 34 PACKET *pkt); 35 static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s, 36 PACKET *pkt); 37 38 static ossl_inline int cert_req_allowed(SSL_CONNECTION *s); 39 static int key_exchange_expected(SSL_CONNECTION *s); 40 static int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk, 41 WPACKET *pkt); 42 43 static ossl_inline int received_server_cert(SSL_CONNECTION *sc) 44 { 45 return sc->session->peer_rpk != NULL || sc->session->peer != NULL; 46 } 47 48 /* 49 * Is a CertificateRequest message allowed at the moment or not? 50 * 51 * Return values are: 52 * 1: Yes 53 * 0: No 54 */ 55 static ossl_inline int cert_req_allowed(SSL_CONNECTION *s) 56 { 57 /* TLS does not like anon-DH with client cert */ 58 if ((s->version > SSL3_VERSION 59 && (s->s3.tmp.new_cipher->algorithm_auth & SSL_aNULL)) 60 || (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK))) 61 return 0; 62 63 return 1; 64 } 65 66 /* 67 * Should we expect the ServerKeyExchange message or not? 68 * 69 * Return values are: 70 * 1: Yes 71 * 0: No 72 */ 73 static int key_exchange_expected(SSL_CONNECTION *s) 74 { 75 long alg_k = s->s3.tmp.new_cipher->algorithm_mkey; 76 77 /* 78 * Can't skip server key exchange if this is an ephemeral 79 * ciphersuite or for SRP 80 */ 81 if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK | SSL_kSRP)) { 82 return 1; 83 } 84 85 return 0; 86 } 87 88 /* 89 * ossl_statem_client_read_transition() encapsulates the logic for the allowed 90 * handshake state transitions when a TLS1.3 client is reading messages from the 91 * server. The message type that the server has sent is provided in |mt|. The 92 * current state is in |s->statem.hand_state|. 93 * 94 * Return values are 1 for success (transition allowed) and 0 on error 95 * (transition not allowed) 96 */ 97 static int ossl_statem_client13_read_transition(SSL_CONNECTION *s, int mt) 98 { 99 OSSL_STATEM *st = &s->statem; 100 101 /* 102 * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't 103 * yet negotiated TLSv1.3 at that point so that is handled by 104 * ossl_statem_client_read_transition() 105 */ 106 107 switch (st->hand_state) { 108 default: 109 break; 110 111 case TLS_ST_CW_CLNT_HELLO: 112 /* 113 * This must a ClientHello following a HelloRetryRequest, so the only 114 * thing we can get now is a ServerHello. 115 */ 116 if (mt == SSL3_MT_SERVER_HELLO) { 117 st->hand_state = TLS_ST_CR_SRVR_HELLO; 118 return 1; 119 } 120 break; 121 122 case TLS_ST_CR_SRVR_HELLO: 123 if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) { 124 st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS; 125 return 1; 126 } 127 break; 128 129 case TLS_ST_CR_ENCRYPTED_EXTENSIONS: 130 if (s->hit) { 131 if (mt == SSL3_MT_FINISHED) { 132 st->hand_state = TLS_ST_CR_FINISHED; 133 return 1; 134 } 135 } else { 136 if (mt == SSL3_MT_CERTIFICATE_REQUEST) { 137 st->hand_state = TLS_ST_CR_CERT_REQ; 138 return 1; 139 } 140 if (mt == SSL3_MT_CERTIFICATE) { 141 st->hand_state = TLS_ST_CR_CERT; 142 return 1; 143 } 144 #ifndef OPENSSL_NO_COMP_ALG 145 if (mt == SSL3_MT_COMPRESSED_CERTIFICATE 146 && s->ext.compress_certificate_sent) { 147 st->hand_state = TLS_ST_CR_COMP_CERT; 148 return 1; 149 } 150 #endif 151 } 152 break; 153 154 case TLS_ST_CR_CERT_REQ: 155 if (mt == SSL3_MT_CERTIFICATE) { 156 st->hand_state = TLS_ST_CR_CERT; 157 return 1; 158 } 159 #ifndef OPENSSL_NO_COMP_ALG 160 if (mt == SSL3_MT_COMPRESSED_CERTIFICATE 161 && s->ext.compress_certificate_sent) { 162 st->hand_state = TLS_ST_CR_COMP_CERT; 163 return 1; 164 } 165 #endif 166 break; 167 168 case TLS_ST_CR_CERT: 169 case TLS_ST_CR_COMP_CERT: 170 if (mt == SSL3_MT_CERTIFICATE_VERIFY) { 171 st->hand_state = TLS_ST_CR_CERT_VRFY; 172 return 1; 173 } 174 break; 175 176 case TLS_ST_CR_CERT_VRFY: 177 if (mt == SSL3_MT_FINISHED) { 178 st->hand_state = TLS_ST_CR_FINISHED; 179 return 1; 180 } 181 break; 182 183 case TLS_ST_OK: 184 if (mt == SSL3_MT_NEWSESSION_TICKET) { 185 st->hand_state = TLS_ST_CR_SESSION_TICKET; 186 return 1; 187 } 188 if (mt == SSL3_MT_KEY_UPDATE && !SSL_IS_QUIC_HANDSHAKE(s)) { 189 st->hand_state = TLS_ST_CR_KEY_UPDATE; 190 return 1; 191 } 192 if (mt == SSL3_MT_CERTIFICATE_REQUEST) { 193 #if DTLS_MAX_VERSION_INTERNAL != DTLS1_2_VERSION 194 /* Restore digest for PHA before adding message.*/ 195 #error Internal DTLS version error 196 #endif 197 if (!SSL_CONNECTION_IS_DTLS(s) 198 && s->post_handshake_auth == SSL_PHA_EXT_SENT) { 199 s->post_handshake_auth = SSL_PHA_REQUESTED; 200 /* 201 * In TLS, this is called before the message is added to the 202 * digest. In DTLS, this is expected to be called after adding 203 * to the digest. Either move the digest restore, or add the 204 * message here after the swap, or do it after the clientFinished? 205 */ 206 if (!tls13_restore_handshake_digest_for_pha(s)) { 207 /* SSLfatal() already called */ 208 return 0; 209 } 210 st->hand_state = TLS_ST_CR_CERT_REQ; 211 return 1; 212 } 213 } 214 break; 215 } 216 217 /* No valid transition found */ 218 return 0; 219 } 220 221 /* 222 * ossl_statem_client_read_transition() encapsulates the logic for the allowed 223 * handshake state transitions when the client is reading messages from the 224 * server. The message type that the server has sent is provided in |mt|. The 225 * current state is in |s->statem.hand_state|. 226 * 227 * Return values are 1 for success (transition allowed) and 0 on error 228 * (transition not allowed) 229 */ 230 int ossl_statem_client_read_transition(SSL_CONNECTION *s, int mt) 231 { 232 OSSL_STATEM *st = &s->statem; 233 int ske_expected; 234 235 /* 236 * Note that after writing the first ClientHello we don't know what version 237 * we are going to negotiate yet, so we don't take this branch until later. 238 */ 239 if (SSL_CONNECTION_IS_TLS13(s)) { 240 if (!ossl_statem_client13_read_transition(s, mt)) 241 goto err; 242 return 1; 243 } 244 245 switch (st->hand_state) { 246 default: 247 break; 248 249 case TLS_ST_CW_CLNT_HELLO: 250 if (mt == SSL3_MT_SERVER_HELLO) { 251 st->hand_state = TLS_ST_CR_SRVR_HELLO; 252 return 1; 253 } 254 255 if (SSL_CONNECTION_IS_DTLS(s)) { 256 if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { 257 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; 258 return 1; 259 } 260 } 261 break; 262 263 case TLS_ST_EARLY_DATA: 264 /* 265 * We've not actually selected TLSv1.3 yet, but we have sent early 266 * data. The only thing allowed now is a ServerHello or a 267 * HelloRetryRequest. 268 */ 269 if (mt == SSL3_MT_SERVER_HELLO) { 270 st->hand_state = TLS_ST_CR_SRVR_HELLO; 271 return 1; 272 } 273 break; 274 275 case TLS_ST_CR_SRVR_HELLO: 276 if (s->hit) { 277 if (s->ext.ticket_expected) { 278 if (mt == SSL3_MT_NEWSESSION_TICKET) { 279 st->hand_state = TLS_ST_CR_SESSION_TICKET; 280 return 1; 281 } 282 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 283 st->hand_state = TLS_ST_CR_CHANGE; 284 return 1; 285 } 286 } else { 287 if (SSL_CONNECTION_IS_DTLS(s) 288 && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { 289 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; 290 return 1; 291 } else if (s->version >= TLS1_VERSION 292 && s->ext.session_secret_cb != NULL 293 && s->session->ext.tick != NULL 294 && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 295 /* 296 * Normally, we can tell if the server is resuming the session 297 * from the session ID. EAP-FAST (RFC 4851), however, relies on 298 * the next server message after the ServerHello to determine if 299 * the server is resuming. 300 */ 301 s->hit = 1; 302 st->hand_state = TLS_ST_CR_CHANGE; 303 return 1; 304 } else if (!(s->s3.tmp.new_cipher->algorithm_auth 305 & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) { 306 if (mt == SSL3_MT_CERTIFICATE) { 307 st->hand_state = TLS_ST_CR_CERT; 308 return 1; 309 } 310 } else { 311 ske_expected = key_exchange_expected(s); 312 /* SKE is optional for some PSK ciphersuites */ 313 if (ske_expected 314 || ((s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK) 315 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) { 316 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) { 317 st->hand_state = TLS_ST_CR_KEY_EXCH; 318 return 1; 319 } 320 } else if (mt == SSL3_MT_CERTIFICATE_REQUEST 321 && cert_req_allowed(s)) { 322 st->hand_state = TLS_ST_CR_CERT_REQ; 323 return 1; 324 } else if (mt == SSL3_MT_SERVER_DONE) { 325 st->hand_state = TLS_ST_CR_SRVR_DONE; 326 return 1; 327 } 328 } 329 } 330 break; 331 332 case TLS_ST_CR_CERT: 333 case TLS_ST_CR_COMP_CERT: 334 /* 335 * The CertificateStatus message is optional even if 336 * |ext.status_expected| is set 337 */ 338 if (s->ext.status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) { 339 st->hand_state = TLS_ST_CR_CERT_STATUS; 340 return 1; 341 } 342 /* Fall through */ 343 344 case TLS_ST_CR_CERT_STATUS: 345 ske_expected = key_exchange_expected(s); 346 /* SKE is optional for some PSK ciphersuites */ 347 if (ske_expected || ((s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK) && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) { 348 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) { 349 st->hand_state = TLS_ST_CR_KEY_EXCH; 350 return 1; 351 } 352 goto err; 353 } 354 /* Fall through */ 355 356 case TLS_ST_CR_KEY_EXCH: 357 if (mt == SSL3_MT_CERTIFICATE_REQUEST) { 358 if (cert_req_allowed(s)) { 359 st->hand_state = TLS_ST_CR_CERT_REQ; 360 return 1; 361 } 362 goto err; 363 } 364 /* Fall through */ 365 366 case TLS_ST_CR_CERT_REQ: 367 if (mt == SSL3_MT_SERVER_DONE) { 368 st->hand_state = TLS_ST_CR_SRVR_DONE; 369 return 1; 370 } 371 break; 372 373 case TLS_ST_CW_FINISHED: 374 if (s->ext.ticket_expected) { 375 if (mt == SSL3_MT_NEWSESSION_TICKET) { 376 st->hand_state = TLS_ST_CR_SESSION_TICKET; 377 return 1; 378 } 379 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 380 st->hand_state = TLS_ST_CR_CHANGE; 381 return 1; 382 } 383 break; 384 385 case TLS_ST_CR_SESSION_TICKET: 386 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 387 st->hand_state = TLS_ST_CR_CHANGE; 388 return 1; 389 } 390 break; 391 392 case TLS_ST_CR_CHANGE: 393 if (mt == SSL3_MT_FINISHED) { 394 st->hand_state = TLS_ST_CR_FINISHED; 395 return 1; 396 } 397 break; 398 399 case TLS_ST_OK: 400 if (mt == SSL3_MT_HELLO_REQUEST) { 401 st->hand_state = TLS_ST_CR_HELLO_REQ; 402 return 1; 403 } 404 break; 405 } 406 407 err: 408 /* No valid transition found */ 409 if (SSL_CONNECTION_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { 410 BIO *rbio; 411 412 /* 413 * CCS messages don't have a message sequence number so this is probably 414 * because of an out-of-order CCS. We'll just drop it. 415 */ 416 s->init_num = 0; 417 s->rwstate = SSL_READING; 418 rbio = SSL_get_rbio(SSL_CONNECTION_GET_SSL(s)); 419 BIO_clear_retry_flags(rbio); 420 BIO_set_retry_read(rbio); 421 return 0; 422 } 423 SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); 424 return 0; 425 } 426 427 static int do_compressed_cert(SSL_CONNECTION *sc) 428 { 429 /* If we negotiated RPK, we won't try to compress it */ 430 return sc->ext.client_cert_type == TLSEXT_cert_type_x509 431 && sc->ext.compress_certificate_from_peer[0] != TLSEXT_comp_cert_none; 432 } 433 434 /* 435 * ossl_statem_client13_write_transition() works out what handshake state to 436 * move to next when the TLSv1.3 client is writing messages to be sent to the 437 * server. 438 */ 439 static WRITE_TRAN ossl_statem_client13_write_transition(SSL_CONNECTION *s) 440 { 441 OSSL_STATEM *st = &s->statem; 442 443 /* 444 * Note: There are no cases for TLS_ST_BEFORE because we haven't negotiated 445 * TLSv1.3 yet at that point. They are handled by 446 * ossl_statem_client_write_transition(). 447 */ 448 switch (st->hand_state) { 449 default: 450 /* Shouldn't happen */ 451 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 452 return WRITE_TRAN_ERROR; 453 454 case TLS_ST_CR_CERT_REQ: 455 if (s->post_handshake_auth == SSL_PHA_REQUESTED) { 456 if (do_compressed_cert(s)) 457 st->hand_state = TLS_ST_CW_COMP_CERT; 458 else 459 st->hand_state = TLS_ST_CW_CERT; 460 return WRITE_TRAN_CONTINUE; 461 } 462 /* 463 * We should only get here if we received a CertificateRequest after 464 * we already sent close_notify 465 */ 466 if (!ossl_assert((s->shutdown & SSL_SENT_SHUTDOWN) != 0)) { 467 /* Shouldn't happen - same as default case */ 468 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 469 return WRITE_TRAN_ERROR; 470 } 471 st->hand_state = TLS_ST_OK; 472 return WRITE_TRAN_CONTINUE; 473 474 case TLS_ST_CR_FINISHED: 475 if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY 476 || s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING) 477 st->hand_state = TLS_ST_PENDING_EARLY_DATA_END; 478 else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 479 && s->hello_retry_request == SSL_HRR_NONE) 480 st->hand_state = TLS_ST_CW_CHANGE; 481 else if (s->s3.tmp.cert_req == 0) 482 st->hand_state = TLS_ST_CW_FINISHED; 483 else if (do_compressed_cert(s)) 484 st->hand_state = TLS_ST_CW_COMP_CERT; 485 else 486 st->hand_state = TLS_ST_CW_CERT; 487 488 s->ts_msg_read = ossl_time_now(); 489 return WRITE_TRAN_CONTINUE; 490 491 case TLS_ST_PENDING_EARLY_DATA_END: 492 if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED && !SSL_NO_EOED(s)) { 493 st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA; 494 return WRITE_TRAN_CONTINUE; 495 } 496 /* Fall through */ 497 498 case TLS_ST_CW_END_OF_EARLY_DATA: 499 case TLS_ST_CW_CHANGE: 500 if (s->s3.tmp.cert_req == 0) 501 st->hand_state = TLS_ST_CW_FINISHED; 502 else if (do_compressed_cert(s)) 503 st->hand_state = TLS_ST_CW_COMP_CERT; 504 else 505 st->hand_state = TLS_ST_CW_CERT; 506 return WRITE_TRAN_CONTINUE; 507 508 case TLS_ST_CW_COMP_CERT: 509 case TLS_ST_CW_CERT: 510 /* If a non-empty Certificate we also send CertificateVerify */ 511 st->hand_state = (s->s3.tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY 512 : TLS_ST_CW_FINISHED; 513 return WRITE_TRAN_CONTINUE; 514 515 case TLS_ST_CW_CERT_VRFY: 516 st->hand_state = TLS_ST_CW_FINISHED; 517 return WRITE_TRAN_CONTINUE; 518 519 case TLS_ST_CR_KEY_UPDATE: 520 case TLS_ST_CW_KEY_UPDATE: 521 case TLS_ST_CR_SESSION_TICKET: 522 case TLS_ST_CW_FINISHED: 523 st->hand_state = TLS_ST_OK; 524 return WRITE_TRAN_CONTINUE; 525 526 case TLS_ST_OK: 527 if (s->key_update != SSL_KEY_UPDATE_NONE) { 528 st->hand_state = TLS_ST_CW_KEY_UPDATE; 529 return WRITE_TRAN_CONTINUE; 530 } 531 532 /* Try to read from the server instead */ 533 return WRITE_TRAN_FINISHED; 534 } 535 } 536 537 /* 538 * ossl_statem_client_write_transition() works out what handshake state to 539 * move to next when the client is writing messages to be sent to the server. 540 */ 541 WRITE_TRAN ossl_statem_client_write_transition(SSL_CONNECTION *s) 542 { 543 OSSL_STATEM *st = &s->statem; 544 545 /* 546 * Note that immediately before/after a ClientHello we don't know what 547 * version we are going to negotiate yet, so we don't take this branch until 548 * later 549 */ 550 if (SSL_CONNECTION_IS_TLS13(s)) 551 return ossl_statem_client13_write_transition(s); 552 553 switch (st->hand_state) { 554 default: 555 /* Shouldn't happen */ 556 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 557 return WRITE_TRAN_ERROR; 558 559 case TLS_ST_OK: 560 if (!s->renegotiate) { 561 /* 562 * We haven't requested a renegotiation ourselves so we must have 563 * received a message from the server. Better read it. 564 */ 565 return WRITE_TRAN_FINISHED; 566 } 567 /* Renegotiation */ 568 /* fall thru */ 569 case TLS_ST_BEFORE: 570 st->hand_state = TLS_ST_CW_CLNT_HELLO; 571 return WRITE_TRAN_CONTINUE; 572 573 case TLS_ST_CW_CLNT_HELLO: 574 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING 575 && !SSL_IS_QUIC_HANDSHAKE(s)) { 576 /* 577 * We are assuming this is a TLSv1.3 connection, although we haven't 578 * actually selected a version yet. 579 */ 580 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) 581 st->hand_state = TLS_ST_CW_CHANGE; 582 else 583 st->hand_state = TLS_ST_EARLY_DATA; 584 return WRITE_TRAN_CONTINUE; 585 } 586 /* 587 * No transition at the end of writing because we don't know what 588 * we will be sent 589 */ 590 s->ts_msg_write = ossl_time_now(); 591 return WRITE_TRAN_FINISHED; 592 593 case TLS_ST_CR_SRVR_HELLO: 594 /* 595 * We only get here in TLSv1.3. We just received an HRR, so issue a 596 * CCS unless middlebox compat mode is off, or we already issued one 597 * because we did early data. 598 */ 599 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 600 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 601 st->hand_state = TLS_ST_CW_CHANGE; 602 else 603 st->hand_state = TLS_ST_CW_CLNT_HELLO; 604 return WRITE_TRAN_CONTINUE; 605 606 case TLS_ST_EARLY_DATA: 607 s->ts_msg_write = ossl_time_now(); 608 return WRITE_TRAN_FINISHED; 609 610 case DTLS_ST_CR_HELLO_VERIFY_REQUEST: 611 st->hand_state = TLS_ST_CW_CLNT_HELLO; 612 return WRITE_TRAN_CONTINUE; 613 614 case TLS_ST_CR_SRVR_DONE: 615 s->ts_msg_read = ossl_time_now(); 616 if (s->s3.tmp.cert_req) 617 st->hand_state = TLS_ST_CW_CERT; 618 else 619 st->hand_state = TLS_ST_CW_KEY_EXCH; 620 return WRITE_TRAN_CONTINUE; 621 622 case TLS_ST_CW_CERT: 623 st->hand_state = TLS_ST_CW_KEY_EXCH; 624 return WRITE_TRAN_CONTINUE; 625 626 case TLS_ST_CW_KEY_EXCH: 627 /* 628 * For TLS, cert_req is set to 2, so a cert chain of nothing is 629 * sent, but no verify packet is sent 630 */ 631 /* 632 * XXX: For now, we do not support client authentication in ECDH 633 * cipher suites with ECDH (rather than ECDSA) certificates. We 634 * need to skip the certificate verify message when client's 635 * ECDH public key is sent inside the client certificate. 636 */ 637 if (s->s3.tmp.cert_req == 1) { 638 st->hand_state = TLS_ST_CW_CERT_VRFY; 639 } else { 640 st->hand_state = TLS_ST_CW_CHANGE; 641 } 642 if (s->s3.flags & TLS1_FLAGS_SKIP_CERT_VERIFY) { 643 st->hand_state = TLS_ST_CW_CHANGE; 644 } 645 return WRITE_TRAN_CONTINUE; 646 647 case TLS_ST_CW_CERT_VRFY: 648 st->hand_state = TLS_ST_CW_CHANGE; 649 return WRITE_TRAN_CONTINUE; 650 651 case TLS_ST_CW_CHANGE: 652 if (s->hello_retry_request == SSL_HRR_PENDING) { 653 st->hand_state = TLS_ST_CW_CLNT_HELLO; 654 } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) { 655 st->hand_state = TLS_ST_EARLY_DATA; 656 } else { 657 #if defined(OPENSSL_NO_NEXTPROTONEG) 658 st->hand_state = TLS_ST_CW_FINISHED; 659 #else 660 if (!SSL_CONNECTION_IS_DTLS(s) && s->s3.npn_seen) 661 st->hand_state = TLS_ST_CW_NEXT_PROTO; 662 else 663 st->hand_state = TLS_ST_CW_FINISHED; 664 #endif 665 } 666 return WRITE_TRAN_CONTINUE; 667 668 #if !defined(OPENSSL_NO_NEXTPROTONEG) 669 case TLS_ST_CW_NEXT_PROTO: 670 st->hand_state = TLS_ST_CW_FINISHED; 671 return WRITE_TRAN_CONTINUE; 672 #endif 673 674 case TLS_ST_CW_FINISHED: 675 if (s->hit) { 676 st->hand_state = TLS_ST_OK; 677 return WRITE_TRAN_CONTINUE; 678 } else { 679 return WRITE_TRAN_FINISHED; 680 } 681 682 case TLS_ST_CR_FINISHED: 683 if (s->hit) { 684 st->hand_state = TLS_ST_CW_CHANGE; 685 return WRITE_TRAN_CONTINUE; 686 } else { 687 st->hand_state = TLS_ST_OK; 688 return WRITE_TRAN_CONTINUE; 689 } 690 691 case TLS_ST_CR_HELLO_REQ: 692 /* 693 * If we can renegotiate now then do so, otherwise wait for a more 694 * convenient time. 695 */ 696 if (ssl3_renegotiate_check(SSL_CONNECTION_GET_SSL(s), 1)) { 697 if (!tls_setup_handshake(s)) { 698 /* SSLfatal() already called */ 699 return WRITE_TRAN_ERROR; 700 } 701 st->hand_state = TLS_ST_CW_CLNT_HELLO; 702 return WRITE_TRAN_CONTINUE; 703 } 704 st->hand_state = TLS_ST_OK; 705 return WRITE_TRAN_CONTINUE; 706 } 707 } 708 709 /* 710 * Perform any pre work that needs to be done prior to sending a message from 711 * the client to the server. 712 */ 713 WORK_STATE ossl_statem_client_pre_work(SSL_CONNECTION *s, WORK_STATE wst) 714 { 715 OSSL_STATEM *st = &s->statem; 716 717 switch (st->hand_state) { 718 default: 719 /* No pre work to be done */ 720 break; 721 722 case TLS_ST_CW_CLNT_HELLO: 723 s->shutdown = 0; 724 if (SSL_CONNECTION_IS_DTLS(s)) { 725 /* every DTLS ClientHello resets Finished MAC */ 726 if (!ssl3_init_finished_mac(s)) { 727 /* SSLfatal() already called */ 728 return WORK_ERROR; 729 } 730 } else if (s->ext.early_data == SSL_EARLY_DATA_REJECTED) { 731 /* 732 * This must be a second ClientHello after an HRR following an 733 * earlier rejected attempt to send early data. Since we were 734 * previously encrypting the early data we now need to reset the 735 * write record layer in order to write in plaintext again. 736 */ 737 if (!ssl_set_new_record_layer(s, 738 TLS_ANY_VERSION, 739 OSSL_RECORD_DIRECTION_WRITE, 740 OSSL_RECORD_PROTECTION_LEVEL_NONE, 741 NULL, 0, NULL, 0, NULL, 0, NULL, 0, 742 NULL, 0, NID_undef, NULL, NULL, 743 NULL)) { 744 /* SSLfatal already called */ 745 return WORK_ERROR; 746 } 747 } 748 break; 749 750 case TLS_ST_CW_CHANGE: 751 if (SSL_CONNECTION_IS_DTLS(s)) { 752 if (s->hit) { 753 /* 754 * We're into the last flight so we don't retransmit these 755 * messages unless we need to. 756 */ 757 st->use_timer = 0; 758 } 759 #ifndef OPENSSL_NO_SCTP 760 if (BIO_dgram_is_sctp(SSL_get_wbio(SSL_CONNECTION_GET_SSL(s)))) { 761 /* Calls SSLfatal() as required */ 762 return dtls_wait_for_dry(s); 763 } 764 #endif 765 } 766 break; 767 768 case TLS_ST_PENDING_EARLY_DATA_END: 769 /* 770 * If we've been called by SSL_do_handshake()/SSL_write(), or we did not 771 * attempt to write early data before calling SSL_read() then we press 772 * on with the handshake. Otherwise we pause here. 773 */ 774 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING 775 || s->early_data_state == SSL_EARLY_DATA_NONE) 776 return WORK_FINISHED_CONTINUE; 777 /* Fall through */ 778 779 case TLS_ST_EARLY_DATA: 780 return tls_finish_handshake(s, wst, 0, 1); 781 782 case TLS_ST_OK: 783 /* Calls SSLfatal() as required */ 784 return tls_finish_handshake(s, wst, 1, 1); 785 } 786 787 return WORK_FINISHED_CONTINUE; 788 } 789 790 /* 791 * Perform any work that needs to be done after sending a message from the 792 * client to the server. 793 */ 794 WORK_STATE ossl_statem_client_post_work(SSL_CONNECTION *s, WORK_STATE wst) 795 { 796 OSSL_STATEM *st = &s->statem; 797 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 798 799 s->init_num = 0; 800 801 switch (st->hand_state) { 802 default: 803 /* No post work to be done */ 804 break; 805 806 case TLS_ST_CW_CLNT_HELLO: 807 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING 808 && s->max_early_data > 0) { 809 /* 810 * We haven't selected TLSv1.3 yet so we don't call the change 811 * cipher state function associated with the SSL_METHOD. Instead 812 * we call tls13_change_cipher_state() directly. 813 */ 814 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0) { 815 if (!tls13_change_cipher_state(s, 816 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 817 /* SSLfatal() already called */ 818 return WORK_ERROR; 819 } 820 } 821 /* else we're in compat mode so we delay flushing until after CCS */ 822 } else if (!statem_flush(s)) { 823 return WORK_MORE_A; 824 } 825 826 if (SSL_CONNECTION_IS_DTLS(s)) { 827 /* Treat the next message as the first packet */ 828 s->first_packet = 1; 829 } 830 break; 831 832 case TLS_ST_CW_KEY_EXCH: 833 if (tls_client_key_exchange_post_work(s) == 0) { 834 /* SSLfatal() already called */ 835 return WORK_ERROR; 836 } 837 break; 838 839 case TLS_ST_CW_CHANGE: 840 if (SSL_CONNECTION_IS_TLS13(s) 841 || s->hello_retry_request == SSL_HRR_PENDING) 842 break; 843 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING 844 && s->max_early_data > 0) { 845 /* 846 * We haven't selected TLSv1.3 yet so we don't call the change 847 * cipher state function associated with the SSL_METHOD. Instead 848 * we call tls13_change_cipher_state() directly. 849 */ 850 if (!tls13_change_cipher_state(s, 851 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) 852 return WORK_ERROR; 853 break; 854 } 855 s->session->cipher = s->s3.tmp.new_cipher; 856 #ifdef OPENSSL_NO_COMP 857 s->session->compress_meth = 0; 858 #else 859 if (s->s3.tmp.new_compression == NULL) 860 s->session->compress_meth = 0; 861 else 862 s->session->compress_meth = s->s3.tmp.new_compression->id; 863 #endif 864 if (!ssl->method->ssl3_enc->setup_key_block(s)) { 865 /* SSLfatal() already called */ 866 return WORK_ERROR; 867 } 868 869 if (!ssl->method->ssl3_enc->change_cipher_state(s, 870 SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 871 /* SSLfatal() already called */ 872 return WORK_ERROR; 873 } 874 875 #ifndef OPENSSL_NO_SCTP 876 if (SSL_CONNECTION_IS_DTLS(s) && s->hit) { 877 /* 878 * Change to new shared key of SCTP-Auth, will be ignored if 879 * no SCTP used. 880 */ 881 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 882 0, NULL); 883 } 884 #endif 885 break; 886 887 case TLS_ST_CW_FINISHED: 888 #ifndef OPENSSL_NO_SCTP 889 if (wst == WORK_MORE_A && SSL_CONNECTION_IS_DTLS(s) && s->hit == 0) { 890 /* 891 * Change to new shared key of SCTP-Auth, will be ignored if 892 * no SCTP used. 893 */ 894 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 895 0, NULL); 896 } 897 #endif 898 if (statem_flush(s) != 1) 899 return WORK_MORE_B; 900 901 if (SSL_CONNECTION_IS_TLS13(s)) { 902 if (!tls13_save_handshake_digest_for_pha(s)) { 903 /* SSLfatal() already called */ 904 return WORK_ERROR; 905 } 906 if (s->post_handshake_auth != SSL_PHA_REQUESTED) { 907 if (!ssl->method->ssl3_enc->change_cipher_state(s, 908 SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 909 /* SSLfatal() already called */ 910 return WORK_ERROR; 911 } 912 /* 913 * For QUIC we deferred setting up these keys until now so 914 * that we can ensure write keys are always set up before read 915 * keys. 916 */ 917 if (SSL_IS_QUIC_HANDSHAKE(s) 918 && !ssl->method->ssl3_enc->change_cipher_state(s, 919 SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_READ)) { 920 /* SSLfatal() already called */ 921 return WORK_ERROR; 922 } 923 } 924 } 925 break; 926 927 case TLS_ST_CW_KEY_UPDATE: 928 if (statem_flush(s) != 1) 929 return WORK_MORE_A; 930 if (!tls13_update_key(s, 1)) { 931 /* SSLfatal() already called */ 932 return WORK_ERROR; 933 } 934 break; 935 } 936 937 return WORK_FINISHED_CONTINUE; 938 } 939 940 /* 941 * Get the message construction function and message type for sending from the 942 * client 943 * 944 * Valid return values are: 945 * 1: Success 946 * 0: Error 947 */ 948 int ossl_statem_client_construct_message(SSL_CONNECTION *s, 949 confunc_f *confunc, int *mt) 950 { 951 OSSL_STATEM *st = &s->statem; 952 953 switch (st->hand_state) { 954 default: 955 /* Shouldn't happen */ 956 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_STATE); 957 return 0; 958 959 case TLS_ST_CW_CHANGE: 960 if (SSL_CONNECTION_IS_DTLS(s)) 961 *confunc = dtls_construct_change_cipher_spec; 962 else 963 *confunc = tls_construct_change_cipher_spec; 964 *mt = SSL3_MT_CHANGE_CIPHER_SPEC; 965 break; 966 967 case TLS_ST_CW_CLNT_HELLO: 968 *confunc = tls_construct_client_hello; 969 *mt = SSL3_MT_CLIENT_HELLO; 970 break; 971 972 case TLS_ST_CW_END_OF_EARLY_DATA: 973 *confunc = tls_construct_end_of_early_data; 974 *mt = SSL3_MT_END_OF_EARLY_DATA; 975 break; 976 977 case TLS_ST_PENDING_EARLY_DATA_END: 978 *confunc = NULL; 979 *mt = SSL3_MT_DUMMY; 980 break; 981 982 case TLS_ST_CW_CERT: 983 *confunc = tls_construct_client_certificate; 984 *mt = SSL3_MT_CERTIFICATE; 985 break; 986 987 #ifndef OPENSSL_NO_COMP_ALG 988 case TLS_ST_CW_COMP_CERT: 989 *confunc = tls_construct_client_compressed_certificate; 990 *mt = SSL3_MT_COMPRESSED_CERTIFICATE; 991 break; 992 #endif 993 994 case TLS_ST_CW_KEY_EXCH: 995 *confunc = tls_construct_client_key_exchange; 996 *mt = SSL3_MT_CLIENT_KEY_EXCHANGE; 997 break; 998 999 case TLS_ST_CW_CERT_VRFY: 1000 *confunc = tls_construct_cert_verify; 1001 *mt = SSL3_MT_CERTIFICATE_VERIFY; 1002 break; 1003 1004 #if !defined(OPENSSL_NO_NEXTPROTONEG) 1005 case TLS_ST_CW_NEXT_PROTO: 1006 *confunc = tls_construct_next_proto; 1007 *mt = SSL3_MT_NEXT_PROTO; 1008 break; 1009 #endif 1010 case TLS_ST_CW_FINISHED: 1011 *confunc = tls_construct_finished; 1012 *mt = SSL3_MT_FINISHED; 1013 break; 1014 1015 case TLS_ST_CW_KEY_UPDATE: 1016 *confunc = tls_construct_key_update; 1017 *mt = SSL3_MT_KEY_UPDATE; 1018 break; 1019 } 1020 1021 return 1; 1022 } 1023 1024 /* 1025 * Returns the maximum allowed length for the current message that we are 1026 * reading. Excludes the message header. 1027 */ 1028 size_t ossl_statem_client_max_message_size(SSL_CONNECTION *s) 1029 { 1030 OSSL_STATEM *st = &s->statem; 1031 1032 switch (st->hand_state) { 1033 default: 1034 /* Shouldn't happen */ 1035 return 0; 1036 1037 case TLS_ST_CR_SRVR_HELLO: 1038 return SERVER_HELLO_MAX_LENGTH; 1039 1040 case DTLS_ST_CR_HELLO_VERIFY_REQUEST: 1041 return HELLO_VERIFY_REQUEST_MAX_LENGTH; 1042 1043 case TLS_ST_CR_COMP_CERT: 1044 case TLS_ST_CR_CERT: 1045 return s->max_cert_list; 1046 1047 case TLS_ST_CR_CERT_VRFY: 1048 return CERTIFICATE_VERIFY_MAX_LENGTH; 1049 1050 case TLS_ST_CR_CERT_STATUS: 1051 return SSL3_RT_MAX_PLAIN_LENGTH; 1052 1053 case TLS_ST_CR_KEY_EXCH: 1054 return SERVER_KEY_EXCH_MAX_LENGTH; 1055 1056 case TLS_ST_CR_CERT_REQ: 1057 /* 1058 * Set to s->max_cert_list for compatibility with previous releases. In 1059 * practice these messages can get quite long if servers are configured 1060 * to provide a long list of acceptable CAs 1061 */ 1062 return s->max_cert_list; 1063 1064 case TLS_ST_CR_SRVR_DONE: 1065 return SERVER_HELLO_DONE_MAX_LENGTH; 1066 1067 case TLS_ST_CR_CHANGE: 1068 if (s->version == DTLS1_BAD_VER) 1069 return 3; 1070 return CCS_MAX_LENGTH; 1071 1072 case TLS_ST_CR_SESSION_TICKET: 1073 return (SSL_CONNECTION_IS_TLS13(s)) ? SESSION_TICKET_MAX_LENGTH_TLS13 1074 : SESSION_TICKET_MAX_LENGTH_TLS12; 1075 1076 case TLS_ST_CR_FINISHED: 1077 return FINISHED_MAX_LENGTH; 1078 1079 case TLS_ST_CR_ENCRYPTED_EXTENSIONS: 1080 return ENCRYPTED_EXTENSIONS_MAX_LENGTH; 1081 1082 case TLS_ST_CR_KEY_UPDATE: 1083 return KEY_UPDATE_MAX_LENGTH; 1084 } 1085 } 1086 1087 /* 1088 * Process a message that the client has received from the server. 1089 */ 1090 MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL_CONNECTION *s, 1091 PACKET *pkt) 1092 { 1093 OSSL_STATEM *st = &s->statem; 1094 1095 switch (st->hand_state) { 1096 default: 1097 /* Shouldn't happen */ 1098 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1099 return MSG_PROCESS_ERROR; 1100 1101 case TLS_ST_CR_SRVR_HELLO: 1102 return tls_process_server_hello(s, pkt); 1103 1104 case DTLS_ST_CR_HELLO_VERIFY_REQUEST: 1105 return dtls_process_hello_verify(s, pkt); 1106 1107 case TLS_ST_CR_CERT: 1108 return tls_process_server_certificate(s, pkt); 1109 1110 #ifndef OPENSSL_NO_COMP_ALG 1111 case TLS_ST_CR_COMP_CERT: 1112 return tls_process_server_compressed_certificate(s, pkt); 1113 #endif 1114 1115 case TLS_ST_CR_CERT_VRFY: 1116 return tls_process_cert_verify(s, pkt); 1117 1118 case TLS_ST_CR_CERT_STATUS: 1119 return tls_process_cert_status(s, pkt); 1120 1121 case TLS_ST_CR_KEY_EXCH: 1122 return tls_process_key_exchange(s, pkt); 1123 1124 case TLS_ST_CR_CERT_REQ: 1125 return tls_process_certificate_request(s, pkt); 1126 1127 case TLS_ST_CR_SRVR_DONE: 1128 return tls_process_server_done(s, pkt); 1129 1130 case TLS_ST_CR_CHANGE: 1131 return tls_process_change_cipher_spec(s, pkt); 1132 1133 case TLS_ST_CR_SESSION_TICKET: 1134 return tls_process_new_session_ticket(s, pkt); 1135 1136 case TLS_ST_CR_FINISHED: 1137 return tls_process_finished(s, pkt); 1138 1139 case TLS_ST_CR_HELLO_REQ: 1140 return tls_process_hello_req(s, pkt); 1141 1142 case TLS_ST_CR_ENCRYPTED_EXTENSIONS: 1143 return tls_process_encrypted_extensions(s, pkt); 1144 1145 case TLS_ST_CR_KEY_UPDATE: 1146 return tls_process_key_update(s, pkt); 1147 } 1148 } 1149 1150 /* 1151 * Perform any further processing required following the receipt of a message 1152 * from the server 1153 */ 1154 WORK_STATE ossl_statem_client_post_process_message(SSL_CONNECTION *s, 1155 WORK_STATE wst) 1156 { 1157 OSSL_STATEM *st = &s->statem; 1158 1159 switch (st->hand_state) { 1160 default: 1161 /* Shouldn't happen */ 1162 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1163 return WORK_ERROR; 1164 1165 case TLS_ST_CR_CERT: 1166 case TLS_ST_CR_COMP_CERT: 1167 return tls_post_process_server_certificate(s, wst); 1168 1169 case TLS_ST_CR_CERT_VRFY: 1170 case TLS_ST_CR_CERT_REQ: 1171 return tls_prepare_client_certificate(s, wst); 1172 } 1173 } 1174 1175 CON_FUNC_RETURN tls_construct_client_hello(SSL_CONNECTION *s, WPACKET *pkt) 1176 { 1177 unsigned char *p; 1178 size_t sess_id_len; 1179 int i, protverr; 1180 #ifndef OPENSSL_NO_COMP 1181 SSL_COMP *comp; 1182 #endif 1183 SSL_SESSION *sess = s->session; 1184 unsigned char *session_id; 1185 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 1186 1187 /* Work out what SSL/TLS/DTLS version to use */ 1188 protverr = ssl_set_client_hello_version(s); 1189 if (protverr != 0) { 1190 SSLfatal(s, SSL_AD_INTERNAL_ERROR, protverr); 1191 return CON_FUNC_ERROR; 1192 } 1193 1194 if (sess == NULL 1195 || !ssl_version_supported(s, sess->ssl_version, NULL) 1196 || !SSL_SESSION_is_resumable(sess)) { 1197 if (s->hello_retry_request == SSL_HRR_NONE 1198 && !ssl_get_new_session(s, 0)) { 1199 /* SSLfatal() already called */ 1200 return CON_FUNC_ERROR; 1201 } 1202 } 1203 /* else use the pre-loaded session */ 1204 1205 p = s->s3.client_random; 1206 1207 /* 1208 * for DTLS if client_random is initialized, reuse it, we are 1209 * required to use same upon reply to HelloVerify 1210 */ 1211 if (SSL_CONNECTION_IS_DTLS(s)) { 1212 size_t idx; 1213 i = 1; 1214 for (idx = 0; idx < sizeof(s->s3.client_random); idx++) { 1215 if (p[idx]) { 1216 i = 0; 1217 break; 1218 } 1219 } 1220 } else { 1221 i = (s->hello_retry_request == SSL_HRR_NONE); 1222 } 1223 1224 if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3.client_random), DOWNGRADE_NONE) <= 0) { 1225 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1226 return CON_FUNC_ERROR; 1227 } 1228 1229 /*- 1230 * version indicates the negotiated version: for example from 1231 * an SSLv2/v3 compatible client hello). The client_version 1232 * field is the maximum version we permit and it is also 1233 * used in RSA encrypted premaster secrets. Some servers can 1234 * choke if we initially report a higher version then 1235 * renegotiate to a lower one in the premaster secret. This 1236 * didn't happen with TLS 1.0 as most servers supported it 1237 * but it can with TLS 1.1 or later if the server only supports 1238 * 1.0. 1239 * 1240 * Possible scenario with previous logic: 1241 * 1. Client hello indicates TLS 1.2 1242 * 2. Server hello says TLS 1.0 1243 * 3. RSA encrypted premaster secret uses 1.2. 1244 * 4. Handshake proceeds using TLS 1.0. 1245 * 5. Server sends hello request to renegotiate. 1246 * 6. Client hello indicates TLS v1.0 as we now 1247 * know that is maximum server supports. 1248 * 7. Server chokes on RSA encrypted premaster secret 1249 * containing version 1.0. 1250 * 1251 * For interoperability it should be OK to always use the 1252 * maximum version we support in client hello and then rely 1253 * on the checking of version to ensure the servers isn't 1254 * being inconsistent: for example initially negotiating with 1255 * TLS 1.0 and renegotiating with TLS 1.2. We do this by using 1256 * client_version in client hello and not resetting it to 1257 * the negotiated version. 1258 * 1259 * For TLS 1.3 we always set the ClientHello version to 1.2 and rely on the 1260 * supported_versions extension for the real supported versions. 1261 */ 1262 if (!WPACKET_put_bytes_u16(pkt, s->client_version) 1263 || !WPACKET_memcpy(pkt, s->s3.client_random, SSL3_RANDOM_SIZE)) { 1264 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1265 return CON_FUNC_ERROR; 1266 } 1267 1268 /* Session ID */ 1269 session_id = s->session->session_id; 1270 if (s->new_session || s->session->ssl_version == TLS1_3_VERSION) { 1271 if (s->version == TLS1_3_VERSION 1272 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) { 1273 sess_id_len = sizeof(s->tmp_session_id); 1274 s->tmp_session_id_len = sess_id_len; 1275 session_id = s->tmp_session_id; 1276 if (s->hello_retry_request == SSL_HRR_NONE 1277 && RAND_bytes_ex(sctx->libctx, s->tmp_session_id, 1278 sess_id_len, 0) 1279 <= 0) { 1280 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1281 return CON_FUNC_ERROR; 1282 } 1283 } else { 1284 sess_id_len = 0; 1285 } 1286 } else { 1287 assert(s->session->session_id_length <= sizeof(s->session->session_id)); 1288 sess_id_len = s->session->session_id_length; 1289 if (s->version == TLS1_3_VERSION) { 1290 s->tmp_session_id_len = sess_id_len; 1291 memcpy(s->tmp_session_id, s->session->session_id, sess_id_len); 1292 } 1293 } 1294 if (!WPACKET_start_sub_packet_u8(pkt) 1295 || (sess_id_len != 0 && !WPACKET_memcpy(pkt, session_id, sess_id_len)) 1296 || !WPACKET_close(pkt)) { 1297 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1298 return CON_FUNC_ERROR; 1299 } 1300 1301 /* cookie stuff for DTLS */ 1302 if (SSL_CONNECTION_IS_DTLS(s)) { 1303 if (s->d1->cookie_len > sizeof(s->d1->cookie) 1304 || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie, 1305 s->d1->cookie_len)) { 1306 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1307 return CON_FUNC_ERROR; 1308 } 1309 } 1310 1311 /* Ciphers supported */ 1312 if (!WPACKET_start_sub_packet_u16(pkt)) { 1313 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1314 return CON_FUNC_ERROR; 1315 } 1316 1317 if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s)), 1318 pkt)) { 1319 /* SSLfatal() already called */ 1320 return CON_FUNC_ERROR; 1321 } 1322 if (!WPACKET_close(pkt)) { 1323 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1324 return CON_FUNC_ERROR; 1325 } 1326 1327 /* COMPRESSION */ 1328 if (!WPACKET_start_sub_packet_u8(pkt)) { 1329 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1330 return CON_FUNC_ERROR; 1331 } 1332 #ifndef OPENSSL_NO_COMP 1333 if (ssl_allow_compression(s) 1334 && sctx->comp_methods 1335 && (SSL_CONNECTION_IS_DTLS(s) 1336 || s->s3.tmp.max_ver < TLS1_3_VERSION)) { 1337 int compnum = sk_SSL_COMP_num(sctx->comp_methods); 1338 for (i = 0; i < compnum; i++) { 1339 comp = sk_SSL_COMP_value(sctx->comp_methods, i); 1340 if (!WPACKET_put_bytes_u8(pkt, comp->id)) { 1341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1342 return CON_FUNC_ERROR; 1343 } 1344 } 1345 } 1346 #endif 1347 /* Add the NULL method */ 1348 if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) { 1349 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1350 return CON_FUNC_ERROR; 1351 } 1352 1353 /* TLS extensions */ 1354 if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0)) { 1355 /* SSLfatal() already called */ 1356 return CON_FUNC_ERROR; 1357 } 1358 1359 return CON_FUNC_SUCCESS; 1360 } 1361 1362 MSG_PROCESS_RETURN dtls_process_hello_verify(SSL_CONNECTION *s, PACKET *pkt) 1363 { 1364 size_t cookie_len; 1365 PACKET cookiepkt; 1366 1367 if (!PACKET_forward(pkt, 2) 1368 || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) { 1369 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1370 return MSG_PROCESS_ERROR; 1371 } 1372 1373 cookie_len = PACKET_remaining(&cookiepkt); 1374 if (cookie_len > sizeof(s->d1->cookie)) { 1375 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_LENGTH_TOO_LONG); 1376 return MSG_PROCESS_ERROR; 1377 } 1378 1379 if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) { 1380 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1381 return MSG_PROCESS_ERROR; 1382 } 1383 s->d1->cookie_len = cookie_len; 1384 1385 return MSG_PROCESS_FINISHED_READING; 1386 } 1387 1388 static int set_client_ciphersuite(SSL_CONNECTION *s, 1389 const unsigned char *cipherchars) 1390 { 1391 STACK_OF(SSL_CIPHER) *sk; 1392 const SSL_CIPHER *c; 1393 int i; 1394 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 1395 1396 c = ssl_get_cipher_by_char(s, cipherchars, 0); 1397 if (c == NULL) { 1398 /* unknown cipher */ 1399 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CIPHER_RETURNED); 1400 return 0; 1401 } 1402 /* 1403 * If it is a disabled cipher we either didn't send it in client hello, 1404 * or it's not allowed for the selected protocol. So we return an error. 1405 */ 1406 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK, 1)) { 1407 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED); 1408 return 0; 1409 } 1410 1411 sk = ssl_get_ciphers_by_id(s); 1412 i = sk_SSL_CIPHER_find(sk, c); 1413 if (i < 0) { 1414 /* we did not say we would use this cipher */ 1415 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED); 1416 return 0; 1417 } 1418 1419 if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.new_cipher != NULL 1420 && s->s3.tmp.new_cipher->id != c->id) { 1421 /* ServerHello selected a different ciphersuite to that in the HRR */ 1422 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED); 1423 return 0; 1424 } 1425 1426 /* 1427 * Depending on the session caching (internal/external), the cipher 1428 * and/or cipher_id values may not be set. Make sure that cipher_id is 1429 * set and use it for comparison. 1430 */ 1431 if (s->session->cipher != NULL) 1432 s->session->cipher_id = s->session->cipher->id; 1433 if (s->hit && (s->session->cipher_id != c->id)) { 1434 if (SSL_CONNECTION_IS_TLS13(s)) { 1435 const EVP_MD *md = ssl_md(sctx, c->algorithm2); 1436 1437 if (!ossl_assert(s->session->cipher != NULL)) { 1438 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1439 return 0; 1440 } 1441 /* 1442 * In TLSv1.3 it is valid for the server to select a different 1443 * ciphersuite as long as the hash is the same. 1444 */ 1445 if (md == NULL 1446 || md != ssl_md(sctx, s->session->cipher->algorithm2)) { 1447 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1448 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED); 1449 return 0; 1450 } 1451 } else { 1452 /* 1453 * Prior to TLSv1.3 resuming a session always meant using the same 1454 * ciphersuite. 1455 */ 1456 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1457 SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); 1458 return 0; 1459 } 1460 } 1461 s->s3.tmp.new_cipher = c; 1462 1463 return 1; 1464 } 1465 1466 MSG_PROCESS_RETURN tls_process_server_hello(SSL_CONNECTION *s, PACKET *pkt) 1467 { 1468 PACKET session_id, extpkt; 1469 size_t session_id_len; 1470 const unsigned char *cipherchars; 1471 int hrr = 0; 1472 unsigned int compression; 1473 unsigned int sversion; 1474 unsigned int context; 1475 RAW_EXTENSION *extensions = NULL; 1476 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 1477 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s); 1478 #ifndef OPENSSL_NO_COMP 1479 SSL_COMP *comp; 1480 #endif 1481 1482 if (!PACKET_get_net_2(pkt, &sversion)) { 1483 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1484 goto err; 1485 } 1486 1487 /* load the server random */ 1488 if (s->version == TLS1_3_VERSION 1489 && sversion == TLS1_2_VERSION 1490 && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE 1491 && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) { 1492 if (s->hello_retry_request != SSL_HRR_NONE) { 1493 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); 1494 goto err; 1495 } 1496 s->hello_retry_request = SSL_HRR_PENDING; 1497 /* Tell the record layer that we know we're going to get TLSv1.3 */ 1498 if (!ssl_set_record_protocol_version(s, s->version)) { 1499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1500 goto err; 1501 } 1502 hrr = 1; 1503 if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) { 1504 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1505 goto err; 1506 } 1507 } else { 1508 if (!PACKET_copy_bytes(pkt, s->s3.server_random, SSL3_RANDOM_SIZE)) { 1509 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1510 goto err; 1511 } 1512 } 1513 1514 /* Get the session-id. */ 1515 if (!PACKET_get_length_prefixed_1(pkt, &session_id)) { 1516 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1517 goto err; 1518 } 1519 session_id_len = PACKET_remaining(&session_id); 1520 if (session_id_len > sizeof(s->session->session_id) 1521 || session_id_len > SSL3_SESSION_ID_SIZE) { 1522 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_SSL3_SESSION_ID_TOO_LONG); 1523 goto err; 1524 } 1525 1526 if (!PACKET_get_bytes(pkt, &cipherchars, TLS_CIPHER_LEN)) { 1527 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1528 goto err; 1529 } 1530 1531 if (!PACKET_get_1(pkt, &compression)) { 1532 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 1533 goto err; 1534 } 1535 1536 /* TLS extensions */ 1537 if (PACKET_remaining(pkt) == 0 && !hrr) { 1538 PACKET_null_init(&extpkt); 1539 } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt) 1540 || PACKET_remaining(pkt) != 0) { 1541 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH); 1542 goto err; 1543 } 1544 1545 if (!hrr) { 1546 if (!tls_collect_extensions(s, &extpkt, 1547 SSL_EXT_TLS1_2_SERVER_HELLO 1548 | SSL_EXT_TLS1_3_SERVER_HELLO, 1549 &extensions, NULL, 1)) { 1550 /* SSLfatal() already called */ 1551 goto err; 1552 } 1553 1554 if (!ssl_choose_client_version(s, sversion, extensions)) { 1555 /* SSLfatal() already called */ 1556 goto err; 1557 } 1558 } 1559 1560 if (SSL_CONNECTION_IS_TLS13(s) || hrr) { 1561 if (compression != 0) { 1562 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1563 SSL_R_INVALID_COMPRESSION_ALGORITHM); 1564 goto err; 1565 } 1566 1567 if (session_id_len != s->tmp_session_id_len 1568 || memcmp(PACKET_data(&session_id), s->tmp_session_id, 1569 session_id_len) 1570 != 0) { 1571 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_INVALID_SESSION_ID); 1572 goto err; 1573 } 1574 } 1575 1576 if (hrr) { 1577 if (!set_client_ciphersuite(s, cipherchars)) { 1578 /* SSLfatal() already called */ 1579 goto err; 1580 } 1581 1582 return tls_process_as_hello_retry_request(s, &extpkt); 1583 } 1584 1585 /* 1586 * Now we have chosen the version we need to check again that the extensions 1587 * are appropriate for this version. 1588 */ 1589 context = SSL_CONNECTION_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO 1590 : SSL_EXT_TLS1_2_SERVER_HELLO; 1591 if (!tls_validate_all_contexts(s, context, extensions)) { 1592 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION); 1593 goto err; 1594 } 1595 1596 s->hit = 0; 1597 1598 if (SSL_CONNECTION_IS_TLS13(s)) { 1599 /* 1600 * In TLSv1.3 a ServerHello message signals a key change so the end of 1601 * the message must be on a record boundary. 1602 */ 1603 if (RECORD_LAYER_processed_read_pending(&s->rlayer)) { 1604 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, 1605 SSL_R_NOT_ON_RECORD_BOUNDARY); 1606 goto err; 1607 } 1608 1609 /* This will set s->hit if we are resuming */ 1610 if (!tls_parse_extension(s, TLSEXT_IDX_psk, 1611 SSL_EXT_TLS1_3_SERVER_HELLO, 1612 extensions, NULL, 0)) { 1613 /* SSLfatal() already called */ 1614 goto err; 1615 } 1616 } else { 1617 /* 1618 * Check if we can resume the session based on external pre-shared 1619 * secret. EAP-FAST (RFC 4851) supports two types of session resumption. 1620 * Resumption based on server-side state works with session IDs. 1621 * Resumption based on pre-shared Protected Access Credentials (PACs) 1622 * works by overriding the SessionTicket extension at the application 1623 * layer, and does not send a session ID. (We do not know whether 1624 * EAP-FAST servers would honour the session ID.) Therefore, the session 1625 * ID alone is not a reliable indicator of session resumption, so we 1626 * first check if we can resume, and later peek at the next handshake 1627 * message to see if the server wants to resume. 1628 */ 1629 if (s->version >= TLS1_VERSION 1630 && s->ext.session_secret_cb != NULL && s->session->ext.tick) { 1631 const SSL_CIPHER *pref_cipher = NULL; 1632 /* 1633 * s->session->master_key_length is a size_t, but this is an int for 1634 * backwards compat reasons 1635 */ 1636 int master_key_length; 1637 1638 master_key_length = sizeof(s->session->master_key); 1639 if (s->ext.session_secret_cb(ussl, s->session->master_key, 1640 &master_key_length, 1641 NULL, &pref_cipher, 1642 s->ext.session_secret_cb_arg) 1643 && master_key_length > 0) { 1644 s->session->master_key_length = master_key_length; 1645 s->session->cipher = pref_cipher ? pref_cipher : ssl_get_cipher_by_char(s, cipherchars, 0); 1646 } else { 1647 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1648 goto err; 1649 } 1650 } 1651 1652 if (session_id_len != 0 1653 && session_id_len == s->session->session_id_length 1654 && memcmp(PACKET_data(&session_id), s->session->session_id, 1655 session_id_len) 1656 == 0) 1657 s->hit = 1; 1658 } 1659 1660 if (s->hit) { 1661 if (s->sid_ctx_length != s->session->sid_ctx_length 1662 || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) { 1663 /* actually a client application bug */ 1664 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1665 SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 1666 goto err; 1667 } 1668 } else { 1669 /* 1670 * If we were trying for session-id reuse but the server 1671 * didn't resume, make a new SSL_SESSION. 1672 * In the case of EAP-FAST and PAC, we do not send a session ID, 1673 * so the PAC-based session secret is always preserved. It'll be 1674 * overwritten if the server refuses resumption. 1675 */ 1676 if (s->session->session_id_length > 0) { 1677 ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_miss); 1678 if (!ssl_get_new_session(s, 0)) { 1679 /* SSLfatal() already called */ 1680 goto err; 1681 } 1682 } 1683 1684 s->session->ssl_version = s->version; 1685 /* 1686 * In TLSv1.2 and below we save the session id we were sent so we can 1687 * resume it later. In TLSv1.3 the session id we were sent is just an 1688 * echo of what we originally sent in the ClientHello and should not be 1689 * used for resumption. 1690 */ 1691 if (!SSL_CONNECTION_IS_TLS13(s)) { 1692 s->session->session_id_length = session_id_len; 1693 /* session_id_len could be 0 */ 1694 if (session_id_len > 0) 1695 memcpy(s->session->session_id, PACKET_data(&session_id), 1696 session_id_len); 1697 } 1698 } 1699 1700 /* Session version and negotiated protocol version should match */ 1701 if (s->version != s->session->ssl_version) { 1702 SSLfatal(s, SSL_AD_PROTOCOL_VERSION, 1703 SSL_R_SSL_SESSION_VERSION_MISMATCH); 1704 goto err; 1705 } 1706 /* 1707 * Now that we know the version, update the check to see if it's an allowed 1708 * version. 1709 */ 1710 s->s3.tmp.min_ver = s->version; 1711 s->s3.tmp.max_ver = s->version; 1712 1713 if (!set_client_ciphersuite(s, cipherchars)) { 1714 /* SSLfatal() already called */ 1715 goto err; 1716 } 1717 1718 #ifdef OPENSSL_NO_COMP 1719 if (compression != 0) { 1720 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1721 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 1722 goto err; 1723 } 1724 /* 1725 * If compression is disabled we'd better not try to resume a session 1726 * using compression. 1727 */ 1728 if (s->session->compress_meth != 0) { 1729 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_COMPRESSION); 1730 goto err; 1731 } 1732 #else 1733 if (s->hit && compression != s->session->compress_meth) { 1734 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1735 SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED); 1736 goto err; 1737 } 1738 if (compression == 0) 1739 comp = NULL; 1740 else if (!ssl_allow_compression(s)) { 1741 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COMPRESSION_DISABLED); 1742 goto err; 1743 } else { 1744 comp = ssl3_comp_find(SSL_CONNECTION_GET_CTX(s)->comp_methods, 1745 compression); 1746 } 1747 1748 if (compression != 0 && comp == NULL) { 1749 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1750 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 1751 goto err; 1752 } else { 1753 s->s3.tmp.new_compression = comp; 1754 } 1755 #endif 1756 1757 if (!tls_parse_all_extensions(s, context, extensions, NULL, 0, 1)) { 1758 /* SSLfatal() already called */ 1759 goto err; 1760 } 1761 1762 #ifndef OPENSSL_NO_SCTP 1763 if (SSL_CONNECTION_IS_DTLS(s) && s->hit) { 1764 unsigned char sctpauthkey[64]; 1765 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; 1766 size_t labellen; 1767 1768 /* 1769 * Add new shared key for SCTP-Auth, will be ignored if 1770 * no SCTP used. 1771 */ 1772 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, 1773 sizeof(DTLS1_SCTP_AUTH_LABEL)); 1774 1775 /* Don't include the terminating zero. */ 1776 labellen = sizeof(labelbuffer) - 1; 1777 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) 1778 labellen += 1; 1779 1780 if (SSL_export_keying_material(ssl, sctpauthkey, 1781 sizeof(sctpauthkey), 1782 labelbuffer, 1783 labellen, NULL, 0, 0) 1784 <= 0) { 1785 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 1786 goto err; 1787 } 1788 1789 BIO_ctrl(SSL_get_wbio(ssl), 1790 BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, 1791 sizeof(sctpauthkey), sctpauthkey); 1792 } 1793 #endif 1794 1795 /* 1796 * In TLSv1.3 we have some post-processing to change cipher state, otherwise 1797 * we're done with this message 1798 */ 1799 if (SSL_CONNECTION_IS_TLS13(s)) { 1800 if (!ssl->method->ssl3_enc->setup_key_block(s) 1801 || !tls13_store_handshake_traffic_hash(s)) { 1802 /* SSLfatal() already called */ 1803 goto err; 1804 } 1805 /* 1806 * If we're not doing early-data and we're not going to send a dummy CCS 1807 * (i.e. no middlebox compat mode) then we can change the write keys 1808 * immediately. Otherwise we have to defer this until after all possible 1809 * early data is written. We could just always defer until the last 1810 * moment except QUIC needs it done at the same time as the read keys 1811 * are changed. Since QUIC doesn't do TLS early data or need middlebox 1812 * compat this doesn't cause a problem. 1813 */ 1814 if (SSL_IS_QUIC_HANDSHAKE(s) 1815 || (s->early_data_state == SSL_EARLY_DATA_NONE 1816 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0)) { 1817 if (!ssl->method->ssl3_enc->change_cipher_state(s, 1818 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { 1819 /* SSLfatal() already called */ 1820 goto err; 1821 } 1822 } 1823 if (!ssl->method->ssl3_enc->change_cipher_state(s, 1824 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ)) { 1825 /* SSLfatal() already called */ 1826 goto err; 1827 } 1828 } 1829 1830 OPENSSL_free(extensions); 1831 return MSG_PROCESS_CONTINUE_READING; 1832 err: 1833 OPENSSL_free(extensions); 1834 return MSG_PROCESS_ERROR; 1835 } 1836 1837 static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s, 1838 PACKET *extpkt) 1839 { 1840 RAW_EXTENSION *extensions = NULL; 1841 1842 /* 1843 * If we were sending early_data then any alerts should not be sent using 1844 * the old wrlmethod. 1845 */ 1846 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING 1847 && !ssl_set_new_record_layer(s, 1848 TLS_ANY_VERSION, 1849 OSSL_RECORD_DIRECTION_WRITE, 1850 OSSL_RECORD_PROTECTION_LEVEL_NONE, 1851 NULL, 0, NULL, 0, NULL, 0, NULL, 0, 1852 NULL, 0, NID_undef, NULL, NULL, NULL)) { 1853 /* SSLfatal already called */ 1854 goto err; 1855 } 1856 /* We are definitely going to be using TLSv1.3 */ 1857 s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, TLS1_3_VERSION); 1858 1859 if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, 1860 &extensions, NULL, 1) 1861 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, 1862 extensions, NULL, 0, 1)) { 1863 /* SSLfatal() already called */ 1864 goto err; 1865 } 1866 1867 OPENSSL_free(extensions); 1868 extensions = NULL; 1869 1870 if (s->ext.tls13_cookie_len == 0 && s->s3.tmp.pkey != NULL) { 1871 /* 1872 * We didn't receive a cookie or a new key_share so the next 1873 * ClientHello will not change 1874 */ 1875 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CHANGE_FOLLOWING_HRR); 1876 goto err; 1877 } 1878 1879 /* 1880 * Re-initialise the Transcript Hash. We're going to prepopulate it with 1881 * a synthetic message_hash in place of ClientHello1. 1882 */ 1883 if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) { 1884 /* SSLfatal() already called */ 1885 goto err; 1886 } 1887 1888 /* 1889 * Add this message to the Transcript Hash. Normally this is done 1890 * automatically prior to the message processing stage. However due to the 1891 * need to create the synthetic message hash, we defer that step until now 1892 * for HRR messages. 1893 */ 1894 if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 1895 s->init_num + SSL3_HM_HEADER_LENGTH)) { 1896 /* SSLfatal() already called */ 1897 goto err; 1898 } 1899 1900 return MSG_PROCESS_FINISHED_READING; 1901 err: 1902 OPENSSL_free(extensions); 1903 return MSG_PROCESS_ERROR; 1904 } 1905 1906 MSG_PROCESS_RETURN tls_process_server_rpk(SSL_CONNECTION *sc, PACKET *pkt) 1907 { 1908 EVP_PKEY *peer_rpk = NULL; 1909 1910 if (!tls_process_rpk(sc, pkt, &peer_rpk)) { 1911 /* SSLfatal() already called */ 1912 return MSG_PROCESS_ERROR; 1913 } 1914 1915 if (peer_rpk == NULL) { 1916 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_CERTIFICATE); 1917 return MSG_PROCESS_ERROR; 1918 } 1919 1920 EVP_PKEY_free(sc->session->peer_rpk); 1921 sc->session->peer_rpk = peer_rpk; 1922 1923 return MSG_PROCESS_CONTINUE_PROCESSING; 1924 } 1925 1926 static WORK_STATE tls_post_process_server_rpk(SSL_CONNECTION *sc, 1927 WORK_STATE wst) 1928 { 1929 size_t certidx; 1930 const SSL_CERT_LOOKUP *clu; 1931 int v_ok; 1932 1933 if (sc->session->peer_rpk == NULL) { 1934 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, 1935 SSL_R_INVALID_RAW_PUBLIC_KEY); 1936 return WORK_ERROR; 1937 } 1938 1939 if (sc->rwstate == SSL_RETRY_VERIFY) 1940 sc->rwstate = SSL_NOTHING; 1941 1942 ERR_set_mark(); 1943 v_ok = ssl_verify_rpk(sc, sc->session->peer_rpk); 1944 if (v_ok <= 0 && sc->verify_mode != SSL_VERIFY_NONE) { 1945 ERR_clear_last_mark(); 1946 SSLfatal(sc, ssl_x509err2alert(sc->verify_result), 1947 SSL_R_CERTIFICATE_VERIFY_FAILED); 1948 return WORK_ERROR; 1949 } 1950 ERR_pop_to_mark(); /* but we keep s->verify_result */ 1951 if (v_ok > 0 && sc->rwstate == SSL_RETRY_VERIFY) { 1952 return WORK_MORE_A; 1953 } 1954 1955 if ((clu = ssl_cert_lookup_by_pkey(sc->session->peer_rpk, &certidx, 1956 SSL_CONNECTION_GET_CTX(sc))) 1957 == NULL) { 1958 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE); 1959 return WORK_ERROR; 1960 } 1961 1962 /* 1963 * Check certificate type is consistent with ciphersuite. For TLS 1.3 1964 * skip check since TLS 1.3 ciphersuites can be used with any certificate 1965 * type. 1966 */ 1967 if (!SSL_CONNECTION_IS_TLS13(sc)) { 1968 if ((clu->amask & sc->s3.tmp.new_cipher->algorithm_auth) == 0) { 1969 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_RPK_TYPE); 1970 return WORK_ERROR; 1971 } 1972 } 1973 1974 /* Ensure there is no peer/peer_chain */ 1975 X509_free(sc->session->peer); 1976 sc->session->peer = NULL; 1977 sk_X509_pop_free(sc->session->peer_chain, X509_free); 1978 sc->session->peer_chain = NULL; 1979 sc->session->verify_result = sc->verify_result; 1980 1981 /* Save the current hash state for when we receive the CertificateVerify */ 1982 if (SSL_CONNECTION_IS_TLS13(sc) 1983 && !ssl_handshake_hash(sc, sc->cert_verify_hash, 1984 sizeof(sc->cert_verify_hash), 1985 &sc->cert_verify_hash_len)) { 1986 /* SSLfatal() already called */ 1987 return WORK_ERROR; 1988 } 1989 1990 return WORK_FINISHED_CONTINUE; 1991 } 1992 1993 /* prepare server cert verification by setting s->session->peer_chain from pkt */ 1994 MSG_PROCESS_RETURN tls_process_server_certificate(SSL_CONNECTION *s, 1995 PACKET *pkt) 1996 { 1997 unsigned long cert_list_len, cert_len; 1998 X509 *x = NULL; 1999 const unsigned char *certstart, *certbytes; 2000 size_t chainidx; 2001 unsigned int context = 0; 2002 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 2003 2004 if (s->ext.server_cert_type == TLSEXT_cert_type_rpk) 2005 return tls_process_server_rpk(s, pkt); 2006 if (s->ext.server_cert_type != TLSEXT_cert_type_x509) { 2007 SSLfatal(s, SSL_AD_UNSUPPORTED_CERTIFICATE, 2008 SSL_R_UNKNOWN_CERTIFICATE_TYPE); 2009 goto err; 2010 } 2011 2012 if ((s->session->peer_chain = sk_X509_new_null()) == NULL) { 2013 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 2014 goto err; 2015 } 2016 2017 if ((SSL_CONNECTION_IS_TLS13(s) && !PACKET_get_1(pkt, &context)) 2018 || context != 0 2019 || !PACKET_get_net_3(pkt, &cert_list_len) 2020 || PACKET_remaining(pkt) != cert_list_len 2021 || PACKET_remaining(pkt) == 0) { 2022 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2023 goto err; 2024 } 2025 for (chainidx = 0; PACKET_remaining(pkt); chainidx++) { 2026 if (!PACKET_get_net_3(pkt, &cert_len) 2027 || !PACKET_get_bytes(pkt, &certbytes, cert_len)) { 2028 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CERT_LENGTH_MISMATCH); 2029 goto err; 2030 } 2031 2032 certstart = certbytes; 2033 x = X509_new_ex(sctx->libctx, sctx->propq); 2034 if (x == NULL) { 2035 SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_ASN1_LIB); 2036 goto err; 2037 } 2038 if (d2i_X509(&x, (const unsigned char **)&certbytes, 2039 cert_len) 2040 == NULL) { 2041 SSLfatal(s, SSL_AD_BAD_CERTIFICATE, ERR_R_ASN1_LIB); 2042 goto err; 2043 } 2044 2045 if (certbytes != (certstart + cert_len)) { 2046 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CERT_LENGTH_MISMATCH); 2047 goto err; 2048 } 2049 2050 if (SSL_CONNECTION_IS_TLS13(s)) { 2051 RAW_EXTENSION *rawexts = NULL; 2052 PACKET extensions; 2053 2054 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) { 2055 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH); 2056 goto err; 2057 } 2058 if (!tls_collect_extensions(s, &extensions, 2059 SSL_EXT_TLS1_3_CERTIFICATE, &rawexts, 2060 NULL, chainidx == 0) 2061 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE, 2062 rawexts, x, chainidx, 2063 PACKET_remaining(pkt) == 0)) { 2064 OPENSSL_free(rawexts); 2065 /* SSLfatal already called */ 2066 goto err; 2067 } 2068 OPENSSL_free(rawexts); 2069 } 2070 2071 if (!sk_X509_push(s->session->peer_chain, x)) { 2072 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 2073 goto err; 2074 } 2075 x = NULL; 2076 } 2077 return MSG_PROCESS_CONTINUE_PROCESSING; 2078 2079 err: 2080 X509_free(x); 2081 OSSL_STACK_OF_X509_free(s->session->peer_chain); 2082 s->session->peer_chain = NULL; 2083 return MSG_PROCESS_ERROR; 2084 } 2085 2086 /* 2087 * Verify the s->session->peer_chain and check server cert type. 2088 * On success set s->session->peer and s->session->verify_result. 2089 * Else the peer certificate verification callback may request retry. 2090 */ 2091 WORK_STATE tls_post_process_server_certificate(SSL_CONNECTION *s, 2092 WORK_STATE wst) 2093 { 2094 X509 *x; 2095 EVP_PKEY *pkey = NULL; 2096 const SSL_CERT_LOOKUP *clu; 2097 size_t certidx; 2098 int i; 2099 2100 if (s->ext.server_cert_type == TLSEXT_cert_type_rpk) 2101 return tls_post_process_server_rpk(s, wst); 2102 2103 if (s->rwstate == SSL_RETRY_VERIFY) 2104 s->rwstate = SSL_NOTHING; 2105 2106 /* 2107 * The documented interface is that SSL_VERIFY_PEER should be set in order 2108 * for client side verification of the server certificate to take place. 2109 * However, historically the code has only checked that *any* flag is set 2110 * to cause server verification to take place. Use of the other flags makes 2111 * no sense in client mode. An attempt to clean up the semantics was 2112 * reverted because at least one application *only* set 2113 * SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Prior to the clean up this still caused 2114 * server verification to take place, after the clean up it silently did 2115 * nothing. SSL_CTX_set_verify()/SSL_set_verify() cannot validate the flags 2116 * sent to them because they are void functions. Therefore, we now use the 2117 * (less clean) historic behaviour of performing validation if any flag is 2118 * set. The *documented* interface remains the same. 2119 */ 2120 ERR_set_mark(); 2121 i = ssl_verify_cert_chain(s, s->session->peer_chain); 2122 if (i <= 0 && s->verify_mode != SSL_VERIFY_NONE) { 2123 ERR_clear_last_mark(); 2124 SSLfatal(s, ssl_x509err2alert(s->verify_result), 2125 SSL_R_CERTIFICATE_VERIFY_FAILED); 2126 return WORK_ERROR; 2127 } 2128 ERR_pop_to_mark(); /* but we keep s->verify_result */ 2129 if (i > 0 && s->rwstate == SSL_RETRY_VERIFY) 2130 return WORK_MORE_A; 2131 2132 /* 2133 * Inconsistency alert: cert_chain does include the peer's certificate, 2134 * which we don't include in statem_srvr.c 2135 */ 2136 x = sk_X509_value(s->session->peer_chain, 0); 2137 2138 pkey = X509_get0_pubkey(x); 2139 2140 if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) { 2141 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2142 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); 2143 return WORK_ERROR; 2144 } 2145 2146 if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx, 2147 SSL_CONNECTION_GET_CTX(s))) 2148 == NULL) { 2149 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE); 2150 return WORK_ERROR; 2151 } 2152 /* 2153 * Check certificate type is consistent with ciphersuite. For TLS 1.3 2154 * skip check since TLS 1.3 ciphersuites can be used with any certificate 2155 * type. 2156 */ 2157 if (!SSL_CONNECTION_IS_TLS13(s)) { 2158 if ((clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0) { 2159 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CERTIFICATE_TYPE); 2160 return WORK_ERROR; 2161 } 2162 } 2163 2164 if (!X509_up_ref(x)) { 2165 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2166 return WORK_ERROR; 2167 } 2168 2169 X509_free(s->session->peer); 2170 s->session->peer = x; 2171 s->session->verify_result = s->verify_result; 2172 /* Ensure there is no RPK */ 2173 EVP_PKEY_free(s->session->peer_rpk); 2174 s->session->peer_rpk = NULL; 2175 2176 /* Save the current hash state for when we receive the CertificateVerify */ 2177 if (SSL_CONNECTION_IS_TLS13(s) 2178 && !ssl_handshake_hash(s, s->cert_verify_hash, 2179 sizeof(s->cert_verify_hash), 2180 &s->cert_verify_hash_len)) { 2181 /* SSLfatal() already called */; 2182 return WORK_ERROR; 2183 } 2184 return WORK_FINISHED_CONTINUE; 2185 } 2186 2187 #ifndef OPENSSL_NO_COMP_ALG 2188 MSG_PROCESS_RETURN tls_process_server_compressed_certificate(SSL_CONNECTION *sc, PACKET *pkt) 2189 { 2190 MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR; 2191 PACKET tmppkt; 2192 BUF_MEM *buf = BUF_MEM_new(); 2193 2194 if (tls13_process_compressed_certificate(sc, pkt, &tmppkt, buf) != MSG_PROCESS_ERROR) 2195 ret = tls_process_server_certificate(sc, &tmppkt); 2196 2197 BUF_MEM_free(buf); 2198 return ret; 2199 } 2200 #endif 2201 2202 static int tls_process_ske_psk_preamble(SSL_CONNECTION *s, PACKET *pkt) 2203 { 2204 #ifndef OPENSSL_NO_PSK 2205 PACKET psk_identity_hint; 2206 2207 /* PSK ciphersuites are preceded by an identity hint */ 2208 2209 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity_hint)) { 2210 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2211 return 0; 2212 } 2213 2214 /* 2215 * Store PSK identity hint for later use, hint is used in 2216 * tls_construct_client_key_exchange. Assume that the maximum length of 2217 * a PSK identity hint can be as long as the maximum length of a PSK 2218 * identity. 2219 */ 2220 if (PACKET_remaining(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN) { 2221 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_DATA_LENGTH_TOO_LONG); 2222 return 0; 2223 } 2224 2225 if (PACKET_remaining(&psk_identity_hint) == 0) { 2226 OPENSSL_free(s->session->psk_identity_hint); 2227 s->session->psk_identity_hint = NULL; 2228 } else if (!PACKET_strndup(&psk_identity_hint, 2229 &s->session->psk_identity_hint)) { 2230 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2231 return 0; 2232 } 2233 2234 return 1; 2235 #else 2236 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2237 return 0; 2238 #endif 2239 } 2240 2241 static int tls_process_ske_srp(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey) 2242 { 2243 #ifndef OPENSSL_NO_SRP 2244 PACKET prime, generator, salt, server_pub; 2245 2246 if (!PACKET_get_length_prefixed_2(pkt, &prime) 2247 || !PACKET_get_length_prefixed_2(pkt, &generator) 2248 || !PACKET_get_length_prefixed_1(pkt, &salt) 2249 || !PACKET_get_length_prefixed_2(pkt, &server_pub)) { 2250 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2251 return 0; 2252 } 2253 2254 if ((s->srp_ctx.N = BN_bin2bn(PACKET_data(&prime), 2255 (int)PACKET_remaining(&prime), NULL)) 2256 == NULL 2257 || (s->srp_ctx.g = BN_bin2bn(PACKET_data(&generator), 2258 (int)PACKET_remaining(&generator), NULL)) 2259 == NULL 2260 || (s->srp_ctx.s = BN_bin2bn(PACKET_data(&salt), 2261 (int)PACKET_remaining(&salt), NULL)) 2262 == NULL 2263 || (s->srp_ctx.B = BN_bin2bn(PACKET_data(&server_pub), 2264 (int)PACKET_remaining(&server_pub), NULL)) 2265 == NULL) { 2266 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BN_LIB); 2267 return 0; 2268 } 2269 2270 if (!srp_verify_server_param(s)) { 2271 /* SSLfatal() already called */ 2272 return 0; 2273 } 2274 2275 /* We must check if there is a certificate */ 2276 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) 2277 *pkey = tls_get_peer_pkey(s); 2278 2279 return 1; 2280 #else 2281 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2282 return 0; 2283 #endif 2284 } 2285 2286 static int tls_process_ske_dhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey) 2287 { 2288 PACKET prime, generator, pub_key; 2289 EVP_PKEY *peer_tmp = NULL; 2290 BIGNUM *p = NULL, *g = NULL, *bnpub_key = NULL; 2291 EVP_PKEY_CTX *pctx = NULL; 2292 OSSL_PARAM *params = NULL; 2293 OSSL_PARAM_BLD *tmpl = NULL; 2294 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 2295 int ret = 0; 2296 2297 if (!PACKET_get_length_prefixed_2(pkt, &prime) 2298 || !PACKET_get_length_prefixed_2(pkt, &generator) 2299 || !PACKET_get_length_prefixed_2(pkt, &pub_key)) { 2300 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2301 return 0; 2302 } 2303 2304 p = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL); 2305 g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator), 2306 NULL); 2307 bnpub_key = BN_bin2bn(PACKET_data(&pub_key), 2308 (int)PACKET_remaining(&pub_key), NULL); 2309 if (p == NULL || g == NULL || bnpub_key == NULL) { 2310 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BN_LIB); 2311 goto err; 2312 } 2313 2314 tmpl = OSSL_PARAM_BLD_new(); 2315 if (tmpl == NULL 2316 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p) 2317 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G, g) 2318 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_PUB_KEY, 2319 bnpub_key) 2320 || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) { 2321 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2322 goto err; 2323 } 2324 2325 pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq); 2326 if (pctx == NULL) { 2327 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2328 goto err; 2329 } 2330 if (EVP_PKEY_fromdata_init(pctx) <= 0 2331 || EVP_PKEY_fromdata(pctx, &peer_tmp, EVP_PKEY_KEYPAIR, params) <= 0) { 2332 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_DH_VALUE); 2333 goto err; 2334 } 2335 2336 EVP_PKEY_CTX_free(pctx); 2337 pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, peer_tmp, sctx->propq); 2338 if (pctx == NULL 2339 /* 2340 * EVP_PKEY_param_check() will verify that the DH params are using 2341 * a safe prime. In this context, because we're using ephemeral DH, 2342 * we're ok with it not being a safe prime. 2343 * EVP_PKEY_param_check_quick() skips the safe prime check. 2344 */ 2345 || EVP_PKEY_param_check_quick(pctx) != 1 2346 || EVP_PKEY_public_check(pctx) != 1) { 2347 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_DH_VALUE); 2348 goto err; 2349 } 2350 2351 if (!ssl_security(s, SSL_SECOP_TMP_DH, 2352 EVP_PKEY_get_security_bits(peer_tmp), 2353 0, peer_tmp)) { 2354 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_DH_KEY_TOO_SMALL); 2355 goto err; 2356 } 2357 2358 s->s3.peer_tmp = peer_tmp; 2359 peer_tmp = NULL; 2360 2361 /* 2362 * FIXME: This makes assumptions about which ciphersuites come with 2363 * public keys. We should have a less ad-hoc way of doing this 2364 */ 2365 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) 2366 *pkey = tls_get_peer_pkey(s); 2367 /* else anonymous DH, so no certificate or pkey. */ 2368 2369 ret = 1; 2370 2371 err: 2372 OSSL_PARAM_BLD_free(tmpl); 2373 OSSL_PARAM_free(params); 2374 EVP_PKEY_free(peer_tmp); 2375 EVP_PKEY_CTX_free(pctx); 2376 BN_free(p); 2377 BN_free(g); 2378 BN_free(bnpub_key); 2379 2380 return ret; 2381 } 2382 2383 static int tls_process_ske_ecdhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey) 2384 { 2385 PACKET encoded_pt; 2386 unsigned int curve_type, curve_id; 2387 2388 /* 2389 * Extract elliptic curve parameters and the server's ephemeral ECDH 2390 * public key. We only support named (not generic) curves and 2391 * ECParameters in this case is just three bytes. 2392 */ 2393 if (!PACKET_get_1(pkt, &curve_type) || !PACKET_get_net_2(pkt, &curve_id)) { 2394 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT); 2395 return 0; 2396 } 2397 /* 2398 * Check curve is named curve type and one of our preferences, if not 2399 * server has sent an invalid curve. 2400 */ 2401 if (curve_type != NAMED_CURVE_TYPE 2402 || !tls1_check_group_id(s, curve_id, 1)) { 2403 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE); 2404 return 0; 2405 } 2406 2407 if ((s->s3.peer_tmp = ssl_generate_param_group(s, curve_id)) == NULL) { 2408 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2409 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); 2410 return 0; 2411 } 2412 2413 if (!PACKET_get_length_prefixed_1(pkt, &encoded_pt)) { 2414 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2415 return 0; 2416 } 2417 2418 if (EVP_PKEY_set1_encoded_public_key(s->s3.peer_tmp, 2419 PACKET_data(&encoded_pt), 2420 PACKET_remaining(&encoded_pt)) 2421 <= 0) { 2422 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT); 2423 return 0; 2424 } 2425 2426 /* 2427 * The ECC/TLS specification does not mention the use of DSA to sign 2428 * ECParameters in the server key exchange message. We do support RSA 2429 * and ECDSA. 2430 */ 2431 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) 2432 *pkey = tls_get_peer_pkey(s); 2433 else if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aRSA) 2434 *pkey = tls_get_peer_pkey(s); 2435 /* else anonymous ECDH, so no certificate or pkey. */ 2436 2437 /* Cache the agreed upon group in the SSL_SESSION */ 2438 s->session->kex_group = curve_id; 2439 return 1; 2440 } 2441 2442 MSG_PROCESS_RETURN tls_process_key_exchange(SSL_CONNECTION *s, PACKET *pkt) 2443 { 2444 long alg_k; 2445 EVP_PKEY *pkey = NULL; 2446 EVP_MD_CTX *md_ctx = NULL; 2447 EVP_PKEY_CTX *pctx = NULL; 2448 PACKET save_param_start, signature; 2449 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 2450 2451 alg_k = s->s3.tmp.new_cipher->algorithm_mkey; 2452 2453 save_param_start = *pkt; 2454 2455 EVP_PKEY_free(s->s3.peer_tmp); 2456 s->s3.peer_tmp = NULL; 2457 2458 if (alg_k & SSL_PSK) { 2459 if (!tls_process_ske_psk_preamble(s, pkt)) { 2460 /* SSLfatal() already called */ 2461 goto err; 2462 } 2463 } 2464 2465 /* Nothing else to do for plain PSK or RSAPSK */ 2466 if (alg_k & (SSL_kPSK | SSL_kRSAPSK)) { 2467 } else if (alg_k & SSL_kSRP) { 2468 if (!tls_process_ske_srp(s, pkt, &pkey)) { 2469 /* SSLfatal() already called */ 2470 goto err; 2471 } 2472 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { 2473 if (!tls_process_ske_dhe(s, pkt, &pkey)) { 2474 /* SSLfatal() already called */ 2475 goto err; 2476 } 2477 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { 2478 if (!tls_process_ske_ecdhe(s, pkt, &pkey)) { 2479 /* SSLfatal() already called */ 2480 goto err; 2481 } 2482 } else if (alg_k) { 2483 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); 2484 goto err; 2485 } 2486 2487 /* if it was signed, check the signature */ 2488 if (pkey != NULL) { 2489 PACKET params; 2490 const EVP_MD *md = NULL; 2491 unsigned char *tbs; 2492 size_t tbslen; 2493 int rv; 2494 2495 /* 2496 * |pkt| now points to the beginning of the signature, so the difference 2497 * equals the length of the parameters. 2498 */ 2499 if (!PACKET_get_sub_packet(&save_param_start, ¶ms, 2500 PACKET_remaining(&save_param_start) - PACKET_remaining(pkt))) { 2501 SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR); 2502 goto err; 2503 } 2504 2505 if (SSL_USE_SIGALGS(s)) { 2506 unsigned int sigalg; 2507 2508 if (!PACKET_get_net_2(pkt, &sigalg)) { 2509 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT); 2510 goto err; 2511 } 2512 if (tls12_check_peer_sigalg(s, sigalg, pkey) <= 0) { 2513 /* SSLfatal() already called */ 2514 goto err; 2515 } 2516 } else if (!tls1_set_peer_legacy_sigalg(s, pkey)) { 2517 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2518 SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED); 2519 goto err; 2520 } 2521 2522 if (!tls1_lookup_md(sctx, s->s3.tmp.peer_sigalg, &md)) { 2523 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2524 SSL_R_NO_SUITABLE_DIGEST_ALGORITHM); 2525 goto err; 2526 } 2527 if (SSL_USE_SIGALGS(s)) 2528 OSSL_TRACE1(TLS, "USING TLSv1.2 HASH %s\n", 2529 md == NULL ? "n/a" : EVP_MD_get0_name(md)); 2530 2531 if (!PACKET_get_length_prefixed_2(pkt, &signature) 2532 || PACKET_remaining(pkt) != 0) { 2533 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2534 goto err; 2535 } 2536 2537 md_ctx = EVP_MD_CTX_new(); 2538 if (md_ctx == NULL) { 2539 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 2540 goto err; 2541 } 2542 2543 if (EVP_DigestVerifyInit_ex(md_ctx, &pctx, 2544 md == NULL ? NULL : EVP_MD_get0_name(md), 2545 sctx->libctx, sctx->propq, pkey, 2546 NULL) 2547 <= 0) { 2548 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 2549 goto err; 2550 } 2551 if (SSL_USE_PSS(s)) { 2552 if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0 2553 || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, 2554 RSA_PSS_SALTLEN_DIGEST) 2555 <= 0) { 2556 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 2557 goto err; 2558 } 2559 } 2560 tbslen = construct_key_exchange_tbs(s, &tbs, PACKET_data(¶ms), 2561 PACKET_remaining(¶ms)); 2562 if (tbslen == 0) { 2563 /* SSLfatal() already called */ 2564 goto err; 2565 } 2566 2567 rv = EVP_DigestVerify(md_ctx, PACKET_data(&signature), 2568 PACKET_remaining(&signature), tbs, tbslen); 2569 OPENSSL_free(tbs); 2570 if (rv <= 0) { 2571 SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_R_BAD_SIGNATURE); 2572 goto err; 2573 } 2574 EVP_MD_CTX_free(md_ctx); 2575 md_ctx = NULL; 2576 } else { 2577 /* aNULL, aSRP or PSK do not need public keys */ 2578 if (!(s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP)) 2579 && !(alg_k & SSL_PSK)) { 2580 /* Might be wrong key type, check it */ 2581 if (ssl3_check_cert_and_algorithm(s)) { 2582 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_DATA); 2583 } 2584 /* else this shouldn't happen, SSLfatal() already called */ 2585 goto err; 2586 } 2587 /* still data left over */ 2588 if (PACKET_remaining(pkt) != 0) { 2589 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_EXTRA_DATA_IN_MESSAGE); 2590 goto err; 2591 } 2592 } 2593 2594 return MSG_PROCESS_CONTINUE_READING; 2595 err: 2596 EVP_MD_CTX_free(md_ctx); 2597 return MSG_PROCESS_ERROR; 2598 } 2599 2600 MSG_PROCESS_RETURN tls_process_certificate_request(SSL_CONNECTION *s, 2601 PACKET *pkt) 2602 { 2603 /* Clear certificate validity flags */ 2604 if (s->s3.tmp.valid_flags != NULL) 2605 memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t)); 2606 else 2607 s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t)); 2608 2609 /* Give up for good if allocation didn't work */ 2610 if (s->s3.tmp.valid_flags == NULL) { 2611 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 2612 return MSG_PROCESS_ERROR; 2613 } 2614 2615 if (SSL_CONNECTION_IS_TLS13(s)) { 2616 PACKET reqctx, extensions; 2617 RAW_EXTENSION *rawexts = NULL; 2618 2619 if ((s->shutdown & SSL_SENT_SHUTDOWN) != 0) { 2620 /* 2621 * We already sent close_notify. This can only happen in TLSv1.3 2622 * post-handshake messages. We can't reasonably respond to this, so 2623 * we just ignore it 2624 */ 2625 return MSG_PROCESS_FINISHED_READING; 2626 } 2627 2628 /* Free and zero certificate types: it is not present in TLS 1.3 */ 2629 OPENSSL_free(s->s3.tmp.ctype); 2630 s->s3.tmp.ctype = NULL; 2631 s->s3.tmp.ctype_len = 0; 2632 OPENSSL_free(s->pha_context); 2633 s->pha_context = NULL; 2634 s->pha_context_len = 0; 2635 2636 if (!PACKET_get_length_prefixed_1(pkt, &reqctx) || !PACKET_memdup(&reqctx, &s->pha_context, &s->pha_context_len)) { 2637 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2638 return MSG_PROCESS_ERROR; 2639 } 2640 2641 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) { 2642 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH); 2643 return MSG_PROCESS_ERROR; 2644 } 2645 if (!tls_collect_extensions(s, &extensions, 2646 SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, 2647 &rawexts, NULL, 1) 2648 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, 2649 rawexts, NULL, 0, 1)) { 2650 /* SSLfatal() already called */ 2651 OPENSSL_free(rawexts); 2652 return MSG_PROCESS_ERROR; 2653 } 2654 OPENSSL_free(rawexts); 2655 if (!tls1_process_sigalgs(s)) { 2656 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_LENGTH); 2657 return MSG_PROCESS_ERROR; 2658 } 2659 } else { 2660 PACKET ctypes; 2661 2662 /* get the certificate types */ 2663 if (!PACKET_get_length_prefixed_1(pkt, &ctypes)) { 2664 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2665 return MSG_PROCESS_ERROR; 2666 } 2667 2668 if (!PACKET_memdup(&ctypes, &s->s3.tmp.ctype, &s->s3.tmp.ctype_len)) { 2669 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2670 return MSG_PROCESS_ERROR; 2671 } 2672 2673 if (SSL_USE_SIGALGS(s)) { 2674 PACKET sigalgs; 2675 2676 if (!PACKET_get_length_prefixed_2(pkt, &sigalgs)) { 2677 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2678 return MSG_PROCESS_ERROR; 2679 } 2680 2681 /* 2682 * Despite this being for certificates, preserve compatibility 2683 * with pre-TLS 1.3 and use the regular sigalgs field. 2684 */ 2685 if (!tls1_save_sigalgs(s, &sigalgs, 0)) { 2686 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2687 SSL_R_SIGNATURE_ALGORITHMS_ERROR); 2688 return MSG_PROCESS_ERROR; 2689 } 2690 if (!tls1_process_sigalgs(s)) { 2691 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); 2692 return MSG_PROCESS_ERROR; 2693 } 2694 } 2695 2696 /* get the CA RDNs */ 2697 if (!parse_ca_names(s, pkt)) { 2698 /* SSLfatal() already called */ 2699 return MSG_PROCESS_ERROR; 2700 } 2701 } 2702 2703 if (PACKET_remaining(pkt) != 0) { 2704 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2705 return MSG_PROCESS_ERROR; 2706 } 2707 2708 /* we should setup a certificate to return.... */ 2709 s->s3.tmp.cert_req = 1; 2710 2711 /* 2712 * In TLSv1.3 we don't prepare the client certificate yet. We wait until 2713 * after the CertificateVerify message has been received. This is because 2714 * in TLSv1.3 the CertificateRequest arrives before the Certificate message 2715 * but in TLSv1.2 it is the other way around. We want to make sure that 2716 * SSL_get1_peer_certificate() returns something sensible in 2717 * client_cert_cb. 2718 */ 2719 if (SSL_CONNECTION_IS_TLS13(s) 2720 && s->post_handshake_auth != SSL_PHA_REQUESTED) 2721 return MSG_PROCESS_CONTINUE_READING; 2722 2723 return MSG_PROCESS_CONTINUE_PROCESSING; 2724 } 2725 2726 MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s, 2727 PACKET *pkt) 2728 { 2729 unsigned int ticklen; 2730 unsigned long ticket_lifetime_hint, age_add = 0; 2731 unsigned int sess_len; 2732 RAW_EXTENSION *exts = NULL; 2733 PACKET nonce; 2734 EVP_MD *sha256 = NULL; 2735 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 2736 2737 PACKET_null_init(&nonce); 2738 2739 if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint) 2740 || (SSL_CONNECTION_IS_TLS13(s) 2741 && (!PACKET_get_net_4(pkt, &age_add) 2742 || !PACKET_get_length_prefixed_1(pkt, &nonce))) 2743 || !PACKET_get_net_2(pkt, &ticklen) 2744 || (SSL_CONNECTION_IS_TLS13(s) ? (ticklen == 0 2745 || PACKET_remaining(pkt) < ticklen) 2746 : PACKET_remaining(pkt) != ticklen)) { 2747 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2748 goto err; 2749 } 2750 2751 /* 2752 * Server is allowed to change its mind (in <=TLSv1.2) and send an empty 2753 * ticket. We already checked this TLSv1.3 case above, so it should never 2754 * be 0 here in that instance 2755 */ 2756 if (ticklen == 0) 2757 return MSG_PROCESS_CONTINUE_READING; 2758 2759 /* 2760 * Sessions must be immutable once they go into the session cache. Otherwise 2761 * we can get multi-thread problems. Therefore we don't "update" sessions, 2762 * we replace them with a duplicate. In TLSv1.3 we need to do this every 2763 * time a NewSessionTicket arrives because those messages arrive 2764 * post-handshake and the session may have already gone into the session 2765 * cache. 2766 */ 2767 if (SSL_CONNECTION_IS_TLS13(s) || s->session->session_id_length > 0) { 2768 SSL_SESSION *new_sess; 2769 2770 /* 2771 * We reused an existing session, so we need to replace it with a new 2772 * one 2773 */ 2774 if ((new_sess = ssl_session_dup(s->session, 0)) == 0) { 2775 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); 2776 goto err; 2777 } 2778 2779 if ((s->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) != 0 2780 && !SSL_CONNECTION_IS_TLS13(s)) { 2781 /* 2782 * In TLSv1.2 and below the arrival of a new tickets signals that 2783 * any old ticket we were using is now out of date, so we remove the 2784 * old session from the cache. We carry on if this fails 2785 */ 2786 SSL_CTX_remove_session(s->session_ctx, s->session); 2787 } 2788 2789 SSL_SESSION_free(s->session); 2790 s->session = new_sess; 2791 } 2792 2793 s->session->time = ossl_time_now(); 2794 ssl_session_calculate_timeout(s->session); 2795 2796 OPENSSL_free(s->session->ext.tick); 2797 s->session->ext.tick = NULL; 2798 s->session->ext.ticklen = 0; 2799 2800 s->session->ext.tick = OPENSSL_malloc(ticklen); 2801 if (s->session->ext.tick == NULL) { 2802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 2803 goto err; 2804 } 2805 if (!PACKET_copy_bytes(pkt, s->session->ext.tick, ticklen)) { 2806 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2807 goto err; 2808 } 2809 2810 s->session->ext.tick_lifetime_hint = ticket_lifetime_hint; 2811 s->session->ext.tick_age_add = age_add; 2812 s->session->ext.ticklen = ticklen; 2813 2814 if (SSL_CONNECTION_IS_TLS13(s)) { 2815 PACKET extpkt; 2816 2817 /* 2818 * Fulfilling RFC8446:4.6.1 requirement: Clients MUST NOT cache 2819 * tickets for longer than 7 days. 2820 */ 2821 if (ticket_lifetime_hint > 604800) { 2822 s->session->ext.tick_lifetime_hint = 604800; 2823 } 2824 2825 if (!PACKET_as_length_prefixed_2(pkt, &extpkt) 2826 || PACKET_remaining(pkt) != 0) { 2827 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2828 goto err; 2829 } 2830 2831 if (!tls_collect_extensions(s, &extpkt, 2832 SSL_EXT_TLS1_3_NEW_SESSION_TICKET, &exts, 2833 NULL, 1) 2834 || !tls_parse_all_extensions(s, 2835 SSL_EXT_TLS1_3_NEW_SESSION_TICKET, 2836 exts, NULL, 0, 1)) { 2837 /* SSLfatal() already called */ 2838 goto err; 2839 } 2840 } 2841 2842 /* 2843 * There are two ways to detect a resumed ticket session. One is to set 2844 * an appropriate session ID and then the server must return a match in 2845 * ServerHello. This allows the normal client session ID matching to work 2846 * and we know much earlier that the ticket has been accepted. The 2847 * other way is to set zero length session ID when the ticket is 2848 * presented and rely on the handshake to determine session resumption. 2849 * We choose the former approach because this fits in with assumptions 2850 * elsewhere in OpenSSL. The session ID is set to the SHA256 hash of the 2851 * ticket. 2852 */ 2853 sha256 = EVP_MD_fetch(sctx->libctx, "SHA2-256", sctx->propq); 2854 if (sha256 == NULL) { 2855 /* Error is already recorded */ 2856 SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); 2857 goto err; 2858 } 2859 /* 2860 * We use sess_len here because EVP_Digest expects an int 2861 * but s->session->session_id_length is a size_t 2862 */ 2863 if (!EVP_Digest(s->session->ext.tick, ticklen, 2864 s->session->session_id, &sess_len, 2865 sha256, NULL)) { 2866 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 2867 goto err; 2868 } 2869 EVP_MD_free(sha256); 2870 sha256 = NULL; 2871 s->session->session_id_length = sess_len; 2872 s->session->not_resumable = 0; 2873 2874 /* This is a standalone message in TLSv1.3, so there is no more to read */ 2875 if (SSL_CONNECTION_IS_TLS13(s)) { 2876 const EVP_MD *md = ssl_handshake_md(s); 2877 int hashleni = EVP_MD_get_size(md); 2878 size_t hashlen; 2879 /* ASCII: "resumption", in hex for EBCDIC compatibility */ 2880 static const unsigned char nonce_label[] = { 0x72, 0x65, 0x73, 0x75, 0x6D, 2881 0x70, 0x74, 0x69, 0x6F, 0x6E }; 2882 2883 /* Ensure cast to size_t is safe */ 2884 if (!ossl_assert(hashleni > 0)) { 2885 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2886 goto err; 2887 } 2888 hashlen = (size_t)hashleni; 2889 2890 if (!tls13_hkdf_expand(s, md, s->resumption_master_secret, 2891 nonce_label, 2892 sizeof(nonce_label), 2893 PACKET_data(&nonce), 2894 PACKET_remaining(&nonce), 2895 s->session->master_key, 2896 hashlen, 1)) { 2897 /* SSLfatal() already called */ 2898 goto err; 2899 } 2900 s->session->master_key_length = hashlen; 2901 2902 OPENSSL_free(exts); 2903 ssl_update_cache(s, SSL_SESS_CACHE_CLIENT); 2904 return MSG_PROCESS_FINISHED_READING; 2905 } 2906 2907 return MSG_PROCESS_CONTINUE_READING; 2908 err: 2909 EVP_MD_free(sha256); 2910 OPENSSL_free(exts); 2911 return MSG_PROCESS_ERROR; 2912 } 2913 2914 /* 2915 * In TLSv1.3 this is called from the extensions code, otherwise it is used to 2916 * parse a separate message. Returns 1 on success or 0 on failure 2917 */ 2918 int tls_process_cert_status_body(SSL_CONNECTION *s, PACKET *pkt) 2919 { 2920 size_t resplen; 2921 unsigned int type; 2922 2923 if (!PACKET_get_1(pkt, &type) 2924 || type != TLSEXT_STATUSTYPE_ocsp) { 2925 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_UNSUPPORTED_STATUS_TYPE); 2926 return 0; 2927 } 2928 if (!PACKET_get_net_3_len(pkt, &resplen) 2929 || PACKET_remaining(pkt) != resplen) { 2930 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2931 return 0; 2932 } 2933 s->ext.ocsp.resp = OPENSSL_malloc(resplen); 2934 if (s->ext.ocsp.resp == NULL) { 2935 s->ext.ocsp.resp_len = 0; 2936 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 2937 return 0; 2938 } 2939 s->ext.ocsp.resp_len = resplen; 2940 if (!PACKET_copy_bytes(pkt, s->ext.ocsp.resp, resplen)) { 2941 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 2942 return 0; 2943 } 2944 2945 return 1; 2946 } 2947 2948 MSG_PROCESS_RETURN tls_process_cert_status(SSL_CONNECTION *s, PACKET *pkt) 2949 { 2950 if (!tls_process_cert_status_body(s, pkt)) { 2951 /* SSLfatal() already called */ 2952 return MSG_PROCESS_ERROR; 2953 } 2954 2955 return MSG_PROCESS_CONTINUE_READING; 2956 } 2957 2958 /* 2959 * Perform miscellaneous checks and processing after we have received the 2960 * server's initial flight. In TLS1.3 this is after the Server Finished message. 2961 * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0 2962 * on failure. 2963 */ 2964 int tls_process_initial_server_flight(SSL_CONNECTION *s) 2965 { 2966 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 2967 2968 /* 2969 * at this point we check that we have the required stuff from 2970 * the server 2971 */ 2972 if (!ssl3_check_cert_and_algorithm(s)) { 2973 /* SSLfatal() already called */ 2974 return 0; 2975 } 2976 2977 /* 2978 * Call the ocsp status callback if needed. The |ext.ocsp.resp| and 2979 * |ext.ocsp.resp_len| values will be set if we actually received a status 2980 * message, or NULL and -1 otherwise 2981 */ 2982 if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing 2983 && sctx->ext.status_cb != NULL) { 2984 int ret = sctx->ext.status_cb(SSL_CONNECTION_GET_USER_SSL(s), 2985 sctx->ext.status_arg); 2986 2987 if (ret == 0) { 2988 SSLfatal(s, SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE, 2989 SSL_R_INVALID_STATUS_RESPONSE); 2990 return 0; 2991 } 2992 if (ret < 0) { 2993 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 2994 SSL_R_OCSP_CALLBACK_FAILURE); 2995 return 0; 2996 } 2997 } 2998 #ifndef OPENSSL_NO_CT 2999 if (s->ct_validation_callback != NULL) { 3000 /* Note we validate the SCTs whether or not we abort on error */ 3001 if (!ssl_validate_ct(s) && (s->verify_mode & SSL_VERIFY_PEER)) { 3002 /* SSLfatal() already called */ 3003 return 0; 3004 } 3005 } 3006 #endif 3007 3008 return 1; 3009 } 3010 3011 MSG_PROCESS_RETURN tls_process_server_done(SSL_CONNECTION *s, PACKET *pkt) 3012 { 3013 if (PACKET_remaining(pkt) > 0) { 3014 /* should contain no data */ 3015 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 3016 return MSG_PROCESS_ERROR; 3017 } 3018 #ifndef OPENSSL_NO_SRP 3019 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kSRP) { 3020 if (ssl_srp_calc_a_param_intern(s) <= 0) { 3021 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_SRP_A_CALC); 3022 return MSG_PROCESS_ERROR; 3023 } 3024 } 3025 #endif 3026 3027 if (!tls_process_initial_server_flight(s)) { 3028 /* SSLfatal() already called */ 3029 return MSG_PROCESS_ERROR; 3030 } 3031 3032 return MSG_PROCESS_FINISHED_READING; 3033 } 3034 3035 static int tls_construct_cke_psk_preamble(SSL_CONNECTION *s, WPACKET *pkt) 3036 { 3037 #ifndef OPENSSL_NO_PSK 3038 int ret = 0; 3039 /* 3040 * The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes to return a 3041 * \0-terminated identity. The last byte is for us for simulating 3042 * strnlen. 3043 */ 3044 char identity[PSK_MAX_IDENTITY_LEN + 1]; 3045 size_t identitylen = 0; 3046 unsigned char psk[PSK_MAX_PSK_LEN]; 3047 unsigned char *tmppsk = NULL; 3048 char *tmpidentity = NULL; 3049 size_t psklen = 0; 3050 3051 if (s->psk_client_callback == NULL) { 3052 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PSK_NO_CLIENT_CB); 3053 goto err; 3054 } 3055 3056 memset(identity, 0, sizeof(identity)); 3057 3058 psklen = s->psk_client_callback(SSL_CONNECTION_GET_USER_SSL(s), 3059 s->session->psk_identity_hint, 3060 identity, sizeof(identity) - 1, 3061 psk, sizeof(psk)); 3062 3063 if (psklen > PSK_MAX_PSK_LEN) { 3064 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, ERR_R_INTERNAL_ERROR); 3065 psklen = PSK_MAX_PSK_LEN; /* Avoid overrunning the array on cleanse */ 3066 goto err; 3067 } else if (psklen == 0) { 3068 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_PSK_IDENTITY_NOT_FOUND); 3069 goto err; 3070 } 3071 3072 identitylen = strlen(identity); 3073 if (identitylen > PSK_MAX_IDENTITY_LEN) { 3074 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3075 goto err; 3076 } 3077 3078 tmppsk = OPENSSL_memdup(psk, psklen); 3079 tmpidentity = OPENSSL_strdup(identity); 3080 if (tmppsk == NULL || tmpidentity == NULL) { 3081 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 3082 goto err; 3083 } 3084 3085 OPENSSL_free(s->s3.tmp.psk); 3086 s->s3.tmp.psk = tmppsk; 3087 s->s3.tmp.psklen = psklen; 3088 tmppsk = NULL; 3089 OPENSSL_free(s->session->psk_identity); 3090 s->session->psk_identity = tmpidentity; 3091 tmpidentity = NULL; 3092 3093 if (!WPACKET_sub_memcpy_u16(pkt, identity, identitylen)) { 3094 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3095 goto err; 3096 } 3097 3098 ret = 1; 3099 3100 err: 3101 OPENSSL_cleanse(psk, psklen); 3102 OPENSSL_cleanse(identity, sizeof(identity)); 3103 OPENSSL_clear_free(tmppsk, psklen); 3104 OPENSSL_clear_free(tmpidentity, identitylen); 3105 3106 return ret; 3107 #else 3108 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3109 return 0; 3110 #endif 3111 } 3112 3113 static int tls_construct_cke_rsa(SSL_CONNECTION *s, WPACKET *pkt) 3114 { 3115 unsigned char *encdata = NULL; 3116 EVP_PKEY *pkey = NULL; 3117 EVP_PKEY_CTX *pctx = NULL; 3118 size_t enclen; 3119 unsigned char *pms = NULL; 3120 size_t pmslen = 0; 3121 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 3122 3123 if (!received_server_cert(s)) { 3124 /* 3125 * We should always have a server certificate with SSL_kRSA. 3126 */ 3127 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3128 return 0; 3129 } 3130 3131 if ((pkey = tls_get_peer_pkey(s)) == NULL) { 3132 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3133 return 0; 3134 } 3135 3136 if (!EVP_PKEY_is_a(pkey, "RSA")) { 3137 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3138 return 0; 3139 } 3140 3141 pmslen = SSL_MAX_MASTER_KEY_LENGTH; 3142 pms = OPENSSL_malloc(pmslen); 3143 if (pms == NULL) { 3144 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 3145 return 0; 3146 } 3147 3148 pms[0] = s->client_version >> 8; 3149 pms[1] = s->client_version & 0xff; 3150 if (RAND_bytes_ex(sctx->libctx, pms + 2, pmslen - 2, 0) <= 0) { 3151 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_RAND_LIB); 3152 goto err; 3153 } 3154 3155 /* Fix buf for TLS and beyond */ 3156 if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) { 3157 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3158 goto err; 3159 } 3160 3161 pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, pkey, sctx->propq); 3162 if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0 3163 || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) { 3164 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 3165 goto err; 3166 } 3167 if (!WPACKET_allocate_bytes(pkt, enclen, &encdata) 3168 || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) { 3169 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_RSA_ENCRYPT); 3170 goto err; 3171 } 3172 EVP_PKEY_CTX_free(pctx); 3173 pctx = NULL; 3174 3175 /* Fix buf for TLS and beyond */ 3176 if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) { 3177 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3178 goto err; 3179 } 3180 3181 /* Log the premaster secret, if logging is enabled. */ 3182 if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) { 3183 /* SSLfatal() already called */ 3184 goto err; 3185 } 3186 3187 s->s3.tmp.pms = pms; 3188 s->s3.tmp.pmslen = pmslen; 3189 3190 return 1; 3191 err: 3192 OPENSSL_clear_free(pms, pmslen); 3193 EVP_PKEY_CTX_free(pctx); 3194 3195 return 0; 3196 } 3197 3198 static int tls_construct_cke_dhe(SSL_CONNECTION *s, WPACKET *pkt) 3199 { 3200 EVP_PKEY *ckey = NULL, *skey = NULL; 3201 unsigned char *keybytes = NULL; 3202 int prime_len; 3203 unsigned char *encoded_pub = NULL; 3204 size_t encoded_pub_len, pad_len; 3205 int ret = 0; 3206 3207 skey = s->s3.peer_tmp; 3208 if (skey == NULL) { 3209 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3210 goto err; 3211 } 3212 3213 ckey = ssl_generate_pkey(s, skey); 3214 if (ckey == NULL) { 3215 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3216 goto err; 3217 } 3218 3219 if (ssl_derive(s, ckey, skey, 0) == 0) { 3220 /* SSLfatal() already called */ 3221 goto err; 3222 } 3223 3224 /* send off the data */ 3225 3226 /* Generate encoding of server key */ 3227 encoded_pub_len = EVP_PKEY_get1_encoded_public_key(ckey, &encoded_pub); 3228 if (encoded_pub_len == 0) { 3229 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3230 EVP_PKEY_free(ckey); 3231 return EXT_RETURN_FAIL; 3232 } 3233 3234 /* 3235 * For interoperability with some versions of the Microsoft TLS 3236 * stack, we need to zero pad the DHE pub key to the same length 3237 * as the prime. 3238 */ 3239 prime_len = EVP_PKEY_get_size(ckey); 3240 pad_len = prime_len - encoded_pub_len; 3241 if (pad_len > 0) { 3242 if (!WPACKET_sub_allocate_bytes_u16(pkt, pad_len, &keybytes)) { 3243 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3244 goto err; 3245 } 3246 memset(keybytes, 0, pad_len); 3247 } 3248 3249 if (!WPACKET_sub_memcpy_u16(pkt, encoded_pub, encoded_pub_len)) { 3250 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3251 goto err; 3252 } 3253 3254 ret = 1; 3255 err: 3256 OPENSSL_free(encoded_pub); 3257 EVP_PKEY_free(ckey); 3258 return ret; 3259 } 3260 3261 static int tls_construct_cke_ecdhe(SSL_CONNECTION *s, WPACKET *pkt) 3262 { 3263 unsigned char *encodedPoint = NULL; 3264 size_t encoded_pt_len = 0; 3265 EVP_PKEY *ckey = NULL, *skey = NULL; 3266 int ret = 0; 3267 3268 skey = s->s3.peer_tmp; 3269 if (skey == NULL) { 3270 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3271 return 0; 3272 } 3273 3274 ckey = ssl_generate_pkey(s, skey); 3275 if (ckey == NULL) { 3276 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); 3277 goto err; 3278 } 3279 3280 if (ssl_derive(s, ckey, skey, 0) == 0) { 3281 /* SSLfatal() already called */ 3282 goto err; 3283 } 3284 3285 /* Generate encoding of client key */ 3286 encoded_pt_len = EVP_PKEY_get1_encoded_public_key(ckey, &encodedPoint); 3287 3288 if (encoded_pt_len == 0) { 3289 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB); 3290 goto err; 3291 } 3292 3293 if (!WPACKET_sub_memcpy_u8(pkt, encodedPoint, encoded_pt_len)) { 3294 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3295 goto err; 3296 } 3297 3298 ret = 1; 3299 err: 3300 OPENSSL_free(encodedPoint); 3301 EVP_PKEY_free(ckey); 3302 return ret; 3303 } 3304 3305 static int tls_construct_cke_gost(SSL_CONNECTION *s, WPACKET *pkt) 3306 { 3307 #ifndef OPENSSL_NO_GOST 3308 /* GOST key exchange message creation */ 3309 EVP_PKEY_CTX *pkey_ctx = NULL; 3310 EVP_PKEY *pkey = NULL; 3311 size_t msglen; 3312 unsigned int md_len; 3313 unsigned char shared_ukm[32], tmp[256]; 3314 EVP_MD_CTX *ukm_hash = NULL; 3315 int dgst_nid = NID_id_GostR3411_94; 3316 unsigned char *pms = NULL; 3317 size_t pmslen = 0; 3318 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 3319 3320 if ((s->s3.tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0) 3321 dgst_nid = NID_id_GostR3411_2012_256; 3322 3323 /* 3324 * Get server certificate PKEY and create ctx from it 3325 */ 3326 if ((pkey = tls_get_peer_pkey(s)) == NULL) { 3327 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 3328 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); 3329 return 0; 3330 } 3331 3332 pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, 3333 pkey, 3334 sctx->propq); 3335 if (pkey_ctx == NULL) { 3336 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 3337 return 0; 3338 } 3339 /* 3340 * If we have send a certificate, and certificate key 3341 * parameters match those of server certificate, use 3342 * certificate key for key exchange 3343 */ 3344 3345 /* Otherwise, generate ephemeral key pair */ 3346 pmslen = 32; 3347 pms = OPENSSL_malloc(pmslen); 3348 if (pms == NULL) { 3349 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 3350 goto err; 3351 } 3352 3353 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0 3354 /* Generate session key 3355 */ 3356 || RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) { 3357 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3358 goto err; 3359 }; 3360 /* 3361 * Compute shared IV and store it in algorithm-specific context 3362 * data 3363 */ 3364 ukm_hash = EVP_MD_CTX_new(); 3365 if (ukm_hash == NULL 3366 || EVP_DigestInit(ukm_hash, EVP_get_digestbynid(dgst_nid)) <= 0 3367 || EVP_DigestUpdate(ukm_hash, s->s3.client_random, 3368 SSL3_RANDOM_SIZE) 3369 <= 0 3370 || EVP_DigestUpdate(ukm_hash, s->s3.server_random, 3371 SSL3_RANDOM_SIZE) 3372 <= 0 3373 || EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len) <= 0) { 3374 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3375 goto err; 3376 } 3377 EVP_MD_CTX_free(ukm_hash); 3378 ukm_hash = NULL; 3379 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, 3380 EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) 3381 <= 0) { 3382 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG); 3383 goto err; 3384 } 3385 /* Make GOST keytransport blob message */ 3386 /* 3387 * Encapsulate it into sequence 3388 */ 3389 msglen = 255; 3390 if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, pms, pmslen) <= 0) { 3391 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG); 3392 goto err; 3393 } 3394 3395 if (!WPACKET_put_bytes_u8(pkt, V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED) 3396 || (msglen >= 0x80 && !WPACKET_put_bytes_u8(pkt, 0x81)) 3397 || !WPACKET_sub_memcpy_u8(pkt, tmp, msglen)) { 3398 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3399 goto err; 3400 } 3401 3402 EVP_PKEY_CTX_free(pkey_ctx); 3403 s->s3.tmp.pms = pms; 3404 s->s3.tmp.pmslen = pmslen; 3405 3406 return 1; 3407 err: 3408 EVP_PKEY_CTX_free(pkey_ctx); 3409 OPENSSL_clear_free(pms, pmslen); 3410 EVP_MD_CTX_free(ukm_hash); 3411 return 0; 3412 #else 3413 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3414 return 0; 3415 #endif 3416 } 3417 3418 #ifndef OPENSSL_NO_GOST 3419 int ossl_gost18_cke_cipher_nid(const SSL_CONNECTION *s) 3420 { 3421 if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_MAGMA) != 0) 3422 return NID_magma_ctr; 3423 else if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_KUZNYECHIK) != 0) 3424 return NID_kuznyechik_ctr; 3425 3426 return NID_undef; 3427 } 3428 3429 int ossl_gost_ukm(const SSL_CONNECTION *s, unsigned char *dgst_buf) 3430 { 3431 EVP_MD_CTX *hash = NULL; 3432 unsigned int md_len; 3433 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 3434 const EVP_MD *md = ssl_evp_md_fetch(sctx->libctx, NID_id_GostR3411_2012_256, 3435 sctx->propq); 3436 3437 if (md == NULL) 3438 return 0; 3439 3440 if ((hash = EVP_MD_CTX_new()) == NULL 3441 || EVP_DigestInit(hash, md) <= 0 3442 || EVP_DigestUpdate(hash, s->s3.client_random, SSL3_RANDOM_SIZE) <= 0 3443 || EVP_DigestUpdate(hash, s->s3.server_random, SSL3_RANDOM_SIZE) <= 0 3444 || EVP_DigestFinal_ex(hash, dgst_buf, &md_len) <= 0) { 3445 EVP_MD_CTX_free(hash); 3446 ssl_evp_md_free(md); 3447 return 0; 3448 } 3449 3450 EVP_MD_CTX_free(hash); 3451 ssl_evp_md_free(md); 3452 return 1; 3453 } 3454 #endif 3455 3456 static int tls_construct_cke_gost18(SSL_CONNECTION *s, WPACKET *pkt) 3457 { 3458 #ifndef OPENSSL_NO_GOST 3459 /* GOST 2018 key exchange message creation */ 3460 unsigned char rnd_dgst[32]; 3461 unsigned char *encdata = NULL; 3462 EVP_PKEY_CTX *pkey_ctx = NULL; 3463 EVP_PKEY *pkey; 3464 unsigned char *pms = NULL; 3465 size_t pmslen = 0; 3466 size_t msglen; 3467 int cipher_nid = ossl_gost18_cke_cipher_nid(s); 3468 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 3469 3470 if (cipher_nid == NID_undef) { 3471 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3472 return 0; 3473 } 3474 3475 if (ossl_gost_ukm(s, rnd_dgst) <= 0) { 3476 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3477 goto err; 3478 } 3479 3480 /* Pre-master secret - random bytes */ 3481 pmslen = 32; 3482 pms = OPENSSL_malloc(pmslen); 3483 if (pms == NULL) { 3484 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 3485 goto err; 3486 } 3487 3488 if (RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) { 3489 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3490 goto err; 3491 } 3492 3493 /* Get server certificate PKEY and create ctx from it */ 3494 if ((pkey = tls_get_peer_pkey(s)) == NULL) { 3495 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 3496 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); 3497 goto err; 3498 } 3499 3500 pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, 3501 pkey, 3502 sctx->propq); 3503 if (pkey_ctx == NULL) { 3504 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 3505 goto err; 3506 } 3507 3508 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0) { 3509 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3510 goto err; 3511 }; 3512 3513 /* Reuse EVP_PKEY_CTRL_SET_IV, make choice in engine code */ 3514 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, 3515 EVP_PKEY_CTRL_SET_IV, 32, rnd_dgst) 3516 <= 0) { 3517 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG); 3518 goto err; 3519 } 3520 3521 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, 3522 EVP_PKEY_CTRL_CIPHER, cipher_nid, NULL) 3523 <= 0) { 3524 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG); 3525 goto err; 3526 } 3527 3528 if (EVP_PKEY_encrypt(pkey_ctx, NULL, &msglen, pms, pmslen) <= 0) { 3529 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 3530 goto err; 3531 } 3532 3533 if (!WPACKET_allocate_bytes(pkt, msglen, &encdata) 3534 || EVP_PKEY_encrypt(pkey_ctx, encdata, &msglen, pms, pmslen) <= 0) { 3535 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); 3536 goto err; 3537 } 3538 3539 EVP_PKEY_CTX_free(pkey_ctx); 3540 pkey_ctx = NULL; 3541 s->s3.tmp.pms = pms; 3542 s->s3.tmp.pmslen = pmslen; 3543 3544 return 1; 3545 err: 3546 EVP_PKEY_CTX_free(pkey_ctx); 3547 OPENSSL_clear_free(pms, pmslen); 3548 return 0; 3549 #else 3550 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3551 return 0; 3552 #endif 3553 } 3554 3555 static int tls_construct_cke_srp(SSL_CONNECTION *s, WPACKET *pkt) 3556 { 3557 #ifndef OPENSSL_NO_SRP 3558 unsigned char *abytes = NULL; 3559 3560 if (s->srp_ctx.A == NULL 3561 || !WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(s->srp_ctx.A), 3562 &abytes)) { 3563 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3564 return 0; 3565 } 3566 BN_bn2bin(s->srp_ctx.A, abytes); 3567 3568 OPENSSL_free(s->session->srp_username); 3569 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login); 3570 if (s->session->srp_username == NULL) { 3571 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 3572 return 0; 3573 } 3574 3575 return 1; 3576 #else 3577 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3578 return 0; 3579 #endif 3580 } 3581 3582 CON_FUNC_RETURN tls_construct_client_key_exchange(SSL_CONNECTION *s, 3583 WPACKET *pkt) 3584 { 3585 unsigned long alg_k; 3586 3587 alg_k = s->s3.tmp.new_cipher->algorithm_mkey; 3588 3589 /* 3590 * All of the construct functions below call SSLfatal() if necessary so 3591 * no need to do so here. 3592 */ 3593 if ((alg_k & SSL_PSK) 3594 && !tls_construct_cke_psk_preamble(s, pkt)) 3595 goto err; 3596 3597 if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) { 3598 if (!tls_construct_cke_rsa(s, pkt)) 3599 goto err; 3600 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { 3601 if (!tls_construct_cke_dhe(s, pkt)) 3602 goto err; 3603 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { 3604 if (!tls_construct_cke_ecdhe(s, pkt)) 3605 goto err; 3606 } else if (alg_k & SSL_kGOST) { 3607 if (!tls_construct_cke_gost(s, pkt)) 3608 goto err; 3609 } else if (alg_k & SSL_kGOST18) { 3610 if (!tls_construct_cke_gost18(s, pkt)) 3611 goto err; 3612 } else if (alg_k & SSL_kSRP) { 3613 if (!tls_construct_cke_srp(s, pkt)) 3614 goto err; 3615 } else if (!(alg_k & SSL_kPSK)) { 3616 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3617 goto err; 3618 } 3619 3620 return CON_FUNC_SUCCESS; 3621 err: 3622 OPENSSL_clear_free(s->s3.tmp.pms, s->s3.tmp.pmslen); 3623 s->s3.tmp.pms = NULL; 3624 s->s3.tmp.pmslen = 0; 3625 #ifndef OPENSSL_NO_PSK 3626 OPENSSL_clear_free(s->s3.tmp.psk, s->s3.tmp.psklen); 3627 s->s3.tmp.psk = NULL; 3628 s->s3.tmp.psklen = 0; 3629 #endif 3630 return CON_FUNC_ERROR; 3631 } 3632 3633 int tls_client_key_exchange_post_work(SSL_CONNECTION *s) 3634 { 3635 unsigned char *pms = NULL; 3636 size_t pmslen = 0; 3637 3638 pms = s->s3.tmp.pms; 3639 pmslen = s->s3.tmp.pmslen; 3640 3641 #ifndef OPENSSL_NO_SRP 3642 /* Check for SRP */ 3643 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kSRP) { 3644 if (!srp_generate_client_master_secret(s)) { 3645 /* SSLfatal() already called */ 3646 goto err; 3647 } 3648 return 1; 3649 } 3650 #endif 3651 3652 if (pms == NULL && !(s->s3.tmp.new_cipher->algorithm_mkey & SSL_kPSK)) { 3653 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_PASSED_INVALID_ARGUMENT); 3654 goto err; 3655 } 3656 if (!ssl_generate_master_secret(s, pms, pmslen, 1)) { 3657 /* SSLfatal() already called */ 3658 /* ssl_generate_master_secret frees the pms even on error */ 3659 pms = NULL; 3660 pmslen = 0; 3661 goto err; 3662 } 3663 pms = NULL; 3664 pmslen = 0; 3665 3666 #ifndef OPENSSL_NO_SCTP 3667 if (SSL_CONNECTION_IS_DTLS(s)) { 3668 unsigned char sctpauthkey[64]; 3669 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; 3670 size_t labellen; 3671 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 3672 3673 /* 3674 * Add new shared key for SCTP-Auth, will be ignored if no SCTP 3675 * used. 3676 */ 3677 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, 3678 sizeof(DTLS1_SCTP_AUTH_LABEL)); 3679 3680 /* Don't include the terminating zero. */ 3681 labellen = sizeof(labelbuffer) - 1; 3682 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) 3683 labellen += 1; 3684 3685 if (SSL_export_keying_material(ssl, sctpauthkey, 3686 sizeof(sctpauthkey), labelbuffer, 3687 labellen, NULL, 0, 0) 3688 <= 0) { 3689 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3690 goto err; 3691 } 3692 3693 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, 3694 sizeof(sctpauthkey), sctpauthkey); 3695 } 3696 #endif 3697 3698 return 1; 3699 err: 3700 OPENSSL_clear_free(pms, pmslen); 3701 s->s3.tmp.pms = NULL; 3702 s->s3.tmp.pmslen = 0; 3703 return 0; 3704 } 3705 3706 /* 3707 * Check a certificate can be used for client authentication. Currently check 3708 * cert exists, if we have a suitable digest for TLS 1.2 if static DH client 3709 * certificates can be used and optionally checks suitability for Suite B. 3710 */ 3711 static int ssl3_check_client_certificate(SSL_CONNECTION *s) 3712 { 3713 /* If no suitable signature algorithm can't use certificate */ 3714 if (!tls_choose_sigalg(s, 0) || s->s3.tmp.sigalg == NULL) 3715 return 0; 3716 /* 3717 * If strict mode check suitability of chain before using it. This also 3718 * adjusts suite B digest if necessary. 3719 */ 3720 if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT && !tls1_check_chain(s, NULL, NULL, NULL, -2)) 3721 return 0; 3722 return 1; 3723 } 3724 3725 WORK_STATE tls_prepare_client_certificate(SSL_CONNECTION *s, WORK_STATE wst) 3726 { 3727 X509 *x509 = NULL; 3728 EVP_PKEY *pkey = NULL; 3729 int i; 3730 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 3731 3732 if (wst == WORK_MORE_A) { 3733 /* Let cert callback update client certificates if required */ 3734 if (s->cert->cert_cb) { 3735 i = s->cert->cert_cb(ssl, s->cert->cert_cb_arg); 3736 if (i < 0) { 3737 s->rwstate = SSL_X509_LOOKUP; 3738 return WORK_MORE_A; 3739 } 3740 if (i == 0) { 3741 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_CALLBACK_FAILED); 3742 return WORK_ERROR; 3743 } 3744 s->rwstate = SSL_NOTHING; 3745 } 3746 if (ssl3_check_client_certificate(s)) { 3747 if (s->post_handshake_auth == SSL_PHA_REQUESTED) { 3748 return WORK_FINISHED_STOP; 3749 } 3750 return WORK_FINISHED_CONTINUE; 3751 } 3752 3753 /* Fall through to WORK_MORE_B */ 3754 wst = WORK_MORE_B; 3755 } 3756 3757 /* We need to get a client cert */ 3758 if (wst == WORK_MORE_B) { 3759 /* 3760 * If we get an error, we need to ssl->rwstate=SSL_X509_LOOKUP; 3761 * return(-1); We then get retied later 3762 */ 3763 i = ssl_do_client_cert_cb(s, &x509, &pkey); 3764 if (i < 0) { 3765 s->rwstate = SSL_X509_LOOKUP; 3766 return WORK_MORE_B; 3767 } 3768 s->rwstate = SSL_NOTHING; 3769 if ((i == 1) && (pkey != NULL) && (x509 != NULL)) { 3770 if (!SSL_use_certificate(ssl, x509) 3771 || !SSL_use_PrivateKey(ssl, pkey)) 3772 i = 0; 3773 } else if (i == 1) { 3774 i = 0; 3775 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); 3776 } 3777 3778 X509_free(x509); 3779 EVP_PKEY_free(pkey); 3780 if (i && !ssl3_check_client_certificate(s)) 3781 i = 0; 3782 if (i == 0) { 3783 if (s->version == SSL3_VERSION) { 3784 s->s3.tmp.cert_req = 0; 3785 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE); 3786 return WORK_FINISHED_CONTINUE; 3787 } else { 3788 s->s3.tmp.cert_req = 2; 3789 s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none; 3790 if (!ssl3_digest_cached_records(s, 0)) { 3791 /* SSLfatal() already called */ 3792 return WORK_ERROR; 3793 } 3794 } 3795 } 3796 3797 if (!SSL_CONNECTION_IS_TLS13(s) 3798 || (s->options & SSL_OP_NO_TX_CERTIFICATE_COMPRESSION) != 0) 3799 s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none; 3800 3801 if (s->post_handshake_auth == SSL_PHA_REQUESTED) 3802 return WORK_FINISHED_STOP; 3803 return WORK_FINISHED_CONTINUE; 3804 } 3805 3806 /* Shouldn't ever get here */ 3807 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3808 return WORK_ERROR; 3809 } 3810 3811 CON_FUNC_RETURN tls_construct_client_certificate(SSL_CONNECTION *s, 3812 WPACKET *pkt) 3813 { 3814 CERT_PKEY *cpk = NULL; 3815 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 3816 3817 if (SSL_CONNECTION_IS_TLS13(s)) { 3818 if (s->pha_context == NULL) { 3819 /* no context available, add 0-length context */ 3820 if (!WPACKET_put_bytes_u8(pkt, 0)) { 3821 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3822 return CON_FUNC_ERROR; 3823 } 3824 } else if (!WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) { 3825 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3826 return CON_FUNC_ERROR; 3827 } 3828 } 3829 if (s->s3.tmp.cert_req != 2) 3830 cpk = s->cert->key; 3831 switch (s->ext.client_cert_type) { 3832 case TLSEXT_cert_type_rpk: 3833 if (!tls_output_rpk(s, pkt, cpk)) { 3834 /* SSLfatal() already called */ 3835 return CON_FUNC_ERROR; 3836 } 3837 break; 3838 case TLSEXT_cert_type_x509: 3839 if (!ssl3_output_cert_chain(s, pkt, cpk, 0)) { 3840 /* SSLfatal() already called */ 3841 return CON_FUNC_ERROR; 3842 } 3843 break; 3844 default: 3845 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3846 return CON_FUNC_ERROR; 3847 } 3848 3849 /* 3850 * If we attempted to write early data or we're in middlebox compat mode 3851 * then we deferred changing the handshake write keys to the last possible 3852 * moment. We need to do it now. 3853 */ 3854 if (SSL_CONNECTION_IS_TLS13(s) 3855 && !SSL_IS_QUIC_HANDSHAKE(s) 3856 && SSL_IS_FIRST_HANDSHAKE(s) 3857 && (s->early_data_state != SSL_EARLY_DATA_NONE 3858 || (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) 3859 && (!ssl->method->ssl3_enc->change_cipher_state(s, 3860 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) { 3861 /* 3862 * This is a fatal error, which leaves enc_write_ctx in an inconsistent 3863 * state and thus ssl3_send_alert may crash. 3864 */ 3865 SSLfatal(s, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER); 3866 return CON_FUNC_ERROR; 3867 } 3868 3869 return CON_FUNC_SUCCESS; 3870 } 3871 3872 #ifndef OPENSSL_NO_COMP_ALG 3873 CON_FUNC_RETURN tls_construct_client_compressed_certificate(SSL_CONNECTION *sc, 3874 WPACKET *pkt) 3875 { 3876 SSL *ssl = SSL_CONNECTION_GET_SSL(sc); 3877 WPACKET tmppkt; 3878 BUF_MEM *buf = NULL; 3879 size_t length; 3880 size_t max_length; 3881 COMP_METHOD *method; 3882 COMP_CTX *comp = NULL; 3883 int comp_len; 3884 int ret = 0; 3885 int alg = sc->ext.compress_certificate_from_peer[0]; 3886 3887 /* Note that sc->s3.tmp.cert_req == 2 is checked in write transition */ 3888 3889 if ((buf = BUF_MEM_new()) == NULL || !WPACKET_init(&tmppkt, buf)) 3890 goto err; 3891 3892 /* Use the |tmppkt| for the to-be-compressed data */ 3893 if (sc->pha_context == NULL) { 3894 /* no context available, add 0-length context */ 3895 if (!WPACKET_put_bytes_u8(&tmppkt, 0)) 3896 goto err; 3897 } else if (!WPACKET_sub_memcpy_u8(&tmppkt, sc->pha_context, sc->pha_context_len)) 3898 goto err; 3899 3900 if (!ssl3_output_cert_chain(sc, &tmppkt, sc->cert->key, 0)) { 3901 /* SSLfatal() already called */ 3902 goto out; 3903 } 3904 3905 /* continue with the real |pkt| */ 3906 if (!WPACKET_put_bytes_u16(pkt, alg) 3907 || !WPACKET_get_total_written(&tmppkt, &length) 3908 || !WPACKET_put_bytes_u24(pkt, length)) 3909 goto err; 3910 3911 switch (alg) { 3912 case TLSEXT_comp_cert_zlib: 3913 method = COMP_zlib_oneshot(); 3914 break; 3915 case TLSEXT_comp_cert_brotli: 3916 method = COMP_brotli_oneshot(); 3917 break; 3918 case TLSEXT_comp_cert_zstd: 3919 method = COMP_zstd_oneshot(); 3920 break; 3921 default: 3922 goto err; 3923 } 3924 max_length = ossl_calculate_comp_expansion(alg, length); 3925 3926 if ((comp = COMP_CTX_new(method)) == NULL 3927 || !WPACKET_start_sub_packet_u24(pkt) 3928 || !WPACKET_reserve_bytes(pkt, max_length, NULL)) 3929 goto err; 3930 3931 comp_len = COMP_compress_block(comp, WPACKET_get_curr(pkt), max_length, 3932 (unsigned char *)buf->data, length); 3933 if (comp_len <= 0) 3934 goto err; 3935 3936 if (!WPACKET_allocate_bytes(pkt, comp_len, NULL) 3937 || !WPACKET_close(pkt)) 3938 goto err; 3939 3940 /* 3941 * If we attempted to write early data or we're in middlebox compat mode 3942 * then we deferred changing the handshake write keys to the last possible 3943 * moment. We need to do it now. 3944 */ 3945 if (SSL_IS_FIRST_HANDSHAKE(sc) 3946 && !SSL_IS_QUIC_HANDSHAKE(sc) 3947 && (sc->early_data_state != SSL_EARLY_DATA_NONE 3948 || (sc->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) 3949 && (!ssl->method->ssl3_enc->change_cipher_state(sc, 3950 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) { 3951 /* 3952 * This is a fatal error, which leaves sc->enc_write_ctx in an 3953 * inconsistent state and thus ssl3_send_alert may crash. 3954 */ 3955 SSLfatal(sc, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER); 3956 goto out; 3957 } 3958 ret = 1; 3959 goto out; 3960 3961 err: 3962 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 3963 out: 3964 if (buf != NULL) { 3965 /* If |buf| is NULL, then |tmppkt| could not have been initialized */ 3966 WPACKET_cleanup(&tmppkt); 3967 } 3968 BUF_MEM_free(buf); 3969 COMP_CTX_free(comp); 3970 return ret; 3971 } 3972 #endif 3973 3974 int ssl3_check_cert_and_algorithm(SSL_CONNECTION *s) 3975 { 3976 const SSL_CERT_LOOKUP *clu; 3977 size_t idx; 3978 long alg_k, alg_a; 3979 EVP_PKEY *pkey; 3980 3981 alg_k = s->s3.tmp.new_cipher->algorithm_mkey; 3982 alg_a = s->s3.tmp.new_cipher->algorithm_auth; 3983 3984 /* we don't have a certificate */ 3985 if (!(alg_a & SSL_aCERT)) 3986 return 1; 3987 3988 /* This is the passed certificate */ 3989 pkey = tls_get_peer_pkey(s); 3990 clu = ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)); 3991 3992 /* Check certificate is recognised and suitable for cipher */ 3993 if (clu == NULL || (alg_a & clu->amask) == 0) { 3994 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_MISSING_SIGNING_CERT); 3995 return 0; 3996 } 3997 3998 if (alg_k & (SSL_kRSA | SSL_kRSAPSK) && idx != SSL_PKEY_RSA) { 3999 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 4000 SSL_R_MISSING_RSA_ENCRYPTING_CERT); 4001 return 0; 4002 } 4003 4004 if ((alg_k & SSL_kDHE) && (s->s3.peer_tmp == NULL)) { 4005 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 4006 return 0; 4007 } 4008 4009 /* Early out to skip the checks below */ 4010 if (s->session->peer_rpk != NULL) 4011 return 1; 4012 4013 if (clu->amask & SSL_aECDSA) { 4014 if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s)) 4015 return 1; 4016 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_ECC_CERT); 4017 return 0; 4018 } 4019 4020 return 1; 4021 } 4022 4023 #ifndef OPENSSL_NO_NEXTPROTONEG 4024 CON_FUNC_RETURN tls_construct_next_proto(SSL_CONNECTION *s, WPACKET *pkt) 4025 { 4026 size_t len, padding_len; 4027 unsigned char *padding = NULL; 4028 4029 len = s->ext.npn_len; 4030 padding_len = 32 - ((len + 2) % 32); 4031 4032 if (!WPACKET_sub_memcpy_u8(pkt, s->ext.npn, len) 4033 || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) { 4034 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 4035 return CON_FUNC_ERROR; 4036 } 4037 4038 memset(padding, 0, padding_len); 4039 4040 return CON_FUNC_SUCCESS; 4041 } 4042 #endif 4043 4044 MSG_PROCESS_RETURN tls_process_hello_req(SSL_CONNECTION *s, PACKET *pkt) 4045 { 4046 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 4047 4048 if (PACKET_remaining(pkt) > 0) { 4049 /* should contain no data */ 4050 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 4051 return MSG_PROCESS_ERROR; 4052 } 4053 4054 if ((s->options & SSL_OP_NO_RENEGOTIATION)) { 4055 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION); 4056 return MSG_PROCESS_FINISHED_READING; 4057 } 4058 4059 /* 4060 * This is a historical discrepancy (not in the RFC) maintained for 4061 * compatibility reasons. If a TLS client receives a HelloRequest it will 4062 * attempt an abbreviated handshake. However if a DTLS client receives a 4063 * HelloRequest it will do a full handshake. Either behaviour is reasonable 4064 * but doing one for TLS and another for DTLS is odd. 4065 */ 4066 if (SSL_CONNECTION_IS_DTLS(s)) 4067 SSL_renegotiate(ssl); 4068 else 4069 SSL_renegotiate_abbreviated(ssl); 4070 4071 return MSG_PROCESS_FINISHED_READING; 4072 } 4073 4074 static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s, 4075 PACKET *pkt) 4076 { 4077 PACKET extensions; 4078 RAW_EXTENSION *rawexts = NULL; 4079 4080 if (!PACKET_as_length_prefixed_2(pkt, &extensions) 4081 || PACKET_remaining(pkt) != 0) { 4082 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); 4083 goto err; 4084 } 4085 4086 if (!tls_collect_extensions(s, &extensions, 4087 SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, &rawexts, 4088 NULL, 1) 4089 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, 4090 rawexts, NULL, 0, 1)) { 4091 /* SSLfatal() already called */ 4092 goto err; 4093 } 4094 4095 OPENSSL_free(rawexts); 4096 return MSG_PROCESS_CONTINUE_READING; 4097 4098 err: 4099 OPENSSL_free(rawexts); 4100 return MSG_PROCESS_ERROR; 4101 } 4102 4103 int ssl_do_client_cert_cb(SSL_CONNECTION *s, X509 **px509, EVP_PKEY **ppkey) 4104 { 4105 int i = 0; 4106 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 4107 4108 #ifndef OPENSSL_NO_ENGINE 4109 if (sctx->client_cert_engine) { 4110 i = tls_engine_load_ssl_client_cert(s, px509, ppkey); 4111 if (i != 0) 4112 return i; 4113 } 4114 #endif 4115 if (sctx->client_cert_cb) 4116 i = sctx->client_cert_cb(SSL_CONNECTION_GET_USER_SSL(s), px509, ppkey); 4117 return i; 4118 } 4119 4120 int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk, 4121 WPACKET *pkt) 4122 { 4123 int i; 4124 size_t totlen = 0, len, maxlen, maxverok = 0; 4125 int empty_reneg_info_scsv = !s->renegotiate 4126 && !SSL_CONNECTION_IS_DTLS(s) 4127 && ssl_security(s, SSL_SECOP_VERSION, 0, TLS1_VERSION, NULL) 4128 && s->min_proto_version <= TLS1_VERSION; 4129 SSL *ssl = SSL_CONNECTION_GET_SSL(s); 4130 4131 /* Set disabled masks for this session */ 4132 if (!ssl_set_client_disabled(s)) { 4133 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_PROTOCOLS_AVAILABLE); 4134 return 0; 4135 } 4136 4137 if (sk == NULL) { 4138 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 4139 return 0; 4140 } 4141 4142 #ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH 4143 #if OPENSSL_MAX_TLS1_2_CIPHER_LENGTH < 6 4144 #error Max cipher length too short 4145 #endif 4146 /* 4147 * Some servers hang if client hello > 256 bytes as hack workaround 4148 * chop number of supported ciphers to keep it well below this if we 4149 * use TLS v1.2 4150 */ 4151 if (TLS1_get_version(ssl) >= TLS1_2_VERSION) 4152 maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1; 4153 else 4154 #endif 4155 /* Maximum length that can be stored in 2 bytes. Length must be even */ 4156 maxlen = 0xfffe; 4157 4158 if (empty_reneg_info_scsv) 4159 maxlen -= 2; 4160 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) 4161 maxlen -= 2; 4162 4163 for (i = 0; i < sk_SSL_CIPHER_num(sk) && totlen < maxlen; i++) { 4164 const SSL_CIPHER *c; 4165 4166 c = sk_SSL_CIPHER_value(sk, i); 4167 /* Skip disabled ciphers */ 4168 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) 4169 continue; 4170 4171 if (!ssl->method->put_cipher_by_char(c, pkt, &len)) { 4172 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 4173 return 0; 4174 } 4175 4176 /* Sanity check that the maximum version we offer has ciphers enabled */ 4177 if (!maxverok) { 4178 int minproto = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls; 4179 int maxproto = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls; 4180 4181 if (ssl_version_cmp(s, maxproto, s->s3.tmp.max_ver) >= 0 4182 && ssl_version_cmp(s, minproto, s->s3.tmp.max_ver) <= 0) 4183 maxverok = 1; 4184 } 4185 4186 totlen += len; 4187 } 4188 4189 if (totlen == 0 || !maxverok) { 4190 const char *maxvertext = !maxverok 4191 ? "No ciphers enabled for max supported SSL/TLS version" 4192 : NULL; 4193 4194 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_CIPHERS_AVAILABLE, 4195 maxvertext); 4196 return 0; 4197 } 4198 4199 if (totlen != 0) { 4200 if (empty_reneg_info_scsv) { 4201 static const SSL_CIPHER scsv = { 4202 0, NULL, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 4203 }; 4204 if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) { 4205 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 4206 return 0; 4207 } 4208 } 4209 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) { 4210 static const SSL_CIPHER scsv = { 4211 0, NULL, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 4212 }; 4213 if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) { 4214 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 4215 return 0; 4216 } 4217 } 4218 } 4219 4220 return 1; 4221 } 4222 4223 CON_FUNC_RETURN tls_construct_end_of_early_data(SSL_CONNECTION *s, WPACKET *pkt) 4224 { 4225 if (s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 4226 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) { 4227 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 4228 return CON_FUNC_ERROR; 4229 } 4230 4231 s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING; 4232 return CON_FUNC_SUCCESS; 4233 } 4234