1 /* 2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright 2005 Nokia. All rights reserved. 4 * 5 * Licensed under the OpenSSL license (the "License"). You may not use 6 * this file except in compliance with the License. You can obtain a copy 7 * in the file LICENSE in the source distribution or at 8 * https://www.openssl.org/source/license.html 9 */ 10 11 #include <stdio.h> 12 #include "ssl_locl.h" 13 #include <openssl/comp.h> 14 #include <openssl/evp.h> 15 #include <openssl/kdf.h> 16 #include <openssl/rand.h> 17 18 /* seed1 through seed5 are concatenated */ 19 static int tls1_PRF(SSL *s, 20 const void *seed1, size_t seed1_len, 21 const void *seed2, size_t seed2_len, 22 const void *seed3, size_t seed3_len, 23 const void *seed4, size_t seed4_len, 24 const void *seed5, size_t seed5_len, 25 const unsigned char *sec, size_t slen, 26 unsigned char *out, size_t olen, int fatal) 27 { 28 const EVP_MD *md = ssl_prf_md(s); 29 EVP_PKEY_CTX *pctx = NULL; 30 int ret = 0; 31 32 if (md == NULL) { 33 /* Should never happen */ 34 if (fatal) 35 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, 36 ERR_R_INTERNAL_ERROR); 37 else 38 SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); 39 return 0; 40 } 41 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); 42 if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0 43 || EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) <= 0 44 || EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, (int)slen) <= 0 45 || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, (int)seed1_len) <= 0 46 || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, (int)seed2_len) <= 0 47 || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, (int)seed3_len) <= 0 48 || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed4, (int)seed4_len) <= 0 49 || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed5, (int)seed5_len) <= 0 50 || EVP_PKEY_derive(pctx, out, &olen) <= 0) { 51 if (fatal) 52 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, 53 ERR_R_INTERNAL_ERROR); 54 else 55 SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); 56 goto err; 57 } 58 59 ret = 1; 60 61 err: 62 EVP_PKEY_CTX_free(pctx); 63 return ret; 64 } 65 66 static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) 67 { 68 int ret; 69 70 /* Calls SSLfatal() as required */ 71 ret = tls1_PRF(s, 72 TLS_MD_KEY_EXPANSION_CONST, 73 TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3->server_random, 74 SSL3_RANDOM_SIZE, s->s3->client_random, SSL3_RANDOM_SIZE, 75 NULL, 0, NULL, 0, s->session->master_key, 76 s->session->master_key_length, km, num, 1); 77 78 return ret; 79 } 80 81 int tls1_change_cipher_state(SSL *s, int which) 82 { 83 unsigned char *p, *mac_secret; 84 unsigned char tmp1[EVP_MAX_KEY_LENGTH]; 85 unsigned char tmp2[EVP_MAX_KEY_LENGTH]; 86 unsigned char iv1[EVP_MAX_IV_LENGTH * 2]; 87 unsigned char iv2[EVP_MAX_IV_LENGTH * 2]; 88 unsigned char *ms, *key, *iv; 89 EVP_CIPHER_CTX *dd; 90 const EVP_CIPHER *c; 91 #ifndef OPENSSL_NO_COMP 92 const SSL_COMP *comp; 93 #endif 94 const EVP_MD *m; 95 int mac_type; 96 size_t *mac_secret_size; 97 EVP_MD_CTX *mac_ctx; 98 EVP_PKEY *mac_key; 99 size_t n, i, j, k, cl; 100 int reuse_dd = 0; 101 102 c = s->s3->tmp.new_sym_enc; 103 m = s->s3->tmp.new_hash; 104 mac_type = s->s3->tmp.new_mac_pkey_type; 105 #ifndef OPENSSL_NO_COMP 106 comp = s->s3->tmp.new_compression; 107 #endif 108 109 if (which & SSL3_CC_READ) { 110 if (s->ext.use_etm) 111 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; 112 else 113 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; 114 115 if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) 116 s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; 117 else 118 s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; 119 120 if (s->enc_read_ctx != NULL) { 121 reuse_dd = 1; 122 } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) { 123 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 124 ERR_R_MALLOC_FAILURE); 125 goto err; 126 } else { 127 /* 128 * make sure it's initialised in case we exit later with an error 129 */ 130 EVP_CIPHER_CTX_reset(s->enc_read_ctx); 131 } 132 dd = s->enc_read_ctx; 133 mac_ctx = ssl_replace_hash(&s->read_hash, NULL); 134 if (mac_ctx == NULL) 135 goto err; 136 #ifndef OPENSSL_NO_COMP 137 COMP_CTX_free(s->expand); 138 s->expand = NULL; 139 if (comp != NULL) { 140 s->expand = COMP_CTX_new(comp->method); 141 if (s->expand == NULL) { 142 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 143 SSL_F_TLS1_CHANGE_CIPHER_STATE, 144 SSL_R_COMPRESSION_LIBRARY_ERROR); 145 goto err; 146 } 147 } 148 #endif 149 /* 150 * this is done by dtls1_reset_seq_numbers for DTLS 151 */ 152 if (!SSL_IS_DTLS(s)) 153 RECORD_LAYER_reset_read_sequence(&s->rlayer); 154 mac_secret = &(s->s3->read_mac_secret[0]); 155 mac_secret_size = &(s->s3->read_mac_secret_size); 156 } else { 157 s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; 158 if (s->ext.use_etm) 159 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; 160 else 161 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; 162 163 if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) 164 s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; 165 else 166 s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; 167 if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) { 168 reuse_dd = 1; 169 } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { 170 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 171 ERR_R_MALLOC_FAILURE); 172 goto err; 173 } 174 dd = s->enc_write_ctx; 175 if (SSL_IS_DTLS(s)) { 176 mac_ctx = EVP_MD_CTX_new(); 177 if (mac_ctx == NULL) { 178 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 179 SSL_F_TLS1_CHANGE_CIPHER_STATE, 180 ERR_R_MALLOC_FAILURE); 181 goto err; 182 } 183 s->write_hash = mac_ctx; 184 } else { 185 mac_ctx = ssl_replace_hash(&s->write_hash, NULL); 186 if (mac_ctx == NULL) { 187 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 188 SSL_F_TLS1_CHANGE_CIPHER_STATE, 189 ERR_R_MALLOC_FAILURE); 190 goto err; 191 } 192 } 193 #ifndef OPENSSL_NO_COMP 194 COMP_CTX_free(s->compress); 195 s->compress = NULL; 196 if (comp != NULL) { 197 s->compress = COMP_CTX_new(comp->method); 198 if (s->compress == NULL) { 199 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 200 SSL_F_TLS1_CHANGE_CIPHER_STATE, 201 SSL_R_COMPRESSION_LIBRARY_ERROR); 202 goto err; 203 } 204 } 205 #endif 206 /* 207 * this is done by dtls1_reset_seq_numbers for DTLS 208 */ 209 if (!SSL_IS_DTLS(s)) 210 RECORD_LAYER_reset_write_sequence(&s->rlayer); 211 mac_secret = &(s->s3->write_mac_secret[0]); 212 mac_secret_size = &(s->s3->write_mac_secret_size); 213 } 214 215 if (reuse_dd) 216 EVP_CIPHER_CTX_reset(dd); 217 218 p = s->s3->tmp.key_block; 219 i = *mac_secret_size = s->s3->tmp.new_mac_secret_size; 220 221 /* TODO(size_t): convert me */ 222 cl = EVP_CIPHER_key_length(c); 223 j = cl; 224 /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ 225 /* If GCM/CCM mode only part of IV comes from PRF */ 226 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) 227 k = EVP_GCM_TLS_FIXED_IV_LEN; 228 else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) 229 k = EVP_CCM_TLS_FIXED_IV_LEN; 230 else 231 k = EVP_CIPHER_iv_length(c); 232 if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || 233 (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { 234 ms = &(p[0]); 235 n = i + i; 236 key = &(p[n]); 237 n += j + j; 238 iv = &(p[n]); 239 n += k + k; 240 } else { 241 n = i; 242 ms = &(p[n]); 243 n += i + j; 244 key = &(p[n]); 245 n += j + k; 246 iv = &(p[n]); 247 n += k; 248 } 249 250 if (n > s->s3->tmp.key_block_length) { 251 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 252 ERR_R_INTERNAL_ERROR); 253 goto err; 254 } 255 256 memcpy(mac_secret, ms, i); 257 258 if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { 259 /* TODO(size_t): Convert this function */ 260 mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, 261 (int)*mac_secret_size); 262 if (mac_key == NULL 263 || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) { 264 EVP_PKEY_free(mac_key); 265 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 266 ERR_R_INTERNAL_ERROR); 267 goto err; 268 } 269 EVP_PKEY_free(mac_key); 270 } 271 #ifdef SSL_DEBUG 272 printf("which = %04X\nmac key=", which); 273 { 274 size_t z; 275 for (z = 0; z < i; z++) 276 printf("%02X%c", ms[z], ((z + 1) % 16) ? ' ' : '\n'); 277 } 278 #endif 279 280 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { 281 if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) 282 || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, 283 iv)) { 284 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 285 ERR_R_INTERNAL_ERROR); 286 goto err; 287 } 288 } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { 289 int taglen; 290 if (s->s3->tmp. 291 new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) 292 taglen = EVP_CCM8_TLS_TAG_LEN; 293 else 294 taglen = EVP_CCM_TLS_TAG_LEN; 295 if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) 296 || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) 297 || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) 298 || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) 299 || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { 300 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 301 ERR_R_INTERNAL_ERROR); 302 goto err; 303 } 304 } else { 305 if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { 306 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 307 ERR_R_INTERNAL_ERROR); 308 goto err; 309 } 310 } 311 /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ 312 if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size 313 && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, 314 (int)*mac_secret_size, mac_secret)) { 315 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, 316 ERR_R_INTERNAL_ERROR); 317 goto err; 318 } 319 s->statem.enc_write_state = ENC_WRITE_STATE_VALID; 320 321 #ifdef SSL_DEBUG 322 printf("which = %04X\nkey=", which); 323 { 324 int z; 325 for (z = 0; z < EVP_CIPHER_key_length(c); z++) 326 printf("%02X%c", key[z], ((z + 1) % 16) ? ' ' : '\n'); 327 } 328 printf("\niv="); 329 { 330 size_t z; 331 for (z = 0; z < k; z++) 332 printf("%02X%c", iv[z], ((z + 1) % 16) ? ' ' : '\n'); 333 } 334 printf("\n"); 335 #endif 336 337 OPENSSL_cleanse(tmp1, sizeof(tmp1)); 338 OPENSSL_cleanse(tmp2, sizeof(tmp1)); 339 OPENSSL_cleanse(iv1, sizeof(iv1)); 340 OPENSSL_cleanse(iv2, sizeof(iv2)); 341 return 1; 342 err: 343 OPENSSL_cleanse(tmp1, sizeof(tmp1)); 344 OPENSSL_cleanse(tmp2, sizeof(tmp1)); 345 OPENSSL_cleanse(iv1, sizeof(iv1)); 346 OPENSSL_cleanse(iv2, sizeof(iv2)); 347 return 0; 348 } 349 350 int tls1_setup_key_block(SSL *s) 351 { 352 unsigned char *p; 353 const EVP_CIPHER *c; 354 const EVP_MD *hash; 355 SSL_COMP *comp; 356 int mac_type = NID_undef; 357 size_t num, mac_secret_size = 0; 358 int ret = 0; 359 360 if (s->s3->tmp.key_block_length != 0) 361 return 1; 362 363 if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, 364 &comp, s->ext.use_etm)) { 365 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, 366 SSL_R_CIPHER_OR_HASH_UNAVAILABLE); 367 return 0; 368 } 369 370 s->s3->tmp.new_sym_enc = c; 371 s->s3->tmp.new_hash = hash; 372 s->s3->tmp.new_mac_pkey_type = mac_type; 373 s->s3->tmp.new_mac_secret_size = mac_secret_size; 374 num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c); 375 num *= 2; 376 377 ssl3_cleanup_key_block(s); 378 379 if ((p = OPENSSL_malloc(num)) == NULL) { 380 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, 381 ERR_R_MALLOC_FAILURE); 382 goto err; 383 } 384 385 s->s3->tmp.key_block_length = num; 386 s->s3->tmp.key_block = p; 387 388 #ifdef SSL_DEBUG 389 printf("client random\n"); 390 { 391 int z; 392 for (z = 0; z < SSL3_RANDOM_SIZE; z++) 393 printf("%02X%c", s->s3->client_random[z], 394 ((z + 1) % 16) ? ' ' : '\n'); 395 } 396 printf("server random\n"); 397 { 398 int z; 399 for (z = 0; z < SSL3_RANDOM_SIZE; z++) 400 printf("%02X%c", s->s3->server_random[z], 401 ((z + 1) % 16) ? ' ' : '\n'); 402 } 403 printf("master key\n"); 404 { 405 size_t z; 406 for (z = 0; z < s->session->master_key_length; z++) 407 printf("%02X%c", s->session->master_key[z], 408 ((z + 1) % 16) ? ' ' : '\n'); 409 } 410 #endif 411 if (!tls1_generate_key_block(s, p, num)) { 412 /* SSLfatal() already called */ 413 goto err; 414 } 415 #ifdef SSL_DEBUG 416 printf("\nkey block\n"); 417 { 418 size_t z; 419 for (z = 0; z < num; z++) 420 printf("%02X%c", p[z], ((z + 1) % 16) ? ' ' : '\n'); 421 } 422 #endif 423 424 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) 425 && s->method->version <= TLS1_VERSION) { 426 /* 427 * enable vulnerability countermeasure for CBC ciphers with known-IV 428 * problem (http://www.openssl.org/~bodo/tls-cbc.txt) 429 */ 430 s->s3->need_empty_fragments = 1; 431 432 if (s->session->cipher != NULL) { 433 if (s->session->cipher->algorithm_enc == SSL_eNULL) 434 s->s3->need_empty_fragments = 0; 435 436 #ifndef OPENSSL_NO_RC4 437 if (s->session->cipher->algorithm_enc == SSL_RC4) 438 s->s3->need_empty_fragments = 0; 439 #endif 440 } 441 } 442 443 ret = 1; 444 err: 445 return ret; 446 } 447 448 size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, 449 unsigned char *out) 450 { 451 size_t hashlen; 452 unsigned char hash[EVP_MAX_MD_SIZE]; 453 454 if (!ssl3_digest_cached_records(s, 0)) { 455 /* SSLfatal() already called */ 456 return 0; 457 } 458 459 if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { 460 /* SSLfatal() already called */ 461 return 0; 462 } 463 464 if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, 465 s->session->master_key, s->session->master_key_length, 466 out, TLS1_FINISH_MAC_LENGTH, 1)) { 467 /* SSLfatal() already called */ 468 return 0; 469 } 470 OPENSSL_cleanse(hash, hashlen); 471 return TLS1_FINISH_MAC_LENGTH; 472 } 473 474 int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 475 size_t len, size_t *secret_size) 476 { 477 if (s->session->flags & SSL_SESS_FLAG_EXTMS) { 478 unsigned char hash[EVP_MAX_MD_SIZE * 2]; 479 size_t hashlen; 480 /* 481 * Digest cached records keeping record buffer (if present): this wont 482 * affect client auth because we're freezing the buffer at the same 483 * point (after client key exchange and before certificate verify) 484 */ 485 if (!ssl3_digest_cached_records(s, 1) 486 || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { 487 /* SSLfatal() already called */ 488 return 0; 489 } 490 #ifdef SSL_DEBUG 491 fprintf(stderr, "Handshake hashes:\n"); 492 BIO_dump_fp(stderr, (char *)hash, hashlen); 493 #endif 494 if (!tls1_PRF(s, 495 TLS_MD_EXTENDED_MASTER_SECRET_CONST, 496 TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, 497 hash, hashlen, 498 NULL, 0, 499 NULL, 0, 500 NULL, 0, p, len, out, 501 SSL3_MASTER_SECRET_SIZE, 1)) { 502 /* SSLfatal() already called */ 503 return 0; 504 } 505 OPENSSL_cleanse(hash, hashlen); 506 } else { 507 if (!tls1_PRF(s, 508 TLS_MD_MASTER_SECRET_CONST, 509 TLS_MD_MASTER_SECRET_CONST_SIZE, 510 s->s3->client_random, SSL3_RANDOM_SIZE, 511 NULL, 0, 512 s->s3->server_random, SSL3_RANDOM_SIZE, 513 NULL, 0, p, len, out, 514 SSL3_MASTER_SECRET_SIZE, 1)) { 515 /* SSLfatal() already called */ 516 return 0; 517 } 518 } 519 #ifdef SSL_DEBUG 520 fprintf(stderr, "Premaster Secret:\n"); 521 BIO_dump_fp(stderr, (char *)p, len); 522 fprintf(stderr, "Client Random:\n"); 523 BIO_dump_fp(stderr, (char *)s->s3->client_random, SSL3_RANDOM_SIZE); 524 fprintf(stderr, "Server Random:\n"); 525 BIO_dump_fp(stderr, (char *)s->s3->server_random, SSL3_RANDOM_SIZE); 526 fprintf(stderr, "Master Secret:\n"); 527 BIO_dump_fp(stderr, (char *)s->session->master_key, 528 SSL3_MASTER_SECRET_SIZE); 529 #endif 530 531 *secret_size = SSL3_MASTER_SECRET_SIZE; 532 return 1; 533 } 534 535 int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, 536 const char *label, size_t llen, 537 const unsigned char *context, 538 size_t contextlen, int use_context) 539 { 540 unsigned char *val = NULL; 541 size_t vallen = 0, currentvalpos; 542 int rv; 543 544 /* 545 * construct PRF arguments we construct the PRF argument ourself rather 546 * than passing separate values into the TLS PRF to ensure that the 547 * concatenation of values does not create a prohibited label. 548 */ 549 vallen = llen + SSL3_RANDOM_SIZE * 2; 550 if (use_context) { 551 vallen += 2 + contextlen; 552 } 553 554 val = OPENSSL_malloc(vallen); 555 if (val == NULL) 556 goto err2; 557 currentvalpos = 0; 558 memcpy(val + currentvalpos, (unsigned char *)label, llen); 559 currentvalpos += llen; 560 memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE); 561 currentvalpos += SSL3_RANDOM_SIZE; 562 memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE); 563 currentvalpos += SSL3_RANDOM_SIZE; 564 565 if (use_context) { 566 val[currentvalpos] = (contextlen >> 8) & 0xff; 567 currentvalpos++; 568 val[currentvalpos] = contextlen & 0xff; 569 currentvalpos++; 570 if ((contextlen > 0) || (context != NULL)) { 571 memcpy(val + currentvalpos, context, contextlen); 572 } 573 } 574 575 /* 576 * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited 577 * label len) = 15, so size of val > max(prohibited label len) = 15 and 578 * the comparisons won't have buffer overflow 579 */ 580 if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, 581 TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) 582 goto err1; 583 if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, 584 TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) 585 goto err1; 586 if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, 587 TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) 588 goto err1; 589 if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, 590 TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) 591 goto err1; 592 if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, 593 TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) 594 goto err1; 595 596 rv = tls1_PRF(s, 597 val, vallen, 598 NULL, 0, 599 NULL, 0, 600 NULL, 0, 601 NULL, 0, 602 s->session->master_key, s->session->master_key_length, 603 out, olen, 0); 604 605 goto ret; 606 err1: 607 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); 608 rv = 0; 609 goto ret; 610 err2: 611 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); 612 rv = 0; 613 ret: 614 OPENSSL_clear_free(val, vallen); 615 return rv; 616 } 617 618 int tls1_alert_code(int code) 619 { 620 switch (code) { 621 case SSL_AD_CLOSE_NOTIFY: 622 return SSL3_AD_CLOSE_NOTIFY; 623 case SSL_AD_UNEXPECTED_MESSAGE: 624 return SSL3_AD_UNEXPECTED_MESSAGE; 625 case SSL_AD_BAD_RECORD_MAC: 626 return SSL3_AD_BAD_RECORD_MAC; 627 case SSL_AD_DECRYPTION_FAILED: 628 return TLS1_AD_DECRYPTION_FAILED; 629 case SSL_AD_RECORD_OVERFLOW: 630 return TLS1_AD_RECORD_OVERFLOW; 631 case SSL_AD_DECOMPRESSION_FAILURE: 632 return SSL3_AD_DECOMPRESSION_FAILURE; 633 case SSL_AD_HANDSHAKE_FAILURE: 634 return SSL3_AD_HANDSHAKE_FAILURE; 635 case SSL_AD_NO_CERTIFICATE: 636 return -1; 637 case SSL_AD_BAD_CERTIFICATE: 638 return SSL3_AD_BAD_CERTIFICATE; 639 case SSL_AD_UNSUPPORTED_CERTIFICATE: 640 return SSL3_AD_UNSUPPORTED_CERTIFICATE; 641 case SSL_AD_CERTIFICATE_REVOKED: 642 return SSL3_AD_CERTIFICATE_REVOKED; 643 case SSL_AD_CERTIFICATE_EXPIRED: 644 return SSL3_AD_CERTIFICATE_EXPIRED; 645 case SSL_AD_CERTIFICATE_UNKNOWN: 646 return SSL3_AD_CERTIFICATE_UNKNOWN; 647 case SSL_AD_ILLEGAL_PARAMETER: 648 return SSL3_AD_ILLEGAL_PARAMETER; 649 case SSL_AD_UNKNOWN_CA: 650 return TLS1_AD_UNKNOWN_CA; 651 case SSL_AD_ACCESS_DENIED: 652 return TLS1_AD_ACCESS_DENIED; 653 case SSL_AD_DECODE_ERROR: 654 return TLS1_AD_DECODE_ERROR; 655 case SSL_AD_DECRYPT_ERROR: 656 return TLS1_AD_DECRYPT_ERROR; 657 case SSL_AD_EXPORT_RESTRICTION: 658 return TLS1_AD_EXPORT_RESTRICTION; 659 case SSL_AD_PROTOCOL_VERSION: 660 return TLS1_AD_PROTOCOL_VERSION; 661 case SSL_AD_INSUFFICIENT_SECURITY: 662 return TLS1_AD_INSUFFICIENT_SECURITY; 663 case SSL_AD_INTERNAL_ERROR: 664 return TLS1_AD_INTERNAL_ERROR; 665 case SSL_AD_USER_CANCELLED: 666 return TLS1_AD_USER_CANCELLED; 667 case SSL_AD_NO_RENEGOTIATION: 668 return TLS1_AD_NO_RENEGOTIATION; 669 case SSL_AD_UNSUPPORTED_EXTENSION: 670 return TLS1_AD_UNSUPPORTED_EXTENSION; 671 case SSL_AD_CERTIFICATE_UNOBTAINABLE: 672 return TLS1_AD_CERTIFICATE_UNOBTAINABLE; 673 case SSL_AD_UNRECOGNIZED_NAME: 674 return TLS1_AD_UNRECOGNIZED_NAME; 675 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: 676 return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; 677 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: 678 return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; 679 case SSL_AD_UNKNOWN_PSK_IDENTITY: 680 return TLS1_AD_UNKNOWN_PSK_IDENTITY; 681 case SSL_AD_INAPPROPRIATE_FALLBACK: 682 return TLS1_AD_INAPPROPRIATE_FALLBACK; 683 case SSL_AD_NO_APPLICATION_PROTOCOL: 684 return TLS1_AD_NO_APPLICATION_PROTOCOL; 685 case SSL_AD_CERTIFICATE_REQUIRED: 686 return SSL_AD_HANDSHAKE_FAILURE; 687 default: 688 return -1; 689 } 690 } 691