1 /* 2 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <ctype.h> 13 #include <openssl/objects.h> 14 #include <openssl/evp.h> 15 #include <openssl/hmac.h> 16 #include <openssl/core_names.h> 17 #include <openssl/ocsp.h> 18 #include <openssl/conf.h> 19 #include <openssl/x509v3.h> 20 #include <openssl/dh.h> 21 #include <openssl/bn.h> 22 #include <openssl/provider.h> 23 #include <openssl/param_build.h> 24 #include "internal/nelem.h" 25 #include "internal/sizes.h" 26 #include "internal/tlsgroups.h" 27 #include "internal/ssl_unwrap.h" 28 #include "ssl_local.h" 29 #include "quic/quic_local.h" 30 #include <openssl/ct.h> 31 32 static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pkey); 33 static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, const SIGALG_LOOKUP *lu); 34 35 SSL3_ENC_METHOD const TLSv1_enc_data = { 36 tls1_setup_key_block, 37 tls1_generate_master_secret, 38 tls1_change_cipher_state, 39 tls1_final_finish_mac, 40 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE, 41 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE, 42 tls1_alert_code, 43 tls1_export_keying_material, 44 0, 45 ssl3_set_handshake_header, 46 tls_close_construct_packet, 47 ssl3_handshake_write 48 }; 49 50 SSL3_ENC_METHOD const TLSv1_1_enc_data = { 51 tls1_setup_key_block, 52 tls1_generate_master_secret, 53 tls1_change_cipher_state, 54 tls1_final_finish_mac, 55 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE, 56 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE, 57 tls1_alert_code, 58 tls1_export_keying_material, 59 0, 60 ssl3_set_handshake_header, 61 tls_close_construct_packet, 62 ssl3_handshake_write 63 }; 64 65 SSL3_ENC_METHOD const TLSv1_2_enc_data = { 66 tls1_setup_key_block, 67 tls1_generate_master_secret, 68 tls1_change_cipher_state, 69 tls1_final_finish_mac, 70 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE, 71 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE, 72 tls1_alert_code, 73 tls1_export_keying_material, 74 SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF 75 | SSL_ENC_FLAG_TLS1_2_CIPHERS, 76 ssl3_set_handshake_header, 77 tls_close_construct_packet, 78 ssl3_handshake_write 79 }; 80 81 SSL3_ENC_METHOD const TLSv1_3_enc_data = { 82 tls13_setup_key_block, 83 tls13_generate_master_secret, 84 tls13_change_cipher_state, 85 tls13_final_finish_mac, 86 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE, 87 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE, 88 tls13_alert_code, 89 tls13_export_keying_material, 90 SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF, 91 ssl3_set_handshake_header, 92 tls_close_construct_packet, 93 ssl3_handshake_write 94 }; 95 96 OSSL_TIME tls1_default_timeout(void) 97 { 98 /* 99 * 2 hours, the 24 hours mentioned in the TLSv1 spec is way too long for 100 * http, the cache would over fill 101 */ 102 return ossl_seconds2time(60 * 60 * 2); 103 } 104 105 int tls1_new(SSL *s) 106 { 107 if (!ssl3_new(s)) 108 return 0; 109 if (!s->method->ssl_clear(s)) 110 return 0; 111 112 return 1; 113 } 114 115 void tls1_free(SSL *s) 116 { 117 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 118 119 if (sc == NULL) 120 return; 121 122 OPENSSL_free(sc->ext.session_ticket); 123 ssl3_free(s); 124 } 125 126 int tls1_clear(SSL *s) 127 { 128 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 129 130 if (sc == NULL) 131 return 0; 132 133 if (!ssl3_clear(s)) 134 return 0; 135 136 if (s->method->version == TLS_ANY_VERSION) 137 sc->version = TLS_MAX_VERSION_INTERNAL; 138 else 139 sc->version = s->method->version; 140 141 return 1; 142 } 143 144 /* Legacy NID to group_id mapping. Only works for groups we know about */ 145 static const struct { 146 int nid; 147 uint16_t group_id; 148 } nid_to_group[] = { 149 { NID_sect163k1, OSSL_TLS_GROUP_ID_sect163k1 }, 150 { NID_sect163r1, OSSL_TLS_GROUP_ID_sect163r1 }, 151 { NID_sect163r2, OSSL_TLS_GROUP_ID_sect163r2 }, 152 { NID_sect193r1, OSSL_TLS_GROUP_ID_sect193r1 }, 153 { NID_sect193r2, OSSL_TLS_GROUP_ID_sect193r2 }, 154 { NID_sect233k1, OSSL_TLS_GROUP_ID_sect233k1 }, 155 { NID_sect233r1, OSSL_TLS_GROUP_ID_sect233r1 }, 156 { NID_sect239k1, OSSL_TLS_GROUP_ID_sect239k1 }, 157 { NID_sect283k1, OSSL_TLS_GROUP_ID_sect283k1 }, 158 { NID_sect283r1, OSSL_TLS_GROUP_ID_sect283r1 }, 159 { NID_sect409k1, OSSL_TLS_GROUP_ID_sect409k1 }, 160 { NID_sect409r1, OSSL_TLS_GROUP_ID_sect409r1 }, 161 { NID_sect571k1, OSSL_TLS_GROUP_ID_sect571k1 }, 162 { NID_sect571r1, OSSL_TLS_GROUP_ID_sect571r1 }, 163 { NID_secp160k1, OSSL_TLS_GROUP_ID_secp160k1 }, 164 { NID_secp160r1, OSSL_TLS_GROUP_ID_secp160r1 }, 165 { NID_secp160r2, OSSL_TLS_GROUP_ID_secp160r2 }, 166 { NID_secp192k1, OSSL_TLS_GROUP_ID_secp192k1 }, 167 { NID_X9_62_prime192v1, OSSL_TLS_GROUP_ID_secp192r1 }, 168 { NID_secp224k1, OSSL_TLS_GROUP_ID_secp224k1 }, 169 { NID_secp224r1, OSSL_TLS_GROUP_ID_secp224r1 }, 170 { NID_secp256k1, OSSL_TLS_GROUP_ID_secp256k1 }, 171 { NID_X9_62_prime256v1, OSSL_TLS_GROUP_ID_secp256r1 }, 172 { NID_secp384r1, OSSL_TLS_GROUP_ID_secp384r1 }, 173 { NID_secp521r1, OSSL_TLS_GROUP_ID_secp521r1 }, 174 { NID_brainpoolP256r1, OSSL_TLS_GROUP_ID_brainpoolP256r1 }, 175 { NID_brainpoolP384r1, OSSL_TLS_GROUP_ID_brainpoolP384r1 }, 176 { NID_brainpoolP512r1, OSSL_TLS_GROUP_ID_brainpoolP512r1 }, 177 { EVP_PKEY_X25519, OSSL_TLS_GROUP_ID_x25519 }, 178 { EVP_PKEY_X448, OSSL_TLS_GROUP_ID_x448 }, 179 { NID_brainpoolP256r1tls13, OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13 }, 180 { NID_brainpoolP384r1tls13, OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13 }, 181 { NID_brainpoolP512r1tls13, OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13 }, 182 { NID_id_tc26_gost_3410_2012_256_paramSetA, OSSL_TLS_GROUP_ID_gc256A }, 183 { NID_id_tc26_gost_3410_2012_256_paramSetB, OSSL_TLS_GROUP_ID_gc256B }, 184 { NID_id_tc26_gost_3410_2012_256_paramSetC, OSSL_TLS_GROUP_ID_gc256C }, 185 { NID_id_tc26_gost_3410_2012_256_paramSetD, OSSL_TLS_GROUP_ID_gc256D }, 186 { NID_id_tc26_gost_3410_2012_512_paramSetA, OSSL_TLS_GROUP_ID_gc512A }, 187 { NID_id_tc26_gost_3410_2012_512_paramSetB, OSSL_TLS_GROUP_ID_gc512B }, 188 { NID_id_tc26_gost_3410_2012_512_paramSetC, OSSL_TLS_GROUP_ID_gc512C }, 189 { NID_ffdhe2048, OSSL_TLS_GROUP_ID_ffdhe2048 }, 190 { NID_ffdhe3072, OSSL_TLS_GROUP_ID_ffdhe3072 }, 191 { NID_ffdhe4096, OSSL_TLS_GROUP_ID_ffdhe4096 }, 192 { NID_ffdhe6144, OSSL_TLS_GROUP_ID_ffdhe6144 }, 193 { NID_ffdhe8192, OSSL_TLS_GROUP_ID_ffdhe8192 } 194 }; 195 196 static const unsigned char ecformats_default[] = { 197 TLSEXT_ECPOINTFORMAT_uncompressed, 198 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime, 199 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2 200 }; 201 202 /* Group list string of the built-in pseudo group DEFAULT */ 203 #define DEFAULT_GROUP_NAME "DEFAULT" 204 #define TLS_DEFAULT_GROUP_LIST \ 205 "?*X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072" 206 207 static const uint16_t suiteb_curves[] = { 208 OSSL_TLS_GROUP_ID_secp256r1, 209 OSSL_TLS_GROUP_ID_secp384r1, 210 }; 211 212 /* Group list string of the built-in pseudo group DEFAULT_SUITE_B */ 213 #define SUITE_B_GROUP_NAME "DEFAULT_SUITE_B" 214 #define SUITE_B_GROUP_LIST "?secp256r1:?secp384r1", 215 216 struct provider_ctx_data_st { 217 SSL_CTX *ctx; 218 OSSL_PROVIDER *provider; 219 }; 220 221 #define TLS_GROUP_LIST_MALLOC_BLOCK_SIZE 10 222 static OSSL_CALLBACK add_provider_groups; 223 static int add_provider_groups(const OSSL_PARAM params[], void *data) 224 { 225 struct provider_ctx_data_st *pgd = data; 226 SSL_CTX *ctx = pgd->ctx; 227 const OSSL_PARAM *p; 228 TLS_GROUP_INFO *ginf = NULL; 229 EVP_KEYMGMT *keymgmt; 230 unsigned int gid; 231 unsigned int is_kem = 0; 232 int ret = 0; 233 234 if (ctx->group_list_max_len == ctx->group_list_len) { 235 TLS_GROUP_INFO *tmp = NULL; 236 237 if (ctx->group_list_max_len == 0) 238 tmp = OPENSSL_malloc(sizeof(TLS_GROUP_INFO) 239 * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE); 240 else 241 tmp = OPENSSL_realloc(ctx->group_list, 242 (ctx->group_list_max_len 243 + TLS_GROUP_LIST_MALLOC_BLOCK_SIZE) 244 * sizeof(TLS_GROUP_INFO)); 245 if (tmp == NULL) 246 return 0; 247 ctx->group_list = tmp; 248 memset(tmp + ctx->group_list_max_len, 249 0, 250 sizeof(TLS_GROUP_INFO) * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE); 251 ctx->group_list_max_len += TLS_GROUP_LIST_MALLOC_BLOCK_SIZE; 252 } 253 254 ginf = &ctx->group_list[ctx->group_list_len]; 255 256 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME); 257 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) { 258 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 259 goto err; 260 } 261 ginf->tlsname = OPENSSL_strdup(p->data); 262 if (ginf->tlsname == NULL) 263 goto err; 264 265 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL); 266 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) { 267 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 268 goto err; 269 } 270 ginf->realname = OPENSSL_strdup(p->data); 271 if (ginf->realname == NULL) 272 goto err; 273 274 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ID); 275 if (p == NULL || !OSSL_PARAM_get_uint(p, &gid) || gid > UINT16_MAX) { 276 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 277 goto err; 278 } 279 ginf->group_id = (uint16_t)gid; 280 281 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ALG); 282 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) { 283 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 284 goto err; 285 } 286 ginf->algorithm = OPENSSL_strdup(p->data); 287 if (ginf->algorithm == NULL) 288 goto err; 289 290 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS); 291 if (p == NULL || !OSSL_PARAM_get_uint(p, &ginf->secbits)) { 292 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 293 goto err; 294 } 295 296 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_IS_KEM); 297 if (p != NULL && (!OSSL_PARAM_get_uint(p, &is_kem) || is_kem > 1)) { 298 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 299 goto err; 300 } 301 ginf->is_kem = 1 & is_kem; 302 303 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_TLS); 304 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mintls)) { 305 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 306 goto err; 307 } 308 309 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_TLS); 310 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxtls)) { 311 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 312 goto err; 313 } 314 315 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS); 316 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mindtls)) { 317 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 318 goto err; 319 } 320 321 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS); 322 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxdtls)) { 323 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 324 goto err; 325 } 326 /* 327 * Now check that the algorithm is actually usable for our property query 328 * string. Regardless of the result we still return success because we have 329 * successfully processed this group, even though we may decide not to use 330 * it. 331 */ 332 ret = 1; 333 ERR_set_mark(); 334 keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, ginf->algorithm, ctx->propq); 335 if (keymgmt != NULL) { 336 /* We have successfully fetched the algorithm, we can use the group. */ 337 ctx->group_list_len++; 338 ginf = NULL; 339 EVP_KEYMGMT_free(keymgmt); 340 } 341 ERR_pop_to_mark(); 342 err: 343 if (ginf != NULL) { 344 OPENSSL_free(ginf->tlsname); 345 OPENSSL_free(ginf->realname); 346 OPENSSL_free(ginf->algorithm); 347 ginf->algorithm = ginf->tlsname = ginf->realname = NULL; 348 } 349 return ret; 350 } 351 352 static int discover_provider_groups(OSSL_PROVIDER *provider, void *vctx) 353 { 354 struct provider_ctx_data_st pgd; 355 356 pgd.ctx = vctx; 357 pgd.provider = provider; 358 return OSSL_PROVIDER_get_capabilities(provider, "TLS-GROUP", 359 add_provider_groups, &pgd); 360 } 361 362 int ssl_load_groups(SSL_CTX *ctx) 363 { 364 if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_groups, ctx)) 365 return 0; 366 367 return SSL_CTX_set1_groups_list(ctx, TLS_DEFAULT_GROUP_LIST); 368 } 369 370 static const char *inferred_keytype(const TLS_SIGALG_INFO *sinf) 371 { 372 return (sinf->keytype != NULL 373 ? sinf->keytype 374 : (sinf->sig_name != NULL 375 ? sinf->sig_name 376 : sinf->sigalg_name)); 377 } 378 379 #define TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE 10 380 static OSSL_CALLBACK add_provider_sigalgs; 381 static int add_provider_sigalgs(const OSSL_PARAM params[], void *data) 382 { 383 struct provider_ctx_data_st *pgd = data; 384 SSL_CTX *ctx = pgd->ctx; 385 OSSL_PROVIDER *provider = pgd->provider; 386 const OSSL_PARAM *p; 387 TLS_SIGALG_INFO *sinf = NULL; 388 EVP_KEYMGMT *keymgmt; 389 const char *keytype; 390 unsigned int code_point = 0; 391 int ret = 0; 392 393 if (ctx->sigalg_list_max_len == ctx->sigalg_list_len) { 394 TLS_SIGALG_INFO *tmp = NULL; 395 396 if (ctx->sigalg_list_max_len == 0) 397 tmp = OPENSSL_malloc(sizeof(TLS_SIGALG_INFO) 398 * TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE); 399 else 400 tmp = OPENSSL_realloc(ctx->sigalg_list, 401 (ctx->sigalg_list_max_len 402 + TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE) 403 * sizeof(TLS_SIGALG_INFO)); 404 if (tmp == NULL) 405 return 0; 406 ctx->sigalg_list = tmp; 407 memset(tmp + ctx->sigalg_list_max_len, 0, 408 sizeof(TLS_SIGALG_INFO) * TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE); 409 ctx->sigalg_list_max_len += TLS_SIGALG_LIST_MALLOC_BLOCK_SIZE; 410 } 411 412 sinf = &ctx->sigalg_list[ctx->sigalg_list_len]; 413 414 /* First, mandatory parameters */ 415 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_NAME); 416 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) { 417 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 418 goto err; 419 } 420 OPENSSL_free(sinf->sigalg_name); 421 sinf->sigalg_name = OPENSSL_strdup(p->data); 422 if (sinf->sigalg_name == NULL) 423 goto err; 424 425 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_IANA_NAME); 426 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) { 427 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 428 goto err; 429 } 430 OPENSSL_free(sinf->name); 431 sinf->name = OPENSSL_strdup(p->data); 432 if (sinf->name == NULL) 433 goto err; 434 435 p = OSSL_PARAM_locate_const(params, 436 OSSL_CAPABILITY_TLS_SIGALG_CODE_POINT); 437 if (p == NULL 438 || !OSSL_PARAM_get_uint(p, &code_point) 439 || code_point > UINT16_MAX) { 440 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 441 goto err; 442 } 443 sinf->code_point = (uint16_t)code_point; 444 445 p = OSSL_PARAM_locate_const(params, 446 OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS); 447 if (p == NULL || !OSSL_PARAM_get_uint(p, &sinf->secbits)) { 448 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 449 goto err; 450 } 451 452 /* Now, optional parameters */ 453 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_OID); 454 if (p == NULL) { 455 sinf->sigalg_oid = NULL; 456 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 457 goto err; 458 } else { 459 OPENSSL_free(sinf->sigalg_oid); 460 sinf->sigalg_oid = OPENSSL_strdup(p->data); 461 if (sinf->sigalg_oid == NULL) 462 goto err; 463 } 464 465 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_SIG_NAME); 466 if (p == NULL) { 467 sinf->sig_name = NULL; 468 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 469 goto err; 470 } else { 471 OPENSSL_free(sinf->sig_name); 472 sinf->sig_name = OPENSSL_strdup(p->data); 473 if (sinf->sig_name == NULL) 474 goto err; 475 } 476 477 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_SIG_OID); 478 if (p == NULL) { 479 sinf->sig_oid = NULL; 480 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 481 goto err; 482 } else { 483 OPENSSL_free(sinf->sig_oid); 484 sinf->sig_oid = OPENSSL_strdup(p->data); 485 if (sinf->sig_oid == NULL) 486 goto err; 487 } 488 489 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_HASH_NAME); 490 if (p == NULL) { 491 sinf->hash_name = NULL; 492 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 493 goto err; 494 } else { 495 OPENSSL_free(sinf->hash_name); 496 sinf->hash_name = OPENSSL_strdup(p->data); 497 if (sinf->hash_name == NULL) 498 goto err; 499 } 500 501 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_HASH_OID); 502 if (p == NULL) { 503 sinf->hash_oid = NULL; 504 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 505 goto err; 506 } else { 507 OPENSSL_free(sinf->hash_oid); 508 sinf->hash_oid = OPENSSL_strdup(p->data); 509 if (sinf->hash_oid == NULL) 510 goto err; 511 } 512 513 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_KEYTYPE); 514 if (p == NULL) { 515 sinf->keytype = NULL; 516 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 517 goto err; 518 } else { 519 OPENSSL_free(sinf->keytype); 520 sinf->keytype = OPENSSL_strdup(p->data); 521 if (sinf->keytype == NULL) 522 goto err; 523 } 524 525 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_KEYTYPE_OID); 526 if (p == NULL) { 527 sinf->keytype_oid = NULL; 528 } else if (p->data_type != OSSL_PARAM_UTF8_STRING) { 529 goto err; 530 } else { 531 OPENSSL_free(sinf->keytype_oid); 532 sinf->keytype_oid = OPENSSL_strdup(p->data); 533 if (sinf->keytype_oid == NULL) 534 goto err; 535 } 536 537 /* Optional, not documented prior to 3.5 */ 538 sinf->mindtls = sinf->maxdtls = -1; 539 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MIN_DTLS); 540 if (p != NULL && !OSSL_PARAM_get_int(p, &sinf->mindtls)) { 541 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 542 goto err; 543 } 544 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MAX_DTLS); 545 if (p != NULL && !OSSL_PARAM_get_int(p, &sinf->maxdtls)) { 546 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 547 goto err; 548 } 549 /* DTLS version numbers grow downward */ 550 if ((sinf->maxdtls != 0) && (sinf->maxdtls != -1) && ((sinf->maxdtls > sinf->mindtls))) { 551 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 552 goto err; 553 } 554 /* No provider sigalgs are supported in DTLS, reset after checking. */ 555 sinf->mindtls = sinf->maxdtls = -1; 556 557 /* The remaining parameters below are mandatory again */ 558 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MIN_TLS); 559 if (p == NULL || !OSSL_PARAM_get_int(p, &sinf->mintls)) { 560 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 561 goto err; 562 } 563 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_SIGALG_MAX_TLS); 564 if (p == NULL || !OSSL_PARAM_get_int(p, &sinf->maxtls)) { 565 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 566 goto err; 567 } 568 if ((sinf->maxtls != 0) && (sinf->maxtls != -1) && ((sinf->maxtls < sinf->mintls))) { 569 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 570 goto err; 571 } 572 if ((sinf->mintls != 0) && (sinf->mintls != -1) && ((sinf->mintls > TLS1_3_VERSION))) 573 sinf->mintls = sinf->maxtls = -1; 574 if ((sinf->maxtls != 0) && (sinf->maxtls != -1) && ((sinf->maxtls < TLS1_3_VERSION))) 575 sinf->mintls = sinf->maxtls = -1; 576 577 /* Ignore unusable sigalgs */ 578 if (sinf->mintls == -1 && sinf->mindtls == -1) { 579 ret = 1; 580 goto err; 581 } 582 583 /* 584 * Now check that the algorithm is actually usable for our property query 585 * string. Regardless of the result we still return success because we have 586 * successfully processed this signature, even though we may decide not to 587 * use it. 588 */ 589 ret = 1; 590 ERR_set_mark(); 591 keytype = inferred_keytype(sinf); 592 keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, keytype, ctx->propq); 593 if (keymgmt != NULL) { 594 /* 595 * We have successfully fetched the algorithm - however if the provider 596 * doesn't match this one then we ignore it. 597 * 598 * Note: We're cheating a little here. Technically if the same algorithm 599 * is available from more than one provider then it is undefined which 600 * implementation you will get back. Theoretically this could be 601 * different every time...we assume here that you'll always get the 602 * same one back if you repeat the exact same fetch. Is this a reasonable 603 * assumption to make (in which case perhaps we should document this 604 * behaviour)? 605 */ 606 if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) { 607 /* 608 * We have a match - so we could use this signature; 609 * Check proper object registration first, though. 610 * Don't care about return value as this may have been 611 * done within providers or previous calls to 612 * add_provider_sigalgs. 613 */ 614 OBJ_create(sinf->sigalg_oid, sinf->sigalg_name, NULL); 615 /* sanity check: Without successful registration don't use alg */ 616 if ((OBJ_txt2nid(sinf->sigalg_name) == NID_undef) || (OBJ_nid2obj(OBJ_txt2nid(sinf->sigalg_name)) == NULL)) { 617 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); 618 goto err; 619 } 620 if (sinf->sig_name != NULL) 621 OBJ_create(sinf->sig_oid, sinf->sig_name, NULL); 622 if (sinf->keytype != NULL) 623 OBJ_create(sinf->keytype_oid, sinf->keytype, NULL); 624 if (sinf->hash_name != NULL) 625 OBJ_create(sinf->hash_oid, sinf->hash_name, NULL); 626 OBJ_add_sigid(OBJ_txt2nid(sinf->sigalg_name), 627 (sinf->hash_name != NULL 628 ? OBJ_txt2nid(sinf->hash_name) 629 : NID_undef), 630 OBJ_txt2nid(keytype)); 631 ctx->sigalg_list_len++; 632 sinf = NULL; 633 } 634 EVP_KEYMGMT_free(keymgmt); 635 } 636 ERR_pop_to_mark(); 637 err: 638 if (sinf != NULL) { 639 OPENSSL_free(sinf->name); 640 sinf->name = NULL; 641 OPENSSL_free(sinf->sigalg_name); 642 sinf->sigalg_name = NULL; 643 OPENSSL_free(sinf->sigalg_oid); 644 sinf->sigalg_oid = NULL; 645 OPENSSL_free(sinf->sig_name); 646 sinf->sig_name = NULL; 647 OPENSSL_free(sinf->sig_oid); 648 sinf->sig_oid = NULL; 649 OPENSSL_free(sinf->hash_name); 650 sinf->hash_name = NULL; 651 OPENSSL_free(sinf->hash_oid); 652 sinf->hash_oid = NULL; 653 OPENSSL_free(sinf->keytype); 654 sinf->keytype = NULL; 655 OPENSSL_free(sinf->keytype_oid); 656 sinf->keytype_oid = NULL; 657 } 658 return ret; 659 } 660 661 static int discover_provider_sigalgs(OSSL_PROVIDER *provider, void *vctx) 662 { 663 struct provider_ctx_data_st pgd; 664 665 pgd.ctx = vctx; 666 pgd.provider = provider; 667 OSSL_PROVIDER_get_capabilities(provider, "TLS-SIGALG", 668 add_provider_sigalgs, &pgd); 669 /* 670 * Always OK, even if provider doesn't support the capability: 671 * Reconsider testing retval when legacy sigalgs are also loaded this way. 672 */ 673 return 1; 674 } 675 676 int ssl_load_sigalgs(SSL_CTX *ctx) 677 { 678 size_t i; 679 SSL_CERT_LOOKUP lu; 680 681 if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_sigalgs, ctx)) 682 return 0; 683 684 /* now populate ctx->ssl_cert_info */ 685 if (ctx->sigalg_list_len > 0) { 686 OPENSSL_free(ctx->ssl_cert_info); 687 ctx->ssl_cert_info = OPENSSL_zalloc(sizeof(lu) * ctx->sigalg_list_len); 688 if (ctx->ssl_cert_info == NULL) 689 return 0; 690 for (i = 0; i < ctx->sigalg_list_len; i++) { 691 const char *keytype = inferred_keytype(&ctx->sigalg_list[i]); 692 ctx->ssl_cert_info[i].pkey_nid = OBJ_txt2nid(keytype); 693 ctx->ssl_cert_info[i].amask = SSL_aANY; 694 } 695 } 696 697 /* 698 * For now, leave it at this: legacy sigalgs stay in their own 699 * data structures until "legacy cleanup" occurs. 700 */ 701 702 return 1; 703 } 704 705 static uint16_t tls1_group_name2id(SSL_CTX *ctx, const char *name) 706 { 707 size_t i; 708 709 for (i = 0; i < ctx->group_list_len; i++) { 710 if (OPENSSL_strcasecmp(ctx->group_list[i].tlsname, name) == 0 711 || OPENSSL_strcasecmp(ctx->group_list[i].realname, name) == 0) 712 return ctx->group_list[i].group_id; 713 } 714 715 return 0; 716 } 717 718 const TLS_GROUP_INFO *tls1_group_id_lookup(SSL_CTX *ctx, uint16_t group_id) 719 { 720 size_t i; 721 722 for (i = 0; i < ctx->group_list_len; i++) { 723 if (ctx->group_list[i].group_id == group_id) 724 return &ctx->group_list[i]; 725 } 726 727 return NULL; 728 } 729 730 const char *tls1_group_id2name(SSL_CTX *ctx, uint16_t group_id) 731 { 732 const TLS_GROUP_INFO *tls_group_info = tls1_group_id_lookup(ctx, group_id); 733 734 if (tls_group_info == NULL) 735 return NULL; 736 737 return tls_group_info->tlsname; 738 } 739 740 int tls1_group_id2nid(uint16_t group_id, int include_unknown) 741 { 742 size_t i; 743 744 if (group_id == 0) 745 return NID_undef; 746 747 /* 748 * Return well known Group NIDs - for backwards compatibility. This won't 749 * work for groups we don't know about. 750 */ 751 for (i = 0; i < OSSL_NELEM(nid_to_group); i++) { 752 if (nid_to_group[i].group_id == group_id) 753 return nid_to_group[i].nid; 754 } 755 if (!include_unknown) 756 return NID_undef; 757 return TLSEXT_nid_unknown | (int)group_id; 758 } 759 760 uint16_t tls1_nid2group_id(int nid) 761 { 762 size_t i; 763 764 /* 765 * Return well known Group ids - for backwards compatibility. This won't 766 * work for groups we don't know about. 767 */ 768 for (i = 0; i < OSSL_NELEM(nid_to_group); i++) { 769 if (nid_to_group[i].nid == nid) 770 return nid_to_group[i].group_id; 771 } 772 773 return 0; 774 } 775 776 /* 777 * Set *pgroups to the supported groups list and *pgroupslen to 778 * the number of groups supported. 779 */ 780 void tls1_get_supported_groups(SSL_CONNECTION *s, const uint16_t **pgroups, 781 size_t *pgroupslen) 782 { 783 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 784 785 /* For Suite B mode only include P-256, P-384 */ 786 switch (tls1_suiteb(s)) { 787 case SSL_CERT_FLAG_SUITEB_128_LOS: 788 *pgroups = suiteb_curves; 789 *pgroupslen = OSSL_NELEM(suiteb_curves); 790 break; 791 792 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY: 793 *pgroups = suiteb_curves; 794 *pgroupslen = 1; 795 break; 796 797 case SSL_CERT_FLAG_SUITEB_192_LOS: 798 *pgroups = suiteb_curves + 1; 799 *pgroupslen = 1; 800 break; 801 802 default: 803 if (s->ext.supportedgroups == NULL) { 804 *pgroups = sctx->ext.supportedgroups; 805 *pgroupslen = sctx->ext.supportedgroups_len; 806 } else { 807 *pgroups = s->ext.supportedgroups; 808 *pgroupslen = s->ext.supportedgroups_len; 809 } 810 break; 811 } 812 } 813 814 /* 815 * Some comments for the function below: 816 * s->ext.supportedgroups == NULL means legacy syntax (no [*,/,-]) from built-in group array. 817 * In this case, we need to send exactly one key share, which MUST be the first (leftmost) 818 * eligible group from the legacy list. Therefore, we provide the entire list of supported 819 * groups in this case. 820 * 821 * A 'flag' to indicate legacy syntax is created by setting the number of key shares to 1, 822 * but the groupID to 0. 823 * The 'flag' is checked right at the beginning in tls_construct_ctos_key_share and either 824 * the "list of requested key share groups" is used, or the "list of supported groups" in 825 * combination with setting add_only_one = 1 is applied. 826 */ 827 void tls1_get_requested_keyshare_groups(SSL_CONNECTION *s, const uint16_t **pgroups, 828 size_t *pgroupslen) 829 { 830 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 831 832 if (s->ext.supportedgroups == NULL) { 833 *pgroups = sctx->ext.supportedgroups; 834 *pgroupslen = sctx->ext.supportedgroups_len; 835 } else { 836 *pgroups = s->ext.keyshares; 837 *pgroupslen = s->ext.keyshares_len; 838 } 839 } 840 841 void tls1_get_group_tuples(SSL_CONNECTION *s, const size_t **ptuples, 842 size_t *ptupleslen) 843 { 844 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 845 846 if (s->ext.supportedgroups == NULL) { 847 *ptuples = sctx->ext.tuples; 848 *ptupleslen = sctx->ext.tuples_len; 849 } else { 850 *ptuples = s->ext.tuples; 851 *ptupleslen = s->ext.tuples_len; 852 } 853 } 854 855 int tls_valid_group(SSL_CONNECTION *s, uint16_t group_id, 856 int minversion, int maxversion, 857 int isec, int *okfortls13) 858 { 859 const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s), 860 group_id); 861 int ret; 862 int group_minversion, group_maxversion; 863 864 if (okfortls13 != NULL) 865 *okfortls13 = 0; 866 867 if (ginfo == NULL) 868 return 0; 869 870 group_minversion = SSL_CONNECTION_IS_DTLS(s) ? ginfo->mindtls : ginfo->mintls; 871 group_maxversion = SSL_CONNECTION_IS_DTLS(s) ? ginfo->maxdtls : ginfo->maxtls; 872 873 if (group_minversion < 0 || group_maxversion < 0) 874 return 0; 875 if (group_maxversion == 0) 876 ret = 1; 877 else 878 ret = (ssl_version_cmp(s, minversion, group_maxversion) <= 0); 879 if (group_minversion > 0) 880 ret &= (ssl_version_cmp(s, maxversion, group_minversion) >= 0); 881 882 if (!SSL_CONNECTION_IS_DTLS(s)) { 883 if (ret && okfortls13 != NULL && maxversion == TLS1_3_VERSION) 884 *okfortls13 = (group_maxversion == 0) 885 || (group_maxversion >= TLS1_3_VERSION); 886 } 887 ret &= !isec 888 || strcmp(ginfo->algorithm, "EC") == 0 889 || strcmp(ginfo->algorithm, "X25519") == 0 890 || strcmp(ginfo->algorithm, "X448") == 0; 891 892 return ret; 893 } 894 895 /* See if group is allowed by security callback */ 896 int tls_group_allowed(SSL_CONNECTION *s, uint16_t group, int op) 897 { 898 const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s), 899 group); 900 unsigned char gtmp[2]; 901 902 if (ginfo == NULL) 903 return 0; 904 905 gtmp[0] = group >> 8; 906 gtmp[1] = group & 0xff; 907 return ssl_security(s, op, ginfo->secbits, 908 tls1_group_id2nid(ginfo->group_id, 0), (void *)gtmp); 909 } 910 911 /* Return 1 if "id" is in "list" */ 912 static int tls1_in_list(uint16_t id, const uint16_t *list, size_t listlen) 913 { 914 size_t i; 915 for (i = 0; i < listlen; i++) 916 if (list[i] == id) 917 return 1; 918 return 0; 919 } 920 921 typedef struct { 922 TLS_GROUP_INFO *grp; 923 size_t ix; 924 } TLS_GROUP_IX; 925 926 DEFINE_STACK_OF(TLS_GROUP_IX) 927 928 static void free_wrapper(TLS_GROUP_IX *a) 929 { 930 OPENSSL_free(a); 931 } 932 933 static int tls_group_ix_cmp(const TLS_GROUP_IX *const *a, 934 const TLS_GROUP_IX *const *b) 935 { 936 int idcmpab = (*a)->grp->group_id < (*b)->grp->group_id; 937 int idcmpba = (*b)->grp->group_id < (*a)->grp->group_id; 938 int ixcmpab = (*a)->ix < (*b)->ix; 939 int ixcmpba = (*b)->ix < (*a)->ix; 940 941 /* Ascending by group id */ 942 if (idcmpab != idcmpba) 943 return (idcmpba - idcmpab); 944 /* Ascending by original appearance index */ 945 return ixcmpba - ixcmpab; 946 } 947 948 int tls1_get0_implemented_groups(int min_proto_version, int max_proto_version, 949 TLS_GROUP_INFO *grps, size_t num, long all, 950 STACK_OF(OPENSSL_CSTRING) *out) 951 { 952 STACK_OF(TLS_GROUP_IX) *collect = NULL; 953 TLS_GROUP_IX *gix; 954 uint16_t id = 0; 955 int ret = 0; 956 size_t ix; 957 958 if (grps == NULL || out == NULL) 959 return 0; 960 if ((collect = sk_TLS_GROUP_IX_new(tls_group_ix_cmp)) == NULL) 961 return 0; 962 for (ix = 0; ix < num; ++ix, ++grps) { 963 if (grps->mintls > 0 && max_proto_version > 0 964 && grps->mintls > max_proto_version) 965 continue; 966 if (grps->maxtls > 0 && min_proto_version > 0 967 && grps->maxtls < min_proto_version) 968 continue; 969 970 if ((gix = OPENSSL_malloc(sizeof(*gix))) == NULL) 971 goto end; 972 gix->grp = grps; 973 gix->ix = ix; 974 if (sk_TLS_GROUP_IX_push(collect, gix) <= 0) { 975 OPENSSL_free(gix); 976 goto end; 977 } 978 } 979 980 sk_TLS_GROUP_IX_sort(collect); 981 num = sk_TLS_GROUP_IX_num(collect); 982 for (ix = 0; ix < num; ++ix) { 983 gix = sk_TLS_GROUP_IX_value(collect, ix); 984 if (!all && gix->grp->group_id == id) 985 continue; 986 id = gix->grp->group_id; 987 if (sk_OPENSSL_CSTRING_push(out, gix->grp->tlsname) <= 0) 988 goto end; 989 } 990 ret = 1; 991 992 end: 993 sk_TLS_GROUP_IX_pop_free(collect, free_wrapper); 994 return ret; 995 } 996 997 /*- 998 * For nmatch >= 0, return the id of the |nmatch|th shared group or 0 999 * if there is no match. 1000 * For nmatch == -1, return number of matches 1001 * For nmatch == -2, return the id of the group to use for 1002 * a tmp key, or 0 if there is no match. 1003 */ 1004 uint16_t tls1_shared_group(SSL_CONNECTION *s, int nmatch) 1005 { 1006 const uint16_t *pref, *supp; 1007 size_t num_pref, num_supp, i; 1008 int k; 1009 SSL_CTX *ctx = SSL_CONNECTION_GET_CTX(s); 1010 1011 /* Can't do anything on client side */ 1012 if (s->server == 0) 1013 return 0; 1014 if (nmatch == -2) { 1015 if (tls1_suiteb(s)) { 1016 /* 1017 * For Suite B ciphersuite determines curve: we already know 1018 * these are acceptable due to previous checks. 1019 */ 1020 unsigned long cid = s->s3.tmp.new_cipher->id; 1021 1022 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) 1023 return OSSL_TLS_GROUP_ID_secp256r1; 1024 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) 1025 return OSSL_TLS_GROUP_ID_secp384r1; 1026 /* Should never happen */ 1027 return 0; 1028 } 1029 /* If not Suite B just return first preference shared curve */ 1030 nmatch = 0; 1031 } 1032 /* 1033 * If server preference set, our groups are the preference order 1034 * otherwise peer decides. 1035 */ 1036 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) { 1037 tls1_get_supported_groups(s, &pref, &num_pref); 1038 tls1_get_peer_groups(s, &supp, &num_supp); 1039 } else { 1040 tls1_get_peer_groups(s, &pref, &num_pref); 1041 tls1_get_supported_groups(s, &supp, &num_supp); 1042 } 1043 1044 for (k = 0, i = 0; i < num_pref; i++) { 1045 uint16_t id = pref[i]; 1046 const TLS_GROUP_INFO *inf; 1047 int minversion, maxversion; 1048 1049 if (!tls1_in_list(id, supp, num_supp) 1050 || !tls_group_allowed(s, id, SSL_SECOP_CURVE_SHARED)) 1051 continue; 1052 inf = tls1_group_id_lookup(ctx, id); 1053 if (!ossl_assert(inf != NULL)) 1054 return 0; 1055 1056 minversion = SSL_CONNECTION_IS_DTLS(s) 1057 ? inf->mindtls 1058 : inf->mintls; 1059 maxversion = SSL_CONNECTION_IS_DTLS(s) 1060 ? inf->maxdtls 1061 : inf->maxtls; 1062 if (maxversion == -1) 1063 continue; 1064 if ((minversion != 0 && ssl_version_cmp(s, s->version, minversion) < 0) 1065 || (maxversion != 0 1066 && ssl_version_cmp(s, s->version, maxversion) > 0)) 1067 continue; 1068 1069 if (nmatch == k) 1070 return id; 1071 k++; 1072 } 1073 if (nmatch == -1) 1074 return k; 1075 /* Out of range (nmatch > k). */ 1076 return 0; 1077 } 1078 1079 int tls1_set_groups(uint16_t **grpext, size_t *grpextlen, 1080 uint16_t **ksext, size_t *ksextlen, 1081 size_t **tplext, size_t *tplextlen, 1082 int *groups, size_t ngroups) 1083 { 1084 uint16_t *glist = NULL, *kslist = NULL; 1085 size_t *tpllist = NULL; 1086 size_t i; 1087 /* 1088 * Bitmap of groups included to detect duplicates: two variables are added 1089 * to detect duplicates as some values are more than 32. 1090 */ 1091 unsigned long *dup_list = NULL; 1092 unsigned long dup_list_egrp = 0; 1093 unsigned long dup_list_dhgrp = 0; 1094 1095 if (ngroups == 0) { 1096 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 1097 return 0; 1098 } 1099 if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) 1100 goto err; 1101 if ((kslist = OPENSSL_malloc(1 * sizeof(*kslist))) == NULL) 1102 goto err; 1103 if ((tpllist = OPENSSL_malloc(1 * sizeof(*tpllist))) == NULL) 1104 goto err; 1105 for (i = 0; i < ngroups; i++) { 1106 unsigned long idmask; 1107 uint16_t id; 1108 id = tls1_nid2group_id(groups[i]); 1109 if ((id & 0x00FF) >= (sizeof(unsigned long) * 8)) 1110 goto err; 1111 idmask = 1L << (id & 0x00FF); 1112 dup_list = (id < 0x100) ? &dup_list_egrp : &dup_list_dhgrp; 1113 if (!id || ((*dup_list) & idmask)) 1114 goto err; 1115 *dup_list |= idmask; 1116 glist[i] = id; 1117 } 1118 OPENSSL_free(*grpext); 1119 OPENSSL_free(*ksext); 1120 OPENSSL_free(*tplext); 1121 *grpext = glist; 1122 *grpextlen = ngroups; 1123 /* 1124 * No * prefix was used, let tls_construct_ctos_key_share choose a key 1125 * share. This has the advantage that it will filter unsupported groups 1126 * before choosing one, which this function does not do. See also the 1127 * comment for tls1_get_requested_keyshare_groups. 1128 */ 1129 kslist[0] = 0; 1130 *ksext = kslist; 1131 *ksextlen = 1; 1132 tpllist[0] = ngroups; 1133 *tplext = tpllist; 1134 *tplextlen = 1; 1135 return 1; 1136 err: 1137 OPENSSL_free(glist); 1138 OPENSSL_free(kslist); 1139 OPENSSL_free(tpllist); 1140 return 0; 1141 } 1142 1143 /* 1144 * Definition of DEFAULT[_XYZ] pseudo group names. 1145 * A pseudo group name is actually a full list of groups, including prefixes 1146 * and or tuple delimiters. It can be hierarchically defined (for potential future use). 1147 * IMPORTANT REMARK: For ease of use, in the built-in lists of groups, unknown groups or 1148 * groups not backed by a provider will always silently be ignored, even without '?' prefix 1149 */ 1150 typedef struct { 1151 const char *list_name; /* The name of this pseudo group */ 1152 const char *group_string; /* The group string of this pseudo group */ 1153 } default_group_string_st; /* (can include '?', '*'. '-', '/' as needed) */ 1154 1155 /* Built-in pseudo group-names must start with a (D or d) */ 1156 static const char *DEFAULT_GROUPNAME_FIRST_CHARACTER = "D"; 1157 1158 /* The list of all built-in pseudo-group-name structures */ 1159 static const default_group_string_st default_group_strings[] = { 1160 { DEFAULT_GROUP_NAME, TLS_DEFAULT_GROUP_LIST }, 1161 { SUITE_B_GROUP_NAME, SUITE_B_GROUP_LIST } 1162 }; 1163 1164 /* 1165 * Some GOST names are not resolved by tls1_group_name2id, 1166 * hence we'll check for those manually 1167 */ 1168 typedef struct { 1169 const char *group_name; 1170 uint16_t groupID; 1171 } name2id_st; 1172 static const name2id_st name2id_arr[] = { 1173 { "GC256A", OSSL_TLS_GROUP_ID_gc256A }, 1174 { "GC256B", OSSL_TLS_GROUP_ID_gc256B }, 1175 { "GC256C", OSSL_TLS_GROUP_ID_gc256C }, 1176 { "GC256D", OSSL_TLS_GROUP_ID_gc256D }, 1177 { "GC512A", OSSL_TLS_GROUP_ID_gc512A }, 1178 { "GC512B", OSSL_TLS_GROUP_ID_gc512B }, 1179 { "GC512C", OSSL_TLS_GROUP_ID_gc512C }, 1180 }; 1181 1182 /* 1183 * Group list management: 1184 * We establish three lists along with their related size counters: 1185 * 1) List of (unique) groups 1186 * 2) List of number of groups per group-priority-tuple 1187 * 3) List of (unique) key share groups 1188 */ 1189 #define GROUPLIST_INCREMENT 32 /* Memory allocation chunk size (64 Bytes chunks ~= cache line) */ 1190 #define GROUP_NAME_BUFFER_LENGTH 64 /* Max length of a group name */ 1191 1192 /* 1193 * Preparation of the prefix used to indicate the desire to send a key share, 1194 * the characters used as separators between groups or tuples of groups, the 1195 * character to indicate that an unknown group should be ignored, and the 1196 * character to indicate that a group should be deleted from a list 1197 */ 1198 #ifndef TUPLE_DELIMITER_CHARACTER 1199 /* The prefix characters to indicate group tuple boundaries */ 1200 #define TUPLE_DELIMITER_CHARACTER '/' 1201 #endif 1202 #ifndef GROUP_DELIMITER_CHARACTER 1203 /* The prefix characters to indicate group tuple boundaries */ 1204 #define GROUP_DELIMITER_CHARACTER ':' 1205 #endif 1206 #ifndef IGNORE_UNKNOWN_GROUP_CHARACTER 1207 /* The prefix character to ignore unknown groups */ 1208 #define IGNORE_UNKNOWN_GROUP_CHARACTER '?' 1209 #endif 1210 #ifndef KEY_SHARE_INDICATOR_CHARACTER 1211 /* The prefix character to trigger a key share addition */ 1212 #define KEY_SHARE_INDICATOR_CHARACTER '*' 1213 #endif 1214 #ifndef REMOVE_GROUP_INDICATOR_CHARACTER 1215 /* The prefix character to trigger a key share removal */ 1216 #define REMOVE_GROUP_INDICATOR_CHARACTER '-' 1217 #endif 1218 static const char prefixes[] = { TUPLE_DELIMITER_CHARACTER, 1219 GROUP_DELIMITER_CHARACTER, 1220 IGNORE_UNKNOWN_GROUP_CHARACTER, 1221 KEY_SHARE_INDICATOR_CHARACTER, 1222 REMOVE_GROUP_INDICATOR_CHARACTER, 1223 '\0' }; 1224 1225 /* 1226 * High-level description of how group strings are analyzed: 1227 * A first call back function (tuple_cb) is used to process group tuples, and a 1228 * second callback function (gid_cb) is used to process the groups inside a tuple. 1229 * Those callback functions are (indirectly) called by CONF_parse_list with 1230 * different separators (nominally ':' or '/'), a variable based on gid_cb_st 1231 * is used to keep track of the parsing results between the various calls 1232 */ 1233 1234 typedef struct { 1235 SSL_CTX *ctx; 1236 /* Variables to hold the three lists (groups, requested keyshares, tuple structure) */ 1237 size_t gidmax; /* The memory allocation chunk size for the group IDs */ 1238 size_t gidcnt; /* Number of groups */ 1239 uint16_t *gid_arr; /* The IDs of the supported groups (flat list) */ 1240 size_t tplmax; /* Allocated length of tuplcnt_arr */ 1241 /* 1242 * Number of *closed* (fully parsed) tuples. During parsing there is 1243 * always one additional active tuple being built, stored at index tplcnt. 1244 * tuplcnt_arr therefore always needs at least tplcnt + 1 allocated slots. 1245 */ 1246 size_t tplcnt; 1247 size_t *tuplcnt_arr; /* Per-tuple group counts; [0..tplcnt-1] closed, [tplcnt] active */ 1248 size_t ksidmax; /* The memory allocation chunk size */ 1249 size_t ksidcnt; /* Number of key shares */ 1250 uint16_t *ksid_arr; /* The IDs of the key share groups (flat list) */ 1251 /* Variable to keep state between execution of callback or helper functions */ 1252 int inner; /* Are we expanding a DEFAULT list */ 1253 int first; /* First tuple of possibly nested expansion? */ 1254 } gid_cb_st; 1255 1256 /* Forward declaration of tuple callback function */ 1257 static int tuple_cb(const char *tuple, int len, void *arg); 1258 1259 /* 1260 * Extract and process the individual groups (and their prefixes if present) 1261 * present in a tuple. Note: The argument 'elem' is a NON-\0-terminated string 1262 * and must be appended by a \0 if used as \0-terminated string 1263 */ 1264 static int gid_cb(const char *elem, int len, void *arg) 1265 { 1266 gid_cb_st *garg = arg; 1267 size_t i, j, k; 1268 uint16_t gid = 0; 1269 int found_group = 0; 1270 char etmp[GROUP_NAME_BUFFER_LENGTH]; 1271 int retval = 1; /* We assume success */ 1272 const char *current_prefix; 1273 int ignore_unknown = 0; 1274 int add_keyshare = 0; 1275 int remove_group = 0; 1276 size_t restored_prefix_index = 0; 1277 char *restored_default_group_string; 1278 int continue_while_loop = 1; 1279 1280 /* Sanity checks */ 1281 if (garg == NULL || elem == NULL || len <= 0) { 1282 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_CONFIG_VALUE); 1283 return 0; 1284 } 1285 1286 /* Check the possible prefixes (remark: Leading and trailing spaces already cleared) */ 1287 while (continue_while_loop && len > 0 1288 && ((current_prefix = strchr(prefixes, elem[0])) != NULL 1289 || OPENSSL_strncasecmp(current_prefix = (char *)DEFAULT_GROUPNAME_FIRST_CHARACTER, elem, 1) == 0)) { 1290 1291 switch (*current_prefix) { 1292 case TUPLE_DELIMITER_CHARACTER: 1293 /* tuple delimiter not allowed here -> syntax error */ 1294 return -1; 1295 break; 1296 case GROUP_DELIMITER_CHARACTER: 1297 return -1; /* Not a valid prefix for a single group name-> syntax error */ 1298 break; 1299 case KEY_SHARE_INDICATOR_CHARACTER: 1300 if (add_keyshare) 1301 return -1; /* Only single key share prefix allowed -> syntax error */ 1302 add_keyshare = 1; 1303 ++elem; 1304 --len; 1305 break; 1306 case REMOVE_GROUP_INDICATOR_CHARACTER: 1307 if (remove_group) 1308 return -1; /* Only single remove group prefix allowed -> syntax error */ 1309 remove_group = 1; 1310 ++elem; 1311 --len; 1312 break; 1313 case IGNORE_UNKNOWN_GROUP_CHARACTER: 1314 if (ignore_unknown) 1315 return -1; /* Only single ? allowed -> syntax error */ 1316 ignore_unknown = 1; 1317 ++elem; 1318 --len; 1319 break; 1320 default: 1321 /* 1322 * Check whether a DEFAULT[_XYZ] 'pseudo group' (= a built-in 1323 * list of groups) should be added 1324 */ 1325 for (i = 0; i < OSSL_NELEM(default_group_strings); i++) { 1326 if ((size_t)len == (strlen(default_group_strings[i].list_name)) 1327 && OPENSSL_strncasecmp(default_group_strings[i].list_name, elem, len) == 0) { 1328 int saved_first; 1329 1330 /* 1331 * We're asked to insert an entire list of groups from a 1332 * DEFAULT[_XYZ] 'pseudo group' which we do by 1333 * recursively calling this function (indirectly via 1334 * CONF_parse_list and tuple_cb); essentially, we treat a DEFAULT 1335 * group string like a tuple which is appended to the current tuple 1336 * rather then starting a new tuple. 1337 */ 1338 if (ignore_unknown || remove_group) 1339 return -1; /* removal or ignore not allowed here -> syntax error */ 1340 1341 /* 1342 * First, we restore any keyshare prefix in a new zero-terminated string 1343 * (if not already present) 1344 */ 1345 restored_default_group_string = OPENSSL_malloc((1 /* max prefix length */ + strlen(default_group_strings[i].group_string) + 1 /* \0 */) * sizeof(char)); 1346 if (restored_default_group_string == NULL) 1347 return 0; 1348 if (add_keyshare 1349 /* Remark: we tolerate a duplicated keyshare indicator here */ 1350 && default_group_strings[i].group_string[0] 1351 != KEY_SHARE_INDICATOR_CHARACTER) 1352 restored_default_group_string[restored_prefix_index++] = KEY_SHARE_INDICATOR_CHARACTER; 1353 1354 memcpy(restored_default_group_string + restored_prefix_index, 1355 default_group_strings[i].group_string, 1356 strlen(default_group_strings[i].group_string)); 1357 restored_default_group_string[strlen(default_group_strings[i].group_string) + restored_prefix_index] = '\0'; 1358 /* 1359 * Append first tuple of result to current tuple, and don't 1360 * terminate the last tuple until we return to a top-level 1361 * tuple_cb. 1362 */ 1363 saved_first = garg->first; 1364 garg->inner = garg->first = 1; 1365 retval = CONF_parse_list(restored_default_group_string, 1366 TUPLE_DELIMITER_CHARACTER, 1, tuple_cb, garg); 1367 garg->inner = 0; 1368 garg->first = saved_first; 1369 /* We don't need the \0-terminated string anymore */ 1370 OPENSSL_free(restored_default_group_string); 1371 1372 return retval; 1373 } 1374 } 1375 /* 1376 * If we reached this point, a group name started with a 'd' or 'D', but no request 1377 * for a DEFAULT[_XYZ] 'pseudo group' was detected, hence processing of the group 1378 * name can continue as usual (= the while loop checking prefixes can end) 1379 */ 1380 continue_while_loop = 0; 1381 break; 1382 } 1383 } 1384 1385 if (len == 0) 1386 return -1; /* Seems we have prefxes without a group name -> syntax error */ 1387 1388 /* Memory management in case more groups are present compared to initial allocation */ 1389 if (garg->gidcnt == garg->gidmax) { 1390 uint16_t *tmp = OPENSSL_realloc(garg->gid_arr, 1391 (garg->gidmax + GROUPLIST_INCREMENT) * sizeof(*garg->gid_arr)); 1392 1393 if (tmp == NULL) 1394 return 0; 1395 1396 garg->gidmax += GROUPLIST_INCREMENT; 1397 garg->gid_arr = tmp; 1398 } 1399 /* Memory management for key share groups */ 1400 if (garg->ksidcnt == garg->ksidmax) { 1401 uint16_t *tmp = OPENSSL_realloc(garg->ksid_arr, 1402 (garg->ksidmax + GROUPLIST_INCREMENT) * sizeof(*garg->ksid_arr)); 1403 1404 if (tmp == NULL) 1405 return 0; 1406 garg->ksidmax += GROUPLIST_INCREMENT; 1407 garg->ksid_arr = tmp; 1408 } 1409 1410 if (len > (int)(sizeof(etmp) - 1)) 1411 return -1; /* group name to long -> syntax error */ 1412 1413 /* 1414 * Prepare addition or removal of a single group by converting 1415 * a group name into its groupID equivalent 1416 */ 1417 1418 /* Create a \0-terminated string and get the gid for this group if possible */ 1419 memcpy(etmp, elem, len); 1420 etmp[len] = 0; 1421 1422 /* Get the groupID */ 1423 gid = tls1_group_name2id(garg->ctx, etmp); 1424 /* 1425 * Handle the case where no valid groupID was returned 1426 * e.g. for an unknown group, which we'd ignore (only) if relevant prefix was set 1427 */ 1428 if (gid == 0) { 1429 /* Is it one of the GOST groups ? */ 1430 for (i = 0; i < OSSL_NELEM(name2id_arr); i++) { 1431 if (OPENSSL_strcasecmp(etmp, name2id_arr[i].group_name) == 0) { 1432 gid = name2id_arr[i].groupID; 1433 break; 1434 } 1435 } 1436 if (gid == 0) { /* still not found */ 1437 /* Unknown group - ignore if ignore_unknown; trigger error otherwise */ 1438 retval = ignore_unknown; 1439 goto done; 1440 } 1441 } 1442 1443 /* Make sure that at least one provider is supporting this groupID */ 1444 found_group = 0; 1445 for (j = 0; j < garg->ctx->group_list_len; j++) 1446 if (garg->ctx->group_list[j].group_id == gid) { 1447 found_group = 1; 1448 break; 1449 } 1450 1451 /* 1452 * No provider supports this group - ignore if 1453 * ignore_unknown; trigger error otherwise 1454 */ 1455 if (found_group == 0) { 1456 retval = ignore_unknown; 1457 goto done; 1458 } 1459 /* Remove group (and keyshare) from anywhere in the list if present, ignore if not present */ 1460 if (remove_group) { 1461 /* Is the current group specified anywhere in the entire list so far? */ 1462 found_group = 0; 1463 for (i = 0; i < garg->gidcnt; i++) 1464 if (garg->gid_arr[i] == gid) { 1465 found_group = 1; 1466 break; 1467 } 1468 /* The group to remove is at position i in the list of (zero indexed) groups */ 1469 if (found_group) { 1470 /* We remove that group from its position (which is at i)... */ 1471 for (j = i; j < (garg->gidcnt - 1); j++) 1472 garg->gid_arr[j] = garg->gid_arr[j + 1]; /* ...shift remaining groups left ... */ 1473 garg->gidcnt--; /* ..and update the book keeping for the number of groups */ 1474 1475 /* 1476 * We also must update the number of groups either in a previous tuple (which we 1477 * must identify and check whether it becomes empty due to the deletion) or in 1478 * the current tuple, pending where the deleted group resides 1479 */ 1480 k = 0; 1481 for (j = 0; j < garg->tplcnt; j++) { 1482 k += garg->tuplcnt_arr[j]; 1483 /* Remark: i is zero-indexed, k is one-indexed */ 1484 if (k > i) { /* remove from one of the previous tuples */ 1485 garg->tuplcnt_arr[j]--; 1486 break; /* We took care not to have group duplicates, hence we can stop here */ 1487 } 1488 } 1489 if (k <= i) /* remove from current tuple */ 1490 garg->tuplcnt_arr[j]--; 1491 1492 /* We also remove the group from the list of keyshares (if present) */ 1493 found_group = 0; 1494 for (i = 0; i < garg->ksidcnt; i++) 1495 if (garg->ksid_arr[i] == gid) { 1496 found_group = 1; 1497 break; 1498 } 1499 if (found_group) { 1500 /* Found, hence we remove that keyshare from its position (which is at i)... */ 1501 for (j = i; j < (garg->ksidcnt - 1); j++) 1502 garg->ksid_arr[j] = garg->ksid_arr[j + 1]; /* shift remaining key shares */ 1503 /* ... and update the book keeping */ 1504 garg->ksidcnt--; 1505 } 1506 } 1507 } else { /* Processing addition of a single new group */ 1508 1509 /* Check for duplicates */ 1510 for (i = 0; i < garg->gidcnt; i++) 1511 if (garg->gid_arr[i] == gid) { 1512 /* Duplicate group anywhere in the list of groups - ignore */ 1513 goto done; 1514 } 1515 1516 /* Add the current group to the 'flat' list of groups */ 1517 garg->gid_arr[garg->gidcnt++] = gid; 1518 /* and update the book keeping for the number of groups in current tuple */ 1519 garg->tuplcnt_arr[garg->tplcnt]++; 1520 1521 /* We want to add a key share for the current group */ 1522 if (add_keyshare) 1523 garg->ksid_arr[garg->ksidcnt++] = gid; 1524 } 1525 1526 done: 1527 return retval; 1528 } 1529 1530 /* 1531 * Ensure tuplcnt_arr has room for at least tplcnt + 2 entries so that 1532 * close_tuple() can safely increment tplcnt and write the new active-tuple 1533 * slot at index tplcnt + 1. Must be called before that increment. 1534 */ 1535 static int grow_tuples(gid_cb_st *garg) 1536 { 1537 static size_t max_tplcnt = (~(size_t)0) / sizeof(size_t); 1538 1539 /* 1540 * Ensure we have room for at least one additional tuple. 1541 * (tplcnt + 1 are in active use). 1542 */ 1543 if (garg->tplcnt + 1 == garg->tplmax) { 1544 size_t newcnt = garg->tplmax + GROUPLIST_INCREMENT; 1545 size_t newsz = newcnt * sizeof(size_t); 1546 size_t *tmp; 1547 1548 if (newsz > max_tplcnt 1549 || (tmp = OPENSSL_realloc(garg->tuplcnt_arr, newsz)) == NULL) 1550 return 0; 1551 1552 garg->tplmax = newcnt; 1553 garg->tuplcnt_arr = tmp; 1554 } 1555 return 1; 1556 } 1557 1558 /* 1559 * Finalise the active tuple (at index tplcnt) and open a fresh one. 1560 * tplcnt is the count of closed tuples; the active tuple lives at tplcnt 1561 * throughout parsing. After this call tplcnt is incremented and the new 1562 * active tuple at the updated index is initialised to 0. 1563 * Empty tuples (gidcnt == 0) are discarded without advancing tplcnt. 1564 */ 1565 static int close_tuple(gid_cb_st *garg) 1566 { 1567 size_t gidcnt = garg->tuplcnt_arr[garg->tplcnt]; 1568 1569 if (gidcnt == 0) 1570 return 1; /* Discard empty tuple; no need to open a new slot */ 1571 1572 /* Grow before the increment: the new active slot will be at tplcnt + 1 */ 1573 if (!grow_tuples(garg)) 1574 return 0; 1575 1576 /* Promote closed tuple and initialise the new active tuple slot */ 1577 garg->tuplcnt_arr[++garg->tplcnt] = 0; 1578 return 1; 1579 } 1580 1581 /* Extract and process a tuple of groups */ 1582 static int tuple_cb(const char *tuple, int len, void *arg) 1583 { 1584 gid_cb_st *garg = arg; 1585 int retval = 1; /* We assume success */ 1586 char *restored_tuple_string; 1587 1588 /* Sanity checks */ 1589 if (garg == NULL || tuple == NULL || len <= 0) { 1590 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_CONFIG_VALUE); 1591 return 0; 1592 } 1593 1594 if (garg->inner && !garg->first && !close_tuple(garg)) 1595 return 0; 1596 garg->first = 0; 1597 1598 /* Convert to \0-terminated string */ 1599 restored_tuple_string = OPENSSL_malloc((len + 1 /* \0 */) * sizeof(char)); 1600 if (restored_tuple_string == NULL) 1601 return 0; 1602 memcpy(restored_tuple_string, tuple, len); 1603 restored_tuple_string[len] = '\0'; 1604 1605 /* Analyze group list of this tuple */ 1606 retval = CONF_parse_list(restored_tuple_string, GROUP_DELIMITER_CHARACTER, 1, gid_cb, arg); 1607 1608 /* We don't need the \o-terminated string anymore */ 1609 OPENSSL_free(restored_tuple_string); 1610 1611 if (!garg->inner && !close_tuple(garg)) 1612 return 0; 1613 return retval; 1614 } 1615 1616 /* 1617 * Set groups and prepare generation of keyshares based on a string of groupnames, 1618 * names separated by the group or the tuple delimiter, with per-group prefixes to 1619 * (1) add a key share for this group, (2) ignore the group if unknown to the current 1620 * context, (3) delete a previous occurrence of the group in the current tuple. 1621 * 1622 * The list parsing is done in two hierarchical steps: The top-level step extracts the 1623 * string of a tuple using tuple_cb, while the next lower step uses gid_cb to 1624 * parse and process the groups inside a tuple 1625 */ 1626 int tls1_set_groups_list(SSL_CTX *ctx, 1627 uint16_t **grpext, size_t *grpextlen, 1628 uint16_t **ksext, size_t *ksextlen, 1629 size_t **tplext, size_t *tplextlen, 1630 const char *str) 1631 { 1632 size_t i = 0, j; 1633 int ret = 0, parse_ret = 0; 1634 gid_cb_st gcb; 1635 1636 /* Sanity check */ 1637 if (ctx == NULL) { 1638 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); 1639 return 0; 1640 } 1641 1642 memset(&gcb, 0, sizeof(gcb)); 1643 gcb.gidmax = GROUPLIST_INCREMENT; 1644 gcb.tplmax = GROUPLIST_INCREMENT; 1645 gcb.ksidmax = GROUPLIST_INCREMENT; 1646 gcb.ctx = ctx; 1647 1648 /* Prepare initial chunks of memory for groups, tuples and keyshares groupIDs */ 1649 gcb.gid_arr = OPENSSL_malloc(gcb.gidmax * sizeof(*gcb.gid_arr)); 1650 if (gcb.gid_arr == NULL) 1651 goto end; 1652 gcb.tuplcnt_arr = OPENSSL_malloc(gcb.tplmax * sizeof(*gcb.tuplcnt_arr)); 1653 if (gcb.tuplcnt_arr == NULL) 1654 goto end; 1655 gcb.tuplcnt_arr[0] = 0; 1656 gcb.ksid_arr = OPENSSL_malloc(gcb.ksidmax * sizeof(*gcb.ksid_arr)); 1657 if (gcb.ksid_arr == NULL) 1658 goto end; 1659 1660 while (str[0] != '\0' && isspace((unsigned char)*str)) 1661 str++; 1662 if (str[0] == '\0') 1663 goto empty_list; 1664 1665 /* 1666 * Start the (potentially recursive) tuple processing by calling CONF_parse_list 1667 * with the TUPLE_DELIMITER_CHARACTER (which will call tuple_cb after cleaning spaces) 1668 */ 1669 parse_ret = CONF_parse_list(str, TUPLE_DELIMITER_CHARACTER, 1, tuple_cb, &gcb); 1670 1671 if (parse_ret == 0) 1672 goto end; 1673 if (parse_ret == -1) { 1674 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 1675 "Syntax error in '%s'", str); 1676 goto end; 1677 } 1678 1679 /* 1680 * We check whether a tuple was completely emptied by using "-" prefix 1681 * excessively, in which case we remove the tuple 1682 */ 1683 for (i = j = 0; j < gcb.tplcnt; j++) { 1684 if (gcb.tuplcnt_arr[j] == 0) 1685 continue; 1686 /* If there's a gap, move to first unfilled slot */ 1687 if (j == i) 1688 ++i; 1689 else 1690 gcb.tuplcnt_arr[i++] = gcb.tuplcnt_arr[j]; 1691 } 1692 gcb.tplcnt = i; 1693 1694 if (gcb.ksidcnt > OPENSSL_CLIENT_MAX_KEY_SHARES) { 1695 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 1696 "To many keyshares requested in '%s' (max = %d)", 1697 str, OPENSSL_CLIENT_MAX_KEY_SHARES); 1698 goto end; 1699 } 1700 1701 /* 1702 * For backward compatibility we let the rest of the code know that a key share 1703 * for the first valid group should be added if no "*" prefix was used anywhere 1704 */ 1705 if (gcb.gidcnt > 0 && gcb.ksidcnt == 0) { 1706 /* 1707 * No key share group prefix character was used, hence we indicate that a single 1708 * key share should be sent and flag that it should come from the supported_groups list 1709 */ 1710 gcb.ksidcnt = 1; 1711 gcb.ksid_arr[0] = 0; 1712 } 1713 1714 empty_list: 1715 /* 1716 * A call to tls1_set_groups_list with any of the args (other than ctx) set 1717 * to NULL only does a syntax check, hence we're done here and report success 1718 */ 1719 if (grpext == NULL || ksext == NULL || tplext == NULL || grpextlen == NULL || ksextlen == NULL || tplextlen == NULL) { 1720 ret = 1; 1721 goto end; 1722 } 1723 1724 /* 1725 * tuple_cb and gid_cb combo ensures there are no duplicates or unknown groups so we 1726 * can just go ahead and set the results (after disposing the existing) 1727 */ 1728 OPENSSL_free(*grpext); 1729 *grpext = gcb.gid_arr; 1730 *grpextlen = gcb.gidcnt; 1731 OPENSSL_free(*ksext); 1732 *ksext = gcb.ksid_arr; 1733 *ksextlen = gcb.ksidcnt; 1734 OPENSSL_free(*tplext); 1735 *tplext = gcb.tuplcnt_arr; 1736 *tplextlen = gcb.tplcnt; 1737 1738 return 1; 1739 1740 end: 1741 OPENSSL_free(gcb.gid_arr); 1742 OPENSSL_free(gcb.tuplcnt_arr); 1743 OPENSSL_free(gcb.ksid_arr); 1744 return ret; 1745 } 1746 1747 /* Check a group id matches preferences */ 1748 int tls1_check_group_id(SSL_CONNECTION *s, uint16_t group_id, 1749 int check_own_groups) 1750 { 1751 const uint16_t *groups; 1752 size_t groups_len; 1753 1754 if (group_id == 0) 1755 return 0; 1756 1757 /* Check for Suite B compliance */ 1758 if (tls1_suiteb(s) && s->s3.tmp.new_cipher != NULL) { 1759 unsigned long cid = s->s3.tmp.new_cipher->id; 1760 1761 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) { 1762 if (group_id != OSSL_TLS_GROUP_ID_secp256r1) 1763 return 0; 1764 } else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) { 1765 if (group_id != OSSL_TLS_GROUP_ID_secp384r1) 1766 return 0; 1767 } else { 1768 /* Should never happen */ 1769 return 0; 1770 } 1771 } 1772 1773 if (check_own_groups) { 1774 /* Check group is one of our preferences */ 1775 tls1_get_supported_groups(s, &groups, &groups_len); 1776 if (!tls1_in_list(group_id, groups, groups_len)) 1777 return 0; 1778 } 1779 1780 if (!tls_group_allowed(s, group_id, SSL_SECOP_CURVE_CHECK)) 1781 return 0; 1782 1783 /* For clients, nothing more to check */ 1784 if (!s->server) 1785 return 1; 1786 1787 /* Check group is one of peers preferences */ 1788 tls1_get_peer_groups(s, &groups, &groups_len); 1789 1790 /* 1791 * RFC 4492 does not require the supported elliptic curves extension 1792 * so if it is not sent we can just choose any curve. 1793 * It is invalid to send an empty list in the supported groups 1794 * extension, so groups_len == 0 always means no extension. 1795 */ 1796 if (groups_len == 0) 1797 return 1; 1798 return tls1_in_list(group_id, groups, groups_len); 1799 } 1800 1801 void tls1_get_formatlist(SSL_CONNECTION *s, const unsigned char **pformats, 1802 size_t *num_formats) 1803 { 1804 /* 1805 * If we have a custom point format list use it otherwise use default 1806 */ 1807 if (s->ext.ecpointformats) { 1808 *pformats = s->ext.ecpointformats; 1809 *num_formats = s->ext.ecpointformats_len; 1810 } else { 1811 *pformats = ecformats_default; 1812 /* For Suite B we don't support char2 fields */ 1813 if (tls1_suiteb(s)) 1814 *num_formats = sizeof(ecformats_default) - 1; 1815 else 1816 *num_formats = sizeof(ecformats_default); 1817 } 1818 } 1819 1820 /* Return group id of a key */ 1821 static uint16_t tls1_get_group_id(EVP_PKEY *pkey) 1822 { 1823 int curve_nid = ssl_get_EC_curve_nid(pkey); 1824 1825 if (curve_nid == NID_undef) 1826 return 0; 1827 return tls1_nid2group_id(curve_nid); 1828 } 1829 1830 /* 1831 * Check cert parameters compatible with extensions: currently just checks EC 1832 * certificates have compatible curves and compression. 1833 */ 1834 static int tls1_check_cert_param(SSL_CONNECTION *s, X509 *x, int check_ee_md) 1835 { 1836 uint16_t group_id; 1837 EVP_PKEY *pkey; 1838 pkey = X509_get0_pubkey(x); 1839 if (pkey == NULL) 1840 return 0; 1841 /* If not EC nothing to do */ 1842 if (!EVP_PKEY_is_a(pkey, "EC")) 1843 return 1; 1844 group_id = tls1_get_group_id(pkey); 1845 /* 1846 * For a server we allow the certificate to not be in our list of supported 1847 * groups. 1848 */ 1849 if (!tls1_check_group_id(s, group_id, !s->server)) 1850 return 0; 1851 /* 1852 * Special case for suite B. We *MUST* sign using SHA256+P-256 or 1853 * SHA384+P-384. 1854 */ 1855 if (check_ee_md && tls1_suiteb(s)) { 1856 int check_md; 1857 size_t i; 1858 1859 /* Check to see we have necessary signing algorithm */ 1860 if (group_id == OSSL_TLS_GROUP_ID_secp256r1) 1861 check_md = NID_ecdsa_with_SHA256; 1862 else if (group_id == OSSL_TLS_GROUP_ID_secp384r1) 1863 check_md = NID_ecdsa_with_SHA384; 1864 else 1865 return 0; /* Should never happen */ 1866 for (i = 0; i < s->shared_sigalgslen; i++) { 1867 if (check_md == s->shared_sigalgs[i]->sigandhash) 1868 return 1; 1869 } 1870 return 0; 1871 } 1872 return 1; 1873 } 1874 1875 /* 1876 * tls1_check_ec_tmp_key - Check EC temporary key compatibility 1877 * @s: SSL connection 1878 * @cid: Cipher ID we're considering using 1879 * 1880 * Checks that the kECDHE cipher suite we're considering using 1881 * is compatible with the client extensions. 1882 * 1883 * Returns 0 when the cipher can't be used or 1 when it can. 1884 */ 1885 int tls1_check_ec_tmp_key(SSL_CONNECTION *s, unsigned long cid) 1886 { 1887 /* If not Suite B just need a shared group */ 1888 if (!tls1_suiteb(s)) 1889 return tls1_shared_group(s, 0) != 0; 1890 /* 1891 * If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384, no other 1892 * curves permitted. 1893 */ 1894 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) 1895 return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp256r1, 1); 1896 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) 1897 return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp384r1, 1); 1898 1899 return 0; 1900 } 1901 1902 /* Default sigalg schemes */ 1903 static const uint16_t tls12_sigalgs[] = { 1904 TLSEXT_SIGALG_mldsa65, 1905 TLSEXT_SIGALG_mldsa87, 1906 TLSEXT_SIGALG_mldsa44, 1907 TLSEXT_SIGALG_ecdsa_secp256r1_sha256, 1908 TLSEXT_SIGALG_ecdsa_secp384r1_sha384, 1909 TLSEXT_SIGALG_ecdsa_secp521r1_sha512, 1910 TLSEXT_SIGALG_ed25519, 1911 TLSEXT_SIGALG_ed448, 1912 TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256, 1913 TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384, 1914 TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512, 1915 1916 TLSEXT_SIGALG_rsa_pss_pss_sha256, 1917 TLSEXT_SIGALG_rsa_pss_pss_sha384, 1918 TLSEXT_SIGALG_rsa_pss_pss_sha512, 1919 TLSEXT_SIGALG_rsa_pss_rsae_sha256, 1920 TLSEXT_SIGALG_rsa_pss_rsae_sha384, 1921 TLSEXT_SIGALG_rsa_pss_rsae_sha512, 1922 1923 TLSEXT_SIGALG_rsa_pkcs1_sha256, 1924 TLSEXT_SIGALG_rsa_pkcs1_sha384, 1925 TLSEXT_SIGALG_rsa_pkcs1_sha512, 1926 1927 TLSEXT_SIGALG_ecdsa_sha224, 1928 TLSEXT_SIGALG_ecdsa_sha1, 1929 1930 TLSEXT_SIGALG_rsa_pkcs1_sha224, 1931 TLSEXT_SIGALG_rsa_pkcs1_sha1, 1932 1933 TLSEXT_SIGALG_dsa_sha224, 1934 TLSEXT_SIGALG_dsa_sha1, 1935 1936 TLSEXT_SIGALG_dsa_sha256, 1937 TLSEXT_SIGALG_dsa_sha384, 1938 TLSEXT_SIGALG_dsa_sha512, 1939 1940 #ifndef OPENSSL_NO_GOST 1941 TLSEXT_SIGALG_gostr34102012_256_intrinsic, 1942 TLSEXT_SIGALG_gostr34102012_512_intrinsic, 1943 TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256, 1944 TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512, 1945 TLSEXT_SIGALG_gostr34102001_gostr3411, 1946 #endif 1947 }; 1948 1949 static const uint16_t suiteb_sigalgs[] = { 1950 TLSEXT_SIGALG_ecdsa_secp256r1_sha256, 1951 TLSEXT_SIGALG_ecdsa_secp384r1_sha384 1952 }; 1953 1954 static const SIGALG_LOOKUP sigalg_lookup_tbl[] = { 1955 { TLSEXT_SIGALG_ecdsa_secp256r1_sha256_name, 1956 "ECDSA+SHA256", TLSEXT_SIGALG_ecdsa_secp256r1_sha256, 1957 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 1958 NID_ecdsa_with_SHA256, NID_X9_62_prime256v1, 1, 0, 1959 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 1960 { TLSEXT_SIGALG_ecdsa_secp384r1_sha384_name, 1961 "ECDSA+SHA384", TLSEXT_SIGALG_ecdsa_secp384r1_sha384, 1962 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 1963 NID_ecdsa_with_SHA384, NID_secp384r1, 1, 0, 1964 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 1965 { TLSEXT_SIGALG_ecdsa_secp521r1_sha512_name, 1966 "ECDSA+SHA512", TLSEXT_SIGALG_ecdsa_secp521r1_sha512, 1967 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 1968 NID_ecdsa_with_SHA512, NID_secp521r1, 1, 0, 1969 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 1970 1971 { TLSEXT_SIGALG_ed25519_name, 1972 NULL, TLSEXT_SIGALG_ed25519, 1973 NID_undef, -1, EVP_PKEY_ED25519, SSL_PKEY_ED25519, 1974 NID_undef, NID_undef, 1, 0, 1975 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 1976 { TLSEXT_SIGALG_ed448_name, 1977 NULL, TLSEXT_SIGALG_ed448, 1978 NID_undef, -1, EVP_PKEY_ED448, SSL_PKEY_ED448, 1979 NID_undef, NID_undef, 1, 0, 1980 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 1981 1982 { TLSEXT_SIGALG_ecdsa_sha224_name, 1983 "ECDSA+SHA224", TLSEXT_SIGALG_ecdsa_sha224, 1984 NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 1985 NID_ecdsa_with_SHA224, NID_undef, 1, 0, 1986 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 1987 { TLSEXT_SIGALG_ecdsa_sha1_name, 1988 "ECDSA+SHA1", TLSEXT_SIGALG_ecdsa_sha1, 1989 NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 1990 NID_ecdsa_with_SHA1, NID_undef, 1, 0, 1991 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 1992 1993 { TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256_name, 1994 TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256_alias, 1995 TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256, 1996 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 1997 NID_ecdsa_with_SHA256, NID_brainpoolP256r1, 1, 0, 1998 TLS1_3_VERSION, 0, -1, -1 }, 1999 { TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384_name, 2000 TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384_alias, 2001 TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384, 2002 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 2003 NID_ecdsa_with_SHA384, NID_brainpoolP384r1, 1, 0, 2004 TLS1_3_VERSION, 0, -1, -1 }, 2005 { TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512_name, 2006 TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512_alias, 2007 TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512, 2008 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC, 2009 NID_ecdsa_with_SHA512, NID_brainpoolP512r1, 1, 0, 2010 TLS1_3_VERSION, 0, -1, -1 }, 2011 2012 { TLSEXT_SIGALG_rsa_pss_rsae_sha256_name, 2013 "PSS+SHA256", TLSEXT_SIGALG_rsa_pss_rsae_sha256, 2014 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA, 2015 NID_undef, NID_undef, 1, 0, 2016 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2017 { TLSEXT_SIGALG_rsa_pss_rsae_sha384_name, 2018 "PSS+SHA384", TLSEXT_SIGALG_rsa_pss_rsae_sha384, 2019 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA, 2020 NID_undef, NID_undef, 1, 0, 2021 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2022 { TLSEXT_SIGALG_rsa_pss_rsae_sha512_name, 2023 "PSS+SHA512", TLSEXT_SIGALG_rsa_pss_rsae_sha512, 2024 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA, 2025 NID_undef, NID_undef, 1, 0, 2026 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2027 2028 { TLSEXT_SIGALG_rsa_pss_pss_sha256_name, 2029 NULL, TLSEXT_SIGALG_rsa_pss_pss_sha256, 2030 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN, 2031 NID_undef, NID_undef, 1, 0, 2032 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2033 { TLSEXT_SIGALG_rsa_pss_pss_sha384_name, 2034 NULL, TLSEXT_SIGALG_rsa_pss_pss_sha384, 2035 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN, 2036 NID_undef, NID_undef, 1, 0, 2037 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2038 { TLSEXT_SIGALG_rsa_pss_pss_sha512_name, 2039 NULL, TLSEXT_SIGALG_rsa_pss_pss_sha512, 2040 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN, 2041 NID_undef, NID_undef, 1, 0, 2042 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2043 2044 { TLSEXT_SIGALG_rsa_pkcs1_sha256_name, 2045 "RSA+SHA256", TLSEXT_SIGALG_rsa_pkcs1_sha256, 2046 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA, 2047 NID_sha256WithRSAEncryption, NID_undef, 1, 0, 2048 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2049 { TLSEXT_SIGALG_rsa_pkcs1_sha384_name, 2050 "RSA+SHA384", TLSEXT_SIGALG_rsa_pkcs1_sha384, 2051 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA, 2052 NID_sha384WithRSAEncryption, NID_undef, 1, 0, 2053 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2054 { TLSEXT_SIGALG_rsa_pkcs1_sha512_name, 2055 "RSA+SHA512", TLSEXT_SIGALG_rsa_pkcs1_sha512, 2056 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA, 2057 NID_sha512WithRSAEncryption, NID_undef, 1, 0, 2058 TLS1_2_VERSION, 0, DTLS1_2_VERSION, 0 }, 2059 2060 { TLSEXT_SIGALG_rsa_pkcs1_sha224_name, 2061 "RSA+SHA224", TLSEXT_SIGALG_rsa_pkcs1_sha224, 2062 NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA, 2063 NID_sha224WithRSAEncryption, NID_undef, 1, 0, 2064 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2065 { TLSEXT_SIGALG_rsa_pkcs1_sha1_name, 2066 "RSA+SHA1", TLSEXT_SIGALG_rsa_pkcs1_sha1, 2067 NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA, 2068 NID_sha1WithRSAEncryption, NID_undef, 1, 0, 2069 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2070 2071 { TLSEXT_SIGALG_dsa_sha256_name, 2072 "DSA+SHA256", TLSEXT_SIGALG_dsa_sha256, 2073 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN, 2074 NID_dsa_with_SHA256, NID_undef, 1, 0, 2075 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2076 { TLSEXT_SIGALG_dsa_sha384_name, 2077 "DSA+SHA384", TLSEXT_SIGALG_dsa_sha384, 2078 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN, 2079 NID_undef, NID_undef, 1, 0, 2080 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2081 { TLSEXT_SIGALG_dsa_sha512_name, 2082 "DSA+SHA512", TLSEXT_SIGALG_dsa_sha512, 2083 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN, 2084 NID_undef, NID_undef, 1, 0, 2085 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2086 { TLSEXT_SIGALG_dsa_sha224_name, 2087 "DSA+SHA224", TLSEXT_SIGALG_dsa_sha224, 2088 NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN, 2089 NID_undef, NID_undef, 1, 0, 2090 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2091 { TLSEXT_SIGALG_dsa_sha1_name, 2092 "DSA+SHA1", TLSEXT_SIGALG_dsa_sha1, 2093 NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN, 2094 NID_dsaWithSHA1, NID_undef, 1, 0, 2095 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2096 2097 #ifndef OPENSSL_NO_GOST 2098 { TLSEXT_SIGALG_gostr34102012_256_intrinsic_alias, /* RFC9189 */ 2099 TLSEXT_SIGALG_gostr34102012_256_intrinsic_name, 2100 TLSEXT_SIGALG_gostr34102012_256_intrinsic, 2101 NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX, 2102 NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256, 2103 NID_undef, NID_undef, 1, 0, 2104 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2105 { TLSEXT_SIGALG_gostr34102012_256_intrinsic_alias, /* RFC9189 */ 2106 TLSEXT_SIGALG_gostr34102012_256_intrinsic_name, 2107 TLSEXT_SIGALG_gostr34102012_512_intrinsic, 2108 NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX, 2109 NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512, 2110 NID_undef, NID_undef, 1, 0, 2111 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2112 2113 { TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256_name, 2114 NULL, TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256, 2115 NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX, 2116 NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256, 2117 NID_undef, NID_undef, 1, 0, 2118 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2119 { TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512_name, 2120 NULL, TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512, 2121 NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX, 2122 NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512, 2123 NID_undef, NID_undef, 1, 0, 2124 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2125 { TLSEXT_SIGALG_gostr34102001_gostr3411_name, 2126 NULL, TLSEXT_SIGALG_gostr34102001_gostr3411, 2127 NID_id_GostR3411_94, SSL_MD_GOST94_IDX, 2128 NID_id_GostR3410_2001, SSL_PKEY_GOST01, 2129 NID_undef, NID_undef, 1, 0, 2130 TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION }, 2131 #endif 2132 }; 2133 /* Legacy sigalgs for TLS < 1.2 RSA TLS signatures */ 2134 static const SIGALG_LOOKUP legacy_rsa_sigalg = { 2135 "rsa_pkcs1_md5_sha1", NULL, 0, 2136 NID_md5_sha1, SSL_MD_MD5_SHA1_IDX, 2137 EVP_PKEY_RSA, SSL_PKEY_RSA, 2138 NID_undef, NID_undef, 1, 0, 2139 TLS1_VERSION, TLS1_2_VERSION, DTLS1_VERSION, DTLS1_2_VERSION 2140 }; 2141 2142 /* 2143 * Default signature algorithm values used if signature algorithms not present. 2144 * From RFC5246. Note: order must match certificate index order. 2145 */ 2146 static const uint16_t tls_default_sigalg[] = { 2147 TLSEXT_SIGALG_rsa_pkcs1_sha1, /* SSL_PKEY_RSA */ 2148 0, /* SSL_PKEY_RSA_PSS_SIGN */ 2149 TLSEXT_SIGALG_dsa_sha1, /* SSL_PKEY_DSA_SIGN */ 2150 TLSEXT_SIGALG_ecdsa_sha1, /* SSL_PKEY_ECC */ 2151 TLSEXT_SIGALG_gostr34102001_gostr3411, /* SSL_PKEY_GOST01 */ 2152 TLSEXT_SIGALG_gostr34102012_256_intrinsic, /* SSL_PKEY_GOST12_256 */ 2153 TLSEXT_SIGALG_gostr34102012_512_intrinsic, /* SSL_PKEY_GOST12_512 */ 2154 0, /* SSL_PKEY_ED25519 */ 2155 0, /* SSL_PKEY_ED448 */ 2156 }; 2157 2158 int ssl_setup_sigalgs(SSL_CTX *ctx) 2159 { 2160 size_t i, cache_idx, sigalgs_len, enabled; 2161 const SIGALG_LOOKUP *lu; 2162 SIGALG_LOOKUP *cache = NULL; 2163 uint16_t *tls12_sigalgs_list = NULL; 2164 EVP_PKEY *tmpkey = EVP_PKEY_new(); 2165 int istls; 2166 int ret = 0; 2167 2168 if (ctx == NULL) 2169 goto err; 2170 2171 istls = !SSL_CTX_IS_DTLS(ctx); 2172 2173 sigalgs_len = OSSL_NELEM(sigalg_lookup_tbl) + ctx->sigalg_list_len; 2174 2175 cache = OPENSSL_zalloc(sizeof(const SIGALG_LOOKUP) * sigalgs_len); 2176 if (cache == NULL || tmpkey == NULL) 2177 goto err; 2178 2179 tls12_sigalgs_list = OPENSSL_zalloc(sizeof(uint16_t) * sigalgs_len); 2180 if (tls12_sigalgs_list == NULL) 2181 goto err; 2182 2183 ERR_set_mark(); 2184 /* First fill cache and tls12_sigalgs list from legacy algorithm list */ 2185 for (i = 0, lu = sigalg_lookup_tbl; 2186 i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) { 2187 EVP_PKEY_CTX *pctx; 2188 2189 cache[i] = *lu; 2190 2191 /* 2192 * Check hash is available. 2193 * This test is not perfect. A provider could have support 2194 * for a signature scheme, but not a particular hash. However the hash 2195 * could be available from some other loaded provider. In that case it 2196 * could be that the signature is available, and the hash is available 2197 * independently - but not as a combination. We ignore this for now. 2198 */ 2199 if (lu->hash != NID_undef 2200 && ctx->ssl_digest_methods[lu->hash_idx] == NULL) { 2201 cache[i].available = 0; 2202 continue; 2203 } 2204 2205 if (!EVP_PKEY_set_type(tmpkey, lu->sig)) { 2206 cache[i].available = 0; 2207 continue; 2208 } 2209 pctx = EVP_PKEY_CTX_new_from_pkey(ctx->libctx, tmpkey, ctx->propq); 2210 /* If unable to create pctx we assume the sig algorithm is unavailable */ 2211 if (pctx == NULL) 2212 cache[i].available = 0; 2213 EVP_PKEY_CTX_free(pctx); 2214 } 2215 2216 /* Now complete cache and tls12_sigalgs list with provider sig information */ 2217 cache_idx = OSSL_NELEM(sigalg_lookup_tbl); 2218 for (i = 0; i < ctx->sigalg_list_len; i++) { 2219 TLS_SIGALG_INFO si = ctx->sigalg_list[i]; 2220 cache[cache_idx].name = si.name; 2221 cache[cache_idx].name12 = si.sigalg_name; 2222 cache[cache_idx].sigalg = si.code_point; 2223 tls12_sigalgs_list[cache_idx] = si.code_point; 2224 cache[cache_idx].hash = si.hash_name ? OBJ_txt2nid(si.hash_name) : NID_undef; 2225 cache[cache_idx].hash_idx = ssl_get_md_idx(cache[cache_idx].hash); 2226 cache[cache_idx].sig = OBJ_txt2nid(si.sigalg_name); 2227 cache[cache_idx].sig_idx = i + SSL_PKEY_NUM; 2228 cache[cache_idx].sigandhash = OBJ_txt2nid(si.sigalg_name); 2229 cache[cache_idx].curve = NID_undef; 2230 cache[cache_idx].mintls = TLS1_3_VERSION; 2231 cache[cache_idx].maxtls = TLS1_3_VERSION; 2232 cache[cache_idx].mindtls = -1; 2233 cache[cache_idx].maxdtls = -1; 2234 /* Compatibility with TLS 1.3 is checked on load */ 2235 cache[cache_idx].available = istls; 2236 cache[cache_idx].advertise = 0; 2237 cache_idx++; 2238 } 2239 ERR_pop_to_mark(); 2240 2241 enabled = 0; 2242 for (i = 0; i < OSSL_NELEM(tls12_sigalgs); ++i) { 2243 SIGALG_LOOKUP *ent = cache; 2244 size_t j; 2245 2246 for (j = 0; j < sigalgs_len; ent++, j++) { 2247 if (ent->sigalg != tls12_sigalgs[i]) 2248 continue; 2249 /* Dedup by marking cache entry as default enabled. */ 2250 if (ent->available && !ent->advertise) { 2251 ent->advertise = 1; 2252 tls12_sigalgs_list[enabled++] = tls12_sigalgs[i]; 2253 } 2254 break; 2255 } 2256 } 2257 2258 /* Append any provider sigalgs not yet handled */ 2259 for (i = OSSL_NELEM(sigalg_lookup_tbl); i < sigalgs_len; ++i) { 2260 SIGALG_LOOKUP *ent = &cache[i]; 2261 2262 if (ent->available && !ent->advertise) 2263 tls12_sigalgs_list[enabled++] = ent->sigalg; 2264 } 2265 2266 ctx->sigalg_lookup_cache = cache; 2267 ctx->sigalg_lookup_cache_len = sigalgs_len; 2268 ctx->tls12_sigalgs = tls12_sigalgs_list; 2269 ctx->tls12_sigalgs_len = enabled; 2270 cache = NULL; 2271 tls12_sigalgs_list = NULL; 2272 2273 ret = 1; 2274 err: 2275 OPENSSL_free(cache); 2276 OPENSSL_free(tls12_sigalgs_list); 2277 EVP_PKEY_free(tmpkey); 2278 return ret; 2279 } 2280 2281 #define SIGLEN_BUF_INCREMENT 100 2282 2283 char *SSL_get1_builtin_sigalgs(OSSL_LIB_CTX *libctx) 2284 { 2285 size_t i, maxretlen = SIGLEN_BUF_INCREMENT; 2286 const SIGALG_LOOKUP *lu; 2287 EVP_PKEY *tmpkey = EVP_PKEY_new(); 2288 char *retval = OPENSSL_malloc(maxretlen); 2289 2290 if (retval == NULL) 2291 return NULL; 2292 2293 /* ensure retval string is NUL terminated */ 2294 retval[0] = (char)0; 2295 2296 for (i = 0, lu = sigalg_lookup_tbl; 2297 i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) { 2298 EVP_PKEY_CTX *pctx; 2299 int enabled = 1; 2300 2301 ERR_set_mark(); 2302 /* Check hash is available in some provider. */ 2303 if (lu->hash != NID_undef) { 2304 EVP_MD *hash = EVP_MD_fetch(libctx, OBJ_nid2ln(lu->hash), NULL); 2305 2306 /* If unable to create we assume the hash algorithm is unavailable */ 2307 if (hash == NULL) { 2308 enabled = 0; 2309 ERR_pop_to_mark(); 2310 continue; 2311 } 2312 EVP_MD_free(hash); 2313 } 2314 2315 if (!EVP_PKEY_set_type(tmpkey, lu->sig)) { 2316 enabled = 0; 2317 ERR_pop_to_mark(); 2318 continue; 2319 } 2320 pctx = EVP_PKEY_CTX_new_from_pkey(libctx, tmpkey, NULL); 2321 /* If unable to create pctx we assume the sig algorithm is unavailable */ 2322 if (pctx == NULL) 2323 enabled = 0; 2324 ERR_pop_to_mark(); 2325 EVP_PKEY_CTX_free(pctx); 2326 2327 if (enabled) { 2328 const char *sa = lu->name; 2329 2330 if (sa != NULL) { 2331 if (strlen(sa) + strlen(retval) + 1 >= maxretlen) { 2332 char *tmp; 2333 2334 maxretlen += SIGLEN_BUF_INCREMENT; 2335 tmp = OPENSSL_realloc(retval, maxretlen); 2336 if (tmp == NULL) { 2337 OPENSSL_free(retval); 2338 return NULL; 2339 } 2340 retval = tmp; 2341 } 2342 if (strlen(retval) > 0) 2343 OPENSSL_strlcat(retval, ":", maxretlen); 2344 OPENSSL_strlcat(retval, sa, maxretlen); 2345 } else { 2346 /* lu->name must not be NULL */ 2347 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 2348 } 2349 } 2350 } 2351 2352 EVP_PKEY_free(tmpkey); 2353 return retval; 2354 } 2355 2356 /* Lookup TLS signature algorithm */ 2357 static const SIGALG_LOOKUP *tls1_lookup_sigalg(const SSL_CTX *ctx, 2358 uint16_t sigalg) 2359 { 2360 size_t i; 2361 const SIGALG_LOOKUP *lu = ctx->sigalg_lookup_cache; 2362 2363 for (i = 0; i < ctx->sigalg_lookup_cache_len; lu++, i++) { 2364 if (lu->sigalg == sigalg) { 2365 if (!lu->available) 2366 return NULL; 2367 return lu; 2368 } 2369 } 2370 return NULL; 2371 } 2372 2373 /* Lookup hash: return 0 if invalid or not enabled */ 2374 int tls1_lookup_md(SSL_CTX *ctx, const SIGALG_LOOKUP *lu, const EVP_MD **pmd) 2375 { 2376 const EVP_MD *md; 2377 2378 if (lu == NULL) 2379 return 0; 2380 /* lu->hash == NID_undef means no associated digest */ 2381 if (lu->hash == NID_undef) { 2382 md = NULL; 2383 } else { 2384 md = ssl_md(ctx, lu->hash_idx); 2385 if (md == NULL) 2386 return 0; 2387 } 2388 if (pmd) 2389 *pmd = md; 2390 return 1; 2391 } 2392 2393 /* 2394 * Check if key is large enough to generate RSA-PSS signature. 2395 * 2396 * The key must greater than or equal to 2 * hash length + 2. 2397 * SHA512 has a hash length of 64 bytes, which is incompatible 2398 * with a 128 byte (1024 bit) key. 2399 */ 2400 #define RSA_PSS_MINIMUM_KEY_SIZE(md) (2 * EVP_MD_get_size(md) + 2) 2401 static int rsa_pss_check_min_key_size(SSL_CTX *ctx, const EVP_PKEY *pkey, 2402 const SIGALG_LOOKUP *lu) 2403 { 2404 const EVP_MD *md; 2405 2406 if (pkey == NULL) 2407 return 0; 2408 if (!tls1_lookup_md(ctx, lu, &md) || md == NULL) 2409 return 0; 2410 if (EVP_MD_get_size(md) <= 0) 2411 return 0; 2412 if (EVP_PKEY_get_size(pkey) < RSA_PSS_MINIMUM_KEY_SIZE(md)) 2413 return 0; 2414 return 1; 2415 } 2416 2417 /* 2418 * Returns a signature algorithm when the peer did not send a list of supported 2419 * signature algorithms. The signature algorithm is fixed for the certificate 2420 * type. |idx| is a certificate type index (SSL_PKEY_*). When |idx| is -1 the 2421 * certificate type from |s| will be used. 2422 * Returns the signature algorithm to use, or NULL on error. 2423 */ 2424 static const SIGALG_LOOKUP *tls1_get_legacy_sigalg(const SSL_CONNECTION *s, 2425 int idx) 2426 { 2427 if (idx == -1) { 2428 if (s->server) { 2429 size_t i; 2430 2431 /* Work out index corresponding to ciphersuite */ 2432 for (i = 0; i < s->ssl_pkey_num; i++) { 2433 const SSL_CERT_LOOKUP *clu 2434 = ssl_cert_lookup_by_idx(i, SSL_CONNECTION_GET_CTX(s)); 2435 2436 if (clu == NULL) 2437 continue; 2438 if (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) { 2439 idx = i; 2440 break; 2441 } 2442 } 2443 2444 /* 2445 * Some GOST ciphersuites allow more than one signature algorithms 2446 * */ 2447 if (idx == SSL_PKEY_GOST01 && s->s3.tmp.new_cipher->algorithm_auth != SSL_aGOST01) { 2448 int real_idx; 2449 2450 for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01; 2451 real_idx--) { 2452 if (s->cert->pkeys[real_idx].privatekey != NULL) { 2453 idx = real_idx; 2454 break; 2455 } 2456 } 2457 } 2458 /* 2459 * As both SSL_PKEY_GOST12_512 and SSL_PKEY_GOST12_256 indices can be used 2460 * with new (aGOST12-only) ciphersuites, we should find out which one is available really. 2461 */ 2462 else if (idx == SSL_PKEY_GOST12_256) { 2463 int real_idx; 2464 2465 for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST12_256; 2466 real_idx--) { 2467 if (s->cert->pkeys[real_idx].privatekey != NULL) { 2468 idx = real_idx; 2469 break; 2470 } 2471 } 2472 } 2473 } else { 2474 idx = s->cert->key - s->cert->pkeys; 2475 } 2476 } 2477 if (idx < 0 || idx >= (int)OSSL_NELEM(tls_default_sigalg)) 2478 return NULL; 2479 2480 if (SSL_USE_SIGALGS(s) || idx != SSL_PKEY_RSA) { 2481 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), 2482 tls_default_sigalg[idx]); 2483 2484 if (lu == NULL) 2485 return NULL; 2486 if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, NULL)) 2487 return NULL; 2488 if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu)) 2489 return NULL; 2490 return lu; 2491 } 2492 if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, &legacy_rsa_sigalg)) 2493 return NULL; 2494 return &legacy_rsa_sigalg; 2495 } 2496 /* Set peer sigalg based key type */ 2497 int tls1_set_peer_legacy_sigalg(SSL_CONNECTION *s, const EVP_PKEY *pkey) 2498 { 2499 size_t idx; 2500 const SIGALG_LOOKUP *lu; 2501 2502 if (ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)) == NULL) 2503 return 0; 2504 lu = tls1_get_legacy_sigalg(s, idx); 2505 if (lu == NULL) 2506 return 0; 2507 s->s3.tmp.peer_sigalg = lu; 2508 return 1; 2509 } 2510 2511 size_t tls12_get_psigalgs(SSL_CONNECTION *s, int sent, const uint16_t **psigs) 2512 { 2513 /* 2514 * If Suite B mode use Suite B sigalgs only, ignore any other 2515 * preferences. 2516 */ 2517 switch (tls1_suiteb(s)) { 2518 case SSL_CERT_FLAG_SUITEB_128_LOS: 2519 *psigs = suiteb_sigalgs; 2520 return OSSL_NELEM(suiteb_sigalgs); 2521 2522 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY: 2523 *psigs = suiteb_sigalgs; 2524 return 1; 2525 2526 case SSL_CERT_FLAG_SUITEB_192_LOS: 2527 *psigs = suiteb_sigalgs + 1; 2528 return 1; 2529 } 2530 /* 2531 * We use client_sigalgs (if not NULL) if we're a server 2532 * and sending a certificate request or if we're a client and 2533 * determining which shared algorithm to use. 2534 */ 2535 if ((s->server == sent) && s->cert->client_sigalgs != NULL) { 2536 *psigs = s->cert->client_sigalgs; 2537 return s->cert->client_sigalgslen; 2538 } else if (s->cert->conf_sigalgs) { 2539 *psigs = s->cert->conf_sigalgs; 2540 return s->cert->conf_sigalgslen; 2541 } else { 2542 *psigs = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs; 2543 return SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len; 2544 } 2545 } 2546 2547 /* 2548 * Called by servers only. Checks that we have a sig alg that supports the 2549 * specified EC curve. 2550 */ 2551 int tls_check_sigalg_curve(const SSL_CONNECTION *s, int curve) 2552 { 2553 const uint16_t *sigs; 2554 size_t siglen, i; 2555 2556 if (s->cert->conf_sigalgs) { 2557 sigs = s->cert->conf_sigalgs; 2558 siglen = s->cert->conf_sigalgslen; 2559 } else { 2560 sigs = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs; 2561 siglen = SSL_CONNECTION_GET_CTX(s)->tls12_sigalgs_len; 2562 } 2563 2564 for (i = 0; i < siglen; i++) { 2565 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), sigs[i]); 2566 2567 if (lu == NULL) 2568 continue; 2569 if (lu->sig == EVP_PKEY_EC 2570 && lu->curve != NID_undef 2571 && curve == lu->curve) 2572 return 1; 2573 } 2574 2575 return 0; 2576 } 2577 2578 /* 2579 * Return the number of security bits for the signature algorithm, or 0 on 2580 * error. 2581 */ 2582 static int sigalg_security_bits(SSL_CTX *ctx, const SIGALG_LOOKUP *lu) 2583 { 2584 const EVP_MD *md = NULL; 2585 int secbits = 0; 2586 2587 if (!tls1_lookup_md(ctx, lu, &md)) 2588 return 0; 2589 if (md != NULL) { 2590 int md_type = EVP_MD_get_type(md); 2591 2592 /* Security bits: half digest bits */ 2593 secbits = EVP_MD_get_size(md) * 4; 2594 if (secbits <= 0) 2595 return 0; 2596 /* 2597 * SHA1 and MD5 are known to be broken. Reduce security bits so that 2598 * they're no longer accepted at security level 1. The real values don't 2599 * really matter as long as they're lower than 80, which is our 2600 * security level 1. 2601 * https://eprint.iacr.org/2020/014 puts a chosen-prefix attack for 2602 * SHA1 at 2^63.4 and MD5+SHA1 at 2^67.2 2603 * https://documents.epfl.ch/users/l/le/lenstra/public/papers/lat.pdf 2604 * puts a chosen-prefix attack for MD5 at 2^39. 2605 */ 2606 if (md_type == NID_sha1) 2607 secbits = 64; 2608 else if (md_type == NID_md5_sha1) 2609 secbits = 67; 2610 else if (md_type == NID_md5) 2611 secbits = 39; 2612 } else { 2613 /* Values from https://tools.ietf.org/html/rfc8032#section-8.5 */ 2614 if (lu->sigalg == TLSEXT_SIGALG_ed25519) 2615 secbits = 128; 2616 else if (lu->sigalg == TLSEXT_SIGALG_ed448) 2617 secbits = 224; 2618 } 2619 /* 2620 * For provider-based sigalgs we have secbits information available 2621 * in the (provider-loaded) sigalg_list structure 2622 */ 2623 if ((secbits == 0) && (lu->sig_idx >= SSL_PKEY_NUM) 2624 && ((lu->sig_idx - SSL_PKEY_NUM) < (int)ctx->sigalg_list_len)) { 2625 secbits = ctx->sigalg_list[lu->sig_idx - SSL_PKEY_NUM].secbits; 2626 } 2627 return secbits; 2628 } 2629 2630 static int tls_sigalg_compat(SSL_CONNECTION *sc, const SIGALG_LOOKUP *lu) 2631 { 2632 int minversion, maxversion; 2633 int minproto, maxproto; 2634 2635 if (!lu->available) 2636 return 0; 2637 2638 if (SSL_CONNECTION_IS_DTLS(sc)) { 2639 if (sc->ssl.method->version == DTLS_ANY_VERSION) { 2640 minproto = sc->min_proto_version; 2641 maxproto = sc->max_proto_version; 2642 } else { 2643 maxproto = minproto = sc->version; 2644 } 2645 minversion = lu->mindtls; 2646 maxversion = lu->maxdtls; 2647 } else { 2648 if (sc->ssl.method->version == TLS_ANY_VERSION) { 2649 minproto = sc->min_proto_version; 2650 maxproto = sc->max_proto_version; 2651 } else { 2652 maxproto = minproto = sc->version; 2653 } 2654 minversion = lu->mintls; 2655 maxversion = lu->maxtls; 2656 } 2657 if (minversion == -1 || maxversion == -1 2658 || (minversion != 0 && maxproto != 0 2659 && ssl_version_cmp(sc, minversion, maxproto) > 0) 2660 || (maxversion != 0 && minproto != 0 2661 && ssl_version_cmp(sc, maxversion, minproto) < 0) 2662 || !tls12_sigalg_allowed(sc, SSL_SECOP_SIGALG_SUPPORTED, lu)) 2663 return 0; 2664 return 1; 2665 } 2666 2667 /* 2668 * Check signature algorithm is consistent with sent supported signature 2669 * algorithms and if so set relevant digest and signature scheme in 2670 * s. 2671 */ 2672 int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey) 2673 { 2674 const uint16_t *sent_sigs; 2675 const EVP_MD *md = NULL; 2676 char sigalgstr[2]; 2677 size_t sent_sigslen, i, cidx; 2678 int pkeyid = -1; 2679 const SIGALG_LOOKUP *lu; 2680 int secbits = 0; 2681 2682 pkeyid = EVP_PKEY_get_id(pkey); 2683 2684 if (SSL_CONNECTION_IS_TLS13(s)) { 2685 /* Disallow DSA for TLS 1.3 */ 2686 if (pkeyid == EVP_PKEY_DSA) { 2687 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE); 2688 return 0; 2689 } 2690 /* Only allow PSS for TLS 1.3 */ 2691 if (pkeyid == EVP_PKEY_RSA) 2692 pkeyid = EVP_PKEY_RSA_PSS; 2693 } 2694 2695 /* Is this code point available and compatible with the protocol */ 2696 lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), sig); 2697 if (lu == NULL || !tls_sigalg_compat(s, lu)) { 2698 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE); 2699 return 0; 2700 } 2701 2702 /* If we don't know the pkey nid yet go and find it */ 2703 if (pkeyid == EVP_PKEY_KEYMGMT) { 2704 const SSL_CERT_LOOKUP *scl = ssl_cert_lookup_by_pkey(pkey, NULL, SSL_CONNECTION_GET_CTX(s)); 2705 2706 if (scl == NULL) { 2707 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE); 2708 return 0; 2709 } 2710 pkeyid = scl->pkey_nid; 2711 } 2712 2713 /* Should never happen */ 2714 if (pkeyid == -1) { 2715 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE); 2716 return -1; 2717 } 2718 2719 /* 2720 * Check sigalgs is known. Disallow SHA1/SHA224 with TLS 1.3. Check key type 2721 * is consistent with signature: RSA keys can be used for RSA-PSS 2722 */ 2723 if ((SSL_CONNECTION_IS_TLS13(s) 2724 && (lu->hash == NID_sha1 || lu->hash == NID_sha224)) 2725 || (pkeyid != lu->sig 2726 && (lu->sig != EVP_PKEY_RSA_PSS || pkeyid != EVP_PKEY_RSA))) { 2727 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE); 2728 return 0; 2729 } 2730 /* Check the sigalg is consistent with the key OID */ 2731 if (!ssl_cert_lookup_by_nid( 2732 (pkeyid == EVP_PKEY_RSA_PSS) ? EVP_PKEY_get_id(pkey) : pkeyid, 2733 &cidx, SSL_CONNECTION_GET_CTX(s)) 2734 || lu->sig_idx != (int)cidx) { 2735 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE); 2736 return 0; 2737 } 2738 2739 if (pkeyid == EVP_PKEY_EC) { 2740 2741 /* For TLS 1.3 or Suite B check curve matches signature algorithm */ 2742 if (SSL_CONNECTION_IS_TLS13(s) || tls1_suiteb(s)) { 2743 int curve = ssl_get_EC_curve_nid(pkey); 2744 2745 if (lu->curve != NID_undef && curve != lu->curve) { 2746 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE); 2747 return 0; 2748 } 2749 } 2750 if (!SSL_CONNECTION_IS_TLS13(s)) { 2751 /* Check curve matches extensions */ 2752 if (!tls1_check_group_id(s, tls1_get_group_id(pkey), 1)) { 2753 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE); 2754 return 0; 2755 } 2756 if (tls1_suiteb(s)) { 2757 /* Check sigalg matches a permissible Suite B value */ 2758 if (sig != TLSEXT_SIGALG_ecdsa_secp256r1_sha256 2759 && sig != TLSEXT_SIGALG_ecdsa_secp384r1_sha384) { 2760 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 2761 SSL_R_WRONG_SIGNATURE_TYPE); 2762 return 0; 2763 } 2764 } 2765 } 2766 } else if (tls1_suiteb(s)) { 2767 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE); 2768 return 0; 2769 } 2770 2771 /* Check signature matches a type we sent */ 2772 sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs); 2773 for (i = 0; i < sent_sigslen; i++, sent_sigs++) { 2774 if (sig == *sent_sigs) 2775 break; 2776 } 2777 /* Allow fallback to SHA1 if not strict mode */ 2778 if (i == sent_sigslen && (lu->hash != NID_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)) { 2779 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE); 2780 return 0; 2781 } 2782 if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, &md)) { 2783 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST); 2784 return 0; 2785 } 2786 /* 2787 * Make sure security callback allows algorithm. For historical 2788 * reasons we have to pass the sigalg as a two byte char array. 2789 */ 2790 sigalgstr[0] = (sig >> 8) & 0xff; 2791 sigalgstr[1] = sig & 0xff; 2792 secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu); 2793 if (secbits == 0 || !ssl_security(s, SSL_SECOP_SIGALG_CHECK, secbits, md != NULL ? EVP_MD_get_type(md) : NID_undef, (void *)sigalgstr)) { 2794 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE); 2795 return 0; 2796 } 2797 /* Store the sigalg the peer uses */ 2798 s->s3.tmp.peer_sigalg = lu; 2799 return 1; 2800 } 2801 2802 int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid) 2803 { 2804 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 2805 2806 if (sc == NULL) 2807 return 0; 2808 2809 if (sc->s3.tmp.peer_sigalg == NULL) 2810 return 0; 2811 *pnid = sc->s3.tmp.peer_sigalg->sig; 2812 return 1; 2813 } 2814 2815 int SSL_get_signature_type_nid(const SSL *s, int *pnid) 2816 { 2817 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 2818 2819 if (sc == NULL) 2820 return 0; 2821 2822 if (sc->s3.tmp.sigalg == NULL) 2823 return 0; 2824 *pnid = sc->s3.tmp.sigalg->sig; 2825 return 1; 2826 } 2827 2828 /* 2829 * Set a mask of disabled algorithms: an algorithm is disabled if it isn't 2830 * supported, doesn't appear in supported signature algorithms, isn't supported 2831 * by the enabled protocol versions or by the security level. 2832 * 2833 * This function should only be used for checking which ciphers are supported 2834 * by the client. 2835 * 2836 * Call ssl_cipher_disabled() to check that it's enabled or not. 2837 */ 2838 int ssl_set_client_disabled(SSL_CONNECTION *s) 2839 { 2840 s->s3.tmp.mask_a = 0; 2841 s->s3.tmp.mask_k = 0; 2842 ssl_set_sig_mask(&s->s3.tmp.mask_a, s, SSL_SECOP_SIGALG_MASK); 2843 if (ssl_get_min_max_version(s, &s->s3.tmp.min_ver, 2844 &s->s3.tmp.max_ver, NULL) 2845 != 0) 2846 return 0; 2847 #ifndef OPENSSL_NO_PSK 2848 /* with PSK there must be client callback set */ 2849 if (!s->psk_client_callback) { 2850 s->s3.tmp.mask_a |= SSL_aPSK; 2851 s->s3.tmp.mask_k |= SSL_PSK; 2852 } 2853 #endif /* OPENSSL_NO_PSK */ 2854 #ifndef OPENSSL_NO_SRP 2855 if (!(s->srp_ctx.srp_Mask & SSL_kSRP)) { 2856 s->s3.tmp.mask_a |= SSL_aSRP; 2857 s->s3.tmp.mask_k |= SSL_kSRP; 2858 } 2859 #endif 2860 return 1; 2861 } 2862 2863 /* 2864 * ssl_cipher_disabled - check that a cipher is disabled or not 2865 * @s: SSL connection that you want to use the cipher on 2866 * @c: cipher to check 2867 * @op: Security check that you want to do 2868 * @ecdhe: If set to 1 then TLSv1 ECDHE ciphers are also allowed in SSLv3 2869 * 2870 * Returns 1 when it's disabled, 0 when enabled. 2871 */ 2872 int ssl_cipher_disabled(const SSL_CONNECTION *s, const SSL_CIPHER *c, 2873 int op, int ecdhe) 2874 { 2875 int minversion = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls; 2876 int maxversion = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls; 2877 2878 if (c->algorithm_mkey & s->s3.tmp.mask_k 2879 || c->algorithm_auth & s->s3.tmp.mask_a) 2880 return 1; 2881 if (s->s3.tmp.max_ver == 0) 2882 return 1; 2883 2884 if (SSL_IS_QUIC_INT_HANDSHAKE(s)) 2885 /* For QUIC, only allow these ciphersuites. */ 2886 switch (SSL_CIPHER_get_id(c)) { 2887 case TLS1_3_CK_AES_128_GCM_SHA256: 2888 case TLS1_3_CK_AES_256_GCM_SHA384: 2889 case TLS1_3_CK_CHACHA20_POLY1305_SHA256: 2890 break; 2891 default: 2892 return 1; 2893 } 2894 2895 /* 2896 * For historical reasons we will allow ECHDE to be selected by a server 2897 * in SSLv3 if we are a client 2898 */ 2899 if (minversion == TLS1_VERSION 2900 && ecdhe 2901 && (c->algorithm_mkey & (SSL_kECDHE | SSL_kECDHEPSK)) != 0) 2902 minversion = SSL3_VERSION; 2903 2904 if (ssl_version_cmp(s, minversion, s->s3.tmp.max_ver) > 0 2905 || ssl_version_cmp(s, maxversion, s->s3.tmp.min_ver) < 0) 2906 return 1; 2907 2908 return !ssl_security(s, op, c->strength_bits, 0, (void *)c); 2909 } 2910 2911 int tls_use_ticket(SSL_CONNECTION *s) 2912 { 2913 if ((s->options & SSL_OP_NO_TICKET)) 2914 return 0; 2915 return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL); 2916 } 2917 2918 int tls1_set_server_sigalgs(SSL_CONNECTION *s) 2919 { 2920 size_t i; 2921 2922 /* Clear any shared signature algorithms */ 2923 OPENSSL_free(s->shared_sigalgs); 2924 s->shared_sigalgs = NULL; 2925 s->shared_sigalgslen = 0; 2926 2927 /* Clear certificate validity flags */ 2928 if (s->s3.tmp.valid_flags) 2929 memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t)); 2930 else 2931 s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t)); 2932 if (s->s3.tmp.valid_flags == NULL) 2933 return 0; 2934 /* 2935 * If peer sent no signature algorithms check to see if we support 2936 * the default algorithm for each certificate type 2937 */ 2938 if (s->s3.tmp.peer_cert_sigalgs == NULL 2939 && s->s3.tmp.peer_sigalgs == NULL) { 2940 const uint16_t *sent_sigs; 2941 size_t sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs); 2942 2943 for (i = 0; i < s->ssl_pkey_num; i++) { 2944 const SIGALG_LOOKUP *lu = tls1_get_legacy_sigalg(s, i); 2945 size_t j; 2946 2947 if (lu == NULL) 2948 continue; 2949 /* Check default matches a type we sent */ 2950 for (j = 0; j < sent_sigslen; j++) { 2951 if (lu->sigalg == sent_sigs[j]) { 2952 s->s3.tmp.valid_flags[i] = CERT_PKEY_SIGN; 2953 break; 2954 } 2955 } 2956 } 2957 return 1; 2958 } 2959 2960 if (!tls1_process_sigalgs(s)) { 2961 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 2962 return 0; 2963 } 2964 if (s->shared_sigalgs != NULL) 2965 return 1; 2966 2967 /* Fatal error if no shared signature algorithms */ 2968 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 2969 SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS); 2970 return 0; 2971 } 2972 2973 /*- 2974 * Gets the ticket information supplied by the client if any. 2975 * 2976 * hello: The parsed ClientHello data 2977 * ret: (output) on return, if a ticket was decrypted, then this is set to 2978 * point to the resulting session. 2979 */ 2980 SSL_TICKET_STATUS tls_get_ticket_from_client(SSL_CONNECTION *s, 2981 CLIENTHELLO_MSG *hello, 2982 SSL_SESSION **ret) 2983 { 2984 size_t size; 2985 RAW_EXTENSION *ticketext; 2986 2987 *ret = NULL; 2988 s->ext.ticket_expected = 0; 2989 2990 /* 2991 * If tickets disabled or not supported by the protocol version 2992 * (e.g. TLSv1.3) behave as if no ticket present to permit stateful 2993 * resumption. 2994 */ 2995 if (s->version <= SSL3_VERSION || !tls_use_ticket(s)) 2996 return SSL_TICKET_NONE; 2997 2998 ticketext = &hello->pre_proc_exts[TLSEXT_IDX_session_ticket]; 2999 if (!ticketext->present) 3000 return SSL_TICKET_NONE; 3001 3002 size = PACKET_remaining(&ticketext->data); 3003 3004 return tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size, 3005 hello->session_id, hello->session_id_len, ret); 3006 } 3007 3008 /*- 3009 * tls_decrypt_ticket attempts to decrypt a session ticket. 3010 * 3011 * If s->tls_session_secret_cb is set and we're not doing TLSv1.3 then we are 3012 * expecting a pre-shared key ciphersuite, in which case we have no use for 3013 * session tickets and one will never be decrypted, nor will 3014 * s->ext.ticket_expected be set to 1. 3015 * 3016 * Side effects: 3017 * Sets s->ext.ticket_expected to 1 if the server will have to issue 3018 * a new session ticket to the client because the client indicated support 3019 * (and s->tls_session_secret_cb is NULL) but the client either doesn't have 3020 * a session ticket or we couldn't use the one it gave us, or if 3021 * s->ctx->ext.ticket_key_cb asked to renew the client's ticket. 3022 * Otherwise, s->ext.ticket_expected is set to 0. 3023 * 3024 * etick: points to the body of the session ticket extension. 3025 * eticklen: the length of the session tickets extension. 3026 * sess_id: points at the session ID. 3027 * sesslen: the length of the session ID. 3028 * psess: (output) on return, if a ticket was decrypted, then this is set to 3029 * point to the resulting session. 3030 */ 3031 SSL_TICKET_STATUS tls_decrypt_ticket(SSL_CONNECTION *s, 3032 const unsigned char *etick, 3033 size_t eticklen, 3034 const unsigned char *sess_id, 3035 size_t sesslen, SSL_SESSION **psess) 3036 { 3037 SSL_SESSION *sess = NULL; 3038 unsigned char *sdec; 3039 const unsigned char *p; 3040 int slen, ivlen, renew_ticket = 0, declen; 3041 SSL_TICKET_STATUS ret = SSL_TICKET_FATAL_ERR_OTHER; 3042 size_t mlen; 3043 unsigned char tick_hmac[EVP_MAX_MD_SIZE]; 3044 SSL_HMAC *hctx = NULL; 3045 EVP_CIPHER_CTX *ctx = NULL; 3046 SSL_CTX *tctx = s->session_ctx; 3047 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 3048 3049 if (eticklen == 0) { 3050 /* 3051 * The client will accept a ticket but doesn't currently have 3052 * one (TLSv1.2 and below), or treated as a fatal error in TLSv1.3 3053 */ 3054 ret = SSL_TICKET_EMPTY; 3055 goto end; 3056 } 3057 if (!SSL_CONNECTION_IS_TLS13(s) && s->ext.session_secret_cb) { 3058 /* 3059 * Indicate that the ticket couldn't be decrypted rather than 3060 * generating the session from ticket now, trigger 3061 * abbreviated handshake based on external mechanism to 3062 * calculate the master secret later. 3063 */ 3064 ret = SSL_TICKET_NO_DECRYPT; 3065 goto end; 3066 } 3067 3068 /* Need at least keyname + iv */ 3069 if (eticklen < TLSEXT_KEYNAME_LENGTH + EVP_MAX_IV_LENGTH) { 3070 ret = SSL_TICKET_NO_DECRYPT; 3071 goto end; 3072 } 3073 3074 /* Initialize session ticket encryption and HMAC contexts */ 3075 hctx = ssl_hmac_new(tctx); 3076 if (hctx == NULL) { 3077 ret = SSL_TICKET_FATAL_ERR_MALLOC; 3078 goto end; 3079 } 3080 ctx = EVP_CIPHER_CTX_new(); 3081 if (ctx == NULL) { 3082 ret = SSL_TICKET_FATAL_ERR_MALLOC; 3083 goto end; 3084 } 3085 #ifndef OPENSSL_NO_DEPRECATED_3_0 3086 if (tctx->ext.ticket_key_evp_cb != NULL || tctx->ext.ticket_key_cb != NULL) 3087 #else 3088 if (tctx->ext.ticket_key_evp_cb != NULL) 3089 #endif 3090 { 3091 unsigned char *nctick = (unsigned char *)etick; 3092 int rv = 0; 3093 3094 if (tctx->ext.ticket_key_evp_cb != NULL) 3095 rv = tctx->ext.ticket_key_evp_cb(SSL_CONNECTION_GET_USER_SSL(s), 3096 nctick, 3097 nctick + TLSEXT_KEYNAME_LENGTH, 3098 ctx, 3099 ssl_hmac_get0_EVP_MAC_CTX(hctx), 3100 0); 3101 #ifndef OPENSSL_NO_DEPRECATED_3_0 3102 else if (tctx->ext.ticket_key_cb != NULL) 3103 /* if 0 is returned, write an empty ticket */ 3104 rv = tctx->ext.ticket_key_cb(SSL_CONNECTION_GET_USER_SSL(s), nctick, 3105 nctick + TLSEXT_KEYNAME_LENGTH, 3106 ctx, ssl_hmac_get0_HMAC_CTX(hctx), 0); 3107 #endif 3108 if (rv < 0) { 3109 ret = SSL_TICKET_FATAL_ERR_OTHER; 3110 goto end; 3111 } 3112 if (rv == 0) { 3113 ret = SSL_TICKET_NO_DECRYPT; 3114 goto end; 3115 } 3116 if (rv == 2) 3117 renew_ticket = 1; 3118 } else { 3119 EVP_CIPHER *aes256cbc = NULL; 3120 3121 /* Check key name matches */ 3122 if (memcmp(etick, tctx->ext.tick_key_name, 3123 TLSEXT_KEYNAME_LENGTH) 3124 != 0) { 3125 ret = SSL_TICKET_NO_DECRYPT; 3126 goto end; 3127 } 3128 3129 aes256cbc = EVP_CIPHER_fetch(sctx->libctx, "AES-256-CBC", 3130 sctx->propq); 3131 if (aes256cbc == NULL 3132 || ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key, 3133 sizeof(tctx->ext.secure->tick_hmac_key), 3134 "SHA256") 3135 <= 0 3136 || EVP_DecryptInit_ex(ctx, aes256cbc, NULL, 3137 tctx->ext.secure->tick_aes_key, 3138 etick + TLSEXT_KEYNAME_LENGTH) 3139 <= 0) { 3140 EVP_CIPHER_free(aes256cbc); 3141 ret = SSL_TICKET_FATAL_ERR_OTHER; 3142 goto end; 3143 } 3144 EVP_CIPHER_free(aes256cbc); 3145 if (SSL_CONNECTION_IS_TLS13(s)) 3146 renew_ticket = 1; 3147 } 3148 /* 3149 * Attempt to process session ticket, first conduct sanity and integrity 3150 * checks on ticket. 3151 */ 3152 mlen = ssl_hmac_size(hctx); 3153 if (mlen == 0) { 3154 ret = SSL_TICKET_FATAL_ERR_OTHER; 3155 goto end; 3156 } 3157 3158 ivlen = EVP_CIPHER_CTX_get_iv_length(ctx); 3159 if (ivlen < 0) { 3160 ret = SSL_TICKET_FATAL_ERR_OTHER; 3161 goto end; 3162 } 3163 3164 /* Sanity check ticket length: must exceed keyname + IV + HMAC */ 3165 if (eticklen <= TLSEXT_KEYNAME_LENGTH + ivlen + mlen) { 3166 ret = SSL_TICKET_NO_DECRYPT; 3167 goto end; 3168 } 3169 eticklen -= mlen; 3170 /* Check HMAC of encrypted ticket */ 3171 if (ssl_hmac_update(hctx, etick, eticklen) <= 0 3172 || ssl_hmac_final(hctx, tick_hmac, NULL, sizeof(tick_hmac)) <= 0) { 3173 ret = SSL_TICKET_FATAL_ERR_OTHER; 3174 goto end; 3175 } 3176 3177 if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) { 3178 ret = SSL_TICKET_NO_DECRYPT; 3179 goto end; 3180 } 3181 /* Attempt to decrypt session data */ 3182 /* Move p after IV to start of encrypted ticket, update length */ 3183 p = etick + TLSEXT_KEYNAME_LENGTH + ivlen; 3184 eticklen -= TLSEXT_KEYNAME_LENGTH + ivlen; 3185 sdec = OPENSSL_malloc(eticklen); 3186 if (sdec == NULL || EVP_DecryptUpdate(ctx, sdec, &slen, p, (int)eticklen) <= 0) { 3187 OPENSSL_free(sdec); 3188 ret = SSL_TICKET_FATAL_ERR_OTHER; 3189 goto end; 3190 } 3191 if (EVP_DecryptFinal(ctx, sdec + slen, &declen) <= 0) { 3192 OPENSSL_free(sdec); 3193 ret = SSL_TICKET_NO_DECRYPT; 3194 goto end; 3195 } 3196 slen += declen; 3197 p = sdec; 3198 3199 sess = d2i_SSL_SESSION_ex(NULL, &p, slen, sctx->libctx, sctx->propq); 3200 slen -= p - sdec; 3201 OPENSSL_free(sdec); 3202 if (sess) { 3203 /* Some additional consistency checks */ 3204 if (slen != 0) { 3205 SSL_SESSION_free(sess); 3206 sess = NULL; 3207 ret = SSL_TICKET_NO_DECRYPT; 3208 goto end; 3209 } 3210 /* 3211 * The session ID, if non-empty, is used by some clients to detect 3212 * that the ticket has been accepted. So we copy it to the session 3213 * structure. If it is empty set length to zero as required by 3214 * standard. 3215 */ 3216 if (sesslen) { 3217 memcpy(sess->session_id, sess_id, sesslen); 3218 sess->session_id_length = sesslen; 3219 } 3220 if (renew_ticket) 3221 ret = SSL_TICKET_SUCCESS_RENEW; 3222 else 3223 ret = SSL_TICKET_SUCCESS; 3224 goto end; 3225 } 3226 ERR_clear_error(); 3227 /* 3228 * For session parse failure, indicate that we need to send a new ticket. 3229 */ 3230 ret = SSL_TICKET_NO_DECRYPT; 3231 3232 end: 3233 EVP_CIPHER_CTX_free(ctx); 3234 ssl_hmac_free(hctx); 3235 3236 /* 3237 * If set, the decrypt_ticket_cb() is called unless a fatal error was 3238 * detected above. The callback is responsible for checking |ret| before it 3239 * performs any action 3240 */ 3241 if (s->session_ctx->decrypt_ticket_cb != NULL 3242 && (ret == SSL_TICKET_EMPTY 3243 || ret == SSL_TICKET_NO_DECRYPT 3244 || ret == SSL_TICKET_SUCCESS 3245 || ret == SSL_TICKET_SUCCESS_RENEW)) { 3246 size_t keyname_len = eticklen; 3247 int retcb; 3248 3249 if (keyname_len > TLSEXT_KEYNAME_LENGTH) 3250 keyname_len = TLSEXT_KEYNAME_LENGTH; 3251 retcb = s->session_ctx->decrypt_ticket_cb(SSL_CONNECTION_GET_SSL(s), 3252 sess, etick, keyname_len, 3253 ret, 3254 s->session_ctx->ticket_cb_data); 3255 switch (retcb) { 3256 case SSL_TICKET_RETURN_ABORT: 3257 ret = SSL_TICKET_FATAL_ERR_OTHER; 3258 break; 3259 3260 case SSL_TICKET_RETURN_IGNORE: 3261 ret = SSL_TICKET_NONE; 3262 SSL_SESSION_free(sess); 3263 sess = NULL; 3264 break; 3265 3266 case SSL_TICKET_RETURN_IGNORE_RENEW: 3267 if (ret != SSL_TICKET_EMPTY && ret != SSL_TICKET_NO_DECRYPT) 3268 ret = SSL_TICKET_NO_DECRYPT; 3269 /* else the value of |ret| will already do the right thing */ 3270 SSL_SESSION_free(sess); 3271 sess = NULL; 3272 break; 3273 3274 case SSL_TICKET_RETURN_USE: 3275 case SSL_TICKET_RETURN_USE_RENEW: 3276 if (ret != SSL_TICKET_SUCCESS 3277 && ret != SSL_TICKET_SUCCESS_RENEW) 3278 ret = SSL_TICKET_FATAL_ERR_OTHER; 3279 else if (retcb == SSL_TICKET_RETURN_USE) 3280 ret = SSL_TICKET_SUCCESS; 3281 else 3282 ret = SSL_TICKET_SUCCESS_RENEW; 3283 break; 3284 3285 default: 3286 ret = SSL_TICKET_FATAL_ERR_OTHER; 3287 } 3288 } 3289 3290 if (s->ext.session_secret_cb == NULL || SSL_CONNECTION_IS_TLS13(s)) { 3291 switch (ret) { 3292 case SSL_TICKET_NO_DECRYPT: 3293 case SSL_TICKET_SUCCESS_RENEW: 3294 case SSL_TICKET_EMPTY: 3295 s->ext.ticket_expected = 1; 3296 } 3297 } 3298 3299 *psess = sess; 3300 3301 return ret; 3302 } 3303 3304 /* Check to see if a signature algorithm is allowed */ 3305 static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, 3306 const SIGALG_LOOKUP *lu) 3307 { 3308 unsigned char sigalgstr[2]; 3309 int secbits; 3310 3311 if (lu == NULL || !lu->available) 3312 return 0; 3313 /* DSA is not allowed in TLS 1.3 */ 3314 if (SSL_CONNECTION_IS_TLS13(s) && lu->sig == EVP_PKEY_DSA) 3315 return 0; 3316 /* 3317 * At some point we should fully axe DSA/etc. in ClientHello as per TLS 1.3 3318 * spec 3319 */ 3320 if (!s->server && !SSL_CONNECTION_IS_DTLS(s) 3321 && s->s3.tmp.min_ver >= TLS1_3_VERSION 3322 && (lu->sig == EVP_PKEY_DSA || lu->hash_idx == SSL_MD_SHA1_IDX 3323 || lu->hash_idx == SSL_MD_MD5_IDX 3324 || lu->hash_idx == SSL_MD_SHA224_IDX)) 3325 return 0; 3326 3327 /* See if public key algorithm allowed */ 3328 if (ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), lu->sig_idx)) 3329 return 0; 3330 3331 if (lu->sig == NID_id_GostR3410_2012_256 3332 || lu->sig == NID_id_GostR3410_2012_512 3333 || lu->sig == NID_id_GostR3410_2001) { 3334 /* We never allow GOST sig algs on the server with TLSv1.3 */ 3335 if (s->server && SSL_CONNECTION_IS_TLS13(s)) 3336 return 0; 3337 if (!s->server 3338 && SSL_CONNECTION_GET_SSL(s)->method->version == TLS_ANY_VERSION 3339 && s->s3.tmp.max_ver >= TLS1_3_VERSION) { 3340 int i, num; 3341 STACK_OF(SSL_CIPHER) *sk; 3342 3343 /* 3344 * We're a client that could negotiate TLSv1.3. We only allow GOST 3345 * sig algs if we could negotiate TLSv1.2 or below and we have GOST 3346 * ciphersuites enabled. 3347 */ 3348 3349 if (s->s3.tmp.min_ver >= TLS1_3_VERSION) 3350 return 0; 3351 3352 sk = SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s)); 3353 num = sk != NULL ? sk_SSL_CIPHER_num(sk) : 0; 3354 for (i = 0; i < num; i++) { 3355 const SSL_CIPHER *c; 3356 3357 c = sk_SSL_CIPHER_value(sk, i); 3358 /* Skip disabled ciphers */ 3359 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) 3360 continue; 3361 3362 if ((c->algorithm_mkey & (SSL_kGOST | SSL_kGOST18)) != 0) 3363 break; 3364 } 3365 if (i == num) 3366 return 0; 3367 } 3368 } 3369 3370 /* Finally see if security callback allows it */ 3371 secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu); 3372 sigalgstr[0] = (lu->sigalg >> 8) & 0xff; 3373 sigalgstr[1] = lu->sigalg & 0xff; 3374 return ssl_security(s, op, secbits, lu->hash, (void *)sigalgstr); 3375 } 3376 3377 /* 3378 * Get a mask of disabled public key algorithms based on supported signature 3379 * algorithms. For example if no signature algorithm supports RSA then RSA is 3380 * disabled. 3381 */ 3382 3383 void ssl_set_sig_mask(uint32_t *pmask_a, SSL_CONNECTION *s, int op) 3384 { 3385 const uint16_t *sigalgs; 3386 size_t i, sigalgslen; 3387 uint32_t disabled_mask = SSL_aRSA | SSL_aDSS | SSL_aECDSA; 3388 /* 3389 * Go through all signature algorithms seeing if we support any 3390 * in disabled_mask. 3391 */ 3392 sigalgslen = tls12_get_psigalgs(s, 1, &sigalgs); 3393 for (i = 0; i < sigalgslen; i++, sigalgs++) { 3394 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), *sigalgs); 3395 const SSL_CERT_LOOKUP *clu; 3396 3397 if (lu == NULL) 3398 continue; 3399 3400 clu = ssl_cert_lookup_by_idx(lu->sig_idx, 3401 SSL_CONNECTION_GET_CTX(s)); 3402 if (clu == NULL) 3403 continue; 3404 3405 /* If algorithm is disabled see if we can enable it */ 3406 if ((clu->amask & disabled_mask) != 0 3407 && tls12_sigalg_allowed(s, op, lu)) 3408 disabled_mask &= ~clu->amask; 3409 } 3410 *pmask_a |= disabled_mask; 3411 } 3412 3413 int tls12_copy_sigalgs(SSL_CONNECTION *s, WPACKET *pkt, 3414 const uint16_t *psig, size_t psiglen) 3415 { 3416 size_t i; 3417 int rv = 0; 3418 3419 for (i = 0; i < psiglen; i++, psig++) { 3420 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), *psig); 3421 3422 if (lu == NULL || !tls_sigalg_compat(s, lu)) 3423 continue; 3424 if (!WPACKET_put_bytes_u16(pkt, *psig)) 3425 return 0; 3426 /* 3427 * If TLS 1.3 must have at least one valid TLS 1.3 message 3428 * signing algorithm: i.e. neither RSA nor SHA1/SHA224 3429 */ 3430 if (rv == 0 && (!SSL_CONNECTION_IS_TLS13(s) || (lu->sig != EVP_PKEY_RSA && lu->hash != NID_sha1 && lu->hash != NID_sha224))) 3431 rv = 1; 3432 } 3433 if (rv == 0) 3434 ERR_raise(ERR_LIB_SSL, SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); 3435 return rv; 3436 } 3437 3438 /* Given preference and allowed sigalgs set shared sigalgs */ 3439 static size_t tls12_shared_sigalgs(SSL_CONNECTION *s, 3440 const SIGALG_LOOKUP **shsig, 3441 const uint16_t *pref, size_t preflen, 3442 const uint16_t *allow, size_t allowlen) 3443 { 3444 const uint16_t *ptmp, *atmp; 3445 size_t i, j, nmatch = 0; 3446 for (i = 0, ptmp = pref; i < preflen; i++, ptmp++) { 3447 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), *ptmp); 3448 3449 /* Skip disabled hashes or signature algorithms */ 3450 if (lu == NULL 3451 || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, lu)) 3452 continue; 3453 for (j = 0, atmp = allow; j < allowlen; j++, atmp++) { 3454 if (*ptmp == *atmp) { 3455 nmatch++; 3456 if (shsig) 3457 *shsig++ = lu; 3458 break; 3459 } 3460 } 3461 } 3462 return nmatch; 3463 } 3464 3465 /* Set shared signature algorithms for SSL structures */ 3466 static int tls1_set_shared_sigalgs(SSL_CONNECTION *s) 3467 { 3468 const uint16_t *pref, *allow, *conf; 3469 size_t preflen, allowlen, conflen; 3470 size_t nmatch; 3471 const SIGALG_LOOKUP **salgs = NULL; 3472 CERT *c = s->cert; 3473 unsigned int is_suiteb = tls1_suiteb(s); 3474 3475 OPENSSL_free(s->shared_sigalgs); 3476 s->shared_sigalgs = NULL; 3477 s->shared_sigalgslen = 0; 3478 /* If client use client signature algorithms if not NULL */ 3479 if (!s->server && c->client_sigalgs && !is_suiteb) { 3480 conf = c->client_sigalgs; 3481 conflen = c->client_sigalgslen; 3482 } else if (c->conf_sigalgs && !is_suiteb) { 3483 conf = c->conf_sigalgs; 3484 conflen = c->conf_sigalgslen; 3485 } else 3486 conflen = tls12_get_psigalgs(s, 0, &conf); 3487 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb) { 3488 pref = conf; 3489 preflen = conflen; 3490 allow = s->s3.tmp.peer_sigalgs; 3491 allowlen = s->s3.tmp.peer_sigalgslen; 3492 } else { 3493 allow = conf; 3494 allowlen = conflen; 3495 pref = s->s3.tmp.peer_sigalgs; 3496 preflen = s->s3.tmp.peer_sigalgslen; 3497 } 3498 nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen); 3499 if (nmatch) { 3500 if ((salgs = OPENSSL_malloc(nmatch * sizeof(*salgs))) == NULL) 3501 return 0; 3502 nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen); 3503 } else { 3504 salgs = NULL; 3505 } 3506 s->shared_sigalgs = salgs; 3507 s->shared_sigalgslen = nmatch; 3508 return 1; 3509 } 3510 3511 int tls1_save_u16(PACKET *pkt, uint16_t **pdest, size_t *pdestlen) 3512 { 3513 unsigned int stmp; 3514 size_t size, i; 3515 uint16_t *buf; 3516 3517 size = PACKET_remaining(pkt); 3518 3519 /* Invalid data length */ 3520 if (size == 0 || (size & 1) != 0) 3521 return 0; 3522 3523 size >>= 1; 3524 3525 if ((buf = OPENSSL_malloc(size * sizeof(*buf))) == NULL) 3526 return 0; 3527 for (i = 0; i < size && PACKET_get_net_2(pkt, &stmp); i++) 3528 buf[i] = stmp; 3529 3530 if (i != size) { 3531 OPENSSL_free(buf); 3532 return 0; 3533 } 3534 3535 OPENSSL_free(*pdest); 3536 *pdest = buf; 3537 *pdestlen = size; 3538 3539 return 1; 3540 } 3541 3542 int tls1_save_sigalgs(SSL_CONNECTION *s, PACKET *pkt, int cert) 3543 { 3544 /* Extension ignored for inappropriate versions */ 3545 if (!SSL_USE_SIGALGS(s)) 3546 return 1; 3547 /* Should never happen */ 3548 if (s->cert == NULL) 3549 return 0; 3550 3551 if (cert) 3552 return tls1_save_u16(pkt, &s->s3.tmp.peer_cert_sigalgs, 3553 &s->s3.tmp.peer_cert_sigalgslen); 3554 else 3555 return tls1_save_u16(pkt, &s->s3.tmp.peer_sigalgs, 3556 &s->s3.tmp.peer_sigalgslen); 3557 } 3558 3559 /* Set preferred digest for each key type */ 3560 3561 int tls1_process_sigalgs(SSL_CONNECTION *s) 3562 { 3563 size_t i; 3564 uint32_t *pvalid = s->s3.tmp.valid_flags; 3565 3566 if (!tls1_set_shared_sigalgs(s)) 3567 return 0; 3568 3569 for (i = 0; i < s->ssl_pkey_num; i++) 3570 pvalid[i] = 0; 3571 3572 for (i = 0; i < s->shared_sigalgslen; i++) { 3573 const SIGALG_LOOKUP *sigptr = s->shared_sigalgs[i]; 3574 int idx = sigptr->sig_idx; 3575 3576 /* Ignore PKCS1 based sig algs in TLSv1.3 */ 3577 if (SSL_CONNECTION_IS_TLS13(s) && sigptr->sig == EVP_PKEY_RSA) 3578 continue; 3579 /* If not disabled indicate we can explicitly sign */ 3580 if (pvalid[idx] == 0 3581 && !ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), idx)) 3582 pvalid[idx] = CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN; 3583 } 3584 return 1; 3585 } 3586 3587 int SSL_get_sigalgs(SSL *s, int idx, 3588 int *psign, int *phash, int *psignhash, 3589 unsigned char *rsig, unsigned char *rhash) 3590 { 3591 uint16_t *psig; 3592 size_t numsigalgs; 3593 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3594 3595 if (sc == NULL) 3596 return 0; 3597 3598 psig = sc->s3.tmp.peer_sigalgs; 3599 numsigalgs = sc->s3.tmp.peer_sigalgslen; 3600 3601 if (psig == NULL || numsigalgs > INT_MAX) 3602 return 0; 3603 if (idx >= 0) { 3604 const SIGALG_LOOKUP *lu; 3605 3606 if (idx >= (int)numsigalgs) 3607 return 0; 3608 psig += idx; 3609 if (rhash != NULL) 3610 *rhash = (unsigned char)((*psig >> 8) & 0xff); 3611 if (rsig != NULL) 3612 *rsig = (unsigned char)(*psig & 0xff); 3613 lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(sc), *psig); 3614 if (psign != NULL) 3615 *psign = lu != NULL ? lu->sig : NID_undef; 3616 if (phash != NULL) 3617 *phash = lu != NULL ? lu->hash : NID_undef; 3618 if (psignhash != NULL) 3619 *psignhash = lu != NULL ? lu->sigandhash : NID_undef; 3620 } 3621 return (int)numsigalgs; 3622 } 3623 3624 int SSL_get_shared_sigalgs(SSL *s, int idx, 3625 int *psign, int *phash, int *psignhash, 3626 unsigned char *rsig, unsigned char *rhash) 3627 { 3628 const SIGALG_LOOKUP *shsigalgs; 3629 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3630 3631 if (sc == NULL) 3632 return 0; 3633 3634 if (sc->shared_sigalgs == NULL 3635 || idx < 0 3636 || idx >= (int)sc->shared_sigalgslen 3637 || sc->shared_sigalgslen > INT_MAX) 3638 return 0; 3639 shsigalgs = sc->shared_sigalgs[idx]; 3640 if (phash != NULL) 3641 *phash = shsigalgs->hash; 3642 if (psign != NULL) 3643 *psign = shsigalgs->sig; 3644 if (psignhash != NULL) 3645 *psignhash = shsigalgs->sigandhash; 3646 if (rsig != NULL) 3647 *rsig = (unsigned char)(shsigalgs->sigalg & 0xff); 3648 if (rhash != NULL) 3649 *rhash = (unsigned char)((shsigalgs->sigalg >> 8) & 0xff); 3650 return (int)sc->shared_sigalgslen; 3651 } 3652 3653 /* Maximum possible number of unique entries in sigalgs array */ 3654 #define TLS_MAX_SIGALGCNT (OSSL_NELEM(sigalg_lookup_tbl) * 2) 3655 3656 typedef struct { 3657 size_t sigalgcnt; 3658 /* TLSEXT_SIGALG_XXX values */ 3659 uint16_t sigalgs[TLS_MAX_SIGALGCNT]; 3660 SSL_CTX *ctx; 3661 } sig_cb_st; 3662 3663 static void get_sigorhash(int *psig, int *phash, const char *str) 3664 { 3665 if (OPENSSL_strcasecmp(str, "RSA") == 0) { 3666 *psig = EVP_PKEY_RSA; 3667 } else if (OPENSSL_strcasecmp(str, "RSA-PSS") == 0 3668 || OPENSSL_strcasecmp(str, "PSS") == 0) { 3669 *psig = EVP_PKEY_RSA_PSS; 3670 } else if (OPENSSL_strcasecmp(str, "DSA") == 0) { 3671 *psig = EVP_PKEY_DSA; 3672 } else if (OPENSSL_strcasecmp(str, "ECDSA") == 0) { 3673 *psig = EVP_PKEY_EC; 3674 } else { 3675 *phash = OBJ_sn2nid(str); 3676 if (*phash == NID_undef) 3677 *phash = OBJ_ln2nid(str); 3678 } 3679 } 3680 /* Maximum length of a signature algorithm string component */ 3681 #define TLS_MAX_SIGSTRING_LEN 40 3682 3683 static int sig_cb(const char *elem, int len, void *arg) 3684 { 3685 sig_cb_st *sarg = arg; 3686 size_t i = 0; 3687 const SIGALG_LOOKUP *s; 3688 char etmp[TLS_MAX_SIGSTRING_LEN], *p; 3689 const char *iana, *alias; 3690 int sig_alg = NID_undef, hash_alg = NID_undef; 3691 int ignore_unknown = 0; 3692 3693 if (elem == NULL) 3694 return 0; 3695 if (elem[0] == '?') { 3696 ignore_unknown = 1; 3697 ++elem; 3698 --len; 3699 } 3700 if (sarg->sigalgcnt == TLS_MAX_SIGALGCNT) 3701 return 0; 3702 if (len > (int)(sizeof(etmp) - 1)) 3703 return 0; 3704 memcpy(etmp, elem, len); 3705 etmp[len] = 0; 3706 p = strchr(etmp, '+'); 3707 /* 3708 * We only allow SignatureSchemes listed in the sigalg_lookup_tbl; 3709 * if there's no '+' in the provided name, look for the new-style combined 3710 * name. If not, match both sig+hash to find the needed SIGALG_LOOKUP. 3711 * Just sig+hash is not unique since TLS 1.3 adds rsa_pss_pss_* and 3712 * rsa_pss_rsae_* that differ only by public key OID; in such cases 3713 * we will pick the _rsae_ variant, by virtue of them appearing earlier 3714 * in the table. 3715 */ 3716 if (p == NULL) { 3717 if (sarg->ctx != NULL) { 3718 for (i = 0; i < sarg->ctx->sigalg_lookup_cache_len; i++) { 3719 iana = sarg->ctx->sigalg_lookup_cache[i].name; 3720 alias = sarg->ctx->sigalg_lookup_cache[i].name12; 3721 if ((alias != NULL && OPENSSL_strcasecmp(etmp, alias) == 0) 3722 || OPENSSL_strcasecmp(etmp, iana) == 0) { 3723 /* Ignore known, but unavailable sigalgs. */ 3724 if (!sarg->ctx->sigalg_lookup_cache[i].available) 3725 return 1; 3726 sarg->sigalgs[sarg->sigalgcnt++] = sarg->ctx->sigalg_lookup_cache[i].sigalg; 3727 goto found; 3728 } 3729 } 3730 } else { 3731 /* Syntax checks use the built-in sigalgs */ 3732 for (i = 0, s = sigalg_lookup_tbl; 3733 i < OSSL_NELEM(sigalg_lookup_tbl); i++, s++) { 3734 iana = s->name; 3735 alias = s->name12; 3736 if ((alias != NULL && OPENSSL_strcasecmp(etmp, alias) == 0) 3737 || OPENSSL_strcasecmp(etmp, iana) == 0) { 3738 sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; 3739 goto found; 3740 } 3741 } 3742 } 3743 } else { 3744 *p = 0; 3745 p++; 3746 if (*p == 0) 3747 return 0; 3748 get_sigorhash(&sig_alg, &hash_alg, etmp); 3749 get_sigorhash(&sig_alg, &hash_alg, p); 3750 if (sig_alg != NID_undef && hash_alg != NID_undef) { 3751 if (sarg->ctx != NULL) { 3752 for (i = 0; i < sarg->ctx->sigalg_lookup_cache_len; i++) { 3753 s = &sarg->ctx->sigalg_lookup_cache[i]; 3754 if (s->hash == hash_alg && s->sig == sig_alg) { 3755 /* Ignore known, but unavailable sigalgs. */ 3756 if (!sarg->ctx->sigalg_lookup_cache[i].available) 3757 return 1; 3758 sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; 3759 goto found; 3760 } 3761 } 3762 } else { 3763 for (i = 0; i < OSSL_NELEM(sigalg_lookup_tbl); i++) { 3764 s = &sigalg_lookup_tbl[i]; 3765 if (s->hash == hash_alg && s->sig == sig_alg) { 3766 sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; 3767 goto found; 3768 } 3769 } 3770 } 3771 } 3772 } 3773 /* Ignore unknown algorithms if ignore_unknown */ 3774 return ignore_unknown; 3775 3776 found: 3777 /* Ignore duplicates */ 3778 for (i = 0; i < sarg->sigalgcnt - 1; i++) { 3779 if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt - 1]) { 3780 sarg->sigalgcnt--; 3781 return 1; 3782 } 3783 } 3784 return 1; 3785 } 3786 3787 /* 3788 * Set supported signature algorithms based on a colon separated list of the 3789 * form sig+hash e.g. RSA+SHA512:DSA+SHA512 3790 */ 3791 int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client) 3792 { 3793 sig_cb_st sig; 3794 sig.sigalgcnt = 0; 3795 3796 if (ctx != NULL) 3797 sig.ctx = ctx; 3798 if (!CONF_parse_list(str, ':', 1, sig_cb, &sig)) 3799 return 0; 3800 if (sig.sigalgcnt == 0) { 3801 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 3802 "No valid signature algorithms in '%s'", str); 3803 return 0; 3804 } 3805 if (c == NULL) 3806 return 1; 3807 return tls1_set_raw_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client); 3808 } 3809 3810 int tls1_set_raw_sigalgs(CERT *c, const uint16_t *psigs, size_t salglen, 3811 int client) 3812 { 3813 uint16_t *sigalgs; 3814 3815 if ((sigalgs = OPENSSL_malloc(salglen * sizeof(*sigalgs))) == NULL) 3816 return 0; 3817 memcpy(sigalgs, psigs, salglen * sizeof(*sigalgs)); 3818 3819 if (client) { 3820 OPENSSL_free(c->client_sigalgs); 3821 c->client_sigalgs = sigalgs; 3822 c->client_sigalgslen = salglen; 3823 } else { 3824 OPENSSL_free(c->conf_sigalgs); 3825 c->conf_sigalgs = sigalgs; 3826 c->conf_sigalgslen = salglen; 3827 } 3828 3829 return 1; 3830 } 3831 3832 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client) 3833 { 3834 uint16_t *sigalgs, *sptr; 3835 size_t i; 3836 3837 if (salglen & 1) 3838 return 0; 3839 if ((sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs))) == NULL) 3840 return 0; 3841 for (i = 0, sptr = sigalgs; i < salglen; i += 2) { 3842 size_t j; 3843 const SIGALG_LOOKUP *curr; 3844 int md_id = *psig_nids++; 3845 int sig_id = *psig_nids++; 3846 3847 for (j = 0, curr = sigalg_lookup_tbl; j < OSSL_NELEM(sigalg_lookup_tbl); 3848 j++, curr++) { 3849 if (curr->hash == md_id && curr->sig == sig_id) { 3850 *sptr++ = curr->sigalg; 3851 break; 3852 } 3853 } 3854 3855 if (j == OSSL_NELEM(sigalg_lookup_tbl)) 3856 goto err; 3857 } 3858 3859 if (client) { 3860 OPENSSL_free(c->client_sigalgs); 3861 c->client_sigalgs = sigalgs; 3862 c->client_sigalgslen = salglen / 2; 3863 } else { 3864 OPENSSL_free(c->conf_sigalgs); 3865 c->conf_sigalgs = sigalgs; 3866 c->conf_sigalgslen = salglen / 2; 3867 } 3868 3869 return 1; 3870 3871 err: 3872 OPENSSL_free(sigalgs); 3873 return 0; 3874 } 3875 3876 static int tls1_check_sig_alg(SSL_CONNECTION *s, X509 *x, int default_nid) 3877 { 3878 int sig_nid, use_pc_sigalgs = 0; 3879 size_t i; 3880 const SIGALG_LOOKUP *sigalg; 3881 size_t sigalgslen; 3882 3883 /*- 3884 * RFC 8446, section 4.2.3: 3885 * 3886 * The signatures on certificates that are self-signed or certificates 3887 * that are trust anchors are not validated, since they begin a 3888 * certification path (see [RFC5280], Section 3.2). A certificate that 3889 * begins a certification path MAY use a signature algorithm that is not 3890 * advertised as being supported in the "signature_algorithms" 3891 * extension. 3892 */ 3893 if (default_nid == -1 || X509_self_signed(x, 0)) 3894 return 1; 3895 sig_nid = X509_get_signature_nid(x); 3896 if (default_nid) 3897 return sig_nid == default_nid ? 1 : 0; 3898 3899 if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.peer_cert_sigalgs != NULL) { 3900 /* 3901 * If we're in TLSv1.3 then we only get here if we're checking the 3902 * chain. If the peer has specified peer_cert_sigalgs then we use them 3903 * otherwise we default to normal sigalgs. 3904 */ 3905 sigalgslen = s->s3.tmp.peer_cert_sigalgslen; 3906 use_pc_sigalgs = 1; 3907 } else { 3908 sigalgslen = s->shared_sigalgslen; 3909 } 3910 for (i = 0; i < sigalgslen; i++) { 3911 int mdnid, pknid; 3912 3913 sigalg = use_pc_sigalgs 3914 ? tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), 3915 s->s3.tmp.peer_cert_sigalgs[i]) 3916 : s->shared_sigalgs[i]; 3917 if (sigalg == NULL) 3918 continue; 3919 if (sig_nid == sigalg->sigandhash) 3920 return 1; 3921 if (sigalg->sig != EVP_PKEY_RSA_PSS) 3922 continue; 3923 /* 3924 * Accept RSA PKCS#1 signatures in certificates when the signature 3925 * algorithms include RSA-PSS with a matching digest algorithm. 3926 * 3927 * When a TLS 1.3 peer inadvertently omits the legacy RSA PKCS#1 code 3928 * points, and we're doing strict checking of the certificate chain (in 3929 * a cert_cb via SSL_check_chain()) we may then reject RSA signed 3930 * certificates in the chain, but the TLS requirement on PSS should not 3931 * extend to certificates. Though the peer can in fact list the legacy 3932 * sigalgs for just this purpose, it is not likely that a better chain 3933 * signed with RSA-PSS is available. 3934 */ 3935 if (!OBJ_find_sigid_algs(sig_nid, &mdnid, &pknid)) 3936 continue; 3937 if (pknid == EVP_PKEY_RSA && mdnid == sigalg->hash) 3938 return 1; 3939 } 3940 return 0; 3941 } 3942 3943 /* Check to see if a certificate issuer name matches list of CA names */ 3944 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x) 3945 { 3946 const X509_NAME *nm; 3947 int i; 3948 nm = X509_get_issuer_name(x); 3949 for (i = 0; i < sk_X509_NAME_num(names); i++) { 3950 if (!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i))) 3951 return 1; 3952 } 3953 return 0; 3954 } 3955 3956 /* 3957 * Check certificate chain is consistent with TLS extensions and is usable by 3958 * server. This servers two purposes: it allows users to check chains before 3959 * passing them to the server and it allows the server to check chains before 3960 * attempting to use them. 3961 */ 3962 3963 /* Flags which need to be set for a certificate when strict mode not set */ 3964 3965 #define CERT_PKEY_VALID_FLAGS \ 3966 (CERT_PKEY_EE_SIGNATURE | CERT_PKEY_EE_PARAM) 3967 /* Strict mode flags */ 3968 #define CERT_PKEY_STRICT_FLAGS \ 3969 (CERT_PKEY_VALID_FLAGS | CERT_PKEY_CA_SIGNATURE | CERT_PKEY_CA_PARAM \ 3970 | CERT_PKEY_ISSUER_NAME | CERT_PKEY_CERT_TYPE) 3971 3972 int tls1_check_chain(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pk, 3973 STACK_OF(X509) *chain, int idx) 3974 { 3975 int i; 3976 int rv = 0; 3977 int check_flags = 0, strict_mode; 3978 CERT_PKEY *cpk = NULL; 3979 CERT *c = s->cert; 3980 uint32_t *pvalid; 3981 unsigned int suiteb_flags = tls1_suiteb(s); 3982 3983 /* 3984 * Meaning of idx: 3985 * idx == -1 means SSL_check_chain() invocation 3986 * idx == -2 means checking client certificate chains 3987 * idx >= 0 means checking SSL_PKEY index 3988 * 3989 * For RPK, where there may be no cert, we ignore -1 3990 */ 3991 if (idx != -1) { 3992 if (idx == -2) { 3993 cpk = c->key; 3994 idx = (int)(cpk - c->pkeys); 3995 } else 3996 cpk = c->pkeys + idx; 3997 pvalid = s->s3.tmp.valid_flags + idx; 3998 x = cpk->x509; 3999 pk = cpk->privatekey; 4000 chain = cpk->chain; 4001 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT; 4002 if (tls12_rpk_and_privkey(s, idx)) { 4003 *pvalid = rv = CERT_PKEY_RPK; 4004 return rv; 4005 } 4006 /* If no cert or key, forget it */ 4007 if (x == NULL || pk == NULL) 4008 goto end; 4009 } else { 4010 size_t certidx; 4011 4012 if (x == NULL || pk == NULL) 4013 return 0; 4014 4015 if (ssl_cert_lookup_by_pkey(pk, &certidx, 4016 SSL_CONNECTION_GET_CTX(s)) 4017 == NULL) 4018 return 0; 4019 idx = certidx; 4020 pvalid = s->s3.tmp.valid_flags + idx; 4021 4022 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT) 4023 check_flags = CERT_PKEY_STRICT_FLAGS; 4024 else 4025 check_flags = CERT_PKEY_VALID_FLAGS; 4026 strict_mode = 1; 4027 } 4028 4029 if (suiteb_flags) { 4030 int ok; 4031 if (check_flags) 4032 check_flags |= CERT_PKEY_SUITEB; 4033 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags); 4034 if (ok == X509_V_OK) 4035 rv |= CERT_PKEY_SUITEB; 4036 else if (!check_flags) 4037 goto end; 4038 } 4039 4040 /* 4041 * Check all signature algorithms are consistent with signature 4042 * algorithms extension if TLS 1.2 or later and strict mode. 4043 */ 4044 if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION 4045 && strict_mode) { 4046 int default_nid; 4047 int rsign = 0; 4048 4049 if (s->s3.tmp.peer_cert_sigalgs != NULL 4050 || s->s3.tmp.peer_sigalgs != NULL) { 4051 default_nid = 0; 4052 /* If no sigalgs extension use defaults from RFC5246 */ 4053 } else { 4054 switch (idx) { 4055 case SSL_PKEY_RSA: 4056 rsign = EVP_PKEY_RSA; 4057 default_nid = NID_sha1WithRSAEncryption; 4058 break; 4059 4060 case SSL_PKEY_DSA_SIGN: 4061 rsign = EVP_PKEY_DSA; 4062 default_nid = NID_dsaWithSHA1; 4063 break; 4064 4065 case SSL_PKEY_ECC: 4066 rsign = EVP_PKEY_EC; 4067 default_nid = NID_ecdsa_with_SHA1; 4068 break; 4069 4070 case SSL_PKEY_GOST01: 4071 rsign = NID_id_GostR3410_2001; 4072 default_nid = NID_id_GostR3411_94_with_GostR3410_2001; 4073 break; 4074 4075 case SSL_PKEY_GOST12_256: 4076 rsign = NID_id_GostR3410_2012_256; 4077 default_nid = NID_id_tc26_signwithdigest_gost3410_2012_256; 4078 break; 4079 4080 case SSL_PKEY_GOST12_512: 4081 rsign = NID_id_GostR3410_2012_512; 4082 default_nid = NID_id_tc26_signwithdigest_gost3410_2012_512; 4083 break; 4084 4085 default: 4086 default_nid = -1; 4087 break; 4088 } 4089 } 4090 /* 4091 * If peer sent no signature algorithms extension and we have set 4092 * preferred signature algorithms check we support sha1. 4093 */ 4094 if (default_nid > 0 && c->conf_sigalgs) { 4095 size_t j; 4096 const uint16_t *p = c->conf_sigalgs; 4097 for (j = 0; j < c->conf_sigalgslen; j++, p++) { 4098 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), *p); 4099 4100 if (lu != NULL && lu->hash == NID_sha1 && lu->sig == rsign) 4101 break; 4102 } 4103 if (j == c->conf_sigalgslen) { 4104 if (check_flags) 4105 goto skip_sigs; 4106 else 4107 goto end; 4108 } 4109 } 4110 /* Check signature algorithm of each cert in chain */ 4111 if (SSL_CONNECTION_IS_TLS13(s)) { 4112 /* 4113 * We only get here if the application has called SSL_check_chain(), 4114 * so check_flags is always set. 4115 */ 4116 if (find_sig_alg(s, x, pk) != NULL) 4117 rv |= CERT_PKEY_EE_SIGNATURE; 4118 } else if (!tls1_check_sig_alg(s, x, default_nid)) { 4119 if (!check_flags) 4120 goto end; 4121 } else 4122 rv |= CERT_PKEY_EE_SIGNATURE; 4123 rv |= CERT_PKEY_CA_SIGNATURE; 4124 for (i = 0; i < sk_X509_num(chain); i++) { 4125 if (!tls1_check_sig_alg(s, sk_X509_value(chain, i), default_nid)) { 4126 if (check_flags) { 4127 rv &= ~CERT_PKEY_CA_SIGNATURE; 4128 break; 4129 } else 4130 goto end; 4131 } 4132 } 4133 } 4134 /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */ 4135 else if (check_flags) 4136 rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE; 4137 skip_sigs: 4138 /* Check cert parameters are consistent */ 4139 if (tls1_check_cert_param(s, x, 1)) 4140 rv |= CERT_PKEY_EE_PARAM; 4141 else if (!check_flags) 4142 goto end; 4143 if (!s->server) 4144 rv |= CERT_PKEY_CA_PARAM; 4145 /* In strict mode check rest of chain too */ 4146 else if (strict_mode) { 4147 rv |= CERT_PKEY_CA_PARAM; 4148 for (i = 0; i < sk_X509_num(chain); i++) { 4149 X509 *ca = sk_X509_value(chain, i); 4150 if (!tls1_check_cert_param(s, ca, 0)) { 4151 if (check_flags) { 4152 rv &= ~CERT_PKEY_CA_PARAM; 4153 break; 4154 } else 4155 goto end; 4156 } 4157 } 4158 } 4159 if (!s->server && strict_mode) { 4160 STACK_OF(X509_NAME) *ca_dn; 4161 int check_type = 0; 4162 4163 if (EVP_PKEY_is_a(pk, "RSA")) 4164 check_type = TLS_CT_RSA_SIGN; 4165 else if (EVP_PKEY_is_a(pk, "DSA")) 4166 check_type = TLS_CT_DSS_SIGN; 4167 else if (EVP_PKEY_is_a(pk, "EC")) 4168 check_type = TLS_CT_ECDSA_SIGN; 4169 4170 if (check_type) { 4171 const uint8_t *ctypes = s->s3.tmp.ctype; 4172 size_t j; 4173 4174 for (j = 0; j < s->s3.tmp.ctype_len; j++, ctypes++) { 4175 if (*ctypes == check_type) { 4176 rv |= CERT_PKEY_CERT_TYPE; 4177 break; 4178 } 4179 } 4180 if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags) 4181 goto end; 4182 } else { 4183 rv |= CERT_PKEY_CERT_TYPE; 4184 } 4185 4186 ca_dn = s->s3.tmp.peer_ca_names; 4187 4188 if (ca_dn == NULL 4189 || sk_X509_NAME_num(ca_dn) == 0 4190 || ssl_check_ca_name(ca_dn, x)) 4191 rv |= CERT_PKEY_ISSUER_NAME; 4192 else 4193 for (i = 0; i < sk_X509_num(chain); i++) { 4194 X509 *xtmp = sk_X509_value(chain, i); 4195 4196 if (ssl_check_ca_name(ca_dn, xtmp)) { 4197 rv |= CERT_PKEY_ISSUER_NAME; 4198 break; 4199 } 4200 } 4201 4202 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME)) 4203 goto end; 4204 } else 4205 rv |= CERT_PKEY_ISSUER_NAME | CERT_PKEY_CERT_TYPE; 4206 4207 if (!check_flags || (rv & check_flags) == check_flags) 4208 rv |= CERT_PKEY_VALID; 4209 4210 end: 4211 4212 if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION) 4213 rv |= *pvalid & (CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN); 4214 else 4215 rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN; 4216 4217 /* 4218 * When checking a CERT_PKEY structure all flags are irrelevant if the 4219 * chain is invalid. 4220 */ 4221 if (!check_flags) { 4222 if (rv & CERT_PKEY_VALID) { 4223 *pvalid = rv; 4224 } else { 4225 /* Preserve sign and explicit sign flag, clear rest */ 4226 *pvalid &= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN; 4227 return 0; 4228 } 4229 } 4230 return rv; 4231 } 4232 4233 /* Set validity of certificates in an SSL structure */ 4234 void tls1_set_cert_validity(SSL_CONNECTION *s) 4235 { 4236 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA); 4237 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_PSS_SIGN); 4238 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN); 4239 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC); 4240 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST01); 4241 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_256); 4242 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_512); 4243 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED25519); 4244 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED448); 4245 } 4246 4247 /* User level utility function to check a chain is suitable */ 4248 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain) 4249 { 4250 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4251 4252 if (sc == NULL) 4253 return 0; 4254 4255 return tls1_check_chain(sc, x, pk, chain, -1); 4256 } 4257 4258 EVP_PKEY *ssl_get_auto_dh(SSL_CONNECTION *s) 4259 { 4260 EVP_PKEY *dhp = NULL; 4261 BIGNUM *p; 4262 int dh_secbits = 80, sec_level_bits; 4263 EVP_PKEY_CTX *pctx = NULL; 4264 OSSL_PARAM_BLD *tmpl = NULL; 4265 OSSL_PARAM *params = NULL; 4266 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 4267 4268 if (s->cert->dh_tmp_auto != 2) { 4269 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) { 4270 if (s->s3.tmp.new_cipher->strength_bits == 256) 4271 dh_secbits = 128; 4272 else 4273 dh_secbits = 80; 4274 } else { 4275 if (s->s3.tmp.cert == NULL) 4276 return NULL; 4277 dh_secbits = EVP_PKEY_get_security_bits(s->s3.tmp.cert->privatekey); 4278 } 4279 } 4280 4281 /* Do not pick a prime that is too weak for the current security level */ 4282 sec_level_bits = ssl_get_security_level_bits(SSL_CONNECTION_GET_SSL(s), 4283 NULL, NULL); 4284 if (dh_secbits < sec_level_bits) 4285 dh_secbits = sec_level_bits; 4286 4287 if (dh_secbits >= 192) 4288 p = BN_get_rfc3526_prime_8192(NULL); 4289 else if (dh_secbits >= 152) 4290 p = BN_get_rfc3526_prime_4096(NULL); 4291 else if (dh_secbits >= 128) 4292 p = BN_get_rfc3526_prime_3072(NULL); 4293 else if (dh_secbits >= 112) 4294 p = BN_get_rfc3526_prime_2048(NULL); 4295 else 4296 p = BN_get_rfc2409_prime_1024(NULL); 4297 if (p == NULL) 4298 goto err; 4299 4300 pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq); 4301 if (pctx == NULL 4302 || EVP_PKEY_fromdata_init(pctx) != 1) 4303 goto err; 4304 4305 tmpl = OSSL_PARAM_BLD_new(); 4306 if (tmpl == NULL 4307 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p) 4308 || !OSSL_PARAM_BLD_push_uint(tmpl, OSSL_PKEY_PARAM_FFC_G, 2)) 4309 goto err; 4310 4311 params = OSSL_PARAM_BLD_to_param(tmpl); 4312 if (params == NULL 4313 || EVP_PKEY_fromdata(pctx, &dhp, EVP_PKEY_KEY_PARAMETERS, params) != 1) 4314 goto err; 4315 4316 err: 4317 OSSL_PARAM_free(params); 4318 OSSL_PARAM_BLD_free(tmpl); 4319 EVP_PKEY_CTX_free(pctx); 4320 BN_free(p); 4321 return dhp; 4322 } 4323 4324 static int ssl_security_cert_key(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, 4325 int op) 4326 { 4327 int secbits = -1; 4328 EVP_PKEY *pkey = X509_get0_pubkey(x); 4329 4330 if (pkey) { 4331 /* 4332 * If no parameters this will return -1 and fail using the default 4333 * security callback for any non-zero security level. This will 4334 * reject keys which omit parameters but this only affects DSA and 4335 * omission of parameters is never (?) done in practice. 4336 */ 4337 secbits = EVP_PKEY_get_security_bits(pkey); 4338 } 4339 if (s != NULL) 4340 return ssl_security(s, op, secbits, 0, x); 4341 else 4342 return ssl_ctx_security(ctx, op, secbits, 0, x); 4343 } 4344 4345 int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int is_ee) 4346 { 4347 if (is_ee) { 4348 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY)) 4349 return SSL_R_EE_KEY_TOO_SMALL; 4350 } else { 4351 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY)) 4352 return SSL_R_CA_KEY_TOO_SMALL; 4353 } 4354 return 1; 4355 } 4356 4357 /* 4358 * Call ssl_security_check() on all certificates in a stack. 4359 * If |x| is non NULL it is checked first, before checking the 4360 * certificates in the stack. 4361 * 4362 * Return values: 1 if ok otherwise the error code from the first 4363 * failing ssl_security_check().; 4364 */ 4365 4366 int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk, 4367 X509 *x) 4368 { 4369 int rv, start_idx, i; 4370 4371 if (x == NULL) { 4372 x = sk_X509_value(sk, 0); 4373 if (x == NULL) 4374 return ERR_R_INTERNAL_ERROR; 4375 start_idx = 1; 4376 } else 4377 start_idx = 0; 4378 4379 rv = ssl_security_cert(s, NULL, x, 1); 4380 if (rv != 1) 4381 return rv; 4382 4383 for (i = start_idx; i < sk_X509_num(sk); i++) { 4384 x = sk_X509_value(sk, i); 4385 rv = ssl_security_cert(s, NULL, x, 0); 4386 if (rv != 1) 4387 return rv; 4388 } 4389 return 1; 4390 } 4391 4392 /* 4393 * For TLS 1.2 servers check if we have a certificate which can be used 4394 * with the signature algorithm "lu" and return index of certificate. 4395 */ 4396 4397 static int tls12_get_cert_sigalg_idx(const SSL_CONNECTION *s, 4398 const SIGALG_LOOKUP *lu) 4399 { 4400 int sig_idx = lu->sig_idx; 4401 const SSL_CERT_LOOKUP *clu = ssl_cert_lookup_by_idx(sig_idx, 4402 SSL_CONNECTION_GET_CTX(s)); 4403 4404 /* If not recognised or not supported by cipher mask it is not suitable */ 4405 if (clu == NULL 4406 || (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0 4407 || (clu->pkey_nid == EVP_PKEY_RSA_PSS 4408 && (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kRSA) != 0)) 4409 return -1; 4410 4411 /* If doing RPK, the CERT_PKEY won't be "valid" */ 4412 if (tls12_rpk_and_privkey(s, sig_idx)) 4413 return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_RPK ? sig_idx : -1; 4414 4415 return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_VALID ? sig_idx : -1; 4416 } 4417 4418 /* 4419 * Checks the given cert against signature_algorithm_cert restrictions sent by 4420 * the peer (if any) as well as whether the hash from the sigalg is usable with 4421 * the key. 4422 * Returns true if the cert is usable and false otherwise. 4423 */ 4424 static int check_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, 4425 X509 *x, EVP_PKEY *pkey) 4426 { 4427 const SIGALG_LOOKUP *lu; 4428 int mdnid, pknid, supported; 4429 size_t i; 4430 const char *mdname = NULL; 4431 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 4432 4433 /* 4434 * If the given EVP_PKEY cannot support signing with this digest, 4435 * the answer is simply 'no'. 4436 */ 4437 if (sig->hash != NID_undef) 4438 mdname = OBJ_nid2sn(sig->hash); 4439 supported = EVP_PKEY_digestsign_supports_digest(pkey, sctx->libctx, 4440 mdname, 4441 sctx->propq); 4442 if (supported <= 0) 4443 return 0; 4444 4445 /* 4446 * When RPK is negotiated there are no certificate signatures to 4447 * constrain, and there may not even be a certificate configured. 4448 */ 4449 if (TLSEXT_cert_type_rpk == (s->server ? s->ext.server_cert_type : s->ext.client_cert_type)) 4450 return 1; 4451 4452 /* 4453 * RPK was enabled, adding candidate private-key-only slots, but was not 4454 * negotiated, so the key-only slot is not usable. 4455 */ 4456 if (x == NULL) 4457 return 0; 4458 4459 /* 4460 * The TLS 1.3 signature_algorithms_cert extension places restrictions 4461 * on the sigalg with which the certificate was signed (by its issuer). 4462 */ 4463 if (s->s3.tmp.peer_cert_sigalgs != NULL) { 4464 if (!X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL)) 4465 return 0; 4466 for (i = 0; i < s->s3.tmp.peer_cert_sigalgslen; i++) { 4467 lu = tls1_lookup_sigalg(SSL_CONNECTION_GET_CTX(s), 4468 s->s3.tmp.peer_cert_sigalgs[i]); 4469 if (lu == NULL) 4470 continue; 4471 4472 /* 4473 * This does not differentiate between the 4474 * rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not 4475 * have a chain here that lets us look at the key OID in the 4476 * signing certificate. 4477 */ 4478 if (mdnid == lu->hash && pknid == lu->sig) 4479 return 1; 4480 } 4481 return 0; 4482 } 4483 4484 /* 4485 * Without signat_algorithms_cert, any certificate for which we have 4486 * a viable public key is permitted. 4487 */ 4488 return 1; 4489 } 4490 4491 /* 4492 * Returns true if |s| has a usable certificate configured for use 4493 * with signature scheme |sig|. 4494 * "Usable" includes a check for presence as well as applying 4495 * the signature_algorithm_cert restrictions sent by the peer (if any). 4496 * Returns false if no usable certificate is found. 4497 */ 4498 static int has_usable_cert(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, int idx) 4499 { 4500 /* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */ 4501 if (idx == -1) 4502 idx = sig->sig_idx; 4503 if (!ssl_has_cert(s, idx)) 4504 return 0; 4505 4506 return check_cert_usable(s, sig, s->cert->pkeys[idx].x509, 4507 s->cert->pkeys[idx].privatekey); 4508 } 4509 4510 /* 4511 * Returns true if the supplied cert |x| and key |pkey| is usable with the 4512 * specified signature scheme |sig|, or false otherwise. 4513 */ 4514 static int is_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, X509 *x, 4515 EVP_PKEY *pkey) 4516 { 4517 size_t idx; 4518 4519 if (ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)) == NULL) 4520 return 0; 4521 4522 /* Check the key is consistent with the sig alg */ 4523 if ((int)idx != sig->sig_idx) 4524 return 0; 4525 4526 return check_cert_usable(s, sig, x, pkey); 4527 } 4528 4529 /* 4530 * Find a signature scheme that works with the supplied certificate |x| and key 4531 * |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our 4532 * available certs/keys to find one that works. 4533 */ 4534 static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x, 4535 EVP_PKEY *pkey) 4536 { 4537 const SIGALG_LOOKUP *lu = NULL; 4538 size_t i; 4539 int curve = -1; 4540 EVP_PKEY *tmppkey; 4541 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 4542 4543 /* Look for a shared sigalgs matching possible certificates */ 4544 for (i = 0; i < s->shared_sigalgslen; i++) { 4545 /* Skip SHA1, SHA224, DSA and RSA if not PSS */ 4546 lu = s->shared_sigalgs[i]; 4547 if (lu->hash == NID_sha1 4548 || lu->hash == NID_sha224 4549 || lu->sig == EVP_PKEY_DSA 4550 || lu->sig == EVP_PKEY_RSA 4551 || !tls_sigalg_compat(s, lu)) 4552 continue; 4553 4554 /* Check that we have a cert, and signature_algorithms_cert */ 4555 if (!tls1_lookup_md(sctx, lu, NULL)) 4556 continue; 4557 if ((pkey == NULL && !has_usable_cert(s, lu, -1)) 4558 || (pkey != NULL && !is_cert_usable(s, lu, x, pkey))) 4559 continue; 4560 4561 tmppkey = (pkey != NULL) ? pkey 4562 : s->cert->pkeys[lu->sig_idx].privatekey; 4563 4564 if (lu->sig == EVP_PKEY_EC) { 4565 if (curve == -1) 4566 curve = ssl_get_EC_curve_nid(tmppkey); 4567 if (lu->curve != NID_undef && curve != lu->curve) 4568 continue; 4569 } else if (lu->sig == EVP_PKEY_RSA_PSS) { 4570 /* validate that key is large enough for the signature algorithm */ 4571 if (!rsa_pss_check_min_key_size(sctx, tmppkey, lu)) 4572 continue; 4573 } 4574 break; 4575 } 4576 4577 if (i == s->shared_sigalgslen) 4578 return NULL; 4579 4580 return lu; 4581 } 4582 4583 /* 4584 * Choose an appropriate signature algorithm based on available certificates 4585 * Sets chosen certificate and signature algorithm. 4586 * 4587 * For servers if we fail to find a required certificate it is a fatal error, 4588 * an appropriate error code is set and a TLS alert is sent. 4589 * 4590 * For clients fatalerrs is set to 0. If a certificate is not suitable it is not 4591 * a fatal error: we will either try another certificate or not present one 4592 * to the server. In this case no error is set. 4593 */ 4594 int tls_choose_sigalg(SSL_CONNECTION *s, int fatalerrs) 4595 { 4596 const SIGALG_LOOKUP *lu = NULL; 4597 int sig_idx = -1; 4598 4599 s->s3.tmp.cert = NULL; 4600 s->s3.tmp.sigalg = NULL; 4601 4602 if (SSL_CONNECTION_IS_TLS13(s)) { 4603 lu = find_sig_alg(s, NULL, NULL); 4604 if (lu == NULL) { 4605 if (!fatalerrs) 4606 return 1; 4607 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 4608 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); 4609 return 0; 4610 } 4611 } else { 4612 /* If ciphersuite doesn't require a cert nothing to do */ 4613 if (!(s->s3.tmp.new_cipher->algorithm_auth & SSL_aCERT)) 4614 return 1; 4615 if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys)) 4616 return 1; 4617 4618 if (SSL_USE_SIGALGS(s)) { 4619 size_t i; 4620 if (s->s3.tmp.peer_sigalgs != NULL) { 4621 int curve = -1; 4622 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); 4623 4624 /* For Suite B need to match signature algorithm to curve */ 4625 if (tls1_suiteb(s)) 4626 curve = ssl_get_EC_curve_nid(s->cert->pkeys[SSL_PKEY_ECC] 4627 .privatekey); 4628 4629 /* 4630 * Find highest preference signature algorithm matching 4631 * cert type 4632 */ 4633 for (i = 0; i < s->shared_sigalgslen; i++) { 4634 /* Check the sigalg version bounds */ 4635 lu = s->shared_sigalgs[i]; 4636 if (!tls_sigalg_compat(s, lu)) 4637 continue; 4638 if (s->server) { 4639 if ((sig_idx = tls12_get_cert_sigalg_idx(s, lu)) == -1) 4640 continue; 4641 } else { 4642 int cc_idx = s->cert->key - s->cert->pkeys; 4643 4644 sig_idx = lu->sig_idx; 4645 if (cc_idx != sig_idx) 4646 continue; 4647 } 4648 /* Check that we have a cert, and sig_algs_cert */ 4649 if (!has_usable_cert(s, lu, sig_idx)) 4650 continue; 4651 if (lu->sig == EVP_PKEY_RSA_PSS) { 4652 /* validate that key is large enough for the signature algorithm */ 4653 EVP_PKEY *pkey = s->cert->pkeys[sig_idx].privatekey; 4654 4655 if (!rsa_pss_check_min_key_size(sctx, pkey, lu)) 4656 continue; 4657 } 4658 if (curve == -1 || lu->curve == curve) 4659 break; 4660 } 4661 #ifndef OPENSSL_NO_GOST 4662 /* 4663 * Some Windows-based implementations do not send GOST algorithms indication 4664 * in supported_algorithms extension, so when we have GOST-based ciphersuite, 4665 * we have to assume GOST support. 4666 */ 4667 if (i == s->shared_sigalgslen 4668 && (s->s3.tmp.new_cipher->algorithm_auth 4669 & (SSL_aGOST01 | SSL_aGOST12)) 4670 != 0) { 4671 if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) { 4672 if (!fatalerrs) 4673 return 1; 4674 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 4675 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); 4676 return 0; 4677 } else { 4678 i = 0; 4679 sig_idx = lu->sig_idx; 4680 } 4681 } 4682 #endif 4683 if (i == s->shared_sigalgslen) { 4684 if (!fatalerrs) 4685 return 1; 4686 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 4687 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); 4688 return 0; 4689 } 4690 } else { 4691 /* 4692 * If we have no sigalg use defaults 4693 */ 4694 const uint16_t *sent_sigs; 4695 size_t sent_sigslen; 4696 4697 if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) { 4698 if (!fatalerrs) 4699 return 1; 4700 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 4701 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); 4702 return 0; 4703 } 4704 4705 /* Check signature matches a type we sent */ 4706 sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs); 4707 for (i = 0; i < sent_sigslen; i++, sent_sigs++) { 4708 if (lu->sigalg == *sent_sigs 4709 && has_usable_cert(s, lu, lu->sig_idx)) 4710 break; 4711 } 4712 if (i == sent_sigslen) { 4713 if (!fatalerrs) 4714 return 1; 4715 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 4716 SSL_R_WRONG_SIGNATURE_TYPE); 4717 return 0; 4718 } 4719 } 4720 } else { 4721 if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) { 4722 if (!fatalerrs) 4723 return 1; 4724 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 4725 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); 4726 return 0; 4727 } 4728 } 4729 } 4730 if (sig_idx == -1) 4731 sig_idx = lu->sig_idx; 4732 s->s3.tmp.cert = &s->cert->pkeys[sig_idx]; 4733 s->cert->key = s->s3.tmp.cert; 4734 s->s3.tmp.sigalg = lu; 4735 return 1; 4736 } 4737 4738 int SSL_CTX_set_tlsext_max_fragment_length(SSL_CTX *ctx, uint8_t mode) 4739 { 4740 if (mode != TLSEXT_max_fragment_length_DISABLED 4741 && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) { 4742 ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 4743 return 0; 4744 } 4745 4746 ctx->ext.max_fragment_len_mode = mode; 4747 return 1; 4748 } 4749 4750 int SSL_set_tlsext_max_fragment_length(SSL *ssl, uint8_t mode) 4751 { 4752 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 4753 4754 if (sc == NULL 4755 || (IS_QUIC(ssl) && mode != TLSEXT_max_fragment_length_DISABLED)) 4756 return 0; 4757 4758 if (mode != TLSEXT_max_fragment_length_DISABLED 4759 && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) { 4760 ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 4761 return 0; 4762 } 4763 4764 sc->ext.max_fragment_len_mode = mode; 4765 return 1; 4766 } 4767 4768 uint8_t SSL_SESSION_get_max_fragment_length(const SSL_SESSION *session) 4769 { 4770 if (session->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_UNSPECIFIED) 4771 return TLSEXT_max_fragment_length_DISABLED; 4772 return session->ext.max_fragment_len_mode; 4773 } 4774 4775 /* 4776 * Helper functions for HMAC access with legacy support included. 4777 */ 4778 SSL_HMAC *ssl_hmac_new(const SSL_CTX *ctx) 4779 { 4780 SSL_HMAC *ret = OPENSSL_zalloc(sizeof(*ret)); 4781 EVP_MAC *mac = NULL; 4782 4783 if (ret == NULL) 4784 return NULL; 4785 #ifndef OPENSSL_NO_DEPRECATED_3_0 4786 if (ctx->ext.ticket_key_evp_cb == NULL 4787 && ctx->ext.ticket_key_cb != NULL) { 4788 if (!ssl_hmac_old_new(ret)) 4789 goto err; 4790 return ret; 4791 } 4792 #endif 4793 mac = EVP_MAC_fetch(ctx->libctx, "HMAC", ctx->propq); 4794 if (mac == NULL || (ret->ctx = EVP_MAC_CTX_new(mac)) == NULL) 4795 goto err; 4796 EVP_MAC_free(mac); 4797 return ret; 4798 err: 4799 EVP_MAC_CTX_free(ret->ctx); 4800 EVP_MAC_free(mac); 4801 OPENSSL_free(ret); 4802 return NULL; 4803 } 4804 4805 void ssl_hmac_free(SSL_HMAC *ctx) 4806 { 4807 if (ctx != NULL) { 4808 EVP_MAC_CTX_free(ctx->ctx); 4809 #ifndef OPENSSL_NO_DEPRECATED_3_0 4810 ssl_hmac_old_free(ctx); 4811 #endif 4812 OPENSSL_free(ctx); 4813 } 4814 } 4815 4816 EVP_MAC_CTX *ssl_hmac_get0_EVP_MAC_CTX(SSL_HMAC *ctx) 4817 { 4818 return ctx->ctx; 4819 } 4820 4821 int ssl_hmac_init(SSL_HMAC *ctx, void *key, size_t len, char *md) 4822 { 4823 OSSL_PARAM params[2], *p = params; 4824 4825 if (ctx->ctx != NULL) { 4826 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, md, 0); 4827 *p = OSSL_PARAM_construct_end(); 4828 if (EVP_MAC_init(ctx->ctx, key, len, params)) 4829 return 1; 4830 } 4831 #ifndef OPENSSL_NO_DEPRECATED_3_0 4832 if (ctx->old_ctx != NULL) 4833 return ssl_hmac_old_init(ctx, key, len, md); 4834 #endif 4835 return 0; 4836 } 4837 4838 int ssl_hmac_update(SSL_HMAC *ctx, const unsigned char *data, size_t len) 4839 { 4840 if (ctx->ctx != NULL) 4841 return EVP_MAC_update(ctx->ctx, data, len); 4842 #ifndef OPENSSL_NO_DEPRECATED_3_0 4843 if (ctx->old_ctx != NULL) 4844 return ssl_hmac_old_update(ctx, data, len); 4845 #endif 4846 return 0; 4847 } 4848 4849 int ssl_hmac_final(SSL_HMAC *ctx, unsigned char *md, size_t *len, 4850 size_t max_size) 4851 { 4852 if (ctx->ctx != NULL) 4853 return EVP_MAC_final(ctx->ctx, md, len, max_size); 4854 #ifndef OPENSSL_NO_DEPRECATED_3_0 4855 if (ctx->old_ctx != NULL) 4856 return ssl_hmac_old_final(ctx, md, len); 4857 #endif 4858 return 0; 4859 } 4860 4861 size_t ssl_hmac_size(const SSL_HMAC *ctx) 4862 { 4863 if (ctx->ctx != NULL) 4864 return EVP_MAC_CTX_get_mac_size(ctx->ctx); 4865 #ifndef OPENSSL_NO_DEPRECATED_3_0 4866 if (ctx->old_ctx != NULL) 4867 return ssl_hmac_old_size(ctx); 4868 #endif 4869 return 0; 4870 } 4871 4872 int ssl_get_EC_curve_nid(const EVP_PKEY *pkey) 4873 { 4874 char gname[OSSL_MAX_NAME_SIZE]; 4875 4876 if (EVP_PKEY_get_group_name(pkey, gname, sizeof(gname), NULL) > 0) 4877 return OBJ_txt2nid(gname); 4878 4879 return NID_undef; 4880 } 4881 4882 __owur int tls13_set_encoded_pub_key(EVP_PKEY *pkey, 4883 const unsigned char *enckey, 4884 size_t enckeylen) 4885 { 4886 if (EVP_PKEY_is_a(pkey, "DH")) { 4887 int bits = EVP_PKEY_get_bits(pkey); 4888 4889 if (bits <= 0 || enckeylen != (size_t)bits / 8) 4890 /* the encoded key must be padded to the length of the p */ 4891 return 0; 4892 } else if (EVP_PKEY_is_a(pkey, "EC")) { 4893 if (enckeylen < 3 /* point format and at least 1 byte for x and y */ 4894 || enckey[0] != 0x04) 4895 return 0; 4896 } 4897 4898 return EVP_PKEY_set1_encoded_public_key(pkey, enckey, enckeylen); 4899 } 4900