1 /*
2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4 * Copyright 2005 Nokia. All rights reserved.
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 #include <stdio.h>
13 #include <time.h>
14 #include <assert.h>
15 #include "../ssl_local.h"
16 #include "statem_local.h"
17 #include <openssl/buffer.h>
18 #include <openssl/rand.h>
19 #include <openssl/objects.h>
20 #include <openssl/evp.h>
21 #include <openssl/md5.h>
22 #include <openssl/dh.h>
23 #include <openssl/rsa.h>
24 #include <openssl/bn.h>
25 #include <openssl/engine.h>
26 #include <openssl/trace.h>
27 #include <openssl/core_names.h>
28 #include <openssl/param_build.h>
29 #include "internal/cryptlib.h"
30 #include "internal/comp.h"
31
32 static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s,
33 PACKET *pkt);
34 static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s,
35 PACKET *pkt);
36
37 static ossl_inline int cert_req_allowed(SSL_CONNECTION *s);
38 static int key_exchange_expected(SSL_CONNECTION *s);
39 static int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk,
40 WPACKET *pkt);
41
received_server_cert(SSL_CONNECTION * sc)42 static ossl_inline int received_server_cert(SSL_CONNECTION *sc)
43 {
44 return sc->session->peer_rpk != NULL || sc->session->peer != NULL;
45 }
46
47 /*
48 * Is a CertificateRequest message allowed at the moment or not?
49 *
50 * Return values are:
51 * 1: Yes
52 * 0: No
53 */
cert_req_allowed(SSL_CONNECTION * s)54 static ossl_inline int cert_req_allowed(SSL_CONNECTION *s)
55 {
56 /* TLS does not like anon-DH with client cert */
57 if ((s->version > SSL3_VERSION
58 && (s->s3.tmp.new_cipher->algorithm_auth & SSL_aNULL))
59 || (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK)))
60 return 0;
61
62 return 1;
63 }
64
65 /*
66 * Should we expect the ServerKeyExchange message or not?
67 *
68 * Return values are:
69 * 1: Yes
70 * 0: No
71 */
key_exchange_expected(SSL_CONNECTION * s)72 static int key_exchange_expected(SSL_CONNECTION *s)
73 {
74 long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
75
76 /*
77 * Can't skip server key exchange if this is an ephemeral
78 * ciphersuite or for SRP
79 */
80 if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK
81 | SSL_kSRP)) {
82 return 1;
83 }
84
85 return 0;
86 }
87
88 /*
89 * ossl_statem_client_read_transition() encapsulates the logic for the allowed
90 * handshake state transitions when a TLS1.3 client is reading messages from the
91 * server. The message type that the server has sent is provided in |mt|. The
92 * current state is in |s->statem.hand_state|.
93 *
94 * Return values are 1 for success (transition allowed) and 0 on error
95 * (transition not allowed)
96 */
ossl_statem_client13_read_transition(SSL_CONNECTION * s,int mt)97 static int ossl_statem_client13_read_transition(SSL_CONNECTION *s, int mt)
98 {
99 OSSL_STATEM *st = &s->statem;
100
101 /*
102 * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't
103 * yet negotiated TLSv1.3 at that point so that is handled by
104 * ossl_statem_client_read_transition()
105 */
106
107 switch (st->hand_state) {
108 default:
109 break;
110
111 case TLS_ST_CW_CLNT_HELLO:
112 /*
113 * This must a ClientHello following a HelloRetryRequest, so the only
114 * thing we can get now is a ServerHello.
115 */
116 if (mt == SSL3_MT_SERVER_HELLO) {
117 st->hand_state = TLS_ST_CR_SRVR_HELLO;
118 return 1;
119 }
120 break;
121
122 case TLS_ST_CR_SRVR_HELLO:
123 if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) {
124 st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS;
125 return 1;
126 }
127 break;
128
129 case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
130 if (s->hit) {
131 if (mt == SSL3_MT_FINISHED) {
132 st->hand_state = TLS_ST_CR_FINISHED;
133 return 1;
134 }
135 } else {
136 if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
137 st->hand_state = TLS_ST_CR_CERT_REQ;
138 return 1;
139 }
140 if (mt == SSL3_MT_CERTIFICATE) {
141 st->hand_state = TLS_ST_CR_CERT;
142 return 1;
143 }
144 #ifndef OPENSSL_NO_COMP_ALG
145 if (mt == SSL3_MT_COMPRESSED_CERTIFICATE
146 && s->ext.compress_certificate_sent) {
147 st->hand_state = TLS_ST_CR_COMP_CERT;
148 return 1;
149 }
150 #endif
151 }
152 break;
153
154 case TLS_ST_CR_CERT_REQ:
155 if (mt == SSL3_MT_CERTIFICATE) {
156 st->hand_state = TLS_ST_CR_CERT;
157 return 1;
158 }
159 #ifndef OPENSSL_NO_COMP_ALG
160 if (mt == SSL3_MT_COMPRESSED_CERTIFICATE
161 && s->ext.compress_certificate_sent) {
162 st->hand_state = TLS_ST_CR_COMP_CERT;
163 return 1;
164 }
165 #endif
166 break;
167
168 case TLS_ST_CR_CERT:
169 case TLS_ST_CR_COMP_CERT:
170 if (mt == SSL3_MT_CERTIFICATE_VERIFY) {
171 st->hand_state = TLS_ST_CR_CERT_VRFY;
172 return 1;
173 }
174 break;
175
176 case TLS_ST_CR_CERT_VRFY:
177 if (mt == SSL3_MT_FINISHED) {
178 st->hand_state = TLS_ST_CR_FINISHED;
179 return 1;
180 }
181 break;
182
183 case TLS_ST_OK:
184 if (mt == SSL3_MT_NEWSESSION_TICKET) {
185 st->hand_state = TLS_ST_CR_SESSION_TICKET;
186 return 1;
187 }
188 if (mt == SSL3_MT_KEY_UPDATE && !SSL_IS_QUIC_HANDSHAKE(s)) {
189 st->hand_state = TLS_ST_CR_KEY_UPDATE;
190 return 1;
191 }
192 if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
193 #if DTLS_MAX_VERSION_INTERNAL != DTLS1_2_VERSION
194 /* Restore digest for PHA before adding message.*/
195 # error Internal DTLS version error
196 #endif
197 if (!SSL_CONNECTION_IS_DTLS(s)
198 && s->post_handshake_auth == SSL_PHA_EXT_SENT) {
199 s->post_handshake_auth = SSL_PHA_REQUESTED;
200 /*
201 * In TLS, this is called before the message is added to the
202 * digest. In DTLS, this is expected to be called after adding
203 * to the digest. Either move the digest restore, or add the
204 * message here after the swap, or do it after the clientFinished?
205 */
206 if (!tls13_restore_handshake_digest_for_pha(s)) {
207 /* SSLfatal() already called */
208 return 0;
209 }
210 st->hand_state = TLS_ST_CR_CERT_REQ;
211 return 1;
212 }
213 }
214 break;
215 }
216
217 /* No valid transition found */
218 return 0;
219 }
220
221 /*
222 * ossl_statem_client_read_transition() encapsulates the logic for the allowed
223 * handshake state transitions when the client is reading messages from the
224 * server. The message type that the server has sent is provided in |mt|. The
225 * current state is in |s->statem.hand_state|.
226 *
227 * Return values are 1 for success (transition allowed) and 0 on error
228 * (transition not allowed)
229 */
ossl_statem_client_read_transition(SSL_CONNECTION * s,int mt)230 int ossl_statem_client_read_transition(SSL_CONNECTION *s, int mt)
231 {
232 OSSL_STATEM *st = &s->statem;
233 int ske_expected;
234
235 /*
236 * Note that after writing the first ClientHello we don't know what version
237 * we are going to negotiate yet, so we don't take this branch until later.
238 */
239 if (SSL_CONNECTION_IS_TLS13(s)) {
240 if (!ossl_statem_client13_read_transition(s, mt))
241 goto err;
242 return 1;
243 }
244
245 switch (st->hand_state) {
246 default:
247 break;
248
249 case TLS_ST_CW_CLNT_HELLO:
250 if (mt == SSL3_MT_SERVER_HELLO) {
251 st->hand_state = TLS_ST_CR_SRVR_HELLO;
252 return 1;
253 }
254
255 if (SSL_CONNECTION_IS_DTLS(s)) {
256 if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {
257 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;
258 return 1;
259 }
260 }
261 break;
262
263 case TLS_ST_EARLY_DATA:
264 /*
265 * We've not actually selected TLSv1.3 yet, but we have sent early
266 * data. The only thing allowed now is a ServerHello or a
267 * HelloRetryRequest.
268 */
269 if (mt == SSL3_MT_SERVER_HELLO) {
270 st->hand_state = TLS_ST_CR_SRVR_HELLO;
271 return 1;
272 }
273 break;
274
275 case TLS_ST_CR_SRVR_HELLO:
276 if (s->hit) {
277 if (s->ext.ticket_expected) {
278 if (mt == SSL3_MT_NEWSESSION_TICKET) {
279 st->hand_state = TLS_ST_CR_SESSION_TICKET;
280 return 1;
281 }
282 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
283 st->hand_state = TLS_ST_CR_CHANGE;
284 return 1;
285 }
286 } else {
287 if (SSL_CONNECTION_IS_DTLS(s)
288 && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {
289 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;
290 return 1;
291 } else if (s->version >= TLS1_VERSION
292 && s->ext.session_secret_cb != NULL
293 && s->session->ext.tick != NULL
294 && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
295 /*
296 * Normally, we can tell if the server is resuming the session
297 * from the session ID. EAP-FAST (RFC 4851), however, relies on
298 * the next server message after the ServerHello to determine if
299 * the server is resuming.
300 */
301 s->hit = 1;
302 st->hand_state = TLS_ST_CR_CHANGE;
303 return 1;
304 } else if (!(s->s3.tmp.new_cipher->algorithm_auth
305 & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {
306 if (mt == SSL3_MT_CERTIFICATE) {
307 st->hand_state = TLS_ST_CR_CERT;
308 return 1;
309 }
310 } else {
311 ske_expected = key_exchange_expected(s);
312 /* SKE is optional for some PSK ciphersuites */
313 if (ske_expected
314 || ((s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK)
315 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {
316 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {
317 st->hand_state = TLS_ST_CR_KEY_EXCH;
318 return 1;
319 }
320 } else if (mt == SSL3_MT_CERTIFICATE_REQUEST
321 && cert_req_allowed(s)) {
322 st->hand_state = TLS_ST_CR_CERT_REQ;
323 return 1;
324 } else if (mt == SSL3_MT_SERVER_DONE) {
325 st->hand_state = TLS_ST_CR_SRVR_DONE;
326 return 1;
327 }
328 }
329 }
330 break;
331
332 case TLS_ST_CR_CERT:
333 case TLS_ST_CR_COMP_CERT:
334 /*
335 * The CertificateStatus message is optional even if
336 * |ext.status_expected| is set
337 */
338 if (s->ext.status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) {
339 st->hand_state = TLS_ST_CR_CERT_STATUS;
340 return 1;
341 }
342 /* Fall through */
343
344 case TLS_ST_CR_CERT_STATUS:
345 ske_expected = key_exchange_expected(s);
346 /* SKE is optional for some PSK ciphersuites */
347 if (ske_expected || ((s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK)
348 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {
349 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {
350 st->hand_state = TLS_ST_CR_KEY_EXCH;
351 return 1;
352 }
353 goto err;
354 }
355 /* Fall through */
356
357 case TLS_ST_CR_KEY_EXCH:
358 if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
359 if (cert_req_allowed(s)) {
360 st->hand_state = TLS_ST_CR_CERT_REQ;
361 return 1;
362 }
363 goto err;
364 }
365 /* Fall through */
366
367 case TLS_ST_CR_CERT_REQ:
368 if (mt == SSL3_MT_SERVER_DONE) {
369 st->hand_state = TLS_ST_CR_SRVR_DONE;
370 return 1;
371 }
372 break;
373
374 case TLS_ST_CW_FINISHED:
375 if (s->ext.ticket_expected) {
376 if (mt == SSL3_MT_NEWSESSION_TICKET) {
377 st->hand_state = TLS_ST_CR_SESSION_TICKET;
378 return 1;
379 }
380 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
381 st->hand_state = TLS_ST_CR_CHANGE;
382 return 1;
383 }
384 break;
385
386 case TLS_ST_CR_SESSION_TICKET:
387 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
388 st->hand_state = TLS_ST_CR_CHANGE;
389 return 1;
390 }
391 break;
392
393 case TLS_ST_CR_CHANGE:
394 if (mt == SSL3_MT_FINISHED) {
395 st->hand_state = TLS_ST_CR_FINISHED;
396 return 1;
397 }
398 break;
399
400 case TLS_ST_OK:
401 if (mt == SSL3_MT_HELLO_REQUEST) {
402 st->hand_state = TLS_ST_CR_HELLO_REQ;
403 return 1;
404 }
405 break;
406 }
407
408 err:
409 /* No valid transition found */
410 if (SSL_CONNECTION_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
411 BIO *rbio;
412
413 /*
414 * CCS messages don't have a message sequence number so this is probably
415 * because of an out-of-order CCS. We'll just drop it.
416 */
417 s->init_num = 0;
418 s->rwstate = SSL_READING;
419 rbio = SSL_get_rbio(SSL_CONNECTION_GET_SSL(s));
420 BIO_clear_retry_flags(rbio);
421 BIO_set_retry_read(rbio);
422 return 0;
423 }
424 SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
425 return 0;
426 }
427
do_compressed_cert(SSL_CONNECTION * sc)428 static int do_compressed_cert(SSL_CONNECTION *sc)
429 {
430 /* If we negotiated RPK, we won't try to compress it */
431 return sc->ext.client_cert_type == TLSEXT_cert_type_x509
432 && sc->ext.compress_certificate_from_peer[0] != TLSEXT_comp_cert_none;
433 }
434
435 /*
436 * ossl_statem_client13_write_transition() works out what handshake state to
437 * move to next when the TLSv1.3 client is writing messages to be sent to the
438 * server.
439 */
ossl_statem_client13_write_transition(SSL_CONNECTION * s)440 static WRITE_TRAN ossl_statem_client13_write_transition(SSL_CONNECTION *s)
441 {
442 OSSL_STATEM *st = &s->statem;
443
444 /*
445 * Note: There are no cases for TLS_ST_BEFORE because we haven't negotiated
446 * TLSv1.3 yet at that point. They are handled by
447 * ossl_statem_client_write_transition().
448 */
449 switch (st->hand_state) {
450 default:
451 /* Shouldn't happen */
452 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
453 return WRITE_TRAN_ERROR;
454
455 case TLS_ST_CR_CERT_REQ:
456 if (s->post_handshake_auth == SSL_PHA_REQUESTED) {
457 if (do_compressed_cert(s))
458 st->hand_state = TLS_ST_CW_COMP_CERT;
459 else
460 st->hand_state = TLS_ST_CW_CERT;
461 return WRITE_TRAN_CONTINUE;
462 }
463 /*
464 * We should only get here if we received a CertificateRequest after
465 * we already sent close_notify
466 */
467 if (!ossl_assert((s->shutdown & SSL_SENT_SHUTDOWN) != 0)) {
468 /* Shouldn't happen - same as default case */
469 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
470 return WRITE_TRAN_ERROR;
471 }
472 st->hand_state = TLS_ST_OK;
473 return WRITE_TRAN_CONTINUE;
474
475 case TLS_ST_CR_FINISHED:
476 if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY
477 || s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING)
478 st->hand_state = TLS_ST_PENDING_EARLY_DATA_END;
479 else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0
480 && s->hello_retry_request == SSL_HRR_NONE)
481 st->hand_state = TLS_ST_CW_CHANGE;
482 else if (s->s3.tmp.cert_req == 0)
483 st->hand_state = TLS_ST_CW_FINISHED;
484 else if (do_compressed_cert(s))
485 st->hand_state = TLS_ST_CW_COMP_CERT;
486 else
487 st->hand_state = TLS_ST_CW_CERT;
488
489 s->ts_msg_read = ossl_time_now();
490 return WRITE_TRAN_CONTINUE;
491
492 case TLS_ST_PENDING_EARLY_DATA_END:
493 if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
494 st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA;
495 return WRITE_TRAN_CONTINUE;
496 }
497 /* Fall through */
498
499 case TLS_ST_CW_END_OF_EARLY_DATA:
500 case TLS_ST_CW_CHANGE:
501 if (s->s3.tmp.cert_req == 0)
502 st->hand_state = TLS_ST_CW_FINISHED;
503 else if (do_compressed_cert(s))
504 st->hand_state = TLS_ST_CW_COMP_CERT;
505 else
506 st->hand_state = TLS_ST_CW_CERT;
507 return WRITE_TRAN_CONTINUE;
508
509 case TLS_ST_CW_COMP_CERT:
510 case TLS_ST_CW_CERT:
511 /* If a non-empty Certificate we also send CertificateVerify */
512 st->hand_state = (s->s3.tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY
513 : TLS_ST_CW_FINISHED;
514 return WRITE_TRAN_CONTINUE;
515
516 case TLS_ST_CW_CERT_VRFY:
517 st->hand_state = TLS_ST_CW_FINISHED;
518 return WRITE_TRAN_CONTINUE;
519
520 case TLS_ST_CR_KEY_UPDATE:
521 case TLS_ST_CW_KEY_UPDATE:
522 case TLS_ST_CR_SESSION_TICKET:
523 case TLS_ST_CW_FINISHED:
524 st->hand_state = TLS_ST_OK;
525 return WRITE_TRAN_CONTINUE;
526
527 case TLS_ST_OK:
528 if (s->key_update != SSL_KEY_UPDATE_NONE) {
529 st->hand_state = TLS_ST_CW_KEY_UPDATE;
530 return WRITE_TRAN_CONTINUE;
531 }
532
533 /* Try to read from the server instead */
534 return WRITE_TRAN_FINISHED;
535 }
536 }
537
538 /*
539 * ossl_statem_client_write_transition() works out what handshake state to
540 * move to next when the client is writing messages to be sent to the server.
541 */
ossl_statem_client_write_transition(SSL_CONNECTION * s)542 WRITE_TRAN ossl_statem_client_write_transition(SSL_CONNECTION *s)
543 {
544 OSSL_STATEM *st = &s->statem;
545
546 /*
547 * Note that immediately before/after a ClientHello we don't know what
548 * version we are going to negotiate yet, so we don't take this branch until
549 * later
550 */
551 if (SSL_CONNECTION_IS_TLS13(s))
552 return ossl_statem_client13_write_transition(s);
553
554 switch (st->hand_state) {
555 default:
556 /* Shouldn't happen */
557 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
558 return WRITE_TRAN_ERROR;
559
560 case TLS_ST_OK:
561 if (!s->renegotiate) {
562 /*
563 * We haven't requested a renegotiation ourselves so we must have
564 * received a message from the server. Better read it.
565 */
566 return WRITE_TRAN_FINISHED;
567 }
568 /* Renegotiation */
569 /* fall thru */
570 case TLS_ST_BEFORE:
571 st->hand_state = TLS_ST_CW_CLNT_HELLO;
572 return WRITE_TRAN_CONTINUE;
573
574 case TLS_ST_CW_CLNT_HELLO:
575 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) {
576 /*
577 * We are assuming this is a TLSv1.3 connection, although we haven't
578 * actually selected a version yet.
579 */
580 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)
581 st->hand_state = TLS_ST_CW_CHANGE;
582 else
583 st->hand_state = TLS_ST_EARLY_DATA;
584 return WRITE_TRAN_CONTINUE;
585 }
586 /*
587 * No transition at the end of writing because we don't know what
588 * we will be sent
589 */
590 s->ts_msg_write = ossl_time_now();
591 return WRITE_TRAN_FINISHED;
592
593 case TLS_ST_CR_SRVR_HELLO:
594 /*
595 * We only get here in TLSv1.3. We just received an HRR, so issue a
596 * CCS unless middlebox compat mode is off, or we already issued one
597 * because we did early data.
598 */
599 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0
600 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING)
601 st->hand_state = TLS_ST_CW_CHANGE;
602 else
603 st->hand_state = TLS_ST_CW_CLNT_HELLO;
604 return WRITE_TRAN_CONTINUE;
605
606 case TLS_ST_EARLY_DATA:
607 s->ts_msg_write = ossl_time_now();
608 return WRITE_TRAN_FINISHED;
609
610 case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
611 st->hand_state = TLS_ST_CW_CLNT_HELLO;
612 return WRITE_TRAN_CONTINUE;
613
614 case TLS_ST_CR_SRVR_DONE:
615 s->ts_msg_read = ossl_time_now();
616 if (s->s3.tmp.cert_req)
617 st->hand_state = TLS_ST_CW_CERT;
618 else
619 st->hand_state = TLS_ST_CW_KEY_EXCH;
620 return WRITE_TRAN_CONTINUE;
621
622 case TLS_ST_CW_CERT:
623 st->hand_state = TLS_ST_CW_KEY_EXCH;
624 return WRITE_TRAN_CONTINUE;
625
626 case TLS_ST_CW_KEY_EXCH:
627 /*
628 * For TLS, cert_req is set to 2, so a cert chain of nothing is
629 * sent, but no verify packet is sent
630 */
631 /*
632 * XXX: For now, we do not support client authentication in ECDH
633 * cipher suites with ECDH (rather than ECDSA) certificates. We
634 * need to skip the certificate verify message when client's
635 * ECDH public key is sent inside the client certificate.
636 */
637 if (s->s3.tmp.cert_req == 1) {
638 st->hand_state = TLS_ST_CW_CERT_VRFY;
639 } else {
640 st->hand_state = TLS_ST_CW_CHANGE;
641 }
642 if (s->s3.flags & TLS1_FLAGS_SKIP_CERT_VERIFY) {
643 st->hand_state = TLS_ST_CW_CHANGE;
644 }
645 return WRITE_TRAN_CONTINUE;
646
647 case TLS_ST_CW_CERT_VRFY:
648 st->hand_state = TLS_ST_CW_CHANGE;
649 return WRITE_TRAN_CONTINUE;
650
651 case TLS_ST_CW_CHANGE:
652 if (s->hello_retry_request == SSL_HRR_PENDING) {
653 st->hand_state = TLS_ST_CW_CLNT_HELLO;
654 } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) {
655 st->hand_state = TLS_ST_EARLY_DATA;
656 } else {
657 #if defined(OPENSSL_NO_NEXTPROTONEG)
658 st->hand_state = TLS_ST_CW_FINISHED;
659 #else
660 if (!SSL_CONNECTION_IS_DTLS(s) && s->s3.npn_seen)
661 st->hand_state = TLS_ST_CW_NEXT_PROTO;
662 else
663 st->hand_state = TLS_ST_CW_FINISHED;
664 #endif
665 }
666 return WRITE_TRAN_CONTINUE;
667
668 #if !defined(OPENSSL_NO_NEXTPROTONEG)
669 case TLS_ST_CW_NEXT_PROTO:
670 st->hand_state = TLS_ST_CW_FINISHED;
671 return WRITE_TRAN_CONTINUE;
672 #endif
673
674 case TLS_ST_CW_FINISHED:
675 if (s->hit) {
676 st->hand_state = TLS_ST_OK;
677 return WRITE_TRAN_CONTINUE;
678 } else {
679 return WRITE_TRAN_FINISHED;
680 }
681
682 case TLS_ST_CR_FINISHED:
683 if (s->hit) {
684 st->hand_state = TLS_ST_CW_CHANGE;
685 return WRITE_TRAN_CONTINUE;
686 } else {
687 st->hand_state = TLS_ST_OK;
688 return WRITE_TRAN_CONTINUE;
689 }
690
691 case TLS_ST_CR_HELLO_REQ:
692 /*
693 * If we can renegotiate now then do so, otherwise wait for a more
694 * convenient time.
695 */
696 if (ssl3_renegotiate_check(SSL_CONNECTION_GET_SSL(s), 1)) {
697 if (!tls_setup_handshake(s)) {
698 /* SSLfatal() already called */
699 return WRITE_TRAN_ERROR;
700 }
701 st->hand_state = TLS_ST_CW_CLNT_HELLO;
702 return WRITE_TRAN_CONTINUE;
703 }
704 st->hand_state = TLS_ST_OK;
705 return WRITE_TRAN_CONTINUE;
706 }
707 }
708
709 /*
710 * Perform any pre work that needs to be done prior to sending a message from
711 * the client to the server.
712 */
ossl_statem_client_pre_work(SSL_CONNECTION * s,WORK_STATE wst)713 WORK_STATE ossl_statem_client_pre_work(SSL_CONNECTION *s, WORK_STATE wst)
714 {
715 OSSL_STATEM *st = &s->statem;
716
717 switch (st->hand_state) {
718 default:
719 /* No pre work to be done */
720 break;
721
722 case TLS_ST_CW_CLNT_HELLO:
723 s->shutdown = 0;
724 if (SSL_CONNECTION_IS_DTLS(s)) {
725 /* every DTLS ClientHello resets Finished MAC */
726 if (!ssl3_init_finished_mac(s)) {
727 /* SSLfatal() already called */
728 return WORK_ERROR;
729 }
730 } else if (s->ext.early_data == SSL_EARLY_DATA_REJECTED) {
731 /*
732 * This must be a second ClientHello after an HRR following an
733 * earlier rejected attempt to send early data. Since we were
734 * previously encrypting the early data we now need to reset the
735 * write record layer in order to write in plaintext again.
736 */
737 if (!ssl_set_new_record_layer(s,
738 TLS_ANY_VERSION,
739 OSSL_RECORD_DIRECTION_WRITE,
740 OSSL_RECORD_PROTECTION_LEVEL_NONE,
741 NULL, 0, NULL, 0, NULL, 0, NULL, 0,
742 NULL, 0, NID_undef, NULL, NULL,
743 NULL)) {
744 /* SSLfatal already called */
745 return WORK_ERROR;
746 }
747 }
748 break;
749
750 case TLS_ST_CW_CHANGE:
751 if (SSL_CONNECTION_IS_DTLS(s)) {
752 if (s->hit) {
753 /*
754 * We're into the last flight so we don't retransmit these
755 * messages unless we need to.
756 */
757 st->use_timer = 0;
758 }
759 #ifndef OPENSSL_NO_SCTP
760 if (BIO_dgram_is_sctp(SSL_get_wbio(SSL_CONNECTION_GET_SSL(s)))) {
761 /* Calls SSLfatal() as required */
762 return dtls_wait_for_dry(s);
763 }
764 #endif
765 }
766 break;
767
768 case TLS_ST_PENDING_EARLY_DATA_END:
769 /*
770 * If we've been called by SSL_do_handshake()/SSL_write(), or we did not
771 * attempt to write early data before calling SSL_read() then we press
772 * on with the handshake. Otherwise we pause here.
773 */
774 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING
775 || s->early_data_state == SSL_EARLY_DATA_NONE)
776 return WORK_FINISHED_CONTINUE;
777 /* Fall through */
778
779 case TLS_ST_EARLY_DATA:
780 return tls_finish_handshake(s, wst, 0, 1);
781
782 case TLS_ST_OK:
783 /* Calls SSLfatal() as required */
784 return tls_finish_handshake(s, wst, 1, 1);
785 }
786
787 return WORK_FINISHED_CONTINUE;
788 }
789
790 /*
791 * Perform any work that needs to be done after sending a message from the
792 * client to the server.
793 */
ossl_statem_client_post_work(SSL_CONNECTION * s,WORK_STATE wst)794 WORK_STATE ossl_statem_client_post_work(SSL_CONNECTION *s, WORK_STATE wst)
795 {
796 OSSL_STATEM *st = &s->statem;
797 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
798
799 s->init_num = 0;
800
801 switch (st->hand_state) {
802 default:
803 /* No post work to be done */
804 break;
805
806 case TLS_ST_CW_CLNT_HELLO:
807 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
808 && s->max_early_data > 0) {
809 /*
810 * We haven't selected TLSv1.3 yet so we don't call the change
811 * cipher state function associated with the SSL_METHOD. Instead
812 * we call tls13_change_cipher_state() directly.
813 */
814 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0) {
815 if (!tls13_change_cipher_state(s,
816 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
817 /* SSLfatal() already called */
818 return WORK_ERROR;
819 }
820 }
821 /* else we're in compat mode so we delay flushing until after CCS */
822 } else if (!statem_flush(s)) {
823 return WORK_MORE_A;
824 }
825
826 if (SSL_CONNECTION_IS_DTLS(s)) {
827 /* Treat the next message as the first packet */
828 s->first_packet = 1;
829 }
830 break;
831
832 case TLS_ST_CW_KEY_EXCH:
833 if (tls_client_key_exchange_post_work(s) == 0) {
834 /* SSLfatal() already called */
835 return WORK_ERROR;
836 }
837 break;
838
839 case TLS_ST_CW_CHANGE:
840 if (SSL_CONNECTION_IS_TLS13(s)
841 || s->hello_retry_request == SSL_HRR_PENDING)
842 break;
843 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
844 && s->max_early_data > 0) {
845 /*
846 * We haven't selected TLSv1.3 yet so we don't call the change
847 * cipher state function associated with the SSL_METHOD. Instead
848 * we call tls13_change_cipher_state() directly.
849 */
850 if (!tls13_change_cipher_state(s,
851 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE))
852 return WORK_ERROR;
853 break;
854 }
855 s->session->cipher = s->s3.tmp.new_cipher;
856 #ifdef OPENSSL_NO_COMP
857 s->session->compress_meth = 0;
858 #else
859 if (s->s3.tmp.new_compression == NULL)
860 s->session->compress_meth = 0;
861 else
862 s->session->compress_meth = s->s3.tmp.new_compression->id;
863 #endif
864 if (!ssl->method->ssl3_enc->setup_key_block(s)) {
865 /* SSLfatal() already called */
866 return WORK_ERROR;
867 }
868
869 if (!ssl->method->ssl3_enc->change_cipher_state(s,
870 SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
871 /* SSLfatal() already called */
872 return WORK_ERROR;
873 }
874
875 #ifndef OPENSSL_NO_SCTP
876 if (SSL_CONNECTION_IS_DTLS(s) && s->hit) {
877 /*
878 * Change to new shared key of SCTP-Auth, will be ignored if
879 * no SCTP used.
880 */
881 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
882 0, NULL);
883 }
884 #endif
885 break;
886
887 case TLS_ST_CW_FINISHED:
888 #ifndef OPENSSL_NO_SCTP
889 if (wst == WORK_MORE_A && SSL_CONNECTION_IS_DTLS(s) && s->hit == 0) {
890 /*
891 * Change to new shared key of SCTP-Auth, will be ignored if
892 * no SCTP used.
893 */
894 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
895 0, NULL);
896 }
897 #endif
898 if (statem_flush(s) != 1)
899 return WORK_MORE_B;
900
901 if (SSL_CONNECTION_IS_TLS13(s)) {
902 if (!tls13_save_handshake_digest_for_pha(s)) {
903 /* SSLfatal() already called */
904 return WORK_ERROR;
905 }
906 if (s->post_handshake_auth != SSL_PHA_REQUESTED) {
907 if (!ssl->method->ssl3_enc->change_cipher_state(s,
908 SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
909 /* SSLfatal() already called */
910 return WORK_ERROR;
911 }
912 }
913 }
914 break;
915
916 case TLS_ST_CW_KEY_UPDATE:
917 if (statem_flush(s) != 1)
918 return WORK_MORE_A;
919 if (!tls13_update_key(s, 1)) {
920 /* SSLfatal() already called */
921 return WORK_ERROR;
922 }
923 break;
924 }
925
926 return WORK_FINISHED_CONTINUE;
927 }
928
929 /*
930 * Get the message construction function and message type for sending from the
931 * client
932 *
933 * Valid return values are:
934 * 1: Success
935 * 0: Error
936 */
ossl_statem_client_construct_message(SSL_CONNECTION * s,confunc_f * confunc,int * mt)937 int ossl_statem_client_construct_message(SSL_CONNECTION *s,
938 confunc_f *confunc, int *mt)
939 {
940 OSSL_STATEM *st = &s->statem;
941
942 switch (st->hand_state) {
943 default:
944 /* Shouldn't happen */
945 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_STATE);
946 return 0;
947
948 case TLS_ST_CW_CHANGE:
949 if (SSL_CONNECTION_IS_DTLS(s))
950 *confunc = dtls_construct_change_cipher_spec;
951 else
952 *confunc = tls_construct_change_cipher_spec;
953 *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
954 break;
955
956 case TLS_ST_CW_CLNT_HELLO:
957 *confunc = tls_construct_client_hello;
958 *mt = SSL3_MT_CLIENT_HELLO;
959 break;
960
961 case TLS_ST_CW_END_OF_EARLY_DATA:
962 *confunc = tls_construct_end_of_early_data;
963 *mt = SSL3_MT_END_OF_EARLY_DATA;
964 break;
965
966 case TLS_ST_PENDING_EARLY_DATA_END:
967 *confunc = NULL;
968 *mt = SSL3_MT_DUMMY;
969 break;
970
971 case TLS_ST_CW_CERT:
972 *confunc = tls_construct_client_certificate;
973 *mt = SSL3_MT_CERTIFICATE;
974 break;
975
976 #ifndef OPENSSL_NO_COMP_ALG
977 case TLS_ST_CW_COMP_CERT:
978 *confunc = tls_construct_client_compressed_certificate;
979 *mt = SSL3_MT_COMPRESSED_CERTIFICATE;
980 break;
981 #endif
982
983 case TLS_ST_CW_KEY_EXCH:
984 *confunc = tls_construct_client_key_exchange;
985 *mt = SSL3_MT_CLIENT_KEY_EXCHANGE;
986 break;
987
988 case TLS_ST_CW_CERT_VRFY:
989 *confunc = tls_construct_cert_verify;
990 *mt = SSL3_MT_CERTIFICATE_VERIFY;
991 break;
992
993 #if !defined(OPENSSL_NO_NEXTPROTONEG)
994 case TLS_ST_CW_NEXT_PROTO:
995 *confunc = tls_construct_next_proto;
996 *mt = SSL3_MT_NEXT_PROTO;
997 break;
998 #endif
999 case TLS_ST_CW_FINISHED:
1000 *confunc = tls_construct_finished;
1001 *mt = SSL3_MT_FINISHED;
1002 break;
1003
1004 case TLS_ST_CW_KEY_UPDATE:
1005 *confunc = tls_construct_key_update;
1006 *mt = SSL3_MT_KEY_UPDATE;
1007 break;
1008 }
1009
1010 return 1;
1011 }
1012
1013 /*
1014 * Returns the maximum allowed length for the current message that we are
1015 * reading. Excludes the message header.
1016 */
ossl_statem_client_max_message_size(SSL_CONNECTION * s)1017 size_t ossl_statem_client_max_message_size(SSL_CONNECTION *s)
1018 {
1019 OSSL_STATEM *st = &s->statem;
1020
1021 switch (st->hand_state) {
1022 default:
1023 /* Shouldn't happen */
1024 return 0;
1025
1026 case TLS_ST_CR_SRVR_HELLO:
1027 return SERVER_HELLO_MAX_LENGTH;
1028
1029 case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
1030 return HELLO_VERIFY_REQUEST_MAX_LENGTH;
1031
1032 case TLS_ST_CR_COMP_CERT:
1033 case TLS_ST_CR_CERT:
1034 return s->max_cert_list;
1035
1036 case TLS_ST_CR_CERT_VRFY:
1037 return CERTIFICATE_VERIFY_MAX_LENGTH;
1038
1039 case TLS_ST_CR_CERT_STATUS:
1040 return SSL3_RT_MAX_PLAIN_LENGTH;
1041
1042 case TLS_ST_CR_KEY_EXCH:
1043 return SERVER_KEY_EXCH_MAX_LENGTH;
1044
1045 case TLS_ST_CR_CERT_REQ:
1046 /*
1047 * Set to s->max_cert_list for compatibility with previous releases. In
1048 * practice these messages can get quite long if servers are configured
1049 * to provide a long list of acceptable CAs
1050 */
1051 return s->max_cert_list;
1052
1053 case TLS_ST_CR_SRVR_DONE:
1054 return SERVER_HELLO_DONE_MAX_LENGTH;
1055
1056 case TLS_ST_CR_CHANGE:
1057 if (s->version == DTLS1_BAD_VER)
1058 return 3;
1059 return CCS_MAX_LENGTH;
1060
1061 case TLS_ST_CR_SESSION_TICKET:
1062 return (SSL_CONNECTION_IS_TLS13(s)) ? SESSION_TICKET_MAX_LENGTH_TLS13
1063 : SESSION_TICKET_MAX_LENGTH_TLS12;
1064
1065 case TLS_ST_CR_FINISHED:
1066 return FINISHED_MAX_LENGTH;
1067
1068 case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
1069 return ENCRYPTED_EXTENSIONS_MAX_LENGTH;
1070
1071 case TLS_ST_CR_KEY_UPDATE:
1072 return KEY_UPDATE_MAX_LENGTH;
1073 }
1074 }
1075
1076 /*
1077 * Process a message that the client has received from the server.
1078 */
ossl_statem_client_process_message(SSL_CONNECTION * s,PACKET * pkt)1079 MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL_CONNECTION *s,
1080 PACKET *pkt)
1081 {
1082 OSSL_STATEM *st = &s->statem;
1083
1084 switch (st->hand_state) {
1085 default:
1086 /* Shouldn't happen */
1087 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1088 return MSG_PROCESS_ERROR;
1089
1090 case TLS_ST_CR_SRVR_HELLO:
1091 return tls_process_server_hello(s, pkt);
1092
1093 case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
1094 return dtls_process_hello_verify(s, pkt);
1095
1096 case TLS_ST_CR_CERT:
1097 return tls_process_server_certificate(s, pkt);
1098
1099 #ifndef OPENSSL_NO_COMP_ALG
1100 case TLS_ST_CR_COMP_CERT:
1101 return tls_process_server_compressed_certificate(s, pkt);
1102 #endif
1103
1104 case TLS_ST_CR_CERT_VRFY:
1105 return tls_process_cert_verify(s, pkt);
1106
1107 case TLS_ST_CR_CERT_STATUS:
1108 return tls_process_cert_status(s, pkt);
1109
1110 case TLS_ST_CR_KEY_EXCH:
1111 return tls_process_key_exchange(s, pkt);
1112
1113 case TLS_ST_CR_CERT_REQ:
1114 return tls_process_certificate_request(s, pkt);
1115
1116 case TLS_ST_CR_SRVR_DONE:
1117 return tls_process_server_done(s, pkt);
1118
1119 case TLS_ST_CR_CHANGE:
1120 return tls_process_change_cipher_spec(s, pkt);
1121
1122 case TLS_ST_CR_SESSION_TICKET:
1123 return tls_process_new_session_ticket(s, pkt);
1124
1125 case TLS_ST_CR_FINISHED:
1126 return tls_process_finished(s, pkt);
1127
1128 case TLS_ST_CR_HELLO_REQ:
1129 return tls_process_hello_req(s, pkt);
1130
1131 case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
1132 return tls_process_encrypted_extensions(s, pkt);
1133
1134 case TLS_ST_CR_KEY_UPDATE:
1135 return tls_process_key_update(s, pkt);
1136 }
1137 }
1138
1139 /*
1140 * Perform any further processing required following the receipt of a message
1141 * from the server
1142 */
ossl_statem_client_post_process_message(SSL_CONNECTION * s,WORK_STATE wst)1143 WORK_STATE ossl_statem_client_post_process_message(SSL_CONNECTION *s,
1144 WORK_STATE wst)
1145 {
1146 OSSL_STATEM *st = &s->statem;
1147
1148 switch (st->hand_state) {
1149 default:
1150 /* Shouldn't happen */
1151 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1152 return WORK_ERROR;
1153
1154 case TLS_ST_CR_CERT:
1155 case TLS_ST_CR_COMP_CERT:
1156 return tls_post_process_server_certificate(s, wst);
1157
1158 case TLS_ST_CR_CERT_VRFY:
1159 case TLS_ST_CR_CERT_REQ:
1160 return tls_prepare_client_certificate(s, wst);
1161 }
1162 }
1163
tls_construct_client_hello(SSL_CONNECTION * s,WPACKET * pkt)1164 CON_FUNC_RETURN tls_construct_client_hello(SSL_CONNECTION *s, WPACKET *pkt)
1165 {
1166 unsigned char *p;
1167 size_t sess_id_len;
1168 int i, protverr;
1169 #ifndef OPENSSL_NO_COMP
1170 SSL_COMP *comp;
1171 #endif
1172 SSL_SESSION *sess = s->session;
1173 unsigned char *session_id;
1174 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1175
1176 /* Work out what SSL/TLS/DTLS version to use */
1177 protverr = ssl_set_client_hello_version(s);
1178 if (protverr != 0) {
1179 SSLfatal(s, SSL_AD_INTERNAL_ERROR, protverr);
1180 return CON_FUNC_ERROR;
1181 }
1182
1183 if (sess == NULL
1184 || !ssl_version_supported(s, sess->ssl_version, NULL)
1185 || !SSL_SESSION_is_resumable(sess)) {
1186 if (s->hello_retry_request == SSL_HRR_NONE
1187 && !ssl_get_new_session(s, 0)) {
1188 /* SSLfatal() already called */
1189 return CON_FUNC_ERROR;
1190 }
1191 }
1192 /* else use the pre-loaded session */
1193
1194 p = s->s3.client_random;
1195
1196 /*
1197 * for DTLS if client_random is initialized, reuse it, we are
1198 * required to use same upon reply to HelloVerify
1199 */
1200 if (SSL_CONNECTION_IS_DTLS(s)) {
1201 size_t idx;
1202 i = 1;
1203 for (idx = 0; idx < sizeof(s->s3.client_random); idx++) {
1204 if (p[idx]) {
1205 i = 0;
1206 break;
1207 }
1208 }
1209 } else {
1210 i = (s->hello_retry_request == SSL_HRR_NONE);
1211 }
1212
1213 if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3.client_random),
1214 DOWNGRADE_NONE) <= 0) {
1215 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1216 return CON_FUNC_ERROR;
1217 }
1218
1219 /*-
1220 * version indicates the negotiated version: for example from
1221 * an SSLv2/v3 compatible client hello). The client_version
1222 * field is the maximum version we permit and it is also
1223 * used in RSA encrypted premaster secrets. Some servers can
1224 * choke if we initially report a higher version then
1225 * renegotiate to a lower one in the premaster secret. This
1226 * didn't happen with TLS 1.0 as most servers supported it
1227 * but it can with TLS 1.1 or later if the server only supports
1228 * 1.0.
1229 *
1230 * Possible scenario with previous logic:
1231 * 1. Client hello indicates TLS 1.2
1232 * 2. Server hello says TLS 1.0
1233 * 3. RSA encrypted premaster secret uses 1.2.
1234 * 4. Handshake proceeds using TLS 1.0.
1235 * 5. Server sends hello request to renegotiate.
1236 * 6. Client hello indicates TLS v1.0 as we now
1237 * know that is maximum server supports.
1238 * 7. Server chokes on RSA encrypted premaster secret
1239 * containing version 1.0.
1240 *
1241 * For interoperability it should be OK to always use the
1242 * maximum version we support in client hello and then rely
1243 * on the checking of version to ensure the servers isn't
1244 * being inconsistent: for example initially negotiating with
1245 * TLS 1.0 and renegotiating with TLS 1.2. We do this by using
1246 * client_version in client hello and not resetting it to
1247 * the negotiated version.
1248 *
1249 * For TLS 1.3 we always set the ClientHello version to 1.2 and rely on the
1250 * supported_versions extension for the real supported versions.
1251 */
1252 if (!WPACKET_put_bytes_u16(pkt, s->client_version)
1253 || !WPACKET_memcpy(pkt, s->s3.client_random, SSL3_RANDOM_SIZE)) {
1254 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1255 return CON_FUNC_ERROR;
1256 }
1257
1258 /* Session ID */
1259 session_id = s->session->session_id;
1260 if (s->new_session || s->session->ssl_version == TLS1_3_VERSION) {
1261 if (s->version == TLS1_3_VERSION
1262 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) {
1263 sess_id_len = sizeof(s->tmp_session_id);
1264 s->tmp_session_id_len = sess_id_len;
1265 session_id = s->tmp_session_id;
1266 if (s->hello_retry_request == SSL_HRR_NONE
1267 && RAND_bytes_ex(sctx->libctx, s->tmp_session_id,
1268 sess_id_len, 0) <= 0) {
1269 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1270 return CON_FUNC_ERROR;
1271 }
1272 } else {
1273 sess_id_len = 0;
1274 }
1275 } else {
1276 assert(s->session->session_id_length <= sizeof(s->session->session_id));
1277 sess_id_len = s->session->session_id_length;
1278 if (s->version == TLS1_3_VERSION) {
1279 s->tmp_session_id_len = sess_id_len;
1280 memcpy(s->tmp_session_id, s->session->session_id, sess_id_len);
1281 }
1282 }
1283 if (!WPACKET_start_sub_packet_u8(pkt)
1284 || (sess_id_len != 0 && !WPACKET_memcpy(pkt, session_id,
1285 sess_id_len))
1286 || !WPACKET_close(pkt)) {
1287 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1288 return CON_FUNC_ERROR;
1289 }
1290
1291 /* cookie stuff for DTLS */
1292 if (SSL_CONNECTION_IS_DTLS(s)) {
1293 if (s->d1->cookie_len > sizeof(s->d1->cookie)
1294 || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie,
1295 s->d1->cookie_len)) {
1296 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1297 return CON_FUNC_ERROR;
1298 }
1299 }
1300
1301 /* Ciphers supported */
1302 if (!WPACKET_start_sub_packet_u16(pkt)) {
1303 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1304 return CON_FUNC_ERROR;
1305 }
1306
1307 if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s)),
1308 pkt)) {
1309 /* SSLfatal() already called */
1310 return CON_FUNC_ERROR;
1311 }
1312 if (!WPACKET_close(pkt)) {
1313 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1314 return CON_FUNC_ERROR;
1315 }
1316
1317 /* COMPRESSION */
1318 if (!WPACKET_start_sub_packet_u8(pkt)) {
1319 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1320 return CON_FUNC_ERROR;
1321 }
1322 #ifndef OPENSSL_NO_COMP
1323 if (ssl_allow_compression(s)
1324 && sctx->comp_methods
1325 && (SSL_CONNECTION_IS_DTLS(s)
1326 || s->s3.tmp.max_ver < TLS1_3_VERSION)) {
1327 int compnum = sk_SSL_COMP_num(sctx->comp_methods);
1328 for (i = 0; i < compnum; i++) {
1329 comp = sk_SSL_COMP_value(sctx->comp_methods, i);
1330 if (!WPACKET_put_bytes_u8(pkt, comp->id)) {
1331 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1332 return CON_FUNC_ERROR;
1333 }
1334 }
1335 }
1336 #endif
1337 /* Add the NULL method */
1338 if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) {
1339 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1340 return CON_FUNC_ERROR;
1341 }
1342
1343 /* TLS extensions */
1344 if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0)) {
1345 /* SSLfatal() already called */
1346 return CON_FUNC_ERROR;
1347 }
1348
1349 return CON_FUNC_SUCCESS;
1350 }
1351
dtls_process_hello_verify(SSL_CONNECTION * s,PACKET * pkt)1352 MSG_PROCESS_RETURN dtls_process_hello_verify(SSL_CONNECTION *s, PACKET *pkt)
1353 {
1354 size_t cookie_len;
1355 PACKET cookiepkt;
1356
1357 if (!PACKET_forward(pkt, 2)
1358 || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) {
1359 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1360 return MSG_PROCESS_ERROR;
1361 }
1362
1363 cookie_len = PACKET_remaining(&cookiepkt);
1364 if (cookie_len > sizeof(s->d1->cookie)) {
1365 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_LENGTH_TOO_LONG);
1366 return MSG_PROCESS_ERROR;
1367 }
1368
1369 if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) {
1370 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1371 return MSG_PROCESS_ERROR;
1372 }
1373 s->d1->cookie_len = cookie_len;
1374
1375 return MSG_PROCESS_FINISHED_READING;
1376 }
1377
set_client_ciphersuite(SSL_CONNECTION * s,const unsigned char * cipherchars)1378 static int set_client_ciphersuite(SSL_CONNECTION *s,
1379 const unsigned char *cipherchars)
1380 {
1381 STACK_OF(SSL_CIPHER) *sk;
1382 const SSL_CIPHER *c;
1383 int i;
1384 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1385
1386 c = ssl_get_cipher_by_char(s, cipherchars, 0);
1387 if (c == NULL) {
1388 /* unknown cipher */
1389 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CIPHER_RETURNED);
1390 return 0;
1391 }
1392 /*
1393 * If it is a disabled cipher we either didn't send it in client hello,
1394 * or it's not allowed for the selected protocol. So we return an error.
1395 */
1396 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK, 1)) {
1397 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED);
1398 return 0;
1399 }
1400
1401 sk = ssl_get_ciphers_by_id(s);
1402 i = sk_SSL_CIPHER_find(sk, c);
1403 if (i < 0) {
1404 /* we did not say we would use this cipher */
1405 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED);
1406 return 0;
1407 }
1408
1409 if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.new_cipher != NULL
1410 && s->s3.tmp.new_cipher->id != c->id) {
1411 /* ServerHello selected a different ciphersuite to that in the HRR */
1412 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED);
1413 return 0;
1414 }
1415
1416 /*
1417 * Depending on the session caching (internal/external), the cipher
1418 * and/or cipher_id values may not be set. Make sure that cipher_id is
1419 * set and use it for comparison.
1420 */
1421 if (s->session->cipher != NULL)
1422 s->session->cipher_id = s->session->cipher->id;
1423 if (s->hit && (s->session->cipher_id != c->id)) {
1424 if (SSL_CONNECTION_IS_TLS13(s)) {
1425 const EVP_MD *md = ssl_md(sctx, c->algorithm2);
1426
1427 if (!ossl_assert(s->session->cipher != NULL)) {
1428 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1429 return 0;
1430 }
1431 /*
1432 * In TLSv1.3 it is valid for the server to select a different
1433 * ciphersuite as long as the hash is the same.
1434 */
1435 if (md == NULL
1436 || md != ssl_md(sctx, s->session->cipher->algorithm2)) {
1437 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1438 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED);
1439 return 0;
1440 }
1441 } else {
1442 /*
1443 * Prior to TLSv1.3 resuming a session always meant using the same
1444 * ciphersuite.
1445 */
1446 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1447 SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
1448 return 0;
1449 }
1450 }
1451 s->s3.tmp.new_cipher = c;
1452
1453 return 1;
1454 }
1455
tls_process_server_hello(SSL_CONNECTION * s,PACKET * pkt)1456 MSG_PROCESS_RETURN tls_process_server_hello(SSL_CONNECTION *s, PACKET *pkt)
1457 {
1458 PACKET session_id, extpkt;
1459 size_t session_id_len;
1460 const unsigned char *cipherchars;
1461 int hrr = 0;
1462 unsigned int compression;
1463 unsigned int sversion;
1464 unsigned int context;
1465 RAW_EXTENSION *extensions = NULL;
1466 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1467 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s);
1468 #ifndef OPENSSL_NO_COMP
1469 SSL_COMP *comp;
1470 #endif
1471
1472 if (!PACKET_get_net_2(pkt, &sversion)) {
1473 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1474 goto err;
1475 }
1476
1477 /* load the server random */
1478 if (s->version == TLS1_3_VERSION
1479 && sversion == TLS1_2_VERSION
1480 && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE
1481 && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) {
1482 if (s->hello_retry_request != SSL_HRR_NONE) {
1483 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
1484 goto err;
1485 }
1486 s->hello_retry_request = SSL_HRR_PENDING;
1487 /* Tell the record layer that we know we're going to get TLSv1.3 */
1488 if (!ssl_set_record_protocol_version(s, s->version)) {
1489 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1490 goto err;
1491 }
1492 hrr = 1;
1493 if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) {
1494 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1495 goto err;
1496 }
1497 } else {
1498 if (!PACKET_copy_bytes(pkt, s->s3.server_random, SSL3_RANDOM_SIZE)) {
1499 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1500 goto err;
1501 }
1502 }
1503
1504 /* Get the session-id. */
1505 if (!PACKET_get_length_prefixed_1(pkt, &session_id)) {
1506 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1507 goto err;
1508 }
1509 session_id_len = PACKET_remaining(&session_id);
1510 if (session_id_len > sizeof(s->session->session_id)
1511 || session_id_len > SSL3_SESSION_ID_SIZE) {
1512 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_SSL3_SESSION_ID_TOO_LONG);
1513 goto err;
1514 }
1515
1516 if (!PACKET_get_bytes(pkt, &cipherchars, TLS_CIPHER_LEN)) {
1517 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1518 goto err;
1519 }
1520
1521 if (!PACKET_get_1(pkt, &compression)) {
1522 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1523 goto err;
1524 }
1525
1526 /* TLS extensions */
1527 if (PACKET_remaining(pkt) == 0 && !hrr) {
1528 PACKET_null_init(&extpkt);
1529 } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt)
1530 || PACKET_remaining(pkt) != 0) {
1531 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
1532 goto err;
1533 }
1534
1535 if (!hrr) {
1536 if (!tls_collect_extensions(s, &extpkt,
1537 SSL_EXT_TLS1_2_SERVER_HELLO
1538 | SSL_EXT_TLS1_3_SERVER_HELLO,
1539 &extensions, NULL, 1)) {
1540 /* SSLfatal() already called */
1541 goto err;
1542 }
1543
1544 if (!ssl_choose_client_version(s, sversion, extensions)) {
1545 /* SSLfatal() already called */
1546 goto err;
1547 }
1548 }
1549
1550 if (SSL_CONNECTION_IS_TLS13(s) || hrr) {
1551 if (compression != 0) {
1552 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1553 SSL_R_INVALID_COMPRESSION_ALGORITHM);
1554 goto err;
1555 }
1556
1557 if (session_id_len != s->tmp_session_id_len
1558 || memcmp(PACKET_data(&session_id), s->tmp_session_id,
1559 session_id_len) != 0) {
1560 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_INVALID_SESSION_ID);
1561 goto err;
1562 }
1563 }
1564
1565 if (hrr) {
1566 if (!set_client_ciphersuite(s, cipherchars)) {
1567 /* SSLfatal() already called */
1568 goto err;
1569 }
1570
1571 return tls_process_as_hello_retry_request(s, &extpkt);
1572 }
1573
1574 /*
1575 * Now we have chosen the version we need to check again that the extensions
1576 * are appropriate for this version.
1577 */
1578 context = SSL_CONNECTION_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO
1579 : SSL_EXT_TLS1_2_SERVER_HELLO;
1580 if (!tls_validate_all_contexts(s, context, extensions)) {
1581 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
1582 goto err;
1583 }
1584
1585 s->hit = 0;
1586
1587 if (SSL_CONNECTION_IS_TLS13(s)) {
1588 /*
1589 * In TLSv1.3 a ServerHello message signals a key change so the end of
1590 * the message must be on a record boundary.
1591 */
1592 if (RECORD_LAYER_processed_read_pending(&s->rlayer)) {
1593 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
1594 SSL_R_NOT_ON_RECORD_BOUNDARY);
1595 goto err;
1596 }
1597
1598 /* This will set s->hit if we are resuming */
1599 if (!tls_parse_extension(s, TLSEXT_IDX_psk,
1600 SSL_EXT_TLS1_3_SERVER_HELLO,
1601 extensions, NULL, 0)) {
1602 /* SSLfatal() already called */
1603 goto err;
1604 }
1605 } else {
1606 /*
1607 * Check if we can resume the session based on external pre-shared
1608 * secret. EAP-FAST (RFC 4851) supports two types of session resumption.
1609 * Resumption based on server-side state works with session IDs.
1610 * Resumption based on pre-shared Protected Access Credentials (PACs)
1611 * works by overriding the SessionTicket extension at the application
1612 * layer, and does not send a session ID. (We do not know whether
1613 * EAP-FAST servers would honour the session ID.) Therefore, the session
1614 * ID alone is not a reliable indicator of session resumption, so we
1615 * first check if we can resume, and later peek at the next handshake
1616 * message to see if the server wants to resume.
1617 */
1618 if (s->version >= TLS1_VERSION
1619 && s->ext.session_secret_cb != NULL && s->session->ext.tick) {
1620 const SSL_CIPHER *pref_cipher = NULL;
1621 /*
1622 * s->session->master_key_length is a size_t, but this is an int for
1623 * backwards compat reasons
1624 */
1625 int master_key_length;
1626
1627 master_key_length = sizeof(s->session->master_key);
1628 if (s->ext.session_secret_cb(ussl, s->session->master_key,
1629 &master_key_length,
1630 NULL, &pref_cipher,
1631 s->ext.session_secret_cb_arg)
1632 && master_key_length > 0) {
1633 s->session->master_key_length = master_key_length;
1634 s->session->cipher = pref_cipher ?
1635 pref_cipher : ssl_get_cipher_by_char(s, cipherchars, 0);
1636 } else {
1637 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1638 goto err;
1639 }
1640 }
1641
1642 if (session_id_len != 0
1643 && session_id_len == s->session->session_id_length
1644 && memcmp(PACKET_data(&session_id), s->session->session_id,
1645 session_id_len) == 0)
1646 s->hit = 1;
1647 }
1648
1649 if (s->hit) {
1650 if (s->sid_ctx_length != s->session->sid_ctx_length
1651 || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) {
1652 /* actually a client application bug */
1653 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1654 SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
1655 goto err;
1656 }
1657 } else {
1658 /*
1659 * If we were trying for session-id reuse but the server
1660 * didn't resume, make a new SSL_SESSION.
1661 * In the case of EAP-FAST and PAC, we do not send a session ID,
1662 * so the PAC-based session secret is always preserved. It'll be
1663 * overwritten if the server refuses resumption.
1664 */
1665 if (s->session->session_id_length > 0) {
1666 ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_miss);
1667 if (!ssl_get_new_session(s, 0)) {
1668 /* SSLfatal() already called */
1669 goto err;
1670 }
1671 }
1672
1673 s->session->ssl_version = s->version;
1674 /*
1675 * In TLSv1.2 and below we save the session id we were sent so we can
1676 * resume it later. In TLSv1.3 the session id we were sent is just an
1677 * echo of what we originally sent in the ClientHello and should not be
1678 * used for resumption.
1679 */
1680 if (!SSL_CONNECTION_IS_TLS13(s)) {
1681 s->session->session_id_length = session_id_len;
1682 /* session_id_len could be 0 */
1683 if (session_id_len > 0)
1684 memcpy(s->session->session_id, PACKET_data(&session_id),
1685 session_id_len);
1686 }
1687 }
1688
1689 /* Session version and negotiated protocol version should match */
1690 if (s->version != s->session->ssl_version) {
1691 SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
1692 SSL_R_SSL_SESSION_VERSION_MISMATCH);
1693 goto err;
1694 }
1695 /*
1696 * Now that we know the version, update the check to see if it's an allowed
1697 * version.
1698 */
1699 s->s3.tmp.min_ver = s->version;
1700 s->s3.tmp.max_ver = s->version;
1701
1702 if (!set_client_ciphersuite(s, cipherchars)) {
1703 /* SSLfatal() already called */
1704 goto err;
1705 }
1706
1707 #ifdef OPENSSL_NO_COMP
1708 if (compression != 0) {
1709 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1710 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
1711 goto err;
1712 }
1713 /*
1714 * If compression is disabled we'd better not try to resume a session
1715 * using compression.
1716 */
1717 if (s->session->compress_meth != 0) {
1718 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_COMPRESSION);
1719 goto err;
1720 }
1721 #else
1722 if (s->hit && compression != s->session->compress_meth) {
1723 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1724 SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED);
1725 goto err;
1726 }
1727 if (compression == 0)
1728 comp = NULL;
1729 else if (!ssl_allow_compression(s)) {
1730 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COMPRESSION_DISABLED);
1731 goto err;
1732 } else {
1733 comp = ssl3_comp_find(SSL_CONNECTION_GET_CTX(s)->comp_methods,
1734 compression);
1735 }
1736
1737 if (compression != 0 && comp == NULL) {
1738 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1739 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
1740 goto err;
1741 } else {
1742 s->s3.tmp.new_compression = comp;
1743 }
1744 #endif
1745
1746 if (!tls_parse_all_extensions(s, context, extensions, NULL, 0, 1)) {
1747 /* SSLfatal() already called */
1748 goto err;
1749 }
1750
1751 #ifndef OPENSSL_NO_SCTP
1752 if (SSL_CONNECTION_IS_DTLS(s) && s->hit) {
1753 unsigned char sctpauthkey[64];
1754 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
1755 size_t labellen;
1756
1757 /*
1758 * Add new shared key for SCTP-Auth, will be ignored if
1759 * no SCTP used.
1760 */
1761 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
1762 sizeof(DTLS1_SCTP_AUTH_LABEL));
1763
1764 /* Don't include the terminating zero. */
1765 labellen = sizeof(labelbuffer) - 1;
1766 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG)
1767 labellen += 1;
1768
1769 if (SSL_export_keying_material(ssl, sctpauthkey,
1770 sizeof(sctpauthkey),
1771 labelbuffer,
1772 labellen, NULL, 0, 0) <= 0) {
1773 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1774 goto err;
1775 }
1776
1777 BIO_ctrl(SSL_get_wbio(ssl),
1778 BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
1779 sizeof(sctpauthkey), sctpauthkey);
1780 }
1781 #endif
1782
1783 /*
1784 * In TLSv1.3 we have some post-processing to change cipher state, otherwise
1785 * we're done with this message
1786 */
1787 if (SSL_CONNECTION_IS_TLS13(s)) {
1788 if (!ssl->method->ssl3_enc->setup_key_block(s)
1789 || !ssl->method->ssl3_enc->change_cipher_state(s,
1790 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ)) {
1791 /* SSLfatal() already called */
1792 goto err;
1793 }
1794 /*
1795 * If we're not doing early-data and we're not going to send a dummy CCS
1796 * (i.e. no middlebox compat mode) then we can change the write keys
1797 * immediately. Otherwise we have to defer this until after all possible
1798 * early data is written. We could just always defer until the last
1799 * moment except QUIC needs it done at the same time as the read keys
1800 * are changed. Since QUIC doesn't do TLS early data or need middlebox
1801 * compat this doesn't cause a problem.
1802 */
1803 if (s->early_data_state == SSL_EARLY_DATA_NONE
1804 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0
1805 && !ssl->method->ssl3_enc->change_cipher_state(s,
1806 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
1807 /* SSLfatal() already called */
1808 goto err;
1809 }
1810 }
1811
1812 OPENSSL_free(extensions);
1813 return MSG_PROCESS_CONTINUE_READING;
1814 err:
1815 OPENSSL_free(extensions);
1816 return MSG_PROCESS_ERROR;
1817 }
1818
tls_process_as_hello_retry_request(SSL_CONNECTION * s,PACKET * extpkt)1819 static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s,
1820 PACKET *extpkt)
1821 {
1822 RAW_EXTENSION *extensions = NULL;
1823
1824 /*
1825 * If we were sending early_data then any alerts should not be sent using
1826 * the old wrlmethod.
1827 */
1828 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING
1829 && !ssl_set_new_record_layer(s,
1830 TLS_ANY_VERSION,
1831 OSSL_RECORD_DIRECTION_WRITE,
1832 OSSL_RECORD_PROTECTION_LEVEL_NONE,
1833 NULL, 0, NULL, 0, NULL, 0, NULL, 0,
1834 NULL, 0, NID_undef, NULL, NULL, NULL)) {
1835 /* SSLfatal already called */
1836 goto err;
1837 }
1838 /* We are definitely going to be using TLSv1.3 */
1839 s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, TLS1_3_VERSION);
1840
1841 if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST,
1842 &extensions, NULL, 1)
1843 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST,
1844 extensions, NULL, 0, 1)) {
1845 /* SSLfatal() already called */
1846 goto err;
1847 }
1848
1849 OPENSSL_free(extensions);
1850 extensions = NULL;
1851
1852 if (s->ext.tls13_cookie_len == 0 && s->s3.tmp.pkey != NULL) {
1853 /*
1854 * We didn't receive a cookie or a new key_share so the next
1855 * ClientHello will not change
1856 */
1857 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CHANGE_FOLLOWING_HRR);
1858 goto err;
1859 }
1860
1861 /*
1862 * Re-initialise the Transcript Hash. We're going to prepopulate it with
1863 * a synthetic message_hash in place of ClientHello1.
1864 */
1865 if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) {
1866 /* SSLfatal() already called */
1867 goto err;
1868 }
1869
1870 /*
1871 * Add this message to the Transcript Hash. Normally this is done
1872 * automatically prior to the message processing stage. However due to the
1873 * need to create the synthetic message hash, we defer that step until now
1874 * for HRR messages.
1875 */
1876 if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
1877 s->init_num + SSL3_HM_HEADER_LENGTH)) {
1878 /* SSLfatal() already called */
1879 goto err;
1880 }
1881
1882 return MSG_PROCESS_FINISHED_READING;
1883 err:
1884 OPENSSL_free(extensions);
1885 return MSG_PROCESS_ERROR;
1886 }
1887
tls_process_server_rpk(SSL_CONNECTION * sc,PACKET * pkt)1888 MSG_PROCESS_RETURN tls_process_server_rpk(SSL_CONNECTION *sc, PACKET *pkt)
1889 {
1890 EVP_PKEY *peer_rpk = NULL;
1891
1892 if (!tls_process_rpk(sc, pkt, &peer_rpk)) {
1893 /* SSLfatal() already called */
1894 return MSG_PROCESS_ERROR;
1895 }
1896
1897 if (peer_rpk == NULL) {
1898 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_CERTIFICATE);
1899 return MSG_PROCESS_ERROR;
1900 }
1901
1902 EVP_PKEY_free(sc->session->peer_rpk);
1903 sc->session->peer_rpk = peer_rpk;
1904
1905 return MSG_PROCESS_CONTINUE_PROCESSING;
1906 }
1907
tls_post_process_server_rpk(SSL_CONNECTION * sc,WORK_STATE wst)1908 static WORK_STATE tls_post_process_server_rpk(SSL_CONNECTION *sc,
1909 WORK_STATE wst)
1910 {
1911 size_t certidx;
1912 const SSL_CERT_LOOKUP *clu;
1913
1914 if (sc->session->peer_rpk == NULL) {
1915 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER,
1916 SSL_R_INVALID_RAW_PUBLIC_KEY);
1917 return WORK_ERROR;
1918 }
1919
1920 if (sc->rwstate == SSL_RETRY_VERIFY)
1921 sc->rwstate = SSL_NOTHING;
1922 if (ssl_verify_rpk(sc, sc->session->peer_rpk) > 0
1923 && sc->rwstate == SSL_RETRY_VERIFY)
1924 return WORK_MORE_A;
1925
1926 if ((clu = ssl_cert_lookup_by_pkey(sc->session->peer_rpk, &certidx,
1927 SSL_CONNECTION_GET_CTX(sc))) == NULL) {
1928 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1929 return WORK_ERROR;
1930 }
1931
1932 /*
1933 * Check certificate type is consistent with ciphersuite. For TLS 1.3
1934 * skip check since TLS 1.3 ciphersuites can be used with any certificate
1935 * type.
1936 */
1937 if (!SSL_CONNECTION_IS_TLS13(sc)) {
1938 if ((clu->amask & sc->s3.tmp.new_cipher->algorithm_auth) == 0) {
1939 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_RPK_TYPE);
1940 return WORK_ERROR;
1941 }
1942 }
1943
1944 /* Ensure there is no peer/peer_chain */
1945 X509_free(sc->session->peer);
1946 sc->session->peer = NULL;
1947 sk_X509_pop_free(sc->session->peer_chain, X509_free);
1948 sc->session->peer_chain = NULL;
1949 sc->session->verify_result = sc->verify_result;
1950
1951 /* Save the current hash state for when we receive the CertificateVerify */
1952 if (SSL_CONNECTION_IS_TLS13(sc)
1953 && !ssl_handshake_hash(sc, sc->cert_verify_hash,
1954 sizeof(sc->cert_verify_hash),
1955 &sc->cert_verify_hash_len)) {
1956 /* SSLfatal() already called */
1957 return WORK_ERROR;
1958 }
1959
1960 return WORK_FINISHED_CONTINUE;
1961 }
1962
1963 /* prepare server cert verification by setting s->session->peer_chain from pkt */
tls_process_server_certificate(SSL_CONNECTION * s,PACKET * pkt)1964 MSG_PROCESS_RETURN tls_process_server_certificate(SSL_CONNECTION *s,
1965 PACKET *pkt)
1966 {
1967 unsigned long cert_list_len, cert_len;
1968 X509 *x = NULL;
1969 const unsigned char *certstart, *certbytes;
1970 size_t chainidx;
1971 unsigned int context = 0;
1972 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1973
1974 if (s->ext.server_cert_type == TLSEXT_cert_type_rpk)
1975 return tls_process_server_rpk(s, pkt);
1976 if (s->ext.server_cert_type != TLSEXT_cert_type_x509) {
1977 SSLfatal(s, SSL_AD_UNSUPPORTED_CERTIFICATE,
1978 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1979 goto err;
1980 }
1981
1982 if ((s->session->peer_chain = sk_X509_new_null()) == NULL) {
1983 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
1984 goto err;
1985 }
1986
1987 if ((SSL_CONNECTION_IS_TLS13(s) && !PACKET_get_1(pkt, &context))
1988 || context != 0
1989 || !PACKET_get_net_3(pkt, &cert_list_len)
1990 || PACKET_remaining(pkt) != cert_list_len
1991 || PACKET_remaining(pkt) == 0) {
1992 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1993 goto err;
1994 }
1995 for (chainidx = 0; PACKET_remaining(pkt); chainidx++) {
1996 if (!PACKET_get_net_3(pkt, &cert_len)
1997 || !PACKET_get_bytes(pkt, &certbytes, cert_len)) {
1998 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CERT_LENGTH_MISMATCH);
1999 goto err;
2000 }
2001
2002 certstart = certbytes;
2003 x = X509_new_ex(sctx->libctx, sctx->propq);
2004 if (x == NULL) {
2005 SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_ASN1_LIB);
2006 goto err;
2007 }
2008 if (d2i_X509(&x, (const unsigned char **)&certbytes,
2009 cert_len) == NULL) {
2010 SSLfatal(s, SSL_AD_BAD_CERTIFICATE, ERR_R_ASN1_LIB);
2011 goto err;
2012 }
2013
2014 if (certbytes != (certstart + cert_len)) {
2015 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CERT_LENGTH_MISMATCH);
2016 goto err;
2017 }
2018
2019 if (SSL_CONNECTION_IS_TLS13(s)) {
2020 RAW_EXTENSION *rawexts = NULL;
2021 PACKET extensions;
2022
2023 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) {
2024 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
2025 goto err;
2026 }
2027 if (!tls_collect_extensions(s, &extensions,
2028 SSL_EXT_TLS1_3_CERTIFICATE, &rawexts,
2029 NULL, chainidx == 0)
2030 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE,
2031 rawexts, x, chainidx,
2032 PACKET_remaining(pkt) == 0)) {
2033 OPENSSL_free(rawexts);
2034 /* SSLfatal already called */
2035 goto err;
2036 }
2037 OPENSSL_free(rawexts);
2038 }
2039
2040 if (!sk_X509_push(s->session->peer_chain, x)) {
2041 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
2042 goto err;
2043 }
2044 x = NULL;
2045 }
2046 return MSG_PROCESS_CONTINUE_PROCESSING;
2047
2048 err:
2049 X509_free(x);
2050 OSSL_STACK_OF_X509_free(s->session->peer_chain);
2051 s->session->peer_chain = NULL;
2052 return MSG_PROCESS_ERROR;
2053 }
2054
2055 /*
2056 * Verify the s->session->peer_chain and check server cert type.
2057 * On success set s->session->peer and s->session->verify_result.
2058 * Else the peer certificate verification callback may request retry.
2059 */
tls_post_process_server_certificate(SSL_CONNECTION * s,WORK_STATE wst)2060 WORK_STATE tls_post_process_server_certificate(SSL_CONNECTION *s,
2061 WORK_STATE wst)
2062 {
2063 X509 *x;
2064 EVP_PKEY *pkey = NULL;
2065 const SSL_CERT_LOOKUP *clu;
2066 size_t certidx;
2067 int i;
2068
2069 if (s->ext.server_cert_type == TLSEXT_cert_type_rpk)
2070 return tls_post_process_server_rpk(s, wst);
2071
2072 if (s->rwstate == SSL_RETRY_VERIFY)
2073 s->rwstate = SSL_NOTHING;
2074 i = ssl_verify_cert_chain(s, s->session->peer_chain);
2075 if (i > 0 && s->rwstate == SSL_RETRY_VERIFY) {
2076 return WORK_MORE_A;
2077 }
2078 /*
2079 * The documented interface is that SSL_VERIFY_PEER should be set in order
2080 * for client side verification of the server certificate to take place.
2081 * However, historically the code has only checked that *any* flag is set
2082 * to cause server verification to take place. Use of the other flags makes
2083 * no sense in client mode. An attempt to clean up the semantics was
2084 * reverted because at least one application *only* set
2085 * SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Prior to the clean up this still caused
2086 * server verification to take place, after the clean up it silently did
2087 * nothing. SSL_CTX_set_verify()/SSL_set_verify() cannot validate the flags
2088 * sent to them because they are void functions. Therefore, we now use the
2089 * (less clean) historic behaviour of performing validation if any flag is
2090 * set. The *documented* interface remains the same.
2091 */
2092 if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) {
2093 SSLfatal(s, ssl_x509err2alert(s->verify_result),
2094 SSL_R_CERTIFICATE_VERIFY_FAILED);
2095 return WORK_ERROR;
2096 }
2097 ERR_clear_error(); /* but we keep s->verify_result */
2098
2099 /*
2100 * Inconsistency alert: cert_chain does include the peer's certificate,
2101 * which we don't include in statem_srvr.c
2102 */
2103 x = sk_X509_value(s->session->peer_chain, 0);
2104
2105 pkey = X509_get0_pubkey(x);
2106
2107 if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) {
2108 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2109 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
2110 return WORK_ERROR;
2111 }
2112
2113 if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx,
2114 SSL_CONNECTION_GET_CTX(s))) == NULL) {
2115 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
2116 return WORK_ERROR;
2117 }
2118 /*
2119 * Check certificate type is consistent with ciphersuite. For TLS 1.3
2120 * skip check since TLS 1.3 ciphersuites can be used with any certificate
2121 * type.
2122 */
2123 if (!SSL_CONNECTION_IS_TLS13(s)) {
2124 if ((clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0) {
2125 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CERTIFICATE_TYPE);
2126 return WORK_ERROR;
2127 }
2128 }
2129
2130 X509_free(s->session->peer);
2131 X509_up_ref(x);
2132 s->session->peer = x;
2133 s->session->verify_result = s->verify_result;
2134 /* Ensure there is no RPK */
2135 EVP_PKEY_free(s->session->peer_rpk);
2136 s->session->peer_rpk = NULL;
2137
2138 /* Save the current hash state for when we receive the CertificateVerify */
2139 if (SSL_CONNECTION_IS_TLS13(s)
2140 && !ssl_handshake_hash(s, s->cert_verify_hash,
2141 sizeof(s->cert_verify_hash),
2142 &s->cert_verify_hash_len)) {
2143 /* SSLfatal() already called */;
2144 return WORK_ERROR;
2145 }
2146 return WORK_FINISHED_CONTINUE;
2147 }
2148
2149 #ifndef OPENSSL_NO_COMP_ALG
tls_process_server_compressed_certificate(SSL_CONNECTION * sc,PACKET * pkt)2150 MSG_PROCESS_RETURN tls_process_server_compressed_certificate(SSL_CONNECTION *sc, PACKET *pkt)
2151 {
2152 MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR;
2153 PACKET tmppkt;
2154 BUF_MEM *buf = BUF_MEM_new();
2155
2156 if (tls13_process_compressed_certificate(sc, pkt, &tmppkt, buf) != MSG_PROCESS_ERROR)
2157 ret = tls_process_server_certificate(sc, &tmppkt);
2158
2159 BUF_MEM_free(buf);
2160 return ret;
2161 }
2162 #endif
2163
tls_process_ske_psk_preamble(SSL_CONNECTION * s,PACKET * pkt)2164 static int tls_process_ske_psk_preamble(SSL_CONNECTION *s, PACKET *pkt)
2165 {
2166 #ifndef OPENSSL_NO_PSK
2167 PACKET psk_identity_hint;
2168
2169 /* PSK ciphersuites are preceded by an identity hint */
2170
2171 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity_hint)) {
2172 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2173 return 0;
2174 }
2175
2176 /*
2177 * Store PSK identity hint for later use, hint is used in
2178 * tls_construct_client_key_exchange. Assume that the maximum length of
2179 * a PSK identity hint can be as long as the maximum length of a PSK
2180 * identity.
2181 */
2182 if (PACKET_remaining(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN) {
2183 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_DATA_LENGTH_TOO_LONG);
2184 return 0;
2185 }
2186
2187 if (PACKET_remaining(&psk_identity_hint) == 0) {
2188 OPENSSL_free(s->session->psk_identity_hint);
2189 s->session->psk_identity_hint = NULL;
2190 } else if (!PACKET_strndup(&psk_identity_hint,
2191 &s->session->psk_identity_hint)) {
2192 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2193 return 0;
2194 }
2195
2196 return 1;
2197 #else
2198 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2199 return 0;
2200 #endif
2201 }
2202
tls_process_ske_srp(SSL_CONNECTION * s,PACKET * pkt,EVP_PKEY ** pkey)2203 static int tls_process_ske_srp(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey)
2204 {
2205 #ifndef OPENSSL_NO_SRP
2206 PACKET prime, generator, salt, server_pub;
2207
2208 if (!PACKET_get_length_prefixed_2(pkt, &prime)
2209 || !PACKET_get_length_prefixed_2(pkt, &generator)
2210 || !PACKET_get_length_prefixed_1(pkt, &salt)
2211 || !PACKET_get_length_prefixed_2(pkt, &server_pub)) {
2212 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2213 return 0;
2214 }
2215
2216 if ((s->srp_ctx.N =
2217 BN_bin2bn(PACKET_data(&prime),
2218 (int)PACKET_remaining(&prime), NULL)) == NULL
2219 || (s->srp_ctx.g =
2220 BN_bin2bn(PACKET_data(&generator),
2221 (int)PACKET_remaining(&generator), NULL)) == NULL
2222 || (s->srp_ctx.s =
2223 BN_bin2bn(PACKET_data(&salt),
2224 (int)PACKET_remaining(&salt), NULL)) == NULL
2225 || (s->srp_ctx.B =
2226 BN_bin2bn(PACKET_data(&server_pub),
2227 (int)PACKET_remaining(&server_pub), NULL)) == NULL) {
2228 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BN_LIB);
2229 return 0;
2230 }
2231
2232 if (!srp_verify_server_param(s)) {
2233 /* SSLfatal() already called */
2234 return 0;
2235 }
2236
2237 /* We must check if there is a certificate */
2238 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS))
2239 *pkey = tls_get_peer_pkey(s);
2240
2241 return 1;
2242 #else
2243 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2244 return 0;
2245 #endif
2246 }
2247
tls_process_ske_dhe(SSL_CONNECTION * s,PACKET * pkt,EVP_PKEY ** pkey)2248 static int tls_process_ske_dhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey)
2249 {
2250 PACKET prime, generator, pub_key;
2251 EVP_PKEY *peer_tmp = NULL;
2252 BIGNUM *p = NULL, *g = NULL, *bnpub_key = NULL;
2253 EVP_PKEY_CTX *pctx = NULL;
2254 OSSL_PARAM *params = NULL;
2255 OSSL_PARAM_BLD *tmpl = NULL;
2256 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
2257 int ret = 0;
2258
2259 if (!PACKET_get_length_prefixed_2(pkt, &prime)
2260 || !PACKET_get_length_prefixed_2(pkt, &generator)
2261 || !PACKET_get_length_prefixed_2(pkt, &pub_key)) {
2262 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2263 return 0;
2264 }
2265
2266 p = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL);
2267 g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator),
2268 NULL);
2269 bnpub_key = BN_bin2bn(PACKET_data(&pub_key),
2270 (int)PACKET_remaining(&pub_key), NULL);
2271 if (p == NULL || g == NULL || bnpub_key == NULL) {
2272 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BN_LIB);
2273 goto err;
2274 }
2275
2276 tmpl = OSSL_PARAM_BLD_new();
2277 if (tmpl == NULL
2278 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)
2279 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G, g)
2280 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_PUB_KEY,
2281 bnpub_key)
2282 || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) {
2283 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2284 goto err;
2285 }
2286
2287 pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq);
2288 if (pctx == NULL) {
2289 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2290 goto err;
2291 }
2292 if (EVP_PKEY_fromdata_init(pctx) <= 0
2293 || EVP_PKEY_fromdata(pctx, &peer_tmp, EVP_PKEY_KEYPAIR, params) <= 0) {
2294 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_DH_VALUE);
2295 goto err;
2296 }
2297
2298 EVP_PKEY_CTX_free(pctx);
2299 pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, peer_tmp, sctx->propq);
2300 if (pctx == NULL
2301 /*
2302 * EVP_PKEY_param_check() will verify that the DH params are using
2303 * a safe prime. In this context, because we're using ephemeral DH,
2304 * we're ok with it not being a safe prime.
2305 * EVP_PKEY_param_check_quick() skips the safe prime check.
2306 */
2307 || EVP_PKEY_param_check_quick(pctx) != 1
2308 || EVP_PKEY_public_check(pctx) != 1) {
2309 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_DH_VALUE);
2310 goto err;
2311 }
2312
2313 if (!ssl_security(s, SSL_SECOP_TMP_DH,
2314 EVP_PKEY_get_security_bits(peer_tmp),
2315 0, peer_tmp)) {
2316 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_DH_KEY_TOO_SMALL);
2317 goto err;
2318 }
2319
2320 s->s3.peer_tmp = peer_tmp;
2321 peer_tmp = NULL;
2322
2323 /*
2324 * FIXME: This makes assumptions about which ciphersuites come with
2325 * public keys. We should have a less ad-hoc way of doing this
2326 */
2327 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS))
2328 *pkey = tls_get_peer_pkey(s);
2329 /* else anonymous DH, so no certificate or pkey. */
2330
2331 ret = 1;
2332
2333 err:
2334 OSSL_PARAM_BLD_free(tmpl);
2335 OSSL_PARAM_free(params);
2336 EVP_PKEY_free(peer_tmp);
2337 EVP_PKEY_CTX_free(pctx);
2338 BN_free(p);
2339 BN_free(g);
2340 BN_free(bnpub_key);
2341
2342 return ret;
2343 }
2344
tls_process_ske_ecdhe(SSL_CONNECTION * s,PACKET * pkt,EVP_PKEY ** pkey)2345 static int tls_process_ske_ecdhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey)
2346 {
2347 PACKET encoded_pt;
2348 unsigned int curve_type, curve_id;
2349
2350 /*
2351 * Extract elliptic curve parameters and the server's ephemeral ECDH
2352 * public key. We only support named (not generic) curves and
2353 * ECParameters in this case is just three bytes.
2354 */
2355 if (!PACKET_get_1(pkt, &curve_type) || !PACKET_get_net_2(pkt, &curve_id)) {
2356 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT);
2357 return 0;
2358 }
2359 /*
2360 * Check curve is named curve type and one of our preferences, if not
2361 * server has sent an invalid curve.
2362 */
2363 if (curve_type != NAMED_CURVE_TYPE
2364 || !tls1_check_group_id(s, curve_id, 1)) {
2365 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
2366 return 0;
2367 }
2368
2369 if ((s->s3.peer_tmp = ssl_generate_param_group(s, curve_id)) == NULL) {
2370 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2371 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
2372 return 0;
2373 }
2374
2375 if (!PACKET_get_length_prefixed_1(pkt, &encoded_pt)) {
2376 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2377 return 0;
2378 }
2379
2380 if (EVP_PKEY_set1_encoded_public_key(s->s3.peer_tmp,
2381 PACKET_data(&encoded_pt),
2382 PACKET_remaining(&encoded_pt)) <= 0) {
2383 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
2384 return 0;
2385 }
2386
2387 /*
2388 * The ECC/TLS specification does not mention the use of DSA to sign
2389 * ECParameters in the server key exchange message. We do support RSA
2390 * and ECDSA.
2391 */
2392 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA)
2393 *pkey = tls_get_peer_pkey(s);
2394 else if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aRSA)
2395 *pkey = tls_get_peer_pkey(s);
2396 /* else anonymous ECDH, so no certificate or pkey. */
2397
2398 /* Cache the agreed upon group in the SSL_SESSION */
2399 s->session->kex_group = curve_id;
2400 return 1;
2401 }
2402
tls_process_key_exchange(SSL_CONNECTION * s,PACKET * pkt)2403 MSG_PROCESS_RETURN tls_process_key_exchange(SSL_CONNECTION *s, PACKET *pkt)
2404 {
2405 long alg_k;
2406 EVP_PKEY *pkey = NULL;
2407 EVP_MD_CTX *md_ctx = NULL;
2408 EVP_PKEY_CTX *pctx = NULL;
2409 PACKET save_param_start, signature;
2410 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
2411
2412 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
2413
2414 save_param_start = *pkt;
2415
2416 EVP_PKEY_free(s->s3.peer_tmp);
2417 s->s3.peer_tmp = NULL;
2418
2419 if (alg_k & SSL_PSK) {
2420 if (!tls_process_ske_psk_preamble(s, pkt)) {
2421 /* SSLfatal() already called */
2422 goto err;
2423 }
2424 }
2425
2426 /* Nothing else to do for plain PSK or RSAPSK */
2427 if (alg_k & (SSL_kPSK | SSL_kRSAPSK)) {
2428 } else if (alg_k & SSL_kSRP) {
2429 if (!tls_process_ske_srp(s, pkt, &pkey)) {
2430 /* SSLfatal() already called */
2431 goto err;
2432 }
2433 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
2434 if (!tls_process_ske_dhe(s, pkt, &pkey)) {
2435 /* SSLfatal() already called */
2436 goto err;
2437 }
2438 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
2439 if (!tls_process_ske_ecdhe(s, pkt, &pkey)) {
2440 /* SSLfatal() already called */
2441 goto err;
2442 }
2443 } else if (alg_k) {
2444 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
2445 goto err;
2446 }
2447
2448 /* if it was signed, check the signature */
2449 if (pkey != NULL) {
2450 PACKET params;
2451 const EVP_MD *md = NULL;
2452 unsigned char *tbs;
2453 size_t tbslen;
2454 int rv;
2455
2456 /*
2457 * |pkt| now points to the beginning of the signature, so the difference
2458 * equals the length of the parameters.
2459 */
2460 if (!PACKET_get_sub_packet(&save_param_start, ¶ms,
2461 PACKET_remaining(&save_param_start) -
2462 PACKET_remaining(pkt))) {
2463 SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR);
2464 goto err;
2465 }
2466
2467 if (SSL_USE_SIGALGS(s)) {
2468 unsigned int sigalg;
2469
2470 if (!PACKET_get_net_2(pkt, &sigalg)) {
2471 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT);
2472 goto err;
2473 }
2474 if (tls12_check_peer_sigalg(s, sigalg, pkey) <=0) {
2475 /* SSLfatal() already called */
2476 goto err;
2477 }
2478 } else if (!tls1_set_peer_legacy_sigalg(s, pkey)) {
2479 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2480 SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED);
2481 goto err;
2482 }
2483
2484 if (!tls1_lookup_md(sctx, s->s3.tmp.peer_sigalg, &md)) {
2485 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2486 SSL_R_NO_SUITABLE_DIGEST_ALGORITHM);
2487 goto err;
2488 }
2489 if (SSL_USE_SIGALGS(s))
2490 OSSL_TRACE1(TLS, "USING TLSv1.2 HASH %s\n",
2491 md == NULL ? "n/a" : EVP_MD_get0_name(md));
2492
2493 if (!PACKET_get_length_prefixed_2(pkt, &signature)
2494 || PACKET_remaining(pkt) != 0) {
2495 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2496 goto err;
2497 }
2498
2499 md_ctx = EVP_MD_CTX_new();
2500 if (md_ctx == NULL) {
2501 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
2502 goto err;
2503 }
2504
2505 if (EVP_DigestVerifyInit_ex(md_ctx, &pctx,
2506 md == NULL ? NULL : EVP_MD_get0_name(md),
2507 sctx->libctx, sctx->propq, pkey,
2508 NULL) <= 0) {
2509 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
2510 goto err;
2511 }
2512 if (SSL_USE_PSS(s)) {
2513 if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
2514 || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx,
2515 RSA_PSS_SALTLEN_DIGEST) <= 0) {
2516 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
2517 goto err;
2518 }
2519 }
2520 tbslen = construct_key_exchange_tbs(s, &tbs, PACKET_data(¶ms),
2521 PACKET_remaining(¶ms));
2522 if (tbslen == 0) {
2523 /* SSLfatal() already called */
2524 goto err;
2525 }
2526
2527 rv = EVP_DigestVerify(md_ctx, PACKET_data(&signature),
2528 PACKET_remaining(&signature), tbs, tbslen);
2529 OPENSSL_free(tbs);
2530 if (rv <= 0) {
2531 SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_R_BAD_SIGNATURE);
2532 goto err;
2533 }
2534 EVP_MD_CTX_free(md_ctx);
2535 md_ctx = NULL;
2536 } else {
2537 /* aNULL, aSRP or PSK do not need public keys */
2538 if (!(s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
2539 && !(alg_k & SSL_PSK)) {
2540 /* Might be wrong key type, check it */
2541 if (ssl3_check_cert_and_algorithm(s)) {
2542 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_DATA);
2543 }
2544 /* else this shouldn't happen, SSLfatal() already called */
2545 goto err;
2546 }
2547 /* still data left over */
2548 if (PACKET_remaining(pkt) != 0) {
2549 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_EXTRA_DATA_IN_MESSAGE);
2550 goto err;
2551 }
2552 }
2553
2554 return MSG_PROCESS_CONTINUE_READING;
2555 err:
2556 EVP_MD_CTX_free(md_ctx);
2557 return MSG_PROCESS_ERROR;
2558 }
2559
tls_process_certificate_request(SSL_CONNECTION * s,PACKET * pkt)2560 MSG_PROCESS_RETURN tls_process_certificate_request(SSL_CONNECTION *s,
2561 PACKET *pkt)
2562 {
2563 /* Clear certificate validity flags */
2564 if (s->s3.tmp.valid_flags != NULL)
2565 memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t));
2566 else
2567 s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t));
2568
2569 /* Give up for good if allocation didn't work */
2570 if (s->s3.tmp.valid_flags == NULL)
2571 return 0;
2572
2573 if (SSL_CONNECTION_IS_TLS13(s)) {
2574 PACKET reqctx, extensions;
2575 RAW_EXTENSION *rawexts = NULL;
2576
2577 if ((s->shutdown & SSL_SENT_SHUTDOWN) != 0) {
2578 /*
2579 * We already sent close_notify. This can only happen in TLSv1.3
2580 * post-handshake messages. We can't reasonably respond to this, so
2581 * we just ignore it
2582 */
2583 return MSG_PROCESS_FINISHED_READING;
2584 }
2585
2586 /* Free and zero certificate types: it is not present in TLS 1.3 */
2587 OPENSSL_free(s->s3.tmp.ctype);
2588 s->s3.tmp.ctype = NULL;
2589 s->s3.tmp.ctype_len = 0;
2590 OPENSSL_free(s->pha_context);
2591 s->pha_context = NULL;
2592 s->pha_context_len = 0;
2593
2594 if (!PACKET_get_length_prefixed_1(pkt, &reqctx) ||
2595 !PACKET_memdup(&reqctx, &s->pha_context, &s->pha_context_len)) {
2596 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2597 return MSG_PROCESS_ERROR;
2598 }
2599
2600 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) {
2601 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
2602 return MSG_PROCESS_ERROR;
2603 }
2604 if (!tls_collect_extensions(s, &extensions,
2605 SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
2606 &rawexts, NULL, 1)
2607 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
2608 rawexts, NULL, 0, 1)) {
2609 /* SSLfatal() already called */
2610 OPENSSL_free(rawexts);
2611 return MSG_PROCESS_ERROR;
2612 }
2613 OPENSSL_free(rawexts);
2614 if (!tls1_process_sigalgs(s)) {
2615 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_LENGTH);
2616 return MSG_PROCESS_ERROR;
2617 }
2618 } else {
2619 PACKET ctypes;
2620
2621 /* get the certificate types */
2622 if (!PACKET_get_length_prefixed_1(pkt, &ctypes)) {
2623 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2624 return MSG_PROCESS_ERROR;
2625 }
2626
2627 if (!PACKET_memdup(&ctypes, &s->s3.tmp.ctype, &s->s3.tmp.ctype_len)) {
2628 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2629 return MSG_PROCESS_ERROR;
2630 }
2631
2632 if (SSL_USE_SIGALGS(s)) {
2633 PACKET sigalgs;
2634
2635 if (!PACKET_get_length_prefixed_2(pkt, &sigalgs)) {
2636 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2637 return MSG_PROCESS_ERROR;
2638 }
2639
2640 /*
2641 * Despite this being for certificates, preserve compatibility
2642 * with pre-TLS 1.3 and use the regular sigalgs field.
2643 */
2644 if (!tls1_save_sigalgs(s, &sigalgs, 0)) {
2645 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2646 SSL_R_SIGNATURE_ALGORITHMS_ERROR);
2647 return MSG_PROCESS_ERROR;
2648 }
2649 if (!tls1_process_sigalgs(s)) {
2650 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
2651 return MSG_PROCESS_ERROR;
2652 }
2653 }
2654
2655 /* get the CA RDNs */
2656 if (!parse_ca_names(s, pkt)) {
2657 /* SSLfatal() already called */
2658 return MSG_PROCESS_ERROR;
2659 }
2660 }
2661
2662 if (PACKET_remaining(pkt) != 0) {
2663 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2664 return MSG_PROCESS_ERROR;
2665 }
2666
2667 /* we should setup a certificate to return.... */
2668 s->s3.tmp.cert_req = 1;
2669
2670 /*
2671 * In TLSv1.3 we don't prepare the client certificate yet. We wait until
2672 * after the CertificateVerify message has been received. This is because
2673 * in TLSv1.3 the CertificateRequest arrives before the Certificate message
2674 * but in TLSv1.2 it is the other way around. We want to make sure that
2675 * SSL_get1_peer_certificate() returns something sensible in
2676 * client_cert_cb.
2677 */
2678 if (SSL_CONNECTION_IS_TLS13(s)
2679 && s->post_handshake_auth != SSL_PHA_REQUESTED)
2680 return MSG_PROCESS_CONTINUE_READING;
2681
2682 return MSG_PROCESS_CONTINUE_PROCESSING;
2683 }
2684
tls_process_new_session_ticket(SSL_CONNECTION * s,PACKET * pkt)2685 MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s,
2686 PACKET *pkt)
2687 {
2688 unsigned int ticklen;
2689 unsigned long ticket_lifetime_hint, age_add = 0;
2690 unsigned int sess_len;
2691 RAW_EXTENSION *exts = NULL;
2692 PACKET nonce;
2693 EVP_MD *sha256 = NULL;
2694 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
2695
2696 PACKET_null_init(&nonce);
2697
2698 if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint)
2699 || (SSL_CONNECTION_IS_TLS13(s)
2700 && (!PACKET_get_net_4(pkt, &age_add)
2701 || !PACKET_get_length_prefixed_1(pkt, &nonce)))
2702 || !PACKET_get_net_2(pkt, &ticklen)
2703 || (SSL_CONNECTION_IS_TLS13(s) ? (ticklen == 0
2704 || PACKET_remaining(pkt) < ticklen)
2705 : PACKET_remaining(pkt) != ticklen)) {
2706 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2707 goto err;
2708 }
2709
2710 /*
2711 * Server is allowed to change its mind (in <=TLSv1.2) and send an empty
2712 * ticket. We already checked this TLSv1.3 case above, so it should never
2713 * be 0 here in that instance
2714 */
2715 if (ticklen == 0)
2716 return MSG_PROCESS_CONTINUE_READING;
2717
2718 /*
2719 * Sessions must be immutable once they go into the session cache. Otherwise
2720 * we can get multi-thread problems. Therefore we don't "update" sessions,
2721 * we replace them with a duplicate. In TLSv1.3 we need to do this every
2722 * time a NewSessionTicket arrives because those messages arrive
2723 * post-handshake and the session may have already gone into the session
2724 * cache.
2725 */
2726 if (SSL_CONNECTION_IS_TLS13(s) || s->session->session_id_length > 0) {
2727 SSL_SESSION *new_sess;
2728
2729 /*
2730 * We reused an existing session, so we need to replace it with a new
2731 * one
2732 */
2733 if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
2734 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
2735 goto err;
2736 }
2737
2738 if ((s->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) != 0
2739 && !SSL_CONNECTION_IS_TLS13(s)) {
2740 /*
2741 * In TLSv1.2 and below the arrival of a new tickets signals that
2742 * any old ticket we were using is now out of date, so we remove the
2743 * old session from the cache. We carry on if this fails
2744 */
2745 SSL_CTX_remove_session(s->session_ctx, s->session);
2746 }
2747
2748 SSL_SESSION_free(s->session);
2749 s->session = new_sess;
2750 }
2751
2752 s->session->time = ossl_time_now();
2753 ssl_session_calculate_timeout(s->session);
2754
2755 OPENSSL_free(s->session->ext.tick);
2756 s->session->ext.tick = NULL;
2757 s->session->ext.ticklen = 0;
2758
2759 s->session->ext.tick = OPENSSL_malloc(ticklen);
2760 if (s->session->ext.tick == NULL) {
2761 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
2762 goto err;
2763 }
2764 if (!PACKET_copy_bytes(pkt, s->session->ext.tick, ticklen)) {
2765 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2766 goto err;
2767 }
2768
2769 s->session->ext.tick_lifetime_hint = ticket_lifetime_hint;
2770 s->session->ext.tick_age_add = age_add;
2771 s->session->ext.ticklen = ticklen;
2772
2773 if (SSL_CONNECTION_IS_TLS13(s)) {
2774 PACKET extpkt;
2775
2776 if (!PACKET_as_length_prefixed_2(pkt, &extpkt)
2777 || PACKET_remaining(pkt) != 0) {
2778 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2779 goto err;
2780 }
2781
2782 if (!tls_collect_extensions(s, &extpkt,
2783 SSL_EXT_TLS1_3_NEW_SESSION_TICKET, &exts,
2784 NULL, 1)
2785 || !tls_parse_all_extensions(s,
2786 SSL_EXT_TLS1_3_NEW_SESSION_TICKET,
2787 exts, NULL, 0, 1)) {
2788 /* SSLfatal() already called */
2789 goto err;
2790 }
2791 }
2792
2793 /*
2794 * There are two ways to detect a resumed ticket session. One is to set
2795 * an appropriate session ID and then the server must return a match in
2796 * ServerHello. This allows the normal client session ID matching to work
2797 * and we know much earlier that the ticket has been accepted. The
2798 * other way is to set zero length session ID when the ticket is
2799 * presented and rely on the handshake to determine session resumption.
2800 * We choose the former approach because this fits in with assumptions
2801 * elsewhere in OpenSSL. The session ID is set to the SHA256 hash of the
2802 * ticket.
2803 */
2804 sha256 = EVP_MD_fetch(sctx->libctx, "SHA2-256", sctx->propq);
2805 if (sha256 == NULL) {
2806 /* Error is already recorded */
2807 SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR);
2808 goto err;
2809 }
2810 /*
2811 * We use sess_len here because EVP_Digest expects an int
2812 * but s->session->session_id_length is a size_t
2813 */
2814 if (!EVP_Digest(s->session->ext.tick, ticklen,
2815 s->session->session_id, &sess_len,
2816 sha256, NULL)) {
2817 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
2818 goto err;
2819 }
2820 EVP_MD_free(sha256);
2821 sha256 = NULL;
2822 s->session->session_id_length = sess_len;
2823 s->session->not_resumable = 0;
2824
2825 /* This is a standalone message in TLSv1.3, so there is no more to read */
2826 if (SSL_CONNECTION_IS_TLS13(s)) {
2827 const EVP_MD *md = ssl_handshake_md(s);
2828 int hashleni = EVP_MD_get_size(md);
2829 size_t hashlen;
2830 static const unsigned char nonce_label[] = "resumption";
2831
2832 /* Ensure cast to size_t is safe */
2833 if (!ossl_assert(hashleni > 0)) {
2834 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2835 goto err;
2836 }
2837 hashlen = (size_t)hashleni;
2838
2839 if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
2840 nonce_label,
2841 sizeof(nonce_label) - 1,
2842 PACKET_data(&nonce),
2843 PACKET_remaining(&nonce),
2844 s->session->master_key,
2845 hashlen, 1)) {
2846 /* SSLfatal() already called */
2847 goto err;
2848 }
2849 s->session->master_key_length = hashlen;
2850
2851 OPENSSL_free(exts);
2852 ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
2853 return MSG_PROCESS_FINISHED_READING;
2854 }
2855
2856 return MSG_PROCESS_CONTINUE_READING;
2857 err:
2858 EVP_MD_free(sha256);
2859 OPENSSL_free(exts);
2860 return MSG_PROCESS_ERROR;
2861 }
2862
2863 /*
2864 * In TLSv1.3 this is called from the extensions code, otherwise it is used to
2865 * parse a separate message. Returns 1 on success or 0 on failure
2866 */
tls_process_cert_status_body(SSL_CONNECTION * s,PACKET * pkt)2867 int tls_process_cert_status_body(SSL_CONNECTION *s, PACKET *pkt)
2868 {
2869 size_t resplen;
2870 unsigned int type;
2871
2872 if (!PACKET_get_1(pkt, &type)
2873 || type != TLSEXT_STATUSTYPE_ocsp) {
2874 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_UNSUPPORTED_STATUS_TYPE);
2875 return 0;
2876 }
2877 if (!PACKET_get_net_3_len(pkt, &resplen)
2878 || PACKET_remaining(pkt) != resplen) {
2879 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2880 return 0;
2881 }
2882 s->ext.ocsp.resp = OPENSSL_malloc(resplen);
2883 if (s->ext.ocsp.resp == NULL) {
2884 s->ext.ocsp.resp_len = 0;
2885 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
2886 return 0;
2887 }
2888 s->ext.ocsp.resp_len = resplen;
2889 if (!PACKET_copy_bytes(pkt, s->ext.ocsp.resp, resplen)) {
2890 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2891 return 0;
2892 }
2893
2894 return 1;
2895 }
2896
2897
tls_process_cert_status(SSL_CONNECTION * s,PACKET * pkt)2898 MSG_PROCESS_RETURN tls_process_cert_status(SSL_CONNECTION *s, PACKET *pkt)
2899 {
2900 if (!tls_process_cert_status_body(s, pkt)) {
2901 /* SSLfatal() already called */
2902 return MSG_PROCESS_ERROR;
2903 }
2904
2905 return MSG_PROCESS_CONTINUE_READING;
2906 }
2907
2908 /*
2909 * Perform miscellaneous checks and processing after we have received the
2910 * server's initial flight. In TLS1.3 this is after the Server Finished message.
2911 * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0
2912 * on failure.
2913 */
tls_process_initial_server_flight(SSL_CONNECTION * s)2914 int tls_process_initial_server_flight(SSL_CONNECTION *s)
2915 {
2916 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
2917
2918 /*
2919 * at this point we check that we have the required stuff from
2920 * the server
2921 */
2922 if (!ssl3_check_cert_and_algorithm(s)) {
2923 /* SSLfatal() already called */
2924 return 0;
2925 }
2926
2927 /*
2928 * Call the ocsp status callback if needed. The |ext.ocsp.resp| and
2929 * |ext.ocsp.resp_len| values will be set if we actually received a status
2930 * message, or NULL and -1 otherwise
2931 */
2932 if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing
2933 && sctx->ext.status_cb != NULL) {
2934 int ret = sctx->ext.status_cb(SSL_CONNECTION_GET_USER_SSL(s),
2935 sctx->ext.status_arg);
2936
2937 if (ret == 0) {
2938 SSLfatal(s, SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE,
2939 SSL_R_INVALID_STATUS_RESPONSE);
2940 return 0;
2941 }
2942 if (ret < 0) {
2943 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2944 SSL_R_OCSP_CALLBACK_FAILURE);
2945 return 0;
2946 }
2947 }
2948 #ifndef OPENSSL_NO_CT
2949 if (s->ct_validation_callback != NULL) {
2950 /* Note we validate the SCTs whether or not we abort on error */
2951 if (!ssl_validate_ct(s) && (s->verify_mode & SSL_VERIFY_PEER)) {
2952 /* SSLfatal() already called */
2953 return 0;
2954 }
2955 }
2956 #endif
2957
2958 return 1;
2959 }
2960
tls_process_server_done(SSL_CONNECTION * s,PACKET * pkt)2961 MSG_PROCESS_RETURN tls_process_server_done(SSL_CONNECTION *s, PACKET *pkt)
2962 {
2963 if (PACKET_remaining(pkt) > 0) {
2964 /* should contain no data */
2965 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2966 return MSG_PROCESS_ERROR;
2967 }
2968 #ifndef OPENSSL_NO_SRP
2969 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
2970 if (ssl_srp_calc_a_param_intern(s) <= 0) {
2971 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_SRP_A_CALC);
2972 return MSG_PROCESS_ERROR;
2973 }
2974 }
2975 #endif
2976
2977 if (!tls_process_initial_server_flight(s)) {
2978 /* SSLfatal() already called */
2979 return MSG_PROCESS_ERROR;
2980 }
2981
2982 return MSG_PROCESS_FINISHED_READING;
2983 }
2984
tls_construct_cke_psk_preamble(SSL_CONNECTION * s,WPACKET * pkt)2985 static int tls_construct_cke_psk_preamble(SSL_CONNECTION *s, WPACKET *pkt)
2986 {
2987 #ifndef OPENSSL_NO_PSK
2988 int ret = 0;
2989 /*
2990 * The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes to return a
2991 * \0-terminated identity. The last byte is for us for simulating
2992 * strnlen.
2993 */
2994 char identity[PSK_MAX_IDENTITY_LEN + 1];
2995 size_t identitylen = 0;
2996 unsigned char psk[PSK_MAX_PSK_LEN];
2997 unsigned char *tmppsk = NULL;
2998 char *tmpidentity = NULL;
2999 size_t psklen = 0;
3000
3001 if (s->psk_client_callback == NULL) {
3002 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PSK_NO_CLIENT_CB);
3003 goto err;
3004 }
3005
3006 memset(identity, 0, sizeof(identity));
3007
3008 psklen = s->psk_client_callback(SSL_CONNECTION_GET_USER_SSL(s),
3009 s->session->psk_identity_hint,
3010 identity, sizeof(identity) - 1,
3011 psk, sizeof(psk));
3012
3013 if (psklen > PSK_MAX_PSK_LEN) {
3014 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, ERR_R_INTERNAL_ERROR);
3015 psklen = PSK_MAX_PSK_LEN; /* Avoid overrunning the array on cleanse */
3016 goto err;
3017 } else if (psklen == 0) {
3018 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_PSK_IDENTITY_NOT_FOUND);
3019 goto err;
3020 }
3021
3022 identitylen = strlen(identity);
3023 if (identitylen > PSK_MAX_IDENTITY_LEN) {
3024 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3025 goto err;
3026 }
3027
3028 tmppsk = OPENSSL_memdup(psk, psklen);
3029 tmpidentity = OPENSSL_strdup(identity);
3030 if (tmppsk == NULL || tmpidentity == NULL) {
3031 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
3032 goto err;
3033 }
3034
3035 OPENSSL_free(s->s3.tmp.psk);
3036 s->s3.tmp.psk = tmppsk;
3037 s->s3.tmp.psklen = psklen;
3038 tmppsk = NULL;
3039 OPENSSL_free(s->session->psk_identity);
3040 s->session->psk_identity = tmpidentity;
3041 tmpidentity = NULL;
3042
3043 if (!WPACKET_sub_memcpy_u16(pkt, identity, identitylen)) {
3044 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3045 goto err;
3046 }
3047
3048 ret = 1;
3049
3050 err:
3051 OPENSSL_cleanse(psk, psklen);
3052 OPENSSL_cleanse(identity, sizeof(identity));
3053 OPENSSL_clear_free(tmppsk, psklen);
3054 OPENSSL_clear_free(tmpidentity, identitylen);
3055
3056 return ret;
3057 #else
3058 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3059 return 0;
3060 #endif
3061 }
3062
tls_construct_cke_rsa(SSL_CONNECTION * s,WPACKET * pkt)3063 static int tls_construct_cke_rsa(SSL_CONNECTION *s, WPACKET *pkt)
3064 {
3065 unsigned char *encdata = NULL;
3066 EVP_PKEY *pkey = NULL;
3067 EVP_PKEY_CTX *pctx = NULL;
3068 size_t enclen;
3069 unsigned char *pms = NULL;
3070 size_t pmslen = 0;
3071 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
3072
3073 if (!received_server_cert(s)) {
3074 /*
3075 * We should always have a server certificate with SSL_kRSA.
3076 */
3077 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3078 return 0;
3079 }
3080
3081 if ((pkey = tls_get_peer_pkey(s)) == NULL) {
3082 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3083 return 0;
3084 }
3085
3086 if (!EVP_PKEY_is_a(pkey, "RSA")) {
3087 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3088 return 0;
3089 }
3090
3091 pmslen = SSL_MAX_MASTER_KEY_LENGTH;
3092 pms = OPENSSL_malloc(pmslen);
3093 if (pms == NULL) {
3094 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
3095 return 0;
3096 }
3097
3098 pms[0] = s->client_version >> 8;
3099 pms[1] = s->client_version & 0xff;
3100 if (RAND_bytes_ex(sctx->libctx, pms + 2, pmslen - 2, 0) <= 0) {
3101 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_RAND_LIB);
3102 goto err;
3103 }
3104
3105 /* Fix buf for TLS and beyond */
3106 if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {
3107 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3108 goto err;
3109 }
3110
3111 pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, pkey, sctx->propq);
3112 if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
3113 || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
3114 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
3115 goto err;
3116 }
3117 if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)
3118 || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {
3119 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_RSA_ENCRYPT);
3120 goto err;
3121 }
3122 EVP_PKEY_CTX_free(pctx);
3123 pctx = NULL;
3124
3125 /* Fix buf for TLS and beyond */
3126 if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {
3127 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3128 goto err;
3129 }
3130
3131 /* Log the premaster secret, if logging is enabled. */
3132 if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) {
3133 /* SSLfatal() already called */
3134 goto err;
3135 }
3136
3137 s->s3.tmp.pms = pms;
3138 s->s3.tmp.pmslen = pmslen;
3139
3140 return 1;
3141 err:
3142 OPENSSL_clear_free(pms, pmslen);
3143 EVP_PKEY_CTX_free(pctx);
3144
3145 return 0;
3146 }
3147
tls_construct_cke_dhe(SSL_CONNECTION * s,WPACKET * pkt)3148 static int tls_construct_cke_dhe(SSL_CONNECTION *s, WPACKET *pkt)
3149 {
3150 EVP_PKEY *ckey = NULL, *skey = NULL;
3151 unsigned char *keybytes = NULL;
3152 int prime_len;
3153 unsigned char *encoded_pub = NULL;
3154 size_t encoded_pub_len, pad_len;
3155 int ret = 0;
3156
3157 skey = s->s3.peer_tmp;
3158 if (skey == NULL) {
3159 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3160 goto err;
3161 }
3162
3163 ckey = ssl_generate_pkey(s, skey);
3164 if (ckey == NULL) {
3165 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3166 goto err;
3167 }
3168
3169 if (ssl_derive(s, ckey, skey, 0) == 0) {
3170 /* SSLfatal() already called */
3171 goto err;
3172 }
3173
3174 /* send off the data */
3175
3176 /* Generate encoding of server key */
3177 encoded_pub_len = EVP_PKEY_get1_encoded_public_key(ckey, &encoded_pub);
3178 if (encoded_pub_len == 0) {
3179 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3180 EVP_PKEY_free(ckey);
3181 return EXT_RETURN_FAIL;
3182 }
3183
3184 /*
3185 * For interoperability with some versions of the Microsoft TLS
3186 * stack, we need to zero pad the DHE pub key to the same length
3187 * as the prime.
3188 */
3189 prime_len = EVP_PKEY_get_size(ckey);
3190 pad_len = prime_len - encoded_pub_len;
3191 if (pad_len > 0) {
3192 if (!WPACKET_sub_allocate_bytes_u16(pkt, pad_len, &keybytes)) {
3193 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3194 goto err;
3195 }
3196 memset(keybytes, 0, pad_len);
3197 }
3198
3199 if (!WPACKET_sub_memcpy_u16(pkt, encoded_pub, encoded_pub_len)) {
3200 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3201 goto err;
3202 }
3203
3204 ret = 1;
3205 err:
3206 OPENSSL_free(encoded_pub);
3207 EVP_PKEY_free(ckey);
3208 return ret;
3209 }
3210
tls_construct_cke_ecdhe(SSL_CONNECTION * s,WPACKET * pkt)3211 static int tls_construct_cke_ecdhe(SSL_CONNECTION *s, WPACKET *pkt)
3212 {
3213 unsigned char *encodedPoint = NULL;
3214 size_t encoded_pt_len = 0;
3215 EVP_PKEY *ckey = NULL, *skey = NULL;
3216 int ret = 0;
3217
3218 skey = s->s3.peer_tmp;
3219 if (skey == NULL) {
3220 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3221 return 0;
3222 }
3223
3224 ckey = ssl_generate_pkey(s, skey);
3225 if (ckey == NULL) {
3226 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
3227 goto err;
3228 }
3229
3230 if (ssl_derive(s, ckey, skey, 0) == 0) {
3231 /* SSLfatal() already called */
3232 goto err;
3233 }
3234
3235 /* Generate encoding of client key */
3236 encoded_pt_len = EVP_PKEY_get1_encoded_public_key(ckey, &encodedPoint);
3237
3238 if (encoded_pt_len == 0) {
3239 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
3240 goto err;
3241 }
3242
3243 if (!WPACKET_sub_memcpy_u8(pkt, encodedPoint, encoded_pt_len)) {
3244 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3245 goto err;
3246 }
3247
3248 ret = 1;
3249 err:
3250 OPENSSL_free(encodedPoint);
3251 EVP_PKEY_free(ckey);
3252 return ret;
3253 }
3254
tls_construct_cke_gost(SSL_CONNECTION * s,WPACKET * pkt)3255 static int tls_construct_cke_gost(SSL_CONNECTION *s, WPACKET *pkt)
3256 {
3257 #ifndef OPENSSL_NO_GOST
3258 /* GOST key exchange message creation */
3259 EVP_PKEY_CTX *pkey_ctx = NULL;
3260 EVP_PKEY *pkey = NULL;
3261 size_t msglen;
3262 unsigned int md_len;
3263 unsigned char shared_ukm[32], tmp[256];
3264 EVP_MD_CTX *ukm_hash = NULL;
3265 int dgst_nid = NID_id_GostR3411_94;
3266 unsigned char *pms = NULL;
3267 size_t pmslen = 0;
3268 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
3269
3270 if ((s->s3.tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0)
3271 dgst_nid = NID_id_GostR3411_2012_256;
3272
3273 /*
3274 * Get server certificate PKEY and create ctx from it
3275 */
3276 if ((pkey = tls_get_peer_pkey(s)) == NULL) {
3277 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3278 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
3279 return 0;
3280 }
3281
3282 pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx,
3283 pkey,
3284 sctx->propq);
3285 if (pkey_ctx == NULL) {
3286 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
3287 return 0;
3288 }
3289 /*
3290 * If we have send a certificate, and certificate key
3291 * parameters match those of server certificate, use
3292 * certificate key for key exchange
3293 */
3294
3295 /* Otherwise, generate ephemeral key pair */
3296 pmslen = 32;
3297 pms = OPENSSL_malloc(pmslen);
3298 if (pms == NULL) {
3299 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
3300 goto err;
3301 }
3302
3303 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0
3304 /* Generate session key
3305 */
3306 || RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) {
3307 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3308 goto err;
3309 };
3310 /*
3311 * Compute shared IV and store it in algorithm-specific context
3312 * data
3313 */
3314 ukm_hash = EVP_MD_CTX_new();
3315 if (ukm_hash == NULL
3316 || EVP_DigestInit(ukm_hash, EVP_get_digestbynid(dgst_nid)) <= 0
3317 || EVP_DigestUpdate(ukm_hash, s->s3.client_random,
3318 SSL3_RANDOM_SIZE) <= 0
3319 || EVP_DigestUpdate(ukm_hash, s->s3.server_random,
3320 SSL3_RANDOM_SIZE) <= 0
3321 || EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len) <= 0) {
3322 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3323 goto err;
3324 }
3325 EVP_MD_CTX_free(ukm_hash);
3326 ukm_hash = NULL;
3327 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
3328 EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) <= 0) {
3329 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
3330 goto err;
3331 }
3332 /* Make GOST keytransport blob message */
3333 /*
3334 * Encapsulate it into sequence
3335 */
3336 msglen = 255;
3337 if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, pms, pmslen) <= 0) {
3338 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
3339 goto err;
3340 }
3341
3342 if (!WPACKET_put_bytes_u8(pkt, V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED)
3343 || (msglen >= 0x80 && !WPACKET_put_bytes_u8(pkt, 0x81))
3344 || !WPACKET_sub_memcpy_u8(pkt, tmp, msglen)) {
3345 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3346 goto err;
3347 }
3348
3349 EVP_PKEY_CTX_free(pkey_ctx);
3350 s->s3.tmp.pms = pms;
3351 s->s3.tmp.pmslen = pmslen;
3352
3353 return 1;
3354 err:
3355 EVP_PKEY_CTX_free(pkey_ctx);
3356 OPENSSL_clear_free(pms, pmslen);
3357 EVP_MD_CTX_free(ukm_hash);
3358 return 0;
3359 #else
3360 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3361 return 0;
3362 #endif
3363 }
3364
3365 #ifndef OPENSSL_NO_GOST
ossl_gost18_cke_cipher_nid(const SSL_CONNECTION * s)3366 int ossl_gost18_cke_cipher_nid(const SSL_CONNECTION *s)
3367 {
3368 if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_MAGMA) != 0)
3369 return NID_magma_ctr;
3370 else if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_KUZNYECHIK) != 0)
3371 return NID_kuznyechik_ctr;
3372
3373 return NID_undef;
3374 }
3375
ossl_gost_ukm(const SSL_CONNECTION * s,unsigned char * dgst_buf)3376 int ossl_gost_ukm(const SSL_CONNECTION *s, unsigned char *dgst_buf)
3377 {
3378 EVP_MD_CTX *hash = NULL;
3379 unsigned int md_len;
3380 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
3381 const EVP_MD *md = ssl_evp_md_fetch(sctx->libctx, NID_id_GostR3411_2012_256,
3382 sctx->propq);
3383
3384 if (md == NULL)
3385 return 0;
3386
3387 if ((hash = EVP_MD_CTX_new()) == NULL
3388 || EVP_DigestInit(hash, md) <= 0
3389 || EVP_DigestUpdate(hash, s->s3.client_random, SSL3_RANDOM_SIZE) <= 0
3390 || EVP_DigestUpdate(hash, s->s3.server_random, SSL3_RANDOM_SIZE) <= 0
3391 || EVP_DigestFinal_ex(hash, dgst_buf, &md_len) <= 0) {
3392 EVP_MD_CTX_free(hash);
3393 ssl_evp_md_free(md);
3394 return 0;
3395 }
3396
3397 EVP_MD_CTX_free(hash);
3398 ssl_evp_md_free(md);
3399 return 1;
3400 }
3401 #endif
3402
tls_construct_cke_gost18(SSL_CONNECTION * s,WPACKET * pkt)3403 static int tls_construct_cke_gost18(SSL_CONNECTION *s, WPACKET *pkt)
3404 {
3405 #ifndef OPENSSL_NO_GOST
3406 /* GOST 2018 key exchange message creation */
3407 unsigned char rnd_dgst[32];
3408 unsigned char *encdata = NULL;
3409 EVP_PKEY_CTX *pkey_ctx = NULL;
3410 EVP_PKEY *pkey;
3411 unsigned char *pms = NULL;
3412 size_t pmslen = 0;
3413 size_t msglen;
3414 int cipher_nid = ossl_gost18_cke_cipher_nid(s);
3415 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
3416
3417 if (cipher_nid == NID_undef) {
3418 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3419 return 0;
3420 }
3421
3422 if (ossl_gost_ukm(s, rnd_dgst) <= 0) {
3423 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3424 goto err;
3425 }
3426
3427 /* Pre-master secret - random bytes */
3428 pmslen = 32;
3429 pms = OPENSSL_malloc(pmslen);
3430 if (pms == NULL) {
3431 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
3432 goto err;
3433 }
3434
3435 if (RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) {
3436 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3437 goto err;
3438 }
3439
3440 /* Get server certificate PKEY and create ctx from it */
3441 if ((pkey = tls_get_peer_pkey(s)) == NULL) {
3442 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3443 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
3444 goto err;
3445 }
3446
3447 pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx,
3448 pkey,
3449 sctx->propq);
3450 if (pkey_ctx == NULL) {
3451 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
3452 goto err;
3453 }
3454
3455 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0) {
3456 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3457 goto err;
3458 };
3459
3460 /* Reuse EVP_PKEY_CTRL_SET_IV, make choice in engine code */
3461 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
3462 EVP_PKEY_CTRL_SET_IV, 32, rnd_dgst) <= 0) {
3463 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
3464 goto err;
3465 }
3466
3467 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
3468 EVP_PKEY_CTRL_CIPHER, cipher_nid, NULL) <= 0) {
3469 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
3470 goto err;
3471 }
3472
3473 if (EVP_PKEY_encrypt(pkey_ctx, NULL, &msglen, pms, pmslen) <= 0) {
3474 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
3475 goto err;
3476 }
3477
3478 if (!WPACKET_allocate_bytes(pkt, msglen, &encdata)
3479 || EVP_PKEY_encrypt(pkey_ctx, encdata, &msglen, pms, pmslen) <= 0) {
3480 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
3481 goto err;
3482 }
3483
3484 EVP_PKEY_CTX_free(pkey_ctx);
3485 pkey_ctx = NULL;
3486 s->s3.tmp.pms = pms;
3487 s->s3.tmp.pmslen = pmslen;
3488
3489 return 1;
3490 err:
3491 EVP_PKEY_CTX_free(pkey_ctx);
3492 OPENSSL_clear_free(pms, pmslen);
3493 return 0;
3494 #else
3495 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3496 return 0;
3497 #endif
3498 }
3499
tls_construct_cke_srp(SSL_CONNECTION * s,WPACKET * pkt)3500 static int tls_construct_cke_srp(SSL_CONNECTION *s, WPACKET *pkt)
3501 {
3502 #ifndef OPENSSL_NO_SRP
3503 unsigned char *abytes = NULL;
3504
3505 if (s->srp_ctx.A == NULL
3506 || !WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(s->srp_ctx.A),
3507 &abytes)) {
3508 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3509 return 0;
3510 }
3511 BN_bn2bin(s->srp_ctx.A, abytes);
3512
3513 OPENSSL_free(s->session->srp_username);
3514 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);
3515 if (s->session->srp_username == NULL) {
3516 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
3517 return 0;
3518 }
3519
3520 return 1;
3521 #else
3522 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3523 return 0;
3524 #endif
3525 }
3526
tls_construct_client_key_exchange(SSL_CONNECTION * s,WPACKET * pkt)3527 CON_FUNC_RETURN tls_construct_client_key_exchange(SSL_CONNECTION *s,
3528 WPACKET *pkt)
3529 {
3530 unsigned long alg_k;
3531
3532 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
3533
3534 /*
3535 * All of the construct functions below call SSLfatal() if necessary so
3536 * no need to do so here.
3537 */
3538 if ((alg_k & SSL_PSK)
3539 && !tls_construct_cke_psk_preamble(s, pkt))
3540 goto err;
3541
3542 if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) {
3543 if (!tls_construct_cke_rsa(s, pkt))
3544 goto err;
3545 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
3546 if (!tls_construct_cke_dhe(s, pkt))
3547 goto err;
3548 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
3549 if (!tls_construct_cke_ecdhe(s, pkt))
3550 goto err;
3551 } else if (alg_k & SSL_kGOST) {
3552 if (!tls_construct_cke_gost(s, pkt))
3553 goto err;
3554 } else if (alg_k & SSL_kGOST18) {
3555 if (!tls_construct_cke_gost18(s, pkt))
3556 goto err;
3557 } else if (alg_k & SSL_kSRP) {
3558 if (!tls_construct_cke_srp(s, pkt))
3559 goto err;
3560 } else if (!(alg_k & SSL_kPSK)) {
3561 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3562 goto err;
3563 }
3564
3565 return CON_FUNC_SUCCESS;
3566 err:
3567 OPENSSL_clear_free(s->s3.tmp.pms, s->s3.tmp.pmslen);
3568 s->s3.tmp.pms = NULL;
3569 s->s3.tmp.pmslen = 0;
3570 #ifndef OPENSSL_NO_PSK
3571 OPENSSL_clear_free(s->s3.tmp.psk, s->s3.tmp.psklen);
3572 s->s3.tmp.psk = NULL;
3573 s->s3.tmp.psklen = 0;
3574 #endif
3575 return CON_FUNC_ERROR;
3576 }
3577
tls_client_key_exchange_post_work(SSL_CONNECTION * s)3578 int tls_client_key_exchange_post_work(SSL_CONNECTION *s)
3579 {
3580 unsigned char *pms = NULL;
3581 size_t pmslen = 0;
3582
3583 pms = s->s3.tmp.pms;
3584 pmslen = s->s3.tmp.pmslen;
3585
3586 #ifndef OPENSSL_NO_SRP
3587 /* Check for SRP */
3588 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
3589 if (!srp_generate_client_master_secret(s)) {
3590 /* SSLfatal() already called */
3591 goto err;
3592 }
3593 return 1;
3594 }
3595 #endif
3596
3597 if (pms == NULL && !(s->s3.tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
3598 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_PASSED_INVALID_ARGUMENT);
3599 goto err;
3600 }
3601 if (!ssl_generate_master_secret(s, pms, pmslen, 1)) {
3602 /* SSLfatal() already called */
3603 /* ssl_generate_master_secret frees the pms even on error */
3604 pms = NULL;
3605 pmslen = 0;
3606 goto err;
3607 }
3608 pms = NULL;
3609 pmslen = 0;
3610
3611 #ifndef OPENSSL_NO_SCTP
3612 if (SSL_CONNECTION_IS_DTLS(s)) {
3613 unsigned char sctpauthkey[64];
3614 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
3615 size_t labellen;
3616 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
3617
3618 /*
3619 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
3620 * used.
3621 */
3622 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
3623 sizeof(DTLS1_SCTP_AUTH_LABEL));
3624
3625 /* Don't include the terminating zero. */
3626 labellen = sizeof(labelbuffer) - 1;
3627 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG)
3628 labellen += 1;
3629
3630 if (SSL_export_keying_material(ssl, sctpauthkey,
3631 sizeof(sctpauthkey), labelbuffer,
3632 labellen, NULL, 0, 0) <= 0) {
3633 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3634 goto err;
3635 }
3636
3637 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
3638 sizeof(sctpauthkey), sctpauthkey);
3639 }
3640 #endif
3641
3642 return 1;
3643 err:
3644 OPENSSL_clear_free(pms, pmslen);
3645 s->s3.tmp.pms = NULL;
3646 s->s3.tmp.pmslen = 0;
3647 return 0;
3648 }
3649
3650 /*
3651 * Check a certificate can be used for client authentication. Currently check
3652 * cert exists, if we have a suitable digest for TLS 1.2 if static DH client
3653 * certificates can be used and optionally checks suitability for Suite B.
3654 */
ssl3_check_client_certificate(SSL_CONNECTION * s)3655 static int ssl3_check_client_certificate(SSL_CONNECTION *s)
3656 {
3657 /* If no suitable signature algorithm can't use certificate */
3658 if (!tls_choose_sigalg(s, 0) || s->s3.tmp.sigalg == NULL)
3659 return 0;
3660 /*
3661 * If strict mode check suitability of chain before using it. This also
3662 * adjusts suite B digest if necessary.
3663 */
3664 if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT &&
3665 !tls1_check_chain(s, NULL, NULL, NULL, -2))
3666 return 0;
3667 return 1;
3668 }
3669
tls_prepare_client_certificate(SSL_CONNECTION * s,WORK_STATE wst)3670 WORK_STATE tls_prepare_client_certificate(SSL_CONNECTION *s, WORK_STATE wst)
3671 {
3672 X509 *x509 = NULL;
3673 EVP_PKEY *pkey = NULL;
3674 int i;
3675 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
3676
3677 if (wst == WORK_MORE_A) {
3678 /* Let cert callback update client certificates if required */
3679 if (s->cert->cert_cb) {
3680 i = s->cert->cert_cb(ssl, s->cert->cert_cb_arg);
3681 if (i < 0) {
3682 s->rwstate = SSL_X509_LOOKUP;
3683 return WORK_MORE_A;
3684 }
3685 if (i == 0) {
3686 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_CALLBACK_FAILED);
3687 return WORK_ERROR;
3688 }
3689 s->rwstate = SSL_NOTHING;
3690 }
3691 if (ssl3_check_client_certificate(s)) {
3692 if (s->post_handshake_auth == SSL_PHA_REQUESTED) {
3693 return WORK_FINISHED_STOP;
3694 }
3695 return WORK_FINISHED_CONTINUE;
3696 }
3697
3698 /* Fall through to WORK_MORE_B */
3699 wst = WORK_MORE_B;
3700 }
3701
3702 /* We need to get a client cert */
3703 if (wst == WORK_MORE_B) {
3704 /*
3705 * If we get an error, we need to ssl->rwstate=SSL_X509_LOOKUP;
3706 * return(-1); We then get retied later
3707 */
3708 i = ssl_do_client_cert_cb(s, &x509, &pkey);
3709 if (i < 0) {
3710 s->rwstate = SSL_X509_LOOKUP;
3711 return WORK_MORE_B;
3712 }
3713 s->rwstate = SSL_NOTHING;
3714 if ((i == 1) && (pkey != NULL) && (x509 != NULL)) {
3715 if (!SSL_use_certificate(ssl, x509)
3716 || !SSL_use_PrivateKey(ssl, pkey))
3717 i = 0;
3718 } else if (i == 1) {
3719 i = 0;
3720 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
3721 }
3722
3723 X509_free(x509);
3724 EVP_PKEY_free(pkey);
3725 if (i && !ssl3_check_client_certificate(s))
3726 i = 0;
3727 if (i == 0) {
3728 if (s->version == SSL3_VERSION) {
3729 s->s3.tmp.cert_req = 0;
3730 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE);
3731 return WORK_FINISHED_CONTINUE;
3732 } else {
3733 s->s3.tmp.cert_req = 2;
3734 s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none;
3735 if (!ssl3_digest_cached_records(s, 0)) {
3736 /* SSLfatal() already called */
3737 return WORK_ERROR;
3738 }
3739 }
3740 }
3741
3742 if (!SSL_CONNECTION_IS_TLS13(s)
3743 || (s->options & SSL_OP_NO_TX_CERTIFICATE_COMPRESSION) != 0)
3744 s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none;
3745
3746 if (s->post_handshake_auth == SSL_PHA_REQUESTED)
3747 return WORK_FINISHED_STOP;
3748 return WORK_FINISHED_CONTINUE;
3749 }
3750
3751 /* Shouldn't ever get here */
3752 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3753 return WORK_ERROR;
3754 }
3755
tls_construct_client_certificate(SSL_CONNECTION * s,WPACKET * pkt)3756 CON_FUNC_RETURN tls_construct_client_certificate(SSL_CONNECTION *s,
3757 WPACKET *pkt)
3758 {
3759 CERT_PKEY *cpk = NULL;
3760 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
3761
3762 if (SSL_CONNECTION_IS_TLS13(s)) {
3763 if (s->pha_context == NULL) {
3764 /* no context available, add 0-length context */
3765 if (!WPACKET_put_bytes_u8(pkt, 0)) {
3766 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3767 return CON_FUNC_ERROR;
3768 }
3769 } else if (!WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) {
3770 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3771 return CON_FUNC_ERROR;
3772 }
3773 }
3774 if (s->s3.tmp.cert_req != 2)
3775 cpk = s->cert->key;
3776 switch (s->ext.client_cert_type) {
3777 case TLSEXT_cert_type_rpk:
3778 if (!tls_output_rpk(s, pkt, cpk)) {
3779 /* SSLfatal() already called */
3780 return CON_FUNC_ERROR;
3781 }
3782 break;
3783 case TLSEXT_cert_type_x509:
3784 if (!ssl3_output_cert_chain(s, pkt, cpk, 0)) {
3785 /* SSLfatal() already called */
3786 return CON_FUNC_ERROR;
3787 }
3788 break;
3789 default:
3790 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3791 return CON_FUNC_ERROR;
3792 }
3793
3794 /*
3795 * If we attempted to write early data or we're in middlebox compat mode
3796 * then we deferred changing the handshake write keys to the last possible
3797 * moment. We need to do it now.
3798 */
3799 if (SSL_CONNECTION_IS_TLS13(s)
3800 && SSL_IS_FIRST_HANDSHAKE(s)
3801 && (s->early_data_state != SSL_EARLY_DATA_NONE
3802 || (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)
3803 && (!ssl->method->ssl3_enc->change_cipher_state(s,
3804 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) {
3805 /*
3806 * This is a fatal error, which leaves enc_write_ctx in an inconsistent
3807 * state and thus ssl3_send_alert may crash.
3808 */
3809 SSLfatal(s, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER);
3810 return CON_FUNC_ERROR;
3811 }
3812
3813 return CON_FUNC_SUCCESS;
3814 }
3815
3816 #ifndef OPENSSL_NO_COMP_ALG
tls_construct_client_compressed_certificate(SSL_CONNECTION * sc,WPACKET * pkt)3817 CON_FUNC_RETURN tls_construct_client_compressed_certificate(SSL_CONNECTION *sc,
3818 WPACKET *pkt)
3819 {
3820 SSL *ssl = SSL_CONNECTION_GET_SSL(sc);
3821 WPACKET tmppkt;
3822 BUF_MEM *buf = NULL;
3823 size_t length;
3824 size_t max_length;
3825 COMP_METHOD *method;
3826 COMP_CTX *comp = NULL;
3827 int comp_len;
3828 int ret = 0;
3829 int alg = sc->ext.compress_certificate_from_peer[0];
3830
3831 /* Note that sc->s3.tmp.cert_req == 2 is checked in write transition */
3832
3833 if ((buf = BUF_MEM_new()) == NULL || !WPACKET_init(&tmppkt, buf))
3834 goto err;
3835
3836 /* Use the |tmppkt| for the to-be-compressed data */
3837 if (sc->pha_context == NULL) {
3838 /* no context available, add 0-length context */
3839 if (!WPACKET_put_bytes_u8(&tmppkt, 0))
3840 goto err;
3841 } else if (!WPACKET_sub_memcpy_u8(&tmppkt, sc->pha_context, sc->pha_context_len))
3842 goto err;
3843
3844 if (!ssl3_output_cert_chain(sc, &tmppkt, sc->cert->key, 0)) {
3845 /* SSLfatal() already called */
3846 goto out;
3847 }
3848
3849 /* continue with the real |pkt| */
3850 if (!WPACKET_put_bytes_u16(pkt, alg)
3851 || !WPACKET_get_total_written(&tmppkt, &length)
3852 || !WPACKET_put_bytes_u24(pkt, length))
3853 goto err;
3854
3855 switch (alg) {
3856 case TLSEXT_comp_cert_zlib:
3857 method = COMP_zlib_oneshot();
3858 break;
3859 case TLSEXT_comp_cert_brotli:
3860 method = COMP_brotli_oneshot();
3861 break;
3862 case TLSEXT_comp_cert_zstd:
3863 method = COMP_zstd_oneshot();
3864 break;
3865 default:
3866 goto err;
3867 }
3868 max_length = ossl_calculate_comp_expansion(alg, length);
3869
3870 if ((comp = COMP_CTX_new(method)) == NULL
3871 || !WPACKET_start_sub_packet_u24(pkt)
3872 || !WPACKET_reserve_bytes(pkt, max_length, NULL))
3873 goto err;
3874
3875 comp_len = COMP_compress_block(comp, WPACKET_get_curr(pkt), max_length,
3876 (unsigned char *)buf->data, length);
3877 if (comp_len <= 0)
3878 goto err;
3879
3880 if (!WPACKET_allocate_bytes(pkt, comp_len, NULL)
3881 || !WPACKET_close(pkt))
3882 goto err;
3883
3884 /*
3885 * If we attempted to write early data or we're in middlebox compat mode
3886 * then we deferred changing the handshake write keys to the last possible
3887 * moment. We need to do it now.
3888 */
3889 if (SSL_IS_FIRST_HANDSHAKE(sc)
3890 && (sc->early_data_state != SSL_EARLY_DATA_NONE
3891 || (sc->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)
3892 && (!ssl->method->ssl3_enc->change_cipher_state(sc,
3893 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) {
3894 /*
3895 * This is a fatal error, which leaves sc->enc_write_ctx in an
3896 * inconsistent state and thus ssl3_send_alert may crash.
3897 */
3898 SSLfatal(sc, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER);
3899 goto out;
3900 }
3901 ret = 1;
3902 goto out;
3903
3904 err:
3905 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3906 out:
3907 if (buf != NULL) {
3908 /* If |buf| is NULL, then |tmppkt| could not have been initialized */
3909 WPACKET_cleanup(&tmppkt);
3910 }
3911 BUF_MEM_free(buf);
3912 COMP_CTX_free(comp);
3913 return ret;
3914 }
3915 #endif
3916
ssl3_check_cert_and_algorithm(SSL_CONNECTION * s)3917 int ssl3_check_cert_and_algorithm(SSL_CONNECTION *s)
3918 {
3919 const SSL_CERT_LOOKUP *clu;
3920 size_t idx;
3921 long alg_k, alg_a;
3922 EVP_PKEY *pkey;
3923
3924 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
3925 alg_a = s->s3.tmp.new_cipher->algorithm_auth;
3926
3927 /* we don't have a certificate */
3928 if (!(alg_a & SSL_aCERT))
3929 return 1;
3930
3931 /* This is the passed certificate */
3932 pkey = tls_get_peer_pkey(s);
3933 clu = ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s));
3934
3935 /* Check certificate is recognised and suitable for cipher */
3936 if (clu == NULL || (alg_a & clu->amask) == 0) {
3937 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_MISSING_SIGNING_CERT);
3938 return 0;
3939 }
3940
3941 if (alg_k & (SSL_kRSA | SSL_kRSAPSK) && idx != SSL_PKEY_RSA) {
3942 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3943 SSL_R_MISSING_RSA_ENCRYPTING_CERT);
3944 return 0;
3945 }
3946
3947 if ((alg_k & SSL_kDHE) && (s->s3.peer_tmp == NULL)) {
3948 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3949 return 0;
3950 }
3951
3952 /* Early out to skip the checks below */
3953 if (s->session->peer_rpk != NULL)
3954 return 1;
3955
3956 if (clu->amask & SSL_aECDSA) {
3957 if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s))
3958 return 1;
3959 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_ECC_CERT);
3960 return 0;
3961 }
3962
3963 return 1;
3964 }
3965
3966 #ifndef OPENSSL_NO_NEXTPROTONEG
tls_construct_next_proto(SSL_CONNECTION * s,WPACKET * pkt)3967 CON_FUNC_RETURN tls_construct_next_proto(SSL_CONNECTION *s, WPACKET *pkt)
3968 {
3969 size_t len, padding_len;
3970 unsigned char *padding = NULL;
3971
3972 len = s->ext.npn_len;
3973 padding_len = 32 - ((len + 2) % 32);
3974
3975 if (!WPACKET_sub_memcpy_u8(pkt, s->ext.npn, len)
3976 || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) {
3977 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3978 return CON_FUNC_ERROR;
3979 }
3980
3981 memset(padding, 0, padding_len);
3982
3983 return CON_FUNC_SUCCESS;
3984 }
3985 #endif
3986
tls_process_hello_req(SSL_CONNECTION * s,PACKET * pkt)3987 MSG_PROCESS_RETURN tls_process_hello_req(SSL_CONNECTION *s, PACKET *pkt)
3988 {
3989 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
3990
3991 if (PACKET_remaining(pkt) > 0) {
3992 /* should contain no data */
3993 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
3994 return MSG_PROCESS_ERROR;
3995 }
3996
3997 if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
3998 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
3999 return MSG_PROCESS_FINISHED_READING;
4000 }
4001
4002 /*
4003 * This is a historical discrepancy (not in the RFC) maintained for
4004 * compatibility reasons. If a TLS client receives a HelloRequest it will
4005 * attempt an abbreviated handshake. However if a DTLS client receives a
4006 * HelloRequest it will do a full handshake. Either behaviour is reasonable
4007 * but doing one for TLS and another for DTLS is odd.
4008 */
4009 if (SSL_CONNECTION_IS_DTLS(s))
4010 SSL_renegotiate(ssl);
4011 else
4012 SSL_renegotiate_abbreviated(ssl);
4013
4014 return MSG_PROCESS_FINISHED_READING;
4015 }
4016
tls_process_encrypted_extensions(SSL_CONNECTION * s,PACKET * pkt)4017 static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s,
4018 PACKET *pkt)
4019 {
4020 PACKET extensions;
4021 RAW_EXTENSION *rawexts = NULL;
4022
4023 if (!PACKET_as_length_prefixed_2(pkt, &extensions)
4024 || PACKET_remaining(pkt) != 0) {
4025 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
4026 goto err;
4027 }
4028
4029 if (!tls_collect_extensions(s, &extensions,
4030 SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, &rawexts,
4031 NULL, 1)
4032 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
4033 rawexts, NULL, 0, 1)) {
4034 /* SSLfatal() already called */
4035 goto err;
4036 }
4037
4038 OPENSSL_free(rawexts);
4039 return MSG_PROCESS_CONTINUE_READING;
4040
4041 err:
4042 OPENSSL_free(rawexts);
4043 return MSG_PROCESS_ERROR;
4044 }
4045
ssl_do_client_cert_cb(SSL_CONNECTION * s,X509 ** px509,EVP_PKEY ** ppkey)4046 int ssl_do_client_cert_cb(SSL_CONNECTION *s, X509 **px509, EVP_PKEY **ppkey)
4047 {
4048 int i = 0;
4049 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
4050
4051 #ifndef OPENSSL_NO_ENGINE
4052 if (sctx->client_cert_engine) {
4053 i = tls_engine_load_ssl_client_cert(s, px509, ppkey);
4054 if (i != 0)
4055 return i;
4056 }
4057 #endif
4058 if (sctx->client_cert_cb)
4059 i = sctx->client_cert_cb(SSL_CONNECTION_GET_USER_SSL(s), px509, ppkey);
4060 return i;
4061 }
4062
ssl_cipher_list_to_bytes(SSL_CONNECTION * s,STACK_OF (SSL_CIPHER)* sk,WPACKET * pkt)4063 int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk,
4064 WPACKET *pkt)
4065 {
4066 int i;
4067 size_t totlen = 0, len, maxlen, maxverok = 0;
4068 int empty_reneg_info_scsv = !s->renegotiate
4069 && !SSL_CONNECTION_IS_DTLS(s)
4070 && ssl_security(s, SSL_SECOP_VERSION, 0, TLS1_VERSION, NULL)
4071 && s->min_proto_version <= TLS1_VERSION;
4072 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
4073
4074 /* Set disabled masks for this session */
4075 if (!ssl_set_client_disabled(s)) {
4076 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_PROTOCOLS_AVAILABLE);
4077 return 0;
4078 }
4079
4080 if (sk == NULL) {
4081 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4082 return 0;
4083 }
4084
4085 #ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH
4086 # if OPENSSL_MAX_TLS1_2_CIPHER_LENGTH < 6
4087 # error Max cipher length too short
4088 # endif
4089 /*
4090 * Some servers hang if client hello > 256 bytes as hack workaround
4091 * chop number of supported ciphers to keep it well below this if we
4092 * use TLS v1.2
4093 */
4094 if (TLS1_get_version(ssl) >= TLS1_2_VERSION)
4095 maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;
4096 else
4097 #endif
4098 /* Maximum length that can be stored in 2 bytes. Length must be even */
4099 maxlen = 0xfffe;
4100
4101 if (empty_reneg_info_scsv)
4102 maxlen -= 2;
4103 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV)
4104 maxlen -= 2;
4105
4106 for (i = 0; i < sk_SSL_CIPHER_num(sk) && totlen < maxlen; i++) {
4107 const SSL_CIPHER *c;
4108
4109 c = sk_SSL_CIPHER_value(sk, i);
4110 /* Skip disabled ciphers */
4111 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
4112 continue;
4113
4114 if (!ssl->method->put_cipher_by_char(c, pkt, &len)) {
4115 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4116 return 0;
4117 }
4118
4119 /* Sanity check that the maximum version we offer has ciphers enabled */
4120 if (!maxverok) {
4121 int minproto = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls;
4122 int maxproto = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls;
4123
4124 if (ssl_version_cmp(s, maxproto, s->s3.tmp.max_ver) >= 0
4125 && ssl_version_cmp(s, minproto, s->s3.tmp.max_ver) <= 0)
4126 maxverok = 1;
4127 }
4128
4129 totlen += len;
4130 }
4131
4132 if (totlen == 0 || !maxverok) {
4133 const char *maxvertext =
4134 !maxverok
4135 ? "No ciphers enabled for max supported SSL/TLS version"
4136 : NULL;
4137
4138 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_CIPHERS_AVAILABLE,
4139 maxvertext);
4140 return 0;
4141 }
4142
4143 if (totlen != 0) {
4144 if (empty_reneg_info_scsv) {
4145 static const SSL_CIPHER scsv = {
4146 0, NULL, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
4147 };
4148 if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) {
4149 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4150 return 0;
4151 }
4152 }
4153 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) {
4154 static const SSL_CIPHER scsv = {
4155 0, NULL, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
4156 };
4157 if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) {
4158 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4159 return 0;
4160 }
4161 }
4162 }
4163
4164 return 1;
4165 }
4166
tls_construct_end_of_early_data(SSL_CONNECTION * s,WPACKET * pkt)4167 CON_FUNC_RETURN tls_construct_end_of_early_data(SSL_CONNECTION *s, WPACKET *pkt)
4168 {
4169 if (s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY
4170 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) {
4171 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
4172 return CON_FUNC_ERROR;
4173 }
4174
4175 s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
4176 return CON_FUNC_SUCCESS;
4177 }
4178
