1 /*
2 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "internal/cryptlib.h"
13 #include "statem_local.h"
14
tls_construct_ctos_renegotiate(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)15 EXT_RETURN tls_construct_ctos_renegotiate(SSL_CONNECTION *s, WPACKET *pkt,
16 unsigned int context, X509 *x,
17 size_t chainidx)
18 {
19 /* Add RI if renegotiating */
20 if (!s->renegotiate)
21 return EXT_RETURN_NOT_SENT;
22
23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
24 || !WPACKET_start_sub_packet_u16(pkt)
25 || !WPACKET_sub_memcpy_u8(pkt, s->s3.previous_client_finished,
26 s->s3.previous_client_finished_len)
27 || !WPACKET_close(pkt)) {
28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
29 return EXT_RETURN_FAIL;
30 }
31
32 return EXT_RETURN_SENT;
33 }
34
tls_construct_ctos_server_name(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)35 EXT_RETURN tls_construct_ctos_server_name(SSL_CONNECTION *s, WPACKET *pkt,
36 unsigned int context, X509 *x,
37 size_t chainidx)
38 {
39 if (s->ext.hostname == NULL)
40 return EXT_RETURN_NOT_SENT;
41
42 /* Add TLS extension servername to the Client Hello message */
43 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
44 /* Sub-packet for server_name extension */
45 || !WPACKET_start_sub_packet_u16(pkt)
46 /* Sub-packet for servername list (always 1 hostname)*/
47 || !WPACKET_start_sub_packet_u16(pkt)
48 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name)
49 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname,
50 strlen(s->ext.hostname))
51 || !WPACKET_close(pkt)
52 || !WPACKET_close(pkt)) {
53 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
54 return EXT_RETURN_FAIL;
55 }
56
57 return EXT_RETURN_SENT;
58 }
59
60 /* Push a Max Fragment Len extension into ClientHello */
tls_construct_ctos_maxfragmentlen(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)61 EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt,
62 unsigned int context, X509 *x,
63 size_t chainidx)
64 {
65 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED)
66 return EXT_RETURN_NOT_SENT;
67
68 /* Add Max Fragment Length extension if client enabled it. */
69 /*-
70 * 4 bytes for this extension type and extension length
71 * 1 byte for the Max Fragment Length code value.
72 */
73 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)
74 /* Sub-packet for Max Fragment Length extension (1 byte) */
75 || !WPACKET_start_sub_packet_u16(pkt)
76 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode)
77 || !WPACKET_close(pkt)) {
78 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
79 return EXT_RETURN_FAIL;
80 }
81
82 return EXT_RETURN_SENT;
83 }
84
85 #ifndef OPENSSL_NO_SRP
tls_construct_ctos_srp(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)86 EXT_RETURN tls_construct_ctos_srp(SSL_CONNECTION *s, WPACKET *pkt,
87 unsigned int context,
88 X509 *x, size_t chainidx)
89 {
90 /* Add SRP username if there is one */
91 if (s->srp_ctx.login == NULL)
92 return EXT_RETURN_NOT_SENT;
93
94 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp)
95 /* Sub-packet for SRP extension */
96 || !WPACKET_start_sub_packet_u16(pkt)
97 || !WPACKET_start_sub_packet_u8(pkt)
98 /* login must not be zero...internal error if so */
99 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)
100 || !WPACKET_memcpy(pkt, s->srp_ctx.login,
101 strlen(s->srp_ctx.login))
102 || !WPACKET_close(pkt)
103 || !WPACKET_close(pkt)) {
104 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
105 return EXT_RETURN_FAIL;
106 }
107
108 return EXT_RETURN_SENT;
109 }
110 #endif
111
use_ecc(SSL_CONNECTION * s,int min_version,int max_version)112 static int use_ecc(SSL_CONNECTION *s, int min_version, int max_version)
113 {
114 int i, end, ret = 0;
115 unsigned long alg_k, alg_a;
116 STACK_OF(SSL_CIPHER) *cipher_stack = NULL;
117 const uint16_t *pgroups = NULL;
118 size_t num_groups, j;
119 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
120
121 /* See if we support any ECC ciphersuites */
122 if (s->version == SSL3_VERSION)
123 return 0;
124
125 cipher_stack = SSL_get1_supported_ciphers(ssl);
126 end = sk_SSL_CIPHER_num(cipher_stack);
127 for (i = 0; i < end; i++) {
128 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
129
130 alg_k = c->algorithm_mkey;
131 alg_a = c->algorithm_auth;
132 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK))
133 || (alg_a & SSL_aECDSA)
134 || c->min_tls >= TLS1_3_VERSION) {
135 ret = 1;
136 break;
137 }
138 }
139 sk_SSL_CIPHER_free(cipher_stack);
140 if (!ret)
141 return 0;
142
143 /* Check we have at least one EC supported group */
144 tls1_get_supported_groups(s, &pgroups, &num_groups);
145 for (j = 0; j < num_groups; j++) {
146 uint16_t ctmp = pgroups[j];
147
148 if (tls_valid_group(s, ctmp, min_version, max_version, 1, NULL)
149 && tls_group_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED))
150 return 1;
151 }
152
153 return 0;
154 }
155
tls_construct_ctos_ec_pt_formats(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)156 EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt,
157 unsigned int context, X509 *x,
158 size_t chainidx)
159 {
160 const unsigned char *pformats;
161 size_t num_formats;
162 int reason, min_version, max_version;
163
164 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
165 if (reason != 0) {
166 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
167 return EXT_RETURN_FAIL;
168 }
169 if (!use_ecc(s, min_version, max_version))
170 return EXT_RETURN_NOT_SENT;
171
172 /* Add TLS extension ECPointFormats to the ClientHello message */
173 tls1_get_formatlist(s, &pformats, &num_formats);
174
175 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
176 /* Sub-packet for formats extension */
177 || !WPACKET_start_sub_packet_u16(pkt)
178 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats)
179 || !WPACKET_close(pkt)) {
180 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
181 return EXT_RETURN_FAIL;
182 }
183
184 return EXT_RETURN_SENT;
185 }
186
tls_construct_ctos_supported_groups(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)187 EXT_RETURN tls_construct_ctos_supported_groups(SSL_CONNECTION *s, WPACKET *pkt,
188 unsigned int context, X509 *x,
189 size_t chainidx)
190 {
191 const uint16_t *pgroups = NULL;
192 size_t num_groups = 0, i, tls13added = 0, added = 0;
193 int min_version, max_version, reason;
194
195 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
196 if (reason != 0) {
197 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
198 return EXT_RETURN_FAIL;
199 }
200
201 /*
202 * We only support EC groups in TLSv1.2 or below, and in DTLS. Therefore
203 * if we don't have EC support then we don't send this extension.
204 */
205 if (!use_ecc(s, min_version, max_version)
206 && (SSL_CONNECTION_IS_DTLS(s) || max_version < TLS1_3_VERSION))
207 return EXT_RETURN_NOT_SENT;
208
209 /*
210 * Add TLS extension supported_groups to the ClientHello message
211 */
212 tls1_get_supported_groups(s, &pgroups, &num_groups);
213
214 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
215 /* Sub-packet for supported_groups extension */
216 || !WPACKET_start_sub_packet_u16(pkt)
217 || !WPACKET_start_sub_packet_u16(pkt)
218 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)) {
219 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
220 return EXT_RETURN_FAIL;
221 }
222 /* Copy group ID if supported */
223 for (i = 0; i < num_groups; i++) {
224 uint16_t ctmp = pgroups[i];
225 int okfortls13;
226
227 if (tls_valid_group(s, ctmp, min_version, max_version, 0, &okfortls13)
228 && tls_group_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) {
229 #ifndef OPENSSL_NO_TLS1_3
230 int ctmp13 = ssl_group_id_internal_to_tls13(ctmp);
231
232 if (ctmp13 != 0 && ctmp13 != ctmp
233 && max_version == TLS1_3_VERSION) {
234 if (!WPACKET_put_bytes_u16(pkt, ctmp13)) {
235 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
236 return EXT_RETURN_FAIL;
237 }
238 tls13added++;
239 added++;
240 if (min_version == TLS1_3_VERSION)
241 continue;
242 }
243 #endif
244 if (!WPACKET_put_bytes_u16(pkt, ctmp)) {
245 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
246 return EXT_RETURN_FAIL;
247 }
248 if (okfortls13 && max_version == TLS1_3_VERSION)
249 tls13added++;
250 added++;
251 }
252 }
253 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
254 if (added == 0)
255 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_GROUPS,
256 "No groups enabled for max supported SSL/TLS version");
257 else
258 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
259 return EXT_RETURN_FAIL;
260 }
261
262 if (tls13added == 0 && max_version == TLS1_3_VERSION) {
263 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_GROUPS,
264 "No groups enabled for max supported SSL/TLS version");
265 return EXT_RETURN_FAIL;
266 }
267
268 return EXT_RETURN_SENT;
269 }
270
tls_construct_ctos_session_ticket(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)271 EXT_RETURN tls_construct_ctos_session_ticket(SSL_CONNECTION *s, WPACKET *pkt,
272 unsigned int context, X509 *x,
273 size_t chainidx)
274 {
275 size_t ticklen;
276
277 if (!tls_use_ticket(s))
278 return EXT_RETURN_NOT_SENT;
279
280 if (!s->new_session && s->session != NULL
281 && s->session->ext.tick != NULL
282 && s->session->ssl_version != TLS1_3_VERSION) {
283 ticklen = s->session->ext.ticklen;
284 } else if (s->session && s->ext.session_ticket != NULL
285 && s->ext.session_ticket->data != NULL) {
286 ticklen = s->ext.session_ticket->length;
287 s->session->ext.tick = OPENSSL_malloc(ticklen);
288 if (s->session->ext.tick == NULL) {
289 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
290 return EXT_RETURN_FAIL;
291 }
292 memcpy(s->session->ext.tick,
293 s->ext.session_ticket->data, ticklen);
294 s->session->ext.ticklen = ticklen;
295 } else {
296 ticklen = 0;
297 }
298
299 if (ticklen == 0 && s->ext.session_ticket != NULL &&
300 s->ext.session_ticket->data == NULL)
301 return EXT_RETURN_NOT_SENT;
302
303 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
304 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) {
305 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
306 return EXT_RETURN_FAIL;
307 }
308
309 return EXT_RETURN_SENT;
310 }
311
tls_construct_ctos_sig_algs(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)312 EXT_RETURN tls_construct_ctos_sig_algs(SSL_CONNECTION *s, WPACKET *pkt,
313 unsigned int context, X509 *x,
314 size_t chainidx)
315 {
316 size_t salglen;
317 const uint16_t *salg;
318
319 if (!SSL_CLIENT_USE_SIGALGS(s))
320 return EXT_RETURN_NOT_SENT;
321
322 salglen = tls12_get_psigalgs(s, 1, &salg);
323 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms)
324 /* Sub-packet for sig-algs extension */
325 || !WPACKET_start_sub_packet_u16(pkt)
326 /* Sub-packet for the actual list */
327 || !WPACKET_start_sub_packet_u16(pkt)
328 || !tls12_copy_sigalgs(s, pkt, salg, salglen)
329 || !WPACKET_close(pkt)
330 || !WPACKET_close(pkt)) {
331 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
332 return EXT_RETURN_FAIL;
333 }
334
335 return EXT_RETURN_SENT;
336 }
337
338 #ifndef OPENSSL_NO_OCSP
tls_construct_ctos_status_request(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)339 EXT_RETURN tls_construct_ctos_status_request(SSL_CONNECTION *s, WPACKET *pkt,
340 unsigned int context, X509 *x,
341 size_t chainidx)
342 {
343 int i;
344
345 /* This extension isn't defined for client Certificates */
346 if (x != NULL)
347 return EXT_RETURN_NOT_SENT;
348
349 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp)
350 return EXT_RETURN_NOT_SENT;
351
352 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
353 /* Sub-packet for status request extension */
354 || !WPACKET_start_sub_packet_u16(pkt)
355 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp)
356 /* Sub-packet for the ids */
357 || !WPACKET_start_sub_packet_u16(pkt)) {
358 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
359 return EXT_RETURN_FAIL;
360 }
361 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) {
362 unsigned char *idbytes;
363 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i);
364 int idlen = i2d_OCSP_RESPID(id, NULL);
365
366 if (idlen <= 0
367 /* Sub-packet for an individual id */
368 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes)
369 || i2d_OCSP_RESPID(id, &idbytes) != idlen) {
370 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
371 return EXT_RETURN_FAIL;
372 }
373 }
374 if (!WPACKET_close(pkt)
375 || !WPACKET_start_sub_packet_u16(pkt)) {
376 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
377 return EXT_RETURN_FAIL;
378 }
379 if (s->ext.ocsp.exts) {
380 unsigned char *extbytes;
381 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL);
382
383 if (extlen < 0) {
384 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
385 return EXT_RETURN_FAIL;
386 }
387 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes)
388 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes)
389 != extlen) {
390 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
391 return EXT_RETURN_FAIL;
392 }
393 }
394 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
395 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
396 return EXT_RETURN_FAIL;
397 }
398
399 return EXT_RETURN_SENT;
400 }
401 #endif
402
403 #ifndef OPENSSL_NO_NEXTPROTONEG
tls_construct_ctos_npn(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)404 EXT_RETURN tls_construct_ctos_npn(SSL_CONNECTION *s, WPACKET *pkt,
405 unsigned int context,
406 X509 *x, size_t chainidx)
407 {
408 if (SSL_CONNECTION_GET_CTX(s)->ext.npn_select_cb == NULL
409 || !SSL_IS_FIRST_HANDSHAKE(s))
410 return EXT_RETURN_NOT_SENT;
411
412 /*
413 * The client advertises an empty extension to indicate its support
414 * for Next Protocol Negotiation
415 */
416 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
417 || !WPACKET_put_bytes_u16(pkt, 0)) {
418 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
419 return EXT_RETURN_FAIL;
420 }
421
422 return EXT_RETURN_SENT;
423 }
424 #endif
425
tls_construct_ctos_alpn(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)426 EXT_RETURN tls_construct_ctos_alpn(SSL_CONNECTION *s, WPACKET *pkt,
427 unsigned int context,
428 X509 *x, size_t chainidx)
429 {
430 s->s3.alpn_sent = 0;
431
432 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s))
433 return EXT_RETURN_NOT_SENT;
434
435 if (!WPACKET_put_bytes_u16(pkt,
436 TLSEXT_TYPE_application_layer_protocol_negotiation)
437 /* Sub-packet ALPN extension */
438 || !WPACKET_start_sub_packet_u16(pkt)
439 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len)
440 || !WPACKET_close(pkt)) {
441 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
442 return EXT_RETURN_FAIL;
443 }
444 s->s3.alpn_sent = 1;
445
446 return EXT_RETURN_SENT;
447 }
448
449
450 #ifndef OPENSSL_NO_SRTP
tls_construct_ctos_use_srtp(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)451 EXT_RETURN tls_construct_ctos_use_srtp(SSL_CONNECTION *s, WPACKET *pkt,
452 unsigned int context, X509 *x,
453 size_t chainidx)
454 {
455 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
456 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(ssl);
457 int i, end;
458
459 if (clnt == NULL)
460 return EXT_RETURN_NOT_SENT;
461
462 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
463 /* Sub-packet for SRTP extension */
464 || !WPACKET_start_sub_packet_u16(pkt)
465 /* Sub-packet for the protection profile list */
466 || !WPACKET_start_sub_packet_u16(pkt)) {
467 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
468 return EXT_RETURN_FAIL;
469 }
470
471 end = sk_SRTP_PROTECTION_PROFILE_num(clnt);
472 for (i = 0; i < end; i++) {
473 const SRTP_PROTECTION_PROFILE *prof =
474 sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
475
476 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) {
477 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
478 return EXT_RETURN_FAIL;
479 }
480 }
481 if (!WPACKET_close(pkt)
482 /* Add an empty use_mki value */
483 || !WPACKET_put_bytes_u8(pkt, 0)
484 || !WPACKET_close(pkt)) {
485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
486 return EXT_RETURN_FAIL;
487 }
488
489 return EXT_RETURN_SENT;
490 }
491 #endif
492
tls_construct_ctos_etm(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)493 EXT_RETURN tls_construct_ctos_etm(SSL_CONNECTION *s, WPACKET *pkt,
494 unsigned int context,
495 X509 *x, size_t chainidx)
496 {
497 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
498 return EXT_RETURN_NOT_SENT;
499
500 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
501 || !WPACKET_put_bytes_u16(pkt, 0)) {
502 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
503 return EXT_RETURN_FAIL;
504 }
505
506 return EXT_RETURN_SENT;
507 }
508
509 #ifndef OPENSSL_NO_CT
tls_construct_ctos_sct(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)510 EXT_RETURN tls_construct_ctos_sct(SSL_CONNECTION *s, WPACKET *pkt,
511 unsigned int context,
512 X509 *x, size_t chainidx)
513 {
514 if (s->ct_validation_callback == NULL)
515 return EXT_RETURN_NOT_SENT;
516
517 /* Not defined for client Certificates */
518 if (x != NULL)
519 return EXT_RETURN_NOT_SENT;
520
521 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp)
522 || !WPACKET_put_bytes_u16(pkt, 0)) {
523 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
524 return EXT_RETURN_FAIL;
525 }
526
527 return EXT_RETURN_SENT;
528 }
529 #endif
530
tls_construct_ctos_ems(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)531 EXT_RETURN tls_construct_ctos_ems(SSL_CONNECTION *s, WPACKET *pkt,
532 unsigned int context,
533 X509 *x, size_t chainidx)
534 {
535 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET)
536 return EXT_RETURN_NOT_SENT;
537
538 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
539 || !WPACKET_put_bytes_u16(pkt, 0)) {
540 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
541 return EXT_RETURN_FAIL;
542 }
543
544 return EXT_RETURN_SENT;
545 }
546
tls_construct_ctos_supported_versions(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)547 EXT_RETURN tls_construct_ctos_supported_versions(SSL_CONNECTION *s, WPACKET *pkt,
548 unsigned int context, X509 *x,
549 size_t chainidx)
550 {
551 int currv, min_version, max_version, reason;
552
553 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
554 if (reason != 0) {
555 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
556 return EXT_RETURN_FAIL;
557 }
558
559 /*
560 * Don't include this if we can't negotiate TLSv1.3. We can do a straight
561 * comparison here because we will never be called in DTLS.
562 */
563 if (max_version < TLS1_3_VERSION)
564 return EXT_RETURN_NOT_SENT;
565
566 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
567 || !WPACKET_start_sub_packet_u16(pkt)
568 || !WPACKET_start_sub_packet_u8(pkt)) {
569 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
570 return EXT_RETURN_FAIL;
571 }
572
573 for (currv = max_version; currv >= min_version; currv--) {
574 if (!WPACKET_put_bytes_u16(pkt, currv)) {
575 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
576 return EXT_RETURN_FAIL;
577 }
578 }
579 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
580 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
581 return EXT_RETURN_FAIL;
582 }
583
584 return EXT_RETURN_SENT;
585 }
586
587 /*
588 * Construct a psk_kex_modes extension.
589 */
tls_construct_ctos_psk_kex_modes(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)590 EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL_CONNECTION *s, WPACKET *pkt,
591 unsigned int context, X509 *x,
592 size_t chainidx)
593 {
594 #ifndef OPENSSL_NO_TLS1_3
595 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX;
596
597 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes)
598 || !WPACKET_start_sub_packet_u16(pkt)
599 || !WPACKET_start_sub_packet_u8(pkt)
600 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE)
601 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE))
602 || !WPACKET_close(pkt)
603 || !WPACKET_close(pkt)) {
604 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
605 return EXT_RETURN_FAIL;
606 }
607
608 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE;
609 if (nodhe)
610 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;
611 #endif
612
613 return EXT_RETURN_SENT;
614 }
615
616 #ifndef OPENSSL_NO_TLS1_3
add_key_share(SSL_CONNECTION * s,WPACKET * pkt,unsigned int curve_id)617 static int add_key_share(SSL_CONNECTION *s, WPACKET *pkt, unsigned int curve_id)
618 {
619 unsigned char *encoded_point = NULL;
620 EVP_PKEY *key_share_key = NULL;
621 size_t encodedlen;
622
623 if (s->s3.tmp.pkey != NULL) {
624 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) {
625 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
626 return 0;
627 }
628 /*
629 * Could happen if we got an HRR that wasn't requesting a new key_share
630 */
631 key_share_key = s->s3.tmp.pkey;
632 } else {
633 key_share_key = ssl_generate_pkey_group(s, curve_id);
634 if (key_share_key == NULL) {
635 /* SSLfatal() already called */
636 return 0;
637 }
638 }
639
640 /* Encode the public key. */
641 encodedlen = EVP_PKEY_get1_encoded_public_key(key_share_key,
642 &encoded_point);
643 if (encodedlen == 0) {
644 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
645 goto err;
646 }
647
648 /* Create KeyShareEntry */
649 if (!WPACKET_put_bytes_u16(pkt, ssl_group_id_internal_to_tls13(curve_id))
650 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) {
651 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
652 goto err;
653 }
654
655 /*
656 * When changing to send more than one key_share we're
657 * going to need to be able to save more than one EVP_PKEY. For now
658 * we reuse the existing tmp.pkey
659 */
660 s->s3.tmp.pkey = key_share_key;
661 s->s3.group_id = curve_id;
662 OPENSSL_free(encoded_point);
663
664 return 1;
665 err:
666 if (s->s3.tmp.pkey == NULL)
667 EVP_PKEY_free(key_share_key);
668 OPENSSL_free(encoded_point);
669 return 0;
670 }
671 #endif
672
tls_construct_ctos_key_share(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)673 EXT_RETURN tls_construct_ctos_key_share(SSL_CONNECTION *s, WPACKET *pkt,
674 unsigned int context, X509 *x,
675 size_t chainidx)
676 {
677 #ifndef OPENSSL_NO_TLS1_3
678 size_t i, num_groups = 0;
679 const uint16_t *pgroups = NULL;
680 uint16_t curve_id = 0;
681
682 /* key_share extension */
683 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
684 /* Extension data sub-packet */
685 || !WPACKET_start_sub_packet_u16(pkt)
686 /* KeyShare list sub-packet */
687 || !WPACKET_start_sub_packet_u16(pkt)) {
688 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
689 return EXT_RETURN_FAIL;
690 }
691
692 tls1_get_supported_groups(s, &pgroups, &num_groups);
693
694 /*
695 * Make the number of key_shares sent configurable. For
696 * now, we just send one
697 */
698 if (s->s3.group_id != 0) {
699 curve_id = s->s3.group_id;
700 } else {
701 for (i = 0; i < num_groups; i++) {
702 if (ssl_group_id_internal_to_tls13(pgroups[i]) == 0)
703 continue;
704
705 if (!tls_group_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED))
706 continue;
707
708 curve_id = pgroups[i];
709 break;
710 }
711 }
712
713 if (curve_id == 0) {
714 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_KEY_SHARE);
715 return EXT_RETURN_FAIL;
716 }
717
718 if (!add_key_share(s, pkt, curve_id)) {
719 /* SSLfatal() already called */
720 return EXT_RETURN_FAIL;
721 }
722
723 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
724 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
725 return EXT_RETURN_FAIL;
726 }
727 return EXT_RETURN_SENT;
728 #else
729 return EXT_RETURN_NOT_SENT;
730 #endif
731 }
732
tls_construct_ctos_cookie(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)733 EXT_RETURN tls_construct_ctos_cookie(SSL_CONNECTION *s, WPACKET *pkt,
734 unsigned int context,
735 X509 *x, size_t chainidx)
736 {
737 EXT_RETURN ret = EXT_RETURN_FAIL;
738
739 /* Should only be set if we've had an HRR */
740 if (s->ext.tls13_cookie_len == 0)
741 return EXT_RETURN_NOT_SENT;
742
743 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)
744 /* Extension data sub-packet */
745 || !WPACKET_start_sub_packet_u16(pkt)
746 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie,
747 s->ext.tls13_cookie_len)
748 || !WPACKET_close(pkt)) {
749 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
750 goto end;
751 }
752
753 ret = EXT_RETURN_SENT;
754 end:
755 OPENSSL_free(s->ext.tls13_cookie);
756 s->ext.tls13_cookie = NULL;
757 s->ext.tls13_cookie_len = 0;
758
759 return ret;
760 }
761
tls_construct_ctos_early_data(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)762 EXT_RETURN tls_construct_ctos_early_data(SSL_CONNECTION *s, WPACKET *pkt,
763 unsigned int context, X509 *x,
764 size_t chainidx)
765 {
766 #ifndef OPENSSL_NO_PSK
767 char identity[PSK_MAX_IDENTITY_LEN + 1];
768 #endif /* OPENSSL_NO_PSK */
769 const unsigned char *id = NULL;
770 size_t idlen = 0;
771 SSL_SESSION *psksess = NULL;
772 SSL_SESSION *edsess = NULL;
773 const EVP_MD *handmd = NULL;
774 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
775
776 if (s->hello_retry_request == SSL_HRR_PENDING)
777 handmd = ssl_handshake_md(s);
778
779 if (s->psk_use_session_cb != NULL
780 && (!s->psk_use_session_cb(ssl, handmd, &id, &idlen, &psksess)
781 || (psksess != NULL
782 && psksess->ssl_version != TLS1_3_VERSION))) {
783 SSL_SESSION_free(psksess);
784 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
785 return EXT_RETURN_FAIL;
786 }
787
788 #ifndef OPENSSL_NO_PSK
789 if (psksess == NULL && s->psk_client_callback != NULL) {
790 unsigned char psk[PSK_MAX_PSK_LEN];
791 size_t psklen = 0;
792
793 memset(identity, 0, sizeof(identity));
794 psklen = s->psk_client_callback(ssl, NULL,
795 identity, sizeof(identity) - 1,
796 psk, sizeof(psk));
797
798 if (psklen > PSK_MAX_PSK_LEN) {
799 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, ERR_R_INTERNAL_ERROR);
800 return EXT_RETURN_FAIL;
801 } else if (psklen > 0) {
802 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
803 const SSL_CIPHER *cipher;
804
805 idlen = strlen(identity);
806 if (idlen > PSK_MAX_IDENTITY_LEN) {
807 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
808 return EXT_RETURN_FAIL;
809 }
810 id = (unsigned char *)identity;
811
812 /*
813 * We found a PSK using an old style callback. We don't know
814 * the digest so we default to SHA256 as per the TLSv1.3 spec
815 */
816 cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id);
817 if (cipher == NULL) {
818 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
819 return EXT_RETURN_FAIL;
820 }
821
822 psksess = SSL_SESSION_new();
823 if (psksess == NULL
824 || !SSL_SESSION_set1_master_key(psksess, psk, psklen)
825 || !SSL_SESSION_set_cipher(psksess, cipher)
826 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) {
827 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
828 OPENSSL_cleanse(psk, psklen);
829 return EXT_RETURN_FAIL;
830 }
831 OPENSSL_cleanse(psk, psklen);
832 }
833 }
834 #endif /* OPENSSL_NO_PSK */
835
836 SSL_SESSION_free(s->psksession);
837 s->psksession = psksess;
838 if (psksess != NULL) {
839 OPENSSL_free(s->psksession_id);
840 s->psksession_id = OPENSSL_memdup(id, idlen);
841 if (s->psksession_id == NULL) {
842 s->psksession_id_len = 0;
843 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
844 return EXT_RETURN_FAIL;
845 }
846 s->psksession_id_len = idlen;
847 }
848
849 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING
850 || (s->session->ext.max_early_data == 0
851 && (psksess == NULL || psksess->ext.max_early_data == 0))) {
852 s->max_early_data = 0;
853 return EXT_RETURN_NOT_SENT;
854 }
855 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess;
856 s->max_early_data = edsess->ext.max_early_data;
857
858 if (edsess->ext.hostname != NULL) {
859 if (s->ext.hostname == NULL
860 || (s->ext.hostname != NULL
861 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) {
862 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
863 SSL_R_INCONSISTENT_EARLY_DATA_SNI);
864 return EXT_RETURN_FAIL;
865 }
866 }
867
868 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) {
869 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_INCONSISTENT_EARLY_DATA_ALPN);
870 return EXT_RETURN_FAIL;
871 }
872
873 /*
874 * Verify that we are offering an ALPN protocol consistent with the early
875 * data.
876 */
877 if (edsess->ext.alpn_selected != NULL) {
878 PACKET prots, alpnpkt;
879 int found = 0;
880
881 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) {
882 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
883 return EXT_RETURN_FAIL;
884 }
885 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) {
886 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected,
887 edsess->ext.alpn_selected_len)) {
888 found = 1;
889 break;
890 }
891 }
892 if (!found) {
893 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
894 SSL_R_INCONSISTENT_EARLY_DATA_ALPN);
895 return EXT_RETURN_FAIL;
896 }
897 }
898
899 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
900 || !WPACKET_start_sub_packet_u16(pkt)
901 || !WPACKET_close(pkt)) {
902 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
903 return EXT_RETURN_FAIL;
904 }
905
906 /*
907 * We set this to rejected here. Later, if the server acknowledges the
908 * extension, we set it to accepted.
909 */
910 s->ext.early_data = SSL_EARLY_DATA_REJECTED;
911 s->ext.early_data_ok = 1;
912
913 return EXT_RETURN_SENT;
914 }
915
916 #define F5_WORKAROUND_MIN_MSG_LEN 0xff
917 #define F5_WORKAROUND_MAX_MSG_LEN 0x200
918
919 /*
920 * PSK pre binder overhead =
921 * 2 bytes for TLSEXT_TYPE_psk
922 * 2 bytes for extension length
923 * 2 bytes for identities list length
924 * 2 bytes for identity length
925 * 4 bytes for obfuscated_ticket_age
926 * 2 bytes for binder list length
927 * 1 byte for binder length
928 * The above excludes the number of bytes for the identity itself and the
929 * subsequent binder bytes
930 */
931 #define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1)
932
tls_construct_ctos_padding(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)933 EXT_RETURN tls_construct_ctos_padding(SSL_CONNECTION *s, WPACKET *pkt,
934 unsigned int context, X509 *x,
935 size_t chainidx)
936 {
937 unsigned char *padbytes;
938 size_t hlen;
939
940 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0)
941 return EXT_RETURN_NOT_SENT;
942
943 /*
944 * Add padding to workaround bugs in F5 terminators. See RFC7685.
945 * This code calculates the length of all extensions added so far but
946 * excludes the PSK extension (because that MUST be written last). Therefore
947 * this extension MUST always appear second to last.
948 */
949 if (!WPACKET_get_total_written(pkt, &hlen)) {
950 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
951 return EXT_RETURN_FAIL;
952 }
953
954 /*
955 * If we're going to send a PSK then that will be written out after this
956 * extension, so we need to calculate how long it is going to be.
957 */
958 if (s->session->ssl_version == TLS1_3_VERSION
959 && s->session->ext.ticklen != 0
960 && s->session->cipher != NULL) {
961 const EVP_MD *md = ssl_md(SSL_CONNECTION_GET_CTX(s),
962 s->session->cipher->algorithm2);
963
964 if (md != NULL) {
965 /*
966 * Add the fixed PSK overhead, the identity length and the binder
967 * length.
968 */
969 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen
970 + EVP_MD_get_size(md);
971 }
972 }
973
974 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) {
975 /* Calculate the amount of padding we need to add */
976 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen;
977
978 /*
979 * Take off the size of extension header itself (2 bytes for type and
980 * 2 bytes for length bytes), but ensure that the extension is at least
981 * 1 byte long so as not to have an empty extension last (WebSphere 7.x,
982 * 8.x are intolerant of that condition)
983 */
984 if (hlen > 4)
985 hlen -= 4;
986 else
987 hlen = 1;
988
989 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding)
990 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) {
991 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
992 return EXT_RETURN_FAIL;
993 }
994 memset(padbytes, 0, hlen);
995 }
996
997 return EXT_RETURN_SENT;
998 }
999
1000 /*
1001 * Construct the pre_shared_key extension
1002 */
tls_construct_ctos_psk(SSL_CONNECTION * s,WPACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1003 EXT_RETURN tls_construct_ctos_psk(SSL_CONNECTION *s, WPACKET *pkt,
1004 unsigned int context,
1005 X509 *x, size_t chainidx)
1006 {
1007 #ifndef OPENSSL_NO_TLS1_3
1008 uint32_t agesec, agems = 0;
1009 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen;
1010 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL;
1011 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL;
1012 int dores = 0;
1013 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1014
1015 s->ext.tick_identity = 0;
1016
1017 /*
1018 * Note: At this stage of the code we only support adding a single
1019 * resumption PSK. If we add support for multiple PSKs then the length
1020 * calculations in the padding extension will need to be adjusted.
1021 */
1022
1023 /*
1024 * If this is an incompatible or new session then we have nothing to resume
1025 * so don't add this extension.
1026 */
1027 if (s->session->ssl_version != TLS1_3_VERSION
1028 || (s->session->ext.ticklen == 0 && s->psksession == NULL))
1029 return EXT_RETURN_NOT_SENT;
1030
1031 if (s->hello_retry_request == SSL_HRR_PENDING)
1032 handmd = ssl_handshake_md(s);
1033
1034 if (s->session->ext.ticklen != 0) {
1035 /* Get the digest associated with the ciphersuite in the session */
1036 if (s->session->cipher == NULL) {
1037 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1038 return EXT_RETURN_FAIL;
1039 }
1040 mdres = ssl_md(sctx, s->session->cipher->algorithm2);
1041 if (mdres == NULL) {
1042 /*
1043 * Don't recognize this cipher so we can't use the session.
1044 * Ignore it
1045 */
1046 goto dopsksess;
1047 }
1048
1049 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) {
1050 /*
1051 * Selected ciphersuite hash does not match the hash for the session
1052 * so we can't use it.
1053 */
1054 goto dopsksess;
1055 }
1056
1057 /*
1058 * Technically the C standard just says time() returns a time_t and says
1059 * nothing about the encoding of that type. In practice most
1060 * implementations follow POSIX which holds it as an integral type in
1061 * seconds since epoch. We've already made the assumption that we can do
1062 * this in multiple places in the code, so portability shouldn't be an
1063 * issue.
1064 */
1065 agesec = (uint32_t)(time(NULL) - s->session->time);
1066 /*
1067 * We calculate the age in seconds but the server may work in ms. Due to
1068 * rounding errors we could overestimate the age by up to 1s. It is
1069 * better to underestimate it. Otherwise, if the RTT is very short, when
1070 * the server calculates the age reported by the client it could be
1071 * bigger than the age calculated on the server - which should never
1072 * happen.
1073 */
1074 if (agesec > 0)
1075 agesec--;
1076
1077 if (s->session->ext.tick_lifetime_hint < agesec) {
1078 /* Ticket is too old. Ignore it. */
1079 goto dopsksess;
1080 }
1081
1082 /*
1083 * Calculate age in ms. We're just doing it to nearest second. Should be
1084 * good enough.
1085 */
1086 agems = agesec * (uint32_t)1000;
1087
1088 if (agesec != 0 && agems / (uint32_t)1000 != agesec) {
1089 /*
1090 * Overflow. Shouldn't happen unless this is a *really* old session.
1091 * If so we just ignore it.
1092 */
1093 goto dopsksess;
1094 }
1095
1096 /*
1097 * Obfuscate the age. Overflow here is fine, this addition is supposed
1098 * to be mod 2^32.
1099 */
1100 agems += s->session->ext.tick_age_add;
1101
1102 reshashsize = EVP_MD_get_size(mdres);
1103 s->ext.tick_identity++;
1104 dores = 1;
1105 }
1106
1107 dopsksess:
1108 if (!dores && s->psksession == NULL)
1109 return EXT_RETURN_NOT_SENT;
1110
1111 if (s->psksession != NULL) {
1112 mdpsk = ssl_md(sctx, s->psksession->cipher->algorithm2);
1113 if (mdpsk == NULL) {
1114 /*
1115 * Don't recognize this cipher so we can't use the session.
1116 * If this happens it's an application bug.
1117 */
1118 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
1119 return EXT_RETURN_FAIL;
1120 }
1121
1122 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) {
1123 /*
1124 * Selected ciphersuite hash does not match the hash for the PSK
1125 * session. This is an application bug.
1126 */
1127 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
1128 return EXT_RETURN_FAIL;
1129 }
1130
1131 pskhashsize = EVP_MD_get_size(mdpsk);
1132 }
1133
1134 /* Create the extension, but skip over the binder for now */
1135 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
1136 || !WPACKET_start_sub_packet_u16(pkt)
1137 || !WPACKET_start_sub_packet_u16(pkt)) {
1138 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1139 return EXT_RETURN_FAIL;
1140 }
1141
1142 if (dores) {
1143 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick,
1144 s->session->ext.ticklen)
1145 || !WPACKET_put_bytes_u32(pkt, agems)) {
1146 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1147 return EXT_RETURN_FAIL;
1148 }
1149 }
1150
1151 if (s->psksession != NULL) {
1152 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id,
1153 s->psksession_id_len)
1154 || !WPACKET_put_bytes_u32(pkt, 0)) {
1155 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1156 return EXT_RETURN_FAIL;
1157 }
1158 s->ext.tick_identity++;
1159 }
1160
1161 if (!WPACKET_close(pkt)
1162 || !WPACKET_get_total_written(pkt, &binderoffset)
1163 || !WPACKET_start_sub_packet_u16(pkt)
1164 || (dores
1165 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder))
1166 || (s->psksession != NULL
1167 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder))
1168 || !WPACKET_close(pkt)
1169 || !WPACKET_close(pkt)
1170 || !WPACKET_get_total_written(pkt, &msglen)
1171 /*
1172 * We need to fill in all the sub-packet lengths now so we can
1173 * calculate the HMAC of the message up to the binders
1174 */
1175 || !WPACKET_fill_lengths(pkt)) {
1176 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1177 return EXT_RETURN_FAIL;
1178 }
1179
1180 msgstart = WPACKET_get_curr(pkt) - msglen;
1181
1182 if (dores
1183 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL,
1184 resbinder, s->session, 1, 0) != 1) {
1185 /* SSLfatal() already called */
1186 return EXT_RETURN_FAIL;
1187 }
1188
1189 if (s->psksession != NULL
1190 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL,
1191 pskbinder, s->psksession, 1, 1) != 1) {
1192 /* SSLfatal() already called */
1193 return EXT_RETURN_FAIL;
1194 }
1195
1196 return EXT_RETURN_SENT;
1197 #else
1198 return EXT_RETURN_NOT_SENT;
1199 #endif
1200 }
1201
tls_construct_ctos_post_handshake_auth(SSL_CONNECTION * s,WPACKET * pkt,ossl_unused unsigned int context,ossl_unused X509 * x,ossl_unused size_t chainidx)1202 EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL_CONNECTION *s, WPACKET *pkt,
1203 ossl_unused unsigned int context,
1204 ossl_unused X509 *x,
1205 ossl_unused size_t chainidx)
1206 {
1207 #ifndef OPENSSL_NO_TLS1_3
1208 if (!s->pha_enabled)
1209 return EXT_RETURN_NOT_SENT;
1210
1211 /* construct extension - 0 length, no contents */
1212 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth)
1213 || !WPACKET_start_sub_packet_u16(pkt)
1214 || !WPACKET_close(pkt)) {
1215 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1216 return EXT_RETURN_FAIL;
1217 }
1218
1219 s->post_handshake_auth = SSL_PHA_EXT_SENT;
1220
1221 return EXT_RETURN_SENT;
1222 #else
1223 return EXT_RETURN_NOT_SENT;
1224 #endif
1225 }
1226
1227
1228 /*
1229 * Parse the server's renegotiation binding and abort if it's not right
1230 */
tls_parse_stoc_renegotiate(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1231 int tls_parse_stoc_renegotiate(SSL_CONNECTION *s, PACKET *pkt,
1232 unsigned int context,
1233 X509 *x, size_t chainidx)
1234 {
1235 size_t expected_len = s->s3.previous_client_finished_len
1236 + s->s3.previous_server_finished_len;
1237 size_t ilen;
1238 const unsigned char *data;
1239
1240 /* Check for logic errors */
1241 if (!ossl_assert(expected_len == 0
1242 || s->s3.previous_client_finished_len != 0)
1243 || !ossl_assert(expected_len == 0
1244 || s->s3.previous_server_finished_len != 0)) {
1245 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1246 return 0;
1247 }
1248
1249 /* Parse the length byte */
1250 if (!PACKET_get_1_len(pkt, &ilen)) {
1251 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR);
1252 return 0;
1253 }
1254
1255 /* Consistency check */
1256 if (PACKET_remaining(pkt) != ilen) {
1257 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR);
1258 return 0;
1259 }
1260
1261 /* Check that the extension matches */
1262 if (ilen != expected_len) {
1263 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_RENEGOTIATION_MISMATCH);
1264 return 0;
1265 }
1266
1267 if (!PACKET_get_bytes(pkt, &data, s->s3.previous_client_finished_len)
1268 || memcmp(data, s->s3.previous_client_finished,
1269 s->s3.previous_client_finished_len) != 0) {
1270 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_RENEGOTIATION_MISMATCH);
1271 return 0;
1272 }
1273
1274 if (!PACKET_get_bytes(pkt, &data, s->s3.previous_server_finished_len)
1275 || memcmp(data, s->s3.previous_server_finished,
1276 s->s3.previous_server_finished_len) != 0) {
1277 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_RENEGOTIATION_MISMATCH);
1278 return 0;
1279 }
1280 s->s3.send_connection_binding = 1;
1281
1282 return 1;
1283 }
1284
1285 /* Parse the server's max fragment len extension packet */
tls_parse_stoc_maxfragmentlen(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1286 int tls_parse_stoc_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt,
1287 unsigned int context,
1288 X509 *x, size_t chainidx)
1289 {
1290 unsigned int value;
1291
1292 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) {
1293 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1294 return 0;
1295 }
1296
1297 /* |value| should contains a valid max-fragment-length code. */
1298 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) {
1299 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1300 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
1301 return 0;
1302 }
1303
1304 /* Must be the same value as client-configured one who was sent to server */
1305 /*-
1306 * RFC 6066: if a client receives a maximum fragment length negotiation
1307 * response that differs from the length it requested, ...
1308 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert
1309 */
1310 if (value != s->ext.max_fragment_len_mode) {
1311 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1312 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
1313 return 0;
1314 }
1315
1316 /*
1317 * Maximum Fragment Length Negotiation succeeded.
1318 * The negotiated Maximum Fragment Length is binding now.
1319 */
1320 s->session->ext.max_fragment_len_mode = value;
1321
1322 return 1;
1323 }
1324
tls_parse_stoc_server_name(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1325 int tls_parse_stoc_server_name(SSL_CONNECTION *s, PACKET *pkt,
1326 unsigned int context,
1327 X509 *x, size_t chainidx)
1328 {
1329 if (s->ext.hostname == NULL) {
1330 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1331 return 0;
1332 }
1333
1334 if (PACKET_remaining(pkt) > 0) {
1335 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1336 return 0;
1337 }
1338
1339 if (!s->hit) {
1340 if (s->session->ext.hostname != NULL) {
1341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1342 return 0;
1343 }
1344 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname);
1345 if (s->session->ext.hostname == NULL) {
1346 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1347 return 0;
1348 }
1349 }
1350
1351 return 1;
1352 }
1353
tls_parse_stoc_ec_pt_formats(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1354 int tls_parse_stoc_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,
1355 unsigned int context,
1356 X509 *x, size_t chainidx)
1357 {
1358 size_t ecpointformats_len;
1359 PACKET ecptformatlist;
1360
1361 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) {
1362 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1363 return 0;
1364 }
1365 if (!s->hit) {
1366 ecpointformats_len = PACKET_remaining(&ecptformatlist);
1367 if (ecpointformats_len == 0) {
1368 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
1369 return 0;
1370 }
1371
1372 s->ext.peer_ecpointformats_len = 0;
1373 OPENSSL_free(s->ext.peer_ecpointformats);
1374 s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len);
1375 if (s->ext.peer_ecpointformats == NULL) {
1376 s->ext.peer_ecpointformats_len = 0;
1377 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1378 return 0;
1379 }
1380
1381 s->ext.peer_ecpointformats_len = ecpointformats_len;
1382
1383 if (!PACKET_copy_bytes(&ecptformatlist,
1384 s->ext.peer_ecpointformats,
1385 ecpointformats_len)) {
1386 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1387 return 0;
1388 }
1389 }
1390
1391 return 1;
1392 }
1393
tls_parse_stoc_session_ticket(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1394 int tls_parse_stoc_session_ticket(SSL_CONNECTION *s, PACKET *pkt,
1395 unsigned int context,
1396 X509 *x, size_t chainidx)
1397 {
1398 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1399
1400 if (s->ext.session_ticket_cb != NULL &&
1401 !s->ext.session_ticket_cb(ssl, PACKET_data(pkt),
1402 PACKET_remaining(pkt),
1403 s->ext.session_ticket_cb_arg)) {
1404 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_EXTENSION);
1405 return 0;
1406 }
1407
1408 if (!tls_use_ticket(s)) {
1409 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
1410 return 0;
1411 }
1412 if (PACKET_remaining(pkt) > 0) {
1413 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1414 return 0;
1415 }
1416
1417 s->ext.ticket_expected = 1;
1418
1419 return 1;
1420 }
1421
1422 #ifndef OPENSSL_NO_OCSP
tls_parse_stoc_status_request(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1423 int tls_parse_stoc_status_request(SSL_CONNECTION *s, PACKET *pkt,
1424 unsigned int context,
1425 X509 *x, size_t chainidx)
1426 {
1427 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) {
1428 /* We ignore this if the server sends a CertificateRequest */
1429 return 1;
1430 }
1431
1432 /*
1433 * MUST only be sent if we've requested a status
1434 * request message. In TLS <= 1.2 it must also be empty.
1435 */
1436 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
1437 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
1438 return 0;
1439 }
1440 if (!SSL_CONNECTION_IS_TLS13(s) && PACKET_remaining(pkt) > 0) {
1441 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1442 return 0;
1443 }
1444
1445 if (SSL_CONNECTION_IS_TLS13(s)) {
1446 /* We only know how to handle this if it's for the first Certificate in
1447 * the chain. We ignore any other responses.
1448 */
1449 if (chainidx != 0)
1450 return 1;
1451
1452 /* SSLfatal() already called */
1453 return tls_process_cert_status_body(s, pkt);
1454 }
1455
1456 /* Set flag to expect CertificateStatus message */
1457 s->ext.status_expected = 1;
1458
1459 return 1;
1460 }
1461 #endif
1462
1463
1464 #ifndef OPENSSL_NO_CT
tls_parse_stoc_sct(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1465 int tls_parse_stoc_sct(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1466 X509 *x, size_t chainidx)
1467 {
1468 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) {
1469 /* We ignore this if the server sends it in a CertificateRequest */
1470 return 1;
1471 }
1472
1473 /*
1474 * Only take it if we asked for it - i.e if there is no CT validation
1475 * callback set, then a custom extension MAY be processing it, so we
1476 * need to let control continue to flow to that.
1477 */
1478 if (s->ct_validation_callback != NULL) {
1479 size_t size = PACKET_remaining(pkt);
1480
1481 /* Simply copy it off for later processing */
1482 OPENSSL_free(s->ext.scts);
1483 s->ext.scts = NULL;
1484
1485 s->ext.scts_len = (uint16_t)size;
1486 if (size > 0) {
1487 s->ext.scts = OPENSSL_malloc(size);
1488 if (s->ext.scts == NULL) {
1489 s->ext.scts_len = 0;
1490 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
1491 return 0;
1492 }
1493 if (!PACKET_copy_bytes(pkt, s->ext.scts, size)) {
1494 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1495 return 0;
1496 }
1497 }
1498 } else {
1499 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0
1500 ? ENDPOINT_CLIENT : ENDPOINT_BOTH;
1501
1502 /*
1503 * If we didn't ask for it then there must be a custom extension,
1504 * otherwise this is unsolicited.
1505 */
1506 if (custom_ext_find(&s->cert->custext, role,
1507 TLSEXT_TYPE_signed_certificate_timestamp,
1508 NULL) == NULL) {
1509 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
1510 return 0;
1511 }
1512
1513 if (!custom_ext_parse(s, context,
1514 TLSEXT_TYPE_signed_certificate_timestamp,
1515 PACKET_data(pkt), PACKET_remaining(pkt),
1516 x, chainidx)) {
1517 /* SSLfatal already called */
1518 return 0;
1519 }
1520 }
1521
1522 return 1;
1523 }
1524 #endif
1525
1526
1527 #ifndef OPENSSL_NO_NEXTPROTONEG
1528 /*
1529 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1530 * elements of zero length are allowed and the set of elements must exactly
1531 * fill the length of the block. Returns 1 on success or 0 on failure.
1532 */
ssl_next_proto_validate(SSL_CONNECTION * s,PACKET * pkt)1533 static int ssl_next_proto_validate(SSL_CONNECTION *s, PACKET *pkt)
1534 {
1535 PACKET tmp_protocol;
1536
1537 while (PACKET_remaining(pkt)) {
1538 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol)
1539 || PACKET_remaining(&tmp_protocol) == 0) {
1540 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1541 return 0;
1542 }
1543 }
1544
1545 return 1;
1546 }
1547
tls_parse_stoc_npn(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1548 int tls_parse_stoc_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1549 X509 *x, size_t chainidx)
1550 {
1551 unsigned char *selected;
1552 unsigned char selected_len;
1553 PACKET tmppkt;
1554 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1555
1556 /* Check if we are in a renegotiation. If so ignore this extension */
1557 if (!SSL_IS_FIRST_HANDSHAKE(s))
1558 return 1;
1559
1560 /* We must have requested it. */
1561 if (sctx->ext.npn_select_cb == NULL) {
1562 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
1563 return 0;
1564 }
1565
1566 /* The data must be valid */
1567 tmppkt = *pkt;
1568 if (!ssl_next_proto_validate(s, &tmppkt)) {
1569 /* SSLfatal() already called */
1570 return 0;
1571 }
1572 if (sctx->ext.npn_select_cb(SSL_CONNECTION_GET_SSL(s),
1573 &selected, &selected_len,
1574 PACKET_data(pkt), PACKET_remaining(pkt),
1575 sctx->ext.npn_select_cb_arg) !=
1576 SSL_TLSEXT_ERR_OK) {
1577 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_EXTENSION);
1578 return 0;
1579 }
1580
1581 /*
1582 * Could be non-NULL if server has sent multiple NPN extensions in
1583 * a single Serverhello
1584 */
1585 OPENSSL_free(s->ext.npn);
1586 s->ext.npn = OPENSSL_malloc(selected_len);
1587 if (s->ext.npn == NULL) {
1588 s->ext.npn_len = 0;
1589 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1590 return 0;
1591 }
1592
1593 memcpy(s->ext.npn, selected, selected_len);
1594 s->ext.npn_len = selected_len;
1595 s->s3.npn_seen = 1;
1596
1597 return 1;
1598 }
1599 #endif
1600
tls_parse_stoc_alpn(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1601 int tls_parse_stoc_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1602 X509 *x, size_t chainidx)
1603 {
1604 size_t len;
1605
1606 /* We must have requested it. */
1607 if (!s->s3.alpn_sent) {
1608 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
1609 return 0;
1610 }
1611 /*-
1612 * The extension data consists of:
1613 * uint16 list_length
1614 * uint8 proto_length;
1615 * uint8 proto[proto_length];
1616 */
1617 if (!PACKET_get_net_2_len(pkt, &len)
1618 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len)
1619 || PACKET_remaining(pkt) != len) {
1620 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1621 return 0;
1622 }
1623 OPENSSL_free(s->s3.alpn_selected);
1624 s->s3.alpn_selected = OPENSSL_malloc(len);
1625 if (s->s3.alpn_selected == NULL) {
1626 s->s3.alpn_selected_len = 0;
1627 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1628 return 0;
1629 }
1630 if (!PACKET_copy_bytes(pkt, s->s3.alpn_selected, len)) {
1631 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1632 return 0;
1633 }
1634 s->s3.alpn_selected_len = len;
1635
1636 if (s->session->ext.alpn_selected == NULL
1637 || s->session->ext.alpn_selected_len != len
1638 || memcmp(s->session->ext.alpn_selected, s->s3.alpn_selected, len)
1639 != 0) {
1640 /* ALPN not consistent with the old session so cannot use early_data */
1641 s->ext.early_data_ok = 0;
1642 }
1643 if (!s->hit) {
1644 /*
1645 * This is a new session and so alpn_selected should have been
1646 * initialised to NULL. We should update it with the selected ALPN.
1647 */
1648 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) {
1649 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1650 return 0;
1651 }
1652 s->session->ext.alpn_selected =
1653 OPENSSL_memdup(s->s3.alpn_selected, s->s3.alpn_selected_len);
1654 if (s->session->ext.alpn_selected == NULL) {
1655 s->session->ext.alpn_selected_len = 0;
1656 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1657 return 0;
1658 }
1659 s->session->ext.alpn_selected_len = s->s3.alpn_selected_len;
1660 }
1661
1662 return 1;
1663 }
1664
1665 #ifndef OPENSSL_NO_SRTP
tls_parse_stoc_use_srtp(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1666 int tls_parse_stoc_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
1667 unsigned int context, X509 *x, size_t chainidx)
1668 {
1669 unsigned int id, ct, mki;
1670 int i;
1671 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
1672 SRTP_PROTECTION_PROFILE *prof;
1673
1674 if (!PACKET_get_net_2(pkt, &ct) || ct != 2
1675 || !PACKET_get_net_2(pkt, &id)
1676 || !PACKET_get_1(pkt, &mki)
1677 || PACKET_remaining(pkt) != 0) {
1678 SSLfatal(s, SSL_AD_DECODE_ERROR,
1679 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
1680 return 0;
1681 }
1682
1683 if (mki != 0) {
1684 /* Must be no MKI, since we never offer one */
1685 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_SRTP_MKI_VALUE);
1686 return 0;
1687 }
1688
1689 /* Throw an error if the server gave us an unsolicited extension */
1690 clnt = SSL_get_srtp_profiles(SSL_CONNECTION_GET_SSL(s));
1691 if (clnt == NULL) {
1692 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_NO_SRTP_PROFILES);
1693 return 0;
1694 }
1695
1696 /*
1697 * Check to see if the server gave us something we support (and
1698 * presumably offered)
1699 */
1700 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
1701 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
1702
1703 if (prof->id == id) {
1704 s->srtp_profile = prof;
1705 return 1;
1706 }
1707 }
1708
1709 SSLfatal(s, SSL_AD_DECODE_ERROR,
1710 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
1711 return 0;
1712 }
1713 #endif
1714
tls_parse_stoc_etm(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1715 int tls_parse_stoc_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1716 X509 *x, size_t chainidx)
1717 {
1718 /* Ignore if inappropriate ciphersuite */
1719 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
1720 && s->s3.tmp.new_cipher->algorithm_mac != SSL_AEAD
1721 && s->s3.tmp.new_cipher->algorithm_enc != SSL_RC4
1722 && s->s3.tmp.new_cipher->algorithm_enc != SSL_eGOST2814789CNT
1723 && s->s3.tmp.new_cipher->algorithm_enc != SSL_eGOST2814789CNT12
1724 && s->s3.tmp.new_cipher->algorithm_enc != SSL_MAGMA
1725 && s->s3.tmp.new_cipher->algorithm_enc != SSL_KUZNYECHIK)
1726 s->ext.use_etm = 1;
1727
1728 return 1;
1729 }
1730
tls_parse_stoc_ems(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1731 int tls_parse_stoc_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1732 X509 *x, size_t chainidx)
1733 {
1734 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET)
1735 return 1;
1736 s->s3.flags |= TLS1_FLAGS_RECEIVED_EXTMS;
1737 if (!s->hit)
1738 s->session->flags |= SSL_SESS_FLAG_EXTMS;
1739
1740 return 1;
1741 }
1742
tls_parse_stoc_supported_versions(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1743 int tls_parse_stoc_supported_versions(SSL_CONNECTION *s, PACKET *pkt,
1744 unsigned int context,
1745 X509 *x, size_t chainidx)
1746 {
1747 unsigned int version;
1748
1749 if (!PACKET_get_net_2(pkt, &version)
1750 || PACKET_remaining(pkt) != 0) {
1751 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1752 return 0;
1753 }
1754
1755 /*
1756 * The only protocol version we support which is valid in this extension in
1757 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else.
1758 */
1759 if (version != TLS1_3_VERSION) {
1760 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1761 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
1762 return 0;
1763 }
1764
1765 /* We ignore this extension for HRRs except to sanity check it */
1766 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST)
1767 return 1;
1768
1769 /* We just set it here. We validate it in ssl_choose_client_version */
1770 s->version = version;
1771 s->rlayer.rrlmethod->set_protocol_version(s->rlayer.rrl, version);
1772
1773 return 1;
1774 }
1775
tls_parse_stoc_key_share(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1776 int tls_parse_stoc_key_share(SSL_CONNECTION *s, PACKET *pkt,
1777 unsigned int context, X509 *x,
1778 size_t chainidx)
1779 {
1780 #ifndef OPENSSL_NO_TLS1_3
1781 unsigned int group_id;
1782 PACKET encoded_pt;
1783 EVP_PKEY *ckey = s->s3.tmp.pkey, *skey = NULL;
1784 const TLS_GROUP_INFO *ginf = NULL;
1785
1786 /* Sanity check */
1787 if (ckey == NULL || s->s3.peer_tmp != NULL) {
1788 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1789 return 0;
1790 }
1791
1792 if (!PACKET_get_net_2(pkt, &group_id)) {
1793 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1794 return 0;
1795 }
1796
1797 group_id = ssl_group_id_tls13_to_internal(group_id);
1798 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) {
1799 const uint16_t *pgroups = NULL;
1800 size_t i, num_groups;
1801
1802 if (PACKET_remaining(pkt) != 0) {
1803 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1804 return 0;
1805 }
1806
1807 /*
1808 * It is an error if the HelloRetryRequest wants a key_share that we
1809 * already sent in the first ClientHello
1810 */
1811 if (group_id == s->s3.group_id) {
1812 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
1813 return 0;
1814 }
1815
1816 /* Validate the selected group is one we support */
1817 tls1_get_supported_groups(s, &pgroups, &num_groups);
1818 for (i = 0; i < num_groups; i++) {
1819 if (group_id == pgroups[i])
1820 break;
1821 }
1822 if (i >= num_groups
1823 || !tls_group_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) {
1824 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
1825 return 0;
1826 }
1827
1828 s->s3.group_id = group_id;
1829 EVP_PKEY_free(s->s3.tmp.pkey);
1830 s->s3.tmp.pkey = NULL;
1831 return 1;
1832 }
1833
1834 if (group_id != s->s3.group_id) {
1835 /*
1836 * This isn't for the group that we sent in the original
1837 * key_share!
1838 */
1839 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
1840 return 0;
1841 }
1842 /* Retain this group in the SSL_SESSION */
1843 if (!s->hit) {
1844 s->session->kex_group = group_id;
1845 } else if (group_id != s->session->kex_group) {
1846 /*
1847 * If this is a resumption but changed what group was used, we need
1848 * to record the new group in the session, but the session is not
1849 * a new session and could be in use by other threads. So, make
1850 * a copy of the session to record the new information so that it's
1851 * useful for any sessions resumed from tickets issued on this
1852 * connection.
1853 */
1854 SSL_SESSION *new_sess;
1855
1856 if ((new_sess = ssl_session_dup(s->session, 0)) == NULL) {
1857 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
1858 return 0;
1859 }
1860 SSL_SESSION_free(s->session);
1861 s->session = new_sess;
1862 s->session->kex_group = group_id;
1863 }
1864
1865 if ((ginf = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
1866 group_id)) == NULL) {
1867 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
1868 return 0;
1869 }
1870
1871 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt)
1872 || PACKET_remaining(&encoded_pt) == 0) {
1873 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1874 return 0;
1875 }
1876
1877 if (!ginf->is_kem) {
1878 /* Regular KEX */
1879 skey = EVP_PKEY_new();
1880 if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) {
1881 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_COPY_PARAMETERS_FAILED);
1882 EVP_PKEY_free(skey);
1883 return 0;
1884 }
1885
1886 if (tls13_set_encoded_pub_key(skey, PACKET_data(&encoded_pt),
1887 PACKET_remaining(&encoded_pt)) <= 0) {
1888 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
1889 EVP_PKEY_free(skey);
1890 return 0;
1891 }
1892
1893 if (ssl_derive(s, ckey, skey, 1) == 0) {
1894 /* SSLfatal() already called */
1895 EVP_PKEY_free(skey);
1896 return 0;
1897 }
1898 s->s3.peer_tmp = skey;
1899 } else {
1900 /* KEM Mode */
1901 const unsigned char *ct = PACKET_data(&encoded_pt);
1902 size_t ctlen = PACKET_remaining(&encoded_pt);
1903
1904 if (ssl_decapsulate(s, ckey, ct, ctlen, 1) == 0) {
1905 /* SSLfatal() already called */
1906 return 0;
1907 }
1908 }
1909 s->s3.did_kex = 1;
1910 #endif
1911
1912 return 1;
1913 }
1914
tls_parse_stoc_cookie(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1915 int tls_parse_stoc_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1916 X509 *x, size_t chainidx)
1917 {
1918 PACKET cookie;
1919
1920 if (!PACKET_as_length_prefixed_2(pkt, &cookie)
1921 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie,
1922 &s->ext.tls13_cookie_len)) {
1923 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1924 return 0;
1925 }
1926
1927 return 1;
1928 }
1929
tls_parse_stoc_early_data(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1930 int tls_parse_stoc_early_data(SSL_CONNECTION *s, PACKET *pkt,
1931 unsigned int context,
1932 X509 *x, size_t chainidx)
1933 {
1934 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
1935 unsigned long max_early_data;
1936
1937 if (!PACKET_get_net_4(pkt, &max_early_data)
1938 || PACKET_remaining(pkt) != 0) {
1939 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_INVALID_MAX_EARLY_DATA);
1940 return 0;
1941 }
1942
1943 s->session->ext.max_early_data = max_early_data;
1944
1945 return 1;
1946 }
1947
1948 if (PACKET_remaining(pkt) != 0) {
1949 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1950 return 0;
1951 }
1952
1953 if (!s->ext.early_data_ok
1954 || !s->hit) {
1955 /*
1956 * If we get here then we didn't send early data, or we didn't resume
1957 * using the first identity, or the SNI/ALPN is not consistent so the
1958 * server should not be accepting it.
1959 */
1960 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
1961 return 0;
1962 }
1963
1964 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
1965
1966 return 1;
1967 }
1968
tls_parse_stoc_psk(SSL_CONNECTION * s,PACKET * pkt,unsigned int context,X509 * x,size_t chainidx)1969 int tls_parse_stoc_psk(SSL_CONNECTION *s, PACKET *pkt,
1970 unsigned int context, X509 *x,
1971 size_t chainidx)
1972 {
1973 #ifndef OPENSSL_NO_TLS1_3
1974 unsigned int identity;
1975
1976 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) {
1977 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1978 return 0;
1979 }
1980
1981 if (identity >= (unsigned int)s->ext.tick_identity) {
1982 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_PSK_IDENTITY);
1983 return 0;
1984 }
1985
1986 /*
1987 * Session resumption tickets are always sent before PSK tickets. If the
1988 * ticket index is 0 then it must be for a session resumption ticket if we
1989 * sent two tickets, or if we didn't send a PSK ticket.
1990 */
1991 if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) {
1992 s->hit = 1;
1993 SSL_SESSION_free(s->psksession);
1994 s->psksession = NULL;
1995 return 1;
1996 }
1997
1998 if (s->psksession == NULL) {
1999 /* Should never happen */
2000 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2001 return 0;
2002 }
2003
2004 /*
2005 * If we used the external PSK for sending early_data then s->early_secret
2006 * is already set up, so don't overwrite it. Otherwise we copy the
2007 * early_secret across that we generated earlier.
2008 */
2009 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY
2010 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING)
2011 || s->session->ext.max_early_data > 0
2012 || s->psksession->ext.max_early_data == 0)
2013 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE);
2014
2015 SSL_SESSION_free(s->session);
2016 s->session = s->psksession;
2017 s->psksession = NULL;
2018 s->hit = 1;
2019 /* Early data is only allowed if we used the first ticket */
2020 if (identity != 0)
2021 s->ext.early_data_ok = 0;
2022 #endif
2023
2024 return 1;
2025 }
2026
