]>
Commit | Line | Data |
---|---|---|
6b473aca | 1 | /* |
b186a592 | 2 | * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved. |
6b473aca MC |
3 | * |
4 | * Licensed under the OpenSSL license (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
f6370040 | 10 | #include <string.h> |
6b473aca MC |
11 | #include "../ssl_locl.h" |
12 | #include "statem_locl.h" | |
13 | ||
1266eefd | 14 | static int final_renegotiate(SSL *s, unsigned int context, int sent, |
805a2e9e | 15 | int *al); |
1266eefd MC |
16 | static int init_server_name(SSL *s, unsigned int context); |
17 | static int final_server_name(SSL *s, unsigned int context, int sent, | |
805a2e9e | 18 | int *al); |
332eb390 | 19 | #ifndef OPENSSL_NO_EC |
1266eefd | 20 | static int final_ec_pt_formats(SSL *s, unsigned int context, int sent, |
332eb390 MC |
21 | int *al); |
22 | #endif | |
1266eefd | 23 | static int init_session_ticket(SSL *s, unsigned int context); |
8f8c11d8 | 24 | #ifndef OPENSSL_NO_OCSP |
1266eefd | 25 | static int init_status_request(SSL *s, unsigned int context); |
8f8c11d8 | 26 | #endif |
805a2e9e | 27 | #ifndef OPENSSL_NO_NEXTPROTONEG |
1266eefd | 28 | static int init_npn(SSL *s, unsigned int context); |
805a2e9e | 29 | #endif |
1266eefd MC |
30 | static int init_alpn(SSL *s, unsigned int context); |
31 | static int final_alpn(SSL *s, unsigned int context, int sent, int *al); | |
32 | static int init_sig_algs(SSL *s, unsigned int context); | |
45615c5f | 33 | static int init_certificate_authorities(SSL *s, unsigned int context); |
b186a592 MC |
34 | static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt, |
35 | unsigned int context, | |
36 | X509 *x, | |
37 | size_t chainidx, | |
38 | int *al); | |
45615c5f DSH |
39 | static int tls_parse_certificate_authorities(SSL *s, PACKET *pkt, |
40 | unsigned int context, X509 *x, | |
41 | size_t chainidx, int *al); | |
805a2e9e | 42 | #ifndef OPENSSL_NO_SRP |
1266eefd | 43 | static int init_srp(SSL *s, unsigned int context); |
805a2e9e | 44 | #endif |
1266eefd MC |
45 | static int init_etm(SSL *s, unsigned int context); |
46 | static int init_ems(SSL *s, unsigned int context); | |
47 | static int final_ems(SSL *s, unsigned int context, int sent, int *al); | |
b2f7e8c0 | 48 | static int init_psk_kex_modes(SSL *s, unsigned int context); |
deb2d5e7 | 49 | #ifndef OPENSSL_NO_EC |
f4bbb37c | 50 | static int final_key_share(SSL *s, unsigned int context, int sent, int *al); |
deb2d5e7 | 51 | #endif |
805a2e9e | 52 | #ifndef OPENSSL_NO_SRTP |
1266eefd | 53 | static int init_srtp(SSL *s, unsigned int context); |
805a2e9e | 54 | #endif |
04904312 | 55 | static int final_sig_algs(SSL *s, unsigned int context, int sent, int *al); |
38df5a45 | 56 | static int final_early_data(SSL *s, unsigned int context, int sent, int *al); |
805a2e9e | 57 | |
70af3d8e | 58 | /* Structure to define a built-in extension */ |
1266eefd MC |
59 | typedef struct extensions_definition_st { |
60 | /* The defined type for the extension */ | |
6b473aca | 61 | unsigned int type; |
1266eefd MC |
62 | /* |
63 | * The context that this extension applies to, e.g. what messages and | |
64 | * protocol versions | |
65 | */ | |
66 | unsigned int context; | |
68db4dda | 67 | /* |
805a2e9e MC |
68 | * Initialise extension before parsing. Always called for relevant contexts |
69 | * even if extension not present | |
68db4dda | 70 | */ |
1266eefd MC |
71 | int (*init)(SSL *s, unsigned int context); |
72 | /* Parse extension sent from client to server */ | |
61138358 MC |
73 | int (*parse_ctos)(SSL *s, PACKET *pkt, unsigned int context, X509 *x, |
74 | size_t chainidx, int *al); | |
1266eefd | 75 | /* Parse extension send from server to client */ |
61138358 MC |
76 | int (*parse_stoc)(SSL *s, PACKET *pkt, unsigned int context, X509 *x, |
77 | size_t chainidx, int *al); | |
1266eefd | 78 | /* Construct extension sent from server to client */ |
b186a592 MC |
79 | EXT_RETURN (*construct_stoc)(SSL *s, WPACKET *pkt, unsigned int context, |
80 | X509 *x, size_t chainidx, int *al); | |
1266eefd | 81 | /* Construct extension sent from client to server */ |
b186a592 MC |
82 | EXT_RETURN (*construct_ctos)(SSL *s, WPACKET *pkt, unsigned int context, |
83 | X509 *x, size_t chainidx, int *al); | |
68db4dda | 84 | /* |
805a2e9e MC |
85 | * Finalise extension after parsing. Always called where an extensions was |
86 | * initialised even if the extension was not present. |sent| is set to 1 if | |
87 | * the extension was seen, or 0 otherwise. | |
68db4dda | 88 | */ |
1266eefd | 89 | int (*final)(SSL *s, unsigned int context, int sent, int *al); |
6b473aca MC |
90 | } EXTENSION_DEFINITION; |
91 | ||
4b299b8e | 92 | /* |
70af3d8e | 93 | * Definitions of all built-in extensions. NOTE: Changes in the number or order |
bd91e3c8 | 94 | * of these extensions should be mirrored with equivalent changes to the |
3e6c1da8 | 95 | * indexes ( TLSEXT_IDX_* ) defined in ssl_locl.h. |
70af3d8e MC |
96 | * Each extension has an initialiser, a client and |
97 | * server side parser and a finaliser. The initialiser is called (if the | |
98 | * extension is relevant to the given context) even if we did not see the | |
99 | * extension in the message that we received. The parser functions are only | |
100 | * called if we see the extension in the message. The finalisers are always | |
101 | * called if the initialiser was called. | |
102 | * There are also server and client side constructor functions which are always | |
103 | * called during message construction if the extension is relevant for the | |
104 | * given context. | |
105 | * The initialisation, parsing, finalisation and construction functions are | |
106 | * always called in the order defined in this list. Some extensions may depend | |
107 | * on others having been processed first, so the order of this list is | |
108 | * significant. | |
109 | * The extension context is defined by a series of flags which specify which | |
110 | * messages the extension is relevant to. These flags also specify whether the | |
3e6c1da8 | 111 | * extension is relevant to a particular protocol or protocol version. |
a1448c26 | 112 | * |
70af3d8e | 113 | * TODO(TLS1.3): Make sure we have a test to check the consistency of these |
4b299b8e | 114 | */ |
0785274c | 115 | #define INVALID_EXTENSION { 0x10000, 0, NULL, NULL, NULL, NULL, NULL, NULL } |
6b473aca MC |
116 | static const EXTENSION_DEFINITION ext_defs[] = { |
117 | { | |
118 | TLSEXT_TYPE_renegotiate, | |
fe874d27 MC |
119 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
120 | | SSL_EXT_SSL3_ALLOWED | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
121 | NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate, |
122 | tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate, | |
123 | final_renegotiate | |
6b473aca MC |
124 | }, |
125 | { | |
126 | TLSEXT_TYPE_server_name, | |
fe874d27 MC |
127 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
128 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, | |
1266eefd MC |
129 | init_server_name, |
130 | tls_parse_ctos_server_name, tls_parse_stoc_server_name, | |
131 | tls_construct_stoc_server_name, tls_construct_ctos_server_name, | |
132 | final_server_name | |
6b473aca MC |
133 | }, |
134 | #ifndef OPENSSL_NO_SRP | |
135 | { | |
136 | TLSEXT_TYPE_srp, | |
fe874d27 | 137 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, |
1266eefd | 138 | init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL |
6b473aca | 139 | }, |
0785274c MC |
140 | #else |
141 | INVALID_EXTENSION, | |
6b473aca MC |
142 | #endif |
143 | #ifndef OPENSSL_NO_EC | |
144 | { | |
145 | TLSEXT_TYPE_ec_point_formats, | |
fe874d27 MC |
146 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
147 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
148 | NULL, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats, |
149 | tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats, | |
150 | final_ec_pt_formats | |
6b473aca MC |
151 | }, |
152 | { | |
153 | TLSEXT_TYPE_supported_groups, | |
fe874d27 | 154 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, |
1266eefd | 155 | NULL, tls_parse_ctos_supported_groups, NULL, |
6af87546 | 156 | tls_construct_stoc_supported_groups, |
1266eefd | 157 | tls_construct_ctos_supported_groups, NULL |
6b473aca | 158 | }, |
0785274c MC |
159 | #else |
160 | INVALID_EXTENSION, | |
161 | INVALID_EXTENSION, | |
6b473aca MC |
162 | #endif |
163 | { | |
164 | TLSEXT_TYPE_session_ticket, | |
fe874d27 MC |
165 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
166 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
167 | init_session_ticket, tls_parse_ctos_session_ticket, |
168 | tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket, | |
169 | tls_construct_ctos_session_ticket, NULL | |
6b473aca MC |
170 | }, |
171 | { | |
172 | TLSEXT_TYPE_signature_algorithms, | |
fe874d27 | 173 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, |
51c7d3e8 DSH |
174 | init_sig_algs, tls_parse_ctos_sig_algs, |
175 | tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs, | |
04904312 | 176 | tls_construct_ctos_sig_algs, final_sig_algs |
6b473aca | 177 | }, |
ab83e314 | 178 | #ifndef OPENSSL_NO_OCSP |
6b473aca MC |
179 | { |
180 | TLSEXT_TYPE_status_request, | |
fe874d27 MC |
181 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
182 | | SSL_EXT_TLS1_3_CERTIFICATE, | |
1266eefd MC |
183 | init_status_request, tls_parse_ctos_status_request, |
184 | tls_parse_stoc_status_request, tls_construct_stoc_status_request, | |
f63e4288 | 185 | tls_construct_ctos_status_request, NULL |
6b473aca | 186 | }, |
0785274c MC |
187 | #else |
188 | INVALID_EXTENSION, | |
ab83e314 | 189 | #endif |
6b473aca MC |
190 | #ifndef OPENSSL_NO_NEXTPROTONEG |
191 | { | |
192 | TLSEXT_TYPE_next_proto_neg, | |
fe874d27 MC |
193 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
194 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
195 | init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn, |
196 | tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL | |
6b473aca | 197 | }, |
0785274c MC |
198 | #else |
199 | INVALID_EXTENSION, | |
6b473aca MC |
200 | #endif |
201 | { | |
02f0274e MC |
202 | /* |
203 | * Must appear in this list after server_name so that finalisation | |
204 | * happens after server_name callbacks | |
205 | */ | |
6b473aca | 206 | TLSEXT_TYPE_application_layer_protocol_negotiation, |
fe874d27 MC |
207 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
208 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, | |
1266eefd MC |
209 | init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn, |
210 | tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn | |
6b473aca | 211 | }, |
7da160b0 | 212 | #ifndef OPENSSL_NO_SRTP |
6b473aca MC |
213 | { |
214 | TLSEXT_TYPE_use_srtp, | |
fe874d27 MC |
215 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
216 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_DTLS_ONLY, | |
1266eefd MC |
217 | init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp, |
218 | tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL | |
6b473aca | 219 | }, |
0785274c MC |
220 | #else |
221 | INVALID_EXTENSION, | |
7da160b0 | 222 | #endif |
6b473aca MC |
223 | { |
224 | TLSEXT_TYPE_encrypt_then_mac, | |
fe874d27 MC |
225 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
226 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
227 | init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm, |
228 | tls_construct_stoc_etm, tls_construct_ctos_etm, NULL | |
6b473aca | 229 | }, |
6dd083fd | 230 | #ifndef OPENSSL_NO_CT |
6b473aca MC |
231 | { |
232 | TLSEXT_TYPE_signed_certificate_timestamp, | |
fe874d27 MC |
233 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
234 | | SSL_EXT_TLS1_3_CERTIFICATE, | |
68db4dda | 235 | NULL, |
6b473aca MC |
236 | /* |
237 | * No server side support for this, but can be provided by a custom | |
238 | * extension. This is an exception to the rule that custom extensions | |
239 | * cannot override built in ones. | |
240 | */ | |
1266eefd | 241 | NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct, NULL |
6b473aca | 242 | }, |
0785274c MC |
243 | #else |
244 | INVALID_EXTENSION, | |
6dd083fd | 245 | #endif |
6b473aca MC |
246 | { |
247 | TLSEXT_TYPE_extended_master_secret, | |
fe874d27 MC |
248 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
249 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
250 | init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems, |
251 | tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems | |
6b473aca MC |
252 | }, |
253 | { | |
254 | TLSEXT_TYPE_supported_versions, | |
fe874d27 MC |
255 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY |
256 | | SSL_EXT_TLS1_3_ONLY, | |
68db4dda | 257 | NULL, |
6b473aca | 258 | /* Processed inline as part of version selection */ |
1266eefd | 259 | NULL, NULL, NULL, tls_construct_ctos_supported_versions, NULL |
6b473aca | 260 | }, |
b2f7e8c0 | 261 | { |
b2f7e8c0 | 262 | TLSEXT_TYPE_psk_kex_modes, |
fe874d27 MC |
263 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY |
264 | | SSL_EXT_TLS1_3_ONLY, | |
b2f7e8c0 MC |
265 | init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL, |
266 | tls_construct_ctos_psk_kex_modes, NULL | |
267 | }, | |
deb2d5e7 | 268 | #ifndef OPENSSL_NO_EC |
6b473aca | 269 | { |
70af3d8e MC |
270 | /* |
271 | * Must be in this list after supported_groups. We need that to have | |
272 | * been parsed before we do this one. | |
273 | */ | |
6b473aca | 274 | TLSEXT_TYPE_key_share, |
fe874d27 MC |
275 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO |
276 | | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY | |
277 | | SSL_EXT_TLS1_3_ONLY, | |
1266eefd | 278 | NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share, |
f4bbb37c MC |
279 | tls_construct_stoc_key_share, tls_construct_ctos_key_share, |
280 | final_key_share | |
7da160b0 | 281 | }, |
deb2d5e7 | 282 | #endif |
cfef5027 MC |
283 | { |
284 | TLSEXT_TYPE_cookie, | |
fe874d27 MC |
285 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST |
286 | | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, | |
cfef5027 MC |
287 | NULL, NULL, tls_parse_stoc_cookie, NULL, tls_construct_ctos_cookie, |
288 | NULL | |
289 | }, | |
7da160b0 MC |
290 | { |
291 | /* | |
292 | * Special unsolicited ServerHello extension only used when | |
293 | * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set | |
294 | */ | |
295 | TLSEXT_TYPE_cryptopro_bug, | |
fe874d27 | 296 | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, |
1266eefd | 297 | NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL |
ab83e314 | 298 | }, |
38df5a45 MC |
299 | { |
300 | TLSEXT_TYPE_early_data, | |
fe874d27 MC |
301 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS |
302 | | SSL_EXT_TLS1_3_NEW_SESSION_TICKET, | |
38df5a45 MC |
303 | NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data, |
304 | tls_construct_stoc_early_data, tls_construct_ctos_early_data, | |
305 | final_early_data | |
306 | }, | |
45615c5f DSH |
307 | { |
308 | TLSEXT_TYPE_certificate_authorities, | |
fe874d27 MC |
309 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST |
310 | | SSL_EXT_TLS1_3_ONLY, | |
45615c5f DSH |
311 | init_certificate_authorities, |
312 | tls_parse_certificate_authorities, tls_parse_certificate_authorities, | |
313 | tls_construct_certificate_authorities, | |
314 | tls_construct_certificate_authorities, NULL, | |
315 | }, | |
ab83e314 | 316 | { |
ec15acb6 | 317 | /* Must be immediately before pre_shared_key */ |
ab83e314 | 318 | TLSEXT_TYPE_padding, |
fe874d27 | 319 | SSL_EXT_CLIENT_HELLO, |
68db4dda | 320 | NULL, |
ab83e314 | 321 | /* We send this, but don't read it */ |
1266eefd | 322 | NULL, NULL, NULL, tls_construct_ctos_padding, NULL |
ec15acb6 MC |
323 | }, |
324 | { | |
325 | /* Required by the TLSv1.3 spec to always be the last extension */ | |
326 | TLSEXT_TYPE_psk, | |
fe874d27 MC |
327 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO |
328 | | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, | |
0247086d | 329 | NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk, |
1053a6e2 | 330 | tls_construct_ctos_psk, NULL |
6b473aca MC |
331 | } |
332 | }; | |
333 | ||
43ae5eed MC |
334 | /* Check whether an extension's context matches the current context */ |
335 | static int validate_context(SSL *s, unsigned int extctx, unsigned int thisctx) | |
336 | { | |
337 | /* Check we're allowed to use this extension in this context */ | |
338 | if ((thisctx & extctx) == 0) | |
339 | return 0; | |
340 | ||
341 | if (SSL_IS_DTLS(s)) { | |
342 | if ((extctx & SSL_EXT_TLS_ONLY) != 0) | |
343 | return 0; | |
344 | } else if ((extctx & SSL_EXT_DTLS_ONLY) != 0) { | |
345 | return 0; | |
346 | } | |
347 | ||
348 | return 1; | |
349 | } | |
350 | ||
6b473aca MC |
351 | /* |
352 | * Verify whether we are allowed to use the extension |type| in the current | |
353 | * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to | |
70af3d8e | 354 | * indicate the extension is not allowed. If returning 1 then |*found| is set to |
69687aa8 | 355 | * the definition for the extension we found. |
6b473aca | 356 | */ |
70af3d8e | 357 | static int verify_extension(SSL *s, unsigned int context, unsigned int type, |
1266eefd MC |
358 | custom_ext_methods *meths, RAW_EXTENSION *rawexlist, |
359 | RAW_EXTENSION **found) | |
6b473aca MC |
360 | { |
361 | size_t i; | |
70af3d8e | 362 | size_t builtin_num = OSSL_NELEM(ext_defs); |
d270de32 | 363 | const EXTENSION_DEFINITION *thisext; |
6b473aca | 364 | |
1266eefd MC |
365 | for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) { |
366 | if (type == thisext->type) { | |
43ae5eed | 367 | if (!validate_context(s, thisext->context, context)) |
6b473aca MC |
368 | return 0; |
369 | ||
1266eefd | 370 | *found = &rawexlist[i]; |
6b473aca MC |
371 | return 1; |
372 | } | |
373 | } | |
374 | ||
70af3d8e MC |
375 | /* Check the custom extensions */ |
376 | if (meths != NULL) { | |
43ae5eed | 377 | size_t offset = 0; |
787d9ec7 | 378 | ENDPOINT role = ENDPOINT_BOTH; |
43ae5eed MC |
379 | custom_ext_method *meth = NULL; |
380 | ||
381 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) | |
787d9ec7 | 382 | role = ENDPOINT_SERVER; |
43ae5eed | 383 | else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0) |
787d9ec7 | 384 | role = ENDPOINT_CLIENT; |
43ae5eed | 385 | |
787d9ec7 | 386 | meth = custom_ext_find(meths, role, type, &offset); |
43ae5eed MC |
387 | if (meth != NULL) { |
388 | if (!validate_context(s, meth->context, context)) | |
389 | return 0; | |
390 | *found = &rawexlist[offset + builtin_num]; | |
391 | return 1; | |
6b473aca MC |
392 | } |
393 | } | |
394 | ||
70af3d8e | 395 | /* Unknown extension. We allow it */ |
1266eefd | 396 | *found = NULL; |
70af3d8e | 397 | return 1; |
6b473aca MC |
398 | } |
399 | ||
70af3d8e MC |
400 | /* |
401 | * Check whether the context defined for an extension |extctx| means whether | |
402 | * the extension is relevant for the current context |thisctx| or not. Returns | |
403 | * 1 if the extension is relevant for this context, and 0 otherwise | |
404 | */ | |
43ae5eed | 405 | int extension_is_relevant(SSL *s, unsigned int extctx, unsigned int thisctx) |
805a2e9e MC |
406 | { |
407 | if ((SSL_IS_DTLS(s) | |
fe874d27 | 408 | && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0) |
805a2e9e | 409 | || (s->version == SSL3_VERSION |
fe874d27 | 410 | && (extctx & SSL_EXT_SSL3_ALLOWED) == 0) |
805a2e9e | 411 | || (SSL_IS_TLS13(s) |
fe874d27 | 412 | && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0) |
43ae5eed MC |
413 | || (!SSL_IS_TLS13(s) && (extctx & SSL_EXT_TLS1_3_ONLY) != 0) |
414 | || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0)) | |
805a2e9e MC |
415 | return 0; |
416 | ||
417 | return 1; | |
418 | } | |
419 | ||
6b473aca MC |
420 | /* |
421 | * Gather a list of all the extensions from the data in |packet]. |context| | |
70af3d8e | 422 | * tells us which message this extension is for. The raw extension data is |
1266eefd MC |
423 | * stored in |*res| on success. In the event of an error the alert type to use |
424 | * is stored in |*al|. We don't actually process the content of the extensions | |
425 | * yet, except to check their types. This function also runs the initialiser | |
735d5b59 TT |
426 | * functions for all known extensions if |init| is nonzero (whether we have |
427 | * collected them or not). If successful the caller is responsible for freeing | |
428 | * the contents of |*res|. | |
6b473aca MC |
429 | * |
430 | * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be | |
431 | * more than one extension of the same type in a ClientHello or ServerHello. | |
432 | * This function returns 1 if all extensions are unique and we have parsed their | |
433 | * types, and 0 if the extensions contain duplicates, could not be successfully | |
1266eefd | 434 | * found, or an internal error occurred. We only check duplicates for |
70af3d8e | 435 | * extensions that we know about. We ignore others. |
6b473aca | 436 | */ |
6b473aca | 437 | int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context, |
735d5b59 TT |
438 | RAW_EXTENSION **res, int *al, size_t *len, |
439 | int init) | |
6b473aca MC |
440 | { |
441 | PACKET extensions = *packet; | |
d270de32 | 442 | size_t i = 0; |
fc5ece2e | 443 | size_t num_exts; |
43ae5eed | 444 | custom_ext_methods *exts = &s->cert->custext; |
6b473aca | 445 | RAW_EXTENSION *raw_extensions = NULL; |
d270de32 | 446 | const EXTENSION_DEFINITION *thisexd; |
6b473aca | 447 | |
ecc2f938 MC |
448 | *res = NULL; |
449 | ||
70af3d8e MC |
450 | /* |
451 | * Initialise server side custom extensions. Client side is done during | |
452 | * construction of extensions for the ClientHello. | |
453 | */ | |
43ae5eed MC |
454 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) |
455 | custom_ext_init(&s->cert->custext); | |
70af3d8e | 456 | |
fc5ece2e BK |
457 | num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0); |
458 | raw_extensions = OPENSSL_zalloc(num_exts * sizeof(*raw_extensions)); | |
70af3d8e MC |
459 | if (raw_extensions == NULL) { |
460 | *al = SSL_AD_INTERNAL_ERROR; | |
461 | SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, ERR_R_MALLOC_FAILURE); | |
462 | return 0; | |
463 | } | |
464 | ||
193b5d76 | 465 | i = 0; |
6b473aca | 466 | while (PACKET_remaining(&extensions) > 0) { |
b186a592 | 467 | unsigned int type, idx; |
6b473aca | 468 | PACKET extension; |
1266eefd | 469 | RAW_EXTENSION *thisex; |
6b473aca MC |
470 | |
471 | if (!PACKET_get_net_2(&extensions, &type) || | |
472 | !PACKET_get_length_prefixed_2(&extensions, &extension)) { | |
473 | SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION); | |
70af3d8e | 474 | *al = SSL_AD_DECODE_ERROR; |
6b473aca MC |
475 | goto err; |
476 | } | |
70af3d8e MC |
477 | /* |
478 | * Verify this extension is allowed. We only check duplicates for | |
652a6b7e MC |
479 | * extensions that we recognise. We also have a special case for the |
480 | * PSK extension, which must be the last one in the ClientHello. | |
70af3d8e | 481 | */ |
1266eefd | 482 | if (!verify_extension(s, context, type, exts, raw_extensions, &thisex) |
652a6b7e MC |
483 | || (thisex != NULL && thisex->present == 1) |
484 | || (type == TLSEXT_TYPE_psk | |
fe874d27 | 485 | && (context & SSL_EXT_CLIENT_HELLO) != 0 |
652a6b7e | 486 | && PACKET_remaining(&extensions) != 0)) { |
6b473aca | 487 | SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION); |
70af3d8e | 488 | *al = SSL_AD_ILLEGAL_PARAMETER; |
6b473aca MC |
489 | goto err; |
490 | } | |
b186a592 MC |
491 | idx = thisex - raw_extensions; |
492 | /*- | |
493 | * Check that we requested this extension (if appropriate). Requests can | |
494 | * be sent in the ClientHello and CertificateRequest. Unsolicited | |
495 | * extensions can be sent in the NewSessionTicket. We only do this for | |
496 | * the built-in extensions. Custom extensions have a different but | |
497 | * similar check elsewhere. | |
498 | * Special cases: | |
499 | * - The HRR cookie extension is unsolicited | |
500 | * - The renegotiate extension is unsolicited (the client signals | |
501 | * support via an SCSV) | |
502 | * - The signed_certificate_timestamp extension can be provided by a | |
503 | * custom extension or by the built-in version. We let the extension | |
504 | * itself handle unsolicited response checks. | |
505 | */ | |
506 | if (idx < OSSL_NELEM(ext_defs) | |
507 | && (context & (SSL_EXT_CLIENT_HELLO | |
508 | | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | |
509 | | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) == 0 | |
510 | && type != TLSEXT_TYPE_cookie | |
511 | && type != TLSEXT_TYPE_renegotiate | |
512 | && type != TLSEXT_TYPE_signed_certificate_timestamp | |
513 | && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0) { | |
355a0d10 | 514 | SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_UNSOLICITED_EXTENSION); |
b186a592 MC |
515 | *al = SSL_AD_UNSUPPORTED_EXTENSION; |
516 | goto err; | |
517 | } | |
1266eefd MC |
518 | if (thisex != NULL) { |
519 | thisex->data = extension; | |
520 | thisex->present = 1; | |
521 | thisex->type = type; | |
193b5d76 | 522 | thisex->received_order = i++; |
6b473aca MC |
523 | } |
524 | } | |
525 | ||
735d5b59 TT |
526 | if (init) { |
527 | /* | |
528 | * Initialise all known extensions relevant to this context, | |
529 | * whether we have found them or not | |
530 | */ | |
531 | for (thisexd = ext_defs, i = 0; i < OSSL_NELEM(ext_defs); | |
532 | i++, thisexd++) { | |
bf5c84f5 TT |
533 | if (thisexd->init != NULL && (thisexd->context & context) != 0 |
534 | && extension_is_relevant(s, thisexd->context, context) | |
535 | && !thisexd->init(s, context)) { | |
735d5b59 TT |
536 | *al = SSL_AD_INTERNAL_ERROR; |
537 | goto err; | |
538 | } | |
68db4dda MC |
539 | } |
540 | } | |
541 | ||
6b473aca | 542 | *res = raw_extensions; |
fc5ece2e BK |
543 | if (len != NULL) |
544 | *len = num_exts; | |
6b473aca MC |
545 | return 1; |
546 | ||
547 | err: | |
548 | OPENSSL_free(raw_extensions); | |
549 | return 0; | |
550 | } | |
551 | ||
68db4dda | 552 | /* |
70af3d8e MC |
553 | * Runs the parser for a given extension with index |idx|. |exts| contains the |
554 | * list of all parsed extensions previously collected by | |
555 | * tls_collect_extensions(). The parser is only run if it is applicable for the | |
f97d4c37 MC |
556 | * given |context| and the parser has not already been run. If this is for a |
557 | * Certificate message, then we also provide the parser with the relevant | |
8521ced6 | 558 | * Certificate |x| and its position in the |chainidx| with 0 being the first |
f97d4c37 MC |
559 | * Certificate. Returns 1 on success or 0 on failure. In the event of a failure |
560 | * |*al| is populated with a suitable alert code. If an extension is not present | |
561 | * this counted as success. | |
68db4dda | 562 | */ |
d270de32 | 563 | int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context, |
8521ced6 | 564 | RAW_EXTENSION *exts, X509 *x, size_t chainidx, int *al) |
6b473aca | 565 | { |
70af3d8e | 566 | RAW_EXTENSION *currext = &exts[idx]; |
61138358 MC |
567 | int (*parser)(SSL *s, PACKET *pkt, unsigned int context, X509 *x, |
568 | size_t chainidx, int *al) = NULL; | |
6b473aca | 569 | |
70af3d8e MC |
570 | /* Skip if the extension is not present */ |
571 | if (!currext->present) | |
572 | return 1; | |
6b473aca | 573 | |
aff8c126 RS |
574 | if (s->ext.debug_cb) |
575 | s->ext.debug_cb(s, !s->server, currext->type, | |
576 | PACKET_data(&currext->data), | |
577 | PACKET_remaining(&currext->data), | |
578 | s->ext.debug_arg); | |
6b473aca | 579 | |
70af3d8e MC |
580 | /* Skip if we've already parsed this extension */ |
581 | if (currext->parsed) | |
582 | return 1; | |
6b473aca | 583 | |
70af3d8e MC |
584 | currext->parsed = 1; |
585 | ||
586 | if (idx < OSSL_NELEM(ext_defs)) { | |
587 | /* We are handling a built-in extension */ | |
588 | const EXTENSION_DEFINITION *extdef = &ext_defs[idx]; | |
589 | ||
590 | /* Check if extension is defined for our protocol. If not, skip */ | |
591 | if (!extension_is_relevant(s, extdef->context, context)) | |
592 | return 1; | |
593 | ||
1266eefd | 594 | parser = s->server ? extdef->parse_ctos : extdef->parse_stoc; |
224135e9 | 595 | |
1266eefd | 596 | if (parser != NULL) |
61138358 | 597 | return parser(s, &currext->data, context, x, chainidx, al); |
6b473aca | 598 | |
70af3d8e MC |
599 | /* |
600 | * If the parser is NULL we fall through to the custom extension | |
601 | * processing | |
602 | */ | |
6b473aca MC |
603 | } |
604 | ||
43ae5eed MC |
605 | /* Parse custom extensions */ |
606 | if (custom_ext_parse(s, context, currext->type, | |
607 | PACKET_data(&currext->data), | |
608 | PACKET_remaining(&currext->data), | |
609 | x, chainidx, al) <= 0) | |
70af3d8e MC |
610 | return 0; |
611 | ||
805a2e9e MC |
612 | return 1; |
613 | } | |
614 | ||
615 | /* | |
616 | * Parse all remaining extensions that have not yet been parsed. Also calls the | |
735d5b59 TT |
617 | * finalisation for all extensions at the end if |fin| is nonzero, whether we |
618 | * collected them or not. Returns 1 for success or 0 for failure. If we are | |
619 | * working on a Certificate message then we also pass the Certificate |x| and | |
620 | * its position in the |chainidx|, with 0 being the first certificate. On | |
621 | * failure, |*al| is populated with a suitable alert code. | |
805a2e9e | 622 | */ |
f97d4c37 | 623 | int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts, X509 *x, |
735d5b59 | 624 | size_t chainidx, int *al, int fin) |
805a2e9e | 625 | { |
1266eefd | 626 | size_t i, numexts = OSSL_NELEM(ext_defs); |
d270de32 | 627 | const EXTENSION_DEFINITION *thisexd; |
805a2e9e | 628 | |
70af3d8e | 629 | /* Calculate the number of extensions in the extensions list */ |
43ae5eed | 630 | numexts += s->cert->custext.meths_count; |
70af3d8e MC |
631 | |
632 | /* Parse each extension in turn */ | |
1266eefd | 633 | for (i = 0; i < numexts; i++) { |
8521ced6 | 634 | if (!tls_parse_extension(s, i, context, exts, x, chainidx, al)) |
70af3d8e MC |
635 | return 0; |
636 | } | |
805a2e9e | 637 | |
735d5b59 TT |
638 | if (fin) { |
639 | /* | |
640 | * Finalise all known extensions relevant to this context, | |
641 | * whether we have found them or not | |
642 | */ | |
643 | for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); | |
644 | i++, thisexd++) { | |
bf5c84f5 TT |
645 | if (thisexd->final != NULL && (thisexd->context & context) != 0 |
646 | && !thisexd->final(s, context, exts[i].present, al)) | |
735d5b59 TT |
647 | return 0; |
648 | } | |
68db4dda MC |
649 | } |
650 | ||
6b473aca MC |
651 | return 1; |
652 | } | |
653 | ||
43ae5eed MC |
654 | int should_add_extension(SSL *s, unsigned int extctx, unsigned int thisctx, |
655 | int max_version) | |
656 | { | |
657 | /* Skip if not relevant for our context */ | |
658 | if ((extctx & thisctx) == 0) | |
659 | return 0; | |
660 | ||
661 | /* Check if this extension is defined for our protocol. If not, skip */ | |
662 | if ((SSL_IS_DTLS(s) && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0) | |
663 | || (s->version == SSL3_VERSION | |
664 | && (extctx & SSL_EXT_SSL3_ALLOWED) == 0) | |
665 | || (SSL_IS_TLS13(s) | |
666 | && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0) | |
667 | || (!SSL_IS_TLS13(s) | |
668 | && (extctx & SSL_EXT_TLS1_3_ONLY) != 0 | |
669 | && (thisctx & SSL_EXT_CLIENT_HELLO) == 0) | |
670 | || ((extctx & SSL_EXT_TLS1_3_ONLY) != 0 | |
671 | && (thisctx & SSL_EXT_CLIENT_HELLO) != 0 | |
672 | && (SSL_IS_DTLS(s) || max_version < TLS1_3_VERSION))) | |
673 | return 0; | |
674 | ||
675 | return 1; | |
676 | } | |
677 | ||
6b473aca | 678 | /* |
70af3d8e | 679 | * Construct all the extensions relevant to the current |context| and write |
30aeba43 | 680 | * them to |pkt|. If this is an extension for a Certificate in a Certificate |
8521ced6 MC |
681 | * message, then |x| will be set to the Certificate we are handling, and |
682 | * |chainidx| will indicate the position in the chainidx we are processing (with | |
683 | * 0 being the first in the chain). Returns 1 on success or 0 on failure. If a | |
684 | * failure occurs then |al| is populated with a suitable alert code. On a | |
685 | * failure construction stops at the first extension to fail to construct. | |
6b473aca | 686 | */ |
224135e9 | 687 | int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context, |
8521ced6 | 688 | X509 *x, size_t chainidx, int *al) |
224135e9 | 689 | { |
1266eefd | 690 | size_t i; |
43ae5eed | 691 | int min_version, max_version = 0, reason, tmpal; |
d270de32 | 692 | const EXTENSION_DEFINITION *thisexd; |
224135e9 | 693 | |
7da160b0 | 694 | /* |
70af3d8e | 695 | * Normally if something goes wrong during construction it's an internal |
7da160b0 MC |
696 | * error. We can always override this later. |
697 | */ | |
70af3d8e | 698 | tmpal = SSL_AD_INTERNAL_ERROR; |
7da160b0 | 699 | |
224135e9 MC |
700 | if (!WPACKET_start_sub_packet_u16(pkt) |
701 | /* | |
702 | * If extensions are of zero length then we don't even add the | |
7da160b0 | 703 | * extensions length bytes to a ClientHello/ServerHello in SSLv3 |
224135e9 | 704 | */ |
fe874d27 MC |
705 | || ((context & |
706 | (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0 | |
707 | && s->version == SSL3_VERSION | |
708 | && !WPACKET_set_flags(pkt, | |
224135e9 | 709 | WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) { |
224135e9 | 710 | SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR); |
70af3d8e | 711 | goto err; |
224135e9 MC |
712 | } |
713 | ||
fe874d27 | 714 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) { |
38a73150 | 715 | reason = ssl_get_min_max_version(s, &min_version, &max_version); |
ab83e314 MC |
716 | if (reason != 0) { |
717 | SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, reason); | |
70af3d8e | 718 | goto err; |
ab83e314 MC |
719 | } |
720 | } | |
721 | ||
722 | /* Add custom extensions first */ | |
fe874d27 | 723 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) { |
43ae5eed MC |
724 | /* On the server side with initiase during ClientHello parsing */ |
725 | custom_ext_init(&s->cert->custext); | |
ab83e314 | 726 | } |
43ae5eed | 727 | if (!custom_ext_add(s, context, pkt, x, chainidx, max_version, &tmpal)) { |
ab83e314 | 728 | SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR); |
70af3d8e | 729 | goto err; |
ab83e314 MC |
730 | } |
731 | ||
1266eefd | 732 | for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) { |
b186a592 MC |
733 | EXT_RETURN (*construct)(SSL *s, WPACKET *pkt, unsigned int context, |
734 | X509 *x, size_t chainidx, int *al); | |
735 | EXT_RETURN ret; | |
4b299b8e | 736 | |
224135e9 | 737 | /* Skip if not relevant for our context */ |
43ae5eed | 738 | if (!should_add_extension(s, thisexd->context, context, max_version)) |
224135e9 MC |
739 | continue; |
740 | ||
1266eefd MC |
741 | construct = s->server ? thisexd->construct_stoc |
742 | : thisexd->construct_ctos; | |
224135e9 | 743 | |
43ae5eed | 744 | if (construct == NULL) |
224135e9 MC |
745 | continue; |
746 | ||
b186a592 MC |
747 | ret = construct(s, pkt, context, x, chainidx, &tmpal); |
748 | if (ret == EXT_RETURN_FAIL) | |
70af3d8e | 749 | goto err; |
b186a592 MC |
750 | if (ret == EXT_RETURN_SENT |
751 | && (context & (SSL_EXT_CLIENT_HELLO | |
752 | | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | |
753 | | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) != 0) | |
754 | s->ext.extflags[i] |= SSL_EXT_FLAG_SENT; | |
224135e9 MC |
755 | } |
756 | ||
224135e9 | 757 | if (!WPACKET_close(pkt)) { |
224135e9 | 758 | SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR); |
70af3d8e | 759 | goto err; |
224135e9 MC |
760 | } |
761 | ||
762 | return 1; | |
70af3d8e MC |
763 | |
764 | err: | |
765 | *al = tmpal; | |
766 | return 0; | |
224135e9 | 767 | } |
805a2e9e | 768 | |
70af3d8e MC |
769 | /* |
770 | * Built in extension finalisation and initialisation functions. All initialise | |
771 | * or finalise the associated extension type for the given |context|. For | |
772 | * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0 | |
773 | * otherwise. These functions return 1 on success or 0 on failure. In the event | |
774 | * of a failure then |*al| is populated with a suitable error code. | |
775 | */ | |
776 | ||
1266eefd | 777 | static int final_renegotiate(SSL *s, unsigned int context, int sent, |
805a2e9e MC |
778 | int *al) |
779 | { | |
332eb390 MC |
780 | if (!s->server) { |
781 | /* | |
782 | * Check if we can connect to a server that doesn't support safe | |
783 | * renegotiation | |
784 | */ | |
785 | if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT) | |
786 | && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) | |
787 | && !sent) { | |
788 | *al = SSL_AD_HANDSHAKE_FAILURE; | |
7fe97c07 | 789 | SSLerr(SSL_F_FINAL_RENEGOTIATE, |
332eb390 MC |
790 | SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); |
791 | return 0; | |
792 | } | |
793 | ||
805a2e9e | 794 | return 1; |
332eb390 | 795 | } |
805a2e9e MC |
796 | |
797 | /* Need RI if renegotiating */ | |
798 | if (s->renegotiate | |
799 | && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) | |
800 | && !sent) { | |
801 | *al = SSL_AD_HANDSHAKE_FAILURE; | |
7fe97c07 | 802 | SSLerr(SSL_F_FINAL_RENEGOTIATE, |
805a2e9e MC |
803 | SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); |
804 | return 0; | |
805 | } | |
806 | ||
332eb390 | 807 | |
805a2e9e MC |
808 | return 1; |
809 | } | |
810 | ||
1266eefd | 811 | static int init_server_name(SSL *s, unsigned int context) |
805a2e9e MC |
812 | { |
813 | if (s->server) | |
814 | s->servername_done = 0; | |
815 | ||
816 | return 1; | |
817 | } | |
818 | ||
1266eefd | 819 | static int final_server_name(SSL *s, unsigned int context, int sent, |
805a2e9e MC |
820 | int *al) |
821 | { | |
822 | int ret = SSL_TLSEXT_ERR_NOACK; | |
823 | int altmp = SSL_AD_UNRECOGNIZED_NAME; | |
824 | ||
aff8c126 RS |
825 | if (s->ctx != NULL && s->ctx->ext.servername_cb != 0) |
826 | ret = s->ctx->ext.servername_cb(s, &altmp, | |
827 | s->ctx->ext.servername_arg); | |
222da979 TS |
828 | else if (s->session_ctx != NULL |
829 | && s->session_ctx->ext.servername_cb != 0) | |
830 | ret = s->session_ctx->ext.servername_cb(s, &altmp, | |
831 | s->session_ctx->ext.servername_arg); | |
805a2e9e MC |
832 | |
833 | switch (ret) { | |
834 | case SSL_TLSEXT_ERR_ALERT_FATAL: | |
835 | *al = altmp; | |
836 | return 0; | |
837 | ||
838 | case SSL_TLSEXT_ERR_ALERT_WARNING: | |
839 | *al = altmp; | |
840 | return 1; | |
841 | ||
842 | case SSL_TLSEXT_ERR_NOACK: | |
843 | s->servername_done = 0; | |
844 | return 1; | |
845 | ||
846 | default: | |
847 | return 1; | |
848 | } | |
849 | } | |
850 | ||
332eb390 | 851 | #ifndef OPENSSL_NO_EC |
1266eefd | 852 | static int final_ec_pt_formats(SSL *s, unsigned int context, int sent, |
332eb390 MC |
853 | int *al) |
854 | { | |
855 | unsigned long alg_k, alg_a; | |
856 | ||
857 | if (s->server) | |
858 | return 1; | |
859 | ||
860 | alg_k = s->s3->tmp.new_cipher->algorithm_mkey; | |
861 | alg_a = s->s3->tmp.new_cipher->algorithm_auth; | |
862 | ||
863 | /* | |
864 | * If we are client and using an elliptic curve cryptography cipher | |
865 | * suite, then if server returns an EC point formats lists extension it | |
866 | * must contain uncompressed. | |
867 | */ | |
aff8c126 RS |
868 | if (s->ext.ecpointformats != NULL |
869 | && s->ext.ecpointformats_len > 0 | |
870 | && s->session->ext.ecpointformats != NULL | |
871 | && s->session->ext.ecpointformats_len > 0 | |
1266eefd | 872 | && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) { |
332eb390 MC |
873 | /* we are using an ECC cipher */ |
874 | size_t i; | |
aff8c126 | 875 | unsigned char *list = s->session->ext.ecpointformats; |
1266eefd | 876 | |
aff8c126 | 877 | for (i = 0; i < s->session->ext.ecpointformats_len; i++) { |
1266eefd | 878 | if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed) |
332eb390 | 879 | break; |
332eb390 | 880 | } |
aff8c126 | 881 | if (i == s->session->ext.ecpointformats_len) { |
7fe97c07 | 882 | SSLerr(SSL_F_FINAL_EC_PT_FORMATS, |
332eb390 MC |
883 | SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); |
884 | return 0; | |
885 | } | |
886 | } | |
887 | ||
888 | return 1; | |
889 | } | |
890 | #endif | |
891 | ||
1266eefd | 892 | static int init_session_ticket(SSL *s, unsigned int context) |
332eb390 MC |
893 | { |
894 | if (!s->server) | |
aff8c126 | 895 | s->ext.ticket_expected = 0; |
332eb390 MC |
896 | |
897 | return 1; | |
898 | } | |
899 | ||
8f8c11d8 | 900 | #ifndef OPENSSL_NO_OCSP |
1266eefd | 901 | static int init_status_request(SSL *s, unsigned int context) |
805a2e9e | 902 | { |
f63e4288 | 903 | if (s->server) { |
aff8c126 | 904 | s->ext.status_type = TLSEXT_STATUSTYPE_nothing; |
f63e4288 MC |
905 | } else { |
906 | /* | |
907 | * Ensure we get sensible values passed to tlsext_status_cb in the event | |
908 | * that we don't receive a status message | |
909 | */ | |
8cbfcc70 RS |
910 | OPENSSL_free(s->ext.ocsp.resp); |
911 | s->ext.ocsp.resp = NULL; | |
912 | s->ext.ocsp.resp_len = 0; | |
f63e4288 | 913 | } |
332eb390 MC |
914 | |
915 | return 1; | |
916 | } | |
8f8c11d8 | 917 | #endif |
332eb390 | 918 | |
805a2e9e | 919 | #ifndef OPENSSL_NO_NEXTPROTONEG |
1266eefd | 920 | static int init_npn(SSL *s, unsigned int context) |
805a2e9e | 921 | { |
aff8c126 | 922 | s->s3->npn_seen = 0; |
805a2e9e MC |
923 | |
924 | return 1; | |
925 | } | |
926 | #endif | |
927 | ||
1266eefd | 928 | static int init_alpn(SSL *s, unsigned int context) |
805a2e9e | 929 | { |
332eb390 MC |
930 | OPENSSL_free(s->s3->alpn_selected); |
931 | s->s3->alpn_selected = NULL; | |
a5bb1aa1 | 932 | s->s3->alpn_selected_len = 0; |
805a2e9e | 933 | if (s->server) { |
805a2e9e MC |
934 | OPENSSL_free(s->s3->alpn_proposed); |
935 | s->s3->alpn_proposed = NULL; | |
936 | s->s3->alpn_proposed_len = 0; | |
937 | } | |
805a2e9e MC |
938 | return 1; |
939 | } | |
940 | ||
1266eefd | 941 | static int final_alpn(SSL *s, unsigned int context, int sent, int *al) |
02f0274e MC |
942 | { |
943 | const unsigned char *selected = NULL; | |
944 | unsigned char selected_len = 0; | |
945 | ||
946 | if (!s->server) | |
947 | return 1; | |
948 | ||
aff8c126 RS |
949 | if (s->ctx->ext.alpn_select_cb != NULL && s->s3->alpn_proposed != NULL) { |
950 | int r = s->ctx->ext.alpn_select_cb(s, &selected, &selected_len, | |
951 | s->s3->alpn_proposed, | |
952 | (unsigned int)s->s3->alpn_proposed_len, | |
953 | s->ctx->ext.alpn_select_cb_arg); | |
02f0274e MC |
954 | |
955 | if (r == SSL_TLSEXT_ERR_OK) { | |
956 | OPENSSL_free(s->s3->alpn_selected); | |
957 | s->s3->alpn_selected = OPENSSL_memdup(selected, selected_len); | |
958 | if (s->s3->alpn_selected == NULL) { | |
959 | *al = SSL_AD_INTERNAL_ERROR; | |
960 | return 0; | |
961 | } | |
962 | s->s3->alpn_selected_len = selected_len; | |
963 | #ifndef OPENSSL_NO_NEXTPROTONEG | |
964 | /* ALPN takes precedence over NPN. */ | |
aff8c126 | 965 | s->s3->npn_seen = 0; |
02f0274e | 966 | #endif |
8313a787 BK |
967 | } else if (r == SSL_TLSEXT_ERR_NOACK) { |
968 | /* Behave as if no callback was present. */ | |
969 | return 1; | |
02f0274e MC |
970 | } else { |
971 | *al = SSL_AD_NO_APPLICATION_PROTOCOL; | |
972 | return 0; | |
973 | } | |
974 | } | |
975 | ||
976 | return 1; | |
977 | } | |
978 | ||
1266eefd | 979 | static int init_sig_algs(SSL *s, unsigned int context) |
805a2e9e MC |
980 | { |
981 | /* Clear any signature algorithms extension received */ | |
982 | OPENSSL_free(s->s3->tmp.peer_sigalgs); | |
983 | s->s3->tmp.peer_sigalgs = NULL; | |
984 | ||
985 | return 1; | |
986 | } | |
987 | ||
988 | #ifndef OPENSSL_NO_SRP | |
1266eefd | 989 | static int init_srp(SSL *s, unsigned int context) |
805a2e9e MC |
990 | { |
991 | OPENSSL_free(s->srp_ctx.login); | |
992 | s->srp_ctx.login = NULL; | |
993 | ||
994 | return 1; | |
995 | } | |
996 | #endif | |
997 | ||
1266eefd | 998 | static int init_etm(SSL *s, unsigned int context) |
805a2e9e | 999 | { |
28a31a0a | 1000 | s->ext.use_etm = 0; |
332eb390 MC |
1001 | |
1002 | return 1; | |
1003 | } | |
1004 | ||
1266eefd | 1005 | static int init_ems(SSL *s, unsigned int context) |
332eb390 MC |
1006 | { |
1007 | if (!s->server) | |
1008 | s->s3->flags &= ~TLS1_FLAGS_RECEIVED_EXTMS; | |
1009 | ||
1010 | return 1; | |
1011 | } | |
1012 | ||
1266eefd | 1013 | static int final_ems(SSL *s, unsigned int context, int sent, int *al) |
332eb390 MC |
1014 | { |
1015 | if (!s->server && s->hit) { | |
1016 | /* | |
1017 | * Check extended master secret extension is consistent with | |
1018 | * original session. | |
1019 | */ | |
1020 | if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) != | |
1021 | !(s->session->flags & SSL_SESS_FLAG_EXTMS)) { | |
1022 | *al = SSL_AD_HANDSHAKE_FAILURE; | |
7fe97c07 | 1023 | SSLerr(SSL_F_FINAL_EMS, SSL_R_INCONSISTENT_EXTMS); |
332eb390 MC |
1024 | return 0; |
1025 | } | |
1026 | } | |
805a2e9e MC |
1027 | |
1028 | return 1; | |
1029 | } | |
1030 | ||
45615c5f DSH |
1031 | static int init_certificate_authorities(SSL *s, unsigned int context) |
1032 | { | |
fa7c2637 DSH |
1033 | sk_X509_NAME_pop_free(s->s3->tmp.peer_ca_names, X509_NAME_free); |
1034 | s->s3->tmp.peer_ca_names = NULL; | |
45615c5f DSH |
1035 | return 1; |
1036 | } | |
1037 | ||
b186a592 MC |
1038 | static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt, |
1039 | unsigned int context, | |
1040 | X509 *x, | |
1041 | size_t chainidx, | |
1042 | int *al) | |
45615c5f | 1043 | { |
9784ec04 | 1044 | const STACK_OF(X509_NAME) *ca_sk = SSL_get0_CA_list(s); |
45615c5f DSH |
1045 | |
1046 | if (ca_sk == NULL || sk_X509_NAME_num(ca_sk) == 0) | |
b186a592 | 1047 | return EXT_RETURN_NOT_SENT; |
45615c5f DSH |
1048 | |
1049 | if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_certificate_authorities) | |
1050 | || !WPACKET_start_sub_packet_u16(pkt) | |
1051 | || !construct_ca_names(s, pkt) | |
1052 | || !WPACKET_close(pkt)) { | |
1053 | SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES, | |
1054 | ERR_R_INTERNAL_ERROR); | |
b186a592 | 1055 | return EXT_RETURN_FAIL; |
45615c5f DSH |
1056 | } |
1057 | ||
b186a592 | 1058 | return EXT_RETURN_SENT; |
45615c5f DSH |
1059 | } |
1060 | ||
1061 | static int tls_parse_certificate_authorities(SSL *s, PACKET *pkt, | |
1062 | unsigned int context, X509 *x, | |
1063 | size_t chainidx, int *al) | |
1064 | { | |
1065 | if (!parse_ca_names(s, pkt, al)) | |
1066 | return 0; | |
1067 | if (PACKET_remaining(pkt) != 0) { | |
1068 | *al = SSL_AD_DECODE_ERROR; | |
1069 | return 0; | |
1070 | } | |
1071 | return 1; | |
1072 | } | |
1073 | ||
805a2e9e | 1074 | #ifndef OPENSSL_NO_SRTP |
1266eefd | 1075 | static int init_srtp(SSL *s, unsigned int context) |
805a2e9e MC |
1076 | { |
1077 | if (s->server) | |
1078 | s->srtp_profile = NULL; | |
1079 | ||
1080 | return 1; | |
1081 | } | |
1082 | #endif | |
04904312 MC |
1083 | |
1084 | static int final_sig_algs(SSL *s, unsigned int context, int sent, int *al) | |
1085 | { | |
108d45df | 1086 | if (!sent && SSL_IS_TLS13(s) && !s->hit) { |
04904312 MC |
1087 | *al = TLS13_AD_MISSING_EXTENSION; |
1088 | SSLerr(SSL_F_FINAL_SIG_ALGS, SSL_R_MISSING_SIGALGS_EXTENSION); | |
1089 | return 0; | |
1090 | } | |
1091 | ||
1092 | return 1; | |
1093 | } | |
b2f7e8c0 | 1094 | |
deb2d5e7 | 1095 | #ifndef OPENSSL_NO_EC |
f4bbb37c MC |
1096 | static int final_key_share(SSL *s, unsigned int context, int sent, int *al) |
1097 | { | |
1098 | if (!SSL_IS_TLS13(s)) | |
1099 | return 1; | |
1100 | ||
07d447a6 MC |
1101 | /* Nothing to do for key_share in an HRR */ |
1102 | if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) | |
1103 | return 1; | |
1104 | ||
f4bbb37c MC |
1105 | /* |
1106 | * If | |
aff9929b MC |
1107 | * we are a client |
1108 | * AND | |
f4bbb37c MC |
1109 | * we have no key_share |
1110 | * AND | |
1111 | * (we are not resuming | |
1112 | * OR the kex_mode doesn't allow non key_share resumes) | |
1113 | * THEN | |
aff9929b | 1114 | * fail; |
f4bbb37c | 1115 | */ |
aff9929b MC |
1116 | if (!s->server |
1117 | && !sent | |
f4bbb37c MC |
1118 | && (!s->hit |
1119 | || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0)) { | |
7d061fce | 1120 | /* Nothing left we can do - just fail */ |
fb34a0f4 | 1121 | *al = SSL_AD_MISSING_EXTENSION; |
f4bbb37c MC |
1122 | SSLerr(SSL_F_FINAL_KEY_SHARE, SSL_R_NO_SUITABLE_KEY_SHARE); |
1123 | return 0; | |
1124 | } | |
aff9929b MC |
1125 | /* |
1126 | * If | |
1127 | * we are a server | |
1128 | * AND | |
1129 | * we have no key_share | |
1130 | * THEN | |
1131 | * If | |
1132 | * we didn't already send a HelloRetryRequest | |
1133 | * AND | |
1134 | * the client sent a key_share extension | |
1135 | * AND | |
1136 | * (we are not resuming | |
1137 | * OR the kex_mode allows key_share resumes) | |
1138 | * AND | |
1139 | * a shared group exists | |
1140 | * THEN | |
1141 | * send a HelloRetryRequest | |
1142 | * ELSE If | |
1143 | * we are not resuming | |
1144 | * OR | |
1145 | * the kex_mode doesn't allow non key_share resumes | |
1146 | * THEN | |
1147 | * fail; | |
1148 | */ | |
1149 | if (s->server && s->s3->peer_tmp == NULL) { | |
1150 | /* No suitable share */ | |
1151 | if (s->hello_retry_request == 0 && sent | |
1152 | && (!s->hit | |
1153 | || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) | |
1154 | != 0)) { | |
1155 | const unsigned char *pcurves, *pcurvestmp, *clntcurves; | |
1156 | size_t num_curves, clnt_num_curves, i; | |
319a33d0 | 1157 | unsigned int group_id = 0; |
aff9929b | 1158 | |
2248dbeb | 1159 | /* Check if a shared group exists */ |
aff9929b MC |
1160 | |
1161 | /* Get the clients list of supported groups. */ | |
1162 | if (!tls1_get_curvelist(s, 1, &clntcurves, &clnt_num_curves)) { | |
1163 | *al = SSL_AD_INTERNAL_ERROR; | |
1164 | SSLerr(SSL_F_FINAL_KEY_SHARE, ERR_R_INTERNAL_ERROR); | |
1165 | return 0; | |
1166 | } | |
1167 | ||
1168 | /* Get our list of available groups */ | |
1169 | if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves)) { | |
1170 | *al = SSL_AD_INTERNAL_ERROR; | |
1171 | SSLerr(SSL_F_FINAL_KEY_SHARE, ERR_R_INTERNAL_ERROR); | |
1172 | return 0; | |
1173 | } | |
1174 | ||
1175 | /* Find the first group we allow that is also in client's list */ | |
1176 | for (i = 0, pcurvestmp = pcurves; i < num_curves; | |
1177 | i++, pcurvestmp += 2) { | |
0dd7ba24 | 1178 | group_id = bytestogroup(pcurvestmp); |
aff9929b MC |
1179 | |
1180 | if (check_in_list(s, group_id, clntcurves, clnt_num_curves, 1)) | |
1181 | break; | |
1182 | } | |
1183 | ||
1184 | if (i < num_curves) { | |
1185 | /* A shared group exists so send a HelloRetryRequest */ | |
1186 | s->s3->group_id = group_id; | |
1187 | s->hello_retry_request = 1; | |
1188 | return 1; | |
1189 | } | |
1190 | } | |
1191 | if (!s->hit | |
1192 | || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0) { | |
1193 | /* Nothing left we can do - just fail */ | |
b6fdc12d MC |
1194 | if (!sent) |
1195 | *al = SSL_AD_MISSING_EXTENSION; | |
1196 | else | |
1197 | *al = SSL_AD_HANDSHAKE_FAILURE; | |
aff9929b MC |
1198 | SSLerr(SSL_F_FINAL_KEY_SHARE, SSL_R_NO_SUITABLE_KEY_SHARE); |
1199 | return 0; | |
1200 | } | |
1201 | } | |
1202 | ||
1203 | /* We have a key_share so don't send any more HelloRetryRequest messages */ | |
1204 | if (s->server) | |
1205 | s->hello_retry_request = 0; | |
f4bbb37c MC |
1206 | |
1207 | /* | |
1208 | * For a client side resumption with no key_share we need to generate | |
1209 | * the handshake secret (otherwise this is done during key_share | |
1210 | * processing). | |
1211 | */ | |
1212 | if (!sent && !s->server && !tls13_generate_handshake_secret(s, NULL, 0)) { | |
1213 | *al = SSL_AD_INTERNAL_ERROR; | |
1214 | SSLerr(SSL_F_FINAL_KEY_SHARE, ERR_R_INTERNAL_ERROR); | |
1215 | return 0; | |
1216 | } | |
1217 | ||
1218 | return 1; | |
1219 | } | |
deb2d5e7 | 1220 | #endif |
f4bbb37c | 1221 | |
b2f7e8c0 MC |
1222 | static int init_psk_kex_modes(SSL *s, unsigned int context) |
1223 | { | |
1224 | s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_NONE; | |
b2f7e8c0 MC |
1225 | return 1; |
1226 | } | |
1053a6e2 MC |
1227 | |
1228 | int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart, | |
1229 | size_t binderoffset, const unsigned char *binderin, | |
3a7c56b2 MC |
1230 | unsigned char *binderout, SSL_SESSION *sess, int sign, |
1231 | int external) | |
1053a6e2 MC |
1232 | { |
1233 | EVP_PKEY *mackey = NULL; | |
1234 | EVP_MD_CTX *mctx = NULL; | |
1235 | unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE]; | |
1236 | unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE]; | |
b81bd336 MC |
1237 | unsigned char tmppsk[EVP_MAX_MD_SIZE]; |
1238 | unsigned char *early_secret, *psk; | |
17aa119e | 1239 | const char resumption_label[] = "res binder"; |
3a7c56b2 | 1240 | const char external_label[] = "ext binder"; |
b81bd336 | 1241 | const char nonce_label[] = "resumption"; |
3a7c56b2 MC |
1242 | const char *label; |
1243 | size_t bindersize, labelsize, hashsize = EVP_MD_size(md); | |
1053a6e2 MC |
1244 | int ret = -1; |
1245 | ||
3a7c56b2 MC |
1246 | if (external) { |
1247 | label = external_label; | |
1248 | labelsize = sizeof(external_label) - 1; | |
1249 | } else { | |
1250 | label = resumption_label; | |
1251 | labelsize = sizeof(resumption_label) - 1; | |
1252 | } | |
1253 | ||
b81bd336 MC |
1254 | if (sess->master_key_length != hashsize) { |
1255 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, SSL_R_BAD_PSK); | |
1256 | goto err; | |
1257 | } | |
1258 | ||
1259 | if (external) { | |
1260 | psk = sess->master_key; | |
1261 | } else { | |
b81bd336 MC |
1262 | psk = tmppsk; |
1263 | if (!tls13_hkdf_expand(s, md, sess->master_key, | |
1264 | (const unsigned char *)nonce_label, | |
1265 | sizeof(nonce_label) - 1, sess->ext.tick_nonce, | |
1266 | sess->ext.tick_nonce_len, psk, hashsize)) { | |
1267 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1268 | goto err; | |
1269 | } | |
1270 | } | |
1271 | ||
9368f865 MC |
1272 | /* |
1273 | * Generate the early_secret. On the server side we've selected a PSK to | |
1274 | * resume with (internal or external) so we always do this. On the client | |
1275 | * side we do this for a non-external (i.e. resumption) PSK so that it | |
1276 | * is in place for sending early data. For client side external PSK we | |
1277 | * generate it but store it away for later use. | |
1278 | */ | |
1279 | if (s->server || !external) | |
1280 | early_secret = (unsigned char *)s->early_secret; | |
1281 | else | |
1282 | early_secret = (unsigned char *)sess->early_secret; | |
b81bd336 | 1283 | if (!tls13_generate_secret(s, md, NULL, psk, hashsize, early_secret)) { |
1053a6e2 MC |
1284 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); |
1285 | goto err; | |
1286 | } | |
1287 | ||
1288 | /* | |
1289 | * Create the handshake hash for the binder key...the messages so far are | |
1290 | * empty! | |
1291 | */ | |
1292 | mctx = EVP_MD_CTX_new(); | |
1293 | if (mctx == NULL | |
1294 | || EVP_DigestInit_ex(mctx, md, NULL) <= 0 | |
1295 | || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { | |
1296 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1297 | goto err; | |
1298 | } | |
1299 | ||
1300 | /* Generate the binder key */ | |
9368f865 | 1301 | if (!tls13_hkdf_expand(s, md, early_secret, (unsigned char *)label, |
a19ae67d | 1302 | labelsize, hash, hashsize, binderkey, hashsize)) { |
1053a6e2 MC |
1303 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); |
1304 | goto err; | |
1305 | } | |
1306 | ||
1307 | /* Generate the finished key */ | |
1308 | if (!tls13_derive_finishedkey(s, md, binderkey, finishedkey, hashsize)) { | |
1309 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1310 | goto err; | |
1311 | } | |
1312 | ||
aff9929b MC |
1313 | if (EVP_DigestInit_ex(mctx, md, NULL) <= 0) { |
1314 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1315 | goto err; | |
1316 | } | |
1317 | ||
1053a6e2 | 1318 | /* |
aff9929b MC |
1319 | * Get a hash of the ClientHello up to the start of the binders. If we are |
1320 | * following a HelloRetryRequest then this includes the hash of the first | |
1321 | * ClientHello and the HelloRetryRequest itself. | |
1053a6e2 | 1322 | */ |
aff9929b MC |
1323 | if (s->hello_retry_request) { |
1324 | size_t hdatalen; | |
1325 | void *hdata; | |
1326 | ||
1327 | hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata); | |
1328 | if (hdatalen <= 0) { | |
1329 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, SSL_R_BAD_HANDSHAKE_LENGTH); | |
1330 | goto err; | |
1331 | } | |
1332 | ||
1333 | /* | |
1334 | * For servers the handshake buffer data will include the second | |
1335 | * ClientHello - which we don't want - so we need to take that bit off. | |
1336 | */ | |
1337 | if (s->server) { | |
77815a02 MC |
1338 | PACKET hashprefix, msg; |
1339 | ||
1340 | /* Find how many bytes are left after the first two messages */ | |
1341 | if (!PACKET_buf_init(&hashprefix, hdata, hdatalen) | |
1342 | || !PACKET_forward(&hashprefix, 1) | |
1343 | || !PACKET_get_length_prefixed_3(&hashprefix, &msg) | |
1344 | || !PACKET_forward(&hashprefix, 1) | |
1345 | || !PACKET_get_length_prefixed_3(&hashprefix, &msg)) { | |
aff9929b MC |
1346 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); |
1347 | goto err; | |
1348 | } | |
77815a02 | 1349 | hdatalen -= PACKET_remaining(&hashprefix); |
aff9929b MC |
1350 | } |
1351 | ||
1352 | if (EVP_DigestUpdate(mctx, hdata, hdatalen) <= 0) { | |
1353 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1354 | goto err; | |
1355 | } | |
1356 | } | |
1357 | ||
1358 | if (EVP_DigestUpdate(mctx, msgstart, binderoffset) <= 0 | |
1053a6e2 MC |
1359 | || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { |
1360 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1361 | goto err; | |
1362 | } | |
1363 | ||
1364 | mackey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, finishedkey, hashsize); | |
1365 | if (mackey == NULL) { | |
1366 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1367 | goto err; | |
1368 | } | |
1369 | ||
1370 | if (!sign) | |
1371 | binderout = tmpbinder; | |
1372 | ||
1373 | bindersize = hashsize; | |
1374 | if (EVP_DigestSignInit(mctx, NULL, md, NULL, mackey) <= 0 | |
1375 | || EVP_DigestSignUpdate(mctx, hash, hashsize) <= 0 | |
1376 | || EVP_DigestSignFinal(mctx, binderout, &bindersize) <= 0 | |
1377 | || bindersize != hashsize) { | |
1378 | SSLerr(SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); | |
1379 | goto err; | |
1380 | } | |
1381 | ||
1382 | if (sign) { | |
1383 | ret = 1; | |
1384 | } else { | |
1385 | /* HMAC keys can't do EVP_DigestVerify* - use CRYPTO_memcmp instead */ | |
1386 | ret = (CRYPTO_memcmp(binderin, binderout, hashsize) == 0); | |
1387 | } | |
1388 | ||
1389 | err: | |
1390 | OPENSSL_cleanse(binderkey, sizeof(binderkey)); | |
1391 | OPENSSL_cleanse(finishedkey, sizeof(finishedkey)); | |
1392 | EVP_PKEY_free(mackey); | |
1393 | EVP_MD_CTX_free(mctx); | |
1394 | ||
1395 | return ret; | |
1396 | } | |
38df5a45 MC |
1397 | |
1398 | static int final_early_data(SSL *s, unsigned int context, int sent, int *al) | |
1399 | { | |
1400 | if (!s->server || !sent) | |
1401 | return 1; | |
1402 | ||
1403 | if (s->max_early_data == 0 | |
1404 | || !s->hit | |
1405 | || s->session->ext.tick_identity != 0 | |
1406 | || s->early_data_state != SSL_EARLY_DATA_ACCEPTING | |
1407 | || !s->ext.early_data_ok | |
f6370040 MC |
1408 | || s->hello_retry_request |
1409 | || s->s3->alpn_selected_len != s->session->ext.alpn_selected_len | |
e6941c78 MC |
1410 | || (s->s3->alpn_selected_len > 0 |
1411 | && memcmp(s->s3->alpn_selected, s->session->ext.alpn_selected, | |
1412 | s->s3->alpn_selected_len) != 0)) { | |
38df5a45 MC |
1413 | s->ext.early_data = SSL_EARLY_DATA_REJECTED; |
1414 | } else { | |
1415 | s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; | |
1416 | ||
1417 | if (!tls13_change_cipher_state(s, | |
1418 | SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
1419 | *al = SSL_AD_INTERNAL_ERROR; | |
1420 | return 0; | |
1421 | } | |
1422 | } | |
1423 | ||
1424 | return 1; | |
1425 | } |