]>
Commit | Line | Data |
---|---|---|
6b473aca | 1 | /* |
3c95ef22 | 2 | * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved. |
6b473aca | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
6b473aca MC |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
650c6687 RB |
10 | #if defined(__TANDEM) && defined(_SPT_MODEL_) |
11 | # include <spthread.h> | |
12 | # include <spt_extensions.h> /* timeval */ | |
13 | #endif | |
14 | ||
f6370040 | 15 | #include <string.h> |
677963e5 | 16 | #include "internal/nelem.h" |
88050dd1 | 17 | #include "internal/cryptlib.h" |
706457b7 DMSP |
18 | #include "../ssl_local.h" |
19 | #include "statem_local.h" | |
6b473aca | 20 | |
38b051a1 TM |
21 | static int final_renegotiate(SSL_CONNECTION *s, unsigned int context, int sent); |
22 | static int init_server_name(SSL_CONNECTION *s, unsigned int context); | |
23 | static int final_server_name(SSL_CONNECTION *s, unsigned int context, int sent); | |
24 | static int final_ec_pt_formats(SSL_CONNECTION *s, unsigned int context, | |
25 | int sent); | |
26 | static int init_session_ticket(SSL_CONNECTION *s, unsigned int context); | |
8f8c11d8 | 27 | #ifndef OPENSSL_NO_OCSP |
38b051a1 | 28 | static int init_status_request(SSL_CONNECTION *s, unsigned int context); |
8f8c11d8 | 29 | #endif |
805a2e9e | 30 | #ifndef OPENSSL_NO_NEXTPROTONEG |
38b051a1 | 31 | static int init_npn(SSL_CONNECTION *s, unsigned int context); |
805a2e9e | 32 | #endif |
38b051a1 TM |
33 | static int init_alpn(SSL_CONNECTION *s, unsigned int context); |
34 | static int final_alpn(SSL_CONNECTION *s, unsigned int context, int sent); | |
35 | static int init_sig_algs_cert(SSL_CONNECTION *s, unsigned int context); | |
36 | static int init_sig_algs(SSL_CONNECTION *s, unsigned int context); | |
3c95ef22 TS |
37 | static int init_server_cert_type(SSL_CONNECTION *sc, unsigned int context); |
38 | static int init_client_cert_type(SSL_CONNECTION *sc, unsigned int context); | |
38b051a1 TM |
39 | static int init_certificate_authorities(SSL_CONNECTION *s, |
40 | unsigned int context); | |
41 | static EXT_RETURN tls_construct_certificate_authorities(SSL_CONNECTION *s, | |
42 | WPACKET *pkt, | |
b186a592 MC |
43 | unsigned int context, |
44 | X509 *x, | |
f63a17d6 | 45 | size_t chainidx); |
38b051a1 | 46 | static int tls_parse_certificate_authorities(SSL_CONNECTION *s, PACKET *pkt, |
45615c5f | 47 | unsigned int context, X509 *x, |
f63a17d6 | 48 | size_t chainidx); |
805a2e9e | 49 | #ifndef OPENSSL_NO_SRP |
38b051a1 | 50 | static int init_srp(SSL_CONNECTION *s, unsigned int context); |
805a2e9e | 51 | #endif |
38b051a1 TM |
52 | static int init_ec_point_formats(SSL_CONNECTION *s, unsigned int context); |
53 | static int init_etm(SSL_CONNECTION *s, unsigned int context); | |
54 | static int init_ems(SSL_CONNECTION *s, unsigned int context); | |
55 | static int final_ems(SSL_CONNECTION *s, unsigned int context, int sent); | |
56 | static int init_psk_kex_modes(SSL_CONNECTION *s, unsigned int context); | |
57 | static int final_key_share(SSL_CONNECTION *s, unsigned int context, int sent); | |
805a2e9e | 58 | #ifndef OPENSSL_NO_SRTP |
38b051a1 | 59 | static int init_srtp(SSL_CONNECTION *s, unsigned int context); |
805a2e9e | 60 | #endif |
38b051a1 TM |
61 | static int final_sig_algs(SSL_CONNECTION *s, unsigned int context, int sent); |
62 | static int final_early_data(SSL_CONNECTION *s, unsigned int context, int sent); | |
63 | static int final_maxfragmentlen(SSL_CONNECTION *s, unsigned int context, | |
64 | int sent); | |
65 | static int init_post_handshake_auth(SSL_CONNECTION *s, unsigned int context); | |
66 | static int final_psk(SSL_CONNECTION *s, unsigned int context, int sent); | |
b67cb09f TS |
67 | static int tls_init_compress_certificate(SSL_CONNECTION *sc, unsigned int context); |
68 | static EXT_RETURN tls_construct_compress_certificate(SSL_CONNECTION *sc, WPACKET *pkt, | |
69 | unsigned int context, | |
70 | X509 *x, size_t chainidx); | |
71 | static int tls_parse_compress_certificate(SSL_CONNECTION *sc, PACKET *pkt, | |
72 | unsigned int context, | |
73 | X509 *x, size_t chainidx); | |
9d75dce3 | 74 | |
70af3d8e | 75 | /* Structure to define a built-in extension */ |
1266eefd MC |
76 | typedef struct extensions_definition_st { |
77 | /* The defined type for the extension */ | |
6b473aca | 78 | unsigned int type; |
1266eefd MC |
79 | /* |
80 | * The context that this extension applies to, e.g. what messages and | |
81 | * protocol versions | |
82 | */ | |
83 | unsigned int context; | |
68db4dda | 84 | /* |
805a2e9e MC |
85 | * Initialise extension before parsing. Always called for relevant contexts |
86 | * even if extension not present | |
68db4dda | 87 | */ |
38b051a1 | 88 | int (*init)(SSL_CONNECTION *s, unsigned int context); |
1266eefd | 89 | /* Parse extension sent from client to server */ |
38b051a1 TM |
90 | int (*parse_ctos)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, |
91 | X509 *x, size_t chainidx); | |
1266eefd | 92 | /* Parse extension send from server to client */ |
38b051a1 TM |
93 | int (*parse_stoc)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, |
94 | X509 *x, size_t chainidx); | |
1266eefd | 95 | /* Construct extension sent from server to client */ |
38b051a1 TM |
96 | EXT_RETURN (*construct_stoc)(SSL_CONNECTION *s, WPACKET *pkt, |
97 | unsigned int context, | |
f63a17d6 | 98 | X509 *x, size_t chainidx); |
1266eefd | 99 | /* Construct extension sent from client to server */ |
38b051a1 TM |
100 | EXT_RETURN (*construct_ctos)(SSL_CONNECTION *s, WPACKET *pkt, |
101 | unsigned int context, | |
f63a17d6 | 102 | X509 *x, size_t chainidx); |
68db4dda | 103 | /* |
805a2e9e MC |
104 | * Finalise extension after parsing. Always called where an extensions was |
105 | * initialised even if the extension was not present. |sent| is set to 1 if | |
106 | * the extension was seen, or 0 otherwise. | |
68db4dda | 107 | */ |
38b051a1 | 108 | int (*final)(SSL_CONNECTION *s, unsigned int context, int sent); |
6b473aca MC |
109 | } EXTENSION_DEFINITION; |
110 | ||
4b299b8e | 111 | /* |
70af3d8e | 112 | * Definitions of all built-in extensions. NOTE: Changes in the number or order |
bd91e3c8 | 113 | * of these extensions should be mirrored with equivalent changes to the |
706457b7 | 114 | * indexes ( TLSEXT_IDX_* ) defined in ssl_local.h. |
ac44deaf TS |
115 | * Extensions should be added to test/ext_internal_test.c as well, as that |
116 | * tests the ordering of the extensions. | |
117 | * | |
70af3d8e MC |
118 | * Each extension has an initialiser, a client and |
119 | * server side parser and a finaliser. The initialiser is called (if the | |
120 | * extension is relevant to the given context) even if we did not see the | |
121 | * extension in the message that we received. The parser functions are only | |
122 | * called if we see the extension in the message. The finalisers are always | |
123 | * called if the initialiser was called. | |
124 | * There are also server and client side constructor functions which are always | |
125 | * called during message construction if the extension is relevant for the | |
126 | * given context. | |
127 | * The initialisation, parsing, finalisation and construction functions are | |
128 | * always called in the order defined in this list. Some extensions may depend | |
129 | * on others having been processed first, so the order of this list is | |
130 | * significant. | |
131 | * The extension context is defined by a series of flags which specify which | |
132 | * messages the extension is relevant to. These flags also specify whether the | |
3e6c1da8 | 133 | * extension is relevant to a particular protocol or protocol version. |
a1448c26 | 134 | * |
10ed1b72 TS |
135 | * NOTE: WebSphere Application Server 7+ cannot handle empty extensions at |
136 | * the end, keep these extensions before signature_algorithm. | |
4b299b8e | 137 | */ |
ac44deaf | 138 | #define INVALID_EXTENSION { TLSEXT_TYPE_invalid, 0, NULL, NULL, NULL, NULL, NULL, NULL } |
6b473aca MC |
139 | static const EXTENSION_DEFINITION ext_defs[] = { |
140 | { | |
141 | TLSEXT_TYPE_renegotiate, | |
fe874d27 MC |
142 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
143 | | SSL_EXT_SSL3_ALLOWED | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
144 | NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate, |
145 | tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate, | |
146 | final_renegotiate | |
6b473aca MC |
147 | }, |
148 | { | |
149 | TLSEXT_TYPE_server_name, | |
fe874d27 MC |
150 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
151 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, | |
1266eefd MC |
152 | init_server_name, |
153 | tls_parse_ctos_server_name, tls_parse_stoc_server_name, | |
154 | tls_construct_stoc_server_name, tls_construct_ctos_server_name, | |
155 | final_server_name | |
6b473aca | 156 | }, |
cf72c757 F |
157 | { |
158 | TLSEXT_TYPE_max_fragment_length, | |
159 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | |
160 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, | |
161 | NULL, tls_parse_ctos_maxfragmentlen, tls_parse_stoc_maxfragmentlen, | |
162 | tls_construct_stoc_maxfragmentlen, tls_construct_ctos_maxfragmentlen, | |
163 | final_maxfragmentlen | |
164 | }, | |
6b473aca MC |
165 | #ifndef OPENSSL_NO_SRP |
166 | { | |
167 | TLSEXT_TYPE_srp, | |
fe874d27 | 168 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, |
1266eefd | 169 | init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL |
6b473aca | 170 | }, |
0785274c MC |
171 | #else |
172 | INVALID_EXTENSION, | |
6b473aca | 173 | #endif |
6b473aca MC |
174 | { |
175 | TLSEXT_TYPE_ec_point_formats, | |
fe874d27 MC |
176 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
177 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
3f987381 | 178 | init_ec_point_formats, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats, |
1266eefd MC |
179 | tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats, |
180 | final_ec_pt_formats | |
6b473aca MC |
181 | }, |
182 | { | |
7bc2bddb BK |
183 | /* |
184 | * "supported_groups" is spread across several specifications. | |
185 | * It was originally specified as "elliptic_curves" in RFC 4492, | |
186 | * and broadened to include named FFDH groups by RFC 7919. | |
187 | * Both RFCs 4492 and 7919 do not include a provision for the server | |
188 | * to indicate to the client the complete list of groups supported | |
189 | * by the server, with the server instead just indicating the | |
190 | * selected group for this connection in the ServerKeyExchange | |
191 | * message. TLS 1.3 adds a scheme for the server to indicate | |
192 | * to the client its list of supported groups in the | |
193 | * EncryptedExtensions message, but none of the relevant | |
194 | * specifications permit sending supported_groups in the ServerHello. | |
195 | * Nonetheless (possibly due to the close proximity to the | |
196 | * "ec_point_formats" extension, which is allowed in the ServerHello), | |
197 | * there are several servers that send this extension in the | |
198 | * ServerHello anyway. Up to and including the 1.1.0 release, | |
199 | * we did not check for the presence of nonpermitted extensions, | |
200 | * so to avoid a regression, we must permit this extension in the | |
201 | * TLS 1.2 ServerHello as well. | |
202 | * | |
203 | * Note that there is no tls_parse_stoc_supported_groups function, | |
204 | * so we do not perform any additional parsing, validation, or | |
205 | * processing on the server's group list -- this is just a minimal | |
206 | * change to preserve compatibility with these misbehaving servers. | |
207 | */ | |
6b473aca | 208 | TLSEXT_TYPE_supported_groups, |
7bc2bddb BK |
209 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS |
210 | | SSL_EXT_TLS1_2_SERVER_HELLO, | |
1266eefd | 211 | NULL, tls_parse_ctos_supported_groups, NULL, |
6af87546 | 212 | tls_construct_stoc_supported_groups, |
1266eefd | 213 | tls_construct_ctos_supported_groups, NULL |
6b473aca | 214 | }, |
6b473aca MC |
215 | { |
216 | TLSEXT_TYPE_session_ticket, | |
fe874d27 MC |
217 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
218 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
219 | init_session_ticket, tls_parse_ctos_session_ticket, |
220 | tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket, | |
221 | tls_construct_ctos_session_ticket, NULL | |
6b473aca | 222 | }, |
ab83e314 | 223 | #ifndef OPENSSL_NO_OCSP |
6b473aca MC |
224 | { |
225 | TLSEXT_TYPE_status_request, | |
fe874d27 | 226 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
5de683d2 | 227 | | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, |
1266eefd MC |
228 | init_status_request, tls_parse_ctos_status_request, |
229 | tls_parse_stoc_status_request, tls_construct_stoc_status_request, | |
f63e4288 | 230 | tls_construct_ctos_status_request, NULL |
6b473aca | 231 | }, |
0785274c MC |
232 | #else |
233 | INVALID_EXTENSION, | |
ab83e314 | 234 | #endif |
6b473aca MC |
235 | #ifndef OPENSSL_NO_NEXTPROTONEG |
236 | { | |
237 | TLSEXT_TYPE_next_proto_neg, | |
fe874d27 MC |
238 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
239 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
240 | init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn, |
241 | tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL | |
6b473aca | 242 | }, |
0785274c MC |
243 | #else |
244 | INVALID_EXTENSION, | |
6b473aca MC |
245 | #endif |
246 | { | |
02f0274e MC |
247 | /* |
248 | * Must appear in this list after server_name so that finalisation | |
249 | * happens after server_name callbacks | |
250 | */ | |
6b473aca | 251 | TLSEXT_TYPE_application_layer_protocol_negotiation, |
fe874d27 MC |
252 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
253 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, | |
1266eefd | 254 | init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn, |
630369d9 | 255 | tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn |
6b473aca | 256 | }, |
7da160b0 | 257 | #ifndef OPENSSL_NO_SRTP |
6b473aca MC |
258 | { |
259 | TLSEXT_TYPE_use_srtp, | |
fe874d27 MC |
260 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
261 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_DTLS_ONLY, | |
1266eefd MC |
262 | init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp, |
263 | tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL | |
6b473aca | 264 | }, |
0785274c MC |
265 | #else |
266 | INVALID_EXTENSION, | |
7da160b0 | 267 | #endif |
6b473aca MC |
268 | { |
269 | TLSEXT_TYPE_encrypt_then_mac, | |
fe874d27 MC |
270 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
271 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
272 | init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm, |
273 | tls_construct_stoc_etm, tls_construct_ctos_etm, NULL | |
6b473aca | 274 | }, |
6dd083fd | 275 | #ifndef OPENSSL_NO_CT |
6b473aca MC |
276 | { |
277 | TLSEXT_TYPE_signed_certificate_timestamp, | |
fe874d27 | 278 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
5de683d2 | 279 | | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, |
68db4dda | 280 | NULL, |
6b473aca MC |
281 | /* |
282 | * No server side support for this, but can be provided by a custom | |
283 | * extension. This is an exception to the rule that custom extensions | |
284 | * cannot override built in ones. | |
285 | */ | |
1266eefd | 286 | NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct, NULL |
6b473aca | 287 | }, |
0785274c MC |
288 | #else |
289 | INVALID_EXTENSION, | |
6dd083fd | 290 | #endif |
6b473aca MC |
291 | { |
292 | TLSEXT_TYPE_extended_master_secret, | |
fe874d27 MC |
293 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
294 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd MC |
295 | init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems, |
296 | tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems | |
6b473aca | 297 | }, |
c589c34e BK |
298 | { |
299 | TLSEXT_TYPE_signature_algorithms_cert, | |
300 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, | |
301 | init_sig_algs_cert, tls_parse_ctos_sig_algs_cert, | |
302 | tls_parse_ctos_sig_algs_cert, | |
303 | /* We do not generate signature_algorithms_cert at present. */ | |
304 | NULL, NULL, NULL | |
305 | }, | |
9d75dce3 TS |
306 | { |
307 | TLSEXT_TYPE_post_handshake_auth, | |
308 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY, | |
309 | init_post_handshake_auth, | |
310 | tls_parse_ctos_post_handshake_auth, NULL, | |
311 | NULL, tls_construct_ctos_post_handshake_auth, | |
312 | NULL, | |
313 | }, | |
3c95ef22 TS |
314 | { |
315 | TLSEXT_TYPE_client_cert_type, | |
316 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | |
317 | | SSL_EXT_TLS1_2_SERVER_HELLO, | |
318 | init_client_cert_type, | |
319 | tls_parse_ctos_client_cert_type, tls_parse_stoc_client_cert_type, | |
320 | tls_construct_stoc_client_cert_type, tls_construct_ctos_client_cert_type, | |
321 | NULL | |
322 | }, | |
323 | { | |
324 | TLSEXT_TYPE_server_cert_type, | |
325 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | |
326 | | SSL_EXT_TLS1_2_SERVER_HELLO, | |
327 | init_server_cert_type, | |
328 | tls_parse_ctos_server_cert_type, tls_parse_stoc_server_cert_type, | |
329 | tls_construct_stoc_server_cert_type, tls_construct_ctos_server_cert_type, | |
330 | NULL | |
331 | }, | |
10ed1b72 TS |
332 | { |
333 | TLSEXT_TYPE_signature_algorithms, | |
334 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, | |
335 | init_sig_algs, tls_parse_ctos_sig_algs, | |
336 | tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs, | |
337 | tls_construct_ctos_sig_algs, final_sig_algs | |
338 | }, | |
6b473aca MC |
339 | { |
340 | TLSEXT_TYPE_supported_versions, | |
27e462f1 MC |
341 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO |
342 | | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY, | |
68db4dda | 343 | NULL, |
6b473aca | 344 | /* Processed inline as part of version selection */ |
88050dd1 MC |
345 | NULL, tls_parse_stoc_supported_versions, |
346 | tls_construct_stoc_supported_versions, | |
347 | tls_construct_ctos_supported_versions, NULL | |
6b473aca | 348 | }, |
b2f7e8c0 | 349 | { |
b2f7e8c0 | 350 | TLSEXT_TYPE_psk_kex_modes, |
fe874d27 MC |
351 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY |
352 | | SSL_EXT_TLS1_3_ONLY, | |
b2f7e8c0 MC |
353 | init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL, |
354 | tls_construct_ctos_psk_kex_modes, NULL | |
355 | }, | |
6b473aca | 356 | { |
70af3d8e MC |
357 | /* |
358 | * Must be in this list after supported_groups. We need that to have | |
359 | * been parsed before we do this one. | |
360 | */ | |
6b473aca | 361 | TLSEXT_TYPE_key_share, |
fe874d27 MC |
362 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO |
363 | | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY | |
364 | | SSL_EXT_TLS1_3_ONLY, | |
1266eefd | 365 | NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share, |
f4bbb37c MC |
366 | tls_construct_stoc_key_share, tls_construct_ctos_key_share, |
367 | final_key_share | |
7da160b0 | 368 | }, |
cfef5027 | 369 | { |
97ea1e7f | 370 | /* Must be after key_share */ |
cfef5027 | 371 | TLSEXT_TYPE_cookie, |
fe874d27 MC |
372 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST |
373 | | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, | |
43054d3d MC |
374 | NULL, tls_parse_ctos_cookie, tls_parse_stoc_cookie, |
375 | tls_construct_stoc_cookie, tls_construct_ctos_cookie, NULL | |
cfef5027 | 376 | }, |
7da160b0 MC |
377 | { |
378 | /* | |
379 | * Special unsolicited ServerHello extension only used when | |
23fed8ba MC |
380 | * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set. We allow it in a ClientHello but |
381 | * ignore it. | |
7da160b0 MC |
382 | */ |
383 | TLSEXT_TYPE_cryptopro_bug, | |
23fed8ba MC |
384 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO |
385 | | SSL_EXT_TLS1_2_AND_BELOW_ONLY, | |
1266eefd | 386 | NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL |
ab83e314 | 387 | }, |
b67cb09f TS |
388 | { |
389 | TLSEXT_TYPE_compress_certificate, | |
390 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | |
391 | | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, | |
392 | tls_init_compress_certificate, | |
393 | tls_parse_compress_certificate, tls_parse_compress_certificate, | |
394 | tls_construct_compress_certificate, tls_construct_compress_certificate, | |
395 | NULL | |
396 | }, | |
38df5a45 MC |
397 | { |
398 | TLSEXT_TYPE_early_data, | |
fe874d27 | 399 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS |
6e99ae58 | 400 | | SSL_EXT_TLS1_3_NEW_SESSION_TICKET | SSL_EXT_TLS1_3_ONLY, |
38df5a45 MC |
401 | NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data, |
402 | tls_construct_stoc_early_data, tls_construct_ctos_early_data, | |
403 | final_early_data | |
404 | }, | |
45615c5f DSH |
405 | { |
406 | TLSEXT_TYPE_certificate_authorities, | |
fe874d27 MC |
407 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST |
408 | | SSL_EXT_TLS1_3_ONLY, | |
45615c5f DSH |
409 | init_certificate_authorities, |
410 | tls_parse_certificate_authorities, tls_parse_certificate_authorities, | |
411 | tls_construct_certificate_authorities, | |
412 | tls_construct_certificate_authorities, NULL, | |
413 | }, | |
ab83e314 | 414 | { |
ec15acb6 | 415 | /* Must be immediately before pre_shared_key */ |
ab83e314 | 416 | TLSEXT_TYPE_padding, |
fe874d27 | 417 | SSL_EXT_CLIENT_HELLO, |
68db4dda | 418 | NULL, |
ab83e314 | 419 | /* We send this, but don't read it */ |
1266eefd | 420 | NULL, NULL, NULL, tls_construct_ctos_padding, NULL |
ec15acb6 MC |
421 | }, |
422 | { | |
423 | /* Required by the TLSv1.3 spec to always be the last extension */ | |
424 | TLSEXT_TYPE_psk, | |
fe874d27 MC |
425 | SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO |
426 | | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, | |
0247086d | 427 | NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk, |
efe0f315 | 428 | tls_construct_ctos_psk, final_psk |
6b473aca MC |
429 | } |
430 | }; | |
431 | ||
ac44deaf TS |
432 | /* Returns a TLSEXT_TYPE for the given index */ |
433 | unsigned int ossl_get_extension_type(size_t idx) | |
434 | { | |
435 | size_t num_exts = OSSL_NELEM(ext_defs); | |
436 | ||
437 | if (idx >= num_exts) | |
438 | return TLSEXT_TYPE_out_of_range; | |
439 | ||
440 | return ext_defs[idx].type; | |
441 | } | |
442 | ||
43ae5eed | 443 | /* Check whether an extension's context matches the current context */ |
38b051a1 TM |
444 | static int validate_context(SSL_CONNECTION *s, unsigned int extctx, |
445 | unsigned int thisctx) | |
43ae5eed MC |
446 | { |
447 | /* Check we're allowed to use this extension in this context */ | |
448 | if ((thisctx & extctx) == 0) | |
449 | return 0; | |
450 | ||
38b051a1 | 451 | if (SSL_CONNECTION_IS_DTLS(s)) { |
43ae5eed MC |
452 | if ((extctx & SSL_EXT_TLS_ONLY) != 0) |
453 | return 0; | |
454 | } else if ((extctx & SSL_EXT_DTLS_ONLY) != 0) { | |
455 | return 0; | |
456 | } | |
457 | ||
458 | return 1; | |
459 | } | |
460 | ||
38b051a1 TM |
461 | int tls_validate_all_contexts(SSL_CONNECTION *s, unsigned int thisctx, |
462 | RAW_EXTENSION *exts) | |
88050dd1 MC |
463 | { |
464 | size_t i, num_exts, builtin_num = OSSL_NELEM(ext_defs), offset; | |
465 | RAW_EXTENSION *thisext; | |
466 | unsigned int context; | |
467 | ENDPOINT role = ENDPOINT_BOTH; | |
468 | ||
469 | if ((thisctx & SSL_EXT_CLIENT_HELLO) != 0) | |
470 | role = ENDPOINT_SERVER; | |
471 | else if ((thisctx & SSL_EXT_TLS1_2_SERVER_HELLO) != 0) | |
472 | role = ENDPOINT_CLIENT; | |
473 | ||
474 | /* Calculate the number of extensions in the extensions list */ | |
475 | num_exts = builtin_num + s->cert->custext.meths_count; | |
476 | ||
477 | for (thisext = exts, i = 0; i < num_exts; i++, thisext++) { | |
478 | if (!thisext->present) | |
479 | continue; | |
480 | ||
481 | if (i < builtin_num) { | |
482 | context = ext_defs[i].context; | |
483 | } else { | |
484 | custom_ext_method *meth = NULL; | |
485 | ||
486 | meth = custom_ext_find(&s->cert->custext, role, thisext->type, | |
487 | &offset); | |
488 | if (!ossl_assert(meth != NULL)) | |
489 | return 0; | |
490 | context = meth->context; | |
491 | } | |
492 | ||
493 | if (!validate_context(s, context, thisctx)) | |
494 | return 0; | |
495 | } | |
496 | ||
497 | return 1; | |
498 | } | |
499 | ||
6b473aca MC |
500 | /* |
501 | * Verify whether we are allowed to use the extension |type| in the current | |
502 | * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to | |
70af3d8e | 503 | * indicate the extension is not allowed. If returning 1 then |*found| is set to |
69687aa8 | 504 | * the definition for the extension we found. |
6b473aca | 505 | */ |
38b051a1 TM |
506 | static int verify_extension(SSL_CONNECTION *s, unsigned int context, |
507 | unsigned int type, custom_ext_methods *meths, | |
508 | RAW_EXTENSION *rawexlist, RAW_EXTENSION **found) | |
6b473aca MC |
509 | { |
510 | size_t i; | |
70af3d8e | 511 | size_t builtin_num = OSSL_NELEM(ext_defs); |
d270de32 | 512 | const EXTENSION_DEFINITION *thisext; |
6b473aca | 513 | |
1266eefd MC |
514 | for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) { |
515 | if (type == thisext->type) { | |
43ae5eed | 516 | if (!validate_context(s, thisext->context, context)) |
6b473aca MC |
517 | return 0; |
518 | ||
1266eefd | 519 | *found = &rawexlist[i]; |
6b473aca MC |
520 | return 1; |
521 | } | |
522 | } | |
523 | ||
70af3d8e MC |
524 | /* Check the custom extensions */ |
525 | if (meths != NULL) { | |
43ae5eed | 526 | size_t offset = 0; |
787d9ec7 | 527 | ENDPOINT role = ENDPOINT_BOTH; |
43ae5eed MC |
528 | custom_ext_method *meth = NULL; |
529 | ||
530 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) | |
787d9ec7 | 531 | role = ENDPOINT_SERVER; |
43ae5eed | 532 | else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0) |
787d9ec7 | 533 | role = ENDPOINT_CLIENT; |
43ae5eed | 534 | |
787d9ec7 | 535 | meth = custom_ext_find(meths, role, type, &offset); |
43ae5eed MC |
536 | if (meth != NULL) { |
537 | if (!validate_context(s, meth->context, context)) | |
538 | return 0; | |
539 | *found = &rawexlist[offset + builtin_num]; | |
540 | return 1; | |
6b473aca MC |
541 | } |
542 | } | |
543 | ||
70af3d8e | 544 | /* Unknown extension. We allow it */ |
1266eefd | 545 | *found = NULL; |
70af3d8e | 546 | return 1; |
6b473aca MC |
547 | } |
548 | ||
70af3d8e MC |
549 | /* |
550 | * Check whether the context defined for an extension |extctx| means whether | |
551 | * the extension is relevant for the current context |thisctx| or not. Returns | |
552 | * 1 if the extension is relevant for this context, and 0 otherwise | |
553 | */ | |
38b051a1 TM |
554 | int extension_is_relevant(SSL_CONNECTION *s, unsigned int extctx, |
555 | unsigned int thisctx) | |
805a2e9e | 556 | { |
a2b97bdf MC |
557 | int is_tls13; |
558 | ||
559 | /* | |
560 | * For HRR we haven't selected the version yet but we know it will be | |
561 | * TLSv1.3 | |
562 | */ | |
563 | if ((thisctx & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) | |
564 | is_tls13 = 1; | |
565 | else | |
38b051a1 | 566 | is_tls13 = SSL_CONNECTION_IS_TLS13(s); |
a2b97bdf | 567 | |
38b051a1 | 568 | if ((SSL_CONNECTION_IS_DTLS(s) |
fe874d27 | 569 | && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0) |
805a2e9e | 570 | || (s->version == SSL3_VERSION |
fe874d27 | 571 | && (extctx & SSL_EXT_SSL3_ALLOWED) == 0) |
ee36b963 BK |
572 | /* |
573 | * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated", | |
574 | * which is never true when generating the ClientHello. | |
575 | * However, version negotiation *has* occurred by the time the | |
576 | * ClientHello extensions are being parsed. | |
577 | * Be careful to allow TLS 1.3-only extensions when generating | |
578 | * the ClientHello. | |
579 | */ | |
a2b97bdf | 580 | || (is_tls13 && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0) |
ee36b963 BK |
581 | || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0 |
582 | && (thisctx & SSL_EXT_CLIENT_HELLO) == 0) | |
583 | || (s->server && !is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0) | |
43ae5eed | 584 | || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0)) |
805a2e9e | 585 | return 0; |
805a2e9e MC |
586 | return 1; |
587 | } | |
588 | ||
6b473aca MC |
589 | /* |
590 | * Gather a list of all the extensions from the data in |packet]. |context| | |
70af3d8e | 591 | * tells us which message this extension is for. The raw extension data is |
29bfd5b7 MC |
592 | * stored in |*res| on success. We don't actually process the content of the |
593 | * extensions yet, except to check their types. This function also runs the | |
594 | * initialiser functions for all known extensions if |init| is nonzero (whether | |
595 | * we have collected them or not). If successful the caller is responsible for | |
596 | * freeing the contents of |*res|. | |
6b473aca MC |
597 | * |
598 | * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be | |
599 | * more than one extension of the same type in a ClientHello or ServerHello. | |
600 | * This function returns 1 if all extensions are unique and we have parsed their | |
601 | * types, and 0 if the extensions contain duplicates, could not be successfully | |
1266eefd | 602 | * found, or an internal error occurred. We only check duplicates for |
70af3d8e | 603 | * extensions that we know about. We ignore others. |
6b473aca | 604 | */ |
38b051a1 TM |
605 | int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet, |
606 | unsigned int context, | |
f63a17d6 | 607 | RAW_EXTENSION **res, size_t *len, int init) |
6b473aca MC |
608 | { |
609 | PACKET extensions = *packet; | |
d270de32 | 610 | size_t i = 0; |
fc5ece2e | 611 | size_t num_exts; |
43ae5eed | 612 | custom_ext_methods *exts = &s->cert->custext; |
6b473aca | 613 | RAW_EXTENSION *raw_extensions = NULL; |
d270de32 | 614 | const EXTENSION_DEFINITION *thisexd; |
6b473aca | 615 | |
ecc2f938 MC |
616 | *res = NULL; |
617 | ||
70af3d8e MC |
618 | /* |
619 | * Initialise server side custom extensions. Client side is done during | |
620 | * construction of extensions for the ClientHello. | |
621 | */ | |
43ae5eed MC |
622 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) |
623 | custom_ext_init(&s->cert->custext); | |
70af3d8e | 624 | |
fc5ece2e BK |
625 | num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0); |
626 | raw_extensions = OPENSSL_zalloc(num_exts * sizeof(*raw_extensions)); | |
70af3d8e | 627 | if (raw_extensions == NULL) { |
e077455e | 628 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); |
70af3d8e MC |
629 | return 0; |
630 | } | |
631 | ||
193b5d76 | 632 | i = 0; |
6b473aca | 633 | while (PACKET_remaining(&extensions) > 0) { |
b186a592 | 634 | unsigned int type, idx; |
6b473aca | 635 | PACKET extension; |
1266eefd | 636 | RAW_EXTENSION *thisex; |
6b473aca MC |
637 | |
638 | if (!PACKET_get_net_2(&extensions, &type) || | |
639 | !PACKET_get_length_prefixed_2(&extensions, &extension)) { | |
c48ffbcc | 640 | SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); |
6b473aca MC |
641 | goto err; |
642 | } | |
70af3d8e MC |
643 | /* |
644 | * Verify this extension is allowed. We only check duplicates for | |
652a6b7e MC |
645 | * extensions that we recognise. We also have a special case for the |
646 | * PSK extension, which must be the last one in the ClientHello. | |
70af3d8e | 647 | */ |
1266eefd | 648 | if (!verify_extension(s, context, type, exts, raw_extensions, &thisex) |
652a6b7e MC |
649 | || (thisex != NULL && thisex->present == 1) |
650 | || (type == TLSEXT_TYPE_psk | |
fe874d27 | 651 | && (context & SSL_EXT_CLIENT_HELLO) != 0 |
652a6b7e | 652 | && PACKET_remaining(&extensions) != 0)) { |
c48ffbcc | 653 | SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION); |
6b473aca MC |
654 | goto err; |
655 | } | |
b186a592 MC |
656 | idx = thisex - raw_extensions; |
657 | /*- | |
658 | * Check that we requested this extension (if appropriate). Requests can | |
659 | * be sent in the ClientHello and CertificateRequest. Unsolicited | |
660 | * extensions can be sent in the NewSessionTicket. We only do this for | |
661 | * the built-in extensions. Custom extensions have a different but | |
662 | * similar check elsewhere. | |
663 | * Special cases: | |
664 | * - The HRR cookie extension is unsolicited | |
665 | * - The renegotiate extension is unsolicited (the client signals | |
666 | * support via an SCSV) | |
667 | * - The signed_certificate_timestamp extension can be provided by a | |
668 | * custom extension or by the built-in version. We let the extension | |
669 | * itself handle unsolicited response checks. | |
670 | */ | |
671 | if (idx < OSSL_NELEM(ext_defs) | |
672 | && (context & (SSL_EXT_CLIENT_HELLO | |
673 | | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | |
674 | | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) == 0 | |
675 | && type != TLSEXT_TYPE_cookie | |
676 | && type != TLSEXT_TYPE_renegotiate | |
677 | && type != TLSEXT_TYPE_signed_certificate_timestamp | |
673e0bbb DB |
678 | && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0 |
679 | #ifndef OPENSSL_NO_GOST | |
680 | && !((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 | |
681 | && type == TLSEXT_TYPE_cryptopro_bug) | |
682 | #endif | |
dd6b2706 | 683 | ) { |
f63a17d6 | 684 | SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, |
c48ffbcc | 685 | SSL_R_UNSOLICITED_EXTENSION); |
b186a592 MC |
686 | goto err; |
687 | } | |
1266eefd MC |
688 | if (thisex != NULL) { |
689 | thisex->data = extension; | |
690 | thisex->present = 1; | |
691 | thisex->type = type; | |
193b5d76 | 692 | thisex->received_order = i++; |
b93a295a | 693 | if (s->ext.debug_cb) |
38b051a1 TM |
694 | s->ext.debug_cb(SSL_CONNECTION_GET_SSL(s), !s->server, |
695 | thisex->type, PACKET_data(&thisex->data), | |
b93a295a TS |
696 | PACKET_remaining(&thisex->data), |
697 | s->ext.debug_arg); | |
6b473aca MC |
698 | } |
699 | } | |
700 | ||
735d5b59 TT |
701 | if (init) { |
702 | /* | |
703 | * Initialise all known extensions relevant to this context, | |
704 | * whether we have found them or not | |
705 | */ | |
706 | for (thisexd = ext_defs, i = 0; i < OSSL_NELEM(ext_defs); | |
707 | i++, thisexd++) { | |
bf5c84f5 TT |
708 | if (thisexd->init != NULL && (thisexd->context & context) != 0 |
709 | && extension_is_relevant(s, thisexd->context, context) | |
710 | && !thisexd->init(s, context)) { | |
f63a17d6 | 711 | /* SSLfatal() already called */ |
735d5b59 TT |
712 | goto err; |
713 | } | |
68db4dda MC |
714 | } |
715 | } | |
716 | ||
6b473aca | 717 | *res = raw_extensions; |
fc5ece2e BK |
718 | if (len != NULL) |
719 | *len = num_exts; | |
6b473aca MC |
720 | return 1; |
721 | ||
722 | err: | |
723 | OPENSSL_free(raw_extensions); | |
724 | return 0; | |
725 | } | |
726 | ||
68db4dda | 727 | /* |
70af3d8e MC |
728 | * Runs the parser for a given extension with index |idx|. |exts| contains the |
729 | * list of all parsed extensions previously collected by | |
730 | * tls_collect_extensions(). The parser is only run if it is applicable for the | |
f97d4c37 MC |
731 | * given |context| and the parser has not already been run. If this is for a |
732 | * Certificate message, then we also provide the parser with the relevant | |
8521ced6 | 733 | * Certificate |x| and its position in the |chainidx| with 0 being the first |
29bfd5b7 MC |
734 | * Certificate. Returns 1 on success or 0 on failure. If an extension is not |
735 | * present this counted as success. | |
68db4dda | 736 | */ |
38b051a1 | 737 | int tls_parse_extension(SSL_CONNECTION *s, TLSEXT_INDEX idx, int context, |
f63a17d6 | 738 | RAW_EXTENSION *exts, X509 *x, size_t chainidx) |
6b473aca | 739 | { |
70af3d8e | 740 | RAW_EXTENSION *currext = &exts[idx]; |
38b051a1 | 741 | int (*parser)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, X509 *x, |
f63a17d6 | 742 | size_t chainidx) = NULL; |
6b473aca | 743 | |
70af3d8e MC |
744 | /* Skip if the extension is not present */ |
745 | if (!currext->present) | |
746 | return 1; | |
6b473aca | 747 | |
70af3d8e MC |
748 | /* Skip if we've already parsed this extension */ |
749 | if (currext->parsed) | |
750 | return 1; | |
6b473aca | 751 | |
70af3d8e MC |
752 | currext->parsed = 1; |
753 | ||
754 | if (idx < OSSL_NELEM(ext_defs)) { | |
755 | /* We are handling a built-in extension */ | |
756 | const EXTENSION_DEFINITION *extdef = &ext_defs[idx]; | |
757 | ||
758 | /* Check if extension is defined for our protocol. If not, skip */ | |
759 | if (!extension_is_relevant(s, extdef->context, context)) | |
760 | return 1; | |
761 | ||
1266eefd | 762 | parser = s->server ? extdef->parse_ctos : extdef->parse_stoc; |
224135e9 | 763 | |
1266eefd | 764 | if (parser != NULL) |
f63a17d6 | 765 | return parser(s, &currext->data, context, x, chainidx); |
6b473aca | 766 | |
70af3d8e MC |
767 | /* |
768 | * If the parser is NULL we fall through to the custom extension | |
769 | * processing | |
770 | */ | |
6b473aca MC |
771 | } |
772 | ||
43ae5eed | 773 | /* Parse custom extensions */ |
f63a17d6 MC |
774 | return custom_ext_parse(s, context, currext->type, |
775 | PACKET_data(&currext->data), | |
776 | PACKET_remaining(&currext->data), | |
777 | x, chainidx); | |
805a2e9e MC |
778 | } |
779 | ||
780 | /* | |
781 | * Parse all remaining extensions that have not yet been parsed. Also calls the | |
735d5b59 TT |
782 | * finalisation for all extensions at the end if |fin| is nonzero, whether we |
783 | * collected them or not. Returns 1 for success or 0 for failure. If we are | |
784 | * working on a Certificate message then we also pass the Certificate |x| and | |
29bfd5b7 | 785 | * its position in the |chainidx|, with 0 being the first certificate. |
805a2e9e | 786 | */ |
38b051a1 TM |
787 | int tls_parse_all_extensions(SSL_CONNECTION *s, int context, |
788 | RAW_EXTENSION *exts, X509 *x, | |
f63a17d6 | 789 | size_t chainidx, int fin) |
805a2e9e | 790 | { |
1266eefd | 791 | size_t i, numexts = OSSL_NELEM(ext_defs); |
d270de32 | 792 | const EXTENSION_DEFINITION *thisexd; |
805a2e9e | 793 | |
70af3d8e | 794 | /* Calculate the number of extensions in the extensions list */ |
43ae5eed | 795 | numexts += s->cert->custext.meths_count; |
70af3d8e MC |
796 | |
797 | /* Parse each extension in turn */ | |
1266eefd | 798 | for (i = 0; i < numexts; i++) { |
f63a17d6 MC |
799 | if (!tls_parse_extension(s, i, context, exts, x, chainidx)) { |
800 | /* SSLfatal() already called */ | |
70af3d8e | 801 | return 0; |
f63a17d6 | 802 | } |
70af3d8e | 803 | } |
805a2e9e | 804 | |
735d5b59 TT |
805 | if (fin) { |
806 | /* | |
807 | * Finalise all known extensions relevant to this context, | |
808 | * whether we have found them or not | |
809 | */ | |
810 | for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); | |
811 | i++, thisexd++) { | |
bf5c84f5 | 812 | if (thisexd->final != NULL && (thisexd->context & context) != 0 |
f63a17d6 MC |
813 | && !thisexd->final(s, context, exts[i].present)) { |
814 | /* SSLfatal() already called */ | |
735d5b59 | 815 | return 0; |
f63a17d6 | 816 | } |
735d5b59 | 817 | } |
68db4dda MC |
818 | } |
819 | ||
6b473aca MC |
820 | return 1; |
821 | } | |
822 | ||
38b051a1 TM |
823 | int should_add_extension(SSL_CONNECTION *s, unsigned int extctx, |
824 | unsigned int thisctx, int max_version) | |
43ae5eed MC |
825 | { |
826 | /* Skip if not relevant for our context */ | |
827 | if ((extctx & thisctx) == 0) | |
828 | return 0; | |
829 | ||
830 | /* Check if this extension is defined for our protocol. If not, skip */ | |
ee36b963 | 831 | if (!extension_is_relevant(s, extctx, thisctx) |
43ae5eed MC |
832 | || ((extctx & SSL_EXT_TLS1_3_ONLY) != 0 |
833 | && (thisctx & SSL_EXT_CLIENT_HELLO) != 0 | |
38b051a1 | 834 | && (SSL_CONNECTION_IS_DTLS(s) || max_version < TLS1_3_VERSION))) |
43ae5eed MC |
835 | return 0; |
836 | ||
837 | return 1; | |
838 | } | |
839 | ||
6b473aca | 840 | /* |
70af3d8e | 841 | * Construct all the extensions relevant to the current |context| and write |
30aeba43 | 842 | * them to |pkt|. If this is an extension for a Certificate in a Certificate |
8521ced6 MC |
843 | * message, then |x| will be set to the Certificate we are handling, and |
844 | * |chainidx| will indicate the position in the chainidx we are processing (with | |
f63a17d6 | 845 | * 0 being the first in the chain). Returns 1 on success or 0 on failure. On a |
8521ced6 | 846 | * failure construction stops at the first extension to fail to construct. |
6b473aca | 847 | */ |
38b051a1 TM |
848 | int tls_construct_extensions(SSL_CONNECTION *s, WPACKET *pkt, |
849 | unsigned int context, | |
f63a17d6 | 850 | X509 *x, size_t chainidx) |
224135e9 | 851 | { |
1266eefd | 852 | size_t i; |
f63a17d6 | 853 | int min_version, max_version = 0, reason; |
d270de32 | 854 | const EXTENSION_DEFINITION *thisexd; |
72620ac7 | 855 | int for_comp = (context & SSL_EXT_TLS1_3_CERTIFICATE_COMPRESSION) != 0; |
224135e9 MC |
856 | |
857 | if (!WPACKET_start_sub_packet_u16(pkt) | |
858 | /* | |
859 | * If extensions are of zero length then we don't even add the | |
1c259bb5 BK |
860 | * extensions length bytes to a ClientHello/ServerHello |
861 | * (for non-TLSv1.3). | |
224135e9 | 862 | */ |
fe874d27 MC |
863 | || ((context & |
864 | (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0 | |
fe874d27 | 865 | && !WPACKET_set_flags(pkt, |
72620ac7 TS |
866 | WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) { |
867 | if (!for_comp) | |
868 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
f63a17d6 | 869 | return 0; |
224135e9 MC |
870 | } |
871 | ||
fe874d27 | 872 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) { |
b5b993b2 | 873 | reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); |
ab83e314 | 874 | if (reason != 0) { |
72620ac7 TS |
875 | if (!for_comp) |
876 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason); | |
f63a17d6 | 877 | return 0; |
ab83e314 MC |
878 | } |
879 | } | |
880 | ||
881 | /* Add custom extensions first */ | |
fe874d27 | 882 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) { |
44e69951 | 883 | /* On the server side with initialise during ClientHello parsing */ |
43ae5eed | 884 | custom_ext_init(&s->cert->custext); |
ab83e314 | 885 | } |
f63a17d6 MC |
886 | if (!custom_ext_add(s, context, pkt, x, chainidx, max_version)) { |
887 | /* SSLfatal() already called */ | |
888 | return 0; | |
ab83e314 MC |
889 | } |
890 | ||
1266eefd | 891 | for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) { |
38b051a1 TM |
892 | EXT_RETURN (*construct)(SSL_CONNECTION *s, WPACKET *pkt, |
893 | unsigned int context, | |
f63a17d6 | 894 | X509 *x, size_t chainidx); |
b186a592 | 895 | EXT_RETURN ret; |
4b299b8e | 896 | |
224135e9 | 897 | /* Skip if not relevant for our context */ |
43ae5eed | 898 | if (!should_add_extension(s, thisexd->context, context, max_version)) |
224135e9 MC |
899 | continue; |
900 | ||
1266eefd MC |
901 | construct = s->server ? thisexd->construct_stoc |
902 | : thisexd->construct_ctos; | |
224135e9 | 903 | |
43ae5eed | 904 | if (construct == NULL) |
224135e9 MC |
905 | continue; |
906 | ||
f63a17d6 MC |
907 | ret = construct(s, pkt, context, x, chainidx); |
908 | if (ret == EXT_RETURN_FAIL) { | |
909 | /* SSLfatal() already called */ | |
910 | return 0; | |
911 | } | |
b186a592 MC |
912 | if (ret == EXT_RETURN_SENT |
913 | && (context & (SSL_EXT_CLIENT_HELLO | |
914 | | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | |
915 | | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) != 0) | |
916 | s->ext.extflags[i] |= SSL_EXT_FLAG_SENT; | |
224135e9 MC |
917 | } |
918 | ||
224135e9 | 919 | if (!WPACKET_close(pkt)) { |
72620ac7 TS |
920 | if (!for_comp) |
921 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
f63a17d6 | 922 | return 0; |
224135e9 MC |
923 | } |
924 | ||
925 | return 1; | |
926 | } | |
805a2e9e | 927 | |
70af3d8e MC |
928 | /* |
929 | * Built in extension finalisation and initialisation functions. All initialise | |
930 | * or finalise the associated extension type for the given |context|. For | |
931 | * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0 | |
29bfd5b7 | 932 | * otherwise. These functions return 1 on success or 0 on failure. |
70af3d8e MC |
933 | */ |
934 | ||
38b051a1 | 935 | static int final_renegotiate(SSL_CONNECTION *s, unsigned int context, int sent) |
805a2e9e | 936 | { |
332eb390 MC |
937 | if (!s->server) { |
938 | /* | |
939 | * Check if we can connect to a server that doesn't support safe | |
940 | * renegotiation | |
941 | */ | |
942 | if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT) | |
943 | && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) | |
944 | && !sent) { | |
c48ffbcc | 945 | SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, |
f63a17d6 | 946 | SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); |
332eb390 MC |
947 | return 0; |
948 | } | |
949 | ||
805a2e9e | 950 | return 1; |
332eb390 | 951 | } |
805a2e9e MC |
952 | |
953 | /* Need RI if renegotiating */ | |
954 | if (s->renegotiate | |
955 | && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) | |
956 | && !sent) { | |
c48ffbcc | 957 | SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, |
f63a17d6 | 958 | SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); |
805a2e9e MC |
959 | return 0; |
960 | } | |
961 | ||
332eb390 | 962 | |
805a2e9e MC |
963 | return 1; |
964 | } | |
965 | ||
acce0557 P |
966 | static ossl_inline void ssl_tsan_decr(const SSL_CTX *ctx, |
967 | TSAN_QUALIFIER int *stat) | |
968 | { | |
969 | if (ssl_tsan_lock(ctx)) { | |
970 | tsan_decr(stat); | |
971 | ssl_tsan_unlock(ctx); | |
972 | } | |
973 | } | |
974 | ||
38b051a1 | 975 | static int init_server_name(SSL_CONNECTION *s, unsigned int context) |
805a2e9e | 976 | { |
f01344cb | 977 | if (s->server) { |
805a2e9e MC |
978 | s->servername_done = 0; |
979 | ||
f01344cb MC |
980 | OPENSSL_free(s->ext.hostname); |
981 | s->ext.hostname = NULL; | |
982 | } | |
983 | ||
805a2e9e MC |
984 | return 1; |
985 | } | |
986 | ||
38b051a1 | 987 | static int final_server_name(SSL_CONNECTION *s, unsigned int context, int sent) |
805a2e9e | 988 | { |
9ef9088c | 989 | int ret = SSL_TLSEXT_ERR_NOACK; |
805a2e9e | 990 | int altmp = SSL_AD_UNRECOGNIZED_NAME; |
38b051a1 TM |
991 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
992 | SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); | |
993 | int was_ticket = (SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0; | |
805a2e9e | 994 | |
38b051a1 | 995 | if (!ossl_assert(sctx != NULL) || !ossl_assert(s->session_ctx != NULL)) { |
c48ffbcc | 996 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
c4715212 MC |
997 | return 0; |
998 | } | |
999 | ||
38b051a1 TM |
1000 | if (sctx->ext.servername_cb != NULL) |
1001 | ret = sctx->ext.servername_cb(ssl, &altmp, | |
1002 | sctx->ext.servername_arg); | |
c4715212 | 1003 | else if (s->session_ctx->ext.servername_cb != NULL) |
38b051a1 | 1004 | ret = s->session_ctx->ext.servername_cb(ssl, &altmp, |
222da979 | 1005 | s->session_ctx->ext.servername_arg); |
805a2e9e | 1006 | |
1c4aa31d BK |
1007 | /* |
1008 | * For servers, propagate the SNI hostname from the temporary | |
1009 | * storage in the SSL to the persistent SSL_SESSION, now that we | |
1010 | * know we accepted it. | |
1011 | * Clients make this copy when parsing the server's response to | |
1012 | * the extension, which is when they find out that the negotiation | |
1013 | * was successful. | |
1014 | */ | |
1015 | if (s->server) { | |
2a538551 | 1016 | if (sent && ret == SSL_TLSEXT_ERR_OK && !s->hit) { |
1c4aa31d BK |
1017 | /* Only store the hostname in the session if we accepted it. */ |
1018 | OPENSSL_free(s->session->ext.hostname); | |
1019 | s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); | |
1020 | if (s->session->ext.hostname == NULL && s->ext.hostname != NULL) { | |
c48ffbcc | 1021 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
1c4aa31d BK |
1022 | } |
1023 | } | |
9fb6cb81 MC |
1024 | } |
1025 | ||
3be08e30 BK |
1026 | /* |
1027 | * If we switched contexts (whether here or in the client_hello callback), | |
1028 | * move the sess_accept increment from the session_ctx to the new | |
1029 | * context, to avoid the confusing situation of having sess_accept_good | |
1030 | * exceed sess_accept (zero) for the new context. | |
1031 | */ | |
38b051a1 | 1032 | if (SSL_IS_FIRST_HANDSHAKE(s) && sctx != s->session_ctx |
2d6f72aa | 1033 | && s->hello_retry_request == SSL_HRR_NONE) { |
38b051a1 | 1034 | ssl_tsan_counter(sctx, &sctx->stats.sess_accept); |
acce0557 | 1035 | ssl_tsan_decr(s->session_ctx, &s->session_ctx->stats.sess_accept); |
3be08e30 BK |
1036 | } |
1037 | ||
a84e5c9a TS |
1038 | /* |
1039 | * If we're expecting to send a ticket, and tickets were previously enabled, | |
1040 | * and now tickets are disabled, then turn off expected ticket. | |
1041 | * Also, if this is not a resumption, create a new session ID | |
1042 | */ | |
1043 | if (ret == SSL_TLSEXT_ERR_OK && s->ext.ticket_expected | |
38b051a1 | 1044 | && was_ticket && (SSL_get_options(ssl) & SSL_OP_NO_TICKET) != 0) { |
a84e5c9a TS |
1045 | s->ext.ticket_expected = 0; |
1046 | if (!s->hit) { | |
38b051a1 | 1047 | SSL_SESSION* ss = SSL_get_session(ssl); |
a84e5c9a TS |
1048 | |
1049 | if (ss != NULL) { | |
1050 | OPENSSL_free(ss->ext.tick); | |
1051 | ss->ext.tick = NULL; | |
1052 | ss->ext.ticklen = 0; | |
1053 | ss->ext.tick_lifetime_hint = 0; | |
1054 | ss->ext.tick_age_add = 0; | |
a84e5c9a | 1055 | if (!ssl_generate_session_id(s, ss)) { |
c48ffbcc | 1056 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 1057 | return 0; |
a84e5c9a TS |
1058 | } |
1059 | } else { | |
c48ffbcc | 1060 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 1061 | return 0; |
a84e5c9a TS |
1062 | } |
1063 | } | |
1064 | } | |
1065 | ||
805a2e9e MC |
1066 | switch (ret) { |
1067 | case SSL_TLSEXT_ERR_ALERT_FATAL: | |
c48ffbcc | 1068 | SSLfatal(s, altmp, SSL_R_CALLBACK_FAILED); |
805a2e9e MC |
1069 | return 0; |
1070 | ||
1071 | case SSL_TLSEXT_ERR_ALERT_WARNING: | |
fb62e47c | 1072 | /* TLSv1.3 doesn't have warning alerts so we suppress this */ |
38b051a1 | 1073 | if (!SSL_CONNECTION_IS_TLS13(s)) |
fb62e47c | 1074 | ssl3_send_alert(s, SSL3_AL_WARNING, altmp); |
cd624ccd | 1075 | s->servername_done = 0; |
805a2e9e MC |
1076 | return 1; |
1077 | ||
1078 | case SSL_TLSEXT_ERR_NOACK: | |
1079 | s->servername_done = 0; | |
1080 | return 1; | |
1081 | ||
1082 | default: | |
1083 | return 1; | |
1084 | } | |
1085 | } | |
1086 | ||
38b051a1 TM |
1087 | static int final_ec_pt_formats(SSL_CONNECTION *s, unsigned int context, |
1088 | int sent) | |
332eb390 MC |
1089 | { |
1090 | unsigned long alg_k, alg_a; | |
1091 | ||
1092 | if (s->server) | |
1093 | return 1; | |
1094 | ||
555cbb32 TS |
1095 | alg_k = s->s3.tmp.new_cipher->algorithm_mkey; |
1096 | alg_a = s->s3.tmp.new_cipher->algorithm_auth; | |
332eb390 MC |
1097 | |
1098 | /* | |
1099 | * If we are client and using an elliptic curve cryptography cipher | |
1100 | * suite, then if server returns an EC point formats lists extension it | |
1101 | * must contain uncompressed. | |
1102 | */ | |
aff8c126 RS |
1103 | if (s->ext.ecpointformats != NULL |
1104 | && s->ext.ecpointformats_len > 0 | |
cd0fb43c MC |
1105 | && s->ext.peer_ecpointformats != NULL |
1106 | && s->ext.peer_ecpointformats_len > 0 | |
1266eefd | 1107 | && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) { |
332eb390 MC |
1108 | /* we are using an ECC cipher */ |
1109 | size_t i; | |
cd0fb43c | 1110 | unsigned char *list = s->ext.peer_ecpointformats; |
1266eefd | 1111 | |
cd0fb43c | 1112 | for (i = 0; i < s->ext.peer_ecpointformats_len; i++) { |
1266eefd | 1113 | if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed) |
332eb390 | 1114 | break; |
332eb390 | 1115 | } |
cd0fb43c | 1116 | if (i == s->ext.peer_ecpointformats_len) { |
c48ffbcc | 1117 | SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, |
f63a17d6 | 1118 | SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); |
332eb390 MC |
1119 | return 0; |
1120 | } | |
1121 | } | |
1122 | ||
1123 | return 1; | |
1124 | } | |
332eb390 | 1125 | |
38b051a1 | 1126 | static int init_session_ticket(SSL_CONNECTION *s, unsigned int context) |
332eb390 MC |
1127 | { |
1128 | if (!s->server) | |
aff8c126 | 1129 | s->ext.ticket_expected = 0; |
332eb390 MC |
1130 | |
1131 | return 1; | |
1132 | } | |
1133 | ||
8f8c11d8 | 1134 | #ifndef OPENSSL_NO_OCSP |
38b051a1 | 1135 | static int init_status_request(SSL_CONNECTION *s, unsigned int context) |
805a2e9e | 1136 | { |
f63e4288 | 1137 | if (s->server) { |
aff8c126 | 1138 | s->ext.status_type = TLSEXT_STATUSTYPE_nothing; |
f63e4288 MC |
1139 | } else { |
1140 | /* | |
1141 | * Ensure we get sensible values passed to tlsext_status_cb in the event | |
1142 | * that we don't receive a status message | |
1143 | */ | |
8cbfcc70 RS |
1144 | OPENSSL_free(s->ext.ocsp.resp); |
1145 | s->ext.ocsp.resp = NULL; | |
1146 | s->ext.ocsp.resp_len = 0; | |
f63e4288 | 1147 | } |
332eb390 MC |
1148 | |
1149 | return 1; | |
1150 | } | |
8f8c11d8 | 1151 | #endif |
332eb390 | 1152 | |
805a2e9e | 1153 | #ifndef OPENSSL_NO_NEXTPROTONEG |
38b051a1 | 1154 | static int init_npn(SSL_CONNECTION *s, unsigned int context) |
805a2e9e | 1155 | { |
555cbb32 | 1156 | s->s3.npn_seen = 0; |
805a2e9e MC |
1157 | |
1158 | return 1; | |
1159 | } | |
1160 | #endif | |
1161 | ||
38b051a1 | 1162 | static int init_alpn(SSL_CONNECTION *s, unsigned int context) |
805a2e9e | 1163 | { |
555cbb32 TS |
1164 | OPENSSL_free(s->s3.alpn_selected); |
1165 | s->s3.alpn_selected = NULL; | |
1166 | s->s3.alpn_selected_len = 0; | |
805a2e9e | 1167 | if (s->server) { |
555cbb32 TS |
1168 | OPENSSL_free(s->s3.alpn_proposed); |
1169 | s->s3.alpn_proposed = NULL; | |
1170 | s->s3.alpn_proposed_len = 0; | |
805a2e9e | 1171 | } |
805a2e9e MC |
1172 | return 1; |
1173 | } | |
1174 | ||
38b051a1 | 1175 | static int final_alpn(SSL_CONNECTION *s, unsigned int context, int sent) |
630369d9 | 1176 | { |
4be3a7c7 MC |
1177 | if (!s->server && !sent && s->session->ext.alpn_selected != NULL) |
1178 | s->ext.early_data_ok = 0; | |
1179 | ||
38b051a1 | 1180 | if (!s->server || !SSL_CONNECTION_IS_TLS13(s)) |
630369d9 MC |
1181 | return 1; |
1182 | ||
1183 | /* | |
1184 | * Call alpn_select callback if needed. Has to be done after SNI and | |
1185 | * cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3 | |
1186 | * we also have to do this before we decide whether to accept early_data. | |
1187 | * In TLSv1.3 we've already negotiated our cipher so we do this call now. | |
1188 | * For < TLSv1.3 we defer it until after cipher negotiation. | |
56d36288 | 1189 | * |
f63a17d6 | 1190 | * On failure SSLfatal() already called. |
630369d9 | 1191 | */ |
f63a17d6 | 1192 | return tls_handle_alpn(s); |
630369d9 MC |
1193 | } |
1194 | ||
38b051a1 | 1195 | static int init_sig_algs(SSL_CONNECTION *s, unsigned int context) |
805a2e9e MC |
1196 | { |
1197 | /* Clear any signature algorithms extension received */ | |
555cbb32 TS |
1198 | OPENSSL_free(s->s3.tmp.peer_sigalgs); |
1199 | s->s3.tmp.peer_sigalgs = NULL; | |
02b1636f | 1200 | s->s3.tmp.peer_sigalgslen = 0; |
805a2e9e MC |
1201 | |
1202 | return 1; | |
1203 | } | |
1204 | ||
38b051a1 TM |
1205 | static int init_sig_algs_cert(SSL_CONNECTION *s, |
1206 | ossl_unused unsigned int context) | |
c589c34e BK |
1207 | { |
1208 | /* Clear any signature algorithms extension received */ | |
555cbb32 TS |
1209 | OPENSSL_free(s->s3.tmp.peer_cert_sigalgs); |
1210 | s->s3.tmp.peer_cert_sigalgs = NULL; | |
39a14059 | 1211 | s->s3.tmp.peer_cert_sigalgslen = 0; |
c589c34e BK |
1212 | |
1213 | return 1; | |
1214 | } | |
1215 | ||
805a2e9e | 1216 | #ifndef OPENSSL_NO_SRP |
38b051a1 | 1217 | static int init_srp(SSL_CONNECTION *s, unsigned int context) |
805a2e9e MC |
1218 | { |
1219 | OPENSSL_free(s->srp_ctx.login); | |
1220 | s->srp_ctx.login = NULL; | |
1221 | ||
1222 | return 1; | |
1223 | } | |
1224 | #endif | |
1225 | ||
38b051a1 | 1226 | static int init_ec_point_formats(SSL_CONNECTION *s, unsigned int context) |
3f987381 DB |
1227 | { |
1228 | OPENSSL_free(s->ext.peer_ecpointformats); | |
1229 | s->ext.peer_ecpointformats = NULL; | |
1230 | s->ext.peer_ecpointformats_len = 0; | |
1231 | ||
1232 | return 1; | |
1233 | } | |
1234 | ||
38b051a1 | 1235 | static int init_etm(SSL_CONNECTION *s, unsigned int context) |
805a2e9e | 1236 | { |
28a31a0a | 1237 | s->ext.use_etm = 0; |
332eb390 MC |
1238 | |
1239 | return 1; | |
1240 | } | |
1241 | ||
38b051a1 | 1242 | static int init_ems(SSL_CONNECTION *s, unsigned int context) |
332eb390 | 1243 | { |
11d3235e TM |
1244 | if (s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) { |
1245 | s->s3.flags &= ~TLS1_FLAGS_RECEIVED_EXTMS; | |
1246 | s->s3.flags |= TLS1_FLAGS_REQUIRED_EXTMS; | |
1247 | } | |
332eb390 MC |
1248 | |
1249 | return 1; | |
1250 | } | |
1251 | ||
38b051a1 | 1252 | static int final_ems(SSL_CONNECTION *s, unsigned int context, int sent) |
332eb390 | 1253 | { |
11d3235e TM |
1254 | /* |
1255 | * Check extended master secret extension is not dropped on | |
1256 | * renegotiation. | |
1257 | */ | |
1258 | if (!(s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) | |
1259 | && (s->s3.flags & TLS1_FLAGS_REQUIRED_EXTMS)) { | |
c48ffbcc | 1260 | SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_EXTMS); |
11d3235e TM |
1261 | return 0; |
1262 | } | |
332eb390 MC |
1263 | if (!s->server && s->hit) { |
1264 | /* | |
1265 | * Check extended master secret extension is consistent with | |
1266 | * original session. | |
1267 | */ | |
555cbb32 | 1268 | if (!(s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) != |
332eb390 | 1269 | !(s->session->flags & SSL_SESS_FLAG_EXTMS)) { |
c48ffbcc | 1270 | SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_EXTMS); |
332eb390 MC |
1271 | return 0; |
1272 | } | |
1273 | } | |
805a2e9e MC |
1274 | |
1275 | return 1; | |
1276 | } | |
1277 | ||
38b051a1 | 1278 | static int init_certificate_authorities(SSL_CONNECTION *s, unsigned int context) |
45615c5f | 1279 | { |
555cbb32 TS |
1280 | sk_X509_NAME_pop_free(s->s3.tmp.peer_ca_names, X509_NAME_free); |
1281 | s->s3.tmp.peer_ca_names = NULL; | |
45615c5f DSH |
1282 | return 1; |
1283 | } | |
1284 | ||
38b051a1 TM |
1285 | static EXT_RETURN tls_construct_certificate_authorities(SSL_CONNECTION *s, |
1286 | WPACKET *pkt, | |
b186a592 MC |
1287 | unsigned int context, |
1288 | X509 *x, | |
f63a17d6 | 1289 | size_t chainidx) |
45615c5f | 1290 | { |
98732979 | 1291 | const STACK_OF(X509_NAME) *ca_sk = get_ca_names(s); |
45615c5f DSH |
1292 | |
1293 | if (ca_sk == NULL || sk_X509_NAME_num(ca_sk) == 0) | |
b186a592 | 1294 | return EXT_RETURN_NOT_SENT; |
45615c5f DSH |
1295 | |
1296 | if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_certificate_authorities) | |
f63a17d6 | 1297 | || !WPACKET_start_sub_packet_u16(pkt)) { |
c48ffbcc | 1298 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
b186a592 | 1299 | return EXT_RETURN_FAIL; |
45615c5f DSH |
1300 | } |
1301 | ||
98732979 | 1302 | if (!construct_ca_names(s, ca_sk, pkt)) { |
f63a17d6 MC |
1303 | /* SSLfatal() already called */ |
1304 | return EXT_RETURN_FAIL; | |
1305 | } | |
1306 | ||
1307 | if (!WPACKET_close(pkt)) { | |
c48ffbcc | 1308 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 MC |
1309 | return EXT_RETURN_FAIL; |
1310 | } | |
1311 | ||
b186a592 | 1312 | return EXT_RETURN_SENT; |
45615c5f DSH |
1313 | } |
1314 | ||
38b051a1 | 1315 | static int tls_parse_certificate_authorities(SSL_CONNECTION *s, PACKET *pkt, |
45615c5f | 1316 | unsigned int context, X509 *x, |
f63a17d6 | 1317 | size_t chainidx) |
45615c5f | 1318 | { |
f63a17d6 | 1319 | if (!parse_ca_names(s, pkt)) |
45615c5f DSH |
1320 | return 0; |
1321 | if (PACKET_remaining(pkt) != 0) { | |
c48ffbcc | 1322 | SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); |
45615c5f DSH |
1323 | return 0; |
1324 | } | |
1325 | return 1; | |
1326 | } | |
1327 | ||
805a2e9e | 1328 | #ifndef OPENSSL_NO_SRTP |
38b051a1 | 1329 | static int init_srtp(SSL_CONNECTION *s, unsigned int context) |
805a2e9e MC |
1330 | { |
1331 | if (s->server) | |
1332 | s->srtp_profile = NULL; | |
1333 | ||
1334 | return 1; | |
1335 | } | |
1336 | #endif | |
04904312 | 1337 | |
38b051a1 | 1338 | static int final_sig_algs(SSL_CONNECTION *s, unsigned int context, int sent) |
04904312 | 1339 | { |
38b051a1 | 1340 | if (!sent && SSL_CONNECTION_IS_TLS13(s) && !s->hit) { |
c48ffbcc | 1341 | SSLfatal(s, TLS13_AD_MISSING_EXTENSION, |
f63a17d6 | 1342 | SSL_R_MISSING_SIGALGS_EXTENSION); |
04904312 MC |
1343 | return 0; |
1344 | } | |
1345 | ||
1346 | return 1; | |
1347 | } | |
b2f7e8c0 | 1348 | |
38b051a1 | 1349 | static int final_key_share(SSL_CONNECTION *s, unsigned int context, int sent) |
f4bbb37c | 1350 | { |
65dc5c3c | 1351 | #if !defined(OPENSSL_NO_TLS1_3) |
38b051a1 | 1352 | if (!SSL_CONNECTION_IS_TLS13(s)) |
f4bbb37c MC |
1353 | return 1; |
1354 | ||
07d447a6 MC |
1355 | /* Nothing to do for key_share in an HRR */ |
1356 | if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) | |
1357 | return 1; | |
1358 | ||
f4bbb37c MC |
1359 | /* |
1360 | * If | |
aff9929b MC |
1361 | * we are a client |
1362 | * AND | |
f4bbb37c MC |
1363 | * we have no key_share |
1364 | * AND | |
1365 | * (we are not resuming | |
1366 | * OR the kex_mode doesn't allow non key_share resumes) | |
1367 | * THEN | |
aff9929b | 1368 | * fail; |
f4bbb37c | 1369 | */ |
aff9929b MC |
1370 | if (!s->server |
1371 | && !sent | |
f4bbb37c MC |
1372 | && (!s->hit |
1373 | || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0)) { | |
7d061fce | 1374 | /* Nothing left we can do - just fail */ |
c48ffbcc | 1375 | SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_R_NO_SUITABLE_KEY_SHARE); |
f4bbb37c MC |
1376 | return 0; |
1377 | } | |
aff9929b | 1378 | /* |
c36001c3 | 1379 | * IF |
aff9929b | 1380 | * we are a server |
aff9929b | 1381 | * THEN |
c36001c3 MC |
1382 | * IF |
1383 | * we have a suitable key_share | |
aff9929b | 1384 | * THEN |
c36001c3 MC |
1385 | * IF |
1386 | * we are stateless AND we have no cookie | |
1387 | * THEN | |
1388 | * send a HelloRetryRequest | |
1389 | * ELSE | |
1390 | * IF | |
1391 | * we didn't already send a HelloRetryRequest | |
1392 | * AND | |
1393 | * the client sent a key_share extension | |
1394 | * AND | |
1395 | * (we are not resuming | |
1396 | * OR the kex_mode allows key_share resumes) | |
1397 | * AND | |
1398 | * a shared group exists | |
1399 | * THEN | |
1400 | * send a HelloRetryRequest | |
1401 | * ELSE IF | |
1402 | * we are not resuming | |
1403 | * OR | |
1404 | * the kex_mode doesn't allow non key_share resumes | |
1405 | * THEN | |
1406 | * fail | |
1407 | * ELSE IF | |
1408 | * we are stateless AND we have no cookie | |
1409 | * THEN | |
1410 | * send a HelloRetryRequest | |
aff9929b | 1411 | */ |
c36001c3 | 1412 | if (s->server) { |
555cbb32 | 1413 | if (s->s3.peer_tmp != NULL) { |
c36001c3 | 1414 | /* We have a suitable key_share */ |
555cbb32 | 1415 | if ((s->s3.flags & TLS1_FLAGS_STATELESS) != 0 |
c36001c3 MC |
1416 | && !s->ext.cookieok) { |
1417 | if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) { | |
1418 | /* | |
1419 | * If we are stateless then we wouldn't know about any | |
1420 | * previously sent HRR - so how can this be anything other | |
1421 | * than 0? | |
1422 | */ | |
c48ffbcc | 1423 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
c36001c3 MC |
1424 | return 0; |
1425 | } | |
1426 | s->hello_retry_request = SSL_HRR_PENDING; | |
1427 | return 1; | |
1428 | } | |
1429 | } else { | |
1430 | /* No suitable key_share */ | |
1431 | if (s->hello_retry_request == SSL_HRR_NONE && sent | |
1432 | && (!s->hit | |
1433 | || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) | |
1434 | != 0)) { | |
1435 | const uint16_t *pgroups, *clntgroups; | |
1436 | size_t num_groups, clnt_num_groups, i; | |
1437 | unsigned int group_id = 0; | |
1438 | ||
1439 | /* Check if a shared group exists */ | |
1440 | ||
1441 | /* Get the clients list of supported groups. */ | |
1442 | tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups); | |
1443 | tls1_get_supported_groups(s, &pgroups, &num_groups); | |
1444 | ||
1445 | /* | |
1446 | * Find the first group we allow that is also in client's list | |
1447 | */ | |
1448 | for (i = 0; i < num_groups; i++) { | |
1449 | group_id = pgroups[i]; | |
1450 | ||
1451 | if (check_in_list(s, group_id, clntgroups, clnt_num_groups, | |
16f0e91c | 1452 | 1)) |
c36001c3 MC |
1453 | break; |
1454 | } | |
1455 | ||
1456 | if (i < num_groups) { | |
1457 | /* A shared group exists so send a HelloRetryRequest */ | |
555cbb32 | 1458 | s->s3.group_id = group_id; |
c36001c3 MC |
1459 | s->hello_retry_request = SSL_HRR_PENDING; |
1460 | return 1; | |
1461 | } | |
1462 | } | |
1463 | if (!s->hit | |
1464 | || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0) { | |
1465 | /* Nothing left we can do - just fail */ | |
1466 | SSLfatal(s, sent ? SSL_AD_HANDSHAKE_FAILURE | |
1467 | : SSL_AD_MISSING_EXTENSION, | |
c48ffbcc | 1468 | SSL_R_NO_SUITABLE_KEY_SHARE); |
c36001c3 | 1469 | return 0; |
aff9929b MC |
1470 | } |
1471 | ||
555cbb32 | 1472 | if ((s->s3.flags & TLS1_FLAGS_STATELESS) != 0 |
c36001c3 MC |
1473 | && !s->ext.cookieok) { |
1474 | if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) { | |
1475 | /* | |
1476 | * If we are stateless then we wouldn't know about any | |
1477 | * previously sent HRR - so how can this be anything other | |
1478 | * than 0? | |
1479 | */ | |
c48ffbcc | 1480 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
c36001c3 MC |
1481 | return 0; |
1482 | } | |
fc7129dc | 1483 | s->hello_retry_request = SSL_HRR_PENDING; |
aff9929b MC |
1484 | return 1; |
1485 | } | |
1486 | } | |
c36001c3 MC |
1487 | |
1488 | /* | |
1489 | * We have a key_share so don't send any more HelloRetryRequest | |
1490 | * messages | |
1491 | */ | |
1492 | if (s->hello_retry_request == SSL_HRR_PENDING) | |
1493 | s->hello_retry_request = SSL_HRR_COMPLETE; | |
1494 | } else { | |
1495 | /* | |
1496 | * For a client side resumption with no key_share we need to generate | |
1497 | * the handshake secret (otherwise this is done during key_share | |
1498 | * processing). | |
1499 | */ | |
1500 | if (!sent && !tls13_generate_handshake_secret(s, NULL, 0)) { | |
c48ffbcc | 1501 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
aff9929b MC |
1502 | return 0; |
1503 | } | |
1504 | } | |
65dc5c3c | 1505 | #endif /* !defined(OPENSSL_NO_TLS1_3) */ |
f4bbb37c MC |
1506 | return 1; |
1507 | } | |
1508 | ||
38b051a1 | 1509 | static int init_psk_kex_modes(SSL_CONNECTION *s, unsigned int context) |
b2f7e8c0 MC |
1510 | { |
1511 | s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_NONE; | |
b2f7e8c0 MC |
1512 | return 1; |
1513 | } | |
1053a6e2 | 1514 | |
38b051a1 TM |
1515 | int tls_psk_do_binder(SSL_CONNECTION *s, const EVP_MD *md, |
1516 | const unsigned char *msgstart, | |
1053a6e2 | 1517 | size_t binderoffset, const unsigned char *binderin, |
3a7c56b2 MC |
1518 | unsigned char *binderout, SSL_SESSION *sess, int sign, |
1519 | int external) | |
1053a6e2 MC |
1520 | { |
1521 | EVP_PKEY *mackey = NULL; | |
1522 | EVP_MD_CTX *mctx = NULL; | |
1523 | unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE]; | |
1524 | unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE]; | |
4ff1a526 | 1525 | unsigned char *early_secret; |
44e47328 TS |
1526 | /* ASCII: "res binder", in hex for EBCDIC compatibility */ |
1527 | static const unsigned char resumption_label[] = "\x72\x65\x73\x20\x62\x69\x6E\x64\x65\x72"; | |
1528 | /* ASCII: "ext binder", in hex for EBCDIC compatibility */ | |
1529 | static const unsigned char external_label[] = "\x65\x78\x74\x20\x62\x69\x6E\x64\x65\x72"; | |
4ff1a526 MC |
1530 | const unsigned char *label; |
1531 | size_t bindersize, labelsize, hashsize; | |
ed576acd | 1532 | int hashsizei = EVP_MD_get_size(md); |
1053a6e2 | 1533 | int ret = -1; |
add8d0e9 | 1534 | int usepskfored = 0; |
38b051a1 | 1535 | SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); |
add8d0e9 | 1536 | |
bceae201 MC |
1537 | /* Ensure cast to size_t is safe */ |
1538 | if (!ossl_assert(hashsizei >= 0)) { | |
c48ffbcc | 1539 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
bceae201 MC |
1540 | goto err; |
1541 | } | |
1542 | hashsize = (size_t)hashsizei; | |
1543 | ||
add8d0e9 MC |
1544 | if (external |
1545 | && s->early_data_state == SSL_EARLY_DATA_CONNECTING | |
1546 | && s->session->ext.max_early_data == 0 | |
1547 | && sess->ext.max_early_data > 0) | |
1548 | usepskfored = 1; | |
1053a6e2 | 1549 | |
3a7c56b2 MC |
1550 | if (external) { |
1551 | label = external_label; | |
1552 | labelsize = sizeof(external_label) - 1; | |
1553 | } else { | |
1554 | label = resumption_label; | |
1555 | labelsize = sizeof(resumption_label) - 1; | |
1556 | } | |
1557 | ||
9368f865 MC |
1558 | /* |
1559 | * Generate the early_secret. On the server side we've selected a PSK to | |
1560 | * resume with (internal or external) so we always do this. On the client | |
add8d0e9 MC |
1561 | * side we do this for a non-external (i.e. resumption) PSK or external PSK |
1562 | * that will be used for early_data so that it is in place for sending early | |
1563 | * data. For client side external PSK not being used for early_data we | |
9368f865 MC |
1564 | * generate it but store it away for later use. |
1565 | */ | |
add8d0e9 | 1566 | if (s->server || !external || usepskfored) |
9368f865 MC |
1567 | early_secret = (unsigned char *)s->early_secret; |
1568 | else | |
1569 | early_secret = (unsigned char *)sess->early_secret; | |
4ff1a526 MC |
1570 | |
1571 | if (!tls13_generate_secret(s, md, NULL, sess->master_key, | |
1572 | sess->master_key_length, early_secret)) { | |
635c8f77 | 1573 | /* SSLfatal() already called */ |
1053a6e2 MC |
1574 | goto err; |
1575 | } | |
1576 | ||
1577 | /* | |
1578 | * Create the handshake hash for the binder key...the messages so far are | |
1579 | * empty! | |
1580 | */ | |
1581 | mctx = EVP_MD_CTX_new(); | |
1582 | if (mctx == NULL | |
1583 | || EVP_DigestInit_ex(mctx, md, NULL) <= 0 | |
1584 | || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { | |
c48ffbcc | 1585 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
1053a6e2 MC |
1586 | goto err; |
1587 | } | |
1588 | ||
1589 | /* Generate the binder key */ | |
4ff1a526 | 1590 | if (!tls13_hkdf_expand(s, md, early_secret, label, labelsize, hash, |
0fb2815b | 1591 | hashsize, binderkey, hashsize, 1)) { |
635c8f77 | 1592 | /* SSLfatal() already called */ |
1053a6e2 MC |
1593 | goto err; |
1594 | } | |
1595 | ||
1596 | /* Generate the finished key */ | |
1597 | if (!tls13_derive_finishedkey(s, md, binderkey, finishedkey, hashsize)) { | |
635c8f77 | 1598 | /* SSLfatal() already called */ |
1053a6e2 MC |
1599 | goto err; |
1600 | } | |
1601 | ||
aff9929b | 1602 | if (EVP_DigestInit_ex(mctx, md, NULL) <= 0) { |
c48ffbcc | 1603 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
aff9929b MC |
1604 | goto err; |
1605 | } | |
1606 | ||
1053a6e2 | 1607 | /* |
aff9929b MC |
1608 | * Get a hash of the ClientHello up to the start of the binders. If we are |
1609 | * following a HelloRetryRequest then this includes the hash of the first | |
1610 | * ClientHello and the HelloRetryRequest itself. | |
1053a6e2 | 1611 | */ |
fc7129dc | 1612 | if (s->hello_retry_request == SSL_HRR_PENDING) { |
aff9929b | 1613 | size_t hdatalen; |
60690b5b | 1614 | long hdatalen_l; |
aff9929b MC |
1615 | void *hdata; |
1616 | ||
60690b5b | 1617 | hdatalen = hdatalen_l = |
555cbb32 | 1618 | BIO_get_mem_data(s->s3.handshake_buffer, &hdata); |
60690b5b | 1619 | if (hdatalen_l <= 0) { |
c48ffbcc | 1620 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_LENGTH); |
aff9929b MC |
1621 | goto err; |
1622 | } | |
1623 | ||
1624 | /* | |
1625 | * For servers the handshake buffer data will include the second | |
1626 | * ClientHello - which we don't want - so we need to take that bit off. | |
1627 | */ | |
1628 | if (s->server) { | |
77815a02 MC |
1629 | PACKET hashprefix, msg; |
1630 | ||
1631 | /* Find how many bytes are left after the first two messages */ | |
1632 | if (!PACKET_buf_init(&hashprefix, hdata, hdatalen) | |
1633 | || !PACKET_forward(&hashprefix, 1) | |
1634 | || !PACKET_get_length_prefixed_3(&hashprefix, &msg) | |
1635 | || !PACKET_forward(&hashprefix, 1) | |
1636 | || !PACKET_get_length_prefixed_3(&hashprefix, &msg)) { | |
c48ffbcc | 1637 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
aff9929b MC |
1638 | goto err; |
1639 | } | |
77815a02 | 1640 | hdatalen -= PACKET_remaining(&hashprefix); |
aff9929b MC |
1641 | } |
1642 | ||
1643 | if (EVP_DigestUpdate(mctx, hdata, hdatalen) <= 0) { | |
c48ffbcc | 1644 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
aff9929b MC |
1645 | goto err; |
1646 | } | |
1647 | } | |
1648 | ||
1649 | if (EVP_DigestUpdate(mctx, msgstart, binderoffset) <= 0 | |
1053a6e2 | 1650 | || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { |
c48ffbcc | 1651 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
1053a6e2 MC |
1652 | goto err; |
1653 | } | |
1654 | ||
38b051a1 TM |
1655 | mackey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC", |
1656 | sctx->propq, finishedkey, | |
d8652be0 | 1657 | hashsize); |
1053a6e2 | 1658 | if (mackey == NULL) { |
c48ffbcc | 1659 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
1053a6e2 MC |
1660 | goto err; |
1661 | } | |
1662 | ||
1663 | if (!sign) | |
1664 | binderout = tmpbinder; | |
1665 | ||
1666 | bindersize = hashsize; | |
38b051a1 TM |
1667 | if (EVP_DigestSignInit_ex(mctx, NULL, EVP_MD_get0_name(md), sctx->libctx, |
1668 | sctx->propq, mackey, NULL) <= 0 | |
1053a6e2 MC |
1669 | || EVP_DigestSignUpdate(mctx, hash, hashsize) <= 0 |
1670 | || EVP_DigestSignFinal(mctx, binderout, &bindersize) <= 0 | |
1671 | || bindersize != hashsize) { | |
c48ffbcc | 1672 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
1053a6e2 MC |
1673 | goto err; |
1674 | } | |
1675 | ||
1676 | if (sign) { | |
1677 | ret = 1; | |
1678 | } else { | |
1679 | /* HMAC keys can't do EVP_DigestVerify* - use CRYPTO_memcmp instead */ | |
1680 | ret = (CRYPTO_memcmp(binderin, binderout, hashsize) == 0); | |
635c8f77 | 1681 | if (!ret) |
c48ffbcc | 1682 | SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BINDER_DOES_NOT_VERIFY); |
1053a6e2 MC |
1683 | } |
1684 | ||
1685 | err: | |
1686 | OPENSSL_cleanse(binderkey, sizeof(binderkey)); | |
1687 | OPENSSL_cleanse(finishedkey, sizeof(finishedkey)); | |
1688 | EVP_PKEY_free(mackey); | |
1689 | EVP_MD_CTX_free(mctx); | |
1690 | ||
1691 | return ret; | |
1692 | } | |
38df5a45 | 1693 | |
38b051a1 | 1694 | static int final_early_data(SSL_CONNECTION *s, unsigned int context, int sent) |
38df5a45 | 1695 | { |
4be3a7c7 MC |
1696 | if (!sent) |
1697 | return 1; | |
1698 | ||
1699 | if (!s->server) { | |
1700 | if (context == SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | |
1701 | && sent | |
1702 | && !s->ext.early_data_ok) { | |
1703 | /* | |
1704 | * If we get here then the server accepted our early_data but we | |
1705 | * later realised that it shouldn't have done (e.g. inconsistent | |
1706 | * ALPN) | |
1707 | */ | |
c48ffbcc | 1708 | SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EARLY_DATA); |
4be3a7c7 MC |
1709 | return 0; |
1710 | } | |
1711 | ||
38df5a45 | 1712 | return 1; |
4be3a7c7 | 1713 | } |
38df5a45 MC |
1714 | |
1715 | if (s->max_early_data == 0 | |
1716 | || !s->hit | |
38df5a45 MC |
1717 | || s->early_data_state != SSL_EARLY_DATA_ACCEPTING |
1718 | || !s->ext.early_data_ok | |
c9598459 | 1719 | || s->hello_retry_request != SSL_HRR_NONE |
59b2cb26 | 1720 | || (s->allow_early_data_cb != NULL |
38b051a1 | 1721 | && !s->allow_early_data_cb(SSL_CONNECTION_GET_SSL(s), |
59b2cb26 | 1722 | s->allow_early_data_cb_data))) { |
38df5a45 MC |
1723 | s->ext.early_data = SSL_EARLY_DATA_REJECTED; |
1724 | } else { | |
1725 | s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; | |
1726 | ||
1727 | if (!tls13_change_cipher_state(s, | |
1728 | SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
f63a17d6 | 1729 | /* SSLfatal() already called */ |
38df5a45 MC |
1730 | return 0; |
1731 | } | |
1732 | } | |
1733 | ||
1734 | return 1; | |
1735 | } | |
cf72c757 | 1736 | |
38b051a1 TM |
1737 | static int final_maxfragmentlen(SSL_CONNECTION *s, unsigned int context, |
1738 | int sent) | |
cf72c757 F |
1739 | { |
1740 | /* | |
1741 | * Session resumption on server-side with MFL extension active | |
1742 | * BUT MFL extension packet was not resent (i.e. sent == 0) | |
1743 | */ | |
f63a17d6 | 1744 | if (s->server && s->hit && USE_MAX_FRAGMENT_LENGTH_EXT(s->session) |
cf72c757 | 1745 | && !sent ) { |
c48ffbcc | 1746 | SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_R_BAD_EXTENSION); |
cf72c757 F |
1747 | return 0; |
1748 | } | |
1749 | ||
435d88d7 MC |
1750 | if (s->session && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)) { |
1751 | s->rlayer.rrlmethod->set_max_frag_len(s->rlayer.rrl, | |
1752 | GET_MAX_FRAGMENT_LENGTH(s->session)); | |
1753 | s->rlayer.wrlmethod->set_max_frag_len(s->rlayer.wrl, | |
1754 | ssl_get_max_send_fragment(s)); | |
435d88d7 | 1755 | } |
cf72c757 F |
1756 | |
1757 | return 1; | |
1758 | } | |
9d75dce3 | 1759 | |
38b051a1 TM |
1760 | static int init_post_handshake_auth(SSL_CONNECTION *s, |
1761 | ossl_unused unsigned int context) | |
9d75dce3 TS |
1762 | { |
1763 | s->post_handshake_auth = SSL_PHA_NONE; | |
1764 | ||
1765 | return 1; | |
1766 | } | |
efe0f315 BK |
1767 | |
1768 | /* | |
1769 | * If clients offer "pre_shared_key" without a "psk_key_exchange_modes" | |
1770 | * extension, servers MUST abort the handshake. | |
1771 | */ | |
38b051a1 | 1772 | static int final_psk(SSL_CONNECTION *s, unsigned int context, int sent) |
efe0f315 BK |
1773 | { |
1774 | if (s->server && sent && s->clienthello != NULL | |
1775 | && !s->clienthello->pre_proc_exts[TLSEXT_IDX_psk_kex_modes].present) { | |
1776 | SSLfatal(s, TLS13_AD_MISSING_EXTENSION, | |
1777 | SSL_R_MISSING_PSK_KEX_MODES_EXTENSION); | |
1778 | return 0; | |
1779 | } | |
1780 | ||
1781 | return 1; | |
1782 | } | |
b67cb09f TS |
1783 | |
1784 | static int tls_init_compress_certificate(SSL_CONNECTION *sc, unsigned int context) | |
1785 | { | |
1786 | memset(sc->ext.compress_certificate_from_peer, 0, | |
1787 | sizeof(sc->ext.compress_certificate_from_peer)); | |
1788 | return 1; | |
1789 | } | |
1790 | ||
1791 | /* The order these are put into the packet imply a preference order: [brotli, zlib, zstd] */ | |
1792 | static EXT_RETURN tls_construct_compress_certificate(SSL_CONNECTION *sc, WPACKET *pkt, | |
1793 | unsigned int context, | |
1794 | X509 *x, size_t chainidx) | |
1795 | { | |
1796 | #ifndef OPENSSL_NO_COMP_ALG | |
1797 | int i; | |
1798 | ||
1799 | if (!ossl_comp_has_alg(0)) | |
1800 | return EXT_RETURN_NOT_SENT; | |
1801 | ||
3c95ef22 TS |
1802 | /* Server: Don't attempt to compress a non-X509 (i.e. an RPK) */ |
1803 | if (sc->server && sc->ext.server_cert_type != TLSEXT_cert_type_x509) { | |
1804 | sc->cert_comp_prefs[0] = TLSEXT_comp_cert_none; | |
1805 | return EXT_RETURN_NOT_SENT; | |
1806 | } | |
1807 | ||
1808 | /* Client: If we sent a client cert-type extension, don't indicate compression */ | |
1809 | if (!sc->server && sc->ext.client_cert_type_ctos) { | |
1810 | sc->cert_comp_prefs[0] = TLSEXT_comp_cert_none; | |
1811 | return EXT_RETURN_NOT_SENT; | |
1812 | } | |
1813 | ||
b67cb09f TS |
1814 | /* Do not indicate we support receiving compressed certificates */ |
1815 | if ((sc->options & SSL_OP_NO_RX_CERTIFICATE_COMPRESSION) != 0) | |
1816 | return EXT_RETURN_NOT_SENT; | |
1817 | ||
1818 | if (sc->cert_comp_prefs[0] == TLSEXT_comp_cert_none) | |
1819 | return EXT_RETURN_NOT_SENT; | |
1820 | ||
1821 | if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_compress_certificate) | |
1822 | || !WPACKET_start_sub_packet_u16(pkt) | |
1823 | || !WPACKET_start_sub_packet_u8(pkt)) | |
1824 | goto err; | |
1825 | ||
1826 | for (i = 0; sc->cert_comp_prefs[i] != TLSEXT_comp_cert_none; i++) { | |
1827 | if (!WPACKET_put_bytes_u16(pkt, sc->cert_comp_prefs[i])) | |
1828 | goto err; | |
1829 | } | |
1830 | if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) | |
1831 | goto err; | |
1832 | ||
1833 | sc->ext.compress_certificate_sent = 1; | |
1834 | return EXT_RETURN_SENT; | |
1835 | err: | |
1836 | SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
1837 | return EXT_RETURN_FAIL; | |
1838 | #else | |
1839 | return EXT_RETURN_NOT_SENT; | |
1840 | #endif | |
1841 | } | |
1842 | ||
1843 | #ifndef OPENSSL_NO_COMP_ALG | |
1844 | static int tls_comp_in_pref(SSL_CONNECTION *sc, int alg) | |
1845 | { | |
1846 | int i; | |
1847 | ||
1848 | /* ossl_comp_has_alg() considers 0 as "any" */ | |
1849 | if (alg == 0) | |
1850 | return 0; | |
1851 | /* Make sure algorithm is enabled */ | |
1852 | if (!ossl_comp_has_alg(alg)) | |
1853 | return 0; | |
1854 | /* If no preferences are set, it's ok */ | |
1855 | if (sc->cert_comp_prefs[0] == TLSEXT_comp_cert_none) | |
1856 | return 1; | |
1857 | /* Find the algorithm */ | |
1858 | for (i = 0; i < TLSEXT_comp_cert_limit; i++) | |
1859 | if (sc->cert_comp_prefs[i] == alg) | |
1860 | return 1; | |
1861 | return 0; | |
1862 | } | |
1863 | #endif | |
1864 | ||
1865 | int tls_parse_compress_certificate(SSL_CONNECTION *sc, PACKET *pkt, unsigned int context, | |
1866 | X509 *x, size_t chainidx) | |
1867 | { | |
1868 | #ifndef OPENSSL_NO_COMP_ALG | |
1869 | PACKET supported_comp_algs; | |
1870 | unsigned int comp; | |
1871 | int already_set[TLSEXT_comp_cert_limit]; | |
1872 | int j = 0; | |
1873 | ||
1874 | /* If no algorithms are available, ignore the extension */ | |
1875 | if (!ossl_comp_has_alg(0)) | |
1876 | return 1; | |
1877 | ||
3c95ef22 TS |
1878 | /* Don't attempt to compress a non-X509 (i.e. an RPK) */ |
1879 | if (sc->server && sc->ext.server_cert_type != TLSEXT_cert_type_x509) | |
1880 | return 1; | |
1881 | if (!sc->server && sc->ext.client_cert_type != TLSEXT_cert_type_x509) | |
1882 | return 1; | |
1883 | ||
b67cb09f TS |
1884 | /* Ignore the extension and don't send compressed certificates */ |
1885 | if ((sc->options & SSL_OP_NO_TX_CERTIFICATE_COMPRESSION) != 0) | |
1886 | return 1; | |
1887 | ||
1888 | if (!PACKET_as_length_prefixed_1(pkt, &supported_comp_algs) | |
1889 | || PACKET_remaining(&supported_comp_algs) == 0) { | |
1890 | SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION); | |
1891 | return 0; | |
1892 | } | |
1893 | ||
1894 | memset(already_set, 0, sizeof(already_set)); | |
1895 | /* | |
1896 | * The preference array has real values, so take a look at each | |
1897 | * value coming in, and make sure it's in our preference list | |
1898 | * The array is 0 (i.e. "none") terminated | |
1899 | * The preference list only contains supported algorithms | |
1900 | */ | |
ce74e3fb | 1901 | while (PACKET_get_net_2(&supported_comp_algs, &comp)) { |
b67cb09f TS |
1902 | if (tls_comp_in_pref(sc, comp) && !already_set[comp]) { |
1903 | sc->ext.compress_certificate_from_peer[j++] = comp; | |
1904 | already_set[comp] = 1; | |
1905 | } | |
1906 | } | |
1907 | #endif | |
1908 | return 1; | |
1909 | } | |
3c95ef22 TS |
1910 | |
1911 | static int init_server_cert_type(SSL_CONNECTION *sc, unsigned int context) | |
1912 | { | |
1913 | /* Only reset when parsing client hello */ | |
1914 | if (sc->server) { | |
1915 | sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; | |
1916 | sc->ext.server_cert_type = TLSEXT_cert_type_x509; | |
1917 | } | |
1918 | return 1; | |
1919 | } | |
1920 | ||
1921 | static int init_client_cert_type(SSL_CONNECTION *sc, unsigned int context) | |
1922 | { | |
1923 | /* Only reset when parsing client hello */ | |
1924 | if (sc->server) { | |
1925 | sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE; | |
1926 | sc->ext.client_cert_type = TLSEXT_cert_type_x509; | |
1927 | } | |
1928 | return 1; | |
1929 | } |