]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/statem/statem_srvr.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Harmonise setting the header and closing construction
[thirdparty/openssl.git] / ssl / statem / statem_srvr.c
CommitLineData
846e33c7
RS		 1/*
2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
8e2f6b79 3 *
846e33c7
RS		 4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8e2f6b79 8 */
846e33c7 9
ea262260
BM		 10/* ====================================================================
11 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
12 *
0f113f3e 13 * Portions of the attached software ("Contribution") are developed by
ea262260
BM		 14 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
15 *
16 * The Contribution is licensed pursuant to the OpenSSL open source
17 * license provided above.
18 *
ea262260
BM		 19 * ECC cipher suite support in OpenSSL originally written by
20 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
21 *
22 */
ddac1974
NL		 23/* ====================================================================
24 * Copyright 2005 Nokia. All rights reserved.
25 *
26 * The portions of the attached software ("Contribution") is developed by
27 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
28 * license.
29 *
30 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
31 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
32 * support (see RFC 4279) to OpenSSL.
33 *
34 * No patent licenses or other rights except those expressly stated in
35 * the OpenSSL open source license shall be deemed granted or received
36 * expressly, by implication, estoppel, or otherwise.
37 *
38 * No assurances are provided by Nokia that the Contribution does not
39 * infringe the patent or other intellectual property rights of any third
40 * party or that the license provides you with all the necessary rights
41 * to make use of the Contribution.
42 *
43 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
44 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
45 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
46 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
47 * OTHERWISE.
48 */
d02b48c6 49
d02b48c6 50#include <stdio.h>
8ba708e5 51#include "../ssl_locl.h"
61ae935a 52#include "statem_locl.h"
68570797 53#include "internal/constant_time_locl.h"
ec577822
BM		 54#include <openssl/buffer.h>
55#include <openssl/rand.h>
56#include <openssl/objects.h>
57#include <openssl/evp.h>
6434abbf 58#include <openssl/hmac.h>
ec577822 59#include <openssl/x509.h>
3c27208f 60#include <openssl/dh.h>
d095b68d 61#include <openssl/bn.h>
dbad1690 62#include <openssl/md5.h>
f9b3bff6 63
38a3cbfb
EK		 64static STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,
65 PACKET *cipher_suites,
a230b26e
EK		 66 STACK_OF(SSL_CIPHER)
67 **skp, int sslv2format,
68 int *al);
d45ba43d 69
61ae935a
MC		 70/*
71 * server_read_transition() encapsulates the logic for the allowed handshake
72 * state transitions when the server is reading messages from the client. The
73 * message type that the client has sent is provided in |mt|. The current state
74 * is in |s->statem.hand_state|.
75 *
76 * Valid return values are:
77 * 1: Success (transition allowed)
78 * 0: Error (transition not allowed)
79 */
8481f583 80int ossl_statem_server_read_transition(SSL *s, int mt)
61ae935a 81{
d6f1a6e9 82 OSSL_STATEM *st = &s->statem;
61ae935a 83
e8aa8b6c 84 switch (st->hand_state) {
f3b3d7f0
RS		 85 default:
86 break;
87
61ae935a
MC		 88 case TLS_ST_BEFORE:
89 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
90 if (mt == SSL3_MT_CLIENT_HELLO) {
91 st->hand_state = TLS_ST_SR_CLNT_HELLO;
92 return 1;
93 }
94 break;
95
96 case TLS_ST_SW_SRVR_DONE:
97 /*
98 * If we get a CKE message after a ServerDone then either
99 * 1) We didn't request a Certificate
100 * OR
101 * 2) If we did request one then
102 * a) We allow no Certificate to be returned
103 * AND
104 * b) We are running SSL3 (in TLS1.0+ the client must return a 0
105 * list if we requested a certificate)
106 */
0f512756
MC		 107 if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) {
108 if (s->s3->tmp.cert_request) {
109 if (s->version == SSL3_VERSION) {
23dd09b5
MC		 110 if ((s->verify_mode & SSL_VERIFY_PEER)
111 && (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
0f512756
MC		 112 /*
113 * This isn't an unexpected message as such - we're just
23dd09b5
MC		 114 * not going to accept it because we require a client
115 * cert.
0f512756
MC		 116 */
117 ssl3_send_alert(s, SSL3_AL_FATAL,
118 SSL3_AD_HANDSHAKE_FAILURE);
340a2828 119 SSLerr(SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION,
0f512756
MC		 120 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
121 return 0;
122 }
123 st->hand_state = TLS_ST_SR_KEY_EXCH;
124 return 1;
125 }
126 } else {
127 st->hand_state = TLS_ST_SR_KEY_EXCH;
128 return 1;
129 }
61ae935a
MC		 130 } else if (s->s3->tmp.cert_request) {
131 if (mt == SSL3_MT_CERTIFICATE) {
132 st->hand_state = TLS_ST_SR_CERT;
133 return 1;
f100b031 134 }
61ae935a
MC		 135 }
136 break;
137
138 case TLS_ST_SR_CERT:
139 if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) {
140 st->hand_state = TLS_ST_SR_KEY_EXCH;
141 return 1;
142 }
143 break;
144
145 case TLS_ST_SR_KEY_EXCH:
146 /*
147 * We should only process a CertificateVerify message if we have
148 * received a Certificate from the client. If so then |s->session->peer|
149 * will be non NULL. In some instances a CertificateVerify message is
150 * not required even if the peer has sent a Certificate (e.g. such as in
a71a4966 151 * the case of static DH). In that case |st->no_cert_verify| should be
61ae935a
MC		 152 * set.
153 */
a71a4966 154 if (s->session->peer == NULL || st->no_cert_verify) {
61ae935a
MC		 155 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
156 /*
157 * For the ECDH ciphersuites when the client sends its ECDH
158 * pub key in a certificate, the CertificateVerify message is
159 * not sent. Also for GOST ciphersuites when the client uses
160 * its key from the certificate for key exchange.
161 */
162 st->hand_state = TLS_ST_SR_CHANGE;
163 return 1;
164 }
165 } else {
166 if (mt == SSL3_MT_CERTIFICATE_VERIFY) {
167 st->hand_state = TLS_ST_SR_CERT_VRFY;
168 return 1;
169 }
170 }
171 break;
172
173 case TLS_ST_SR_CERT_VRFY:
174 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
175 st->hand_state = TLS_ST_SR_CHANGE;
176 return 1;
177 }
178 break;
179
180 case TLS_ST_SR_CHANGE:
181#ifndef OPENSSL_NO_NEXTPROTONEG
182 if (s->s3->next_proto_neg_seen) {
183 if (mt == SSL3_MT_NEXT_PROTO) {
184 st->hand_state = TLS_ST_SR_NEXT_PROTO;
185 return 1;
186 }
187 } else {
188#endif
189 if (mt == SSL3_MT_FINISHED) {
190 st->hand_state = TLS_ST_SR_FINISHED;
191 return 1;
192 }
193#ifndef OPENSSL_NO_NEXTPROTONEG
194 }
195#endif
196 break;
197
198#ifndef OPENSSL_NO_NEXTPROTONEG
199 case TLS_ST_SR_NEXT_PROTO:
200 if (mt == SSL3_MT_FINISHED) {
201 st->hand_state = TLS_ST_SR_FINISHED;
202 return 1;
203 }
204 break;
205#endif
206
207 case TLS_ST_SW_FINISHED:
208 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
209 st->hand_state = TLS_ST_SR_CHANGE;
210 return 1;
211 }
212 break;
61ae935a
MC		 213 }
214
215 /* No valid transition found */
672f3337 216 ssl3_send_alert(s, SSL3_AL_FATAL, SSL3_AD_UNEXPECTED_MESSAGE);
340a2828 217 SSLerr(SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION, SSL_R_UNEXPECTED_MESSAGE);
61ae935a
MC		 218 return 0;
219}
220
221/*
222 * Should we send a ServerKeyExchange message?
223 *
224 * Valid return values are:
225 * 1: Yes
226 * 0: No
227 */
bb3e20cf 228static int send_server_key_exchange(SSL *s)
61ae935a
MC		 229{
230 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
231
232 /*
361a1191 233 * only send a ServerKeyExchange if DH or fortezza but we have a
61ae935a
MC		 234 * sign only certificate PSK: may send PSK identity hints For
235 * ECC ciphersuites, we send a serverKeyExchange message only if
236 * the cipher suite is either ECDH-anon or ECDHE. In other cases,
237 * the server certificate contains the server's public key for
238 * key exchange.
239 */
a230b26e 240 if (alg_k & (SSL_kDHE | SSL_kECDHE)
61ae935a
MC		 241 /*
242 * PSK: send ServerKeyExchange if PSK identity hint if
243 * provided
244 */
245#ifndef OPENSSL_NO_PSK
246 /* Only send SKE if we have identity hint for plain PSK */
247 || ((alg_k & (SSL_kPSK | SSL_kRSAPSK))
248 && s->cert->psk_identity_hint)
249 /* For other PSK always send SKE */
250 || (alg_k & (SSL_PSK & (SSL_kDHEPSK | SSL_kECDHEPSK)))
251#endif
252#ifndef OPENSSL_NO_SRP
253 /* SRP: send ServerKeyExchange */
254 || (alg_k & SSL_kSRP)
255#endif
a230b26e 256 ) {
61ae935a
MC		 257 return 1;
258 }
259
260 return 0;
261}
262
263/*
264 * Should we send a CertificateRequest message?
265 *
266 * Valid return values are:
267 * 1: Yes
268 * 0: No
269 */
bb3e20cf 270static int send_certificate_request(SSL *s)
61ae935a
MC		 271{
272 if (
273 /* don't request cert unless asked for it: */
274 s->verify_mode & SSL_VERIFY_PEER
275 /*
276 * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert
277 * during re-negotiation:
278 */
279 && ((s->session->peer == NULL) ||
280 !(s->verify_mode & SSL_VERIFY_CLIENT_ONCE))
281 /*
282 * never request cert in anonymous ciphersuites (see
283 * section "Certificate request" in SSL 3 drafts and in
284 * RFC 2246):
285 */
286 && (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
a230b26e
EK		 287 /*
288 * ... except when the application insists on
289 * verification (against the specs, but statem_clnt.c accepts
290 * this for SSL 3)
291 */
61ae935a
MC		 292 || (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
293 /* don't request certificate for SRP auth */
294 && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP)
295 /*
296 * With normal PSK Certificates and Certificate Requests
297 * are omitted
298 */
b7fa1f98 299 && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aPSK)) {
61ae935a
MC		 300 return 1;
301 }
302
303 return 0;
304}
305
306/*
307 * server_write_transition() works out what handshake state to move to next
308 * when the server is writing messages to be sent to the client.
309 */
8481f583 310WRITE_TRAN ossl_statem_server_write_transition(SSL *s)
61ae935a 311{
d6f1a6e9 312 OSSL_STATEM *st = &s->statem;
61ae935a 313
e8aa8b6c 314 switch (st->hand_state) {
f3b3d7f0
RS		 315 default:
316 /* Shouldn't happen */
317 return WRITE_TRAN_ERROR;
318
e8aa8b6c 319 case TLS_ST_BEFORE:
a230b26e 320 /* Just go straight to trying to read from the client */
e8aa8b6c 321 return WRITE_TRAN_FINISHED;
61ae935a 322
e8aa8b6c
F		 323 case TLS_ST_OK:
324 /* We must be trying to renegotiate */
325 st->hand_state = TLS_ST_SW_HELLO_REQ;
326 return WRITE_TRAN_CONTINUE;
61ae935a 327
e8aa8b6c
F		 328 case TLS_ST_SW_HELLO_REQ:
329 st->hand_state = TLS_ST_OK;
330 ossl_statem_set_in_init(s, 0);
331 return WRITE_TRAN_CONTINUE;
61ae935a 332
e8aa8b6c
F		 333 case TLS_ST_SR_CLNT_HELLO:
334 if (SSL_IS_DTLS(s) && !s->d1->cookie_verified
a230b26e 335 && (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE))
e8aa8b6c
F		 336 st->hand_state = DTLS_ST_SW_HELLO_VERIFY_REQUEST;
337 else
338 st->hand_state = TLS_ST_SW_SRVR_HELLO;
339 return WRITE_TRAN_CONTINUE;
61ae935a 340
e8aa8b6c
F		 341 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
342 return WRITE_TRAN_FINISHED;
61ae935a 343
e8aa8b6c
F		 344 case TLS_ST_SW_SRVR_HELLO:
345 if (s->hit) {
346 if (s->tlsext_ticket_expected)
347 st->hand_state = TLS_ST_SW_SESSION_TICKET;
348 else
349 st->hand_state = TLS_ST_SW_CHANGE;
350 } else {
351 /* Check if it is anon DH or anon ECDH, */
352 /* normal PSK or SRP */
353 if (!(s->s3->tmp.new_cipher->algorithm_auth &
a230b26e 354 (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {
e8aa8b6c
F		 355 st->hand_state = TLS_ST_SW_CERT;
356 } else if (send_server_key_exchange(s)) {
61ae935a 357 st->hand_state = TLS_ST_SW_KEY_EXCH;
e8aa8b6c 358 } else if (send_certificate_request(s)) {
61ae935a 359 st->hand_state = TLS_ST_SW_CERT_REQ;
e8aa8b6c
F		 360 } else {
361 st->hand_state = TLS_ST_SW_SRVR_DONE;
61ae935a 362 }
e8aa8b6c
F		 363 }
364 return WRITE_TRAN_CONTINUE;
61ae935a 365
e8aa8b6c
F		 366 case TLS_ST_SW_CERT:
367 if (s->tlsext_status_expected) {
368 st->hand_state = TLS_ST_SW_CERT_STATUS;
61ae935a 369 return WRITE_TRAN_CONTINUE;
e8aa8b6c
F		 370 }
371 /* Fall through */
61ae935a 372
e8aa8b6c
F		 373 case TLS_ST_SW_CERT_STATUS:
374 if (send_server_key_exchange(s)) {
375 st->hand_state = TLS_ST_SW_KEY_EXCH;
61ae935a 376 return WRITE_TRAN_CONTINUE;
e8aa8b6c
F		 377 }
378 /* Fall through */
61ae935a 379
e8aa8b6c
F		 380 case TLS_ST_SW_KEY_EXCH:
381 if (send_certificate_request(s)) {
382 st->hand_state = TLS_ST_SW_CERT_REQ;
61ae935a 383 return WRITE_TRAN_CONTINUE;
e8aa8b6c
F		 384 }
385 /* Fall through */
61ae935a 386
e8aa8b6c
F		 387 case TLS_ST_SW_CERT_REQ:
388 st->hand_state = TLS_ST_SW_SRVR_DONE;
389 return WRITE_TRAN_CONTINUE;
61ae935a 390
e8aa8b6c
F		 391 case TLS_ST_SW_SRVR_DONE:
392 return WRITE_TRAN_FINISHED;
393
394 case TLS_ST_SR_FINISHED:
395 if (s->hit) {
61ae935a 396 st->hand_state = TLS_ST_OK;
fe3a3291 397 ossl_statem_set_in_init(s, 0);
61ae935a 398 return WRITE_TRAN_CONTINUE;
e8aa8b6c
F		 399 } else if (s->tlsext_ticket_expected) {
400 st->hand_state = TLS_ST_SW_SESSION_TICKET;
401 } else {
402 st->hand_state = TLS_ST_SW_CHANGE;
403 }
404 return WRITE_TRAN_CONTINUE;
405
406 case TLS_ST_SW_SESSION_TICKET:
407 st->hand_state = TLS_ST_SW_CHANGE;
408 return WRITE_TRAN_CONTINUE;
61ae935a 409
e8aa8b6c
F		 410 case TLS_ST_SW_CHANGE:
411 st->hand_state = TLS_ST_SW_FINISHED;
412 return WRITE_TRAN_CONTINUE;
413
414 case TLS_ST_SW_FINISHED:
415 if (s->hit) {
416 return WRITE_TRAN_FINISHED;
417 }
418 st->hand_state = TLS_ST_OK;
419 ossl_statem_set_in_init(s, 0);
420 return WRITE_TRAN_CONTINUE;
61ae935a
MC		 421 }
422}
423
424/*
425 * Perform any pre work that needs to be done prior to sending a message from
426 * the server to the client.
427 */
8481f583 428WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst)
61ae935a 429{
d6f1a6e9 430 OSSL_STATEM *st = &s->statem;
61ae935a 431
e8aa8b6c 432 switch (st->hand_state) {
f3b3d7f0
RS		 433 default:
434 /* No pre work to be done */
435 break;
436
61ae935a
MC		 437 case TLS_ST_SW_HELLO_REQ:
438 s->shutdown = 0;
439 if (SSL_IS_DTLS(s))
f5c7f5df 440 dtls1_clear_sent_buffer(s);
61ae935a
MC		 441 break;
442
443 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
444 s->shutdown = 0;
445 if (SSL_IS_DTLS(s)) {
f5c7f5df 446 dtls1_clear_sent_buffer(s);
61ae935a
MC		 447 /* We don't buffer this message so don't use the timer */
448 st->use_timer = 0;
449 }
450 break;
451
452 case TLS_ST_SW_SRVR_HELLO:
453 if (SSL_IS_DTLS(s)) {
454 /*
455 * Messages we write from now on should be bufferred and
456 * retransmitted if necessary, so we need to use the timer now
457 */
458 st->use_timer = 1;
459 }
460 break;
461
462 case TLS_ST_SW_SRVR_DONE:
463#ifndef OPENSSL_NO_SCTP
464 if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s)))
465 return dtls_wait_for_dry(s);
466#endif
467 return WORK_FINISHED_CONTINUE;
468
469 case TLS_ST_SW_SESSION_TICKET:
470 if (SSL_IS_DTLS(s)) {
471 /*
472 * We're into the last flight. We don't retransmit the last flight
473 * unless we need to, so we don't use the timer
474 */
475 st->use_timer = 0;
476 }
477 break;
478
479 case TLS_ST_SW_CHANGE:
480 s->session->cipher = s->s3->tmp.new_cipher;
481 if (!s->method->ssl3_enc->setup_key_block(s)) {
fe3a3291 482 ossl_statem_set_error(s);
61ae935a
MC		 483 return WORK_ERROR;
484 }
485 if (SSL_IS_DTLS(s)) {
486 /*
487 * We're into the last flight. We don't retransmit the last flight
488 * unless we need to, so we don't use the timer. This might have
489 * already been set to 0 if we sent a NewSessionTicket message,
490 * but we'll set it again here in case we didn't.
491 */
492 st->use_timer = 0;
493 }
494 return WORK_FINISHED_CONTINUE;
495
496 case TLS_ST_OK:
497 return tls_finish_handshake(s, wst);
61ae935a
MC		 498 }
499
500 return WORK_FINISHED_CONTINUE;
501}
502
503/*
504 * Perform any work that needs to be done after sending a message from the
505 * server to the client.
506 */
8481f583 507WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst)
61ae935a 508{
d6f1a6e9 509 OSSL_STATEM *st = &s->statem;
61ae935a
MC		 510
511 s->init_num = 0;
512
e8aa8b6c 513 switch (st->hand_state) {
f3b3d7f0
RS		 514 default:
515 /* No post work to be done */
516 break;
517
61ae935a
MC		 518 case TLS_ST_SW_HELLO_REQ:
519 if (statem_flush(s) != 1)
520 return WORK_MORE_A;
2c4a056f
MC		 521 if (!ssl3_init_finished_mac(s)) {
522 ossl_statem_set_error(s);
523 return WORK_ERROR;
524 }
61ae935a
MC		 525 break;
526
527 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
528 if (statem_flush(s) != 1)
529 return WORK_MORE_A;
530 /* HelloVerifyRequest resets Finished MAC */
2c4a056f
MC		 531 if (s->version != DTLS1_BAD_VER && !ssl3_init_finished_mac(s)) {
532 ossl_statem_set_error(s);
533 return WORK_ERROR;
534 }
61ae935a
MC		 535 /*
536 * The next message should be another ClientHello which we need to
537 * treat like it was the first packet
538 */
539 s->first_packet = 1;
540 break;
541
542 case TLS_ST_SW_SRVR_HELLO:
543#ifndef OPENSSL_NO_SCTP
544 if (SSL_IS_DTLS(s) && s->hit) {
545 unsigned char sctpauthkey[64];
546 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
547
548 /*
549 * Add new shared key for SCTP-Auth, will be ignored if no
550 * SCTP used.
551 */
141eb8c6
MC		 552 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
553 sizeof(DTLS1_SCTP_AUTH_LABEL));
61ae935a
MC		 554
555 if (SSL_export_keying_material(s, sctpauthkey,
a230b26e
EK		 556 sizeof(sctpauthkey), labelbuffer,
557 sizeof(labelbuffer), NULL, 0,
558 0) <= 0) {
fe3a3291 559 ossl_statem_set_error(s);
61ae935a
MC		 560 return WORK_ERROR;
561 }
562
563 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
564 sizeof(sctpauthkey), sctpauthkey);
565 }
566#endif
567 break;
568
569 case TLS_ST_SW_CHANGE:
570#ifndef OPENSSL_NO_SCTP
571 if (SSL_IS_DTLS(s) && !s->hit) {
572 /*
573 * Change to new shared key of SCTP-Auth, will be ignored if
574 * no SCTP used.
575 */
576 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
577 0, NULL);
578 }
579#endif
580 if (!s->method->ssl3_enc->change_cipher_state(s,
a230b26e
EK		 581 SSL3_CHANGE_CIPHER_SERVER_WRITE))
582 {
fe3a3291 583 ossl_statem_set_error(s);
61ae935a
MC		 584 return WORK_ERROR;
585 }
586
587 if (SSL_IS_DTLS(s))
588 dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
589 break;
590
591 case TLS_ST_SW_SRVR_DONE:
592 if (statem_flush(s) != 1)
593 return WORK_MORE_A;
594 break;
595
596 case TLS_ST_SW_FINISHED:
597 if (statem_flush(s) != 1)
598 return WORK_MORE_A;
599#ifndef OPENSSL_NO_SCTP
600 if (SSL_IS_DTLS(s) && s->hit) {
601 /*
602 * Change to new shared key of SCTP-Auth, will be ignored if
603 * no SCTP used.
604 */
605 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
606 0, NULL);
607 }
608#endif
609 break;
61ae935a
MC		 610 }
611
612 return WORK_FINISHED_CONTINUE;
613}
614
615/*
616 * Construct a message to be sent from the server to the client.
617 *
618 * Valid return values are:
619 * 1: Success
620 * 0: Error
621 */
7cea05dc 622int ossl_statem_server_construct_message(SSL *s, WPACKET *pkt)
61ae935a 623{
d6f1a6e9 624 OSSL_STATEM *st = &s->statem;
5923ad4b
MC		 625 int (*confunc) (SSL *s, WPACKET *pkt) = NULL;
626 int ret = 1, mt;
61ae935a 627
4a01c59f
MC		 628 switch (st->hand_state) {
629 default:
630 /* Shouldn't happen */
631 return 0;
632
633 case TLS_ST_SW_CHANGE:
5923ad4b 634 if (SSL_IS_DTLS(s))
4a01c59f
MC		 635 confunc = dtls_construct_change_cipher_spec;
636 else
637 confunc = tls_construct_change_cipher_spec;
638 mt = SSL3_MT_CHANGE_CIPHER_SPEC;
639 break;
f3b3d7f0 640
4a01c59f
MC		 641 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
642 confunc = dtls_construct_hello_verify_request;
643 mt = DTLS1_MT_HELLO_VERIFY_REQUEST;
644 break;
61ae935a 645
4a01c59f
MC		 646 case TLS_ST_SW_HELLO_REQ:
647 /* No construction function needed */
648 mt = SSL3_MT_HELLO_REQUEST;
649 break;
61ae935a 650
4a01c59f
MC		 651 case TLS_ST_SW_SRVR_HELLO:
652 confunc = tls_construct_server_hello;
653 mt = SSL3_MT_SERVER_HELLO;
654 break;
61ae935a 655
4a01c59f
MC		 656 case TLS_ST_SW_CERT:
657 confunc = tls_construct_server_certificate;
658 mt = SSL3_MT_CERTIFICATE;
659 break;
61ae935a 660
4a01c59f
MC		 661 case TLS_ST_SW_KEY_EXCH:
662 confunc = tls_construct_server_key_exchange;
663 mt = SSL3_MT_SERVER_KEY_EXCHANGE;
664 break;
61ae935a 665
4a01c59f
MC		 666 case TLS_ST_SW_CERT_REQ:
667 confunc = tls_construct_certificate_request;
668 mt = SSL3_MT_CERTIFICATE_REQUEST;
669 break;
61ae935a 670
4a01c59f
MC		 671 case TLS_ST_SW_SRVR_DONE:
672 confunc = tls_construct_server_done;
673 mt = SSL3_MT_SERVER_DONE;
674 break;
61ae935a 675
4a01c59f
MC		 676 case TLS_ST_SW_SESSION_TICKET:
677 confunc = tls_construct_new_session_ticket;
678 mt = SSL3_MT_NEWSESSION_TICKET;
679 break;
61ae935a 680
4a01c59f
MC		 681 case TLS_ST_SW_CERT_STATUS:
682 confunc = tls_construct_cert_status;
683 mt = SSL3_MT_CERTIFICATE_STATUS;
684 break;
61ae935a 685
4a01c59f
MC		 686 case TLS_ST_SW_FINISHED:
687 mt = SSL3_MT_FINISHED;
688 break;
689 }
61ae935a 690
4a01c59f
MC		 691 if (!ssl_set_handshake_header(s, pkt, mt)) {
692 SSLerr(SSL_F_OSSL_STATEM_SERVER_CONSTRUCT_MESSAGE,
693 ERR_R_INTERNAL_ERROR);
694 return 0;
695 }
5923ad4b 696
4a01c59f
MC		 697 if (st->hand_state == TLS_ST_SW_FINISHED)
698 ret = tls_construct_finished(s, pkt,
699 s->method->
700 ssl3_enc->server_finished_label,
701 s->method->
702 ssl3_enc->server_finished_label_len);
703 else if (confunc != NULL)
704 ret = confunc(s, pkt);
5923ad4b 705
4a01c59f
MC		 706 if (!ret || !ssl_close_construct_packet(s, pkt, mt)) {
707 SSLerr(SSL_F_OSSL_STATEM_SERVER_CONSTRUCT_MESSAGE,
708 ERR_R_INTERNAL_ERROR);
709 return 0;
61ae935a 710 }
4a01c59f 711
5923ad4b 712 return 1;
61ae935a
MC		 713}
714
8a18bc25
AG		 715/*
716 * Maximum size (excluding the Handshake header) of a ClientHello message,
717 * calculated as follows:
718 *
719 * 2 + # client_version
720 * 32 + # only valid length for random
721 * 1 + # length of session_id
722 * 32 + # maximum size for session_id
723 * 2 + # length of cipher suites
724 * 2^16-2 + # maximum length of cipher suites array
725 * 1 + # length of compression_methods
726 * 2^8-1 + # maximum length of compression methods
727 * 2 + # length of extensions
728 * 2^16-1 # maximum length of extensions
729 */
730#define CLIENT_HELLO_MAX_LENGTH 131396
731
61ae935a
MC		 732#define CLIENT_KEY_EXCH_MAX_LENGTH 2048
733#define NEXT_PROTO_MAX_LENGTH 514
734
735/*
736 * Returns the maximum allowed length for the current message that we are
737 * reading. Excludes the message header.
738 */
8481f583 739unsigned long ossl_statem_server_max_message_size(SSL *s)
61ae935a 740{
d6f1a6e9 741 OSSL_STATEM *st = &s->statem;
61ae935a 742
e8aa8b6c 743 switch (st->hand_state) {
f3b3d7f0
RS		 744 default:
745 /* Shouldn't happen */
746 return 0;
747
61ae935a 748 case TLS_ST_SR_CLNT_HELLO:
8a18bc25 749 return CLIENT_HELLO_MAX_LENGTH;
61ae935a
MC		 750
751 case TLS_ST_SR_CERT:
752 return s->max_cert_list;
753
754 case TLS_ST_SR_KEY_EXCH:
755 return CLIENT_KEY_EXCH_MAX_LENGTH;
756
757 case TLS_ST_SR_CERT_VRFY:
758 return SSL3_RT_MAX_PLAIN_LENGTH;
759
760#ifndef OPENSSL_NO_NEXTPROTONEG
761 case TLS_ST_SR_NEXT_PROTO:
762 return NEXT_PROTO_MAX_LENGTH;
763#endif
764
765 case TLS_ST_SR_CHANGE:
766 return CCS_MAX_LENGTH;
767
768 case TLS_ST_SR_FINISHED:
769 return FINISHED_MAX_LENGTH;
61ae935a 770 }
61ae935a
MC		 771}
772
773/*
774 * Process a message that the server has received from the client.
775 */
8481f583 776MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt)
61ae935a 777{
d6f1a6e9 778 OSSL_STATEM *st = &s->statem;
61ae935a 779
e8aa8b6c 780 switch (st->hand_state) {
f3b3d7f0
RS		 781 default:
782 /* Shouldn't happen */
783 return MSG_PROCESS_ERROR;
784
61ae935a
MC		 785 case TLS_ST_SR_CLNT_HELLO:
786 return tls_process_client_hello(s, pkt);
787
788 case TLS_ST_SR_CERT:
789 return tls_process_client_certificate(s, pkt);
790
791 case TLS_ST_SR_KEY_EXCH:
792 return tls_process_client_key_exchange(s, pkt);
793
794 case TLS_ST_SR_CERT_VRFY:
795 return tls_process_cert_verify(s, pkt);
796
797#ifndef OPENSSL_NO_NEXTPROTONEG
798 case TLS_ST_SR_NEXT_PROTO:
799 return tls_process_next_proto(s, pkt);
800#endif
801
802 case TLS_ST_SR_CHANGE:
803 return tls_process_change_cipher_spec(s, pkt);
804
805 case TLS_ST_SR_FINISHED:
806 return tls_process_finished(s, pkt);
61ae935a 807 }
61ae935a
MC		 808}
809
810/*
811 * Perform any further processing required following the receipt of a message
812 * from the client
813 */
8481f583 814WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst)
61ae935a 815{
d6f1a6e9 816 OSSL_STATEM *st = &s->statem;
61ae935a 817
e8aa8b6c 818 switch (st->hand_state) {
f3b3d7f0
RS		 819 default:
820 /* Shouldn't happen */
821 return WORK_ERROR;
822
61ae935a
MC		 823 case TLS_ST_SR_CLNT_HELLO:
824 return tls_post_process_client_hello(s, wst);
825
826 case TLS_ST_SR_KEY_EXCH:
827 return tls_post_process_client_key_exchange(s, wst);
828
829 case TLS_ST_SR_CERT_VRFY:
830#ifndef OPENSSL_NO_SCTP
a230b26e
EK		 831 if ( /* Is this SCTP? */
832 BIO_dgram_is_sctp(SSL_get_wbio(s))
833 /* Are we renegotiating? */
834 && s->renegotiate && BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
61ae935a
MC		 835 s->s3->in_read_app_data = 2;
836 s->rwstate = SSL_READING;
837 BIO_clear_retry_flags(SSL_get_rbio(s));
838 BIO_set_retry_read(SSL_get_rbio(s));
d99b0691 839 ossl_statem_set_sctp_read_sock(s, 1);
61ae935a
MC		 840 return WORK_MORE_A;
841 } else {
d99b0691 842 ossl_statem_set_sctp_read_sock(s, 0);
61ae935a
MC		 843 }
844#endif
845 return WORK_FINISHED_CONTINUE;
61ae935a
MC		 846 }
847
61ae935a
MC		 848}
849
edc032b5 850#ifndef OPENSSL_NO_SRP
71fa4513 851static int ssl_check_srp_ext_ClientHello(SSL *s, int *al)
0f113f3e
MC		 852{
853 int ret = SSL_ERROR_NONE;
854
855 *al = SSL_AD_UNRECOGNIZED_NAME;
856
857 if ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) &&
858 (s->srp_ctx.TLS_ext_srp_username_callback != NULL)) {
859 if (s->srp_ctx.login == NULL) {
860 /*
861 * RFC 5054 says SHOULD reject, we do so if There is no srp
862 * login name
863 */
864 ret = SSL3_AL_FATAL;
865 *al = SSL_AD_UNKNOWN_PSK_IDENTITY;
866 } else {
867 ret = SSL_srp_server_param_with_username(s, al);
868 }
869 }
870 return ret;
871}
edc032b5
BL		 872#endif
873
c536b6be
MC		 874int dtls_raw_hello_verify_request(WPACKET *pkt, unsigned char *cookie,
875 unsigned char cookie_len)
8ba708e5 876{
8ba708e5 877 /* Always use DTLS 1.0 version: see RFC 6347 */
c536b6be
MC		 878 if (!WPACKET_put_bytes_u16(pkt, DTLS1_VERSION)
879 || !WPACKET_sub_memcpy_u8(pkt, cookie, cookie_len))
880 return 0;
8ba708e5 881
c536b6be 882 return 1;
8ba708e5
MC		 883}
884
7cea05dc 885int dtls_construct_hello_verify_request(SSL *s, WPACKET *pkt)
8ba708e5 886{
8ba708e5
MC		 887 if (s->ctx->app_gen_cookie_cb == NULL ||
888 s->ctx->app_gen_cookie_cb(s, s->d1->cookie,
889 &(s->d1->cookie_len)) == 0 ||
890 s->d1->cookie_len > 255) {
f0659bdb 891 SSLerr(SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST,
8ba708e5 892 SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
8ba708e5
MC		 893 return 0;
894 }
895
4a01c59f
MC		 896 if (!dtls_raw_hello_verify_request(pkt, s->d1->cookie,
897 s->d1->cookie_len)) {
c536b6be 898 SSLerr(SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST, ERR_R_INTERNAL_ERROR);
c536b6be
MC		 899 return 0;
900 }
8ba708e5 901
8ba708e5
MC		 902 return 1;
903}
904
be3583fa 905MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
e27f234a
MC		 906{
907 int i, al = SSL_AD_INTERNAL_ERROR;
908 unsigned int j, complen = 0;
909 unsigned long id;
4a640fb6 910 const SSL_CIPHER *c;
e27f234a
MC		 911#ifndef OPENSSL_NO_COMP
912 SSL_COMP *comp = NULL;
913#endif
914 STACK_OF(SSL_CIPHER) *ciphers = NULL;
4fa52141 915 int protverr;
e27f234a 916 /* |cookie| will only be initialized for DTLS. */
73999b62 917 PACKET session_id, cipher_suites, compression, extensions, cookie;
e27f234a 918 int is_v2_record;
6e3ff632 919 static const unsigned char null_compression = 0;
e27f234a 920
b3e2272c
EK		 921 is_v2_record = RECORD_LAYER_is_sslv2_record(&s->rlayer);
922
bbafa47b 923 PACKET_null_init(&cookie);
32ec4153 924 /* First lets get s->client_version set correctly */
b3e2272c 925 if (is_v2_record) {
9ceb2426
MC		 926 unsigned int version;
927 unsigned int mt;
32ec4153
MC		 928 /*-
929 * An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2
930 * header is sent directly on the wire, not wrapped as a TLS
931 * record. Our record layer just processes the message length and passes
932 * the rest right through. Its format is:
933 * Byte Content
934 * 0-1 msg_length - decoded by the record layer
935 * 2 msg_type - s->init_msg points here
936 * 3-4 version
937 * 5-6 cipher_spec_length
938 * 7-8 session_id_length
939 * 9-10 challenge_length
940 * ... ...
941 */
942
73999b62 943 if (!PACKET_get_1(pkt, &mt)
a230b26e 944 || mt != SSL2_MT_CLIENT_HELLO) {
32ec4153
MC		 945 /*
946 * Should never happen. We should have tested this in the record
947 * layer in order to have determined that this is a SSLv2 record
948 * in the first place
949 */
e27f234a 950 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
d45ba43d 951 goto err;
32ec4153
MC		 952 }
953
73999b62 954 if (!PACKET_get_net_2(pkt, &version)) {
9ceb2426 955 /* No protocol version supplied! */
e27f234a 956 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
9ceb2426
MC		 957 goto err;
958 }
959 if (version == 0x0002) {
32ec4153 960 /* This is real SSLv2. We don't support it. */
e27f234a 961 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
32ec4153 962 goto err;
9ceb2426 963 } else if ((version & 0xff00) == (SSL3_VERSION_MAJOR << 8)) {
32ec4153 964 /* SSLv3/TLS */
9ceb2426 965 s->client_version = version;
32ec4153
MC		 966 } else {
967 /* No idea what protocol this is */
e27f234a 968 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
32ec4153
MC		 969 goto err;
970 }
971 } else {
972 /*
9ceb2426
MC		 973 * use version from inside client hello, not from record header (may
974 * differ: see RFC 2246, Appendix E, second paragraph)
32ec4153 975 */
e8aa8b6c 976 if (!PACKET_get_net_2(pkt, (unsigned int *)&s->client_version)) {
32ec4153 977 al = SSL_AD_DECODE_ERROR;
e27f234a 978 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);
32ec4153
MC		 979 goto f_err;
980 }
5e9f0eeb
MC		 981 }
982
4fa52141
VD		 983 /*
984 * Do SSL/TLS version negotiation if applicable. For DTLS we just check
985 * versions are potentially compatible. Version negotiation comes later.
986 */
32ec4153 987 if (!SSL_IS_DTLS(s)) {
4fa52141
VD		 988 protverr = ssl_choose_server_version(s);
989 } else if (s->method->version != DTLS_ANY_VERSION &&
990 DTLS_VERSION_LT(s->client_version, s->version)) {
991 protverr = SSL_R_VERSION_TOO_LOW;
992 } else {
32ec4153
MC		 993 protverr = 0;
994 }
995
996 if (protverr) {
4fa52141 997 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
32ec4153 998 if ((!s->enc_write_ctx && !s->write_hash)) {
0f113f3e
MC		 999 /*
1000 * similar to ssl3_get_record, send alert using remote version
1001 * number
1002 */
1003 s->version = s->client_version;
1004 }
1005 al = SSL_AD_PROTOCOL_VERSION;
1006 goto f_err;
1007 }
1008
b3e2272c
EK		 1009 /* Parse the message and load client random. */
1010 if (is_v2_record) {
32ec4153
MC		 1011 /*
1012 * Handle an SSLv2 backwards compatible ClientHello
1013 * Note, this is only for SSLv3+ using the backward compatible format.
1014 * Real SSLv2 is not supported, and is rejected above.
1015 */
ec30e856 1016 unsigned int cipher_len, session_id_len, challenge_len;
b3e2272c 1017 PACKET challenge;
0f113f3e 1018
73999b62 1019 if (!PACKET_get_net_2(pkt, &cipher_len)
a230b26e
EK		 1020 || !PACKET_get_net_2(pkt, &session_id_len)
1021 || !PACKET_get_net_2(pkt, &challenge_len)) {
e27f234a
MC		 1022 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1023 SSL_R_RECORD_LENGTH_MISMATCH);
6c3cca57
AE		 1024 al = SSL_AD_DECODE_ERROR;
1025 goto f_err;
5e9f0eeb 1026 }
0f113f3e 1027
293b5ca4
AG		 1028 if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {
1029 al = SSL_AD_DECODE_ERROR;
1030 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1031 goto f_err;
1032 }
1033
73999b62
MC		 1034 if (!PACKET_get_sub_packet(pkt, &cipher_suites, cipher_len)
1035 || !PACKET_get_sub_packet(pkt, &session_id, session_id_len)
1036 || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
b3e2272c 1037 /* No extensions. */
73999b62 1038 || PACKET_remaining(pkt) != 0) {
f0659bdb
MC		 1039 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1040 SSL_R_RECORD_LENGTH_MISMATCH);
9ceb2426
MC		 1041 al = SSL_AD_DECODE_ERROR;
1042 goto f_err;
1043 }
1044
cb21df32 1045 /* Load the client random and compression list. */
b3e2272c
EK		 1046 challenge_len = challenge_len > SSL3_RANDOM_SIZE ? SSL3_RANDOM_SIZE :
1047 challenge_len;
32ec4153 1048 memset(s->s3->client_random, 0, SSL3_RANDOM_SIZE);
b3e2272c
EK		 1049 if (!PACKET_copy_bytes(&challenge,
1050 s->s3->client_random + SSL3_RANDOM_SIZE -
cb21df32
DB		 1051 challenge_len, challenge_len)
1052 /* Advertise only null compression. */
1053 || !PACKET_buf_init(&compression, &null_compression, 1)) {
f0659bdb 1054 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
b3e2272c 1055 al = SSL_AD_INTERNAL_ERROR;
9ceb2426
MC		 1056 goto f_err;
1057 }
b3e2272c 1058
b3e2272c 1059 PACKET_null_init(&extensions);
0f113f3e 1060 } else {
b3e2272c 1061 /* Regular ClientHello. */
73999b62
MC		 1062 if (!PACKET_copy_bytes(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)
1063 || !PACKET_get_length_prefixed_1(pkt, &session_id)) {
9ceb2426 1064 al = SSL_AD_DECODE_ERROR;
f0659bdb 1065 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
9ceb2426
MC		 1066 goto f_err;
1067 }
32ec4153 1068
293b5ca4
AG		 1069 if (PACKET_remaining(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) {
1070 al = SSL_AD_DECODE_ERROR;
1071 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1072 goto f_err;
1073 }
1074
b3e2272c 1075 if (SSL_IS_DTLS(s)) {
73999b62 1076 if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {
32ec4153 1077 al = SSL_AD_DECODE_ERROR;
f0659bdb 1078 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
32ec4153
MC		 1079 goto f_err;
1080 }
b3e2272c
EK		 1081 /*
1082 * If we require cookies and this ClientHello doesn't contain one,
1083 * just return since we do not want to allocate any memory yet.
1084 * So check cookie length...
1085 */
1086 if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
1087 if (PACKET_remaining(&cookie) == 0)
a230b26e 1088 return 1;
b3e2272c 1089 }
5e9f0eeb 1090 }
0f113f3e 1091
73999b62
MC		 1092 if (!PACKET_get_length_prefixed_2(pkt, &cipher_suites)
1093 || !PACKET_get_length_prefixed_1(pkt, &compression)) {
a230b26e
EK		 1094 al = SSL_AD_DECODE_ERROR;
1095 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1096 goto f_err;
b3e2272c
EK		 1097 }
1098 /* Could be empty. */
73999b62 1099 extensions = *pkt;
b3e2272c
EK		 1100 }
1101
1ed65871
DB		 1102 if (SSL_IS_DTLS(s)) {
1103 /* Empty cookie was already handled above by returning early. */
1104 if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
1105 if (s->ctx->app_verify_cookie_cb != NULL) {
1106 if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&cookie),
a230b26e
EK		 1107 PACKET_remaining(&cookie)) ==
1108 0) {
1ed65871
DB		 1109 al = SSL_AD_HANDSHAKE_FAILURE;
1110 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1111 SSL_R_COOKIE_MISMATCH);
1112 goto f_err;
1113 /* else cookie verification succeeded */
1114 }
a230b26e
EK		 1115 /* default verification */
1116 } else if (!PACKET_equal(&cookie, s->d1->cookie, s->d1->cookie_len)) {
1ed65871
DB		 1117 al = SSL_AD_HANDSHAKE_FAILURE;
1118 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
1119 goto f_err;
1120 }
1121 s->d1->cookie_verified = 1;
1122 }
1123 if (s->method->version == DTLS_ANY_VERSION) {
1124 protverr = ssl_choose_server_version(s);
1125 if (protverr != 0) {
1126 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
1127 s->version = s->client_version;
1128 al = SSL_AD_PROTOCOL_VERSION;
1129 goto f_err;
1130 }
1131 }
1132 }
1133
b3e2272c
EK		 1134 s->hit = 0;
1135
1136 /*
1137 * We don't allow resumption in a backwards compatible ClientHello.
1138 * TODO(openssl-team): in TLS1.1+, session_id MUST be empty.
1139 *
1140 * Versions before 0.9.7 always allow clients to resume sessions in
1141 * renegotiation. 0.9.7 and later allow this by default, but optionally
1142 * ignore resumption requests with flag
1143 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION (it's a new flag rather
1144 * than a change to default behavior so that applications relying on
1145 * this for security won't even compile against older library versions).
1146 * 1.0.1 and later also have a function SSL_renegotiate_abbreviated() to
1147 * request renegotiation but not a new session (s->new_session remains
1148 * unset): for servers, this essentially just means that the
1149 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be
1150 * ignored.
1151 */
1152 if (is_v2_record ||
1153 (s->new_session &&
1154 (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) {
1155 if (!ssl_get_new_session(s, 1))
1156 goto err;
1157 } else {
1158 i = ssl_get_prev_session(s, &extensions, &session_id);
0f113f3e 1159 /*
b3e2272c
EK		 1160 * Only resume if the session's version matches the negotiated
1161 * version.
1162 * RFC 5246 does not provide much useful advice on resumption
1163 * with a different protocol version. It doesn't forbid it but
1164 * the sanity of such behaviour would be questionable.
1165 * In practice, clients do not accept a version mismatch and
1166 * will abort the handshake with an error.
0f113f3e 1167 */
b3e2272c
EK		 1168 if (i == 1 && s->version == s->session->ssl_version) {
1169 /* previous session */
1170 s->hit = 1;
1171 } else if (i == -1) {
1172 goto err;
32ec4153 1173 } else {
b3e2272c
EK		 1174 /* i == 0 */
1175 if (!ssl_get_new_session(s, 1))
32ec4153 1176 goto err;
0f113f3e 1177 }
b3e2272c 1178 }
0f113f3e 1179
38a3cbfb
EK		 1180 if (ssl_bytes_to_cipher_list(s, &cipher_suites, &(ciphers),
1181 is_v2_record, &al) == NULL) {
b3e2272c
EK		 1182 goto f_err;
1183 }
5e9f0eeb 1184
b3e2272c
EK		 1185 /* If it is a hit, check that the cipher is in the list */
1186 if (s->hit) {
1187 j = 0;
1188 id = s->session->cipher->id;
d02b48c6 1189
413c4f45 1190#ifdef CIPHER_DEBUG
a230b26e 1191 fprintf(stderr, "client sent %d ciphers\n", sk_SSL_CIPHER_num(ciphers));
413c4f45 1192#endif
b3e2272c
EK		 1193 for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
1194 c = sk_SSL_CIPHER_value(ciphers, i);
413c4f45 1195#ifdef CIPHER_DEBUG
b3e2272c
EK		 1196 fprintf(stderr, "client [%2d of %2d]:%s\n",
1197 i, sk_SSL_CIPHER_num(ciphers), SSL_CIPHER_get_name(c));
88f2a4cf 1198#endif
b3e2272c
EK		 1199 if (c->id == id) {
1200 j = 1;
1201 break;
32ec4153 1202 }
0f113f3e 1203 }
b3e2272c 1204 if (j == 0) {
ec30e856 1205 /*
b3e2272c
EK		 1206 * we need to have the cipher in the cipher list if we are asked
1207 * to reuse it
ec30e856 1208 */
b3e2272c 1209 al = SSL_AD_ILLEGAL_PARAMETER;
f0659bdb 1210 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
b3e2272c 1211 SSL_R_REQUIRED_CIPHER_MISSING);
32ec4153
MC		 1212 goto f_err;
1213 }
b3e2272c 1214 }
9ceb2426 1215
b3e2272c
EK		 1216 complen = PACKET_remaining(&compression);
1217 for (j = 0; j < complen; j++) {
1218 if (PACKET_data(&compression)[j] == 0)
1219 break;
0f113f3e 1220 }
32ec4153 1221
b3e2272c
EK		 1222 if (j >= complen) {
1223 /* no compress */
1224 al = SSL_AD_DECODE_ERROR;
f0659bdb 1225 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_COMPRESSION_SPECIFIED);
b3e2272c
EK		 1226 goto f_err;
1227 }
f100b031 1228
0f113f3e
MC		 1229 /* TLS extensions */
1230 if (s->version >= SSL3_VERSION) {
b3e2272c 1231 if (!ssl_parse_clienthello_tlsext(s, &extensions)) {
f0659bdb 1232 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_PARSE_TLSEXT);
0f113f3e
MC		 1233 goto err;
1234 }
1235 }
1236
1237 /*
1238 * Check if we want to use external pre-shared secret for this handshake
1239 * for not reused session only. We need to generate server_random before
1240 * calling tls_session_secret_cb in order to allow SessionTicket
1241 * processing to use it in key derivation.
1242 */
1243 {
1244 unsigned char *pos;
1245 pos = s->s3->server_random;
1246 if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE) <= 0) {
1247 goto f_err;
1248 }
1249 }
1250
1251 if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) {
4a640fb6 1252 const SSL_CIPHER *pref_cipher = NULL;
0f113f3e
MC		 1253
1254 s->session->master_key_length = sizeof(s->session->master_key);
1255 if (s->tls_session_secret_cb(s, s->session->master_key,
1256 &s->session->master_key_length, ciphers,
1257 &pref_cipher,
1258 s->tls_session_secret_cb_arg)) {
1259 s->hit = 1;
1260 s->session->ciphers = ciphers;
1261 s->session->verify_result = X509_V_OK;
1262
1263 ciphers = NULL;
1264
1265 /* check if some cipher was preferred by call back */
1266 pref_cipher =
1267 pref_cipher ? pref_cipher : ssl3_choose_cipher(s,
1268 s->
1269 session->ciphers,
1270 SSL_get_ciphers
1271 (s));
1272 if (pref_cipher == NULL) {
1273 al = SSL_AD_HANDSHAKE_FAILURE;
e27f234a 1274 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER);
0f113f3e
MC		 1275 goto f_err;
1276 }
1277
1278 s->session->cipher = pref_cipher;
25aaa98a 1279 sk_SSL_CIPHER_free(s->cipher_list);
0f113f3e 1280 s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
25aaa98a 1281 sk_SSL_CIPHER_free(s->cipher_list_by_id);
0f113f3e
MC		 1282 s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers);
1283 }
1284 }
58ece833 1285
0f113f3e
MC		 1286 /*
1287 * Worst case, we will use the NULL compression, but if we have other
b2ce0337 1288 * options, we will now look for them. We have complen-1 compression
0f113f3e
MC		 1289 * algorithms from the client, starting at q.
1290 */
1291 s->s3->tmp.new_compression = NULL;
09b6c2ef 1292#ifndef OPENSSL_NO_COMP
0f113f3e
MC		 1293 /* This only happens if we have a cache hit */
1294 if (s->session->compress_meth != 0) {
1295 int m, comp_id = s->session->compress_meth;
9ceb2426 1296 unsigned int k;
0f113f3e
MC		 1297 /* Perform sanity checks on resumed compression algorithm */
1298 /* Can't disable compression */
1299 if (!ssl_allow_compression(s)) {
e27f234a 1300 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
0f113f3e
MC		 1301 SSL_R_INCONSISTENT_COMPRESSION);
1302 goto f_err;
1303 }
1304 /* Look for resumed compression method */
1305 for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++) {
1306 comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
1307 if (comp_id == comp->id) {
1308 s->s3->tmp.new_compression = comp;
1309 break;
1310 }
1311 }
1312 if (s->s3->tmp.new_compression == NULL) {
e27f234a 1313 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
0f113f3e
MC		 1314 SSL_R_INVALID_COMPRESSION_ALGORITHM);
1315 goto f_err;
1316 }
1317 /* Look for resumed method in compression list */
9ceb2426 1318 for (k = 0; k < complen; k++) {
ec30e856 1319 if (PACKET_data(&compression)[k] == comp_id)
0f113f3e
MC		 1320 break;
1321 }
9ceb2426 1322 if (k >= complen) {
0f113f3e 1323 al = SSL_AD_ILLEGAL_PARAMETER;
e27f234a 1324 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
8fdc99cb 1325 SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING);
0f113f3e
MC		 1326 goto f_err;
1327 }
1328 } else if (s->hit)
1329 comp = NULL;
1330 else if (ssl_allow_compression(s) && s->ctx->comp_methods) {
df6741c9 1331 /* See if we have a match */
9ceb2426
MC		 1332 int m, nn, v, done = 0;
1333 unsigned int o;
0f113f3e
MC		 1334
1335 nn = sk_SSL_COMP_num(s->ctx->comp_methods);
1336 for (m = 0; m < nn; m++) {
1337 comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
1338 v = comp->id;
b2ce0337 1339 for (o = 0; o < complen; o++) {
ec30e856 1340 if (v == PACKET_data(&compression)[o]) {
0f113f3e
MC		 1341 done = 1;
1342 break;
1343 }
1344 }
1345 if (done)
1346 break;
1347 }
1348 if (done)
1349 s->s3->tmp.new_compression = comp;
1350 else
1351 comp = NULL;
1352 }
e6f418bc 1353#else
0f113f3e
MC		 1354 /*
1355 * If compression is disabled we'd better not try to resume a session
1356 * using compression.
1357 */
1358 if (s->session->compress_meth != 0) {
e27f234a 1359 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_INCONSISTENT_COMPRESSION);
0f113f3e
MC		 1360 goto f_err;
1361 }
09b6c2ef 1362#endif
413c4f45 1363
0f113f3e
MC		 1364 /*
1365 * Given s->session->ciphers and SSL_get_ciphers, we must pick a cipher
1366 */
d02b48c6 1367
0f113f3e 1368 if (!s->hit) {
09b6c2ef 1369#ifdef OPENSSL_NO_COMP
0f113f3e 1370 s->session->compress_meth = 0;
09b6c2ef 1371#else
0f113f3e 1372 s->session->compress_meth = (comp == NULL) ? 0 : comp->id;
09b6c2ef 1373#endif
25aaa98a 1374 sk_SSL_CIPHER_free(s->session->ciphers);
0f113f3e
MC		 1375 s->session->ciphers = ciphers;
1376 if (ciphers == NULL) {
3ae91cfb 1377 al = SSL_AD_INTERNAL_ERROR;
e27f234a 1378 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
0f113f3e
MC		 1379 goto f_err;
1380 }
1381 ciphers = NULL;
1382 if (!tls1_set_server_sigalgs(s)) {
e27f234a 1383 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
0f113f3e
MC		 1384 goto err;
1385 }
e27f234a
MC		 1386 }
1387
1388 sk_SSL_CIPHER_free(ciphers);
1389 return MSG_PROCESS_CONTINUE_PROCESSING;
1390 f_err:
1391 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1392 err:
fe3a3291 1393 ossl_statem_set_error(s);
e27f234a
MC		 1394
1395 sk_SSL_CIPHER_free(ciphers);
1396 return MSG_PROCESS_ERROR;
1397
1398}
1399
be3583fa 1400WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst)
e27f234a 1401{
d13dd4be 1402 int al = SSL_AD_HANDSHAKE_FAILURE;
4a640fb6 1403 const SSL_CIPHER *cipher;
e27f234a
MC		 1404
1405 if (wst == WORK_MORE_A) {
1406 if (!s->hit) {
1407 /* Let cert callback update server certificates if required */
1408 if (s->cert->cert_cb) {
1409 int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg);
1410 if (rv == 0) {
1411 al = SSL_AD_INTERNAL_ERROR;
a230b26e
EK		 1412 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
1413 SSL_R_CERT_CB_ERROR);
e27f234a
MC		 1414 goto f_err;
1415 }
1416 if (rv < 0) {
1417 s->rwstate = SSL_X509_LOOKUP;
1418 return WORK_MORE_A;
1419 }
1420 s->rwstate = SSL_NOTHING;
0f113f3e 1421 }
a230b26e
EK		 1422 cipher =
1423 ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s));
e27f234a
MC		 1424
1425 if (cipher == NULL) {
a230b26e
EK		 1426 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
1427 SSL_R_NO_SHARED_CIPHER);
e27f234a 1428 goto f_err;
0f113f3e 1429 }
e27f234a
MC		 1430 s->s3->tmp.new_cipher = cipher;
1431 /* check whether we should disable session resumption */
1432 if (s->not_resumable_session_cb != NULL)
1433 s->session->not_resumable = s->not_resumable_session_cb(s,
a230b26e 1434 ((cipher->algorithm_mkey & (SSL_kDHE | SSL_kECDHE)) != 0));
e27f234a
MC		 1435 if (s->session->not_resumable)
1436 /* do not send a session ticket */
1437 s->tlsext_ticket_expected = 0;
1438 } else {
1439 /* Session-id reuse */
1440 s->s3->tmp.new_cipher = s->session->cipher;
0f113f3e 1441 }
0f113f3e 1442
28f4580c 1443 if (!(s->verify_mode & SSL_VERIFY_PEER)) {
d13dd4be
MC		 1444 if (!ssl3_digest_cached_records(s, 0)) {
1445 al = SSL_AD_INTERNAL_ERROR;
e27f234a 1446 goto f_err;
d13dd4be 1447 }
0f113f3e 1448 }
0f113f3e 1449
e27f234a
MC		 1450 /*-
1451 * we now have the following setup.
1452 * client_random
60250017 1453 * cipher_list - our preferred list of ciphers
1454 * ciphers - the clients preferred list of ciphers
e27f234a
MC		 1455 * compression - basically ignored right now
1456 * ssl version is set - sslv3
1457 * s->session - The ssl session has been setup.
1458 * s->hit - session reuse flag
1459 * s->s3->tmp.new_cipher- the new cipher to use.
1460 */
0f113f3e 1461
e27f234a
MC		 1462 /* Handles TLS extensions that we couldn't check earlier */
1463 if (s->version >= SSL3_VERSION) {
70c22888 1464 if (!ssl_check_clienthello_tlsext_late(s, &al)) {
d13dd4be
MC		 1465 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
1466 SSL_R_CLIENTHELLO_TLSEXT);
e27f234a
MC		 1467 goto f_err;
1468 }
1469 }
0f113f3e 1470
e27f234a
MC		 1471 wst = WORK_MORE_B;
1472 }
1473#ifndef OPENSSL_NO_SRP
1474 if (wst == WORK_MORE_B) {
1475 int ret;
1476 if ((ret = ssl_check_srp_ext_ClientHello(s, &al)) < 0) {
1477 /*
1478 * callback indicates further work to be done
1479 */
1480 s->rwstate = SSL_X509_LOOKUP;
1481 return WORK_MORE_B;
1482 }
1483 if (ret != SSL_ERROR_NONE) {
1484 /*
1485 * This is not really an error but the only means to for
1486 * a client to detect whether srp is supported.
1487 */
1488 if (al != TLS1_AD_UNKNOWN_PSK_IDENTITY)
1489 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
a230b26e 1490 SSL_R_CLIENTHELLO_TLSEXT);
e27f234a 1491 goto f_err;
0f113f3e
MC		 1492 }
1493 }
e27f234a
MC		 1494#endif
1495 s->renegotiate = 2;
0f113f3e 1496
e27f234a 1497 return WORK_FINISHED_STOP;
0f113f3e 1498 f_err:
e27f234a 1499 ssl3_send_alert(s, SSL3_AL_FATAL, al);
fe3a3291 1500 ossl_statem_set_error(s);
e27f234a
MC		 1501 return WORK_ERROR;
1502}
1503
7cea05dc 1504int tls_construct_server_hello(SSL *s, WPACKET *pkt)
0f113f3e 1505{
25849a8f 1506 int sl, compm, al = SSL_AD_INTERNAL_ERROR;
8157d44b 1507 size_t len;
0f113f3e 1508
5923ad4b 1509 if (!WPACKET_put_bytes_u16(pkt, s->version)
8157d44b
MC		 1510 /*
1511 * Random stuff. Filling of the server_random takes place in
1512 * tls_process_client_hello()
1513 */
7cea05dc 1514 || !WPACKET_memcpy(pkt, s->s3->server_random, SSL3_RANDOM_SIZE)) {
8157d44b
MC		 1515 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
1516 goto err;
1517 }
0f113f3e 1518
e27f234a
MC		 1519 /*-
1520 * There are several cases for the session ID to send
1521 * back in the server hello:
1522 * - For session reuse from the session cache,
1523 * we send back the old session ID.
1524 * - If stateless session reuse (using a session ticket)
1525 * is successful, we send back the client's "session ID"
1526 * (which doesn't actually identify the session).
1527 * - If it is a new session, we send back the new
1528 * session ID.
1529 * - However, if we want the new session to be single-use,
1530 * we send back a 0-length session ID.
1531 * s->hit is non-zero in either case of session reuse,
1532 * so the following won't overwrite an ID that we're supposed
1533 * to send back.
1534 */
1535 if (s->session->not_resumable ||
1536 (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
1537 && !s->hit))
1538 s->session->session_id_length = 0;
1539
1540 sl = s->session->session_id_length;
1541 if (sl > (int)sizeof(s->session->session_id)) {
1542 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
8157d44b 1543 goto err;
e27f234a 1544 }
0f113f3e 1545
8157d44b 1546 /* set up the compression method */
09b6c2ef 1547#ifdef OPENSSL_NO_COMP
8157d44b 1548 compm = 0;
09b6c2ef 1549#else
e27f234a 1550 if (s->s3->tmp.new_compression == NULL)
8157d44b 1551 compm = 0;
e27f234a 1552 else
8157d44b 1553 compm = s->s3->tmp.new_compression->id;
09b6c2ef 1554#endif
e481f9b9 1555
7cea05dc
MC		 1556 if (!WPACKET_sub_memcpy_u8(pkt, s->session->session_id, sl)
1557 || !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, pkt, &len)
1558 || !WPACKET_put_bytes_u8(pkt, compm)
8157d44b 1559 || !ssl_prepare_serverhello_tlsext(s)
5923ad4b 1560 || !ssl_add_serverhello_tlsext(s, pkt, &al)) {
e27f234a 1561 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
8157d44b 1562 goto err;
0f113f3e 1563 }
d02b48c6 1564
e27f234a 1565 return 1;
8157d44b 1566 err:
8157d44b 1567 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
8157d44b 1568 return 0;
0f113f3e 1569}
d02b48c6 1570
7cea05dc 1571int tls_construct_server_done(SSL *s, WPACKET *pkt)
e27f234a 1572{
e27f234a 1573 if (!s->s3->tmp.cert_request) {
5923ad4b
MC		 1574 if (!ssl3_digest_cached_records(s, 0)) {
1575 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
1576 return 0;
1577 }
e27f234a 1578 }
e27f234a
MC		 1579 return 1;
1580}
1581
7cea05dc 1582int tls_construct_server_key_exchange(SSL *s, WPACKET *pkt)
0f113f3e 1583{
bc36ee62 1584#ifndef OPENSSL_NO_DH
e2b420fd 1585 EVP_PKEY *pkdh = NULL;
ea262260 1586#endif
10bf4fc2 1587#ifndef OPENSSL_NO_EC
0f113f3e
MC		 1588 unsigned char *encodedPoint = NULL;
1589 int encodedlen = 0;
1590 int curve_id = 0;
d02b48c6 1591#endif
0f113f3e
MC		 1592 EVP_PKEY *pkey;
1593 const EVP_MD *md = NULL;
c13d2a5b 1594 int al = SSL_AD_INTERNAL_ERROR, i;
0f113f3e 1595 unsigned long type;
2ac6115d 1596 const BIGNUM *r[4];
bfb0641f 1597 EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
c13d2a5b
MC		 1598 size_t paramlen, paramoffset;
1599
5923ad4b 1600 if (!WPACKET_get_total_written(pkt, &paramoffset)) {
e4e1aa90 1601 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
c13d2a5b
MC		 1602 goto f_err;
1603 }
0f113f3e 1604
6e59a892
RL		 1605 if (md_ctx == NULL) {
1606 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
6e59a892
RL		 1607 goto f_err;
1608 }
0f113f3e 1609
e27f234a 1610 type = s->s3->tmp.new_cipher->algorithm_mkey;
e27f234a 1611
e27f234a 1612 r[0] = r[1] = r[2] = r[3] = NULL;
85269210 1613#ifndef OPENSSL_NO_PSK
e27f234a
MC		 1614 /* Plain PSK or RSAPSK nothing to do */
1615 if (type & (SSL_kPSK | SSL_kRSAPSK)) {
1616 } else
85269210 1617#endif /* !OPENSSL_NO_PSK */
bc36ee62 1618#ifndef OPENSSL_NO_DH
e27f234a 1619 if (type & (SSL_kDHE | SSL_kDHEPSK)) {
94d61512
BL		 1620 CERT *cert = s->cert;
1621
e2b420fd
DSH		 1622 EVP_PKEY *pkdhp = NULL;
1623 DH *dh;
1624
e27f234a 1625 if (s->cert->dh_tmp_auto) {
e2b420fd
DSH		 1626 DH *dhp = ssl_get_auto_dh(s);
1627 pkdh = EVP_PKEY_new();
1628 if (pkdh == NULL || dhp == NULL) {
1629 DH_free(dhp);
e27f234a 1630 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
0f113f3e 1631 ERR_R_INTERNAL_ERROR);
e27f234a 1632 goto f_err;
0f113f3e 1633 }
e2b420fd
DSH		 1634 EVP_PKEY_assign_DH(pkdh, dhp);
1635 pkdhp = pkdh;
1636 } else {
1637 pkdhp = cert->dh_tmp;
1638 }
1639 if ((pkdhp == NULL) && (s->cert->dh_tmp_cb != NULL)) {
1640 DH *dhp = s->cert->dh_tmp_cb(s, 0, 1024);
1641 pkdh = ssl_dh_to_pkey(dhp);
1642 if (pkdh == NULL) {
e2b420fd
DSH		 1643 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1644 ERR_R_INTERNAL_ERROR);
1645 goto f_err;
1646 }
1647 pkdhp = pkdh;
1648 }
1649 if (pkdhp == NULL) {
e27f234a
MC		 1650 al = SSL_AD_HANDSHAKE_FAILURE;
1651 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1652 SSL_R_MISSING_TMP_DH_KEY);
1653 goto f_err;
1654 }
1655 if (!ssl_security(s, SSL_SECOP_TMP_DH,
e2b420fd 1656 EVP_PKEY_security_bits(pkdhp), 0, pkdhp)) {
e27f234a
MC		 1657 al = SSL_AD_HANDSHAKE_FAILURE;
1658 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1659 SSL_R_DH_KEY_TOO_SMALL);
1660 goto f_err;
1661 }
e2b420fd 1662 if (s->s3->tmp.pkey != NULL) {
e27f234a
MC		 1663 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1664 ERR_R_INTERNAL_ERROR);
1665 goto err;
1666 }
0f113f3e 1667
0a699a07 1668 s->s3->tmp.pkey = ssl_generate_pkey(pkdhp);
e27f234a 1669
e2b420fd
DSH		 1670 if (s->s3->tmp.pkey == NULL) {
1671 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB);
ffaef3f1 1672 goto err;
e27f234a 1673 }
e2b420fd
DSH		 1674
1675 dh = EVP_PKEY_get0_DH(s->s3->tmp.pkey);
1676
1677 EVP_PKEY_free(pkdh);
1678 pkdh = NULL;
1679
0aeddcfa
MC		 1680 DH_get0_pqg(dh, &r[0], NULL, &r[1]);
1681 DH_get0_key(dh, &r[2], NULL);
e27f234a 1682 } else
d02b48c6 1683#endif
10bf4fc2 1684#ifndef OPENSSL_NO_EC
e27f234a 1685 if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {
57be4444 1686 int nid;
e27f234a 1687
880d9d86 1688 if (s->s3->tmp.pkey != NULL) {
e27f234a
MC		 1689 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1690 ERR_R_INTERNAL_ERROR);
1691 goto err;
1692 }
1693
57be4444
DSH		 1694 /* Get NID of appropriate shared curve */
1695 nid = tls1_shared_curve(s, -2);
1696 curve_id = tls1_ec_nid2curve_id(nid);
1697 if (curve_id == 0) {
e27f234a
MC		 1698 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1699 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
1700 goto err;
1701 }
0a699a07 1702 s->s3->tmp.pkey = ssl_generate_pkey_curve(curve_id);
880d9d86
DSH		 1703 /* Generate a new key for this curve */
1704 if (s->s3->tmp.pkey == NULL) {
880d9d86 1705 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB);
57be4444
DSH		 1706 goto f_err;
1707 }
1708
880d9d86 1709 /* Encode the public key. */
ec24630a
DSH		 1710 encodedlen = EVP_PKEY_get1_tls_encodedpoint(s->s3->tmp.pkey,
1711 &encodedPoint);
e27f234a 1712 if (encodedlen == 0) {
cae41364 1713 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EC_LIB);
e27f234a
MC		 1714 goto err;
1715 }
0f113f3e 1716
e27f234a
MC		 1717 /*
1718 * We'll generate the serverKeyExchange message explicitly so we
1719 * can set these to NULLs
1720 */
1721 r[0] = NULL;
1722 r[1] = NULL;
1723 r[2] = NULL;
1724 r[3] = NULL;
1725 } else
10bf4fc2 1726#endif /* !OPENSSL_NO_EC */
edc032b5 1727#ifndef OPENSSL_NO_SRP
e27f234a
MC		 1728 if (type & SSL_kSRP) {
1729 if ((s->srp_ctx.N == NULL) ||
1730 (s->srp_ctx.g == NULL) ||
1731 (s->srp_ctx.s == NULL) || (s->srp_ctx.B == NULL)) {
1732 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1733 SSL_R_MISSING_SRP_PARAM);
1734 goto err;
0f113f3e 1735 }
e27f234a
MC		 1736 r[0] = s->srp_ctx.N;
1737 r[1] = s->srp_ctx.g;
1738 r[2] = s->srp_ctx.s;
1739 r[3] = s->srp_ctx.B;
1740 } else
1741#endif
1742 {
1743 al = SSL_AD_HANDSHAKE_FAILURE;
1744 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1745 SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
1746 goto f_err;
1747 }
0f113f3e 1748
a230b26e 1749 if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
e27f234a
MC		 1750 && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) {
1751 if ((pkey = ssl_get_sign_pkey(s, s->s3->tmp.new_cipher, &md))
1752 == NULL) {
1753 al = SSL_AD_DECODE_ERROR;
1754 goto f_err;
0f113f3e 1755 }
e27f234a
MC		 1756 } else {
1757 pkey = NULL;
e27f234a 1758 }
0f113f3e 1759
85269210 1760#ifndef OPENSSL_NO_PSK
e27f234a 1761 if (type & SSL_PSK) {
c13d2a5b
MC		 1762 size_t len = (s->cert->psk_identity_hint == NULL)
1763 ? 0 : strlen(s->cert->psk_identity_hint);
1764
1765 /*
1766 * It should not happen that len > PSK_MAX_IDENTITY_LEN - we already
1767 * checked this when we set the identity hint - but just in case
1768 */
1769 if (len > PSK_MAX_IDENTITY_LEN
7cea05dc 1770 || !WPACKET_sub_memcpy_u16(pkt, s->cert->psk_identity_hint,
c13d2a5b
MC		 1771 len)) {
1772 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1773 ERR_R_INTERNAL_ERROR);
1774 goto f_err;
85269210 1775 }
e27f234a 1776 }
85269210
DSH		 1777#endif
1778
e27f234a 1779 for (i = 0; i < 4 && r[i] != NULL; i++) {
c13d2a5b
MC		 1780 unsigned char *binval;
1781 int res;
1782
edc032b5 1783#ifndef OPENSSL_NO_SRP
e27f234a 1784 if ((i == 2) && (type & SSL_kSRP)) {
7cea05dc 1785 res = WPACKET_start_sub_packet_u8(pkt);
e27f234a 1786 } else
78a01b3f 1787#endif
7cea05dc 1788 res = WPACKET_start_sub_packet_u16(pkt);
c13d2a5b
MC		 1789
1790 if (!res) {
1791 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1792 ERR_R_INTERNAL_ERROR);
1793 goto f_err;
1794 }
1795
78a01b3f 1796#ifndef OPENSSL_NO_DH
a230b26e 1797 /*-
78a01b3f 1798 * for interoperability with some versions of the Microsoft TLS
1799 * stack, we need to zero pad the DHE pub key to the same length
1800 * as the prime
1801 */
1802 if ((i == 2) && (type & (SSL_kDHE | SSL_kDHEPSK))) {
c13d2a5b 1803 size_t len = BN_num_bytes(r[0]) - BN_num_bytes(r[2]);
ff819477 1804
c13d2a5b 1805 if (len > 0) {
7cea05dc 1806 if (!WPACKET_allocate_bytes(pkt, len, &binval)) {
c13d2a5b
MC		 1807 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1808 ERR_R_INTERNAL_ERROR);
1809 goto f_err;
1810 }
1811 memset(binval, 0, len);
78a01b3f 1812 }
c13d2a5b 1813 }
edc032b5 1814#endif
7cea05dc
MC		 1815 if (!WPACKET_allocate_bytes(pkt, BN_num_bytes(r[i]), &binval)
1816 || !WPACKET_close(pkt)) {
c13d2a5b
MC		 1817 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1818 ERR_R_INTERNAL_ERROR);
1819 goto f_err;
1820 }
1821
1822 BN_bn2bin(r[i], binval);
e27f234a 1823 }
d02b48c6 1824
10bf4fc2 1825#ifndef OPENSSL_NO_EC
e27f234a
MC		 1826 if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {
1827 /*
c13d2a5b
MC		 1828 * We only support named (not generic) curves. In this situation, the
1829 * ServerKeyExchange message has: [1 byte CurveType], [2 byte CurveName]
1830 * [1 byte length of encoded point], followed by the actual encoded
1831 * point itself
e27f234a 1832 */
7cea05dc
MC		 1833 if (!WPACKET_put_bytes_u8(pkt, NAMED_CURVE_TYPE)
1834 || !WPACKET_put_bytes_u8(pkt, 0)
1835 || !WPACKET_put_bytes_u8(pkt, curve_id)
1836 || !WPACKET_sub_memcpy_u8(pkt, encodedPoint, encodedlen)) {
c13d2a5b
MC		 1837 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1838 ERR_R_INTERNAL_ERROR);
1839 goto f_err;
1840 }
e27f234a
MC		 1841 OPENSSL_free(encodedPoint);
1842 encodedPoint = NULL;
e27f234a 1843 }
ea262260
BM		 1844#endif
1845
e27f234a
MC		 1846 /* not anonymous */
1847 if (pkey != NULL) {
1848 /*
1849 * n is the length of the params, they start at &(d[4]) and p
1850 * points to the space at the end.
1851 */
e27f234a 1852 if (md) {
c13d2a5b
MC		 1853 unsigned char *sigbytes1, *sigbytes2;
1854 unsigned int siglen;
1855
1856 /* Get length of the parameters we have written above */
7cea05dc 1857 if (!WPACKET_get_length(pkt, &paramlen)) {
c13d2a5b
MC		 1858 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1859 ERR_R_INTERNAL_ERROR);
1860 goto f_err;
1861 }
e27f234a
MC		 1862 /* send signature algorithm */
1863 if (SSL_USE_SIGALGS(s)) {
7cea05dc 1864 if (!tls12_get_sigandhash(pkt, pkey, md)) {
e27f234a 1865 /* Should never happen */
e27f234a
MC		 1866 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1867 ERR_R_INTERNAL_ERROR);
1868 goto f_err;
0f113f3e 1869 }
e27f234a 1870 }
a2f9200f 1871#ifdef SSL_DEBUG
e27f234a 1872 fprintf(stderr, "Using hash %s\n", EVP_MD_name(md));
a2f9200f 1873#endif
c13d2a5b
MC		 1874 /*
1875 * Create the signature. We don't know the actual length of the sig
1876 * until after we've created it, so we reserve enough bytes for it
1877 * up front, and then properly allocate them in the WPACKET
1878 * afterwards.
1879 */
7cea05dc 1880 if (!WPACKET_sub_reserve_bytes_u16(pkt, EVP_PKEY_size(pkey),
c13d2a5b
MC		 1881 &sigbytes1)
1882 || EVP_SignInit_ex(md_ctx, md, NULL) <= 0
1883 || EVP_SignUpdate(md_ctx, &(s->s3->client_random[0]),
1884 SSL3_RANDOM_SIZE) <= 0
1885 || EVP_SignUpdate(md_ctx, &(s->s3->server_random[0]),
1886 SSL3_RANDOM_SIZE) <= 0
1887 || EVP_SignUpdate(md_ctx, s->init_buf->data + paramoffset,
1888 paramlen) <= 0
1889 || EVP_SignFinal(md_ctx, sigbytes1, &siglen, pkey) <= 0
7cea05dc 1890 || !WPACKET_sub_allocate_bytes_u16(pkt, siglen, &sigbytes2)
c13d2a5b
MC		 1891 || sigbytes1 != sigbytes2) {
1892 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1893 ERR_R_INTERNAL_ERROR);
5f3d93e4 1894 goto f_err;
0f113f3e 1895 }
e27f234a
MC		 1896 } else {
1897 /* Is this error check actually needed? */
77d514c5 1898 al = SSL_AD_HANDSHAKE_FAILURE;
e27f234a
MC		 1899 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1900 SSL_R_UNKNOWN_PKEY_TYPE);
77d514c5
MC		 1901 goto f_err;
1902 }
0f113f3e
MC		 1903 }
1904
bfb0641f 1905 EVP_MD_CTX_free(md_ctx);
e27f234a 1906 return 1;
0f113f3e
MC		 1907 f_err:
1908 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1909 err:
e2b420fd
DSH		 1910#ifndef OPENSSL_NO_DH
1911 EVP_PKEY_free(pkdh);
1912#endif
556efe79 1913#ifndef OPENSSL_NO_EC
b548a1f1 1914 OPENSSL_free(encodedPoint);
ea262260 1915#endif
bfb0641f 1916 EVP_MD_CTX_free(md_ctx);
e27f234a 1917 return 0;
0f113f3e 1918}
d02b48c6 1919
7cea05dc 1920int tls_construct_certificate_request(SSL *s, WPACKET *pkt)
0f113f3e 1921{
28ff8ef3 1922 int i, nl;
0f113f3e 1923 STACK_OF(X509_NAME) *sk = NULL;
0f113f3e 1924
e27f234a 1925 /* get the list of acceptable cert types */
7cea05dc
MC		 1926 if (!WPACKET_start_sub_packet_u8(pkt)
1927 || !ssl3_get_req_cert_type(s, pkt)
1928 || !WPACKET_close(pkt)) {
28ff8ef3
MC		 1929 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);
1930 goto err;
1931 }
0f113f3e 1932
e27f234a
MC		 1933 if (SSL_USE_SIGALGS(s)) {
1934 const unsigned char *psigs;
e27f234a 1935 nl = tls12_get_psigalgs(s, &psigs);
7cea05dc
MC		 1936 if (!WPACKET_start_sub_packet_u16(pkt)
1937 || !tls12_copy_sigalgs(s, pkt, psigs, nl)
1938 || !WPACKET_close(pkt)) {
28ff8ef3
MC		 1939 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
1940 ERR_R_INTERNAL_ERROR);
1941 goto err;
1942 }
e27f234a 1943 }
0f113f3e 1944
28ff8ef3 1945 /* Start sub-packet for client CA list */
7cea05dc 1946 if (!WPACKET_start_sub_packet_u16(pkt)) {
28ff8ef3
MC		 1947 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);
1948 goto err;
1949 }
e27f234a
MC		 1950
1951 sk = SSL_get_client_CA_list(s);
e27f234a
MC		 1952 if (sk != NULL) {
1953 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
28ff8ef3
MC		 1954 unsigned char *namebytes;
1955 X509_NAME *name = sk_X509_NAME_value(sk, i);
1956 int namelen;
1957
1958 if (name == NULL
1959 || (namelen = i2d_X509_NAME(name, NULL)) < 0
7cea05dc 1960 || !WPACKET_sub_allocate_bytes_u16(pkt, namelen,
28ff8ef3
MC		 1961 &namebytes)
1962 || i2d_X509_NAME(name, &namebytes) != namelen) {
1963 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
1964 ERR_R_INTERNAL_ERROR);
e27f234a 1965 goto err;
0f113f3e
MC		 1966 }
1967 }
e27f234a
MC		 1968 }
1969 /* else no CA names */
d02b48c6 1970
5923ad4b 1971 if (!WPACKET_close(pkt)) {
e27f234a
MC		 1972 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);
1973 goto err;
0f113f3e 1974 }
d02b48c6 1975
e27f234a
MC		 1976 s->s3->tmp.cert_request = 1;
1977
1978 return 1;
0f113f3e 1979 err:
28ff8ef3 1980 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
e27f234a 1981 return 0;
0f113f3e 1982}
d02b48c6 1983
0907d710 1984static int tls_process_cke_psk_preamble(SSL *s, PACKET *pkt, int *al)
e27f234a 1985{
85269210 1986#ifndef OPENSSL_NO_PSK
0907d710
MC		 1987 unsigned char psk[PSK_MAX_PSK_LEN];
1988 size_t psklen;
1989 PACKET psk_identity;
efcdbcbe 1990
0907d710
MC		 1991 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity)) {
1992 *al = SSL_AD_DECODE_ERROR;
c76a4aea 1993 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_LENGTH_MISMATCH);
0907d710
MC		 1994 return 0;
1995 }
1996 if (PACKET_remaining(&psk_identity) > PSK_MAX_IDENTITY_LEN) {
1997 *al = SSL_AD_DECODE_ERROR;
c76a4aea 1998 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_DATA_LENGTH_TOO_LONG);
0907d710
MC		 1999 return 0;
2000 }
2001 if (s->psk_server_callback == NULL) {
2002 *al = SSL_AD_INTERNAL_ERROR;
a230b26e 2003 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_PSK_NO_SERVER_CB);
0907d710
MC		 2004 return 0;
2005 }
85269210 2006
0907d710
MC		 2007 if (!PACKET_strndup(&psk_identity, &s->session->psk_identity)) {
2008 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2009 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
0907d710
MC		 2010 return 0;
2011 }
85269210 2012
0907d710 2013 psklen = s->psk_server_callback(s, s->session->psk_identity,
a230b26e 2014 psk, sizeof(psk));
85269210 2015
0907d710
MC		 2016 if (psklen > PSK_MAX_PSK_LEN) {
2017 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2018 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
0907d710
MC		 2019 return 0;
2020 } else if (psklen == 0) {
2021 /*
2022 * PSK related to the given identity not found
2023 */
2024 *al = SSL_AD_UNKNOWN_PSK_IDENTITY;
c76a4aea 2025 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
0907d710
MC		 2026 SSL_R_PSK_IDENTITY_NOT_FOUND);
2027 return 0;
2028 }
85269210 2029
0907d710
MC		 2030 OPENSSL_free(s->s3->tmp.psk);
2031 s->s3->tmp.psk = OPENSSL_memdup(psk, psklen);
2032 OPENSSL_cleanse(psk, psklen);
85269210 2033
0907d710
MC		 2034 if (s->s3->tmp.psk == NULL) {
2035 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2036 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_MALLOC_FAILURE);
0907d710 2037 return 0;
85269210 2038 }
0907d710
MC		 2039
2040 s->s3->tmp.psklen = psklen;
2041
2042 return 1;
2043#else
2044 /* Should never happen */
2045 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2046 SSLerr(SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
0907d710 2047 return 0;
85269210 2048#endif
0907d710
MC		 2049}
2050
0907d710
MC		 2051static int tls_process_cke_rsa(SSL *s, PACKET *pkt, int *al)
2052{
bc36ee62 2053#ifndef OPENSSL_NO_RSA
0907d710
MC		 2054 unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];
2055 int decrypt_len;
2056 unsigned char decrypt_good, version_good;
2057 size_t j, padding_len;
2058 PACKET enc_premaster;
2059 RSA *rsa = NULL;
2060 unsigned char *rsa_decrypt = NULL;
2061 int ret = 0;
2062
2063 rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey);
2064 if (rsa == NULL) {
2065 *al = SSL_AD_HANDSHAKE_FAILURE;
c76a4aea 2066 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_MISSING_RSA_CERTIFICATE);
0907d710
MC		 2067 return 0;
2068 }
2069
2070 /* SSLv3 and pre-standard DTLS omit the length bytes. */
2071 if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {
2072 enc_premaster = *pkt;
2073 } else {
2074 if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)
2075 || PACKET_remaining(pkt) != 0) {
2076 *al = SSL_AD_DECODE_ERROR;
c76a4aea 2077 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_LENGTH_MISMATCH);
0907d710 2078 return 0;
0f113f3e 2079 }
0907d710 2080 }
0f113f3e 2081
0907d710
MC		 2082 /*
2083 * We want to be sure that the plaintext buffer size makes it safe to
2084 * iterate over the entire size of a premaster secret
2085 * (SSL_MAX_MASTER_KEY_LENGTH). Reject overly short RSA keys because
2086 * their ciphertext cannot accommodate a premaster secret anyway.
2087 */
2088 if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {
2089 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2090 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, RSA_R_KEY_SIZE_TOO_SMALL);
0907d710
MC		 2091 return 0;
2092 }
0f113f3e 2093
0907d710
MC		 2094 rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
2095 if (rsa_decrypt == NULL) {
2096 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2097 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_MALLOC_FAILURE);
0907d710
MC		 2098 return 0;
2099 }
0f113f3e 2100
0907d710
MC		 2101 /*
2102 * We must not leak whether a decryption failure occurs because of
2103 * Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246,
2104 * section 7.4.7.1). The code follows that advice of the TLS RFC and
2105 * generates a random premaster secret for the case that the decrypt
2106 * fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1
2107 */
20ca916d 2108
a230b26e 2109 if (RAND_bytes(rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0)
0907d710 2110 goto err;
0f113f3e 2111
0907d710
MC		 2112 /*
2113 * Decrypt with no padding. PKCS#1 padding will be removed as part of
2114 * the timing-sensitive code below.
2115 */
2116 decrypt_len = RSA_private_decrypt(PACKET_remaining(&enc_premaster),
2117 PACKET_data(&enc_premaster),
2118 rsa_decrypt, rsa, RSA_NO_PADDING);
2119 if (decrypt_len < 0)
2120 goto err;
20ca916d 2121
0907d710 2122 /* Check the padding. See RFC 3447, section 7.2.2. */
5b8fa431 2123
0907d710
MC		 2124 /*
2125 * The smallest padded premaster is 11 bytes of overhead. Small keys
2126 * are publicly invalid, so this may return immediately. This ensures
2127 * PS is at least 8 bytes.
2128 */
2129 if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {
2130 *al = SSL_AD_DECRYPT_ERROR;
c76a4aea 2131 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_DECRYPTION_FAILED);
0907d710
MC		 2132 goto err;
2133 }
0f113f3e 2134
0907d710
MC		 2135 padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;
2136 decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &
a230b26e 2137 constant_time_eq_int_8(rsa_decrypt[1], 2);
0907d710
MC		 2138 for (j = 2; j < padding_len - 1; j++) {
2139 decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
2140 }
2141 decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);
5b8fa431 2142
0907d710
MC		 2143 /*
2144 * If the version in the decrypted pre-master secret is correct then
2145 * version_good will be 0xff, otherwise it'll be zero. The
2146 * Klima-Pokorny-Rosa extension of Bleichenbacher's attack
2147 * (http://eprint.iacr.org/2003/052/) exploits the version number
2148 * check as a "bad version oracle". Thus version checks are done in
2149 * constant time and are treated like any other decryption error.
2150 */
2151 version_good =
2152 constant_time_eq_8(rsa_decrypt[padding_len],
2153 (unsigned)(s->client_version >> 8));
2154 version_good &=
2155 constant_time_eq_8(rsa_decrypt[padding_len + 1],
2156 (unsigned)(s->client_version & 0xff));
0f113f3e 2157
0907d710
MC		 2158 /*
2159 * The premaster secret must contain the same version number as the
2160 * ClientHello to detect version rollback attacks (strangely, the
2161 * protocol does not offer such protection for DH ciphersuites).
2162 * However, buggy clients exist that send the negotiated protocol
2163 * version instead if the server does not support the requested
2164 * protocol version. If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such
2165 * clients.
2166 */
2167 if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {
2168 unsigned char workaround_good;
2169 workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],
2170 (unsigned)(s->version >> 8));
2171 workaround_good &=
5b8fa431 2172 constant_time_eq_8(rsa_decrypt[padding_len + 1],
0907d710
MC		 2173 (unsigned)(s->version & 0xff));
2174 version_good |= workaround_good;
2175 }
0f113f3e 2176
0907d710
MC		 2177 /*
2178 * Both decryption and version must be good for decrypt_good to
2179 * remain non-zero (0xff).
2180 */
2181 decrypt_good &= version_good;
0f113f3e 2182
0907d710
MC		 2183 /*
2184 * Now copy rand_premaster_secret over from p using
2185 * decrypt_good_mask. If decryption failed, then p does not
2186 * contain valid plaintext, however, a check above guarantees
2187 * it is still sufficiently large to read from.
2188 */
2189 for (j = 0; j < sizeof(rand_premaster_secret); j++) {
2190 rsa_decrypt[padding_len + j] =
2191 constant_time_select_8(decrypt_good,
2192 rsa_decrypt[padding_len + j],
2193 rand_premaster_secret[j]);
2194 }
0f113f3e 2195
0907d710
MC		 2196 if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,
2197 sizeof(rand_premaster_secret), 0)) {
2198 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2199 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);
0907d710
MC		 2200 goto err;
2201 }
0f113f3e 2202
0907d710
MC		 2203 ret = 1;
2204 err:
2205 OPENSSL_free(rsa_decrypt);
2206 return ret;
2207#else
2208 /* Should never happen */
2209 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2210 SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);
0907d710
MC		 2211 return 0;
2212#endif
2213}
2214
642360f9
MC		 2215static int tls_process_cke_dhe(SSL *s, PACKET *pkt, int *al)
2216{
2217#ifndef OPENSSL_NO_DH
2218 EVP_PKEY *skey = NULL;
2219 DH *cdh;
2220 unsigned int i;
2221 BIGNUM *pub_key;
2222 const unsigned char *data;
2223 EVP_PKEY *ckey = NULL;
2224 int ret = 0;
2225
31a7d80d 2226 if (!PACKET_get_net_2(pkt, &i) || PACKET_remaining(pkt) != i) {
642360f9 2227 *al = SSL_AD_HANDSHAKE_FAILURE;
c76a4aea 2228 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE,
642360f9
MC		 2229 SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
2230 goto err;
2231 }
642360f9
MC		 2232 skey = s->s3->tmp.pkey;
2233 if (skey == NULL) {
2234 *al = SSL_AD_HANDSHAKE_FAILURE;
c76a4aea 2235 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_MISSING_TMP_DH_KEY);
642360f9
MC		 2236 goto err;
2237 }
2238
2239 if (PACKET_remaining(pkt) == 0L) {
2240 *al = SSL_AD_HANDSHAKE_FAILURE;
c76a4aea 2241 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_MISSING_TMP_DH_KEY);
642360f9
MC		 2242 goto err;
2243 }
2244 if (!PACKET_get_bytes(pkt, &data, i)) {
2245 /* We already checked we have enough data */
2246 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2247 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR);
642360f9
MC		 2248 goto err;
2249 }
2250 ckey = EVP_PKEY_new();
2251 if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) == 0) {
c76a4aea 2252 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_BN_LIB);
642360f9
MC		 2253 goto err;
2254 }
2255 cdh = EVP_PKEY_get0_DH(ckey);
2256 pub_key = BN_bin2bn(data, i, NULL);
2257
2258 if (pub_key == NULL || !DH_set0_key(cdh, pub_key, NULL)) {
c76a4aea 2259 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR);
642360f9
MC		 2260 if (pub_key != NULL)
2261 BN_free(pub_key);
2262 goto err;
2263 }
2264
2265 if (ssl_derive(s, skey, ckey) == 0) {
2266 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2267 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR);
642360f9
MC		 2268 goto err;
2269 }
2270
2271 ret = 1;
2272 EVP_PKEY_free(s->s3->tmp.pkey);
2273 s->s3->tmp.pkey = NULL;
2274 err:
2275 EVP_PKEY_free(ckey);
2276 return ret;
2277#else
2278 /* Should never happen */
2279 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2280 SSLerr(SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR);
642360f9
MC		 2281 return 0;
2282#endif
2283}
2284
19ed1ec1
MC		 2285static int tls_process_cke_ecdhe(SSL *s, PACKET *pkt, int *al)
2286{
2287#ifndef OPENSSL_NO_EC
2288 EVP_PKEY *skey = s->s3->tmp.pkey;
2289 EVP_PKEY *ckey = NULL;
2290 int ret = 0;
2291
2292 if (PACKET_remaining(pkt) == 0L) {
2293 /* We don't support ECDH client auth */
2294 *al = SSL_AD_HANDSHAKE_FAILURE;
c76a4aea 2295 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_MISSING_TMP_ECDH_KEY);
19ed1ec1
MC		 2296 goto err;
2297 } else {
2298 unsigned int i;
2299 const unsigned char *data;
2300
2301 /*
2302 * Get client's public key from encoded point in the
2303 * ClientKeyExchange message.
2304 */
2305
2306 /* Get encoded point length */
fb933982
DSH		 2307 if (!PACKET_get_1(pkt, &i) || !PACKET_get_bytes(pkt, &data, i)
2308 || PACKET_remaining(pkt) != 0) {
19ed1ec1 2309 *al = SSL_AD_DECODE_ERROR;
c76a4aea 2310 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_LENGTH_MISMATCH);
19ed1ec1
MC		 2311 goto err;
2312 }
19ed1ec1
MC		 2313 ckey = EVP_PKEY_new();
2314 if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) <= 0) {
c76a4aea 2315 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_EVP_LIB);
19ed1ec1
MC		 2316 goto err;
2317 }
ec24630a 2318 if (EVP_PKEY_set1_tls_encodedpoint(ckey, data, i) == 0) {
fb933982 2319 *al = SSL_AD_HANDSHAKE_FAILURE;
c76a4aea 2320 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_EC_LIB);
19ed1ec1
MC		 2321 goto err;
2322 }
2323 }
2324
2325 if (ssl_derive(s, skey, ckey) == 0) {
2326 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2327 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_INTERNAL_ERROR);
19ed1ec1
MC		 2328 goto err;
2329 }
2330
2331 ret = 1;
2332 EVP_PKEY_free(s->s3->tmp.pkey);
2333 s->s3->tmp.pkey = NULL;
2334 err:
2335 EVP_PKEY_free(ckey);
2336
2337 return ret;
2338#else
2339 /* Should never happen */
2340 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2341 SSLerr(SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_INTERNAL_ERROR);
19ed1ec1
MC		 2342 return 0;
2343#endif
2344}
2345
c437eef6
MC		 2346static int tls_process_cke_srp(SSL *s, PACKET *pkt, int *al)
2347{
2348#ifndef OPENSSL_NO_SRP
2349 unsigned int i;
2350 const unsigned char *data;
2351
2352 if (!PACKET_get_net_2(pkt, &i)
a230b26e 2353 || !PACKET_get_bytes(pkt, &data, i)) {
c437eef6 2354 *al = SSL_AD_DECODE_ERROR;
c76a4aea 2355 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, SSL_R_BAD_SRP_A_LENGTH);
c437eef6
MC		 2356 return 0;
2357 }
2358 if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) {
c76a4aea 2359 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_BN_LIB);
c437eef6
MC		 2360 return 0;
2361 }
a230b26e 2362 if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0 || BN_is_zero(s->srp_ctx.A)) {
c437eef6 2363 *al = SSL_AD_ILLEGAL_PARAMETER;
c76a4aea 2364 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, SSL_R_BAD_SRP_PARAMETERS);
c437eef6
MC		 2365 return 0;
2366 }
2367 OPENSSL_free(s->session->srp_username);
2368 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);
2369 if (s->session->srp_username == NULL) {
c76a4aea 2370 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_MALLOC_FAILURE);
c437eef6
MC		 2371 return 0;
2372 }
2373
2374 if (!srp_generate_server_master_secret(s)) {
c76a4aea 2375 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_INTERNAL_ERROR);
c437eef6
MC		 2376 return 0;
2377 }
2378
2379 return 1;
2380#else
2381 /* Should never happen */
2382 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2383 SSLerr(SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_INTERNAL_ERROR);
c437eef6
MC		 2384 return 0;
2385#endif
2386}
2387
2388static int tls_process_cke_gost(SSL *s, PACKET *pkt, int *al)
2389{
2390#ifndef OPENSSL_NO_GOST
2391 EVP_PKEY_CTX *pkey_ctx;
2392 EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
2393 unsigned char premaster_secret[32];
2394 const unsigned char *start;
2395 size_t outlen = 32, inlen;
2396 unsigned long alg_a;
2397 int Ttag, Tclass;
2398 long Tlen;
2399 long sess_key_len;
2400 const unsigned char *data;
2401 int ret = 0;
2402
2403 /* Get our certificate private key */
2404 alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2405 if (alg_a & SSL_aGOST12) {
2406 /*
2407 * New GOST ciphersuites have SSL_aGOST01 bit too
2408 */
2409 pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey;
2410 if (pk == NULL) {
2411 pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey;
2412 }
2413 if (pk == NULL) {
2414 pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
2415 }
2416 } else if (alg_a & SSL_aGOST01) {
2417 pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
2418 }
2419
2420 pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
2421 if (pkey_ctx == NULL) {
2422 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2423 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_MALLOC_FAILURE);
c437eef6
MC		 2424 return 0;
2425 }
2426 if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) {
2427 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2428 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR);
c437eef6
MC		 2429 return 0;
2430 }
2431 /*
2432 * If client certificate is present and is of the same type, maybe
2433 * use it for key exchange. Don't mind errors from
2434 * EVP_PKEY_derive_set_peer, because it is completely valid to use a
2435 * client certificate for authorization only.
2436 */
2437 client_pub_pkey = X509_get0_pubkey(s->session->peer);
2438 if (client_pub_pkey) {
2439 if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)
2440 ERR_clear_error();
2441 }
2442 /* Decrypt session key */
2443 sess_key_len = PACKET_remaining(pkt);
2444 if (!PACKET_get_bytes(pkt, &data, sess_key_len)) {
2445 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2446 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR);
c437eef6
MC		 2447 goto err;
2448 }
a230b26e
EK		 2449 if (ASN1_get_object((const unsigned char **)&data, &Tlen, &Ttag,
2450 &Tclass, sess_key_len) != V_ASN1_CONSTRUCTED
2451 || Ttag != V_ASN1_SEQUENCE || Tclass != V_ASN1_UNIVERSAL) {
c437eef6 2452 *al = SSL_AD_DECODE_ERROR;
c76a4aea 2453 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED);
c437eef6
MC		 2454 goto err;
2455 }
2456 start = data;
2457 inlen = Tlen;
2458 if (EVP_PKEY_decrypt
2459 (pkey_ctx, premaster_secret, &outlen, start, inlen) <= 0) {
2460 *al = SSL_AD_DECODE_ERROR;
c76a4aea 2461 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED);
c437eef6
MC		 2462 goto err;
2463 }
2464 /* Generate master secret */
2465 if (!ssl_generate_master_secret(s, premaster_secret,
2466 sizeof(premaster_secret), 0)) {
2467 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2468 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR);
c437eef6
MC		 2469 goto err;
2470 }
2471 /* Check if pubkey from client certificate was used */
2472 if (EVP_PKEY_CTX_ctrl
2473 (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)
2474 s->statem.no_cert_verify = 1;
2475
2476 ret = 1;
2477 err:
2478 EVP_PKEY_CTX_free(pkey_ctx);
2479 return ret;
2480#else
2481 /* Should never happen */
2482 *al = SSL_AD_INTERNAL_ERROR;
c76a4aea 2483 SSLerr(SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR);
c437eef6
MC		 2484 return 0;
2485#endif
2486}
2487
0907d710
MC		 2488MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt)
2489{
2490 int al = -1;
2491 unsigned long alg_k;
2492
2493 alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2494
2495 /* For PSK parse and retrieve identity, obtain PSK key */
2496 if ((alg_k & SSL_PSK) && !tls_process_cke_psk_preamble(s, pkt, &al))
2497 goto err;
2498
2499 if (alg_k & SSL_kPSK) {
2500 /* Identity extracted earlier: should be nothing left */
2501 if (PACKET_remaining(pkt) != 0) {
2502 al = SSL_AD_HANDSHAKE_FAILURE;
a230b26e
EK		 2503 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2504 SSL_R_LENGTH_MISMATCH);
9059eb71 2505 goto err;
0907d710
MC		 2506 }
2507 /* PSK handled by ssl_generate_master_secret */
2508 if (!ssl_generate_master_secret(s, NULL, 0, 0)) {
69f68237 2509 al = SSL_AD_INTERNAL_ERROR;
e27f234a 2510 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
9059eb71 2511 goto err;
69f68237 2512 }
0907d710
MC		 2513 } else if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) {
2514 if (!tls_process_cke_rsa(s, pkt, &al))
2515 goto err;
642360f9
MC		 2516 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
2517 if (!tls_process_cke_dhe(s, pkt, &al))
0f113f3e 2518 goto err;
19ed1ec1
MC		 2519 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
2520 if (!tls_process_cke_ecdhe(s, pkt, &al))
2521 goto err;
c437eef6
MC		 2522 } else if (alg_k & SSL_kSRP) {
2523 if (!tls_process_cke_srp(s, pkt, &al))
0f113f3e 2524 goto err;
c437eef6
MC		 2525 } else if (alg_k & SSL_kGOST) {
2526 if (!tls_process_cke_gost(s, pkt, &al))
0f113f3e 2527 goto err;
c437eef6 2528 } else {
0f113f3e 2529 al = SSL_AD_HANDSHAKE_FAILURE;
a230b26e
EK		 2530 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2531 SSL_R_UNKNOWN_CIPHER_TYPE);
9059eb71 2532 goto err;
0f113f3e
MC		 2533 }
2534
e27f234a 2535 return MSG_PROCESS_CONTINUE_PROCESSING;
0f113f3e 2536 err:
0907d710
MC		 2537 if (al != -1)
2538 ssl3_send_alert(s, SSL3_AL_FATAL, al);
85269210
DSH		 2539#ifndef OPENSSL_NO_PSK
2540 OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen);
2541 s->s3->tmp.psk = NULL;
58964a49 2542#endif
fe3a3291 2543 ossl_statem_set_error(s);
e27f234a 2544 return MSG_PROCESS_ERROR;
0f113f3e 2545}
d02b48c6 2546
be3583fa 2547WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst)
94836de2 2548{
94836de2 2549#ifndef OPENSSL_NO_SCTP
c130dd8e
MC		 2550 if (wst == WORK_MORE_A) {
2551 if (SSL_IS_DTLS(s)) {
2552 unsigned char sctpauthkey[64];
2553 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
2554 /*
2555 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
2556 * used.
2557 */
141eb8c6
MC		 2558 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
2559 sizeof(DTLS1_SCTP_AUTH_LABEL));
c130dd8e
MC		 2560
2561 if (SSL_export_keying_material(s, sctpauthkey,
a230b26e
EK		 2562 sizeof(sctpauthkey), labelbuffer,
2563 sizeof(labelbuffer), NULL, 0,
2564 0) <= 0) {
fe3a3291 2565 ossl_statem_set_error(s);
c130dd8e
MC		 2566 return WORK_ERROR;;
2567 }
94836de2 2568
c130dd8e
MC		 2569 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
2570 sizeof(sctpauthkey), sctpauthkey);
94836de2 2571 }
c130dd8e
MC		 2572 wst = WORK_MORE_B;
2573 }
94836de2 2574
c130dd8e 2575 if ((wst == WORK_MORE_B)
a230b26e
EK		 2576 /* Is this SCTP? */
2577 && BIO_dgram_is_sctp(SSL_get_wbio(s))
2578 /* Are we renegotiating? */
2579 && s->renegotiate
2580 /* Are we going to skip the CertificateVerify? */
2581 && (s->session->peer == NULL || s->statem.no_cert_verify)
2582 && BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
c130dd8e
MC		 2583 s->s3->in_read_app_data = 2;
2584 s->rwstate = SSL_READING;
2585 BIO_clear_retry_flags(SSL_get_rbio(s));
2586 BIO_set_retry_read(SSL_get_rbio(s));
d99b0691 2587 ossl_statem_set_sctp_read_sock(s, 1);
c130dd8e
MC		 2588 return WORK_MORE_B;
2589 } else {
fe3a3291 2590 ossl_statem_set_sctp_read_sock(s, 0);
94836de2
MC		 2591 }
2592#endif
2593
149c2ef5 2594 if (s->statem.no_cert_verify || !s->session->peer) {
a230b26e
EK		 2595 /*
2596 * No certificate verify or no peer certificate so we no longer need
2597 * the handshake_buffer
149c2ef5
MC		 2598 */
2599 if (!ssl3_digest_cached_records(s, 0)) {
2600 ossl_statem_set_error(s);
2601 return WORK_ERROR;
2602 }
94836de2 2603 return WORK_FINISHED_CONTINUE;
28f4580c 2604 } else {
94836de2
MC		 2605 if (!s->s3->handshake_buffer) {
2606 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE,
2607 ERR_R_INTERNAL_ERROR);
fe3a3291 2608 ossl_statem_set_error(s);
94836de2
MC		 2609 return WORK_ERROR;
2610 }
2611 /*
2612 * For sigalgs freeze the handshake buffer. If we support
2613 * extms we've done this already so this is a no-op
2614 */
2615 if (!ssl3_digest_cached_records(s, 1)) {
fe3a3291 2616 ossl_statem_set_error(s);
94836de2
MC		 2617 return WORK_ERROR;
2618 }
94836de2
MC		 2619 }
2620
2621 return WORK_FINISHED_CONTINUE;
2622}
2623
be3583fa 2624MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
e27f234a
MC		 2625{
2626 EVP_PKEY *pkey = NULL;
b6981744 2627 const unsigned char *sig, *data;
5ca17d8c 2628#ifndef OPENSSL_NO_GOST
b6981744 2629 unsigned char *gost_data = NULL;
5ca17d8c 2630#endif
e27f234a 2631 int al, ret = MSG_PROCESS_ERROR;
28f4580c 2632 int type = 0, j;
e27f234a
MC		 2633 unsigned int len;
2634 X509 *peer;
2635 const EVP_MD *md = NULL;
28f4580c
DSH		 2636 long hdatalen = 0;
2637 void *hdata;
2638
bfb0641f 2639 EVP_MD_CTX *mctx = EVP_MD_CTX_new();
6e59a892
RL		 2640
2641 if (mctx == NULL) {
2642 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
2643 al = SSL_AD_INTERNAL_ERROR;
2644 goto f_err;
2645 }
e27f234a 2646
a0bd6493 2647 peer = s->session->peer;
8382fd3a 2648 pkey = X509_get0_pubkey(peer);
a0bd6493 2649 type = X509_certificate_type(peer, pkey);
0f113f3e
MC		 2650
2651 if (!(type & EVP_PKT_SIGN)) {
e27f234a 2652 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
0f113f3e
MC		 2653 SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
2654 al = SSL_AD_ILLEGAL_PARAMETER;
2655 goto f_err;
2656 }
2657
0f113f3e
MC		 2658 /* Check for broken implementations of GOST ciphersuites */
2659 /*
2660 * If key is GOST and n is exactly 64, it is bare signature without
e44380a9 2661 * length field (CryptoPro implementations at least till CSP 4.0)
0f113f3e 2662 */
2a9b9654 2663#ifndef OPENSSL_NO_GOST
3aeb9348
DSH		 2664 if (PACKET_remaining(pkt) == 64
2665 && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {
f532a35d 2666 len = 64;
2a9b9654
MC		 2667 } else
2668#endif
2669 {
0f113f3e 2670 if (SSL_USE_SIGALGS(s)) {
f532a35d
MC		 2671 int rv;
2672
73999b62 2673 if (!PACKET_get_bytes(pkt, &sig, 2)) {
f532a35d
MC		 2674 al = SSL_AD_DECODE_ERROR;
2675 goto f_err;
2676 }
2677 rv = tls12_check_peer_sigalg(&md, s, sig, pkey);
0f113f3e
MC		 2678 if (rv == -1) {
2679 al = SSL_AD_INTERNAL_ERROR;
2680 goto f_err;
2681 } else if (rv == 0) {
2682 al = SSL_AD_DECODE_ERROR;
2683 goto f_err;
2684 }
f37f20ff 2685#ifdef SSL_DEBUG
0f113f3e 2686 fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
f37f20ff 2687#endif
28f4580c 2688 } else {
aa430c74
DSH		 2689 /* Use default digest for this key type */
2690 int idx = ssl_cert_type(NULL, pkey);
2691 if (idx >= 0)
2692 md = s->s3->tmp.md[idx];
2693 if (md == NULL) {
2694 al = SSL_AD_INTERNAL_ERROR;
2695 goto f_err;
2696 }
0f113f3e 2697 }
aa430c74 2698
73999b62 2699 if (!PACKET_get_net_2(pkt, &len)) {
e27f234a 2700 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);
0f113f3e
MC		 2701 al = SSL_AD_DECODE_ERROR;
2702 goto f_err;
2703 }
2704 }
2705 j = EVP_PKEY_size(pkey);
73999b62 2706 if (((int)len > j) || ((int)PACKET_remaining(pkt) > j)
a230b26e 2707 || (PACKET_remaining(pkt) == 0)) {
e27f234a 2708 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE);
0f113f3e
MC		 2709 al = SSL_AD_DECODE_ERROR;
2710 goto f_err;
2711 }
73999b62 2712 if (!PACKET_get_bytes(pkt, &data, len)) {
e27f234a 2713 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);
f532a35d
MC		 2714 al = SSL_AD_DECODE_ERROR;
2715 goto f_err;
2716 }
0f113f3e 2717
28f4580c
DSH		 2718 hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
2719 if (hdatalen <= 0) {
2720 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2721 al = SSL_AD_INTERNAL_ERROR;
2722 goto f_err;
2723 }
f37f20ff 2724#ifdef SSL_DEBUG
28f4580c 2725 fprintf(stderr, "Using client verify alg %s\n", EVP_MD_name(md));
f37f20ff 2726#endif
6e59a892
RL		 2727 if (!EVP_VerifyInit_ex(mctx, md, NULL)
2728 || !EVP_VerifyUpdate(mctx, hdata, hdatalen)) {
28f4580c
DSH		 2729 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB);
2730 al = SSL_AD_INTERNAL_ERROR;
2731 goto f_err;
2732 }
2a9b9654 2733#ifndef OPENSSL_NO_GOST
3aeb9348
DSH		 2734 {
2735 int pktype = EVP_PKEY_id(pkey);
2736 if (pktype == NID_id_GostR3410_2001
2737 || pktype == NID_id_GostR3410_2012_256
b6981744
EK		 2738 || pktype == NID_id_GostR3410_2012_512) {
2739 if ((gost_data = OPENSSL_malloc(len)) == NULL) {
2740 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
2741 al = SSL_AD_INTERNAL_ERROR;
2742 goto f_err;
2743 }
2744 BUF_reverse(gost_data, data, len);
2745 data = gost_data;
2746 }
28f4580c 2747 }
2a9b9654 2748#endif
e44380a9 2749
28f4580c 2750 if (s->version == SSL3_VERSION
6e59a892 2751 && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
28f4580c
DSH		 2752 s->session->master_key_length,
2753 s->session->master_key)) {
2754 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB);
2755 al = SSL_AD_INTERNAL_ERROR;
2756 goto f_err;
2757 }
2758
6e59a892 2759 if (EVP_VerifyFinal(mctx, data, len, pkey) <= 0) {
28f4580c
DSH		 2760 al = SSL_AD_DECRYPT_ERROR;
2761 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_BAD_SIGNATURE);
0f113f3e
MC		 2762 goto f_err;
2763 }
2764
c130dd8e 2765 ret = MSG_PROCESS_CONTINUE_PROCESSING;
0f113f3e
MC		 2766 if (0) {
2767 f_err:
2768 ssl3_send_alert(s, SSL3_AL_FATAL, al);
fe3a3291 2769 ossl_statem_set_error(s);
0f113f3e 2770 }
25aaa98a
RS		 2771 BIO_free(s->s3->handshake_buffer);
2772 s->s3->handshake_buffer = NULL;
bfb0641f 2773 EVP_MD_CTX_free(mctx);
5ca17d8c 2774#ifndef OPENSSL_NO_GOST
b6981744 2775 OPENSSL_free(gost_data);
5ca17d8c 2776#endif
e27f234a 2777 return ret;
0f113f3e 2778}
d02b48c6 2779
be3583fa 2780MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt)
e27f234a 2781{
20dbe585 2782 int i, al = SSL_AD_INTERNAL_ERROR, ret = MSG_PROCESS_ERROR;
e27f234a
MC		 2783 X509 *x = NULL;
2784 unsigned long l, llen;
b6981744 2785 const unsigned char *certstart, *certbytes;
e27f234a 2786 STACK_OF(X509) *sk = NULL;
73999b62 2787 PACKET spkt;
0f113f3e
MC		 2788
2789 if ((sk = sk_X509_new_null()) == NULL) {
e27f234a
MC		 2790 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
2791 goto f_err;
0f113f3e
MC		 2792 }
2793
73999b62 2794 if (!PACKET_get_net_3(pkt, &llen)
a230b26e
EK		 2795 || !PACKET_get_sub_packet(pkt, &spkt, llen)
2796 || PACKET_remaining(pkt) != 0) {
0f113f3e 2797 al = SSL_AD_DECODE_ERROR;
e27f234a 2798 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_LENGTH_MISMATCH);
0f113f3e
MC		 2799 goto f_err;
2800 }
0bc09ecd
MC		 2801
2802 while (PACKET_remaining(&spkt) > 0) {
2803 if (!PACKET_get_net_3(&spkt, &l)
a230b26e 2804 || !PACKET_get_bytes(&spkt, &certbytes, l)) {
0f113f3e 2805 al = SSL_AD_DECODE_ERROR;
e27f234a 2806 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
0f113f3e
MC		 2807 SSL_R_CERT_LENGTH_MISMATCH);
2808 goto f_err;
2809 }
2810
0bc09ecd
MC		 2811 certstart = certbytes;
2812 x = d2i_X509(NULL, (const unsigned char **)&certbytes, l);
0f113f3e 2813 if (x == NULL) {
e27f234a
MC		 2814 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_ASN1_LIB);
2815 goto f_err;
0f113f3e 2816 }
0bc09ecd 2817 if (certbytes != (certstart + l)) {
0f113f3e 2818 al = SSL_AD_DECODE_ERROR;
e27f234a 2819 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
0f113f3e
MC		 2820 SSL_R_CERT_LENGTH_MISMATCH);
2821 goto f_err;
2822 }
2823 if (!sk_X509_push(sk, x)) {
e27f234a
MC		 2824 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
2825 goto f_err;
0f113f3e
MC		 2826 }
2827 x = NULL;
0f113f3e
MC		 2828 }
2829
2830 if (sk_X509_num(sk) <= 0) {
2831 /* TLS does not mind 0 certs returned */
2832 if (s->version == SSL3_VERSION) {
2833 al = SSL_AD_HANDSHAKE_FAILURE;
e27f234a 2834 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
0f113f3e
MC		 2835 SSL_R_NO_CERTIFICATES_RETURNED);
2836 goto f_err;
2837 }
2838 /* Fail for TLS only if we required a certificate */
2839 else if ((s->verify_mode & SSL_VERIFY_PEER) &&
2840 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
e27f234a 2841 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
0f113f3e
MC		 2842 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
2843 al = SSL_AD_HANDSHAKE_FAILURE;
2844 goto f_err;
2845 }
2846 /* No client certificate so digest cached records */
124037fd 2847 if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) {
0f113f3e
MC		 2848 goto f_err;
2849 }
2850 } else {
2851 EVP_PKEY *pkey;
2852 i = ssl_verify_cert_chain(s, sk);
2853 if (i <= 0) {
2854 al = ssl_verify_alarm_type(s->verify_result);
e27f234a 2855 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
0f113f3e
MC		 2856 SSL_R_CERTIFICATE_VERIFY_FAILED);
2857 goto f_err;
2858 }
2859 if (i > 1) {
e27f234a 2860 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, i);
0f113f3e
MC		 2861 al = SSL_AD_HANDSHAKE_FAILURE;
2862 goto f_err;
2863 }
8382fd3a 2864 pkey = X509_get0_pubkey(sk_X509_value(sk, 0));
0f113f3e
MC		 2865 if (pkey == NULL) {
2866 al = SSL3_AD_HANDSHAKE_FAILURE;
e27f234a 2867 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
0f113f3e
MC		 2868 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
2869 goto f_err;
2870 }
0f113f3e
MC		 2871 }
2872
222561fe 2873 X509_free(s->session->peer);
0f113f3e
MC		 2874 s->session->peer = sk_X509_shift(sk);
2875 s->session->verify_result = s->verify_result;
2876
c34b0f99
DSH		 2877 sk_X509_pop_free(s->session->peer_chain, X509_free);
2878 s->session->peer_chain = sk;
0f113f3e
MC		 2879 /*
2880 * Inconsistency alert: cert_chain does *not* include the peer's own
d4d78943 2881 * certificate, while we do include it in statem_clnt.c
0f113f3e 2882 */
0f113f3e 2883 sk = NULL;
e27f234a 2884 ret = MSG_PROCESS_CONTINUE_READING;
66696478
RS		 2885 goto done;
2886
0f113f3e 2887 f_err:
66696478 2888 ssl3_send_alert(s, SSL3_AL_FATAL, al);
fe3a3291 2889 ossl_statem_set_error(s);
66696478 2890 done:
222561fe
RS		 2891 X509_free(x);
2892 sk_X509_pop_free(sk, X509_free);
e27f234a 2893 return ret;
0f113f3e 2894}
d02b48c6 2895
7cea05dc 2896int tls_construct_server_certificate(SSL *s, WPACKET *pkt)
e27f234a
MC		 2897{
2898 CERT_PKEY *cpk;
2899
2900 cpk = ssl_get_server_send_pkey(s);
2901 if (cpk == NULL) {
2902 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
e27f234a
MC		 2903 return 0;
2904 }
2905
7cea05dc 2906 if (!ssl3_output_cert_chain(s, pkt, cpk)) {
e27f234a 2907 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
e27f234a
MC		 2908 return 0;
2909 }
2910
2911 return 1;
2912}
2913
7cea05dc 2914int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
e27f234a
MC		 2915{
2916 unsigned char *senc = NULL;
83ae4661 2917 EVP_CIPHER_CTX *ctx = NULL;
bf7c6817 2918 HMAC_CTX *hctx = NULL;
a00d75e1 2919 unsigned char *p, *encdata1, *encdata2, *macdata1, *macdata2;
e27f234a 2920 const unsigned char *const_p;
a00d75e1 2921 int len, slen_full, slen, lenfinal;
e27f234a
MC		 2922 SSL_SESSION *sess;
2923 unsigned int hlen;
2924 SSL_CTX *tctx = s->initial_ctx;
2925 unsigned char iv[EVP_MAX_IV_LENGTH];
d139723b
KR		 2926 unsigned char key_name[TLSEXT_KEYNAME_LENGTH];
2927 int iv_len;
a00d75e1 2928 size_t macoffset, macendoffset;
e27f234a
MC		 2929
2930 /* get session encoding length */
2931 slen_full = i2d_SSL_SESSION(s->session, NULL);
2932 /*
2933 * Some length values are 16 bits, so forget it if session is too
2934 * long
2935 */
2936 if (slen_full == 0 || slen_full > 0xFF00) {
fe3a3291 2937 ossl_statem_set_error(s);
e27f234a
MC		 2938 return 0;
2939 }
2940 senc = OPENSSL_malloc(slen_full);
a71edf3b 2941 if (senc == NULL) {
fe3a3291 2942 ossl_statem_set_error(s);
e27f234a
MC		 2943 return 0;
2944 }
0f113f3e 2945
846ec07d 2946 ctx = EVP_CIPHER_CTX_new();
bf7c6817 2947 hctx = HMAC_CTX_new();
83ae4661
MC		 2948 if (ctx == NULL || hctx == NULL) {
2949 SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
2950 goto err;
2951 }
0f113f3e 2952
e27f234a
MC		 2953 p = senc;
2954 if (!i2d_SSL_SESSION(s->session, &p))
2955 goto err;
687eaf27 2956
e27f234a
MC		 2957 /*
2958 * create a fresh copy (not shared with other threads) to clean up
2959 */
2960 const_p = senc;
2961 sess = d2i_SSL_SESSION(NULL, &const_p, slen_full);
2962 if (sess == NULL)
2963 goto err;
2964 sess->session_id_length = 0; /* ID is irrelevant for the ticket */
0f113f3e 2965
e27f234a
MC		 2966 slen = i2d_SSL_SESSION(sess, NULL);
2967 if (slen == 0 || slen > slen_full) { /* shouldn't ever happen */
2968 SSL_SESSION_free(sess);
2969 goto err;
2970 }
2971 p = senc;
2972 if (!i2d_SSL_SESSION(sess, &p)) {
2973 SSL_SESSION_free(sess);
2974 goto err;
2975 }
2976 SSL_SESSION_free(sess);
0f113f3e 2977
e27f234a
MC		 2978 /*
2979 * Initialize HMAC and cipher contexts. If callback present it does
2980 * all the work otherwise use generated values from parent ctx.
2981 */
2982 if (tctx->tlsext_ticket_key_cb) {
5c753de6
TS		 2983 /* if 0 is returned, write an empty ticket */
2984 int ret = tctx->tlsext_ticket_key_cb(s, key_name, iv, ctx,
2985 hctx, 1);
2986
2987 if (ret == 0) {
a00d75e1
MC		 2988
2989 /* Put timeout and length */
7cea05dc 2990 if (!WPACKET_put_bytes_u32(pkt, 0)
4a01c59f 2991 || !WPACKET_put_bytes_u16(pkt, 0)) {
a00d75e1
MC		 2992 SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
2993 ERR_R_INTERNAL_ERROR);
5c753de6 2994 goto err;
a00d75e1 2995 }
5c753de6
TS		 2996 OPENSSL_free(senc);
2997 EVP_CIPHER_CTX_free(ctx);
2998 HMAC_CTX_free(hctx);
2999 return 1;
3000 }
3001 if (ret < 0)
e27f234a 3002 goto err;
d139723b 3003 iv_len = EVP_CIPHER_CTX_iv_length(ctx);
e27f234a 3004 } else {
d139723b
KR		 3005 const EVP_CIPHER *cipher = EVP_aes_256_cbc();
3006
3007 iv_len = EVP_CIPHER_iv_length(cipher);
3008 if (RAND_bytes(iv, iv_len) <= 0)
687eaf27 3009 goto err;
d139723b 3010 if (!EVP_EncryptInit_ex(ctx, cipher, NULL,
e27f234a 3011 tctx->tlsext_tick_aes_key, iv))
687eaf27 3012 goto err;
4e2e1ec9
TS		 3013 if (!HMAC_Init_ex(hctx, tctx->tlsext_tick_hmac_key,
3014 sizeof(tctx->tlsext_tick_hmac_key),
e27f234a 3015 EVP_sha256(), NULL))
4f9fab6b 3016 goto err;
4e2e1ec9
TS		 3017 memcpy(key_name, tctx->tlsext_tick_key_name,
3018 sizeof(tctx->tlsext_tick_key_name));
0f113f3e
MC		 3019 }
3020
e27f234a
MC		 3021 /*
3022 * Ticket lifetime hint (advisory only): We leave this unspecified
3023 * for resumed session (for simplicity), and guess that tickets for
3024 * new sessions will live as long as their sessions.
3025 */
7cea05dc 3026 if (!WPACKET_put_bytes_u32(pkt, s->hit ? 0 : s->session->timeout)
a00d75e1 3027 /* Now the actual ticket data */
7cea05dc
MC		 3028 || !WPACKET_start_sub_packet_u16(pkt)
3029 || !WPACKET_get_total_written(pkt, &macoffset)
a00d75e1 3030 /* Output key name */
7cea05dc 3031 || !WPACKET_memcpy(pkt, key_name, sizeof(key_name))
a00d75e1 3032 /* output IV */
7cea05dc
MC		 3033 || !WPACKET_memcpy(pkt, iv, iv_len)
3034 || !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH,
a00d75e1
MC		 3035 &encdata1)
3036 /* Encrypt session data */
3037 || !EVP_EncryptUpdate(ctx, encdata1, &len, senc, slen)
7cea05dc 3038 || !WPACKET_allocate_bytes(pkt, len, &encdata2)
a00d75e1
MC		 3039 || encdata1 != encdata2
3040 || !EVP_EncryptFinal(ctx, encdata1 + len, &lenfinal)
7cea05dc 3041 || !WPACKET_allocate_bytes(pkt, lenfinal, &encdata2)
a00d75e1
MC		 3042 || encdata1 + len != encdata2
3043 || len + lenfinal > slen + EVP_MAX_BLOCK_LENGTH
7cea05dc 3044 || !WPACKET_get_total_written(pkt, &macendoffset)
a00d75e1
MC		 3045 || !HMAC_Update(hctx,
3046 (unsigned char *)s->init_buf->data + macoffset,
3047 macendoffset - macoffset)
7cea05dc 3048 || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &macdata1)
a00d75e1
MC		 3049 || !HMAC_Final(hctx, macdata1, &hlen)
3050 || hlen > EVP_MAX_MD_SIZE
7cea05dc 3051 || !WPACKET_allocate_bytes(pkt, hlen, &macdata2)
a00d75e1 3052 || macdata1 != macdata2
5923ad4b 3053 || !WPACKET_close(pkt)) {
a00d75e1 3054 SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
e27f234a 3055 goto err;
a00d75e1 3056 }
bcaad809
DSH		 3057 EVP_CIPHER_CTX_free(ctx);
3058 HMAC_CTX_free(hctx);
e27f234a
MC		 3059 OPENSSL_free(senc);
3060
3061 return 1;
687eaf27 3062 err:
b548a1f1 3063 OPENSSL_free(senc);
846ec07d 3064 EVP_CIPHER_CTX_free(ctx);
bf7c6817 3065 HMAC_CTX_free(hctx);
a00d75e1 3066 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
e27f234a 3067 return 0;
0f113f3e 3068}
67c8e7f4 3069
7cea05dc 3070int tls_construct_cert_status(SSL *s, WPACKET *pkt)
e27f234a 3071{
5923ad4b 3072 if (!WPACKET_put_bytes_u8(pkt, s->tlsext_status_type)
7cea05dc 3073 || !WPACKET_sub_memcpy_u24(pkt, s->tlsext_ocsp_resp,
5923ad4b 3074 s->tlsext_ocsp_resplen)) {
cc59ad10
MC		 3075 SSLerr(SSL_F_TLS_CONSTRUCT_CERT_STATUS, ERR_R_INTERNAL_ERROR);
3076 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
cc59ad10
MC		 3077 return 0;
3078 }
e27f234a
MC		 3079
3080 return 1;
3081}
3082
e481f9b9 3083#ifndef OPENSSL_NO_NEXTPROTONEG
e27f234a
MC		 3084/*
3085 * tls_process_next_proto reads a Next Protocol Negotiation handshake message.
3086 * It sets the next_proto member in s if found
3087 */
be3583fa 3088MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt)
e27f234a 3089{
73999b62 3090 PACKET next_proto, padding;
e27f234a
MC		 3091 size_t next_proto_len;
3092
50e735f9
MC		 3093 /*-
3094 * The payload looks like:
3095 * uint8 proto_len;
3096 * uint8 proto[proto_len];
3097 * uint8 padding_len;
3098 * uint8 padding[padding_len];
3099 */
73999b62
MC		 3100 if (!PACKET_get_length_prefixed_1(pkt, &next_proto)
3101 || !PACKET_get_length_prefixed_1(pkt, &padding)
3102 || PACKET_remaining(pkt) > 0) {
e27f234a 3103 SSLerr(SSL_F_TLS_PROCESS_NEXT_PROTO, SSL_R_LENGTH_MISMATCH);
c3fc7eea 3104 goto err;
cf9b0b6f 3105 }
0f113f3e 3106
a230b26e 3107 if (!PACKET_memdup(&next_proto, &s->next_proto_negotiated, &next_proto_len)) {
6d41fc80 3108 s->next_proto_negotiated_len = 0;
c3fc7eea
MC		 3109 goto err;
3110 }
3111
6d41fc80 3112 s->next_proto_negotiated_len = (unsigned char)next_proto_len;
0f113f3e 3113
e27f234a 3114 return MSG_PROCESS_CONTINUE_READING;
a230b26e 3115 err:
fe3a3291 3116 ossl_statem_set_error(s);
e27f234a 3117 return MSG_PROCESS_ERROR;
0f113f3e 3118}
6434abbf 3119#endif
d45ba43d
MC		 3120
3121#define SSLV2_CIPHER_LEN 3
3122
38a3cbfb
EK		 3123STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,
3124 PACKET *cipher_suites,
d45ba43d 3125 STACK_OF(SSL_CIPHER) **skp,
a230b26e 3126 int sslv2format, int *al)
d45ba43d
MC		 3127{
3128 const SSL_CIPHER *c;
3129 STACK_OF(SSL_CIPHER) *sk;
38a3cbfb
EK		 3130 int n;
3131 /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */
3132 unsigned char cipher[SSLV2_CIPHER_LEN];
d45ba43d 3133
38a3cbfb
EK		 3134 s->s3->send_connection_binding = 0;
3135
3136 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
3137
3138 if (PACKET_remaining(cipher_suites) == 0) {
3139 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);
3140 *al = SSL_AD_ILLEGAL_PARAMETER;
3141 return NULL;
d45ba43d 3142 }
38a3cbfb
EK		 3143
3144 if (PACKET_remaining(cipher_suites) % n != 0) {
d45ba43d
MC		 3145 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,
3146 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
38a3cbfb
EK		 3147 *al = SSL_AD_DECODE_ERROR;
3148 return NULL;
d45ba43d 3149 }
38a3cbfb 3150
d45ba43d
MC		 3151 if ((skp == NULL) || (*skp == NULL)) {
3152 sk = sk_SSL_CIPHER_new_null(); /* change perhaps later */
e8aa8b6c 3153 if (sk == NULL) {
d45ba43d 3154 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
38a3cbfb 3155 *al = SSL_AD_INTERNAL_ERROR;
d45ba43d
MC		 3156 return NULL;
3157 }
3158 } else {
3159 sk = *skp;
3160 sk_SSL_CIPHER_zero(sk);
3161 }
3162
38a3cbfb
EK		 3163 if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw,
3164 &s->s3->tmp.ciphers_rawlen)) {
3165 *al = SSL_AD_INTERNAL_ERROR;
d45ba43d
MC		 3166 goto err;
3167 }
d45ba43d 3168
38a3cbfb
EK		 3169 while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
3170 /*
20218b58
EK		 3171 * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
3172 * first byte set to zero, while true SSLv2 ciphers have a non-zero
3173 * first byte. We don't support any true SSLv2 ciphers, so skip them.
38a3cbfb
EK		 3174 */
3175 if (sslv2format && cipher[0] != '\0')
a230b26e 3176 continue;
38a3cbfb 3177
d45ba43d 3178 /* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */
38a3cbfb
EK		 3179 if ((cipher[n - 2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
3180 (cipher[n - 1] == (SSL3_CK_SCSV & 0xff))) {
d45ba43d
MC		 3181 /* SCSV fatal if renegotiating */
3182 if (s->renegotiate) {
3183 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,
3184 SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
38a3cbfb 3185 *al = SSL_AD_HANDSHAKE_FAILURE;
d45ba43d
MC		 3186 goto err;
3187 }
3188 s->s3->send_connection_binding = 1;
d45ba43d
MC		 3189 continue;
3190 }
3191
3192 /* Check for TLS_FALLBACK_SCSV */
38a3cbfb
EK		 3193 if ((cipher[n - 2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) &&
3194 (cipher[n - 1] == (SSL3_CK_FALLBACK_SCSV & 0xff))) {
d45ba43d
MC		 3195 /*
3196 * The SCSV indicates that the client previously tried a higher
3197 * version. Fail if the current version is an unexpected
3198 * downgrade.
3199 */
4fa52141 3200 if (!ssl_check_version_downgrade(s)) {
d45ba43d
MC		 3201 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,
3202 SSL_R_INAPPROPRIATE_FALLBACK);
38a3cbfb 3203 *al = SSL_AD_INAPPROPRIATE_FALLBACK;
d45ba43d
MC		 3204 goto err;
3205 }
d45ba43d
MC		 3206 continue;
3207 }
3208
38a3cbfb
EK		 3209 /* For SSLv2-compat, ignore leading 0-byte. */
3210 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher);
d45ba43d
MC		 3211 if (c != NULL) {
3212 if (!sk_SSL_CIPHER_push(sk, c)) {
3213 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
38a3cbfb 3214 *al = SSL_AD_INTERNAL_ERROR;
d45ba43d
MC		 3215 goto err;
3216 }
3217 }
3218 }
38a3cbfb
EK		 3219 if (PACKET_remaining(cipher_suites) > 0) {
3220 *al = SSL_AD_INTERNAL_ERROR;
3221 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_INTERNAL_ERROR);
3222 goto err;
3223 }
d45ba43d
MC		 3224
3225 if (skp != NULL)
3226 *skp = sk;
3227 return (sk);
3228 err:
3229 if ((skp == NULL) || (*skp == NULL))
3230 sk_SSL_CIPHER_free(sk);
38a3cbfb 3231 return NULL;
d45ba43d 3232}
A mirror of the official openssl repository