]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
fecb3aae | 2 | * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. |
c80149d9 | 3 | * Copyright 2005 Nokia. All rights reserved. |
82b0bf0b | 4 | * |
2c18d164 | 5 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
6 | * this file except in compliance with the License. You can obtain a copy |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
82b0bf0b | 9 | */ |
846e33c7 | 10 | |
58964a49 | 11 | #include <stdio.h> |
706457b7 DMSP |
12 | #include "ssl_local.h" |
13 | #include "record/record_local.h" | |
50ec7505 BP |
14 | #include "internal/ktls.h" |
15 | #include "internal/cryptlib.h" | |
3c27208f | 16 | #include <openssl/comp.h> |
ec577822 | 17 | #include <openssl/evp.h> |
b7d60e76 | 18 | #include <openssl/kdf.h> |
637f374a | 19 | #include <openssl/rand.h> |
50ec7505 | 20 | #include <openssl/obj_mac.h> |
ce3b1bb4 | 21 | #include <openssl/core_names.h> |
49b26f54 | 22 | #include <openssl/trace.h> |
58964a49 | 23 | |
b7d60e76 | 24 | /* seed1 through seed5 are concatenated */ |
38b051a1 | 25 | static int tls1_PRF(SSL_CONNECTION *s, |
6db6bc5a MC |
26 | const void *seed1, size_t seed1_len, |
27 | const void *seed2, size_t seed2_len, | |
28 | const void *seed3, size_t seed3_len, | |
29 | const void *seed4, size_t seed4_len, | |
30 | const void *seed5, size_t seed5_len, | |
31 | const unsigned char *sec, size_t slen, | |
d4d2f3a4 | 32 | unsigned char *out, size_t olen, int fatal) |
0f113f3e | 33 | { |
28ba2541 | 34 | const EVP_MD *md = ssl_prf_md(s); |
ce3b1bb4 | 35 | EVP_KDF *kdf; |
32495464 | 36 | EVP_KDF_CTX *kctx = NULL; |
ce3b1bb4 | 37 | OSSL_PARAM params[8], *p = params; |
7e56c626 | 38 | const char *mdname; |
0f113f3e | 39 | |
28ba2541 | 40 | if (md == NULL) { |
668f6f08 | 41 | /* Should never happen */ |
d4d2f3a4 | 42 | if (fatal) |
c48ffbcc | 43 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
d4d2f3a4 | 44 | else |
6849b73c | 45 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
28ba2541 | 46 | return 0; |
668f6f08 | 47 | } |
38b051a1 TM |
48 | kdf = EVP_KDF_fetch(SSL_CONNECTION_GET_CTX(s)->libctx, |
49 | OSSL_KDF_NAME_TLS1_PRF, | |
50 | SSL_CONNECTION_GET_CTX(s)->propq); | |
ce3b1bb4 P |
51 | if (kdf == NULL) |
52 | goto err; | |
660c5344 | 53 | kctx = EVP_KDF_CTX_new(kdf); |
ce3b1bb4 P |
54 | EVP_KDF_free(kdf); |
55 | if (kctx == NULL) | |
b7d60e76 | 56 | goto err; |
ed576acd | 57 | mdname = EVP_MD_get0_name(md); |
ce3b1bb4 | 58 | *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, |
8b6ffd40 | 59 | (char *)mdname, 0); |
ce3b1bb4 P |
60 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, |
61 | (unsigned char *)sec, | |
62 | (size_t)slen); | |
63 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
64 | (void *)seed1, (size_t)seed1_len); | |
65 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
66 | (void *)seed2, (size_t)seed2_len); | |
67 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
68 | (void *)seed3, (size_t)seed3_len); | |
69 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
70 | (void *)seed4, (size_t)seed4_len); | |
71 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
72 | (void *)seed5, (size_t)seed5_len); | |
73 | *p = OSSL_PARAM_construct_end(); | |
5cceedb5 | 74 | if (EVP_KDF_derive(kctx, out, olen, params)) { |
660c5344 | 75 | EVP_KDF_CTX_free(kctx); |
ce3b1bb4 | 76 | return 1; |
d4d2f3a4 | 77 | } |
b7d60e76 | 78 | |
a230b26e | 79 | err: |
ce3b1bb4 | 80 | if (fatal) |
c48ffbcc | 81 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
ce3b1bb4 | 82 | else |
6849b73c | 83 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
660c5344 | 84 | EVP_KDF_CTX_free(kctx); |
ce3b1bb4 | 85 | return 0; |
81025661 | 86 | } |
0f113f3e | 87 | |
38b051a1 TM |
88 | static int tls1_generate_key_block(SSL_CONNECTION *s, unsigned char *km, |
89 | size_t num) | |
0f113f3e MC |
90 | { |
91 | int ret; | |
d4d2f3a4 MC |
92 | |
93 | /* Calls SSLfatal() as required */ | |
28ba2541 | 94 | ret = tls1_PRF(s, |
0f113f3e | 95 | TLS_MD_KEY_EXPANSION_CONST, |
555cbb32 TS |
96 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random, |
97 | SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE, | |
0f113f3e | 98 | NULL, 0, NULL, 0, s->session->master_key, |
d4d2f3a4 | 99 | s->session->master_key_length, km, num, 1); |
55a9a16f | 100 | |
0f113f3e MC |
101 | return ret; |
102 | } | |
58964a49 | 103 | |
38b051a1 | 104 | int tls_provider_set_tls_params(SSL_CONNECTION *s, EVP_CIPHER_CTX *ctx, |
b5588178 MC |
105 | const EVP_CIPHER *ciph, |
106 | const EVP_MD *md) | |
107 | { | |
108 | /* | |
109 | * Provided cipher, the TLS padding/MAC removal is performed provider | |
110 | * side so we need to tell the ctx about our TLS version and mac size | |
111 | */ | |
112 | OSSL_PARAM params[3], *pprm = params; | |
113 | size_t macsize = 0; | |
114 | int imacsize = -1; | |
115 | ||
ed576acd | 116 | if ((EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0 |
b5588178 MC |
117 | /* |
118 | * We look at s->ext.use_etm instead of SSL_READ_ETM() or | |
119 | * SSL_WRITE_ETM() because this test applies to both reading | |
120 | * and writing. | |
121 | */ | |
122 | && !s->ext.use_etm) | |
ed576acd | 123 | imacsize = EVP_MD_get_size(md); |
b5588178 MC |
124 | if (imacsize >= 0) |
125 | macsize = (size_t)imacsize; | |
126 | ||
127 | *pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION, | |
128 | &s->version); | |
129 | *pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE, | |
130 | &macsize); | |
131 | *pprm = OSSL_PARAM_construct_end(); | |
132 | ||
133 | if (!EVP_CIPHER_CTX_set_params(ctx, params)) { | |
c48ffbcc | 134 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
b5588178 MC |
135 | return 0; |
136 | } | |
137 | ||
138 | return 1; | |
139 | } | |
140 | ||
62f27ab9 MM |
141 | |
142 | static int tls_iv_length_within_key_block(const EVP_CIPHER *c) | |
143 | { | |
144 | /* If GCM/CCM mode only part of IV comes from PRF */ | |
ed576acd | 145 | if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) |
62f27ab9 | 146 | return EVP_GCM_TLS_FIXED_IV_LEN; |
ed576acd | 147 | else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) |
62f27ab9 MM |
148 | return EVP_CCM_TLS_FIXED_IV_LEN; |
149 | else | |
ed576acd | 150 | return EVP_CIPHER_get_iv_length(c); |
62f27ab9 MM |
151 | } |
152 | ||
38b051a1 | 153 | int tls1_change_cipher_state(SSL_CONNECTION *s, int which) |
0f113f3e | 154 | { |
0f113f3e | 155 | unsigned char *p, *mac_secret; |
aedbb71b | 156 | unsigned char *key, *iv; |
0f113f3e MC |
157 | EVP_CIPHER_CTX *dd; |
158 | const EVP_CIPHER *c; | |
976b263d | 159 | const SSL_COMP *comp = NULL; |
0f113f3e MC |
160 | const EVP_MD *m; |
161 | int mac_type; | |
aedbb71b | 162 | size_t mac_secret_size; |
0f113f3e MC |
163 | EVP_MD_CTX *mac_ctx; |
164 | EVP_PKEY *mac_key; | |
b43d1cbb | 165 | size_t n, i, j, k, cl; |
cc110a0a | 166 | int iivlen; |
0f113f3e | 167 | int reuse_dd = 0; |
50ec7505 | 168 | #ifndef OPENSSL_NO_KTLS |
c34ca13a | 169 | ktls_crypto_info_t crypto_info; |
4ffccf6c | 170 | void *rl_sequence; |
2111f5c2 | 171 | BIO *bio; |
50ec7505 | 172 | #endif |
aedbb71b | 173 | SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); |
cc110a0a MC |
174 | /* |
175 | * Taglen is only relevant for CCM ciphersuites. Other ciphersuites | |
176 | * ignore this value so we can default it to 0. | |
177 | */ | |
178 | size_t taglen = 0; | |
e2d5742b | 179 | |
555cbb32 TS |
180 | c = s->s3.tmp.new_sym_enc; |
181 | m = s->s3.tmp.new_hash; | |
182 | mac_type = s->s3.tmp.new_mac_pkey_type; | |
09b6c2ef | 183 | #ifndef OPENSSL_NO_COMP |
555cbb32 | 184 | comp = s->s3.tmp.new_compression; |
09b6c2ef | 185 | #endif |
58964a49 | 186 | |
aedbb71b MC |
187 | p = s->s3.tmp.key_block; |
188 | i = mac_secret_size = s->s3.tmp.new_mac_secret_size; | |
28a31a0a | 189 | |
aedbb71b MC |
190 | cl = EVP_CIPHER_get_key_length(c); |
191 | j = cl; | |
cc110a0a MC |
192 | iivlen = tls_iv_length_within_key_block(c); |
193 | if (iivlen < 0) { | |
194 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
195 | goto err; | |
196 | } | |
197 | k = iivlen; | |
aedbb71b MC |
198 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || |
199 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
200 | mac_secret = &(p[0]); | |
201 | n = i + i; | |
202 | key = &(p[n]); | |
203 | n += j + j; | |
204 | iv = &(p[n]); | |
205 | n += k + k; | |
206 | } else { | |
207 | n = i; | |
208 | mac_secret = &(p[n]); | |
209 | n += i + j; | |
210 | key = &(p[n]); | |
211 | n += j + k; | |
212 | iv = &(p[n]); | |
213 | n += k; | |
214 | } | |
0f113f3e | 215 | |
aedbb71b MC |
216 | if (n > s->s3.tmp.key_block_length) { |
217 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
218 | goto err; | |
219 | } | |
5a5530a2 | 220 | |
cc110a0a MC |
221 | if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) { |
222 | if ((s->s3.tmp.new_cipher->algorithm_enc | |
223 | & (SSL_AES128CCM8 | SSL_AES256CCM8)) != 0) | |
224 | taglen = EVP_CCM8_TLS_TAG_LEN; | |
225 | else | |
226 | taglen = EVP_CCM_TLS_TAG_LEN; | |
227 | } | |
228 | ||
aedbb71b | 229 | if (which & SSL3_CC_READ) { |
7f2f0ac7 MC |
230 | if (s->ext.use_etm) |
231 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
232 | else | |
233 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
aedbb71b | 234 | |
7f2f0ac7 MC |
235 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
236 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; | |
237 | else | |
238 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
aedbb71b | 239 | |
7f2f0ac7 MC |
240 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) |
241 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_TLSTREE; | |
242 | else | |
243 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_TLSTREE; | |
aedbb71b | 244 | |
222cf410 MC |
245 | if (!ssl_set_new_record_layer(s, s->version, |
246 | OSSL_RECORD_DIRECTION_READ, | |
247 | OSSL_RECORD_PROTECTION_LEVEL_APPLICATION, | |
248 | key, cl, iv, (size_t)k, mac_secret, | |
249 | mac_secret_size, c, taglen, mac_type, | |
250 | m, comp)) { | |
251 | /* SSLfatal already called */ | |
252 | goto err; | |
0f113f3e | 253 | } |
222cf410 | 254 | |
4564b47d | 255 | /* TODO(RECLAYER): Temporary - remove me when write rlayer done*/ |
222cf410 | 256 | goto skip_ktls; |
0f113f3e | 257 | } else { |
7426cd34 | 258 | s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; |
28a31a0a | 259 | if (s->ext.use_etm) |
555cbb32 | 260 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
28a31a0a | 261 | else |
555cbb32 | 262 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
28a31a0a | 263 | |
555cbb32 | 264 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
0f113f3e MC |
265 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; |
266 | else | |
267 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
5a5530a2 DB |
268 | |
269 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) | |
270 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_TLSTREE; | |
271 | else | |
272 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_TLSTREE; | |
38b051a1 | 273 | if (s->enc_write_ctx != NULL && !SSL_CONNECTION_IS_DTLS(s)) { |
0f113f3e | 274 | reuse_dd = 1; |
f63a17d6 | 275 | } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
c48ffbcc | 276 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e | 277 | goto err; |
f63a17d6 | 278 | } |
0f113f3e | 279 | dd = s->enc_write_ctx; |
38b051a1 | 280 | if (SSL_CONNECTION_IS_DTLS(s)) { |
bfb0641f | 281 | mac_ctx = EVP_MD_CTX_new(); |
f63a17d6 | 282 | if (mac_ctx == NULL) { |
c48ffbcc | 283 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e | 284 | goto err; |
f63a17d6 | 285 | } |
0f113f3e | 286 | s->write_hash = mac_ctx; |
5f3d93e4 | 287 | } else { |
0f113f3e | 288 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); |
f63a17d6 | 289 | if (mac_ctx == NULL) { |
c48ffbcc | 290 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
5f3d93e4 | 291 | goto err; |
f63a17d6 | 292 | } |
5f3d93e4 | 293 | } |
09b6c2ef | 294 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
295 | COMP_CTX_free(s->compress); |
296 | s->compress = NULL; | |
0f113f3e MC |
297 | if (comp != NULL) { |
298 | s->compress = COMP_CTX_new(comp->method); | |
299 | if (s->compress == NULL) { | |
f63a17d6 | 300 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
c48ffbcc | 301 | SSL_R_COMPRESSION_LIBRARY_ERROR); |
f63a17d6 | 302 | goto err; |
0f113f3e MC |
303 | } |
304 | } | |
09b6c2ef | 305 | #endif |
0f113f3e | 306 | /* |
d5d0a1cb | 307 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 308 | */ |
38b051a1 | 309 | if (!SSL_CONNECTION_IS_DTLS(s)) |
de07f311 | 310 | RECORD_LAYER_reset_write_sequence(&s->rlayer); |
0f113f3e MC |
311 | } |
312 | ||
313 | if (reuse_dd) | |
846ec07d | 314 | EVP_CIPHER_CTX_reset(dd); |
0f113f3e | 315 | |
ed576acd | 316 | if (!(EVP_CIPHER_get_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { |
6f0bd6ca | 317 | if (mac_type == EVP_PKEY_HMAC) { |
38b051a1 TM |
318 | mac_key = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC", |
319 | sctx->propq, mac_secret, | |
aedbb71b | 320 | mac_secret_size); |
6f0bd6ca MC |
321 | } else { |
322 | /* | |
323 | * If its not HMAC then the only other types of MAC we support are | |
324 | * the GOST MACs, so we need to use the old style way of creating | |
325 | * a MAC key. | |
326 | */ | |
327 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, | |
aedbb71b | 328 | (int)mac_secret_size); |
6f0bd6ca | 329 | } |
5f3d93e4 | 330 | if (mac_key == NULL |
ed576acd | 331 | || EVP_DigestSignInit_ex(mac_ctx, NULL, EVP_MD_get0_name(m), |
38b051a1 | 332 | sctx->libctx, sctx->propq, mac_key, |
d38b6ae9 | 333 | NULL) <= 0) { |
5f3d93e4 | 334 | EVP_PKEY_free(mac_key); |
c48ffbcc | 335 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 336 | goto err; |
5f3d93e4 | 337 | } |
0f113f3e MC |
338 | EVP_PKEY_free(mac_key); |
339 | } | |
49b26f54 RL |
340 | |
341 | OSSL_TRACE_BEGIN(TLS) { | |
342 | BIO_printf(trc_out, "which = %04X, mac key:\n", which); | |
aedbb71b | 343 | BIO_dump_indent(trc_out, mac_secret, i, 4); |
49b26f54 | 344 | } OSSL_TRACE_END(TLS); |
0f113f3e | 345 | |
ed576acd | 346 | if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) { |
eadf70d2 | 347 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) |
d649c51a PH |
348 | || EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, |
349 | iv) <= 0) { | |
c48ffbcc | 350 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 351 | goto err; |
eadf70d2 | 352 | } |
ed576acd | 353 | } else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) { |
e75c5a79 | 354 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) |
d649c51a PH |
355 | || (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) <= 0) |
356 | || (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) <= 0) | |
357 | || (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) <= 0) | |
e75c5a79 | 358 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { |
c48ffbcc | 359 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 360 | goto err; |
e75c5a79 | 361 | } |
eadf70d2 MC |
362 | } else { |
363 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
c48ffbcc | 364 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 365 | goto err; |
eadf70d2 MC |
366 | } |
367 | } | |
0f113f3e | 368 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ |
ed576acd | 369 | if ((EVP_CIPHER_get_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) |
aedbb71b | 370 | && mac_secret_size != 0 |
d649c51a | 371 | && EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, |
aedbb71b | 372 | (int)mac_secret_size, mac_secret) <= 0) { |
c48ffbcc | 373 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 | 374 | goto err; |
eadf70d2 | 375 | } |
ed576acd | 376 | if (EVP_CIPHER_get0_provider(c) != NULL |
b5588178 MC |
377 | && !tls_provider_set_tls_params(s, dd, c, m)) { |
378 | /* SSLfatal already called */ | |
379 | goto err; | |
524cb684 | 380 | } |
b5588178 | 381 | |
50ec7505 | 382 | #ifndef OPENSSL_NO_KTLS |
a3a54179 | 383 | if (s->compress || (s->options & SSL_OP_ENABLE_KTLS) == 0) |
50ec7505 BP |
384 | goto skip_ktls; |
385 | ||
386 | /* ktls supports only the maximum fragment size */ | |
387 | if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH) | |
388 | goto skip_ktls; | |
389 | ||
4ffccf6c | 390 | /* check that cipher is supported */ |
7f2f0ac7 | 391 | if (!ktls_check_supported_cipher(s, c, m, taglen)) |
50ec7505 BP |
392 | goto skip_ktls; |
393 | ||
c35e921f BP |
394 | if (which & SSL3_CC_WRITE) |
395 | bio = s->wbio; | |
396 | else | |
397 | bio = s->rbio; | |
398 | ||
399 | if (!ossl_assert(bio != NULL)) { | |
c48ffbcc | 400 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
50ec7505 BP |
401 | goto err; |
402 | } | |
403 | ||
404 | /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */ | |
c35e921f BP |
405 | if (which & SSL3_CC_WRITE) { |
406 | if (BIO_flush(bio) <= 0) | |
407 | goto skip_ktls; | |
408 | } | |
50ec7505 BP |
409 | |
410 | /* ktls doesn't support renegotiation */ | |
c35e921f BP |
411 | if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) || |
412 | (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) { | |
c48ffbcc | 413 | SSLfatal(s, SSL_AD_NO_RENEGOTIATION, ERR_R_INTERNAL_ERROR); |
50ec7505 BP |
414 | goto err; |
415 | } | |
416 | ||
c35e921f | 417 | if (which & SSL3_CC_WRITE) |
4ffccf6c | 418 | rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer); |
c35e921f | 419 | else |
4ffccf6c VF |
420 | rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer); |
421 | ||
8124ab56 MC |
422 | if (!ktls_configure_crypto(sctx->libctx, s->version, c, m, rl_sequence, |
423 | &crypto_info, which & SSL3_CC_WRITE, iv, | |
424 | (size_t)k, key, cl, mac_secret, mac_secret_size)) | |
4ffccf6c | 425 | goto skip_ktls; |
c35e921f | 426 | |
50ec7505 | 427 | /* ktls works with user provided buffers directly */ |
c35e921f BP |
428 | if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) { |
429 | if (which & SSL3_CC_WRITE) | |
430 | ssl3_release_write_buffer(s); | |
38b051a1 | 431 | SSL_set_options(SSL_CONNECTION_GET_SSL(s), SSL_OP_NO_RENEGOTIATION); |
50ec7505 BP |
432 | } |
433 | ||
50ec7505 | 434 | #endif /* OPENSSL_NO_KTLS */ |
cc110a0a | 435 | skip_ktls: |
7426cd34 | 436 | s->statem.enc_write_state = ENC_WRITE_STATE_VALID; |
1cf218bc | 437 | |
49b26f54 RL |
438 | OSSL_TRACE_BEGIN(TLS) { |
439 | BIO_printf(trc_out, "which = %04X, key:\n", which); | |
ed576acd | 440 | BIO_dump_indent(trc_out, key, EVP_CIPHER_get_key_length(c), 4); |
49b26f54 RL |
441 | BIO_printf(trc_out, "iv:\n"); |
442 | BIO_dump_indent(trc_out, iv, k, 4); | |
443 | } OSSL_TRACE_END(TLS); | |
58964a49 | 444 | |
208fb891 | 445 | return 1; |
0f113f3e | 446 | err: |
26a7d938 | 447 | return 0; |
0f113f3e | 448 | } |
58964a49 | 449 | |
38b051a1 | 450 | int tls1_setup_key_block(SSL_CONNECTION *s) |
0f113f3e | 451 | { |
b7d60e76 | 452 | unsigned char *p; |
0f113f3e MC |
453 | const EVP_CIPHER *c; |
454 | const EVP_MD *hash; | |
0f113f3e | 455 | SSL_COMP *comp; |
8c1a5343 MC |
456 | int mac_type = NID_undef; |
457 | size_t num, mac_secret_size = 0; | |
0f113f3e | 458 | int ret = 0; |
cc110a0a | 459 | int ivlen; |
58964a49 | 460 | |
555cbb32 | 461 | if (s->s3.tmp.key_block_length != 0) |
208fb891 | 462 | return 1; |
0f113f3e | 463 | |
38b051a1 TM |
464 | if (!ssl_cipher_get_evp(SSL_CONNECTION_GET_CTX(s), s->session, &c, &hash, |
465 | &mac_type, &mac_secret_size, &comp, | |
466 | s->ext.use_etm)) { | |
5a2d0ef3 RL |
467 | /* Error is already recorded */ |
468 | SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); | |
26a7d938 | 469 | return 0; |
0f113f3e MC |
470 | } |
471 | ||
c8f6c28a | 472 | ssl_evp_cipher_free(s->s3.tmp.new_sym_enc); |
555cbb32 | 473 | s->s3.tmp.new_sym_enc = c; |
c8f6c28a | 474 | ssl_evp_md_free(s->s3.tmp.new_hash); |
555cbb32 TS |
475 | s->s3.tmp.new_hash = hash; |
476 | s->s3.tmp.new_mac_pkey_type = mac_type; | |
477 | s->s3.tmp.new_mac_secret_size = mac_secret_size; | |
cc110a0a MC |
478 | ivlen = tls_iv_length_within_key_block(c); |
479 | if (ivlen < 0) { | |
480 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
481 | return 0; | |
482 | } | |
483 | num = mac_secret_size + EVP_CIPHER_get_key_length(c) + ivlen; | |
0f113f3e MC |
484 | num *= 2; |
485 | ||
486 | ssl3_cleanup_key_block(s); | |
487 | ||
b7d60e76 | 488 | if ((p = OPENSSL_malloc(num)) == NULL) { |
c48ffbcc | 489 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
490 | goto err; |
491 | } | |
492 | ||
555cbb32 TS |
493 | s->s3.tmp.key_block_length = num; |
494 | s->s3.tmp.key_block = p; | |
0f113f3e | 495 | |
49b26f54 | 496 | OSSL_TRACE_BEGIN(TLS) { |
234261f3 | 497 | BIO_printf(trc_out, "key block length: %zu\n", num); |
49b26f54 | 498 | BIO_printf(trc_out, "client random\n"); |
555cbb32 | 499 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 | 500 | BIO_printf(trc_out, "server random\n"); |
555cbb32 | 501 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 RL |
502 | BIO_printf(trc_out, "master key\n"); |
503 | BIO_dump_indent(trc_out, | |
504 | s->session->master_key, | |
505 | s->session->master_key_length, 4); | |
506 | } OSSL_TRACE_END(TLS); | |
507 | ||
d4d2f3a4 MC |
508 | if (!tls1_generate_key_block(s, p, num)) { |
509 | /* SSLfatal() already called */ | |
0f113f3e | 510 | goto err; |
d4d2f3a4 | 511 | } |
49b26f54 RL |
512 | |
513 | OSSL_TRACE_BEGIN(TLS) { | |
514 | BIO_printf(trc_out, "key block\n"); | |
515 | BIO_dump_indent(trc_out, p, num, 4); | |
516 | } OSSL_TRACE_END(TLS); | |
58964a49 | 517 | |
0f113f3e | 518 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
38b051a1 | 519 | && SSL_CONNECTION_GET_SSL(s)->method->version <= TLS1_VERSION) { |
0f113f3e MC |
520 | /* |
521 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
522 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
523 | */ | |
555cbb32 | 524 | s->s3.need_empty_fragments = 1; |
0f113f3e MC |
525 | |
526 | if (s->session->cipher != NULL) { | |
527 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
555cbb32 | 528 | s->s3.need_empty_fragments = 0; |
0f113f3e | 529 | |
0f113f3e | 530 | if (s->session->cipher->algorithm_enc == SSL_RC4) |
555cbb32 | 531 | s->s3.need_empty_fragments = 0; |
0f113f3e MC |
532 | } |
533 | } | |
534 | ||
535 | ret = 1; | |
536 | err: | |
26a7d938 | 537 | return ret; |
0f113f3e | 538 | } |
58964a49 | 539 | |
38b051a1 TM |
540 | size_t tls1_final_finish_mac(SSL_CONNECTION *s, const char *str, |
541 | size_t slen, unsigned char *out) | |
0f113f3e | 542 | { |
8c1a5343 | 543 | size_t hashlen; |
28ba2541 | 544 | unsigned char hash[EVP_MAX_MD_SIZE]; |
5a5530a2 DB |
545 | size_t finished_size = TLS1_FINISH_MAC_LENGTH; |
546 | ||
547 | if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kGOST18) | |
548 | finished_size = 32; | |
0f113f3e | 549 | |
d4d2f3a4 MC |
550 | if (!ssl3_digest_cached_records(s, 0)) { |
551 | /* SSLfatal() already called */ | |
124037fd | 552 | return 0; |
d4d2f3a4 | 553 | } |
0f113f3e | 554 | |
d4d2f3a4 MC |
555 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
556 | /* SSLfatal() already called */ | |
48fbcbac | 557 | return 0; |
d4d2f3a4 | 558 | } |
0f113f3e | 559 | |
b7d60e76 | 560 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
0f113f3e | 561 | s->session->master_key, s->session->master_key_length, |
5a5530a2 | 562 | out, finished_size, 1)) { |
d4d2f3a4 | 563 | /* SSLfatal() already called */ |
0f113f3e | 564 | return 0; |
d4d2f3a4 | 565 | } |
c9dd49a7 | 566 | OPENSSL_cleanse(hash, hashlen); |
5a5530a2 | 567 | return finished_size; |
0f113f3e | 568 | } |
58964a49 | 569 | |
38b051a1 TM |
570 | int tls1_generate_master_secret(SSL_CONNECTION *s, unsigned char *out, |
571 | unsigned char *p, size_t len, | |
572 | size_t *secret_size) | |
0f113f3e | 573 | { |
329114f9 | 574 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
0cfb0e75 | 575 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
8c1a5343 | 576 | size_t hashlen; |
a230b26e | 577 | /* |
79c44b4e | 578 | * Digest cached records keeping record buffer (if present): this won't |
a230b26e EK |
579 | * affect client auth because we're freezing the buffer at the same |
580 | * point (after client key exchange and before certificate verify) | |
124037fd | 581 | */ |
f63a17d6 MC |
582 | if (!ssl3_digest_cached_records(s, 1) |
583 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { | |
584 | /* SSLfatal() already called */ | |
8c1a5343 | 585 | return 0; |
f63a17d6 | 586 | } |
49b26f54 RL |
587 | OSSL_TRACE_BEGIN(TLS) { |
588 | BIO_printf(trc_out, "Handshake hashes:\n"); | |
589 | BIO_dump(trc_out, (char *)hash, hashlen); | |
590 | } OSSL_TRACE_END(TLS); | |
d4d2f3a4 MC |
591 | if (!tls1_PRF(s, |
592 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
593 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
594 | hash, hashlen, | |
595 | NULL, 0, | |
596 | NULL, 0, | |
597 | NULL, 0, p, len, out, | |
598 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
599 | /* SSLfatal() already called */ | |
600 | return 0; | |
601 | } | |
0cfb0e75 DSH |
602 | OPENSSL_cleanse(hash, hashlen); |
603 | } else { | |
d4d2f3a4 MC |
604 | if (!tls1_PRF(s, |
605 | TLS_MD_MASTER_SECRET_CONST, | |
606 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
555cbb32 | 607 | s->s3.client_random, SSL3_RANDOM_SIZE, |
d4d2f3a4 | 608 | NULL, 0, |
555cbb32 | 609 | s->s3.server_random, SSL3_RANDOM_SIZE, |
d4d2f3a4 MC |
610 | NULL, 0, p, len, out, |
611 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
612 | /* SSLfatal() already called */ | |
613 | return 0; | |
614 | } | |
0cfb0e75 | 615 | } |
49b26f54 RL |
616 | |
617 | OSSL_TRACE_BEGIN(TLS) { | |
618 | BIO_printf(trc_out, "Premaster Secret:\n"); | |
619 | BIO_dump_indent(trc_out, p, len, 4); | |
620 | BIO_printf(trc_out, "Client Random:\n"); | |
555cbb32 | 621 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 | 622 | BIO_printf(trc_out, "Server Random:\n"); |
555cbb32 | 623 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
49b26f54 RL |
624 | BIO_printf(trc_out, "Master Secret:\n"); |
625 | BIO_dump_indent(trc_out, | |
626 | s->session->master_key, | |
627 | SSL3_MASTER_SECRET_SIZE, 4); | |
628 | } OSSL_TRACE_END(TLS); | |
761772d7 | 629 | |
8c1a5343 MC |
630 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
631 | return 1; | |
0f113f3e | 632 | } |
58964a49 | 633 | |
38b051a1 TM |
634 | int tls1_export_keying_material(SSL_CONNECTION *s, unsigned char *out, |
635 | size_t olen, const char *label, size_t llen, | |
0f113f3e MC |
636 | const unsigned char *context, |
637 | size_t contextlen, int use_context) | |
638 | { | |
0f113f3e | 639 | unsigned char *val = NULL; |
1c8a527c | 640 | size_t vallen = 0, currentvalpos; |
0f113f3e | 641 | int rv; |
e0af0405 | 642 | |
0f113f3e MC |
643 | /* |
644 | * construct PRF arguments we construct the PRF argument ourself rather | |
645 | * than passing separate values into the TLS PRF to ensure that the | |
646 | * concatenation of values does not create a prohibited label. | |
647 | */ | |
648 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
649 | if (use_context) { | |
650 | vallen += 2 + contextlen; | |
651 | } | |
652 | ||
653 | val = OPENSSL_malloc(vallen); | |
654 | if (val == NULL) | |
655 | goto err2; | |
656 | currentvalpos = 0; | |
657 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
658 | currentvalpos += llen; | |
555cbb32 | 659 | memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE); |
0f113f3e | 660 | currentvalpos += SSL3_RANDOM_SIZE; |
555cbb32 | 661 | memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE); |
0f113f3e MC |
662 | currentvalpos += SSL3_RANDOM_SIZE; |
663 | ||
664 | if (use_context) { | |
665 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
666 | currentvalpos++; | |
667 | val[currentvalpos] = contextlen & 0xff; | |
668 | currentvalpos++; | |
669 | if ((contextlen > 0) || (context != NULL)) { | |
670 | memcpy(val + currentvalpos, context, contextlen); | |
671 | } | |
672 | } | |
673 | ||
674 | /* | |
675 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
676 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
677 | * the comparisons won't have buffer overflow | |
678 | */ | |
679 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
680 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
681 | goto err1; | |
682 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
683 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
684 | goto err1; | |
685 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
686 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
687 | goto err1; | |
0cfb0e75 DSH |
688 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
689 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
690 | goto err1; | |
0f113f3e MC |
691 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
692 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
693 | goto err1; | |
694 | ||
28ba2541 | 695 | rv = tls1_PRF(s, |
0f113f3e MC |
696 | val, vallen, |
697 | NULL, 0, | |
698 | NULL, 0, | |
699 | NULL, 0, | |
700 | NULL, 0, | |
701 | s->session->master_key, s->session->master_key_length, | |
d4d2f3a4 | 702 | out, olen, 0); |
e0af0405 | 703 | |
0f113f3e MC |
704 | goto ret; |
705 | err1: | |
6849b73c | 706 | ERR_raise(ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
0f113f3e MC |
707 | rv = 0; |
708 | goto ret; | |
709 | err2: | |
6849b73c | 710 | ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); |
0f113f3e MC |
711 | rv = 0; |
712 | ret: | |
05c7b163 | 713 | OPENSSL_clear_free(val, vallen); |
26a7d938 | 714 | return rv; |
0f113f3e | 715 | } |
e0af0405 | 716 | |
6b691a5c | 717 | int tls1_alert_code(int code) |
0f113f3e MC |
718 | { |
719 | switch (code) { | |
720 | case SSL_AD_CLOSE_NOTIFY: | |
26a7d938 | 721 | return SSL3_AD_CLOSE_NOTIFY; |
0f113f3e | 722 | case SSL_AD_UNEXPECTED_MESSAGE: |
26a7d938 | 723 | return SSL3_AD_UNEXPECTED_MESSAGE; |
0f113f3e | 724 | case SSL_AD_BAD_RECORD_MAC: |
26a7d938 | 725 | return SSL3_AD_BAD_RECORD_MAC; |
0f113f3e | 726 | case SSL_AD_DECRYPTION_FAILED: |
26a7d938 | 727 | return TLS1_AD_DECRYPTION_FAILED; |
0f113f3e | 728 | case SSL_AD_RECORD_OVERFLOW: |
26a7d938 | 729 | return TLS1_AD_RECORD_OVERFLOW; |
0f113f3e | 730 | case SSL_AD_DECOMPRESSION_FAILURE: |
26a7d938 | 731 | return SSL3_AD_DECOMPRESSION_FAILURE; |
0f113f3e | 732 | case SSL_AD_HANDSHAKE_FAILURE: |
26a7d938 | 733 | return SSL3_AD_HANDSHAKE_FAILURE; |
0f113f3e | 734 | case SSL_AD_NO_CERTIFICATE: |
26a7d938 | 735 | return -1; |
0f113f3e | 736 | case SSL_AD_BAD_CERTIFICATE: |
26a7d938 | 737 | return SSL3_AD_BAD_CERTIFICATE; |
0f113f3e | 738 | case SSL_AD_UNSUPPORTED_CERTIFICATE: |
26a7d938 | 739 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; |
0f113f3e | 740 | case SSL_AD_CERTIFICATE_REVOKED: |
26a7d938 | 741 | return SSL3_AD_CERTIFICATE_REVOKED; |
0f113f3e | 742 | case SSL_AD_CERTIFICATE_EXPIRED: |
26a7d938 | 743 | return SSL3_AD_CERTIFICATE_EXPIRED; |
0f113f3e | 744 | case SSL_AD_CERTIFICATE_UNKNOWN: |
26a7d938 | 745 | return SSL3_AD_CERTIFICATE_UNKNOWN; |
0f113f3e | 746 | case SSL_AD_ILLEGAL_PARAMETER: |
26a7d938 | 747 | return SSL3_AD_ILLEGAL_PARAMETER; |
0f113f3e | 748 | case SSL_AD_UNKNOWN_CA: |
26a7d938 | 749 | return TLS1_AD_UNKNOWN_CA; |
0f113f3e | 750 | case SSL_AD_ACCESS_DENIED: |
26a7d938 | 751 | return TLS1_AD_ACCESS_DENIED; |
0f113f3e | 752 | case SSL_AD_DECODE_ERROR: |
26a7d938 | 753 | return TLS1_AD_DECODE_ERROR; |
0f113f3e | 754 | case SSL_AD_DECRYPT_ERROR: |
26a7d938 | 755 | return TLS1_AD_DECRYPT_ERROR; |
0f113f3e | 756 | case SSL_AD_EXPORT_RESTRICTION: |
26a7d938 | 757 | return TLS1_AD_EXPORT_RESTRICTION; |
0f113f3e | 758 | case SSL_AD_PROTOCOL_VERSION: |
26a7d938 | 759 | return TLS1_AD_PROTOCOL_VERSION; |
0f113f3e | 760 | case SSL_AD_INSUFFICIENT_SECURITY: |
26a7d938 | 761 | return TLS1_AD_INSUFFICIENT_SECURITY; |
0f113f3e | 762 | case SSL_AD_INTERNAL_ERROR: |
26a7d938 | 763 | return TLS1_AD_INTERNAL_ERROR; |
0f113f3e | 764 | case SSL_AD_USER_CANCELLED: |
26a7d938 | 765 | return TLS1_AD_USER_CANCELLED; |
0f113f3e | 766 | case SSL_AD_NO_RENEGOTIATION: |
26a7d938 | 767 | return TLS1_AD_NO_RENEGOTIATION; |
0f113f3e | 768 | case SSL_AD_UNSUPPORTED_EXTENSION: |
26a7d938 | 769 | return TLS1_AD_UNSUPPORTED_EXTENSION; |
0f113f3e | 770 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: |
26a7d938 | 771 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; |
0f113f3e | 772 | case SSL_AD_UNRECOGNIZED_NAME: |
26a7d938 | 773 | return TLS1_AD_UNRECOGNIZED_NAME; |
0f113f3e | 774 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: |
26a7d938 | 775 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; |
0f113f3e | 776 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: |
26a7d938 | 777 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; |
0f113f3e | 778 | case SSL_AD_UNKNOWN_PSK_IDENTITY: |
26a7d938 | 779 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; |
0f113f3e | 780 | case SSL_AD_INAPPROPRIATE_FALLBACK: |
26a7d938 | 781 | return TLS1_AD_INAPPROPRIATE_FALLBACK; |
06217867 | 782 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
26a7d938 | 783 | return TLS1_AD_NO_APPLICATION_PROTOCOL; |
42c28b63 MC |
784 | case SSL_AD_CERTIFICATE_REQUIRED: |
785 | return SSL_AD_HANDSHAKE_FAILURE; | |
1376708c BK |
786 | case TLS13_AD_MISSING_EXTENSION: |
787 | return SSL_AD_HANDSHAKE_FAILURE; | |
0f113f3e | 788 | default: |
26a7d938 | 789 | return -1; |
0f113f3e MC |
790 | } |
791 | } |