]>
Commit | Line | Data |
---|---|---|
846e33c7 RS |
1 | /* |
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. | |
c80149d9 | 3 | * Copyright 2005 Nokia. All rights reserved. |
82b0bf0b | 4 | * |
846e33c7 RS |
5 | * Licensed under the OpenSSL license (the "License"). You may not use |
6 | * this file except in compliance with the License. You can obtain a copy | |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
82b0bf0b | 9 | */ |
846e33c7 | 10 | |
58964a49 | 11 | #include <stdio.h> |
7b63c0fa | 12 | #include "ssl_locl.h" |
3c27208f | 13 | #include <openssl/comp.h> |
ec577822 | 14 | #include <openssl/evp.h> |
b7d60e76 | 15 | #include <openssl/kdf.h> |
637f374a | 16 | #include <openssl/rand.h> |
58964a49 | 17 | |
b7d60e76 | 18 | /* seed1 through seed5 are concatenated */ |
28ba2541 | 19 | static int tls1_PRF(SSL *s, |
6db6bc5a MC |
20 | const void *seed1, size_t seed1_len, |
21 | const void *seed2, size_t seed2_len, | |
22 | const void *seed3, size_t seed3_len, | |
23 | const void *seed4, size_t seed4_len, | |
24 | const void *seed5, size_t seed5_len, | |
25 | const unsigned char *sec, size_t slen, | |
26 | unsigned char *out, size_t olen) | |
0f113f3e | 27 | { |
28ba2541 | 28 | const EVP_MD *md = ssl_prf_md(s); |
b7d60e76 DSH |
29 | EVP_PKEY_CTX *pctx = NULL; |
30 | ||
31 | int ret = 0; | |
0f113f3e | 32 | |
28ba2541 | 33 | if (md == NULL) { |
668f6f08 MC |
34 | /* Should never happen */ |
35 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
28ba2541 | 36 | return 0; |
668f6f08 | 37 | } |
b7d60e76 DSH |
38 | pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); |
39 | if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0 | |
40 | || EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) <= 0 | |
348240c6 | 41 | || EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, (int)slen) <= 0) |
b7d60e76 | 42 | goto err; |
28ba2541 | 43 | |
348240c6 | 44 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, (int)seed1_len) <= 0) |
b7d60e76 | 45 | goto err; |
348240c6 | 46 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, (int)seed2_len) <= 0) |
b7d60e76 | 47 | goto err; |
348240c6 | 48 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, (int)seed3_len) <= 0) |
b7d60e76 | 49 | goto err; |
348240c6 | 50 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed4, (int)seed4_len) <= 0) |
b7d60e76 | 51 | goto err; |
348240c6 | 52 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed5, (int)seed5_len) <= 0) |
b7d60e76 DSH |
53 | goto err; |
54 | ||
6db6bc5a | 55 | if (EVP_PKEY_derive(pctx, out, &olen) <= 0) |
b7d60e76 DSH |
56 | goto err; |
57 | ret = 1; | |
58 | ||
a230b26e | 59 | err: |
b7d60e76 DSH |
60 | EVP_PKEY_CTX_free(pctx); |
61 | return ret; | |
81025661 | 62 | } |
0f113f3e | 63 | |
8c1a5343 | 64 | static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) |
0f113f3e MC |
65 | { |
66 | int ret; | |
28ba2541 | 67 | ret = tls1_PRF(s, |
0f113f3e MC |
68 | TLS_MD_KEY_EXPANSION_CONST, |
69 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3->server_random, | |
70 | SSL3_RANDOM_SIZE, s->s3->client_random, SSL3_RANDOM_SIZE, | |
71 | NULL, 0, NULL, 0, s->session->master_key, | |
b7d60e76 | 72 | s->session->master_key_length, km, num); |
55a9a16f | 73 | |
0f113f3e MC |
74 | return ret; |
75 | } | |
58964a49 | 76 | |
6b691a5c | 77 | int tls1_change_cipher_state(SSL *s, int which) |
0f113f3e | 78 | { |
0f113f3e | 79 | unsigned char *p, *mac_secret; |
0f113f3e MC |
80 | unsigned char tmp1[EVP_MAX_KEY_LENGTH]; |
81 | unsigned char tmp2[EVP_MAX_KEY_LENGTH]; | |
82 | unsigned char iv1[EVP_MAX_IV_LENGTH * 2]; | |
83 | unsigned char iv2[EVP_MAX_IV_LENGTH * 2]; | |
84 | unsigned char *ms, *key, *iv; | |
0f113f3e MC |
85 | EVP_CIPHER_CTX *dd; |
86 | const EVP_CIPHER *c; | |
09b6c2ef | 87 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 88 | const SSL_COMP *comp; |
09b6c2ef | 89 | #endif |
0f113f3e MC |
90 | const EVP_MD *m; |
91 | int mac_type; | |
b43d1cbb | 92 | size_t *mac_secret_size; |
0f113f3e MC |
93 | EVP_MD_CTX *mac_ctx; |
94 | EVP_PKEY *mac_key; | |
b43d1cbb | 95 | size_t n, i, j, k, cl; |
0f113f3e MC |
96 | int reuse_dd = 0; |
97 | ||
0f113f3e MC |
98 | c = s->s3->tmp.new_sym_enc; |
99 | m = s->s3->tmp.new_hash; | |
100 | mac_type = s->s3->tmp.new_mac_pkey_type; | |
09b6c2ef | 101 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 102 | comp = s->s3->tmp.new_compression; |
09b6c2ef | 103 | #endif |
58964a49 | 104 | |
0f113f3e | 105 | if (which & SSL3_CC_READ) { |
28a31a0a MC |
106 | if (s->ext.use_etm) |
107 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
108 | else | |
109 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
110 | ||
0f113f3e MC |
111 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
112 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; | |
113 | else | |
114 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
115 | ||
116 | if (s->enc_read_ctx != NULL) | |
117 | reuse_dd = 1; | |
846ec07d | 118 | else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) |
0f113f3e MC |
119 | goto err; |
120 | else | |
121 | /* | |
f430ba31 | 122 | * make sure it's initialised in case we exit later with an error |
0f113f3e | 123 | */ |
846ec07d | 124 | EVP_CIPHER_CTX_reset(s->enc_read_ctx); |
0f113f3e MC |
125 | dd = s->enc_read_ctx; |
126 | mac_ctx = ssl_replace_hash(&s->read_hash, NULL); | |
5f3d93e4 MC |
127 | if (mac_ctx == NULL) |
128 | goto err; | |
09b6c2ef | 129 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
130 | COMP_CTX_free(s->expand); |
131 | s->expand = NULL; | |
0f113f3e MC |
132 | if (comp != NULL) { |
133 | s->expand = COMP_CTX_new(comp->method); | |
134 | if (s->expand == NULL) { | |
135 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
136 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
137 | goto err2; | |
138 | } | |
0f113f3e | 139 | } |
09b6c2ef | 140 | #endif |
0f113f3e | 141 | /* |
d5d0a1cb | 142 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 143 | */ |
d5d0a1cb | 144 | if (!SSL_IS_DTLS(s)) |
de07f311 | 145 | RECORD_LAYER_reset_read_sequence(&s->rlayer); |
0f113f3e MC |
146 | mac_secret = &(s->s3->read_mac_secret[0]); |
147 | mac_secret_size = &(s->s3->read_mac_secret_size); | |
148 | } else { | |
28a31a0a MC |
149 | if (s->ext.use_etm) |
150 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
151 | else | |
152 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
153 | ||
0f113f3e MC |
154 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
155 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
156 | else | |
157 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
158 | if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) | |
159 | reuse_dd = 1; | |
160 | else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) | |
161 | goto err; | |
162 | dd = s->enc_write_ctx; | |
163 | if (SSL_IS_DTLS(s)) { | |
bfb0641f | 164 | mac_ctx = EVP_MD_CTX_new(); |
5f3d93e4 | 165 | if (mac_ctx == NULL) |
0f113f3e MC |
166 | goto err; |
167 | s->write_hash = mac_ctx; | |
5f3d93e4 | 168 | } else { |
0f113f3e | 169 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); |
5f3d93e4 MC |
170 | if (mac_ctx == NULL) |
171 | goto err; | |
172 | } | |
09b6c2ef | 173 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
174 | COMP_CTX_free(s->compress); |
175 | s->compress = NULL; | |
0f113f3e MC |
176 | if (comp != NULL) { |
177 | s->compress = COMP_CTX_new(comp->method); | |
178 | if (s->compress == NULL) { | |
179 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
180 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
181 | goto err2; | |
182 | } | |
183 | } | |
09b6c2ef | 184 | #endif |
0f113f3e | 185 | /* |
d5d0a1cb | 186 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 187 | */ |
d5d0a1cb | 188 | if (!SSL_IS_DTLS(s)) |
de07f311 | 189 | RECORD_LAYER_reset_write_sequence(&s->rlayer); |
0f113f3e MC |
190 | mac_secret = &(s->s3->write_mac_secret[0]); |
191 | mac_secret_size = &(s->s3->write_mac_secret_size); | |
192 | } | |
193 | ||
194 | if (reuse_dd) | |
846ec07d | 195 | EVP_CIPHER_CTX_reset(dd); |
0f113f3e MC |
196 | |
197 | p = s->s3->tmp.key_block; | |
198 | i = *mac_secret_size = s->s3->tmp.new_mac_secret_size; | |
199 | ||
b43d1cbb | 200 | /* TODO(size_t): convert me */ |
0f113f3e | 201 | cl = EVP_CIPHER_key_length(c); |
361a1191 | 202 | j = cl; |
0f113f3e | 203 | /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ |
e75c5a79 | 204 | /* If GCM/CCM mode only part of IV comes from PRF */ |
0f113f3e MC |
205 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) |
206 | k = EVP_GCM_TLS_FIXED_IV_LEN; | |
e75c5a79 DSH |
207 | else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) |
208 | k = EVP_CCM_TLS_FIXED_IV_LEN; | |
0f113f3e MC |
209 | else |
210 | k = EVP_CIPHER_iv_length(c); | |
211 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || | |
212 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
213 | ms = &(p[0]); | |
214 | n = i + i; | |
215 | key = &(p[n]); | |
216 | n += j + j; | |
217 | iv = &(p[n]); | |
218 | n += k + k; | |
0f113f3e MC |
219 | } else { |
220 | n = i; | |
221 | ms = &(p[n]); | |
222 | n += i + j; | |
223 | key = &(p[n]); | |
224 | n += j + k; | |
225 | iv = &(p[n]); | |
226 | n += k; | |
0f113f3e MC |
227 | } |
228 | ||
229 | if (n > s->s3->tmp.key_block_length) { | |
230 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
231 | goto err2; | |
232 | } | |
233 | ||
234 | memcpy(mac_secret, ms, i); | |
235 | ||
236 | if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { | |
348240c6 | 237 | /* TODO(size_t): Convert this function */ |
0f113f3e | 238 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, |
348240c6 | 239 | mac_secret, (int)*mac_secret_size); |
5f3d93e4 | 240 | if (mac_key == NULL |
a230b26e | 241 | || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) { |
5f3d93e4 MC |
242 | EVP_PKEY_free(mac_key); |
243 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
244 | goto err2; | |
245 | } | |
0f113f3e MC |
246 | EVP_PKEY_free(mac_key); |
247 | } | |
d63a5e5e | 248 | #ifdef SSL_DEBUG |
0f113f3e MC |
249 | printf("which = %04X\nmac key=", which); |
250 | { | |
2b7363ec | 251 | size_t z; |
0f113f3e MC |
252 | for (z = 0; z < i; z++) |
253 | printf("%02X%c", ms[z], ((z + 1) % 16) ? ' ' : '\n'); | |
254 | } | |
58964a49 | 255 | #endif |
0f113f3e MC |
256 | |
257 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { | |
eadf70d2 | 258 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) |
348240c6 MC |
259 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, |
260 | iv)) { | |
eadf70d2 MC |
261 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); |
262 | goto err2; | |
263 | } | |
e75c5a79 | 264 | } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { |
3d3701ea | 265 | int taglen; |
a230b26e EK |
266 | if (s->s3->tmp. |
267 | new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) | |
ec07b1d8 | 268 | taglen = EVP_CCM8_TLS_TAG_LEN; |
3d3701ea | 269 | else |
ec07b1d8 | 270 | taglen = EVP_CCM_TLS_TAG_LEN; |
e75c5a79 DSH |
271 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) |
272 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) | |
273 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) | |
348240c6 | 274 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) |
e75c5a79 DSH |
275 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { |
276 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
277 | goto err2; | |
278 | } | |
eadf70d2 MC |
279 | } else { |
280 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
281 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
282 | goto err2; | |
283 | } | |
284 | } | |
0f113f3e | 285 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ |
eadf70d2 MC |
286 | if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size |
287 | && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, | |
348240c6 | 288 | (int)*mac_secret_size, mac_secret)) { |
eadf70d2 MC |
289 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); |
290 | goto err2; | |
291 | } | |
1cf218bc | 292 | |
d63a5e5e | 293 | #ifdef SSL_DEBUG |
0f113f3e MC |
294 | printf("which = %04X\nkey=", which); |
295 | { | |
296 | int z; | |
297 | for (z = 0; z < EVP_CIPHER_key_length(c); z++) | |
298 | printf("%02X%c", key[z], ((z + 1) % 16) ? ' ' : '\n'); | |
299 | } | |
300 | printf("\niv="); | |
301 | { | |
2b7363ec | 302 | size_t z; |
0f113f3e MC |
303 | for (z = 0; z < k; z++) |
304 | printf("%02X%c", iv[z], ((z + 1) % 16) ? ' ' : '\n'); | |
305 | } | |
306 | printf("\n"); | |
58964a49 RE |
307 | #endif |
308 | ||
0f113f3e MC |
309 | OPENSSL_cleanse(tmp1, sizeof(tmp1)); |
310 | OPENSSL_cleanse(tmp2, sizeof(tmp1)); | |
311 | OPENSSL_cleanse(iv1, sizeof(iv1)); | |
312 | OPENSSL_cleanse(iv2, sizeof(iv2)); | |
313 | return (1); | |
314 | err: | |
315 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE); | |
316 | err2: | |
e0f9bf1d RS |
317 | OPENSSL_cleanse(tmp1, sizeof(tmp1)); |
318 | OPENSSL_cleanse(tmp2, sizeof(tmp1)); | |
319 | OPENSSL_cleanse(iv1, sizeof(iv1)); | |
320 | OPENSSL_cleanse(iv2, sizeof(iv2)); | |
0f113f3e MC |
321 | return (0); |
322 | } | |
58964a49 | 323 | |
6b691a5c | 324 | int tls1_setup_key_block(SSL *s) |
0f113f3e | 325 | { |
b7d60e76 | 326 | unsigned char *p; |
0f113f3e MC |
327 | const EVP_CIPHER *c; |
328 | const EVP_MD *hash; | |
0f113f3e | 329 | SSL_COMP *comp; |
8c1a5343 MC |
330 | int mac_type = NID_undef; |
331 | size_t num, mac_secret_size = 0; | |
0f113f3e | 332 | int ret = 0; |
58964a49 | 333 | |
0f113f3e MC |
334 | if (s->s3->tmp.key_block_length != 0) |
335 | return (1); | |
336 | ||
28a31a0a MC |
337 | if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, |
338 | &comp, s->ext.use_etm)) { | |
0f113f3e MC |
339 | SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE); |
340 | return (0); | |
341 | } | |
342 | ||
343 | s->s3->tmp.new_sym_enc = c; | |
344 | s->s3->tmp.new_hash = hash; | |
345 | s->s3->tmp.new_mac_pkey_type = mac_type; | |
346 | s->s3->tmp.new_mac_secret_size = mac_secret_size; | |
a230b26e | 347 | num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c); |
0f113f3e MC |
348 | num *= 2; |
349 | ||
350 | ssl3_cleanup_key_block(s); | |
351 | ||
b7d60e76 | 352 | if ((p = OPENSSL_malloc(num)) == NULL) { |
0f113f3e MC |
353 | SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE); |
354 | goto err; | |
355 | } | |
356 | ||
357 | s->s3->tmp.key_block_length = num; | |
b7d60e76 | 358 | s->s3->tmp.key_block = p; |
0f113f3e | 359 | |
d63a5e5e | 360 | #ifdef SSL_DEBUG |
0f113f3e MC |
361 | printf("client random\n"); |
362 | { | |
363 | int z; | |
364 | for (z = 0; z < SSL3_RANDOM_SIZE; z++) | |
365 | printf("%02X%c", s->s3->client_random[z], | |
366 | ((z + 1) % 16) ? ' ' : '\n'); | |
367 | } | |
368 | printf("server random\n"); | |
369 | { | |
370 | int z; | |
371 | for (z = 0; z < SSL3_RANDOM_SIZE; z++) | |
372 | printf("%02X%c", s->s3->server_random[z], | |
373 | ((z + 1) % 16) ? ' ' : '\n'); | |
374 | } | |
375 | printf("master key\n"); | |
376 | { | |
8c1a5343 | 377 | size_t z; |
0f113f3e MC |
378 | for (z = 0; z < s->session->master_key_length; z++) |
379 | printf("%02X%c", s->session->master_key[z], | |
380 | ((z + 1) % 16) ? ' ' : '\n'); | |
381 | } | |
58964a49 | 382 | #endif |
b7d60e76 | 383 | if (!tls1_generate_key_block(s, p, num)) |
0f113f3e | 384 | goto err; |
d63a5e5e | 385 | #ifdef SSL_DEBUG |
0f113f3e MC |
386 | printf("\nkey block\n"); |
387 | { | |
8c1a5343 | 388 | size_t z; |
0f113f3e | 389 | for (z = 0; z < num; z++) |
d1776fde | 390 | printf("%02X%c", p[z], ((z + 1) % 16) ? ' ' : '\n'); |
0f113f3e | 391 | } |
58964a49 RE |
392 | #endif |
393 | ||
0f113f3e MC |
394 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
395 | && s->method->version <= TLS1_VERSION) { | |
396 | /* | |
397 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
398 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
399 | */ | |
400 | s->s3->need_empty_fragments = 1; | |
401 | ||
402 | if (s->session->cipher != NULL) { | |
403 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
404 | s->s3->need_empty_fragments = 0; | |
405 | ||
d1d0be3c | 406 | #ifndef OPENSSL_NO_RC4 |
0f113f3e MC |
407 | if (s->session->cipher->algorithm_enc == SSL_RC4) |
408 | s->s3->need_empty_fragments = 0; | |
82b0bf0b | 409 | #endif |
0f113f3e MC |
410 | } |
411 | } | |
412 | ||
413 | ret = 1; | |
414 | err: | |
0f113f3e MC |
415 | return (ret); |
416 | } | |
58964a49 | 417 | |
6db6bc5a MC |
418 | size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, |
419 | unsigned char *out) | |
0f113f3e | 420 | { |
8c1a5343 | 421 | size_t hashlen; |
28ba2541 | 422 | unsigned char hash[EVP_MAX_MD_SIZE]; |
0f113f3e | 423 | |
124037fd DSH |
424 | if (!ssl3_digest_cached_records(s, 0)) |
425 | return 0; | |
0f113f3e | 426 | |
8c1a5343 | 427 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) |
48fbcbac | 428 | return 0; |
0f113f3e | 429 | |
b7d60e76 | 430 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
0f113f3e | 431 | s->session->master_key, s->session->master_key_length, |
b7d60e76 | 432 | out, TLS1_FINISH_MAC_LENGTH)) |
0f113f3e | 433 | return 0; |
c9dd49a7 | 434 | OPENSSL_cleanse(hash, hashlen); |
b7d60e76 | 435 | return TLS1_FINISH_MAC_LENGTH; |
0f113f3e | 436 | } |
58964a49 | 437 | |
6b691a5c | 438 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, |
8c1a5343 | 439 | size_t len, size_t *secret_size) |
0f113f3e | 440 | { |
329114f9 | 441 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
0cfb0e75 | 442 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
8c1a5343 | 443 | size_t hashlen; |
a230b26e EK |
444 | /* |
445 | * Digest cached records keeping record buffer (if present): this wont | |
446 | * affect client auth because we're freezing the buffer at the same | |
447 | * point (after client key exchange and before certificate verify) | |
124037fd DSH |
448 | */ |
449 | if (!ssl3_digest_cached_records(s, 1)) | |
8c1a5343 MC |
450 | return 0; |
451 | if(!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) | |
452 | return 0; | |
0cfb0e75 DSH |
453 | #ifdef SSL_DEBUG |
454 | fprintf(stderr, "Handshake hashes:\n"); | |
455 | BIO_dump_fp(stderr, (char *)hash, hashlen); | |
456 | #endif | |
28ba2541 | 457 | tls1_PRF(s, |
0cfb0e75 DSH |
458 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
459 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
460 | hash, hashlen, | |
0cfb0e75 | 461 | NULL, 0, |
3d47c1d3 | 462 | NULL, 0, |
b7d60e76 DSH |
463 | NULL, 0, p, len, s->session->master_key, |
464 | SSL3_MASTER_SECRET_SIZE); | |
0cfb0e75 DSH |
465 | OPENSSL_cleanse(hash, hashlen); |
466 | } else { | |
28ba2541 | 467 | tls1_PRF(s, |
0cfb0e75 DSH |
468 | TLS_MD_MASTER_SECRET_CONST, |
469 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
470 | s->s3->client_random, SSL3_RANDOM_SIZE, | |
3d47c1d3 | 471 | NULL, 0, |
0cfb0e75 | 472 | s->s3->server_random, SSL3_RANDOM_SIZE, |
b7d60e76 DSH |
473 | NULL, 0, p, len, s->session->master_key, |
474 | SSL3_MASTER_SECRET_SIZE); | |
0cfb0e75 | 475 | } |
a2f9200f | 476 | #ifdef SSL_DEBUG |
0f113f3e MC |
477 | fprintf(stderr, "Premaster Secret:\n"); |
478 | BIO_dump_fp(stderr, (char *)p, len); | |
479 | fprintf(stderr, "Client Random:\n"); | |
480 | BIO_dump_fp(stderr, (char *)s->s3->client_random, SSL3_RANDOM_SIZE); | |
481 | fprintf(stderr, "Server Random:\n"); | |
482 | BIO_dump_fp(stderr, (char *)s->s3->server_random, SSL3_RANDOM_SIZE); | |
483 | fprintf(stderr, "Master Secret:\n"); | |
484 | BIO_dump_fp(stderr, (char *)s->session->master_key, | |
485 | SSL3_MASTER_SECRET_SIZE); | |
a2f9200f | 486 | #endif |
761772d7 | 487 | |
8c1a5343 MC |
488 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
489 | return 1; | |
0f113f3e | 490 | } |
58964a49 | 491 | |
74b4b494 | 492 | int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, |
0f113f3e MC |
493 | const char *label, size_t llen, |
494 | const unsigned char *context, | |
495 | size_t contextlen, int use_context) | |
496 | { | |
0f113f3e | 497 | unsigned char *val = NULL; |
1c8a527c | 498 | size_t vallen = 0, currentvalpos; |
0f113f3e | 499 | int rv; |
e0af0405 | 500 | |
0f113f3e MC |
501 | /* |
502 | * construct PRF arguments we construct the PRF argument ourself rather | |
503 | * than passing separate values into the TLS PRF to ensure that the | |
504 | * concatenation of values does not create a prohibited label. | |
505 | */ | |
506 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
507 | if (use_context) { | |
508 | vallen += 2 + contextlen; | |
509 | } | |
510 | ||
511 | val = OPENSSL_malloc(vallen); | |
512 | if (val == NULL) | |
513 | goto err2; | |
514 | currentvalpos = 0; | |
515 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
516 | currentvalpos += llen; | |
517 | memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE); | |
518 | currentvalpos += SSL3_RANDOM_SIZE; | |
519 | memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE); | |
520 | currentvalpos += SSL3_RANDOM_SIZE; | |
521 | ||
522 | if (use_context) { | |
523 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
524 | currentvalpos++; | |
525 | val[currentvalpos] = contextlen & 0xff; | |
526 | currentvalpos++; | |
527 | if ((contextlen > 0) || (context != NULL)) { | |
528 | memcpy(val + currentvalpos, context, contextlen); | |
529 | } | |
530 | } | |
531 | ||
532 | /* | |
533 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
534 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
535 | * the comparisons won't have buffer overflow | |
536 | */ | |
537 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
538 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
539 | goto err1; | |
540 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
541 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
542 | goto err1; | |
543 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
544 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
545 | goto err1; | |
0cfb0e75 DSH |
546 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
547 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
548 | goto err1; | |
0f113f3e MC |
549 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
550 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
551 | goto err1; | |
552 | ||
28ba2541 | 553 | rv = tls1_PRF(s, |
0f113f3e MC |
554 | val, vallen, |
555 | NULL, 0, | |
556 | NULL, 0, | |
557 | NULL, 0, | |
558 | NULL, 0, | |
559 | s->session->master_key, s->session->master_key_length, | |
b7d60e76 | 560 | out, olen); |
e0af0405 | 561 | |
0f113f3e MC |
562 | goto ret; |
563 | err1: | |
a230b26e | 564 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
0f113f3e MC |
565 | rv = 0; |
566 | goto ret; | |
567 | err2: | |
568 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); | |
569 | rv = 0; | |
570 | ret: | |
05c7b163 | 571 | OPENSSL_clear_free(val, vallen); |
0f113f3e MC |
572 | return (rv); |
573 | } | |
e0af0405 | 574 | |
6b691a5c | 575 | int tls1_alert_code(int code) |
0f113f3e MC |
576 | { |
577 | switch (code) { | |
578 | case SSL_AD_CLOSE_NOTIFY: | |
579 | return (SSL3_AD_CLOSE_NOTIFY); | |
580 | case SSL_AD_UNEXPECTED_MESSAGE: | |
581 | return (SSL3_AD_UNEXPECTED_MESSAGE); | |
582 | case SSL_AD_BAD_RECORD_MAC: | |
583 | return (SSL3_AD_BAD_RECORD_MAC); | |
584 | case SSL_AD_DECRYPTION_FAILED: | |
585 | return (TLS1_AD_DECRYPTION_FAILED); | |
586 | case SSL_AD_RECORD_OVERFLOW: | |
587 | return (TLS1_AD_RECORD_OVERFLOW); | |
588 | case SSL_AD_DECOMPRESSION_FAILURE: | |
589 | return (SSL3_AD_DECOMPRESSION_FAILURE); | |
590 | case SSL_AD_HANDSHAKE_FAILURE: | |
591 | return (SSL3_AD_HANDSHAKE_FAILURE); | |
592 | case SSL_AD_NO_CERTIFICATE: | |
593 | return (-1); | |
594 | case SSL_AD_BAD_CERTIFICATE: | |
595 | return (SSL3_AD_BAD_CERTIFICATE); | |
596 | case SSL_AD_UNSUPPORTED_CERTIFICATE: | |
597 | return (SSL3_AD_UNSUPPORTED_CERTIFICATE); | |
598 | case SSL_AD_CERTIFICATE_REVOKED: | |
599 | return (SSL3_AD_CERTIFICATE_REVOKED); | |
600 | case SSL_AD_CERTIFICATE_EXPIRED: | |
601 | return (SSL3_AD_CERTIFICATE_EXPIRED); | |
602 | case SSL_AD_CERTIFICATE_UNKNOWN: | |
603 | return (SSL3_AD_CERTIFICATE_UNKNOWN); | |
604 | case SSL_AD_ILLEGAL_PARAMETER: | |
605 | return (SSL3_AD_ILLEGAL_PARAMETER); | |
606 | case SSL_AD_UNKNOWN_CA: | |
607 | return (TLS1_AD_UNKNOWN_CA); | |
608 | case SSL_AD_ACCESS_DENIED: | |
609 | return (TLS1_AD_ACCESS_DENIED); | |
610 | case SSL_AD_DECODE_ERROR: | |
611 | return (TLS1_AD_DECODE_ERROR); | |
612 | case SSL_AD_DECRYPT_ERROR: | |
613 | return (TLS1_AD_DECRYPT_ERROR); | |
614 | case SSL_AD_EXPORT_RESTRICTION: | |
615 | return (TLS1_AD_EXPORT_RESTRICTION); | |
616 | case SSL_AD_PROTOCOL_VERSION: | |
617 | return (TLS1_AD_PROTOCOL_VERSION); | |
618 | case SSL_AD_INSUFFICIENT_SECURITY: | |
619 | return (TLS1_AD_INSUFFICIENT_SECURITY); | |
620 | case SSL_AD_INTERNAL_ERROR: | |
621 | return (TLS1_AD_INTERNAL_ERROR); | |
622 | case SSL_AD_USER_CANCELLED: | |
623 | return (TLS1_AD_USER_CANCELLED); | |
624 | case SSL_AD_NO_RENEGOTIATION: | |
625 | return (TLS1_AD_NO_RENEGOTIATION); | |
626 | case SSL_AD_UNSUPPORTED_EXTENSION: | |
627 | return (TLS1_AD_UNSUPPORTED_EXTENSION); | |
628 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: | |
629 | return (TLS1_AD_CERTIFICATE_UNOBTAINABLE); | |
630 | case SSL_AD_UNRECOGNIZED_NAME: | |
631 | return (TLS1_AD_UNRECOGNIZED_NAME); | |
632 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: | |
633 | return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE); | |
634 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: | |
635 | return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE); | |
636 | case SSL_AD_UNKNOWN_PSK_IDENTITY: | |
637 | return (TLS1_AD_UNKNOWN_PSK_IDENTITY); | |
638 | case SSL_AD_INAPPROPRIATE_FALLBACK: | |
639 | return (TLS1_AD_INAPPROPRIATE_FALLBACK); | |
06217867 EK |
640 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
641 | return (TLS1_AD_NO_APPLICATION_PROTOCOL); | |
42c28b63 MC |
642 | case SSL_AD_CERTIFICATE_REQUIRED: |
643 | return SSL_AD_HANDSHAKE_FAILURE; | |
0f113f3e MC |
644 | default: |
645 | return (-1); | |
646 | } | |
647 | } |