]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
b0edda11 | 2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. |
c80149d9 | 3 | * Copyright 2005 Nokia. All rights reserved. |
82b0bf0b | 4 | * |
2c18d164 | 5 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
6 | * this file except in compliance with the License. You can obtain a copy |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
82b0bf0b | 9 | */ |
846e33c7 | 10 | |
58964a49 | 11 | #include <stdio.h> |
7b63c0fa | 12 | #include "ssl_locl.h" |
3c27208f | 13 | #include <openssl/comp.h> |
ec577822 | 14 | #include <openssl/evp.h> |
b7d60e76 | 15 | #include <openssl/kdf.h> |
637f374a | 16 | #include <openssl/rand.h> |
58964a49 | 17 | |
b7d60e76 | 18 | /* seed1 through seed5 are concatenated */ |
28ba2541 | 19 | static int tls1_PRF(SSL *s, |
6db6bc5a MC |
20 | const void *seed1, size_t seed1_len, |
21 | const void *seed2, size_t seed2_len, | |
22 | const void *seed3, size_t seed3_len, | |
23 | const void *seed4, size_t seed4_len, | |
24 | const void *seed5, size_t seed5_len, | |
25 | const unsigned char *sec, size_t slen, | |
d4d2f3a4 | 26 | unsigned char *out, size_t olen, int fatal) |
0f113f3e | 27 | { |
28ba2541 | 28 | const EVP_MD *md = ssl_prf_md(s); |
b7d60e76 | 29 | EVP_PKEY_CTX *pctx = NULL; |
b7d60e76 | 30 | int ret = 0; |
0f113f3e | 31 | |
28ba2541 | 32 | if (md == NULL) { |
668f6f08 | 33 | /* Should never happen */ |
d4d2f3a4 MC |
34 | if (fatal) |
35 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, | |
36 | ERR_R_INTERNAL_ERROR); | |
37 | else | |
38 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
28ba2541 | 39 | return 0; |
668f6f08 | 40 | } |
b7d60e76 DSH |
41 | pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); |
42 | if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0 | |
43 | || EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) <= 0 | |
d4d2f3a4 MC |
44 | || EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, (int)slen) <= 0 |
45 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, (int)seed1_len) <= 0 | |
46 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, (int)seed2_len) <= 0 | |
47 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, (int)seed3_len) <= 0 | |
48 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed4, (int)seed4_len) <= 0 | |
49 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed5, (int)seed5_len) <= 0 | |
50 | || EVP_PKEY_derive(pctx, out, &olen) <= 0) { | |
51 | if (fatal) | |
52 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, | |
53 | ERR_R_INTERNAL_ERROR); | |
54 | else | |
55 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
b7d60e76 | 56 | goto err; |
d4d2f3a4 | 57 | } |
b7d60e76 | 58 | |
b7d60e76 DSH |
59 | ret = 1; |
60 | ||
a230b26e | 61 | err: |
b7d60e76 DSH |
62 | EVP_PKEY_CTX_free(pctx); |
63 | return ret; | |
81025661 | 64 | } |
0f113f3e | 65 | |
8c1a5343 | 66 | static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) |
0f113f3e MC |
67 | { |
68 | int ret; | |
d4d2f3a4 MC |
69 | |
70 | /* Calls SSLfatal() as required */ | |
28ba2541 | 71 | ret = tls1_PRF(s, |
0f113f3e MC |
72 | TLS_MD_KEY_EXPANSION_CONST, |
73 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3->server_random, | |
74 | SSL3_RANDOM_SIZE, s->s3->client_random, SSL3_RANDOM_SIZE, | |
75 | NULL, 0, NULL, 0, s->session->master_key, | |
d4d2f3a4 | 76 | s->session->master_key_length, km, num, 1); |
55a9a16f | 77 | |
0f113f3e MC |
78 | return ret; |
79 | } | |
58964a49 | 80 | |
6b691a5c | 81 | int tls1_change_cipher_state(SSL *s, int which) |
0f113f3e | 82 | { |
0f113f3e | 83 | unsigned char *p, *mac_secret; |
0f113f3e MC |
84 | unsigned char tmp1[EVP_MAX_KEY_LENGTH]; |
85 | unsigned char tmp2[EVP_MAX_KEY_LENGTH]; | |
86 | unsigned char iv1[EVP_MAX_IV_LENGTH * 2]; | |
87 | unsigned char iv2[EVP_MAX_IV_LENGTH * 2]; | |
88 | unsigned char *ms, *key, *iv; | |
0f113f3e MC |
89 | EVP_CIPHER_CTX *dd; |
90 | const EVP_CIPHER *c; | |
09b6c2ef | 91 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 92 | const SSL_COMP *comp; |
09b6c2ef | 93 | #endif |
0f113f3e MC |
94 | const EVP_MD *m; |
95 | int mac_type; | |
b43d1cbb | 96 | size_t *mac_secret_size; |
0f113f3e MC |
97 | EVP_MD_CTX *mac_ctx; |
98 | EVP_PKEY *mac_key; | |
b43d1cbb | 99 | size_t n, i, j, k, cl; |
0f113f3e MC |
100 | int reuse_dd = 0; |
101 | ||
0f113f3e MC |
102 | c = s->s3->tmp.new_sym_enc; |
103 | m = s->s3->tmp.new_hash; | |
104 | mac_type = s->s3->tmp.new_mac_pkey_type; | |
09b6c2ef | 105 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 106 | comp = s->s3->tmp.new_compression; |
09b6c2ef | 107 | #endif |
58964a49 | 108 | |
0f113f3e | 109 | if (which & SSL3_CC_READ) { |
28a31a0a MC |
110 | if (s->ext.use_etm) |
111 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
112 | else | |
113 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
114 | ||
0f113f3e MC |
115 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
116 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; | |
117 | else | |
118 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
119 | ||
f63a17d6 | 120 | if (s->enc_read_ctx != NULL) { |
0f113f3e | 121 | reuse_dd = 1; |
f63a17d6 MC |
122 | } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
123 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
124 | ERR_R_MALLOC_FAILURE); | |
0f113f3e | 125 | goto err; |
f63a17d6 | 126 | } else { |
0f113f3e | 127 | /* |
f430ba31 | 128 | * make sure it's initialised in case we exit later with an error |
0f113f3e | 129 | */ |
846ec07d | 130 | EVP_CIPHER_CTX_reset(s->enc_read_ctx); |
f63a17d6 | 131 | } |
0f113f3e MC |
132 | dd = s->enc_read_ctx; |
133 | mac_ctx = ssl_replace_hash(&s->read_hash, NULL); | |
157af9be MC |
134 | if (mac_ctx == NULL) { |
135 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
136 | ERR_R_INTERNAL_ERROR); | |
5f3d93e4 | 137 | goto err; |
157af9be | 138 | } |
09b6c2ef | 139 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
140 | COMP_CTX_free(s->expand); |
141 | s->expand = NULL; | |
0f113f3e MC |
142 | if (comp != NULL) { |
143 | s->expand = COMP_CTX_new(comp->method); | |
144 | if (s->expand == NULL) { | |
f63a17d6 MC |
145 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
146 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
147 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
148 | goto err; | |
0f113f3e | 149 | } |
0f113f3e | 150 | } |
09b6c2ef | 151 | #endif |
0f113f3e | 152 | /* |
d5d0a1cb | 153 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 154 | */ |
d5d0a1cb | 155 | if (!SSL_IS_DTLS(s)) |
de07f311 | 156 | RECORD_LAYER_reset_read_sequence(&s->rlayer); |
0f113f3e MC |
157 | mac_secret = &(s->s3->read_mac_secret[0]); |
158 | mac_secret_size = &(s->s3->read_mac_secret_size); | |
159 | } else { | |
7426cd34 | 160 | s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; |
28a31a0a MC |
161 | if (s->ext.use_etm) |
162 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
163 | else | |
164 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
165 | ||
0f113f3e MC |
166 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
167 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
168 | else | |
169 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
f63a17d6 | 170 | if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) { |
0f113f3e | 171 | reuse_dd = 1; |
f63a17d6 MC |
172 | } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
173 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
174 | ERR_R_MALLOC_FAILURE); | |
0f113f3e | 175 | goto err; |
f63a17d6 | 176 | } |
0f113f3e MC |
177 | dd = s->enc_write_ctx; |
178 | if (SSL_IS_DTLS(s)) { | |
bfb0641f | 179 | mac_ctx = EVP_MD_CTX_new(); |
f63a17d6 MC |
180 | if (mac_ctx == NULL) { |
181 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
182 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
183 | ERR_R_MALLOC_FAILURE); | |
0f113f3e | 184 | goto err; |
f63a17d6 | 185 | } |
0f113f3e | 186 | s->write_hash = mac_ctx; |
5f3d93e4 | 187 | } else { |
0f113f3e | 188 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); |
f63a17d6 MC |
189 | if (mac_ctx == NULL) { |
190 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
191 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
192 | ERR_R_MALLOC_FAILURE); | |
5f3d93e4 | 193 | goto err; |
f63a17d6 | 194 | } |
5f3d93e4 | 195 | } |
09b6c2ef | 196 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
197 | COMP_CTX_free(s->compress); |
198 | s->compress = NULL; | |
0f113f3e MC |
199 | if (comp != NULL) { |
200 | s->compress = COMP_CTX_new(comp->method); | |
201 | if (s->compress == NULL) { | |
f63a17d6 MC |
202 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
203 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
204 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
205 | goto err; | |
0f113f3e MC |
206 | } |
207 | } | |
09b6c2ef | 208 | #endif |
0f113f3e | 209 | /* |
d5d0a1cb | 210 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 211 | */ |
d5d0a1cb | 212 | if (!SSL_IS_DTLS(s)) |
de07f311 | 213 | RECORD_LAYER_reset_write_sequence(&s->rlayer); |
0f113f3e MC |
214 | mac_secret = &(s->s3->write_mac_secret[0]); |
215 | mac_secret_size = &(s->s3->write_mac_secret_size); | |
216 | } | |
217 | ||
218 | if (reuse_dd) | |
846ec07d | 219 | EVP_CIPHER_CTX_reset(dd); |
0f113f3e MC |
220 | |
221 | p = s->s3->tmp.key_block; | |
222 | i = *mac_secret_size = s->s3->tmp.new_mac_secret_size; | |
223 | ||
b43d1cbb | 224 | /* TODO(size_t): convert me */ |
0f113f3e | 225 | cl = EVP_CIPHER_key_length(c); |
361a1191 | 226 | j = cl; |
0f113f3e | 227 | /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ |
e75c5a79 | 228 | /* If GCM/CCM mode only part of IV comes from PRF */ |
0f113f3e MC |
229 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) |
230 | k = EVP_GCM_TLS_FIXED_IV_LEN; | |
e75c5a79 DSH |
231 | else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) |
232 | k = EVP_CCM_TLS_FIXED_IV_LEN; | |
0f113f3e MC |
233 | else |
234 | k = EVP_CIPHER_iv_length(c); | |
235 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || | |
236 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
237 | ms = &(p[0]); | |
238 | n = i + i; | |
239 | key = &(p[n]); | |
240 | n += j + j; | |
241 | iv = &(p[n]); | |
242 | n += k + k; | |
0f113f3e MC |
243 | } else { |
244 | n = i; | |
245 | ms = &(p[n]); | |
246 | n += i + j; | |
247 | key = &(p[n]); | |
248 | n += j + k; | |
249 | iv = &(p[n]); | |
250 | n += k; | |
0f113f3e MC |
251 | } |
252 | ||
253 | if (n > s->s3->tmp.key_block_length) { | |
f63a17d6 MC |
254 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
255 | ERR_R_INTERNAL_ERROR); | |
256 | goto err; | |
0f113f3e MC |
257 | } |
258 | ||
259 | memcpy(mac_secret, ms, i); | |
260 | ||
261 | if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { | |
348240c6 | 262 | /* TODO(size_t): Convert this function */ |
7b4d3ffa | 263 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, |
f929439f | 264 | (int)*mac_secret_size); |
5f3d93e4 | 265 | if (mac_key == NULL |
a230b26e | 266 | || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) { |
5f3d93e4 | 267 | EVP_PKEY_free(mac_key); |
f63a17d6 MC |
268 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
269 | ERR_R_INTERNAL_ERROR); | |
270 | goto err; | |
5f3d93e4 | 271 | } |
0f113f3e MC |
272 | EVP_PKEY_free(mac_key); |
273 | } | |
d63a5e5e | 274 | #ifdef SSL_DEBUG |
0f113f3e MC |
275 | printf("which = %04X\nmac key=", which); |
276 | { | |
2b7363ec | 277 | size_t z; |
0f113f3e MC |
278 | for (z = 0; z < i; z++) |
279 | printf("%02X%c", ms[z], ((z + 1) % 16) ? ' ' : '\n'); | |
280 | } | |
58964a49 | 281 | #endif |
0f113f3e MC |
282 | |
283 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { | |
eadf70d2 | 284 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) |
348240c6 MC |
285 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, |
286 | iv)) { | |
f63a17d6 MC |
287 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
288 | ERR_R_INTERNAL_ERROR); | |
289 | goto err; | |
eadf70d2 | 290 | } |
e75c5a79 | 291 | } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { |
3d3701ea | 292 | int taglen; |
a230b26e EK |
293 | if (s->s3->tmp. |
294 | new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) | |
ec07b1d8 | 295 | taglen = EVP_CCM8_TLS_TAG_LEN; |
3d3701ea | 296 | else |
ec07b1d8 | 297 | taglen = EVP_CCM_TLS_TAG_LEN; |
e75c5a79 DSH |
298 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) |
299 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) | |
300 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) | |
348240c6 | 301 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) |
e75c5a79 | 302 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { |
f63a17d6 MC |
303 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
304 | ERR_R_INTERNAL_ERROR); | |
305 | goto err; | |
e75c5a79 | 306 | } |
eadf70d2 MC |
307 | } else { |
308 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
f63a17d6 MC |
309 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
310 | ERR_R_INTERNAL_ERROR); | |
311 | goto err; | |
eadf70d2 MC |
312 | } |
313 | } | |
0f113f3e | 314 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ |
eadf70d2 MC |
315 | if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size |
316 | && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, | |
348240c6 | 317 | (int)*mac_secret_size, mac_secret)) { |
f63a17d6 MC |
318 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
319 | ERR_R_INTERNAL_ERROR); | |
320 | goto err; | |
eadf70d2 | 321 | } |
7426cd34 | 322 | s->statem.enc_write_state = ENC_WRITE_STATE_VALID; |
1cf218bc | 323 | |
d63a5e5e | 324 | #ifdef SSL_DEBUG |
0f113f3e MC |
325 | printf("which = %04X\nkey=", which); |
326 | { | |
327 | int z; | |
328 | for (z = 0; z < EVP_CIPHER_key_length(c); z++) | |
329 | printf("%02X%c", key[z], ((z + 1) % 16) ? ' ' : '\n'); | |
330 | } | |
331 | printf("\niv="); | |
332 | { | |
2b7363ec | 333 | size_t z; |
0f113f3e MC |
334 | for (z = 0; z < k; z++) |
335 | printf("%02X%c", iv[z], ((z + 1) % 16) ? ' ' : '\n'); | |
336 | } | |
337 | printf("\n"); | |
58964a49 RE |
338 | #endif |
339 | ||
0f113f3e MC |
340 | OPENSSL_cleanse(tmp1, sizeof(tmp1)); |
341 | OPENSSL_cleanse(tmp2, sizeof(tmp1)); | |
342 | OPENSSL_cleanse(iv1, sizeof(iv1)); | |
343 | OPENSSL_cleanse(iv2, sizeof(iv2)); | |
208fb891 | 344 | return 1; |
0f113f3e | 345 | err: |
e0f9bf1d RS |
346 | OPENSSL_cleanse(tmp1, sizeof(tmp1)); |
347 | OPENSSL_cleanse(tmp2, sizeof(tmp1)); | |
348 | OPENSSL_cleanse(iv1, sizeof(iv1)); | |
349 | OPENSSL_cleanse(iv2, sizeof(iv2)); | |
26a7d938 | 350 | return 0; |
0f113f3e | 351 | } |
58964a49 | 352 | |
6b691a5c | 353 | int tls1_setup_key_block(SSL *s) |
0f113f3e | 354 | { |
b7d60e76 | 355 | unsigned char *p; |
0f113f3e MC |
356 | const EVP_CIPHER *c; |
357 | const EVP_MD *hash; | |
0f113f3e | 358 | SSL_COMP *comp; |
8c1a5343 MC |
359 | int mac_type = NID_undef; |
360 | size_t num, mac_secret_size = 0; | |
0f113f3e | 361 | int ret = 0; |
58964a49 | 362 | |
0f113f3e | 363 | if (s->s3->tmp.key_block_length != 0) |
208fb891 | 364 | return 1; |
0f113f3e | 365 | |
28a31a0a MC |
366 | if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, |
367 | &comp, s->ext.use_etm)) { | |
f63a17d6 MC |
368 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, |
369 | SSL_R_CIPHER_OR_HASH_UNAVAILABLE); | |
26a7d938 | 370 | return 0; |
0f113f3e MC |
371 | } |
372 | ||
373 | s->s3->tmp.new_sym_enc = c; | |
374 | s->s3->tmp.new_hash = hash; | |
375 | s->s3->tmp.new_mac_pkey_type = mac_type; | |
376 | s->s3->tmp.new_mac_secret_size = mac_secret_size; | |
a230b26e | 377 | num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c); |
0f113f3e MC |
378 | num *= 2; |
379 | ||
380 | ssl3_cleanup_key_block(s); | |
381 | ||
b7d60e76 | 382 | if ((p = OPENSSL_malloc(num)) == NULL) { |
f63a17d6 MC |
383 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, |
384 | ERR_R_MALLOC_FAILURE); | |
0f113f3e MC |
385 | goto err; |
386 | } | |
387 | ||
388 | s->s3->tmp.key_block_length = num; | |
b7d60e76 | 389 | s->s3->tmp.key_block = p; |
0f113f3e | 390 | |
d63a5e5e | 391 | #ifdef SSL_DEBUG |
0f113f3e MC |
392 | printf("client random\n"); |
393 | { | |
394 | int z; | |
395 | for (z = 0; z < SSL3_RANDOM_SIZE; z++) | |
396 | printf("%02X%c", s->s3->client_random[z], | |
397 | ((z + 1) % 16) ? ' ' : '\n'); | |
398 | } | |
399 | printf("server random\n"); | |
400 | { | |
401 | int z; | |
402 | for (z = 0; z < SSL3_RANDOM_SIZE; z++) | |
403 | printf("%02X%c", s->s3->server_random[z], | |
404 | ((z + 1) % 16) ? ' ' : '\n'); | |
405 | } | |
406 | printf("master key\n"); | |
407 | { | |
8c1a5343 | 408 | size_t z; |
0f113f3e MC |
409 | for (z = 0; z < s->session->master_key_length; z++) |
410 | printf("%02X%c", s->session->master_key[z], | |
411 | ((z + 1) % 16) ? ' ' : '\n'); | |
412 | } | |
58964a49 | 413 | #endif |
d4d2f3a4 MC |
414 | if (!tls1_generate_key_block(s, p, num)) { |
415 | /* SSLfatal() already called */ | |
0f113f3e | 416 | goto err; |
d4d2f3a4 | 417 | } |
d63a5e5e | 418 | #ifdef SSL_DEBUG |
0f113f3e MC |
419 | printf("\nkey block\n"); |
420 | { | |
8c1a5343 | 421 | size_t z; |
0f113f3e | 422 | for (z = 0; z < num; z++) |
d1776fde | 423 | printf("%02X%c", p[z], ((z + 1) % 16) ? ' ' : '\n'); |
0f113f3e | 424 | } |
58964a49 RE |
425 | #endif |
426 | ||
0f113f3e MC |
427 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
428 | && s->method->version <= TLS1_VERSION) { | |
429 | /* | |
430 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
431 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
432 | */ | |
433 | s->s3->need_empty_fragments = 1; | |
434 | ||
435 | if (s->session->cipher != NULL) { | |
436 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
437 | s->s3->need_empty_fragments = 0; | |
438 | ||
d1d0be3c | 439 | #ifndef OPENSSL_NO_RC4 |
0f113f3e MC |
440 | if (s->session->cipher->algorithm_enc == SSL_RC4) |
441 | s->s3->need_empty_fragments = 0; | |
82b0bf0b | 442 | #endif |
0f113f3e MC |
443 | } |
444 | } | |
445 | ||
446 | ret = 1; | |
447 | err: | |
26a7d938 | 448 | return ret; |
0f113f3e | 449 | } |
58964a49 | 450 | |
6db6bc5a MC |
451 | size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, |
452 | unsigned char *out) | |
0f113f3e | 453 | { |
8c1a5343 | 454 | size_t hashlen; |
28ba2541 | 455 | unsigned char hash[EVP_MAX_MD_SIZE]; |
0f113f3e | 456 | |
d4d2f3a4 MC |
457 | if (!ssl3_digest_cached_records(s, 0)) { |
458 | /* SSLfatal() already called */ | |
124037fd | 459 | return 0; |
d4d2f3a4 | 460 | } |
0f113f3e | 461 | |
d4d2f3a4 MC |
462 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
463 | /* SSLfatal() already called */ | |
48fbcbac | 464 | return 0; |
d4d2f3a4 | 465 | } |
0f113f3e | 466 | |
b7d60e76 | 467 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
0f113f3e | 468 | s->session->master_key, s->session->master_key_length, |
d4d2f3a4 MC |
469 | out, TLS1_FINISH_MAC_LENGTH, 1)) { |
470 | /* SSLfatal() already called */ | |
0f113f3e | 471 | return 0; |
d4d2f3a4 | 472 | } |
c9dd49a7 | 473 | OPENSSL_cleanse(hash, hashlen); |
b7d60e76 | 474 | return TLS1_FINISH_MAC_LENGTH; |
0f113f3e | 475 | } |
58964a49 | 476 | |
6b691a5c | 477 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, |
8c1a5343 | 478 | size_t len, size_t *secret_size) |
0f113f3e | 479 | { |
329114f9 | 480 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
0cfb0e75 | 481 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
8c1a5343 | 482 | size_t hashlen; |
a230b26e EK |
483 | /* |
484 | * Digest cached records keeping record buffer (if present): this wont | |
485 | * affect client auth because we're freezing the buffer at the same | |
486 | * point (after client key exchange and before certificate verify) | |
124037fd | 487 | */ |
f63a17d6 MC |
488 | if (!ssl3_digest_cached_records(s, 1) |
489 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { | |
490 | /* SSLfatal() already called */ | |
8c1a5343 | 491 | return 0; |
f63a17d6 | 492 | } |
0cfb0e75 DSH |
493 | #ifdef SSL_DEBUG |
494 | fprintf(stderr, "Handshake hashes:\n"); | |
495 | BIO_dump_fp(stderr, (char *)hash, hashlen); | |
496 | #endif | |
d4d2f3a4 MC |
497 | if (!tls1_PRF(s, |
498 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
499 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
500 | hash, hashlen, | |
501 | NULL, 0, | |
502 | NULL, 0, | |
503 | NULL, 0, p, len, out, | |
504 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
505 | /* SSLfatal() already called */ | |
506 | return 0; | |
507 | } | |
0cfb0e75 DSH |
508 | OPENSSL_cleanse(hash, hashlen); |
509 | } else { | |
d4d2f3a4 MC |
510 | if (!tls1_PRF(s, |
511 | TLS_MD_MASTER_SECRET_CONST, | |
512 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
513 | s->s3->client_random, SSL3_RANDOM_SIZE, | |
514 | NULL, 0, | |
515 | s->s3->server_random, SSL3_RANDOM_SIZE, | |
516 | NULL, 0, p, len, out, | |
517 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
518 | /* SSLfatal() already called */ | |
519 | return 0; | |
520 | } | |
0cfb0e75 | 521 | } |
a2f9200f | 522 | #ifdef SSL_DEBUG |
0f113f3e MC |
523 | fprintf(stderr, "Premaster Secret:\n"); |
524 | BIO_dump_fp(stderr, (char *)p, len); | |
525 | fprintf(stderr, "Client Random:\n"); | |
526 | BIO_dump_fp(stderr, (char *)s->s3->client_random, SSL3_RANDOM_SIZE); | |
527 | fprintf(stderr, "Server Random:\n"); | |
528 | BIO_dump_fp(stderr, (char *)s->s3->server_random, SSL3_RANDOM_SIZE); | |
529 | fprintf(stderr, "Master Secret:\n"); | |
530 | BIO_dump_fp(stderr, (char *)s->session->master_key, | |
531 | SSL3_MASTER_SECRET_SIZE); | |
a2f9200f | 532 | #endif |
761772d7 | 533 | |
8c1a5343 MC |
534 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
535 | return 1; | |
0f113f3e | 536 | } |
58964a49 | 537 | |
74b4b494 | 538 | int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, |
0f113f3e MC |
539 | const char *label, size_t llen, |
540 | const unsigned char *context, | |
541 | size_t contextlen, int use_context) | |
542 | { | |
0f113f3e | 543 | unsigned char *val = NULL; |
1c8a527c | 544 | size_t vallen = 0, currentvalpos; |
0f113f3e | 545 | int rv; |
e0af0405 | 546 | |
0f113f3e MC |
547 | /* |
548 | * construct PRF arguments we construct the PRF argument ourself rather | |
549 | * than passing separate values into the TLS PRF to ensure that the | |
550 | * concatenation of values does not create a prohibited label. | |
551 | */ | |
552 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
553 | if (use_context) { | |
554 | vallen += 2 + contextlen; | |
555 | } | |
556 | ||
557 | val = OPENSSL_malloc(vallen); | |
558 | if (val == NULL) | |
559 | goto err2; | |
560 | currentvalpos = 0; | |
561 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
562 | currentvalpos += llen; | |
563 | memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE); | |
564 | currentvalpos += SSL3_RANDOM_SIZE; | |
565 | memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE); | |
566 | currentvalpos += SSL3_RANDOM_SIZE; | |
567 | ||
568 | if (use_context) { | |
569 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
570 | currentvalpos++; | |
571 | val[currentvalpos] = contextlen & 0xff; | |
572 | currentvalpos++; | |
573 | if ((contextlen > 0) || (context != NULL)) { | |
574 | memcpy(val + currentvalpos, context, contextlen); | |
575 | } | |
576 | } | |
577 | ||
578 | /* | |
579 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
580 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
581 | * the comparisons won't have buffer overflow | |
582 | */ | |
583 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
584 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
585 | goto err1; | |
586 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
587 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
588 | goto err1; | |
589 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
590 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
591 | goto err1; | |
0cfb0e75 DSH |
592 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
593 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
594 | goto err1; | |
0f113f3e MC |
595 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
596 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
597 | goto err1; | |
598 | ||
28ba2541 | 599 | rv = tls1_PRF(s, |
0f113f3e MC |
600 | val, vallen, |
601 | NULL, 0, | |
602 | NULL, 0, | |
603 | NULL, 0, | |
604 | NULL, 0, | |
605 | s->session->master_key, s->session->master_key_length, | |
d4d2f3a4 | 606 | out, olen, 0); |
e0af0405 | 607 | |
0f113f3e MC |
608 | goto ret; |
609 | err1: | |
a230b26e | 610 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
0f113f3e MC |
611 | rv = 0; |
612 | goto ret; | |
613 | err2: | |
614 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); | |
615 | rv = 0; | |
616 | ret: | |
05c7b163 | 617 | OPENSSL_clear_free(val, vallen); |
26a7d938 | 618 | return rv; |
0f113f3e | 619 | } |
e0af0405 | 620 | |
6b691a5c | 621 | int tls1_alert_code(int code) |
0f113f3e MC |
622 | { |
623 | switch (code) { | |
624 | case SSL_AD_CLOSE_NOTIFY: | |
26a7d938 | 625 | return SSL3_AD_CLOSE_NOTIFY; |
0f113f3e | 626 | case SSL_AD_UNEXPECTED_MESSAGE: |
26a7d938 | 627 | return SSL3_AD_UNEXPECTED_MESSAGE; |
0f113f3e | 628 | case SSL_AD_BAD_RECORD_MAC: |
26a7d938 | 629 | return SSL3_AD_BAD_RECORD_MAC; |
0f113f3e | 630 | case SSL_AD_DECRYPTION_FAILED: |
26a7d938 | 631 | return TLS1_AD_DECRYPTION_FAILED; |
0f113f3e | 632 | case SSL_AD_RECORD_OVERFLOW: |
26a7d938 | 633 | return TLS1_AD_RECORD_OVERFLOW; |
0f113f3e | 634 | case SSL_AD_DECOMPRESSION_FAILURE: |
26a7d938 | 635 | return SSL3_AD_DECOMPRESSION_FAILURE; |
0f113f3e | 636 | case SSL_AD_HANDSHAKE_FAILURE: |
26a7d938 | 637 | return SSL3_AD_HANDSHAKE_FAILURE; |
0f113f3e | 638 | case SSL_AD_NO_CERTIFICATE: |
26a7d938 | 639 | return -1; |
0f113f3e | 640 | case SSL_AD_BAD_CERTIFICATE: |
26a7d938 | 641 | return SSL3_AD_BAD_CERTIFICATE; |
0f113f3e | 642 | case SSL_AD_UNSUPPORTED_CERTIFICATE: |
26a7d938 | 643 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; |
0f113f3e | 644 | case SSL_AD_CERTIFICATE_REVOKED: |
26a7d938 | 645 | return SSL3_AD_CERTIFICATE_REVOKED; |
0f113f3e | 646 | case SSL_AD_CERTIFICATE_EXPIRED: |
26a7d938 | 647 | return SSL3_AD_CERTIFICATE_EXPIRED; |
0f113f3e | 648 | case SSL_AD_CERTIFICATE_UNKNOWN: |
26a7d938 | 649 | return SSL3_AD_CERTIFICATE_UNKNOWN; |
0f113f3e | 650 | case SSL_AD_ILLEGAL_PARAMETER: |
26a7d938 | 651 | return SSL3_AD_ILLEGAL_PARAMETER; |
0f113f3e | 652 | case SSL_AD_UNKNOWN_CA: |
26a7d938 | 653 | return TLS1_AD_UNKNOWN_CA; |
0f113f3e | 654 | case SSL_AD_ACCESS_DENIED: |
26a7d938 | 655 | return TLS1_AD_ACCESS_DENIED; |
0f113f3e | 656 | case SSL_AD_DECODE_ERROR: |
26a7d938 | 657 | return TLS1_AD_DECODE_ERROR; |
0f113f3e | 658 | case SSL_AD_DECRYPT_ERROR: |
26a7d938 | 659 | return TLS1_AD_DECRYPT_ERROR; |
0f113f3e | 660 | case SSL_AD_EXPORT_RESTRICTION: |
26a7d938 | 661 | return TLS1_AD_EXPORT_RESTRICTION; |
0f113f3e | 662 | case SSL_AD_PROTOCOL_VERSION: |
26a7d938 | 663 | return TLS1_AD_PROTOCOL_VERSION; |
0f113f3e | 664 | case SSL_AD_INSUFFICIENT_SECURITY: |
26a7d938 | 665 | return TLS1_AD_INSUFFICIENT_SECURITY; |
0f113f3e | 666 | case SSL_AD_INTERNAL_ERROR: |
26a7d938 | 667 | return TLS1_AD_INTERNAL_ERROR; |
0f113f3e | 668 | case SSL_AD_USER_CANCELLED: |
26a7d938 | 669 | return TLS1_AD_USER_CANCELLED; |
0f113f3e | 670 | case SSL_AD_NO_RENEGOTIATION: |
26a7d938 | 671 | return TLS1_AD_NO_RENEGOTIATION; |
0f113f3e | 672 | case SSL_AD_UNSUPPORTED_EXTENSION: |
26a7d938 | 673 | return TLS1_AD_UNSUPPORTED_EXTENSION; |
0f113f3e | 674 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: |
26a7d938 | 675 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; |
0f113f3e | 676 | case SSL_AD_UNRECOGNIZED_NAME: |
26a7d938 | 677 | return TLS1_AD_UNRECOGNIZED_NAME; |
0f113f3e | 678 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: |
26a7d938 | 679 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; |
0f113f3e | 680 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: |
26a7d938 | 681 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; |
0f113f3e | 682 | case SSL_AD_UNKNOWN_PSK_IDENTITY: |
26a7d938 | 683 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; |
0f113f3e | 684 | case SSL_AD_INAPPROPRIATE_FALLBACK: |
26a7d938 | 685 | return TLS1_AD_INAPPROPRIATE_FALLBACK; |
06217867 | 686 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
26a7d938 | 687 | return TLS1_AD_NO_APPLICATION_PROTOCOL; |
42c28b63 MC |
688 | case SSL_AD_CERTIFICATE_REQUIRED: |
689 | return SSL_AD_HANDSHAKE_FAILURE; | |
0f113f3e | 690 | default: |
26a7d938 | 691 | return -1; |
0f113f3e MC |
692 | } |
693 | } |