]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/t1_lib.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
SSL object refactoring using SSL_CONNECTION object
[thirdparty/openssl.git] / ssl / t1_lib.c
CommitLineData
846e33c7 1/*
fecb3aae 2 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
f1fd4544 3 *
2c18d164 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
846e33c7
RS		 5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
f1fd4544 8 */
58964a49
RE		 9
10#include <stdio.h>
aa474d1f 11#include <stdlib.h>
ec577822 12#include <openssl/objects.h>
6434abbf
DSH		 13#include <openssl/evp.h>
14#include <openssl/hmac.h>
a76ce286 15#include <openssl/core_names.h>
67c8e7f4 16#include <openssl/ocsp.h>
5951e840
MC		 17#include <openssl/conf.h>
18#include <openssl/x509v3.h>
3c27208f
RS		 19#include <openssl/dh.h>
20#include <openssl/bn.h>
9d2d857f 21#include <openssl/provider.h>
091f6074 22#include <openssl/param_build.h>
677963e5 23#include "internal/nelem.h"
d8975dec 24#include "internal/sizes.h"
48e971dd 25#include "internal/tlsgroups.h"
706457b7 26#include "ssl_local.h"
3c27208f 27#include <openssl/ct.h>
58964a49 28
38b051a1
TM		 29static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pkey);
30static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, const SIGALG_LOOKUP *lu);
5235ef44 31
0f113f3e
MC		 32SSL3_ENC_METHOD const TLSv1_enc_data = {
33 tls1_enc,
34 tls1_mac,
35 tls1_setup_key_block,
36 tls1_generate_master_secret,
37 tls1_change_cipher_state,
38 tls1_final_finish_mac,
0f113f3e
MC		 39 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
40 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
41 tls1_alert_code,
42 tls1_export_keying_material,
43 0,
a29fa98c 44 ssl3_set_handshake_header,
2c7b4dbc 45 tls_close_construct_packet,
0f113f3e
MC		 46 ssl3_handshake_write
47};
48
49SSL3_ENC_METHOD const TLSv1_1_enc_data = {
50 tls1_enc,
51 tls1_mac,
52 tls1_setup_key_block,
53 tls1_generate_master_secret,
54 tls1_change_cipher_state,
55 tls1_final_finish_mac,
0f113f3e
MC		 56 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
57 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
58 tls1_alert_code,
59 tls1_export_keying_material,
60 SSL_ENC_FLAG_EXPLICIT_IV,
a29fa98c 61 ssl3_set_handshake_header,
2c7b4dbc 62 tls_close_construct_packet,
0f113f3e
MC		 63 ssl3_handshake_write
64};
65
66SSL3_ENC_METHOD const TLSv1_2_enc_data = {
67 tls1_enc,
68 tls1_mac,
69 tls1_setup_key_block,
70 tls1_generate_master_secret,
71 tls1_change_cipher_state,
72 tls1_final_finish_mac,
0f113f3e
MC		 73 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
74 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
75 tls1_alert_code,
76 tls1_export_keying_material,
77 SSL_ENC_FLAG_EXPLICIT_IV | SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF
78 | SSL_ENC_FLAG_TLS1_2_CIPHERS,
a29fa98c 79 ssl3_set_handshake_header,
2c7b4dbc 80 tls_close_construct_packet,
0f113f3e
MC		 81 ssl3_handshake_write
82};
58964a49 83
582a17d6 84SSL3_ENC_METHOD const TLSv1_3_enc_data = {
bebc0c7d 85 tls13_enc,
582a17d6 86 tls1_mac,
92760c21
MC		 87 tls13_setup_key_block,
88 tls13_generate_master_secret,
89 tls13_change_cipher_state,
90 tls13_final_finish_mac,
582a17d6
MC		 91 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
92 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
04904312 93 tls13_alert_code,
0ca8d1ec 94 tls13_export_keying_material,
bebc0c7d 95 SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF,
582a17d6
MC		 96 ssl3_set_handshake_header,
97 tls_close_construct_packet,
98 ssl3_handshake_write
99};
100
f3b656b2 101long tls1_default_timeout(void)
0f113f3e
MC		 102{
103 /*
104 * 2 hours, the 24 hours mentioned in the TLSv1 spec is way too long for
105 * http, the cache would over fill
106 */
107 return (60 * 60 * 2);
108}
58964a49 109
6b691a5c 110int tls1_new(SSL *s)
0f113f3e
MC		 111{
112 if (!ssl3_new(s))
b77f3ed1
MC		 113 return 0;
114 if (!s->method->ssl_clear(s))
115 return 0;
116
117 return 1;
0f113f3e 118}
58964a49 119
6b691a5c 120void tls1_free(SSL *s)
0f113f3e 121{
38b051a1
TM		 122 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
123
124 if (sc == NULL)
125 return;
126
127 OPENSSL_free(sc->ext.session_ticket);
0f113f3e
MC		 128 ssl3_free(s);
129}
58964a49 130
b77f3ed1 131int tls1_clear(SSL *s)
0f113f3e 132{
38b051a1
TM		 133 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
134
135 if (sc == NULL)
136 return 0;
137
b77f3ed1
MC		 138 if (!ssl3_clear(s))
139 return 0;
140
4fa52141 141 if (s->method->version == TLS_ANY_VERSION)
38b051a1 142 sc->version = TLS_MAX_VERSION_INTERNAL;
4fa52141 143 else
38b051a1 144 sc->version = s->method->version;
b77f3ed1
MC		 145
146 return 1;
0f113f3e 147}
58964a49 148
9d2d857f
MC		 149/* Legacy NID to group_id mapping. Only works for groups we know about */
150static struct {
151 int nid;
152 uint16_t group_id;
153} nid_to_group[] = {
48e971dd
MC		 154 {NID_sect163k1, OSSL_TLS_GROUP_ID_sect163k1},
155 {NID_sect163r1, OSSL_TLS_GROUP_ID_sect163r1},
156 {NID_sect163r2, OSSL_TLS_GROUP_ID_sect163r2},
157 {NID_sect193r1, OSSL_TLS_GROUP_ID_sect193r1},
158 {NID_sect193r2, OSSL_TLS_GROUP_ID_sect193r2},
159 {NID_sect233k1, OSSL_TLS_GROUP_ID_sect233k1},
160 {NID_sect233r1, OSSL_TLS_GROUP_ID_sect233r1},
161 {NID_sect239k1, OSSL_TLS_GROUP_ID_sect239k1},
162 {NID_sect283k1, OSSL_TLS_GROUP_ID_sect283k1},
163 {NID_sect283r1, OSSL_TLS_GROUP_ID_sect283r1},
164 {NID_sect409k1, OSSL_TLS_GROUP_ID_sect409k1},
165 {NID_sect409r1, OSSL_TLS_GROUP_ID_sect409r1},
166 {NID_sect571k1, OSSL_TLS_GROUP_ID_sect571k1},
167 {NID_sect571r1, OSSL_TLS_GROUP_ID_sect571r1},
168 {NID_secp160k1, OSSL_TLS_GROUP_ID_secp160k1},
169 {NID_secp160r1, OSSL_TLS_GROUP_ID_secp160r1},
170 {NID_secp160r2, OSSL_TLS_GROUP_ID_secp160r2},
171 {NID_secp192k1, OSSL_TLS_GROUP_ID_secp192k1},
172 {NID_X9_62_prime192v1, OSSL_TLS_GROUP_ID_secp192r1},
173 {NID_secp224k1, OSSL_TLS_GROUP_ID_secp224k1},
174 {NID_secp224r1, OSSL_TLS_GROUP_ID_secp224r1},
175 {NID_secp256k1, OSSL_TLS_GROUP_ID_secp256k1},
176 {NID_X9_62_prime256v1, OSSL_TLS_GROUP_ID_secp256r1},
177 {NID_secp384r1, OSSL_TLS_GROUP_ID_secp384r1},
178 {NID_secp521r1, OSSL_TLS_GROUP_ID_secp521r1},
179 {NID_brainpoolP256r1, OSSL_TLS_GROUP_ID_brainpoolP256r1},
180 {NID_brainpoolP384r1, OSSL_TLS_GROUP_ID_brainpoolP384r1},
181 {NID_brainpoolP512r1, OSSL_TLS_GROUP_ID_brainpoolP512r1},
182 {EVP_PKEY_X25519, OSSL_TLS_GROUP_ID_x25519},
183 {EVP_PKEY_X448, OSSL_TLS_GROUP_ID_x448},
0a10825a
BE		 184 {NID_id_tc26_gost_3410_2012_256_paramSetA, OSSL_TLS_GROUP_ID_gc256A},
185 {NID_id_tc26_gost_3410_2012_256_paramSetB, OSSL_TLS_GROUP_ID_gc256B},
186 {NID_id_tc26_gost_3410_2012_256_paramSetC, OSSL_TLS_GROUP_ID_gc256C},
187 {NID_id_tc26_gost_3410_2012_256_paramSetD, OSSL_TLS_GROUP_ID_gc256D},
188 {NID_id_tc26_gost_3410_2012_512_paramSetA, OSSL_TLS_GROUP_ID_gc512A},
189 {NID_id_tc26_gost_3410_2012_512_paramSetB, OSSL_TLS_GROUP_ID_gc512B},
190 {NID_id_tc26_gost_3410_2012_512_paramSetC, OSSL_TLS_GROUP_ID_gc512C},
48e971dd
MC		 191 {NID_ffdhe2048, OSSL_TLS_GROUP_ID_ffdhe2048},
192 {NID_ffdhe3072, OSSL_TLS_GROUP_ID_ffdhe3072},
193 {NID_ffdhe4096, OSSL_TLS_GROUP_ID_ffdhe4096},
194 {NID_ffdhe6144, OSSL_TLS_GROUP_ID_ffdhe6144},
195 {NID_ffdhe8192, OSSL_TLS_GROUP_ID_ffdhe8192}
0f113f3e
MC		 196};
197
198static const unsigned char ecformats_default[] = {
199 TLSEXT_ECPOINTFORMAT_uncompressed,
200 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
201 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
202};
203
fe6ef247 204/* The default curves */
9aaecbfc 205static const uint16_t supported_groups_default[] = {
0a10825a
BE		 206 OSSL_TLS_GROUP_ID_x25519, /* X25519 (29) */
207 OSSL_TLS_GROUP_ID_secp256r1, /* secp256r1 (23) */
208 OSSL_TLS_GROUP_ID_x448, /* X448 (30) */
209 OSSL_TLS_GROUP_ID_secp521r1, /* secp521r1 (25) */
210 OSSL_TLS_GROUP_ID_secp384r1, /* secp384r1 (24) */
211 OSSL_TLS_GROUP_ID_gc256A, /* GC256A (34) */
212 OSSL_TLS_GROUP_ID_gc256B, /* GC256B (35) */
213 OSSL_TLS_GROUP_ID_gc256C, /* GC256C (36) */
214 OSSL_TLS_GROUP_ID_gc256D, /* GC256D (37) */
215 OSSL_TLS_GROUP_ID_gc512A, /* GC512A (38) */
216 OSSL_TLS_GROUP_ID_gc512B, /* GC512B (39) */
217 OSSL_TLS_GROUP_ID_gc512C, /* GC512C (40) */
218 OSSL_TLS_GROUP_ID_ffdhe2048, /* ffdhe2048 (0x100) */
219 OSSL_TLS_GROUP_ID_ffdhe3072, /* ffdhe3072 (0x101) */
220 OSSL_TLS_GROUP_ID_ffdhe4096, /* ffdhe4096 (0x102) */
221 OSSL_TLS_GROUP_ID_ffdhe6144, /* ffdhe6144 (0x103) */
222 OSSL_TLS_GROUP_ID_ffdhe8192, /* ffdhe8192 (0x104) */
de57d237
EK		 223};
224
9e84a42d 225static const uint16_t suiteb_curves[] = {
0a10825a
BE		 226 OSSL_TLS_GROUP_ID_secp256r1,
227 OSSL_TLS_GROUP_ID_secp384r1,
0f113f3e 228};
2ea80354 229
9d2d857f
MC		 230struct provider_group_data_st {
231 SSL_CTX *ctx;
232 OSSL_PROVIDER *provider;
233};
234
235#define TLS_GROUP_LIST_MALLOC_BLOCK_SIZE 10
236static OSSL_CALLBACK add_provider_groups;
237static int add_provider_groups(const OSSL_PARAM params[], void *data)
238{
239 struct provider_group_data_st *pgd = data;
240 SSL_CTX *ctx = pgd->ctx;
241 OSSL_PROVIDER *provider = pgd->provider;
242 const OSSL_PARAM *p;
243 TLS_GROUP_INFO *ginf = NULL;
244 EVP_KEYMGMT *keymgmt;
245 unsigned int gid;
c1a74f59 246 unsigned int is_kem = 0;
9d2d857f
MC		 247 int ret = 0;
248
249 if (ctx->group_list_max_len == ctx->group_list_len) {
250 TLS_GROUP_INFO *tmp = NULL;
251
252 if (ctx->group_list_max_len == 0)
253 tmp = OPENSSL_malloc(sizeof(TLS_GROUP_INFO)
254 * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE);
255 else
256 tmp = OPENSSL_realloc(ctx->group_list,
257 (ctx->group_list_max_len
258 + TLS_GROUP_LIST_MALLOC_BLOCK_SIZE)
259 * sizeof(TLS_GROUP_INFO));
260 if (tmp == NULL) {
6849b73c 261 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
9d2d857f
MC		 262 return 0;
263 }
264 ctx->group_list = tmp;
265 memset(tmp + ctx->group_list_max_len,
266 0,
267 sizeof(TLS_GROUP_INFO) * TLS_GROUP_LIST_MALLOC_BLOCK_SIZE);
268 ctx->group_list_max_len += TLS_GROUP_LIST_MALLOC_BLOCK_SIZE;
269 }
270
271 ginf = &ctx->group_list[ctx->group_list_len];
272
273 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME);
274 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
6849b73c 275 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 276 goto err;
277 }
278 ginf->tlsname = OPENSSL_strdup(p->data);
279 if (ginf->tlsname == NULL) {
6849b73c 280 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
9d2d857f
MC		 281 goto err;
282 }
283
284 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_NAME_INTERNAL);
285 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
6849b73c 286 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 287 goto err;
288 }
289 ginf->realname = OPENSSL_strdup(p->data);
290 if (ginf->realname == NULL) {
6849b73c 291 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
9d2d857f
MC		 292 goto err;
293 }
294
295 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ID);
296 if (p == NULL || !OSSL_PARAM_get_uint(p, &gid) || gid > UINT16_MAX) {
6849b73c 297 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 298 goto err;
299 }
300 ginf->group_id = (uint16_t)gid;
301
302 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_ALG);
303 if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING) {
6849b73c 304 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 305 goto err;
306 }
307 ginf->algorithm = OPENSSL_strdup(p->data);
308 if (ginf->algorithm == NULL) {
6849b73c 309 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
9d2d857f
MC		 310 goto err;
311 }
312
313 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_SECURITY_BITS);
314 if (p == NULL || !OSSL_PARAM_get_uint(p, &ginf->secbits)) {
6849b73c 315 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 316 goto err;
317 }
318
c1a74f59
NT		 319 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_IS_KEM);
320 if (p != NULL && (!OSSL_PARAM_get_uint(p, &is_kem) || is_kem > 1)) {
6849b73c 321 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
c1a74f59
NT		 322 goto err;
323 }
324 ginf->is_kem = 1 & is_kem;
325
9d2d857f
MC		 326 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_TLS);
327 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mintls)) {
6849b73c 328 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 329 goto err;
330 }
331
332 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_TLS);
333 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxtls)) {
6849b73c 334 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
90a74d8c 335 goto err;
9d2d857f
MC		 336 }
337
338 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MIN_DTLS);
339 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->mindtls)) {
6849b73c 340 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 341 goto err;
342 }
343
344 p = OSSL_PARAM_locate_const(params, OSSL_CAPABILITY_TLS_GROUP_MAX_DTLS);
345 if (p == NULL || !OSSL_PARAM_get_int(p, &ginf->maxdtls)) {
6849b73c 346 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
9d2d857f
MC		 347 goto err;
348 }
349 /*
350 * Now check that the algorithm is actually usable for our property query
351 * string. Regardless of the result we still return success because we have
352 * successfully processed this group, even though we may decide not to use
353 * it.
354 */
355 ret = 1;
ce8822b7 356 ERR_set_mark();
9d2d857f
MC		 357 keymgmt = EVP_KEYMGMT_fetch(ctx->libctx, ginf->algorithm, ctx->propq);
358 if (keymgmt != NULL) {
359 /*
360 * We have successfully fetched the algorithm - however if the provider
361 * doesn't match this one then we ignore it.
362 *
363 * Note: We're cheating a little here. Technically if the same algorithm
364 * is available from more than one provider then it is undefined which
365 * implementation you will get back. Theoretically this could be
366 * different every time...we assume here that you'll always get the
367 * same one back if you repeat the exact same fetch. Is this a reasonable
368 * assumption to make (in which case perhaps we should document this
369 * behaviour)?
370 */
ed576acd 371 if (EVP_KEYMGMT_get0_provider(keymgmt) == provider) {
9d2d857f
MC		 372 /* We have a match - so we will use this group */
373 ctx->group_list_len++;
374 ginf = NULL;
375 }
376 EVP_KEYMGMT_free(keymgmt);
377 }
ce8822b7 378 ERR_pop_to_mark();
9d2d857f
MC		 379 err:
380 if (ginf != NULL) {
381 OPENSSL_free(ginf->tlsname);
382 OPENSSL_free(ginf->realname);
383 OPENSSL_free(ginf->algorithm);
a7863f99 384 ginf->algorithm = ginf->tlsname = ginf->realname = NULL;
9d2d857f
MC		 385 }
386 return ret;
387}
388
389static int discover_provider_groups(OSSL_PROVIDER *provider, void *vctx)
390{
391 struct provider_group_data_st pgd;
392
393 pgd.ctx = vctx;
394 pgd.provider = provider;
395 return OSSL_PROVIDER_get_capabilities(provider, "TLS-GROUP",
396 add_provider_groups, &pgd);
397}
398
399int ssl_load_groups(SSL_CTX *ctx)
400{
ddf8f1ce 401 size_t i, j, num_deflt_grps = 0;
8b1db5d3 402 uint16_t tmp_supp_groups[OSSL_NELEM(supported_groups_default)];
ddf8f1ce
MC		 403
404 if (!OSSL_PROVIDER_do_all(ctx->libctx, discover_provider_groups, ctx))
405 return 0;
406
8b1db5d3 407 for (i = 0; i < OSSL_NELEM(supported_groups_default); i++) {
ddf8f1ce 408 for (j = 0; j < ctx->group_list_len; j++) {
8b1db5d3 409 if (ctx->group_list[j].group_id == supported_groups_default[i]) {
ddf8f1ce 410 tmp_supp_groups[num_deflt_grps++] = ctx->group_list[j].group_id;
8b1db5d3
MC		 411 break;
412 }
ddf8f1ce
MC		 413 }
414 }
415
416 if (num_deflt_grps == 0)
417 return 1;
418
419 ctx->ext.supported_groups_default
420 = OPENSSL_malloc(sizeof(uint16_t) * num_deflt_grps);
421
422 if (ctx->ext.supported_groups_default == NULL) {
423 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
424 return 0;
425 }
426
8b1db5d3
MC		 427 memcpy(ctx->ext.supported_groups_default,
428 tmp_supp_groups,
429 num_deflt_grps * sizeof(tmp_supp_groups[0]));
ddf8f1ce
MC		 430 ctx->ext.supported_groups_default_len = num_deflt_grps;
431
432 return 1;
9d2d857f
MC		 433}
434
260009d8
MC		 435static uint16_t tls1_group_name2id(SSL_CTX *ctx, const char *name)
436{
437 size_t i;
260009d8
MC		 438
439 for (i = 0; i < ctx->group_list_len; i++) {
440 if (strcmp(ctx->group_list[i].tlsname, name) == 0
306b8e7e 441 || strcmp(ctx->group_list[i].realname, name) == 0)
260009d8
MC		 442 return ctx->group_list[i].group_id;
443 }
444
445 return 0;
446}
447
0a10825a
BE		 448uint16_t ssl_group_id_internal_to_tls13(uint16_t curve_id)
449{
450 switch(curve_id) {
451 case OSSL_TLS_GROUP_ID_brainpoolP256r1:
452 return OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13;
453 case OSSL_TLS_GROUP_ID_brainpoolP384r1:
454 return OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13;
455 case OSSL_TLS_GROUP_ID_brainpoolP512r1:
456 return OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13;
457 case OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13:
458 case OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13:
459 case OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13:
460 return 0;
461 default:
462 return curve_id;
463 }
464}
465
466uint16_t ssl_group_id_tls13_to_internal(uint16_t curve_id)
467{
468 switch(curve_id) {
469 case OSSL_TLS_GROUP_ID_brainpoolP256r1:
470 case OSSL_TLS_GROUP_ID_brainpoolP384r1:
471 case OSSL_TLS_GROUP_ID_brainpoolP512r1:
472 return 0;
473 case OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13:
474 return OSSL_TLS_GROUP_ID_brainpoolP256r1;
475 case OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13:
476 return OSSL_TLS_GROUP_ID_brainpoolP384r1;
477 case OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13:
478 return OSSL_TLS_GROUP_ID_brainpoolP512r1;
479 default:
480 return curve_id;
481 }
482}
483
9d2d857f 484const TLS_GROUP_INFO *tls1_group_id_lookup(SSL_CTX *ctx, uint16_t group_id)
0f113f3e 485{
9aaecbfc 486 size_t i;
487
9d2d857f
MC		 488 for (i = 0; i < ctx->group_list_len; i++) {
489 if (ctx->group_list[i].group_id == group_id)
490 return &ctx->group_list[i];
9aaecbfc 491 }
9d2d857f 492
9aaecbfc 493 return NULL;
0f113f3e 494}
525de5d3 495
260009d8 496int tls1_group_id2nid(uint16_t group_id, int include_unknown)
84d4b9e3 497{
9d2d857f 498 size_t i;
84d4b9e3 499
260009d8
MC		 500 if (group_id == 0)
501 return NID_undef;
502
9d2d857f
MC		 503 /*
504 * Return well known Group NIDs - for backwards compatibility. This won't
505 * work for groups we don't know about.
506 */
507 for (i = 0; i < OSSL_NELEM(nid_to_group); i++)
508 {
509 if (nid_to_group[i].group_id == group_id)
510 return nid_to_group[i].nid;
511 }
260009d8
MC		 512 if (!include_unknown)
513 return NID_undef;
514 return TLSEXT_nid_unknown | (int)group_id;
84d4b9e3 515}
516
becbacd7 517uint16_t tls1_nid2group_id(int nid)
0f113f3e 518{
2fa2d15a 519 size_t i;
9aaecbfc 520
9d2d857f
MC		 521 /*
522 * Return well known Group ids - for backwards compatibility. This won't
523 * work for groups we don't know about.
524 */
525 for (i = 0; i < OSSL_NELEM(nid_to_group); i++)
526 {
527 if (nid_to_group[i].nid == nid)
528 return nid_to_group[i].group_id;
0f113f3e 529 }
9d2d857f 530
2fa2d15a 531 return 0;
0f113f3e
MC		 532}
533
740580c2 534/*
ff6d20a6
DSH		 535 * Set *pgroups to the supported groups list and *pgroupslen to
536 * the number of groups supported.
fd2b65ce 537 */
38b051a1 538void tls1_get_supported_groups(SSL_CONNECTION *s, const uint16_t **pgroups,
ff6d20a6 539 size_t *pgroupslen)
0f113f3e 540{
38b051a1
TM		 541 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
542
34e5292c
DSH		 543 /* For Suite B mode only include P-256, P-384 */
544 switch (tls1_suiteb(s)) {
545 case SSL_CERT_FLAG_SUITEB_128_LOS:
ff6d20a6
DSH		 546 *pgroups = suiteb_curves;
547 *pgroupslen = OSSL_NELEM(suiteb_curves);
34e5292c
DSH		 548 break;
549
550 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
ff6d20a6
DSH		 551 *pgroups = suiteb_curves;
552 *pgroupslen = 1;
34e5292c
DSH		 553 break;
554
555 case SSL_CERT_FLAG_SUITEB_192_LOS:
ff6d20a6
DSH		 556 *pgroups = suiteb_curves + 1;
557 *pgroupslen = 1;
34e5292c
DSH		 558 break;
559
560 default:
561 if (s->ext.supportedgroups == NULL) {
38b051a1
TM		 562 *pgroups = sctx->ext.supported_groups_default;
563 *pgroupslen = sctx->ext.supported_groups_default_len;
34e5292c 564 } else {
ff6d20a6
DSH		 565 *pgroups = s->ext.supportedgroups;
566 *pgroupslen = s->ext.supportedgroups_len;
0f113f3e 567 }
34e5292c 568 break;
0f113f3e 569 }
0f113f3e 570}
b362ccab 571
38b051a1
TM		 572int tls_valid_group(SSL_CONNECTION *s, uint16_t group_id,
573 int minversion, int maxversion,
8b1db5d3 574 int isec, int *okfortls13)
9aaecbfc 575{
38b051a1
TM		 576 const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
577 group_id);
9d2d857f 578 int ret;
9aaecbfc 579
8b1db5d3 580 if (okfortls13 != NULL)
89e14ca7 581 *okfortls13 = 0;
8b1db5d3 582
9d2d857f
MC		 583 if (ginfo == NULL)
584 return 0;
585
38b051a1 586 if (SSL_CONNECTION_IS_DTLS(s)) {
9d2d857f 587 if (ginfo->mindtls < 0 || ginfo->maxdtls < 0)
9aaecbfc 588 return 0;
9d2d857f
MC		 589 if (ginfo->maxdtls == 0)
590 ret = 1;
591 else
592 ret = DTLS_VERSION_LE(minversion, ginfo->maxdtls);
593 if (ginfo->mindtls > 0)
594 ret &= DTLS_VERSION_GE(maxversion, ginfo->mindtls);
595 } else {
596 if (ginfo->mintls < 0 || ginfo->maxtls < 0)
597 return 0;
598 if (ginfo->maxtls == 0)
599 ret = 1;
600 else
601 ret = (minversion <= ginfo->maxtls);
602 if (ginfo->mintls > 0)
603 ret &= (maxversion >= ginfo->mintls);
8b1db5d3
MC		 604 if (ret && okfortls13 != NULL && maxversion == TLS1_3_VERSION)
605 *okfortls13 = (ginfo->maxtls == 0)
606 || (ginfo->maxtls >= TLS1_3_VERSION);
9aaecbfc 607 }
8b1db5d3
MC		 608 ret &= !isec
609 || strcmp(ginfo->algorithm, "EC") == 0
610 || strcmp(ginfo->algorithm, "X25519") == 0
611 || strcmp(ginfo->algorithm, "X448") == 0;
9d2d857f
MC		 612
613 return ret;
9aaecbfc 614}
615
dbc6268f 616/* See if group is allowed by security callback */
38b051a1 617int tls_group_allowed(SSL_CONNECTION *s, uint16_t group, int op)
0f113f3e 618{
38b051a1
TM		 619 const TLS_GROUP_INFO *ginfo = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
620 group);
dbc6268f 621 unsigned char gtmp[2];
5ce5f787 622
dbc6268f 623 if (ginfo == NULL)
0f113f3e 624 return 0;
9d2d857f 625
dbc6268f
MC		 626 gtmp[0] = group >> 8;
627 gtmp[1] = group & 0xff;
9d2d857f 628 return ssl_security(s, op, ginfo->secbits,
260009d8 629 tls1_group_id2nid(ginfo->group_id, 0), (void *)gtmp);
0f113f3e 630}
b362ccab 631
b50951d3
DSH		 632/* Return 1 if "id" is in "list" */
633static int tls1_in_list(uint16_t id, const uint16_t *list, size_t listlen)
634{
635 size_t i;
636 for (i = 0; i < listlen; i++)
637 if (list[i] == id)
638 return 1;
639 return 0;
640}
641
1d97c843 642/*-
8841154a 643 * For nmatch >= 0, return the id of the |nmatch|th shared group or 0
6977e8ee
KR		 644 * if there is no match.
645 * For nmatch == -1, return number of matches
8841154a 646 * For nmatch == -2, return the id of the group to use for
b50951d3 647 * a tmp key, or 0 if there is no match.
d0595f17 648 */
38b051a1 649uint16_t tls1_shared_group(SSL_CONNECTION *s, int nmatch)
0f113f3e 650{
9e84a42d 651 const uint16_t *pref, *supp;
b50951d3 652 size_t num_pref, num_supp, i;
0f113f3e 653 int k;
3e373518 654
0f113f3e
MC		 655 /* Can't do anything on client side */
656 if (s->server == 0)
8841154a 657 return 0;
0f113f3e
MC		 658 if (nmatch == -2) {
659 if (tls1_suiteb(s)) {
660 /*
661 * For Suite B ciphersuite determines curve: we already know
662 * these are acceptable due to previous checks.
663 */
555cbb32 664 unsigned long cid = s->s3.tmp.new_cipher->id;
3e373518 665
0f113f3e 666 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
0a10825a 667 return OSSL_TLS_GROUP_ID_secp256r1;
0f113f3e 668 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
0a10825a 669 return OSSL_TLS_GROUP_ID_secp384r1;
0f113f3e 670 /* Should never happen */
8841154a 671 return 0;
0f113f3e
MC		 672 }
673 /* If not Suite B just return first preference shared curve */
674 nmatch = 0;
675 }
676 /*
ff6d20a6
DSH		 677 * If server preference set, our groups are the preference order
678 * otherwise peer decides.
0f113f3e 679 */
ff6d20a6
DSH		 680 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
681 tls1_get_supported_groups(s, &pref, &num_pref);
682 tls1_get_peer_groups(s, &supp, &num_supp);
683 } else {
684 tls1_get_peer_groups(s, &pref, &num_pref);
685 tls1_get_supported_groups(s, &supp, &num_supp);
686 }
3c06513f 687
9e84a42d
DSH		 688 for (k = 0, i = 0; i < num_pref; i++) {
689 uint16_t id = pref[i];
0a10825a 690 uint16_t cid = id;
3e373518 691
38b051a1 692 if (SSL_CONNECTION_IS_TLS13(s)) {
0a10825a
BE		 693 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
694 cid = ssl_group_id_internal_to_tls13(id);
695 else
696 cid = id = ssl_group_id_tls13_to_internal(id);
697 }
698 if (!tls1_in_list(cid, supp, num_supp)
699 || !tls_group_allowed(s, id, SSL_SECOP_CURVE_SHARED))
700 continue;
b50951d3
DSH		 701 if (nmatch == k)
702 return id;
703 k++;
0f113f3e
MC		 704 }
705 if (nmatch == -1)
706 return k;
707 /* Out of range (nmatch > k). */
8841154a 708 return 0;
0f113f3e 709}
d0595f17 710
9e84a42d 711int tls1_set_groups(uint16_t **pext, size_t *pextlen,
de4d764e 712 int *groups, size_t ngroups)
0f113f3e 713{
9e84a42d 714 uint16_t *glist;
0f113f3e
MC		 715 size_t i;
716 /*
9aaecbfc 717 * Bitmap of groups included to detect duplicates: two variables are added
718 * to detect duplicates as some values are more than 32.
0f113f3e 719 */
9aaecbfc 720 unsigned long *dup_list = NULL;
721 unsigned long dup_list_egrp = 0;
722 unsigned long dup_list_dhgrp = 0;
cdb10bae 723
680bd131 724 if (ngroups == 0) {
6849b73c 725 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
680bd131
MC		 726 return 0;
727 }
cdb10bae 728 if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) {
6849b73c 729 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
0f113f3e 730 return 0;
cdb10bae 731 }
9e84a42d 732 for (i = 0; i < ngroups; i++) {
0f113f3e 733 unsigned long idmask;
9e84a42d 734 uint16_t id;
4a1b4280 735 id = tls1_nid2group_id(groups[i]);
9aaecbfc 736 if ((id & 0x00FF) >= (sizeof(unsigned long) * 8))
737 goto err;
738 idmask = 1L << (id & 0x00FF);
739 dup_list = (id < 0x100) ? &dup_list_egrp : &dup_list_dhgrp;
740 if (!id || ((*dup_list) & idmask))
741 goto err;
742 *dup_list |= idmask;
9e84a42d 743 glist[i] = id;
0f113f3e 744 }
b548a1f1 745 OPENSSL_free(*pext);
de4d764e 746 *pext = glist;
9e84a42d 747 *pextlen = ngroups;
0f113f3e 748 return 1;
9aaecbfc 749err:
750 OPENSSL_free(glist);
751 return 0;
0f113f3e
MC		 752}
753
57e7401f 754# define GROUPLIST_INCREMENT 40
0a8e6c1f 755# define GROUP_NAME_BUFFER_LENGTH 64
0f113f3e 756typedef struct {
260009d8
MC		 757 SSL_CTX *ctx;
758 size_t gidcnt;
57e7401f
MC		 759 size_t gidmax;
760 uint16_t *gid_arr;
260009d8 761} gid_cb_st;
d0595f17 762
260009d8 763static int gid_cb(const char *elem, int len, void *arg)
0f113f3e 764{
260009d8 765 gid_cb_st *garg = arg;
0f113f3e 766 size_t i;
260009d8 767 uint16_t gid = 0;
0a8e6c1f 768 char etmp[GROUP_NAME_BUFFER_LENGTH];
260009d8 769
2747d73c
KR		 770 if (elem == NULL)
771 return 0;
57e7401f
MC		 772 if (garg->gidcnt == garg->gidmax) {
773 uint16_t *tmp =
774 OPENSSL_realloc(garg->gid_arr, garg->gidmax + GROUPLIST_INCREMENT);
775 if (tmp == NULL)
776 return 0;
777 garg->gidmax += GROUPLIST_INCREMENT;
778 garg->gid_arr = tmp;
779 }
0f113f3e
MC		 780 if (len > (int)(sizeof(etmp) - 1))
781 return 0;
782 memcpy(etmp, elem, len);
783 etmp[len] = 0;
260009d8
MC		 784
785 gid = tls1_group_name2id(garg->ctx, etmp);
ce8822b7
DB		 786 if (gid == 0) {
787 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT,
788 "group '%s' cannot be set", etmp);
0f113f3e 789 return 0;
ce8822b7 790 }
260009d8
MC		 791 for (i = 0; i < garg->gidcnt; i++)
792 if (garg->gid_arr[i] == gid)
0f113f3e 793 return 0;
260009d8 794 garg->gid_arr[garg->gidcnt++] = gid;
0f113f3e
MC		 795 return 1;
796}
797
260009d8
MC		 798/* Set groups based on a colon separated list */
799int tls1_set_groups_list(SSL_CTX *ctx, uint16_t **pext, size_t *pextlen,
800 const char *str)
0f113f3e 801{
260009d8
MC		 802 gid_cb_st gcb;
803 uint16_t *tmparr;
57e7401f 804 int ret = 0;
260009d8
MC		 805
806 gcb.gidcnt = 0;
57e7401f
MC		 807 gcb.gidmax = GROUPLIST_INCREMENT;
808 gcb.gid_arr = OPENSSL_malloc(gcb.gidmax * sizeof(*gcb.gid_arr));
809 if (gcb.gid_arr == NULL)
810 return 0;
260009d8
MC		 811 gcb.ctx = ctx;
812 if (!CONF_parse_list(str, ':', 1, gid_cb, &gcb))
57e7401f
MC		 813 goto end;
814 if (pext == NULL) {
815 ret = 1;
816 goto end;
817 }
260009d8
MC		 818
819 /*
820 * gid_cb ensurse there are no duplicates so we can just go ahead and set
821 * the result
822 */
823 tmparr = OPENSSL_memdup(gcb.gid_arr, gcb.gidcnt * sizeof(*tmparr));
824 if (tmparr == NULL)
57e7401f 825 goto end;
260009d8
MC		 826 *pext = tmparr;
827 *pextlen = gcb.gidcnt;
57e7401f
MC		 828 ret = 1;
829 end:
830 OPENSSL_free(gcb.gid_arr);
831 return ret;
0f113f3e 832}
b50951d3 833
4a1b4280 834/* Check a group id matches preferences */
38b051a1
TM		 835int tls1_check_group_id(SSL_CONNECTION *s, uint16_t group_id,
836 int check_own_groups)
4a1b4280
DSH		 837 {
838 const uint16_t *groups;
b50951d3 839 size_t groups_len;
4a1b4280
DSH		 840
841 if (group_id == 0)
842 return 0;
843
6447e818 844 /* Check for Suite B compliance */
555cbb32
TS		 845 if (tls1_suiteb(s) && s->s3.tmp.new_cipher != NULL) {
846 unsigned long cid = s->s3.tmp.new_cipher->id;
6447e818
DSH		 847
848 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) {
0a10825a 849 if (group_id != OSSL_TLS_GROUP_ID_secp256r1)
6447e818
DSH		 850 return 0;
851 } else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) {
0a10825a 852 if (group_id != OSSL_TLS_GROUP_ID_secp384r1)
6447e818
DSH		 853 return 0;
854 } else {
855 /* Should never happen */
856 return 0;
857 }
858 }
b50951d3 859
dcf8b01f
MC		 860 if (check_own_groups) {
861 /* Check group is one of our preferences */
862 tls1_get_supported_groups(s, &groups, &groups_len);
863 if (!tls1_in_list(group_id, groups, groups_len))
864 return 0;
865 }
4a1b4280 866
dbc6268f 867 if (!tls_group_allowed(s, group_id, SSL_SECOP_CURVE_CHECK))
6447e818
DSH		 868 return 0;
869
4a1b4280
DSH		 870 /* For clients, nothing more to check */
871 if (!s->server)
872 return 1;
873
874 /* Check group is one of peers preferences */
ff6d20a6 875 tls1_get_peer_groups(s, &groups, &groups_len);
4a1b4280
DSH		 876
877 /*
878 * RFC 4492 does not require the supported elliptic curves extension
879 * so if it is not sent we can just choose any curve.
880 * It is invalid to send an empty list in the supported groups
881 * extension, so groups_len == 0 always means no extension.
882 */
883 if (groups_len == 0)
884 return 1;
b50951d3 885 return tls1_in_list(group_id, groups, groups_len);
0f113f3e 886}
d61ff83b 887
38b051a1 888void tls1_get_formatlist(SSL_CONNECTION *s, const unsigned char **pformats,
7da160b0 889 size_t *num_formats)
0f113f3e
MC		 890{
891 /*
892 * If we have a custom point format list use it otherwise use default
893 */
aff8c126
RS		 894 if (s->ext.ecpointformats) {
895 *pformats = s->ext.ecpointformats;
896 *num_formats = s->ext.ecpointformats_len;
0f113f3e
MC		 897 } else {
898 *pformats = ecformats_default;
899 /* For Suite B we don't support char2 fields */
900 if (tls1_suiteb(s))
901 *num_formats = sizeof(ecformats_default) - 1;
902 else
903 *num_formats = sizeof(ecformats_default);
904 }
905}
906
dbc6268f 907/* Check a key is compatible with compression extension */
38b051a1 908static int tls1_check_pkey_comp(SSL_CONNECTION *s, EVP_PKEY *pkey)
dbc6268f 909{
dbc6268f
MC		 910 unsigned char comp_id;
911 size_t i;
3d34bedf 912 int point_conv;
dbc6268f
MC		 913
914 /* If not an EC key nothing to check */
c2041da8 915 if (!EVP_PKEY_is_a(pkey, "EC"))
dbc6268f 916 return 1;
5b5eea4b 917
dbc6268f
MC		 918
919 /* Get required compression id */
3d34bedf
MC		 920 point_conv = EVP_PKEY_get_ec_point_conv_form(pkey);
921 if (point_conv == 0)
922 return 0;
923 if (point_conv == POINT_CONVERSION_UNCOMPRESSED) {
924 comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
38b051a1 925 } else if (SSL_CONNECTION_IS_TLS13(s)) {
5b5eea4b
SL		 926 /*
927 * ec_point_formats extension is not used in TLSv1.3 so we ignore
928 * this check.
929 */
930 return 1;
dbc6268f 931 } else {
3d34bedf 932 int field_type = EVP_PKEY_get_field_type(pkey);
dbc6268f 933
3d34bedf 934 if (field_type == NID_X9_62_prime_field)
dbc6268f 935 comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
3d34bedf 936 else if (field_type == NID_X9_62_characteristic_two_field)
dbc6268f
MC		 937 comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
938 else
939 return 0;
940 }
941 /*
942 * If point formats extension present check it, otherwise everything is
943 * supported (see RFC4492).
944 */
cd0fb43c 945 if (s->ext.peer_ecpointformats == NULL)
dbc6268f
MC		 946 return 1;
947
cd0fb43c
MC		 948 for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
949 if (s->ext.peer_ecpointformats[i] == comp_id)
dbc6268f
MC		 950 return 1;
951 }
952 return 0;
953}
954
955/* Return group id of a key */
956static uint16_t tls1_get_group_id(EVP_PKEY *pkey)
957{
d8975dec 958 int curve_nid = ssl_get_EC_curve_nid(pkey);
dbc6268f 959
c2041da8 960 if (curve_nid == NID_undef)
dbc6268f 961 return 0;
c2041da8 962 return tls1_nid2group_id(curve_nid);
dbc6268f
MC		 963}
964
0f113f3e
MC		 965/*
966 * Check cert parameters compatible with extensions: currently just checks EC
967 * certificates have compatible curves and compression.
d61ff83b 968 */
38b051a1 969static int tls1_check_cert_param(SSL_CONNECTION *s, X509 *x, int check_ee_md)
0f113f3e 970{
4a1b4280 971 uint16_t group_id;
0f113f3e 972 EVP_PKEY *pkey;
8382fd3a 973 pkey = X509_get0_pubkey(x);
4a1b4280 974 if (pkey == NULL)
0f113f3e
MC		 975 return 0;
976 /* If not EC nothing to do */
c2041da8 977 if (!EVP_PKEY_is_a(pkey, "EC"))
0f113f3e 978 return 1;
4a1b4280
DSH		 979 /* Check compression */
980 if (!tls1_check_pkey_comp(s, pkey))
0f113f3e 981 return 0;
4a1b4280 982 group_id = tls1_get_group_id(pkey);
dcf8b01f
MC		 983 /*
984 * For a server we allow the certificate to not be in our list of supported
985 * groups.
986 */
987 if (!tls1_check_group_id(s, group_id, !s->server))
0f113f3e
MC		 988 return 0;
989 /*
990 * Special case for suite B. We *MUST* sign using SHA256+P-256 or
9195ddcd 991 * SHA384+P-384.
0f113f3e 992 */
9195ddcd 993 if (check_ee_md && tls1_suiteb(s)) {
0f113f3e
MC		 994 int check_md;
995 size_t i;
9e84a42d 996
0f113f3e 997 /* Check to see we have necessary signing algorithm */
0a10825a 998 if (group_id == OSSL_TLS_GROUP_ID_secp256r1)
0f113f3e 999 check_md = NID_ecdsa_with_SHA256;
0a10825a 1000 else if (group_id == OSSL_TLS_GROUP_ID_secp384r1)
0f113f3e
MC		 1001 check_md = NID_ecdsa_with_SHA384;
1002 else
1003 return 0; /* Should never happen */
29948ac8
BK		 1004 for (i = 0; i < s->shared_sigalgslen; i++) {
1005 if (check_md == s->shared_sigalgs[i]->sigandhash)
1e331727 1006 return 1;
4a1b4280
DSH		 1007 }
1008 return 0;
0f113f3e 1009 }
4a1b4280 1010 return 1;
0f113f3e
MC		 1011}
1012
6977e8ee 1013/*
8483a003 1014 * tls1_check_ec_tmp_key - Check EC temporary key compatibility
6977e8ee
KR		 1015 * @s: SSL connection
1016 * @cid: Cipher ID we're considering using
1017 *
1018 * Checks that the kECDHE cipher suite we're considering using
1019 * is compatible with the client extensions.
1020 *
1021 * Returns 0 when the cipher can't be used or 1 when it can.
1022 */
38b051a1 1023int tls1_check_ec_tmp_key(SSL_CONNECTION *s, unsigned long cid)
0f113f3e 1024{
4a1b4280
DSH		 1025 /* If not Suite B just need a shared group */
1026 if (!tls1_suiteb(s))
1027 return tls1_shared_group(s, 0) != 0;
0f113f3e
MC		 1028 /*
1029 * If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384, no other
1030 * curves permitted.
1031 */
4a1b4280 1032 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
0a10825a 1033 return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp256r1, 1);
4a1b4280 1034 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
0a10825a 1035 return tls1_check_group_id(s, OSSL_TLS_GROUP_ID_secp384r1, 1);
4a1b4280
DSH		 1036
1037 return 0;
0f113f3e 1038}
d0595f17 1039
703bcee0 1040/* Default sigalg schemes */
98c792d1 1041static const uint16_t tls12_sigalgs[] = {
703bcee0
MC		 1042 TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
1043 TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
1044 TLSEXT_SIGALG_ecdsa_secp521r1_sha512,
3d234c9e 1045 TLSEXT_SIGALG_ed25519,
0e1d6ecf 1046 TLSEXT_SIGALG_ed448,
0a10825a
BE		 1047 TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256,
1048 TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384,
1049 TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512,
0f113f3e 1050
f55e99f7
BK		 1051 TLSEXT_SIGALG_rsa_pss_pss_sha256,
1052 TLSEXT_SIGALG_rsa_pss_pss_sha384,
1053 TLSEXT_SIGALG_rsa_pss_pss_sha512,
1054 TLSEXT_SIGALG_rsa_pss_rsae_sha256,
1055 TLSEXT_SIGALG_rsa_pss_rsae_sha384,
1056 TLSEXT_SIGALG_rsa_pss_rsae_sha512,
536199ec 1057
703bcee0
MC		 1058 TLSEXT_SIGALG_rsa_pkcs1_sha256,
1059 TLSEXT_SIGALG_rsa_pkcs1_sha384,
1060 TLSEXT_SIGALG_rsa_pkcs1_sha512,
0f113f3e 1061
d8311fc9 1062 TLSEXT_SIGALG_ecdsa_sha224,
42ab2230 1063 TLSEXT_SIGALG_ecdsa_sha1,
462f4f4b 1064
d8311fc9 1065 TLSEXT_SIGALG_rsa_pkcs1_sha224,
42ab2230 1066 TLSEXT_SIGALG_rsa_pkcs1_sha1,
e376242d 1067
d8311fc9 1068 TLSEXT_SIGALG_dsa_sha224,
42ab2230
MC		 1069 TLSEXT_SIGALG_dsa_sha1,
1070
703bcee0
MC		 1071 TLSEXT_SIGALG_dsa_sha256,
1072 TLSEXT_SIGALG_dsa_sha384,
41f10305 1073 TLSEXT_SIGALG_dsa_sha512,
e376242d 1074
41f10305 1075#ifndef OPENSSL_NO_GOST
6f892296
NM		 1076 TLSEXT_SIGALG_gostr34102012_256_intrinsic,
1077 TLSEXT_SIGALG_gostr34102012_512_intrinsic,
41f10305
DB		 1078 TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
1079 TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
1080 TLSEXT_SIGALG_gostr34102001_gostr3411,
5eeb6c6e 1081#endif
fc101f88 1082};
0f113f3e 1083
462f4f4b 1084
98c792d1 1085static const uint16_t suiteb_sigalgs[] = {
703bcee0
MC		 1086 TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
1087 TLSEXT_SIGALG_ecdsa_secp384r1_sha384
2ea80354 1088};
aff8c126 1089
7a531ee4 1090static const SIGALG_LOOKUP sigalg_lookup_tbl[] = {
edbfba1a 1091 {"ecdsa_secp256r1_sha256", TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
17ae384e 1092 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
263ff2c9 1093 NID_ecdsa_with_SHA256, NID_X9_62_prime256v1, 1},
edbfba1a 1094 {"ecdsa_secp384r1_sha384", TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
17ae384e 1095 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
263ff2c9 1096 NID_ecdsa_with_SHA384, NID_secp384r1, 1},
edbfba1a 1097 {"ecdsa_secp521r1_sha512", TLSEXT_SIGALG_ecdsa_secp521r1_sha512,
17ae384e 1098 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
263ff2c9 1099 NID_ecdsa_with_SHA512, NID_secp521r1, 1},
b04d4e38 1100 {"ed25519", TLSEXT_SIGALG_ed25519,
d2916a5b 1101 NID_undef, -1, EVP_PKEY_ED25519, SSL_PKEY_ED25519,
263ff2c9 1102 NID_undef, NID_undef, 1},
0e1d6ecf
MC		 1103 {"ed448", TLSEXT_SIGALG_ed448,
1104 NID_undef, -1, EVP_PKEY_ED448, SSL_PKEY_ED448,
263ff2c9 1105 NID_undef, NID_undef, 1},
d8311fc9
MC		 1106 {NULL, TLSEXT_SIGALG_ecdsa_sha224,
1107 NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
263ff2c9 1108 NID_ecdsa_with_SHA224, NID_undef, 1},
edbfba1a 1109 {NULL, TLSEXT_SIGALG_ecdsa_sha1,
17ae384e 1110 NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
263ff2c9 1111 NID_ecdsa_with_SHA1, NID_undef, 1},
0a10825a
BE		 1112 {"ecdsa_brainpoolP256r1_sha256", TLSEXT_SIGALG_ecdsa_brainpoolP256r1_sha256,
1113 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
1114 NID_ecdsa_with_SHA256, NID_brainpoolP256r1, 1},
1115 {"ecdsa_brainpoolP384r1_sha384", TLSEXT_SIGALG_ecdsa_brainpoolP384r1_sha384,
1116 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
1117 NID_ecdsa_with_SHA384, NID_brainpoolP384r1, 1},
1118 {"ecdsa_brainpoolP512r1_sha512", TLSEXT_SIGALG_ecdsa_brainpoolP512r1_sha512,
1119 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_EC, SSL_PKEY_ECC,
1120 NID_ecdsa_with_SHA512, NID_brainpoolP512r1, 1},
f55e99f7
BK		 1121 {"rsa_pss_rsae_sha256", TLSEXT_SIGALG_rsa_pss_rsae_sha256,
1122 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
263ff2c9 1123 NID_undef, NID_undef, 1},
f55e99f7
BK		 1124 {"rsa_pss_rsae_sha384", TLSEXT_SIGALG_rsa_pss_rsae_sha384,
1125 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
263ff2c9 1126 NID_undef, NID_undef, 1},
f55e99f7
BK		 1127 {"rsa_pss_rsae_sha512", TLSEXT_SIGALG_rsa_pss_rsae_sha512,
1128 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA,
263ff2c9 1129 NID_undef, NID_undef, 1},
f55e99f7 1130 {"rsa_pss_pss_sha256", TLSEXT_SIGALG_rsa_pss_pss_sha256,
17ae384e 1131 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
263ff2c9 1132 NID_undef, NID_undef, 1},
f55e99f7 1133 {"rsa_pss_pss_sha384", TLSEXT_SIGALG_rsa_pss_pss_sha384,
17ae384e 1134 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
263ff2c9 1135 NID_undef, NID_undef, 1},
f55e99f7 1136 {"rsa_pss_pss_sha512", TLSEXT_SIGALG_rsa_pss_pss_sha512,
17ae384e 1137 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA_PSS, SSL_PKEY_RSA_PSS_SIGN,
263ff2c9 1138 NID_undef, NID_undef, 1},
edbfba1a 1139 {"rsa_pkcs1_sha256", TLSEXT_SIGALG_rsa_pkcs1_sha256,
d0ff28f8 1140 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
263ff2c9 1141 NID_sha256WithRSAEncryption, NID_undef, 1},
edbfba1a 1142 {"rsa_pkcs1_sha384", TLSEXT_SIGALG_rsa_pkcs1_sha384,
d0ff28f8 1143 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
263ff2c9 1144 NID_sha384WithRSAEncryption, NID_undef, 1},
edbfba1a 1145 {"rsa_pkcs1_sha512", TLSEXT_SIGALG_rsa_pkcs1_sha512,
d0ff28f8 1146 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
263ff2c9 1147 NID_sha512WithRSAEncryption, NID_undef, 1},
d8311fc9
MC		 1148 {"rsa_pkcs1_sha224", TLSEXT_SIGALG_rsa_pkcs1_sha224,
1149 NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
263ff2c9 1150 NID_sha224WithRSAEncryption, NID_undef, 1},
edbfba1a 1151 {"rsa_pkcs1_sha1", TLSEXT_SIGALG_rsa_pkcs1_sha1,
d0ff28f8 1152 NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_RSA, SSL_PKEY_RSA,
263ff2c9 1153 NID_sha1WithRSAEncryption, NID_undef, 1},
edbfba1a 1154 {NULL, TLSEXT_SIGALG_dsa_sha256,
17ae384e 1155 NID_sha256, SSL_MD_SHA256_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
263ff2c9 1156 NID_dsa_with_SHA256, NID_undef, 1},
edbfba1a 1157 {NULL, TLSEXT_SIGALG_dsa_sha384,
17ae384e 1158 NID_sha384, SSL_MD_SHA384_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
263ff2c9 1159 NID_undef, NID_undef, 1},
edbfba1a 1160 {NULL, TLSEXT_SIGALG_dsa_sha512,
17ae384e 1161 NID_sha512, SSL_MD_SHA512_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
263ff2c9 1162 NID_undef, NID_undef, 1},
d8311fc9
MC		 1163 {NULL, TLSEXT_SIGALG_dsa_sha224,
1164 NID_sha224, SSL_MD_SHA224_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
263ff2c9 1165 NID_undef, NID_undef, 1},
edbfba1a 1166 {NULL, TLSEXT_SIGALG_dsa_sha1,
17ae384e 1167 NID_sha1, SSL_MD_SHA1_IDX, EVP_PKEY_DSA, SSL_PKEY_DSA_SIGN,
263ff2c9 1168 NID_dsaWithSHA1, NID_undef, 1},
5eeb6c6e 1169#ifndef OPENSSL_NO_GOST
6f892296
NM		 1170 {NULL, TLSEXT_SIGALG_gostr34102012_256_intrinsic,
1171 NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX,
1172 NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256,
263ff2c9 1173 NID_undef, NID_undef, 1},
6f892296
NM		 1174 {NULL, TLSEXT_SIGALG_gostr34102012_512_intrinsic,
1175 NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX,
1176 NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512,
263ff2c9 1177 NID_undef, NID_undef, 1},
edbfba1a 1178 {NULL, TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
17ae384e
DSH		 1179 NID_id_GostR3411_2012_256, SSL_MD_GOST12_256_IDX,
1180 NID_id_GostR3410_2012_256, SSL_PKEY_GOST12_256,
263ff2c9 1181 NID_undef, NID_undef, 1},
edbfba1a 1182 {NULL, TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
17ae384e
DSH		 1183 NID_id_GostR3411_2012_512, SSL_MD_GOST12_512_IDX,
1184 NID_id_GostR3410_2012_512, SSL_PKEY_GOST12_512,
263ff2c9 1185 NID_undef, NID_undef, 1},
edbfba1a 1186 {NULL, TLSEXT_SIGALG_gostr34102001_gostr3411,
17ae384e
DSH		 1187 NID_id_GostR3411_94, SSL_MD_GOST94_IDX,
1188 NID_id_GostR3410_2001, SSL_PKEY_GOST01,
263ff2c9 1189 NID_undef, NID_undef, 1}
5eeb6c6e 1190#endif
703bcee0 1191};
0972bc5c
DSH		 1192/* Legacy sigalgs for TLS < 1.2 RSA TLS signatures */
1193static const SIGALG_LOOKUP legacy_rsa_sigalg = {
1194 "rsa_pkcs1_md5_sha1", 0,
1195 NID_md5_sha1, SSL_MD_MD5_SHA1_IDX,
1196 EVP_PKEY_RSA, SSL_PKEY_RSA,
263ff2c9 1197 NID_undef, NID_undef, 1
0972bc5c
DSH		 1198};
1199
1200/*
1201 * Default signature algorithm values used if signature algorithms not present.
1202 * From RFC5246. Note: order must match certificate index order.
1203 */
1204static const uint16_t tls_default_sigalg[] = {
1205 TLSEXT_SIGALG_rsa_pkcs1_sha1, /* SSL_PKEY_RSA */
045d078a 1206 0, /* SSL_PKEY_RSA_PSS_SIGN */
0972bc5c
DSH		 1207 TLSEXT_SIGALG_dsa_sha1, /* SSL_PKEY_DSA_SIGN */
1208 TLSEXT_SIGALG_ecdsa_sha1, /* SSL_PKEY_ECC */
1209 TLSEXT_SIGALG_gostr34102001_gostr3411, /* SSL_PKEY_GOST01 */
6f892296
NM		 1210 TLSEXT_SIGALG_gostr34102012_256_intrinsic, /* SSL_PKEY_GOST12_256 */
1211 TLSEXT_SIGALG_gostr34102012_512_intrinsic, /* SSL_PKEY_GOST12_512 */
0e1d6ecf
MC		 1212 0, /* SSL_PKEY_ED25519 */
1213 0, /* SSL_PKEY_ED448 */
0972bc5c 1214};
703bcee0 1215
263ff2c9
MC		 1216int ssl_setup_sig_algs(SSL_CTX *ctx)
1217{
1218 size_t i;
1219 const SIGALG_LOOKUP *lu;
1220 SIGALG_LOOKUP *cache
1221 = OPENSSL_malloc(sizeof(*lu) * OSSL_NELEM(sigalg_lookup_tbl));
1222 EVP_PKEY *tmpkey = EVP_PKEY_new();
1223 int ret = 0;
1224
1225 if (cache == NULL || tmpkey == NULL)
1226 goto err;
1227
1228 ERR_set_mark();
1229 for (i = 0, lu = sigalg_lookup_tbl;
1230 i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
1231 EVP_PKEY_CTX *pctx;
1232
1233 cache[i] = *lu;
1234
1235 /*
1236 * Check hash is available.
57e7401f 1237 * This test is not perfect. A provider could have support
263ff2c9
MC		 1238 * for a signature scheme, but not a particular hash. However the hash
1239 * could be available from some other loaded provider. In that case it
1240 * could be that the signature is available, and the hash is available
1241 * independently - but not as a combination. We ignore this for now.
1242 */
1243 if (lu->hash != NID_undef
1244 && ctx->ssl_digest_methods[lu->hash_idx] == NULL) {
1245 cache[i].enabled = 0;
1246 continue;
1247 }
1248
1249 if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {
1250 cache[i].enabled = 0;
1251 continue;
1252 }
1253 pctx = EVP_PKEY_CTX_new_from_pkey(ctx->libctx, tmpkey, ctx->propq);
1254 /* If unable to create pctx we assume the sig algorithm is unavailable */
1255 if (pctx == NULL)
1256 cache[i].enabled = 0;
1257 EVP_PKEY_CTX_free(pctx);
1258 }
1259 ERR_pop_to_mark();
1260 ctx->sigalg_lookup_cache = cache;
1261 cache = NULL;
1262
1263 ret = 1;
1264 err:
1265 OPENSSL_free(cache);
1266 EVP_PKEY_free(tmpkey);
1267 return ret;
1268}
1269
4d43ee28 1270/* Lookup TLS signature algorithm */
38b051a1
TM		 1271static const SIGALG_LOOKUP *tls1_lookup_sigalg(const SSL_CONNECTION *s,
1272 uint16_t sigalg)
703bcee0
MC		 1273{
1274 size_t i;
263ff2c9 1275 const SIGALG_LOOKUP *lu;
703bcee0 1276
38b051a1 1277 for (i = 0, lu = SSL_CONNECTION_GET_CTX(s)->sigalg_lookup_cache;
263ff2c9
MC		 1278 /* cache should have the same number of elements as sigalg_lookup_tbl */
1279 i < OSSL_NELEM(sigalg_lookup_tbl);
1280 lu++, i++) {
54e3efff
MC		 1281 if (lu->sigalg == sigalg) {
1282 if (!lu->enabled)
1283 return NULL;
263ff2c9 1284 return lu;
54e3efff 1285 }
703bcee0 1286 }
4d43ee28
DSH		 1287 return NULL;
1288}
168067b6 1289/* Lookup hash: return 0 if invalid or not enabled */
c8f6c28a 1290int tls1_lookup_md(SSL_CTX *ctx, const SIGALG_LOOKUP *lu, const EVP_MD **pmd)
168067b6
DSH		 1291{
1292 const EVP_MD *md;
38b051a1 1293
168067b6
DSH		 1294 if (lu == NULL)
1295 return 0;
1296 /* lu->hash == NID_undef means no associated digest */
1297 if (lu->hash == NID_undef) {
1298 md = NULL;
1299 } else {
c8f6c28a 1300 md = ssl_md(ctx, lu->hash_idx);
168067b6
DSH		 1301 if (md == NULL)
1302 return 0;
1303 }
1304 if (pmd)
1305 *pmd = md;
1306 return 1;
1307}
1308
0fe3db25
NR		 1309/*
1310 * Check if key is large enough to generate RSA-PSS signature.
1311 *
1312 * The key must greater than or equal to 2 * hash length + 2.
1313 * SHA512 has a hash length of 64 bytes, which is incompatible
1314 * with a 128 byte (1024 bit) key.
1315 */
ed576acd 1316#define RSA_PSS_MINIMUM_KEY_SIZE(md) (2 * EVP_MD_get_size(md) + 2)
c5f87134 1317static int rsa_pss_check_min_key_size(SSL_CTX *ctx, const EVP_PKEY *pkey,
c8f6c28a 1318 const SIGALG_LOOKUP *lu)
0fe3db25
NR		 1319{
1320 const EVP_MD *md;
1321
c5f87134 1322 if (pkey == NULL)
0fe3db25 1323 return 0;
c8f6c28a 1324 if (!tls1_lookup_md(ctx, lu, &md) || md == NULL)
0fe3db25 1325 return 0;
ed576acd 1326 if (EVP_PKEY_get_size(pkey) < RSA_PSS_MINIMUM_KEY_SIZE(md))
0fe3db25
NR		 1327 return 0;
1328 return 1;
1329}
1330
0972bc5c 1331/*
b0031e5d
KR		 1332 * Returns a signature algorithm when the peer did not send a list of supported
1333 * signature algorithms. The signature algorithm is fixed for the certificate
1334 * type. |idx| is a certificate type index (SSL_PKEY_*). When |idx| is -1 the
1335 * certificate type from |s| will be used.
1336 * Returns the signature algorithm to use, or NULL on error.
0972bc5c 1337 */
38b051a1
TM		 1338static const SIGALG_LOOKUP *tls1_get_legacy_sigalg(const SSL_CONNECTION *s,
1339 int idx)
0972bc5c 1340{
7f6b466b
DSH		 1341 if (idx == -1) {
1342 if (s->server) {
1343 size_t i;
1344
1345 /* Work out index corresponding to ciphersuite */
1346 for (i = 0; i < SSL_PKEY_NUM; i++) {
1347 const SSL_CERT_LOOKUP *clu = ssl_cert_lookup_by_idx(i);
1348
ed5b26ce
P		 1349 if (clu == NULL)
1350 continue;
555cbb32 1351 if (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) {
7f6b466b
DSH		 1352 idx = i;
1353 break;
1354 }
1355 }
1f65c045
DB		 1356
1357 /*
1358 * Some GOST ciphersuites allow more than one signature algorithms
1359 * */
555cbb32 1360 if (idx == SSL_PKEY_GOST01 && s->s3.tmp.new_cipher->algorithm_auth != SSL_aGOST01) {
1f65c045
DB		 1361 int real_idx;
1362
1363 for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01;
1364 real_idx--) {
1365 if (s->cert->pkeys[real_idx].privatekey != NULL) {
1366 idx = real_idx;
1367 break;
1368 }
1369 }
1370 }
5a5530a2
DB		 1371 /*
1372 * As both SSL_PKEY_GOST12_512 and SSL_PKEY_GOST12_256 indices can be used
1373 * with new (aGOST12-only) ciphersuites, we should find out which one is available really.
1374 */
1375 else if (idx == SSL_PKEY_GOST12_256) {
1376 int real_idx;
1377
1378 for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST12_256;
1379 real_idx--) {
1380 if (s->cert->pkeys[real_idx].privatekey != NULL) {
1381 idx = real_idx;
1382 break;
1383 }
1384 }
1385 }
7f6b466b
DSH		 1386 } else {
1387 idx = s->cert->key - s->cert->pkeys;
1388 }
1389 }
0972bc5c
DSH		 1390 if (idx < 0 || idx >= (int)OSSL_NELEM(tls_default_sigalg))
1391 return NULL;
1392 if (SSL_USE_SIGALGS(s) || idx != SSL_PKEY_RSA) {
263ff2c9 1393 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, tls_default_sigalg[idx]);
0972bc5c 1394
54e3efff
MC		 1395 if (lu == NULL)
1396 return NULL;
38b051a1 1397 if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, NULL))
0972bc5c 1398 return NULL;
b0031e5d
KR		 1399 if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu))
1400 return NULL;
0972bc5c
DSH		 1401 return lu;
1402 }
b0031e5d
KR		 1403 if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, &legacy_rsa_sigalg))
1404 return NULL;
0972bc5c
DSH		 1405 return &legacy_rsa_sigalg;
1406}
1407/* Set peer sigalg based key type */
38b051a1 1408int tls1_set_peer_legacy_sigalg(SSL_CONNECTION *s, const EVP_PKEY *pkey)
0972bc5c 1409{
52fd27f9
DSH		 1410 size_t idx;
1411 const SIGALG_LOOKUP *lu;
0972bc5c 1412
52fd27f9
DSH		 1413 if (ssl_cert_lookup_by_pkey(pkey, &idx) == NULL)
1414 return 0;
1415 lu = tls1_get_legacy_sigalg(s, idx);
0972bc5c
DSH		 1416 if (lu == NULL)
1417 return 0;
555cbb32 1418 s->s3.tmp.peer_sigalg = lu;
0972bc5c
DSH		 1419 return 1;
1420}
703bcee0 1421
38b051a1 1422size_t tls12_get_psigalgs(SSL_CONNECTION *s, int sent, const uint16_t **psigs)
0f113f3e
MC		 1423{
1424 /*
1425 * If Suite B mode use Suite B sigalgs only, ignore any other
1426 * preferences.
1427 */
0f113f3e
MC		 1428 switch (tls1_suiteb(s)) {
1429 case SSL_CERT_FLAG_SUITEB_128_LOS:
1430 *psigs = suiteb_sigalgs;
7a531ee4 1431 return OSSL_NELEM(suiteb_sigalgs);
0f113f3e
MC		 1432
1433 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
1434 *psigs = suiteb_sigalgs;
7a531ee4 1435 return 1;
0f113f3e
MC		 1436
1437 case SSL_CERT_FLAG_SUITEB_192_LOS:
7a531ee4
MC		 1438 *psigs = suiteb_sigalgs + 1;
1439 return 1;
0f113f3e 1440 }
a9669ddc
DSH		 1441 /*
1442 * We use client_sigalgs (if not NULL) if we're a server
1443 * and sending a certificate request or if we're a client and
1444 * determining which shared algorithm to use.
1445 */
1446 if ((s->server == sent) && s->cert->client_sigalgs != NULL) {
0f113f3e
MC		 1447 *psigs = s->cert->client_sigalgs;
1448 return s->cert->client_sigalgslen;
1449 } else if (s->cert->conf_sigalgs) {
1450 *psigs = s->cert->conf_sigalgs;
1451 return s->cert->conf_sigalgslen;
1452 } else {
1453 *psigs = tls12_sigalgs;
703bcee0 1454 return OSSL_NELEM(tls12_sigalgs);
0f113f3e
MC		 1455 }
1456}
1457
de4dc598
MC		 1458/*
1459 * Called by servers only. Checks that we have a sig alg that supports the
1460 * specified EC curve.
1461 */
38b051a1 1462int tls_check_sigalg_curve(const SSL_CONNECTION *s, int curve)
de4dc598
MC		 1463{
1464 const uint16_t *sigs;
1465 size_t siglen, i;
1466
1467 if (s->cert->conf_sigalgs) {
1468 sigs = s->cert->conf_sigalgs;
1469 siglen = s->cert->conf_sigalgslen;
1470 } else {
1471 sigs = tls12_sigalgs;
1472 siglen = OSSL_NELEM(tls12_sigalgs);
1473 }
1474
1475 for (i = 0; i < siglen; i++) {
263ff2c9 1476 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, sigs[i]);
de4dc598
MC		 1477
1478 if (lu == NULL)
1479 continue;
1480 if (lu->sig == EVP_PKEY_EC
1481 && lu->curve != NID_undef
1482 && curve == lu->curve)
1483 return 1;
1484 }
1485
1486 return 0;
1487}
1488
620c97b6
KR		 1489/*
1490 * Return the number of security bits for the signature algorithm, or 0 on
1491 * error.
1492 */
1493static int sigalg_security_bits(SSL_CTX *ctx, const SIGALG_LOOKUP *lu)
1494{
1495 const EVP_MD *md = NULL;
1496 int secbits = 0;
1497
1498 if (!tls1_lookup_md(ctx, lu, &md))
1499 return 0;
1500 if (md != NULL)
1501 {
ed576acd 1502 int md_type = EVP_MD_get_type(md);
aba03ae5 1503
620c97b6 1504 /* Security bits: half digest bits */
ed576acd 1505 secbits = EVP_MD_get_size(md) * 4;
aba03ae5
KR		 1506 /*
1507 * SHA1 and MD5 are known to be broken. Reduce security bits so that
1508 * they're no longer accepted at security level 1. The real values don't
1509 * really matter as long as they're lower than 80, which is our
1510 * security level 1.
1511 * https://eprint.iacr.org/2020/014 puts a chosen-prefix attack for
1512 * SHA1 at 2^63.4 and MD5+SHA1 at 2^67.2
1513 * https://documents.epfl.ch/users/l/le/lenstra/public/papers/lat.pdf
1514 * puts a chosen-prefix attack for MD5 at 2^39.
5ea4d764 1515 */
aba03ae5
KR		 1516 if (md_type == NID_sha1)
1517 secbits = 64;
1518 else if (md_type == NID_md5_sha1)
1519 secbits = 67;
1520 else if (md_type == NID_md5)
1521 secbits = 39;
620c97b6
KR		 1522 } else {
1523 /* Values from https://tools.ietf.org/html/rfc8032#section-8.5 */
1524 if (lu->sigalg == TLSEXT_SIGALG_ed25519)
1525 secbits = 128;
1526 else if (lu->sigalg == TLSEXT_SIGALG_ed448)
1527 secbits = 224;
1528 }
1529 return secbits;
1530}
1531
0f113f3e
MC		 1532/*
1533 * Check signature algorithm is consistent with sent supported signature
b2eb6998
DSH		 1534 * algorithms and if so set relevant digest and signature scheme in
1535 * s.
ec4a50b3 1536 */
38b051a1 1537int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey)
0f113f3e 1538{
98c792d1 1539 const uint16_t *sent_sigs;
5554facb 1540 const EVP_MD *md = NULL;
703bcee0 1541 char sigalgstr[2];
11d2641f 1542 size_t sent_sigslen, i, cidx;
c2041da8 1543 int pkeyid = -1;
f742cda8 1544 const SIGALG_LOOKUP *lu;
620c97b6 1545 int secbits = 0;
4d43ee28 1546
ed576acd 1547 pkeyid = EVP_PKEY_get_id(pkey);
0f113f3e 1548 /* Should never happen */
536199ec 1549 if (pkeyid == -1)
0f113f3e 1550 return -1;
38b051a1 1551 if (SSL_CONNECTION_IS_TLS13(s)) {
5a8916d9
DSH		 1552 /* Disallow DSA for TLS 1.3 */
1553 if (pkeyid == EVP_PKEY_DSA) {
c48ffbcc 1554 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
5a8916d9
DSH		 1555 return 0;
1556 }
1557 /* Only allow PSS for TLS 1.3 */
1558 if (pkeyid == EVP_PKEY_RSA)
1559 pkeyid = EVP_PKEY_RSA_PSS;
1560 }
263ff2c9 1561 lu = tls1_lookup_sigalg(s, sig);
f742cda8 1562 /*
d8311fc9
MC		 1563 * Check sigalgs is known. Disallow SHA1/SHA224 with TLS 1.3. Check key type
1564 * is consistent with signature: RSA keys can be used for RSA-PSS
f742cda8 1565 */
d8311fc9 1566 if (lu == NULL
38b051a1
TM		 1567 || (SSL_CONNECTION_IS_TLS13(s)
1568 && (lu->hash == NID_sha1 || lu->hash == NID_sha224))
095a982b 1569 || (pkeyid != lu->sig
f742cda8 1570 && (lu->sig != EVP_PKEY_RSA_PSS || pkeyid != EVP_PKEY_RSA))) {
c48ffbcc 1571 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
0f113f3e
MC		 1572 return 0;
1573 }
11d2641f 1574 /* Check the sigalg is consistent with the key OID */
ed576acd 1575 if (!ssl_cert_lookup_by_nid(EVP_PKEY_get_id(pkey), &cidx)
11d2641f 1576 || lu->sig_idx != (int)cidx) {
c48ffbcc 1577 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_SIGNATURE_TYPE);
11d2641f
MC		 1578 return 0;
1579 }
1580
fe3066ee 1581 if (pkeyid == EVP_PKEY_EC) {
44b6318f 1582
4a1b4280
DSH		 1583 /* Check point compression is permitted */
1584 if (!tls1_check_pkey_comp(s, pkey)) {
f63a17d6 1585 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6 1586 SSL_R_ILLEGAL_POINT_COMPRESSION);
4a1b4280
DSH		 1587 return 0;
1588 }
1589
1590 /* For TLS 1.3 or Suite B check curve matches signature algorithm */
38b051a1 1591 if (SSL_CONNECTION_IS_TLS13(s) || tls1_suiteb(s)) {
d8975dec 1592 int curve = ssl_get_EC_curve_nid(pkey);
4a1b4280 1593
a34a9df0 1594 if (lu->curve != NID_undef && curve != lu->curve) {
c48ffbcc 1595 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
8f88cb53
DSH		 1596 return 0;
1597 }
4a1b4280 1598 }
38b051a1 1599 if (!SSL_CONNECTION_IS_TLS13(s)) {
4a1b4280 1600 /* Check curve matches extensions */
dcf8b01f 1601 if (!tls1_check_group_id(s, tls1_get_group_id(pkey), 1)) {
c48ffbcc 1602 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
8f88cb53
DSH		 1603 return 0;
1604 }
8f88cb53 1605 if (tls1_suiteb(s)) {
f1adb006
DSH		 1606 /* Check sigalg matches a permissible Suite B value */
1607 if (sig != TLSEXT_SIGALG_ecdsa_secp256r1_sha256
1608 && sig != TLSEXT_SIGALG_ecdsa_secp384r1_sha384) {
f63a17d6 1609 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
f63a17d6 1610 SSL_R_WRONG_SIGNATURE_TYPE);
0f113f3e 1611 return 0;
f1adb006 1612 }
8f88cb53 1613 }
0f113f3e 1614 }
8f88cb53 1615 } else if (tls1_suiteb(s)) {
c48ffbcc 1616 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
0f113f3e 1617 return 0;
8f88cb53 1618 }
0f113f3e
MC		 1619
1620 /* Check signature matches a type we sent */
a9669ddc 1621 sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
536199ec 1622 for (i = 0; i < sent_sigslen; i++, sent_sigs++) {
703bcee0 1623 if (sig == *sent_sigs)
0f113f3e
MC		 1624 break;
1625 }
1626 /* Allow fallback to SHA1 if not strict mode */
f742cda8
DSH		 1627 if (i == sent_sigslen && (lu->hash != NID_sha1
1628 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)) {
c48ffbcc 1629 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
0f113f3e
MC		 1630 return 0;
1631 }
38b051a1 1632 if (!tls1_lookup_md(SSL_CONNECTION_GET_CTX(s), lu, &md)) {
c48ffbcc 1633 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST);
f63a17d6 1634 return 0;
0f113f3e 1635 }
620c97b6
KR		 1636 /*
1637 * Make sure security callback allows algorithm. For historical
1638 * reasons we have to pass the sigalg as a two byte char array.
1639 */
1640 sigalgstr[0] = (sig >> 8) & 0xff;
1641 sigalgstr[1] = sig & 0xff;
38b051a1 1642 secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
620c97b6
KR		 1643 if (secbits == 0 ||
1644 !ssl_security(s, SSL_SECOP_SIGALG_CHECK, secbits,
ed576acd 1645 md != NULL ? EVP_MD_get_type(md) : NID_undef,
620c97b6 1646 (void *)sigalgstr)) {
c48ffbcc 1647 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);
620c97b6 1648 return 0;
0f113f3e 1649 }
6cbebb55 1650 /* Store the sigalg the peer uses */
555cbb32 1651 s->s3.tmp.peer_sigalg = lu;
0f113f3e
MC		 1652 return 1;
1653}
2ea80354 1654
42ef7aea
DSH		 1655int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid)
1656{
38b051a1
TM		 1657 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1658
1659 if (sc == NULL)
42ef7aea 1660 return 0;
38b051a1
TM		 1661
1662 if (sc->s3.tmp.peer_sigalg == NULL)
1663 return 0;
1664 *pnid = sc->s3.tmp.peer_sigalg->sig;
42ef7aea
DSH		 1665 return 1;
1666}
1667
a51c9f63
VD		 1668int SSL_get_signature_type_nid(const SSL *s, int *pnid)
1669{
38b051a1
TM		 1670 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1671
1672 if (sc == NULL)
1673 return 0;
1674
1675 if (sc->s3.tmp.sigalg == NULL)
a51c9f63 1676 return 0;
38b051a1 1677 *pnid = sc->s3.tmp.sigalg->sig;
a51c9f63
VD		 1678 return 1;
1679}
1680
0f113f3e 1681/*
3eb2aff4
KR		 1682 * Set a mask of disabled algorithms: an algorithm is disabled if it isn't
1683 * supported, doesn't appear in supported signature algorithms, isn't supported
1684 * by the enabled protocol versions or by the security level.
1685 *
1686 * This function should only be used for checking which ciphers are supported
1687 * by the client.
1688 *
1689 * Call ssl_cipher_disabled() to check that it's enabled or not.
b7bfe69b 1690 */
38b051a1 1691int ssl_set_client_disabled(SSL_CONNECTION *s)
0f113f3e 1692{
555cbb32
TS		 1693 s->s3.tmp.mask_a = 0;
1694 s->s3.tmp.mask_k = 0;
1695 ssl_set_sig_mask(&s->s3.tmp.mask_a, s, SSL_SECOP_SIGALG_MASK);
1696 if (ssl_get_min_max_version(s, &s->s3.tmp.min_ver,
1697 &s->s3.tmp.max_ver, NULL) != 0)
1d0c08b4 1698 return 0;
a230b26e 1699#ifndef OPENSSL_NO_PSK
0f113f3e
MC		 1700 /* with PSK there must be client callback set */
1701 if (!s->psk_client_callback) {
555cbb32
TS		 1702 s->s3.tmp.mask_a |= SSL_aPSK;
1703 s->s3.tmp.mask_k |= SSL_PSK;
0f113f3e 1704 }
a230b26e 1705#endif /* OPENSSL_NO_PSK */
e481f9b9 1706#ifndef OPENSSL_NO_SRP
0f113f3e 1707 if (!(s->srp_ctx.srp_Mask & SSL_kSRP)) {
555cbb32
TS		 1708 s->s3.tmp.mask_a |= SSL_aSRP;
1709 s->s3.tmp.mask_k |= SSL_kSRP;
0f113f3e 1710 }
e481f9b9 1711#endif
1d0c08b4 1712 return 1;
0f113f3e 1713}
fc101f88 1714
3eb2aff4
KR		 1715/*
1716 * ssl_cipher_disabled - check that a cipher is disabled or not
1717 * @s: SSL connection that you want to use the cipher on
1718 * @c: cipher to check
1719 * @op: Security check that you want to do
8af91fd9 1720 * @ecdhe: If set to 1 then TLSv1 ECDHE ciphers are also allowed in SSLv3
3eb2aff4
KR		 1721 *
1722 * Returns 1 when it's disabled, 0 when enabled.
1723 */
38b051a1
TM		 1724int ssl_cipher_disabled(const SSL_CONNECTION *s, const SSL_CIPHER *c,
1725 int op, int ecdhe)
0f113f3e 1726{
555cbb32
TS		 1727 if (c->algorithm_mkey & s->s3.tmp.mask_k
1728 || c->algorithm_auth & s->s3.tmp.mask_a)
0f113f3e 1729 return 1;
555cbb32 1730 if (s->s3.tmp.max_ver == 0)
3eb2aff4 1731 return 1;
38b051a1 1732 if (!SSL_CONNECTION_IS_DTLS(s)) {
8af91fd9
MC		 1733 int min_tls = c->min_tls;
1734
1735 /*
1736 * For historical reasons we will allow ECHDE to be selected by a server
1737 * in SSLv3 if we are a client
1738 */
1739 if (min_tls == TLS1_VERSION && ecdhe
1740 && (c->algorithm_mkey & (SSL_kECDHE | SSL_kECDHEPSK)) != 0)
1741 min_tls = SSL3_VERSION;
1742
555cbb32 1743 if ((min_tls > s->s3.tmp.max_ver) || (c->max_tls < s->s3.tmp.min_ver))
8af91fd9
MC		 1744 return 1;
1745 }
38b051a1
TM		 1746 if (SSL_CONNECTION_IS_DTLS(s)
1747 && (DTLS_VERSION_GT(c->min_dtls, s->s3.tmp.max_ver)
1748 || DTLS_VERSION_LT(c->max_dtls, s->s3.tmp.min_ver)))
3eb2aff4
KR		 1749 return 1;
1750
0f113f3e
MC		 1751 return !ssl_security(s, op, c->strength_bits, 0, (void *)c);
1752}
b362ccab 1753
38b051a1 1754int tls_use_ticket(SSL_CONNECTION *s)
0f113f3e 1755{
08191294 1756 if ((s->options & SSL_OP_NO_TICKET))
0f113f3e
MC		 1757 return 0;
1758 return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
1759}
ed3883d2 1760
38b051a1 1761int tls1_set_server_sigalgs(SSL_CONNECTION *s)
0f113f3e 1762{
0f113f3e 1763 size_t i;
8483a003
F		 1764
1765 /* Clear any shared signature algorithms */
29948ac8
BK		 1766 OPENSSL_free(s->shared_sigalgs);
1767 s->shared_sigalgs = NULL;
1768 s->shared_sigalgslen = 0;
9195ddcd
DSH		 1769 /* Clear certificate validity flags */
1770 for (i = 0; i < SSL_PKEY_NUM; i++)
555cbb32 1771 s->s3.tmp.valid_flags[i] = 0;
a8bb912d
DSH		 1772 /*
1773 * If peer sent no signature algorithms check to see if we support
1774 * the default algorithm for each certificate type
1775 */
555cbb32
TS		 1776 if (s->s3.tmp.peer_cert_sigalgs == NULL
1777 && s->s3.tmp.peer_sigalgs == NULL) {
a8bb912d
DSH		 1778 const uint16_t *sent_sigs;
1779 size_t sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
0f113f3e 1780
a8bb912d
DSH		 1781 for (i = 0; i < SSL_PKEY_NUM; i++) {
1782 const SIGALG_LOOKUP *lu = tls1_get_legacy_sigalg(s, i);
1783 size_t j;
1784
1785 if (lu == NULL)
1786 continue;
1787 /* Check default matches a type we sent */
1788 for (j = 0; j < sent_sigslen; j++) {
1789 if (lu->sigalg == sent_sigs[j]) {
555cbb32 1790 s->s3.tmp.valid_flags[i] = CERT_PKEY_SIGN;
a8bb912d
DSH		 1791 break;
1792 }
1793 }
1794 }
9195ddcd 1795 return 1;
a8bb912d 1796 }
9195ddcd
DSH		 1797
1798 if (!tls1_process_sigalgs(s)) {
c48ffbcc 1799 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f63a17d6 1800 return 0;
d376e57d 1801 }
29948ac8 1802 if (s->shared_sigalgs != NULL)
9195ddcd 1803 return 1;
f63a17d6 1804
fb34a0f4 1805 /* Fatal error if no shared signature algorithms */
c48ffbcc 1806 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
f63a17d6 1807 SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS);
0f113f3e
MC		 1808 return 0;
1809}
e469af8d 1810
1d97c843 1811/*-
1ab3836b 1812 * Gets the ticket information supplied by the client if any.
e7f0d921 1813 *
1ab3836b 1814 * hello: The parsed ClientHello data
c519e89f
BM		 1815 * ret: (output) on return, if a ticket was decrypted, then this is set to
1816 * point to the resulting session.
6434abbf 1817 */
38b051a1
TM		 1818SSL_TICKET_STATUS tls_get_ticket_from_client(SSL_CONNECTION *s,
1819 CLIENTHELLO_MSG *hello,
df0fed9a 1820 SSL_SESSION **ret)
0f113f3e 1821{
1ab3836b
MC		 1822 size_t size;
1823 RAW_EXTENSION *ticketext;
e7f0d921 1824
0f113f3e 1825 *ret = NULL;
aff8c126 1826 s->ext.ticket_expected = 0;
0f113f3e
MC		 1827
1828 /*
9362c93e
MC		 1829 * If tickets disabled or not supported by the protocol version
1830 * (e.g. TLSv1.3) behave as if no ticket present to permit stateful
0f113f3e
MC		 1831 * resumption.
1832 */
1ab3836b 1833 if (s->version <= SSL3_VERSION || !tls_use_ticket(s))
df0fed9a 1834 return SSL_TICKET_NONE;
9ceb2426 1835
70af3d8e
MC		 1836 ticketext = &hello->pre_proc_exts[TLSEXT_IDX_session_ticket];
1837 if (!ticketext->present)
df0fed9a 1838 return SSL_TICKET_NONE;
1ab3836b
MC		 1839
1840 size = PACKET_remaining(&ticketext->data);
70af3d8e 1841
c0638ade 1842 return tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size,
70af3d8e 1843 hello->session_id, hello->session_id_len, ret);
1ab3836b
MC		 1844}
1845
1d97c843
TH		 1846/*-
1847 * tls_decrypt_ticket attempts to decrypt a session ticket.
c519e89f 1848 *
61fb5923
MC		 1849 * If s->tls_session_secret_cb is set and we're not doing TLSv1.3 then we are
1850 * expecting a pre-shared key ciphersuite, in which case we have no use for
1851 * session tickets and one will never be decrypted, nor will
1852 * s->ext.ticket_expected be set to 1.
1853 *
1854 * Side effects:
1855 * Sets s->ext.ticket_expected to 1 if the server will have to issue
1856 * a new session ticket to the client because the client indicated support
1857 * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
1858 * a session ticket or we couldn't use the one it gave us, or if
1859 * s->ctx->ext.ticket_key_cb asked to renew the client's ticket.
1860 * Otherwise, s->ext.ticket_expected is set to 0.
1861 *
c519e89f 1862 * etick: points to the body of the session ticket extension.
8483a003 1863 * eticklen: the length of the session tickets extension.
c519e89f
BM		 1864 * sess_id: points at the session ID.
1865 * sesslen: the length of the session ID.
1866 * psess: (output) on return, if a ticket was decrypted, then this is set to
1867 * point to the resulting session.
c519e89f 1868 */
38b051a1
TM		 1869SSL_TICKET_STATUS tls_decrypt_ticket(SSL_CONNECTION *s,
1870 const unsigned char *etick,
1871 size_t eticklen,
1872 const unsigned char *sess_id,
df0fed9a 1873 size_t sesslen, SSL_SESSION **psess)
0f113f3e 1874{
61fb5923 1875 SSL_SESSION *sess = NULL;
0f113f3e
MC		 1876 unsigned char *sdec;
1877 const unsigned char *p;
ddf6ec00 1878 int slen, renew_ticket = 0, declen;
61fb5923 1879 SSL_TICKET_STATUS ret = SSL_TICKET_FATAL_ERR_OTHER;
348240c6 1880 size_t mlen;
0f113f3e 1881 unsigned char tick_hmac[EVP_MAX_MD_SIZE];
a76ce286 1882 SSL_HMAC *hctx = NULL;
ee763495 1883 EVP_CIPHER_CTX *ctx = NULL;
222da979 1884 SSL_CTX *tctx = s->session_ctx;
e97763c9 1885
61fb5923
MC		 1886 if (eticklen == 0) {
1887 /*
1888 * The client will accept a ticket but doesn't currently have
1889 * one (TLSv1.2 and below), or treated as a fatal error in TLSv1.3
1890 */
1891 ret = SSL_TICKET_EMPTY;
1892 goto end;
1893 }
38b051a1 1894 if (!SSL_CONNECTION_IS_TLS13(s) && s->ext.session_secret_cb) {
61fb5923
MC		 1895 /*
1896 * Indicate that the ticket couldn't be decrypted rather than
1897 * generating the session from ticket now, trigger
1898 * abbreviated handshake based on external mechanism to
1899 * calculate the master secret later.
1900 */
1901 ret = SSL_TICKET_NO_DECRYPT;
1902 goto end;
1903 }
1904
ee763495
MC		 1905 /* Need at least keyname + iv */
1906 if (eticklen < TLSEXT_KEYNAME_LENGTH + EVP_MAX_IV_LENGTH) {
df0fed9a 1907 ret = SSL_TICKET_NO_DECRYPT;
c0638ade 1908 goto end;
ee763495
MC		 1909 }
1910
0f113f3e 1911 /* Initialize session ticket encryption and HMAC contexts */
a76ce286 1912 hctx = ssl_hmac_new(tctx);
c0638ade
MC		 1913 if (hctx == NULL) {
1914 ret = SSL_TICKET_FATAL_ERR_MALLOC;
1915 goto end;
1916 }
846ec07d 1917 ctx = EVP_CIPHER_CTX_new();
35b1a433 1918 if (ctx == NULL) {
df0fed9a 1919 ret = SSL_TICKET_FATAL_ERR_MALLOC;
c0638ade 1920 goto end;
35b1a433 1921 }
a76ce286
P		 1922#ifndef OPENSSL_NO_DEPRECATED_3_0
1923 if (tctx->ext.ticket_key_evp_cb != NULL || tctx->ext.ticket_key_cb != NULL)
1924#else
1925 if (tctx->ext.ticket_key_evp_cb != NULL)
1926#endif
1927 {
0f113f3e 1928 unsigned char *nctick = (unsigned char *)etick;
a76ce286
P		 1929 int rv = 0;
1930
1931 if (tctx->ext.ticket_key_evp_cb != NULL)
38b051a1 1932 rv = tctx->ext.ticket_key_evp_cb(SSL_CONNECTION_GET_SSL(s), nctick,
a76ce286
P		 1933 nctick + TLSEXT_KEYNAME_LENGTH,
1934 ctx,
1935 ssl_hmac_get0_EVP_MAC_CTX(hctx),
1936 0);
1937#ifndef OPENSSL_NO_DEPRECATED_3_0
1938 else if (tctx->ext.ticket_key_cb != NULL)
1939 /* if 0 is returned, write an empty ticket */
38b051a1 1940 rv = tctx->ext.ticket_key_cb(SSL_CONNECTION_GET_SSL(s), nctick,
ee763495 1941 nctick + TLSEXT_KEYNAME_LENGTH,
a76ce286
P		 1942 ctx, ssl_hmac_get0_HMAC_CTX(hctx), 0);
1943#endif
c0638ade
MC		 1944 if (rv < 0) {
1945 ret = SSL_TICKET_FATAL_ERR_OTHER;
1946 goto end;
1947 }
35b1a433 1948 if (rv == 0) {
df0fed9a 1949 ret = SSL_TICKET_NO_DECRYPT;
c0638ade 1950 goto end;
35b1a433 1951 }
0f113f3e
MC		 1952 if (rv == 2)
1953 renew_ticket = 1;
1954 } else {
148bfd26 1955 EVP_CIPHER *aes256cbc = NULL;
38b051a1 1956 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
148bfd26 1957
0f113f3e 1958 /* Check key name matches */
aff8c126 1959 if (memcmp(etick, tctx->ext.tick_key_name,
ee763495 1960 TLSEXT_KEYNAME_LENGTH) != 0) {
df0fed9a 1961 ret = SSL_TICKET_NO_DECRYPT;
c0638ade 1962 goto end;
35b1a433 1963 }
148bfd26 1964
38b051a1
TM		 1965 aes256cbc = EVP_CIPHER_fetch(sctx->libctx, "AES-256-CBC",
1966 sctx->propq);
148bfd26
MC		 1967 if (aes256cbc == NULL
1968 || ssl_hmac_init(hctx, tctx->ext.secure->tick_hmac_key,
1969 sizeof(tctx->ext.secure->tick_hmac_key),
1970 "SHA256") <= 0
1971 || EVP_DecryptInit_ex(ctx, aes256cbc, NULL,
4bfb96f2 1972 tctx->ext.secure->tick_aes_key,
ee763495 1973 etick + TLSEXT_KEYNAME_LENGTH) <= 0) {
148bfd26 1974 EVP_CIPHER_free(aes256cbc);
c0638ade
MC		 1975 ret = SSL_TICKET_FATAL_ERR_OTHER;
1976 goto end;
a230b26e 1977 }
148bfd26 1978 EVP_CIPHER_free(aes256cbc);
38b051a1 1979 if (SSL_CONNECTION_IS_TLS13(s))
c0638ade 1980 renew_ticket = 1;
0f113f3e
MC		 1981 }
1982 /*
1983 * Attempt to process session ticket, first conduct sanity and integrity
1984 * checks on ticket.
1985 */
a76ce286 1986 mlen = ssl_hmac_size(hctx);
348240c6 1987 if (mlen == 0) {
c0638ade
MC		 1988 ret = SSL_TICKET_FATAL_ERR_OTHER;
1989 goto end;
0f113f3e 1990 }
c0638ade 1991
e97763c9
DSH		 1992 /* Sanity check ticket length: must exceed keyname + IV + HMAC */
1993 if (eticklen <=
ed576acd 1994 TLSEXT_KEYNAME_LENGTH + EVP_CIPHER_CTX_get_iv_length(ctx) + mlen) {
df0fed9a 1995 ret = SSL_TICKET_NO_DECRYPT;
c0638ade 1996 goto end;
e97763c9 1997 }
0f113f3e
MC		 1998 eticklen -= mlen;
1999 /* Check HMAC of encrypted ticket */
a76ce286
P		 2000 if (ssl_hmac_update(hctx, etick, eticklen) <= 0
2001 || ssl_hmac_final(hctx, tick_hmac, NULL, sizeof(tick_hmac)) <= 0) {
c0638ade
MC		 2002 ret = SSL_TICKET_FATAL_ERR_OTHER;
2003 goto end;
5f3d93e4 2004 }
c0638ade 2005
0f113f3e 2006 if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) {
c0638ade
MC		 2007 ret = SSL_TICKET_NO_DECRYPT;
2008 goto end;
0f113f3e
MC		 2009 }
2010 /* Attempt to decrypt session data */
2011 /* Move p after IV to start of encrypted ticket, update length */
ed576acd
TM		 2012 p = etick + TLSEXT_KEYNAME_LENGTH + EVP_CIPHER_CTX_get_iv_length(ctx);
2013 eticklen -= TLSEXT_KEYNAME_LENGTH + EVP_CIPHER_CTX_get_iv_length(ctx);
0f113f3e 2014 sdec = OPENSSL_malloc(eticklen);
348240c6
MC		 2015 if (sdec == NULL || EVP_DecryptUpdate(ctx, sdec, &slen, p,
2016 (int)eticklen) <= 0) {
d1247df2 2017 OPENSSL_free(sdec);
c0638ade
MC		 2018 ret = SSL_TICKET_FATAL_ERR_OTHER;
2019 goto end;
0f113f3e 2020 }
348240c6 2021 if (EVP_DecryptFinal(ctx, sdec + slen, &declen) <= 0) {
0f113f3e 2022 OPENSSL_free(sdec);
c0638ade
MC		 2023 ret = SSL_TICKET_NO_DECRYPT;
2024 goto end;
0f113f3e 2025 }
348240c6 2026 slen += declen;
0f113f3e
MC		 2027 p = sdec;
2028
2029 sess = d2i_SSL_SESSION(NULL, &p, slen);
d3bc9805 2030 slen -= p - sdec;
0f113f3e
MC		 2031 OPENSSL_free(sdec);
2032 if (sess) {
79020b27 2033 /* Some additional consistency checks */
32305f88 2034 if (slen != 0) {
79020b27 2035 SSL_SESSION_free(sess);
5f96a95e 2036 sess = NULL;
c0638ade
MC		 2037 ret = SSL_TICKET_NO_DECRYPT;
2038 goto end;
79020b27 2039 }
0f113f3e
MC		 2040 /*
2041 * The session ID, if non-empty, is used by some clients to detect
2042 * that the ticket has been accepted. So we copy it to the session
2043 * structure. If it is empty set length to zero as required by
2044 * standard.
2045 */
32305f88 2046 if (sesslen) {
0f113f3e 2047 memcpy(sess->session_id, sess_id, sesslen);
32305f88
MC		 2048 sess->session_id_length = sesslen;
2049 }
0f113f3e 2050 if (renew_ticket)
c0638ade 2051 ret = SSL_TICKET_SUCCESS_RENEW;
0f113f3e 2052 else
c0638ade
MC		 2053 ret = SSL_TICKET_SUCCESS;
2054 goto end;
0f113f3e
MC		 2055 }
2056 ERR_clear_error();
2057 /*
2058 * For session parse failure, indicate that we need to send a new ticket.
2059 */
c0638ade
MC		 2060 ret = SSL_TICKET_NO_DECRYPT;
2061
2062 end:
846ec07d 2063 EVP_CIPHER_CTX_free(ctx);
a76ce286 2064 ssl_hmac_free(hctx);
c0638ade
MC		 2065
2066 /*
61fb5923
MC		 2067 * If set, the decrypt_ticket_cb() is called unless a fatal error was
2068 * detected above. The callback is responsible for checking |ret| before it
2069 * performs any action
c0638ade 2070 */
61fb5923
MC		 2071 if (s->session_ctx->decrypt_ticket_cb != NULL
2072 && (ret == SSL_TICKET_EMPTY
2073 || ret == SSL_TICKET_NO_DECRYPT
2074 || ret == SSL_TICKET_SUCCESS
2075 || ret == SSL_TICKET_SUCCESS_RENEW)) {
c0638ade 2076 size_t keyname_len = eticklen;
61fb5923 2077 int retcb;
c0638ade
MC		 2078
2079 if (keyname_len > TLSEXT_KEYNAME_LENGTH)
2080 keyname_len = TLSEXT_KEYNAME_LENGTH;
38b051a1
TM		 2081 retcb = s->session_ctx->decrypt_ticket_cb(SSL_CONNECTION_GET_SSL(s),
2082 sess, etick, keyname_len,
61fb5923
MC		 2083 ret,
2084 s->session_ctx->ticket_cb_data);
2085 switch (retcb) {
2086 case SSL_TICKET_RETURN_ABORT:
2087 ret = SSL_TICKET_FATAL_ERR_OTHER;
2088 break;
2089
2090 case SSL_TICKET_RETURN_IGNORE:
2091 ret = SSL_TICKET_NONE;
2092 SSL_SESSION_free(sess);
2093 sess = NULL;
2094 break;
2095
2096 case SSL_TICKET_RETURN_IGNORE_RENEW:
2097 if (ret != SSL_TICKET_EMPTY && ret != SSL_TICKET_NO_DECRYPT)
2098 ret = SSL_TICKET_NO_DECRYPT;
2099 /* else the value of |ret| will already do the right thing */
2100 SSL_SESSION_free(sess);
2101 sess = NULL;
2102 break;
2103
2104 case SSL_TICKET_RETURN_USE:
2105 case SSL_TICKET_RETURN_USE_RENEW:
2106 if (ret != SSL_TICKET_SUCCESS
2107 && ret != SSL_TICKET_SUCCESS_RENEW)
2108 ret = SSL_TICKET_FATAL_ERR_OTHER;
2109 else if (retcb == SSL_TICKET_RETURN_USE)
2110 ret = SSL_TICKET_SUCCESS;
2111 else
2112 ret = SSL_TICKET_SUCCESS_RENEW;
2113 break;
2114
2115 default:
2116 ret = SSL_TICKET_FATAL_ERR_OTHER;
2117 }
c0638ade
MC		 2118 }
2119
38b051a1 2120 if (s->ext.session_secret_cb == NULL || SSL_CONNECTION_IS_TLS13(s)) {
309371d6
MC		 2121 switch (ret) {
2122 case SSL_TICKET_NO_DECRYPT:
2123 case SSL_TICKET_SUCCESS_RENEW:
2124 case SSL_TICKET_EMPTY:
2125 s->ext.ticket_expected = 1;
2126 }
c0638ade
MC		 2127 }
2128
61fb5923
MC		 2129 *psess = sess;
2130
2131 return ret;
0f113f3e 2132}
6434abbf 2133
b362ccab 2134/* Check to see if a signature algorithm is allowed */
38b051a1
TM		 2135static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op,
2136 const SIGALG_LOOKUP *lu)
0f113f3e 2137{
703bcee0 2138 unsigned char sigalgstr[2];
44b6318f 2139 int secbits;
703bcee0 2140
263ff2c9 2141 if (lu == NULL || !lu->enabled)
0f113f3e 2142 return 0;
224b4e37 2143 /* DSA is not allowed in TLS 1.3 */
38b051a1 2144 if (SSL_CONNECTION_IS_TLS13(s) && lu->sig == EVP_PKEY_DSA)
224b4e37 2145 return 0;
08cea586
MC		 2146 /*
2147 * At some point we should fully axe DSA/etc. in ClientHello as per TLS 1.3
2148 * spec
2149 */
38b051a1
TM		 2150 if (!s->server && !SSL_CONNECTION_IS_DTLS(s)
2151 && s->s3.tmp.min_ver >= TLS1_3_VERSION
6ffeb269
BK		 2152 && (lu->sig == EVP_PKEY_DSA || lu->hash_idx == SSL_MD_SHA1_IDX
2153 || lu->hash_idx == SSL_MD_MD5_IDX
2154 || lu->hash_idx == SSL_MD_SHA224_IDX))
2155 return 0;
871980a9 2156
0f113f3e 2157 /* See if public key algorithm allowed */
38b051a1 2158 if (ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), lu->sig_idx))
0f113f3e 2159 return 0;
871980a9
MC		 2160
2161 if (lu->sig == NID_id_GostR3410_2012_256
2162 || lu->sig == NID_id_GostR3410_2012_512
2163 || lu->sig == NID_id_GostR3410_2001) {
2164 /* We never allow GOST sig algs on the server with TLSv1.3 */
38b051a1 2165 if (s->server && SSL_CONNECTION_IS_TLS13(s))
871980a9
MC		 2166 return 0;
2167 if (!s->server
38b051a1 2168 && SSL_CONNECTION_GET_SSL(s)->method->version == TLS_ANY_VERSION
555cbb32 2169 && s->s3.tmp.max_ver >= TLS1_3_VERSION) {
871980a9
MC		 2170 int i, num;
2171 STACK_OF(SSL_CIPHER) *sk;
2172
2173 /*
2174 * We're a client that could negotiate TLSv1.3. We only allow GOST
2175 * sig algs if we could negotiate TLSv1.2 or below and we have GOST
2176 * ciphersuites enabled.
2177 */
2178
555cbb32 2179 if (s->s3.tmp.min_ver >= TLS1_3_VERSION)
871980a9
MC		 2180 return 0;
2181
38b051a1 2182 sk = SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s));
871980a9
MC		 2183 num = sk != NULL ? sk_SSL_CIPHER_num(sk) : 0;
2184 for (i = 0; i < num; i++) {
2185 const SSL_CIPHER *c;
2186
2187 c = sk_SSL_CIPHER_value(sk, i);
2188 /* Skip disabled ciphers */
2189 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
2190 continue;
2191
5a5530a2 2192 if ((c->algorithm_mkey & (SSL_kGOST | SSL_kGOST18)) != 0)
871980a9
MC		 2193 break;
2194 }
2195 if (i == num)
2196 return 0;
2197 }
2198 }
2199
0f113f3e 2200 /* Finally see if security callback allows it */
38b051a1 2201 secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
b0e9ab95
DSH		 2202 sigalgstr[0] = (lu->sigalg >> 8) & 0xff;
2203 sigalgstr[1] = lu->sigalg & 0xff;
44b6318f 2204 return ssl_security(s, op, secbits, lu->hash, (void *)sigalgstr);
0f113f3e
MC		 2205}
2206
2207/*
2208 * Get a mask of disabled public key algorithms based on supported signature
2209 * algorithms. For example if no signature algorithm supports RSA then RSA is
2210 * disabled.
b362ccab
DSH		 2211 */
2212
38b051a1 2213void ssl_set_sig_mask(uint32_t *pmask_a, SSL_CONNECTION *s, int op)
0f113f3e 2214{
98c792d1 2215 const uint16_t *sigalgs;
0f113f3e 2216 size_t i, sigalgslen;
13cc2574 2217 uint32_t disabled_mask = SSL_aRSA | SSL_aDSS | SSL_aECDSA;
0f113f3e 2218 /*
13cc2574
DSH		 2219 * Go through all signature algorithms seeing if we support any
2220 * in disabled_mask.
0f113f3e 2221 */
a9669ddc 2222 sigalgslen = tls12_get_psigalgs(s, 1, &sigalgs);
b2555168 2223 for (i = 0; i < sigalgslen; i++, sigalgs++) {
263ff2c9 2224 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *sigalgs);
13cc2574 2225 const SSL_CERT_LOOKUP *clu;
b0e9ab95
DSH		 2226
2227 if (lu == NULL)
2228 continue;
13cc2574
DSH		 2229
2230 clu = ssl_cert_lookup_by_idx(lu->sig_idx);
dd6b2706
P		 2231 if (clu == NULL)
2232 continue;
13cc2574
DSH		 2233
2234 /* If algorithm is disabled see if we can enable it */
2235 if ((clu->amask & disabled_mask) != 0
2236 && tls12_sigalg_allowed(s, op, lu))
2237 disabled_mask &= ~clu->amask;
0f113f3e 2238 }
13cc2574 2239 *pmask_a |= disabled_mask;
0f113f3e 2240}
b362ccab 2241
38b051a1 2242int tls12_copy_sigalgs(SSL_CONNECTION *s, WPACKET *pkt,
98c792d1 2243 const uint16_t *psig, size_t psiglen)
2c7b4dbc
MC		 2244{
2245 size_t i;
b0e9ab95 2246 int rv = 0;
c0f9e23c 2247
703bcee0 2248 for (i = 0; i < psiglen; i++, psig++) {
263ff2c9 2249 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *psig);
b0e9ab95 2250
54e3efff
MC		 2251 if (lu == NULL
2252 || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, lu))
b0e9ab95
DSH		 2253 continue;
2254 if (!WPACKET_put_bytes_u16(pkt, *psig))
2255 return 0;
2256 /*
2257 * If TLS 1.3 must have at least one valid TLS 1.3 message
d8311fc9 2258 * signing algorithm: i.e. neither RSA nor SHA1/SHA224
b0e9ab95 2259 */
38b051a1 2260 if (rv == 0 && (!SSL_CONNECTION_IS_TLS13(s)
d8311fc9
MC		 2261 || (lu->sig != EVP_PKEY_RSA
2262 && lu->hash != NID_sha1
2263 && lu->hash != NID_sha224)))
b0e9ab95 2264 rv = 1;
2c7b4dbc 2265 }
5528d68f 2266 if (rv == 0)
6849b73c 2267 ERR_raise(ERR_LIB_SSL, SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
b0e9ab95 2268 return rv;
2c7b4dbc
MC		 2269}
2270
4453cd8c 2271/* Given preference and allowed sigalgs set shared sigalgs */
38b051a1
TM		 2272static size_t tls12_shared_sigalgs(SSL_CONNECTION *s,
2273 const SIGALG_LOOKUP **shsig,
98c792d1
DSH		 2274 const uint16_t *pref, size_t preflen,
2275 const uint16_t *allow, size_t allowlen)
0f113f3e 2276{
98c792d1 2277 const uint16_t *ptmp, *atmp;
0f113f3e 2278 size_t i, j, nmatch = 0;
703bcee0 2279 for (i = 0, ptmp = pref; i < preflen; i++, ptmp++) {
263ff2c9 2280 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *ptmp);
b0e9ab95 2281
0f113f3e 2282 /* Skip disabled hashes or signature algorithms */
54e3efff
MC		 2283 if (lu == NULL
2284 || !tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, lu))
0f113f3e 2285 continue;
703bcee0
MC		 2286 for (j = 0, atmp = allow; j < allowlen; j++, atmp++) {
2287 if (*ptmp == *atmp) {
0f113f3e 2288 nmatch++;
b0e9ab95
DSH		 2289 if (shsig)
2290 *shsig++ = lu;
0f113f3e
MC		 2291 break;
2292 }
2293 }
2294 }
2295 return nmatch;
2296}
4453cd8c
DSH		 2297
2298/* Set shared signature algorithms for SSL structures */
38b051a1 2299static int tls1_set_shared_sigalgs(SSL_CONNECTION *s)
0f113f3e 2300{
98c792d1 2301 const uint16_t *pref, *allow, *conf;
0f113f3e
MC		 2302 size_t preflen, allowlen, conflen;
2303 size_t nmatch;
4d43ee28 2304 const SIGALG_LOOKUP **salgs = NULL;
0f113f3e
MC		 2305 CERT *c = s->cert;
2306 unsigned int is_suiteb = tls1_suiteb(s);
b548a1f1 2307
29948ac8
BK		 2308 OPENSSL_free(s->shared_sigalgs);
2309 s->shared_sigalgs = NULL;
2310 s->shared_sigalgslen = 0;
0f113f3e
MC		 2311 /* If client use client signature algorithms if not NULL */
2312 if (!s->server && c->client_sigalgs && !is_suiteb) {
2313 conf = c->client_sigalgs;
2314 conflen = c->client_sigalgslen;
2315 } else if (c->conf_sigalgs && !is_suiteb) {
2316 conf = c->conf_sigalgs;
2317 conflen = c->conf_sigalgslen;
2318 } else
a9669ddc 2319 conflen = tls12_get_psigalgs(s, 0, &conf);
0f113f3e
MC		 2320 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb) {
2321 pref = conf;
2322 preflen = conflen;
555cbb32
TS		 2323 allow = s->s3.tmp.peer_sigalgs;
2324 allowlen = s->s3.tmp.peer_sigalgslen;
0f113f3e
MC		 2325 } else {
2326 allow = conf;
2327 allowlen = conflen;
555cbb32
TS		 2328 pref = s->s3.tmp.peer_sigalgs;
2329 preflen = s->s3.tmp.peer_sigalgslen;
0f113f3e
MC		 2330 }
2331 nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
34e3edbf 2332 if (nmatch) {
cdb10bae 2333 if ((salgs = OPENSSL_malloc(nmatch * sizeof(*salgs))) == NULL) {
6849b73c 2334 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
34e3edbf 2335 return 0;
cdb10bae 2336 }
34e3edbf
DSH		 2337 nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
2338 } else {
2339 salgs = NULL;
2340 }
29948ac8
BK		 2341 s->shared_sigalgs = salgs;
2342 s->shared_sigalgslen = nmatch;
0f113f3e
MC		 2343 return 1;
2344}
4453cd8c 2345
9e84a42d 2346int tls1_save_u16(PACKET *pkt, uint16_t **pdest, size_t *pdestlen)
0f113f3e 2347{
98c792d1 2348 unsigned int stmp;
703bcee0 2349 size_t size, i;
9e84a42d 2350 uint16_t *buf;
0f113f3e 2351
703bcee0
MC		 2352 size = PACKET_remaining(pkt);
2353
2354 /* Invalid data length */
8f12296e 2355 if (size == 0 || (size & 1) != 0)
703bcee0
MC		 2356 return 0;
2357
2358 size >>= 1;
2359
cdb10bae 2360 if ((buf = OPENSSL_malloc(size * sizeof(*buf))) == NULL) {
6849b73c 2361 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
0f113f3e 2362 return 0;
cdb10bae 2363 }
98c792d1 2364 for (i = 0; i < size && PACKET_get_net_2(pkt, &stmp); i++)
9e84a42d 2365 buf[i] = stmp;
703bcee0 2366
9e84a42d
DSH		 2367 if (i != size) {
2368 OPENSSL_free(buf);
703bcee0 2369 return 0;
9e84a42d
DSH		 2370 }
2371
2372 OPENSSL_free(*pdest);
2373 *pdest = buf;
2374 *pdestlen = size;
703bcee0 2375
0f113f3e
MC		 2376 return 1;
2377}
6b7be581 2378
38b051a1 2379int tls1_save_sigalgs(SSL_CONNECTION *s, PACKET *pkt, int cert)
9e84a42d
DSH		 2380{
2381 /* Extension ignored for inappropriate versions */
2382 if (!SSL_USE_SIGALGS(s))
2383 return 1;
2384 /* Should never happen */
2385 if (s->cert == NULL)
2386 return 0;
2387
c589c34e 2388 if (cert)
555cbb32
TS		 2389 return tls1_save_u16(pkt, &s->s3.tmp.peer_cert_sigalgs,
2390 &s->s3.tmp.peer_cert_sigalgslen);
c589c34e 2391 else
555cbb32
TS		 2392 return tls1_save_u16(pkt, &s->s3.tmp.peer_sigalgs,
2393 &s->s3.tmp.peer_sigalgslen);
9e84a42d 2394
9e84a42d
DSH		 2395}
2396
2397/* Set preferred digest for each key type */
2398
38b051a1 2399int tls1_process_sigalgs(SSL_CONNECTION *s)
0f113f3e 2400{
0f113f3e 2401 size_t i;
555cbb32 2402 uint32_t *pvalid = s->s3.tmp.valid_flags;
4d43ee28 2403
0f113f3e
MC		 2404 if (!tls1_set_shared_sigalgs(s))
2405 return 0;
2406
9195ddcd
DSH		 2407 for (i = 0; i < SSL_PKEY_NUM; i++)
2408 pvalid[i] = 0;
2409
29948ac8
BK		 2410 for (i = 0; i < s->shared_sigalgslen; i++) {
2411 const SIGALG_LOOKUP *sigptr = s->shared_sigalgs[i];
9195ddcd 2412 int idx = sigptr->sig_idx;
4d43ee28 2413
523fb323 2414 /* Ignore PKCS1 based sig algs in TLSv1.3 */
38b051a1 2415 if (SSL_CONNECTION_IS_TLS13(s) && sigptr->sig == EVP_PKEY_RSA)
523fb323 2416 continue;
9195ddcd 2417 /* If not disabled indicate we can explicitly sign */
38b051a1
TM		 2418 if (pvalid[idx] == 0
2419 && !ssl_cert_is_disabled(SSL_CONNECTION_GET_CTX(s), idx))
b8858aec 2420 pvalid[idx] = CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
0f113f3e
MC		 2421 }
2422 return 1;
2423}
4817504d 2424
e7f8ff43 2425int SSL_get_sigalgs(SSL *s, int idx,
0f113f3e
MC		 2426 int *psign, int *phash, int *psignhash,
2427 unsigned char *rsig, unsigned char *rhash)
2428{
38b051a1
TM		 2429 uint16_t *psig;
2430 size_t numsigalgs;
2431 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2432
2433 if (sc == NULL)
2434 return 0;
2435
2436 psig = sc->s3.tmp.peer_sigalgs;
2437 numsigalgs = sc->s3.tmp.peer_sigalgslen;
2438
348240c6 2439 if (psig == NULL || numsigalgs > INT_MAX)
0f113f3e
MC		 2440 return 0;
2441 if (idx >= 0) {
4d43ee28
DSH		 2442 const SIGALG_LOOKUP *lu;
2443
703bcee0 2444 if (idx >= (int)numsigalgs)
0f113f3e
MC		 2445 return 0;
2446 psig += idx;
4d43ee28 2447 if (rhash != NULL)
536199ec 2448 *rhash = (unsigned char)((*psig >> 8) & 0xff);
4d43ee28 2449 if (rsig != NULL)
536199ec 2450 *rsig = (unsigned char)(*psig & 0xff);
38b051a1 2451 lu = tls1_lookup_sigalg(sc, *psig);
4d43ee28
DSH		 2452 if (psign != NULL)
2453 *psign = lu != NULL ? lu->sig : NID_undef;
2454 if (phash != NULL)
2455 *phash = lu != NULL ? lu->hash : NID_undef;
2456 if (psignhash != NULL)
2457 *psignhash = lu != NULL ? lu->sigandhash : NID_undef;
0f113f3e 2458 }
348240c6 2459 return (int)numsigalgs;
0f113f3e 2460}
4453cd8c
DSH		 2461
2462int SSL_get_shared_sigalgs(SSL *s, int idx,
0f113f3e
MC		 2463 int *psign, int *phash, int *psignhash,
2464 unsigned char *rsig, unsigned char *rhash)
2465{
4d43ee28 2466 const SIGALG_LOOKUP *shsigalgs;
38b051a1
TM		 2467 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2468
2469 if (sc == NULL)
2470 return 0;
2471
2472 if (sc->shared_sigalgs == NULL
6d047e06 2473 || idx < 0
38b051a1
TM		 2474 || idx >= (int)sc->shared_sigalgslen
2475 || sc->shared_sigalgslen > INT_MAX)
0f113f3e 2476 return 0;
38b051a1 2477 shsigalgs = sc->shared_sigalgs[idx];
4d43ee28
DSH		 2478 if (phash != NULL)
2479 *phash = shsigalgs->hash;
2480 if (psign != NULL)
2481 *psign = shsigalgs->sig;
2482 if (psignhash != NULL)
2483 *psignhash = shsigalgs->sigandhash;
2484 if (rsig != NULL)
2485 *rsig = (unsigned char)(shsigalgs->sigalg & 0xff);
2486 if (rhash != NULL)
2487 *rhash = (unsigned char)((shsigalgs->sigalg >> 8) & 0xff);
38b051a1 2488 return (int)sc->shared_sigalgslen;
0f113f3e
MC		 2489}
2490
787ebcaf
DSH		 2491/* Maximum possible number of unique entries in sigalgs array */
2492#define TLS_MAX_SIGALGCNT (OSSL_NELEM(sigalg_lookup_tbl) * 2)
0f229cce 2493
0f113f3e
MC		 2494typedef struct {
2495 size_t sigalgcnt;
fd5e1a8c
BK		 2496 /* TLSEXT_SIGALG_XXX values */
2497 uint16_t sigalgs[TLS_MAX_SIGALGCNT];
0f113f3e 2498} sig_cb_st;
0f229cce 2499
431f458d
DSH		 2500static void get_sigorhash(int *psig, int *phash, const char *str)
2501{
2502 if (strcmp(str, "RSA") == 0) {
2503 *psig = EVP_PKEY_RSA;
b2eb6998
DSH		 2504 } else if (strcmp(str, "RSA-PSS") == 0 || strcmp(str, "PSS") == 0) {
2505 *psig = EVP_PKEY_RSA_PSS;
431f458d
DSH		 2506 } else if (strcmp(str, "DSA") == 0) {
2507 *psig = EVP_PKEY_DSA;
2508 } else if (strcmp(str, "ECDSA") == 0) {
2509 *psig = EVP_PKEY_EC;
2510 } else {
2511 *phash = OBJ_sn2nid(str);
2512 if (*phash == NID_undef)
2513 *phash = OBJ_ln2nid(str);
2514 }
2515}
787ebcaf
DSH		 2516/* Maximum length of a signature algorithm string component */
2517#define TLS_MAX_SIGSTRING_LEN 40
431f458d 2518
0f229cce 2519static int sig_cb(const char *elem, int len, void *arg)
0f113f3e
MC		 2520{
2521 sig_cb_st *sarg = arg;
2522 size_t i;
fd5e1a8c 2523 const SIGALG_LOOKUP *s;
787ebcaf 2524 char etmp[TLS_MAX_SIGSTRING_LEN], *p;
431f458d 2525 int sig_alg = NID_undef, hash_alg = NID_undef;
2747d73c
KR		 2526 if (elem == NULL)
2527 return 0;
787ebcaf 2528 if (sarg->sigalgcnt == TLS_MAX_SIGALGCNT)
0f113f3e
MC		 2529 return 0;
2530 if (len > (int)(sizeof(etmp) - 1))
2531 return 0;
2532 memcpy(etmp, elem, len);
2533 etmp[len] = 0;
2534 p = strchr(etmp, '+');
fd5e1a8c
BK		 2535 /*
2536 * We only allow SignatureSchemes listed in the sigalg_lookup_tbl;
2537 * if there's no '+' in the provided name, look for the new-style combined
2538 * name. If not, match both sig+hash to find the needed SIGALG_LOOKUP.
2539 * Just sig+hash is not unique since TLS 1.3 adds rsa_pss_pss_* and
2540 * rsa_pss_rsae_* that differ only by public key OID; in such cases
2541 * we will pick the _rsae_ variant, by virtue of them appearing earlier
2542 * in the table.
2543 */
8a43a42a 2544 if (p == NULL) {
8a43a42a
DSH		 2545 for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl);
2546 i++, s++) {
2547 if (s->name != NULL && strcmp(etmp, s->name) == 0) {
fd5e1a8c 2548 sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg;
8a43a42a
DSH		 2549 break;
2550 }
2551 }
fd5e1a8c
BK		 2552 if (i == OSSL_NELEM(sigalg_lookup_tbl))
2553 return 0;
8a43a42a
DSH		 2554 } else {
2555 *p = 0;
2556 p++;
2557 if (*p == 0)
2558 return 0;
2559 get_sigorhash(&sig_alg, &hash_alg, etmp);
2560 get_sigorhash(&sig_alg, &hash_alg, p);
fd5e1a8c
BK		 2561 if (sig_alg == NID_undef || hash_alg == NID_undef)
2562 return 0;
2563 for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl);
2564 i++, s++) {
2565 if (s->hash == hash_alg && s->sig == sig_alg) {
2566 sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg;
2567 break;
2568 }
2569 }
2570 if (i == OSSL_NELEM(sigalg_lookup_tbl))
2571 return 0;
8a43a42a 2572 }
0f113f3e 2573
fd5e1a8c
BK		 2574 /* Reject duplicates */
2575 for (i = 0; i < sarg->sigalgcnt - 1; i++) {
c1acef92 2576 if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt - 1]) {
fd5e1a8c 2577 sarg->sigalgcnt--;
0f113f3e 2578 return 0;
fd5e1a8c 2579 }
0f113f3e 2580 }
0f113f3e
MC		 2581 return 1;
2582}
2583
2584/*
9d22666e 2585 * Set supported signature algorithms based on a colon separated list of the
0f113f3e
MC		 2586 * form sig+hash e.g. RSA+SHA512:DSA+SHA512
2587 */
3dbc46df 2588int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
0f113f3e
MC		 2589{
2590 sig_cb_st sig;
2591 sig.sigalgcnt = 0;
2592 if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
2593 return 0;
2594 if (c == NULL)
2595 return 1;
fd5e1a8c
BK		 2596 return tls1_set_raw_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
2597}
2598
2599int tls1_set_raw_sigalgs(CERT *c, const uint16_t *psigs, size_t salglen,
2600 int client)
2601{
2602 uint16_t *sigalgs;
2603
cdb10bae 2604 if ((sigalgs = OPENSSL_malloc(salglen * sizeof(*sigalgs))) == NULL) {
6849b73c 2605 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
fd5e1a8c 2606 return 0;
cdb10bae 2607 }
fd5e1a8c
BK		 2608 memcpy(sigalgs, psigs, salglen * sizeof(*sigalgs));
2609
2610 if (client) {
2611 OPENSSL_free(c->client_sigalgs);
2612 c->client_sigalgs = sigalgs;
2613 c->client_sigalgslen = salglen;
2614 } else {
2615 OPENSSL_free(c->conf_sigalgs);
2616 c->conf_sigalgs = sigalgs;
2617 c->conf_sigalgslen = salglen;
2618 }
2619
2620 return 1;
0f113f3e
MC		 2621}
2622
a230b26e 2623int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
0f113f3e 2624{
98c792d1 2625 uint16_t *sigalgs, *sptr;
0f113f3e 2626 size_t i;
63c1df09 2627
0f113f3e
MC		 2628 if (salglen & 1)
2629 return 0;
cdb10bae 2630 if ((sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs))) == NULL) {
6849b73c 2631 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
0f113f3e 2632 return 0;
cdb10bae 2633 }
0f113f3e 2634 for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
63c1df09 2635 size_t j;
7a531ee4 2636 const SIGALG_LOOKUP *curr;
63c1df09
MC		 2637 int md_id = *psig_nids++;
2638 int sig_id = *psig_nids++;
2639
2640 for (j = 0, curr = sigalg_lookup_tbl; j < OSSL_NELEM(sigalg_lookup_tbl);
2641 j++, curr++) {
fe3066ee 2642 if (curr->hash == md_id && curr->sig == sig_id) {
63c1df09
MC		 2643 *sptr++ = curr->sigalg;
2644 break;
2645 }
2646 }
0f113f3e 2647
63c1df09 2648 if (j == OSSL_NELEM(sigalg_lookup_tbl))
0f113f3e 2649 goto err;
0f113f3e
MC		 2650 }
2651
2652 if (client) {
b548a1f1 2653 OPENSSL_free(c->client_sigalgs);
0f113f3e 2654 c->client_sigalgs = sigalgs;
7a531ee4 2655 c->client_sigalgslen = salglen / 2;
0f113f3e 2656 } else {
b548a1f1 2657 OPENSSL_free(c->conf_sigalgs);
0f113f3e 2658 c->conf_sigalgs = sigalgs;
7a531ee4 2659 c->conf_sigalgslen = salglen / 2;
0f113f3e
MC		 2660 }
2661
2662 return 1;
2663
2664 err:
2665 OPENSSL_free(sigalgs);
2666 return 0;
2667}
4453cd8c 2668
38b051a1 2669static int tls1_check_sig_alg(SSL_CONNECTION *s, X509 *x, int default_nid)
0f113f3e 2670{
5235ef44 2671 int sig_nid, use_pc_sigalgs = 0;
0f113f3e 2672 size_t i;
5235ef44
MC		 2673 const SIGALG_LOOKUP *sigalg;
2674 size_t sigalgslen;
38b051a1 2675
0f113f3e
MC		 2676 if (default_nid == -1)
2677 return 1;
2678 sig_nid = X509_get_signature_nid(x);
2679 if (default_nid)
2680 return sig_nid == default_nid ? 1 : 0;
5235ef44 2681
38b051a1 2682 if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.peer_cert_sigalgs != NULL) {
5235ef44
MC		 2683 /*
2684 * If we're in TLSv1.3 then we only get here if we're checking the
2685 * chain. If the peer has specified peer_cert_sigalgs then we use them
2686 * otherwise we default to normal sigalgs.
2687 */
2688 sigalgslen = s->s3.tmp.peer_cert_sigalgslen;
2689 use_pc_sigalgs = 1;
2690 } else {
2691 sigalgslen = s->shared_sigalgslen;
2692 }
2693 for (i = 0; i < sigalgslen; i++) {
2694 sigalg = use_pc_sigalgs
263ff2c9 2695 ? tls1_lookup_sigalg(s, s->s3.tmp.peer_cert_sigalgs[i])
5235ef44 2696 : s->shared_sigalgs[i];
a87f3fe0 2697 if (sigalg != NULL && sig_nid == sigalg->sigandhash)
0f113f3e 2698 return 1;
5235ef44 2699 }
0f113f3e
MC		 2700 return 0;
2701}
2702
6dbb6219
DSH		 2703/* Check to see if a certificate issuer name matches list of CA names */
2704static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
0f113f3e 2705{
8cc86b81 2706 const X509_NAME *nm;
0f113f3e
MC		 2707 int i;
2708 nm = X509_get_issuer_name(x);
2709 for (i = 0; i < sk_X509_NAME_num(names); i++) {
2710 if (!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
2711 return 1;
2712 }
2713 return 0;
2714}
2715
2716/*
2717 * Check certificate chain is consistent with TLS extensions and is usable by
2718 * server. This servers two purposes: it allows users to check chains before
2719 * passing them to the server and it allows the server to check chains before
2720 * attempting to use them.
d61ff83b 2721 */
6dbb6219 2722
69687aa8 2723/* Flags which need to be set for a certificate when strict mode not set */
6dbb6219 2724
e481f9b9 2725#define CERT_PKEY_VALID_FLAGS \
0f113f3e 2726 (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
6dbb6219 2727/* Strict mode flags */
e481f9b9 2728#define CERT_PKEY_STRICT_FLAGS \
0f113f3e
MC		 2729 (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
2730 | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
6dbb6219 2731
38b051a1
TM		 2732int tls1_check_chain(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pk,
2733 STACK_OF(X509) *chain, int idx)
0f113f3e
MC		 2734{
2735 int i;
2736 int rv = 0;
2737 int check_flags = 0, strict_mode;
2738 CERT_PKEY *cpk = NULL;
2739 CERT *c = s->cert;
f7d53487 2740 uint32_t *pvalid;
0f113f3e 2741 unsigned int suiteb_flags = tls1_suiteb(s);
38b051a1 2742
0f113f3e
MC		 2743 /* idx == -1 means checking server chains */
2744 if (idx != -1) {
2745 /* idx == -2 means checking client certificate chains */
2746 if (idx == -2) {
2747 cpk = c->key;
348240c6 2748 idx = (int)(cpk - c->pkeys);
0f113f3e
MC		 2749 } else
2750 cpk = c->pkeys + idx;
555cbb32 2751 pvalid = s->s3.tmp.valid_flags + idx;
0f113f3e
MC		 2752 x = cpk->x509;
2753 pk = cpk->privatekey;
2754 chain = cpk->chain;
2755 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
2756 /* If no cert or key, forget it */
2757 if (!x || !pk)
2758 goto end;
0f113f3e 2759 } else {
52fd27f9
DSH		 2760 size_t certidx;
2761
0f113f3e 2762 if (!x || !pk)
d813f9eb 2763 return 0;
52fd27f9
DSH		 2764
2765 if (ssl_cert_lookup_by_pkey(pk, &certidx) == NULL)
d813f9eb 2766 return 0;
52fd27f9 2767 idx = certidx;
555cbb32 2768 pvalid = s->s3.tmp.valid_flags + idx;
6383d316 2769
0f113f3e
MC		 2770 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
2771 check_flags = CERT_PKEY_STRICT_FLAGS;
2772 else
2773 check_flags = CERT_PKEY_VALID_FLAGS;
2774 strict_mode = 1;
2775 }
2776
2777 if (suiteb_flags) {
2778 int ok;
2779 if (check_flags)
2780 check_flags |= CERT_PKEY_SUITEB;
2781 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
2782 if (ok == X509_V_OK)
2783 rv |= CERT_PKEY_SUITEB;
2784 else if (!check_flags)
2785 goto end;
2786 }
2787
2788 /*
2789 * Check all signature algorithms are consistent with signature
2790 * algorithms extension if TLS 1.2 or later and strict mode.
2791 */
38b051a1
TM		 2792 if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION
2793 && strict_mode) {
0f113f3e 2794 int default_nid;
536199ec 2795 int rsign = 0;
38b051a1 2796
555cbb32
TS		 2797 if (s->s3.tmp.peer_cert_sigalgs != NULL
2798 || s->s3.tmp.peer_sigalgs != NULL) {
0f113f3e
MC		 2799 default_nid = 0;
2800 /* If no sigalgs extension use defaults from RFC5246 */
c589c34e 2801 } else {
0f113f3e 2802 switch (idx) {
d0ff28f8 2803 case SSL_PKEY_RSA:
536199ec 2804 rsign = EVP_PKEY_RSA;
0f113f3e
MC		 2805 default_nid = NID_sha1WithRSAEncryption;
2806 break;
2807
2808 case SSL_PKEY_DSA_SIGN:
536199ec 2809 rsign = EVP_PKEY_DSA;
0f113f3e
MC		 2810 default_nid = NID_dsaWithSHA1;
2811 break;
2812
2813 case SSL_PKEY_ECC:
536199ec 2814 rsign = EVP_PKEY_EC;
0f113f3e
MC		 2815 default_nid = NID_ecdsa_with_SHA1;
2816 break;
2817
e44380a9 2818 case SSL_PKEY_GOST01:
536199ec 2819 rsign = NID_id_GostR3410_2001;
e44380a9
DB		 2820 default_nid = NID_id_GostR3411_94_with_GostR3410_2001;
2821 break;
2822
2823 case SSL_PKEY_GOST12_256:
536199ec 2824 rsign = NID_id_GostR3410_2012_256;
e44380a9
DB		 2825 default_nid = NID_id_tc26_signwithdigest_gost3410_2012_256;
2826 break;
2827
2828 case SSL_PKEY_GOST12_512:
536199ec 2829 rsign = NID_id_GostR3410_2012_512;
e44380a9
DB		 2830 default_nid = NID_id_tc26_signwithdigest_gost3410_2012_512;
2831 break;
2832
0f113f3e
MC		 2833 default:
2834 default_nid = -1;
2835 break;
2836 }
2837 }
2838 /*
2839 * If peer sent no signature algorithms extension and we have set
2840 * preferred signature algorithms check we support sha1.
2841 */
2842 if (default_nid > 0 && c->conf_sigalgs) {
2843 size_t j;
98c792d1 2844 const uint16_t *p = c->conf_sigalgs;
703bcee0 2845 for (j = 0; j < c->conf_sigalgslen; j++, p++) {
263ff2c9 2846 const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(s, *p);
44b6318f
DSH		 2847
2848 if (lu != NULL && lu->hash == NID_sha1 && lu->sig == rsign)
0f113f3e
MC		 2849 break;
2850 }
2851 if (j == c->conf_sigalgslen) {
2852 if (check_flags)
2853 goto skip_sigs;
2854 else
2855 goto end;
2856 }
2857 }
2858 /* Check signature algorithm of each cert in chain */
38b051a1 2859 if (SSL_CONNECTION_IS_TLS13(s)) {
5235ef44
MC		 2860 /*
2861 * We only get here if the application has called SSL_check_chain(),
2862 * so check_flags is always set.
2863 */
2864 if (find_sig_alg(s, x, pk) != NULL)
2865 rv |= CERT_PKEY_EE_SIGNATURE;
2866 } else if (!tls1_check_sig_alg(s, x, default_nid)) {
0f113f3e
MC		 2867 if (!check_flags)
2868 goto end;
2869 } else
2870 rv |= CERT_PKEY_EE_SIGNATURE;
2871 rv |= CERT_PKEY_CA_SIGNATURE;
2872 for (i = 0; i < sk_X509_num(chain); i++) {
29948ac8 2873 if (!tls1_check_sig_alg(s, sk_X509_value(chain, i), default_nid)) {
0f113f3e
MC		 2874 if (check_flags) {
2875 rv &= ~CERT_PKEY_CA_SIGNATURE;
2876 break;
2877 } else
2878 goto end;
2879 }
2880 }
2881 }
2882 /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
2883 else if (check_flags)
2884 rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE;
2885 skip_sigs:
2886 /* Check cert parameters are consistent */
9195ddcd 2887 if (tls1_check_cert_param(s, x, 1))
0f113f3e
MC		 2888 rv |= CERT_PKEY_EE_PARAM;
2889 else if (!check_flags)
2890 goto end;
2891 if (!s->server)
2892 rv |= CERT_PKEY_CA_PARAM;
2893 /* In strict mode check rest of chain too */
2894 else if (strict_mode) {
2895 rv |= CERT_PKEY_CA_PARAM;
2896 for (i = 0; i < sk_X509_num(chain); i++) {
2897 X509 *ca = sk_X509_value(chain, i);
2898 if (!tls1_check_cert_param(s, ca, 0)) {
2899 if (check_flags) {
2900 rv &= ~CERT_PKEY_CA_PARAM;
2901 break;
2902 } else
2903 goto end;
2904 }
2905 }
2906 }
2907 if (!s->server && strict_mode) {
2908 STACK_OF(X509_NAME) *ca_dn;
2909 int check_type = 0;
c2041da8
RL		 2910
2911 if (EVP_PKEY_is_a(pk, "RSA"))
0f113f3e 2912 check_type = TLS_CT_RSA_SIGN;
c2041da8 2913 else if (EVP_PKEY_is_a(pk, "DSA"))
0f113f3e 2914 check_type = TLS_CT_DSS_SIGN;
c2041da8 2915 else if (EVP_PKEY_is_a(pk, "EC"))
0f113f3e 2916 check_type = TLS_CT_ECDSA_SIGN;
c2041da8 2917
0f113f3e 2918 if (check_type) {
555cbb32 2919 const uint8_t *ctypes = s->s3.tmp.ctype;
75c13e78
DSH		 2920 size_t j;
2921
555cbb32 2922 for (j = 0; j < s->s3.tmp.ctype_len; j++, ctypes++) {
75c13e78 2923 if (*ctypes == check_type) {
0f113f3e
MC		 2924 rv |= CERT_PKEY_CERT_TYPE;
2925 break;
2926 }
2927 }
2928 if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
2929 goto end;
75c13e78 2930 } else {
0f113f3e 2931 rv |= CERT_PKEY_CERT_TYPE;
75c13e78 2932 }
0f113f3e 2933
555cbb32 2934 ca_dn = s->s3.tmp.peer_ca_names;
0f113f3e 2935
89dd8543
TM		 2936 if (ca_dn == NULL
2937 || sk_X509_NAME_num(ca_dn) == 0
2938 || ssl_check_ca_name(ca_dn, x))
0f113f3e 2939 rv |= CERT_PKEY_ISSUER_NAME;
89dd8543 2940 else
0f113f3e
MC		 2941 for (i = 0; i < sk_X509_num(chain); i++) {
2942 X509 *xtmp = sk_X509_value(chain, i);
89dd8543 2943
0f113f3e
MC		 2944 if (ssl_check_ca_name(ca_dn, xtmp)) {
2945 rv |= CERT_PKEY_ISSUER_NAME;
2946 break;
2947 }
2948 }
89dd8543 2949
0f113f3e
MC		 2950 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
2951 goto end;
2952 } else
2953 rv |= CERT_PKEY_ISSUER_NAME | CERT_PKEY_CERT_TYPE;
2954
2955 if (!check_flags || (rv & check_flags) == check_flags)
2956 rv |= CERT_PKEY_VALID;
2957
2958 end:
2959
38b051a1 2960 if (TLS1_get_version(SSL_CONNECTION_GET_SSL(s)) >= TLS1_2_VERSION)
a8bb912d
DSH		 2961 rv |= *pvalid & (CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN);
2962 else
0f113f3e
MC		 2963 rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN;
2964
2965 /*
2966 * When checking a CERT_PKEY structure all flags are irrelevant if the
2967 * chain is invalid.
2968 */
2969 if (!check_flags) {
a8bb912d 2970 if (rv & CERT_PKEY_VALID) {
6383d316 2971 *pvalid = rv;
a8bb912d
DSH		 2972 } else {
2973 /* Preserve sign and explicit sign flag, clear rest */
2974 *pvalid &= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
0f113f3e
MC		 2975 return 0;
2976 }
2977 }
2978 return rv;
2979}
d61ff83b
DSH		 2980
2981/* Set validity of certificates in an SSL structure */
38b051a1 2982void tls1_set_cert_validity(SSL_CONNECTION *s)
0f113f3e 2983{
d0ff28f8 2984 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA);
045d078a 2985 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_PSS_SIGN);
17dd65e6 2986 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
17dd65e6 2987 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
e44380a9
DB		 2988 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST01);
2989 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_256);
2990 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_GOST12_512);
3d234c9e 2991 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED25519);
0e1d6ecf 2992 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ED448);
0f113f3e
MC		 2993}
2994
69687aa8 2995/* User level utility function to check a chain is suitable */
18d71588 2996int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
0f113f3e 2997{
38b051a1
TM		 2998 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2999
3000 if (sc == NULL)
3001 return 0;
3002
3003 return tls1_check_chain(sc, x, pk, chain, -1);
0f113f3e 3004}
d61ff83b 3005
38b051a1 3006EVP_PKEY *ssl_get_auto_dh(SSL_CONNECTION *s)
0f113f3e 3007{
091f6074
MC		 3008 EVP_PKEY *dhp = NULL;
3009 BIGNUM *p;
d7b5c648 3010 int dh_secbits = 80, sec_level_bits;
091f6074
MC		 3011 EVP_PKEY_CTX *pctx = NULL;
3012 OSSL_PARAM_BLD *tmpl = NULL;
3013 OSSL_PARAM *params = NULL;
38b051a1 3014 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
091f6074 3015
7646610b
HK		 3016 if (s->cert->dh_tmp_auto != 2) {
3017 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aPSK)) {
3018 if (s->s3.tmp.new_cipher->strength_bits == 256)
3019 dh_secbits = 128;
3020 else
3021 dh_secbits = 80;
3022 } else {
3023 if (s->s3.tmp.cert == NULL)
3024 return NULL;
ed576acd 3025 dh_secbits = EVP_PKEY_get_security_bits(s->s3.tmp.cert->privatekey);
7646610b 3026 }
0f113f3e
MC		 3027 }
3028
d7b5c648 3029 /* Do not pick a prime that is too weak for the current security level */
38b051a1
TM		 3030 sec_level_bits = ssl_get_security_level_bits(SSL_CONNECTION_GET_SSL(s),
3031 NULL, NULL);
d7b5c648
P		 3032 if (dh_secbits < sec_level_bits)
3033 dh_secbits = sec_level_bits;
3034
7646610b
HK		 3035 if (dh_secbits >= 192)
3036 p = BN_get_rfc3526_prime_8192(NULL);
3037 else if (dh_secbits >= 152)
3038 p = BN_get_rfc3526_prime_4096(NULL);
3039 else if (dh_secbits >= 128)
3040 p = BN_get_rfc3526_prime_3072(NULL);
3041 else if (dh_secbits >= 112)
3042 p = BN_get_rfc3526_prime_2048(NULL);
3043 else
3044 p = BN_get_rfc2409_prime_1024(NULL);
091f6074
MC		 3045 if (p == NULL)
3046 goto err;
3047
38b051a1 3048 pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq);
091f6074 3049 if (pctx == NULL
2db985b7 3050 || EVP_PKEY_fromdata_init(pctx) != 1)
091f6074
MC		 3051 goto err;
3052
3053 tmpl = OSSL_PARAM_BLD_new();
3054 if (tmpl == NULL
3055 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)
3056 || !OSSL_PARAM_BLD_push_uint(tmpl, OSSL_PKEY_PARAM_FFC_G, 2))
3057 goto err;
3058
3059 params = OSSL_PARAM_BLD_to_param(tmpl);
2db985b7
SL		 3060 if (params == NULL
3061 || EVP_PKEY_fromdata(pctx, &dhp, EVP_PKEY_KEY_PARAMETERS, params) != 1)
091f6074
MC		 3062 goto err;
3063
3064err:
3f883c7c 3065 OSSL_PARAM_free(params);
091f6074
MC		 3066 OSSL_PARAM_BLD_free(tmpl);
3067 EVP_PKEY_CTX_free(pctx);
3068 BN_free(p);
7646610b 3069 return dhp;
0f113f3e 3070}
b362ccab 3071
38b051a1
TM		 3072static int ssl_security_cert_key(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
3073 int op)
0f113f3e 3074{
72245f34 3075 int secbits = -1;
8382fd3a 3076 EVP_PKEY *pkey = X509_get0_pubkey(x);
38b051a1 3077
0f113f3e 3078 if (pkey) {
72245f34
DSH		 3079 /*
3080 * If no parameters this will return -1 and fail using the default
3081 * security callback for any non-zero security level. This will
3082 * reject keys which omit parameters but this only affects DSA and
3083 * omission of parameters is never (?) done in practice.
3084 */
ed576acd 3085 secbits = EVP_PKEY_get_security_bits(pkey);
72245f34 3086 }
38b051a1 3087 if (s != NULL)
0f113f3e
MC		 3088 return ssl_security(s, op, secbits, 0, x);
3089 else
3090 return ssl_ctx_security(ctx, op, secbits, 0, x);
3091}
b362ccab 3092
38b051a1
TM		 3093static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x,
3094 int op)
0f113f3e
MC		 3095{
3096 /* Lookup signature algorithm digest */
65e89736 3097 int secbits, nid, pknid;
38b051a1 3098
221c7b55
DSH		 3099 /* Don't check signature if self signed */
3100 if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)
3101 return 1;
65e89736
DSH		 3102 if (!X509_get_signature_info(x, &nid, &pknid, &secbits, NULL))
3103 secbits = -1;
3104 /* If digest NID not defined use signature NID */
3105 if (nid == NID_undef)
3106 nid = pknid;
38b051a1 3107 if (s != NULL)
65e89736 3108 return ssl_security(s, op, secbits, nid, x);
0f113f3e 3109 else
65e89736 3110 return ssl_ctx_security(ctx, op, secbits, nid, x);
0f113f3e 3111}
b362ccab 3112
38b051a1
TM		 3113int ssl_security_cert(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, int vfy,
3114 int is_ee)
0f113f3e
MC		 3115{
3116 if (vfy)
3117 vfy = SSL_SECOP_PEER;
3118 if (is_ee) {
3119 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
3120 return SSL_R_EE_KEY_TOO_SMALL;
3121 } else {
3122 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
3123 return SSL_R_CA_KEY_TOO_SMALL;
3124 }
3125 if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
3126 return SSL_R_CA_MD_TOO_WEAK;
3127 return 1;
3128}
3129
3130/*
69687aa8
F		 3131 * Check security of a chain, if |sk| includes the end entity certificate then
3132 * |x| is NULL. If |vfy| is 1 then we are verifying a peer chain and not sending
0f113f3e 3133 * one to the peer. Return values: 1 if ok otherwise error code to use
b362ccab
DSH		 3134 */
3135
38b051a1
TM		 3136int ssl_security_cert_chain(SSL_CONNECTION *s, STACK_OF(X509) *sk,
3137 X509 *x, int vfy)
0f113f3e
MC		 3138{
3139 int rv, start_idx, i;
38b051a1 3140
0f113f3e
MC		 3141 if (x == NULL) {
3142 x = sk_X509_value(sk, 0);
dc0ef292
BE		 3143 if (x == NULL)
3144 return ERR_R_INTERNAL_ERROR;
0f113f3e
MC		 3145 start_idx = 1;
3146 } else
3147 start_idx = 0;
3148
3149 rv = ssl_security_cert(s, NULL, x, vfy, 1);
3150 if (rv != 1)
3151 return rv;
3152
3153 for (i = start_idx; i < sk_X509_num(sk); i++) {
3154 x = sk_X509_value(sk, i);
3155 rv = ssl_security_cert(s, NULL, x, vfy, 0);
3156 if (rv != 1)
3157 return rv;
3158 }
3159 return 1;
3160}
93a77f9e 3161
7f6b466b
DSH		 3162/*
3163 * For TLS 1.2 servers check if we have a certificate which can be used
b46867d7 3164 * with the signature algorithm "lu" and return index of certificate.
7f6b466b
DSH		 3165 */
3166
38b051a1
TM		 3167static int tls12_get_cert_sigalg_idx(const SSL_CONNECTION *s,
3168 const SIGALG_LOOKUP *lu)
7f6b466b 3169{
b46867d7
DSH		 3170 int sig_idx = lu->sig_idx;
3171 const SSL_CERT_LOOKUP *clu = ssl_cert_lookup_by_idx(sig_idx);
7f6b466b
DSH		 3172
3173 /* If not recognised or not supported by cipher mask it is not suitable */
b8fef8ee 3174 if (clu == NULL
555cbb32 3175 || (clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0
b8fef8ee 3176 || (clu->nid == EVP_PKEY_RSA_PSS
555cbb32 3177 && (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kRSA) != 0))
b46867d7
DSH		 3178 return -1;
3179
555cbb32 3180 return s->s3.tmp.valid_flags[sig_idx] & CERT_PKEY_VALID ? sig_idx : -1;
7f6b466b
DSH		 3181}
3182
c589c34e 3183/*
5235ef44
MC		 3184 * Checks the given cert against signature_algorithm_cert restrictions sent by
3185 * the peer (if any) as well as whether the hash from the sigalg is usable with
3186 * the key.
3187 * Returns true if the cert is usable and false otherwise.
c589c34e 3188 */
38b051a1
TM		 3189static int check_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig,
3190 X509 *x, EVP_PKEY *pkey)
c589c34e
BK		 3191{
3192 const SIGALG_LOOKUP *lu;
ecbb2fca 3193 int mdnid, pknid, supported;
c589c34e 3194 size_t i;
e9fe0f7e 3195 const char *mdname = NULL;
38b051a1 3196 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
c589c34e 3197
b5a27688 3198 /*
e9fe0f7e 3199 * If the given EVP_PKEY cannot support signing with this digest,
b5a27688
DW		 3200 * the answer is simply 'no'.
3201 */
e9fe0f7e
TM		 3202 if (sig->hash != NID_undef)
3203 mdname = OBJ_nid2sn(sig->hash);
38b051a1 3204 supported = EVP_PKEY_digestsign_supports_digest(pkey, sctx->libctx,
e9fe0f7e 3205 mdname,
38b051a1 3206 sctx->propq);
e9fe0f7e 3207 if (supported <= 0)
b5a27688
DW		 3208 return 0;
3209
3210 /*
3211 * The TLS 1.3 signature_algorithms_cert extension places restrictions
3212 * on the sigalg with which the certificate was signed (by its issuer).
3213 */
555cbb32 3214 if (s->s3.tmp.peer_cert_sigalgs != NULL) {
b5a27688
DW		 3215 if (!X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL))
3216 return 0;
555cbb32 3217 for (i = 0; i < s->s3.tmp.peer_cert_sigalgslen; i++) {
263ff2c9 3218 lu = tls1_lookup_sigalg(s, s->s3.tmp.peer_cert_sigalgs[i]);
b5a27688 3219 if (lu == NULL)
c589c34e 3220 continue;
ecbb2fca 3221
5235ef44 3222 /*
407820c0 3223 * This does not differentiate between the
b5a27688
DW		 3224 * rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
3225 * have a chain here that lets us look at the key OID in the
3226 * signing certificate.
5235ef44 3227 */
b5a27688
DW		 3228 if (mdnid == lu->hash && pknid == lu->sig)
3229 return 1;
c589c34e
BK		 3230 }
3231 return 0;
3232 }
b5a27688 3233
5235ef44 3234 /*
b5a27688
DW		 3235 * Without signat_algorithms_cert, any certificate for which we have
3236 * a viable public key is permitted.
5235ef44 3237 */
ecbb2fca 3238 return 1;
c589c34e
BK		 3239}
3240
5235ef44
MC		 3241/*
3242 * Returns true if |s| has a usable certificate configured for use
3243 * with signature scheme |sig|.
3244 * "Usable" includes a check for presence as well as applying
3245 * the signature_algorithm_cert restrictions sent by the peer (if any).
3246 * Returns false if no usable certificate is found.
3247 */
38b051a1 3248static int has_usable_cert(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, int idx)
5235ef44
MC		 3249{
3250 /* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */
3251 if (idx == -1)
3252 idx = sig->sig_idx;
3253 if (!ssl_has_cert(s, idx))
3254 return 0;
3255
3256 return check_cert_usable(s, sig, s->cert->pkeys[idx].x509,
3257 s->cert->pkeys[idx].privatekey);
3258}
3259
3260/*
3261 * Returns true if the supplied cert |x| and key |pkey| is usable with the
3262 * specified signature scheme |sig|, or false otherwise.
3263 */
38b051a1 3264static int is_cert_usable(SSL_CONNECTION *s, const SIGALG_LOOKUP *sig, X509 *x,
5235ef44
MC		 3265 EVP_PKEY *pkey)
3266{
3267 size_t idx;
3268
3269 if (ssl_cert_lookup_by_pkey(pkey, &idx) == NULL)
3270 return 0;
3271
3272 /* Check the key is consistent with the sig alg */
3273 if ((int)idx != sig->sig_idx)
3274 return 0;
3275
3276 return check_cert_usable(s, sig, x, pkey);
3277}
3278
3279/*
3280 * Find a signature scheme that works with the supplied certificate |x| and key
3281 * |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our
3282 * available certs/keys to find one that works.
3283 */
38b051a1
TM		 3284static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x,
3285 EVP_PKEY *pkey)
5235ef44
MC		 3286{
3287 const SIGALG_LOOKUP *lu = NULL;
3288 size_t i;
5235ef44 3289 int curve = -1;
5235ef44 3290 EVP_PKEY *tmppkey;
38b051a1 3291 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
5235ef44
MC		 3292
3293 /* Look for a shared sigalgs matching possible certificates */
3294 for (i = 0; i < s->shared_sigalgslen; i++) {
3295 lu = s->shared_sigalgs[i];
3296
3297 /* Skip SHA1, SHA224, DSA and RSA if not PSS */
3298 if (lu->hash == NID_sha1
3299 || lu->hash == NID_sha224
3300 || lu->sig == EVP_PKEY_DSA
3301 || lu->sig == EVP_PKEY_RSA)
3302 continue;
3303 /* Check that we have a cert, and signature_algorithms_cert */
38b051a1 3304 if (!tls1_lookup_md(sctx, lu, NULL))
5235ef44
MC		 3305 continue;
3306 if ((pkey == NULL && !has_usable_cert(s, lu, -1))
3307 || (pkey != NULL && !is_cert_usable(s, lu, x, pkey)))
3308 continue;
3309
3310 tmppkey = (pkey != NULL) ? pkey
3311 : s->cert->pkeys[lu->sig_idx].privatekey;
3312
3313 if (lu->sig == EVP_PKEY_EC) {
c2041da8 3314 if (curve == -1)
d8975dec 3315 curve = ssl_get_EC_curve_nid(tmppkey);
5235ef44
MC		 3316 if (lu->curve != NID_undef && curve != lu->curve)
3317 continue;
5235ef44
MC		 3318 } else if (lu->sig == EVP_PKEY_RSA_PSS) {
3319 /* validate that key is large enough for the signature algorithm */
38b051a1 3320 if (!rsa_pss_check_min_key_size(sctx, tmppkey, lu))
5235ef44
MC		 3321 continue;
3322 }
3323 break;
3324 }
3325
3326 if (i == s->shared_sigalgslen)
3327 return NULL;
3328
3329 return lu;
3330}
3331
93a77f9e
DSH		 3332/*
3333 * Choose an appropriate signature algorithm based on available certificates
717a265a
DSH		 3334 * Sets chosen certificate and signature algorithm.
3335 *
f63a17d6
MC		 3336 * For servers if we fail to find a required certificate it is a fatal error,
3337 * an appropriate error code is set and a TLS alert is sent.
717a265a 3338 *
f63a17d6 3339 * For clients fatalerrs is set to 0. If a certificate is not suitable it is not
717a265a
DSH		 3340 * a fatal error: we will either try another certificate or not present one
3341 * to the server. In this case no error is set.
93a77f9e 3342 */
38b051a1 3343int tls_choose_sigalg(SSL_CONNECTION *s, int fatalerrs)
93a77f9e 3344{
0972bc5c 3345 const SIGALG_LOOKUP *lu = NULL;
b46867d7 3346 int sig_idx = -1;
0972bc5c 3347
555cbb32
TS		 3348 s->s3.tmp.cert = NULL;
3349 s->s3.tmp.sigalg = NULL;
717a265a 3350
38b051a1 3351 if (SSL_CONNECTION_IS_TLS13(s)) {
5235ef44
MC		 3352 lu = find_sig_alg(s, NULL, NULL);
3353 if (lu == NULL) {
f63a17d6 3354 if (!fatalerrs)
717a265a 3355 return 1;
c48ffbcc 3356 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
f63a17d6 3357 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
0972bc5c
DSH		 3358 return 0;
3359 }
3360 } else {
7f6b466b 3361 /* If ciphersuite doesn't require a cert nothing to do */
555cbb32 3362 if (!(s->s3.tmp.new_cipher->algorithm_auth & SSL_aCERT))
7f6b466b
DSH		 3363 return 1;
3364 if (!s->server && !ssl_has_cert(s, s->cert->key - s->cert->pkeys))
717a265a 3365 return 1;
0972bc5c
DSH		 3366
3367 if (SSL_USE_SIGALGS(s)) {
c589c34e 3368 size_t i;
555cbb32 3369 if (s->s3.tmp.peer_sigalgs != NULL) {
c2041da8 3370 int curve = -1;
38b051a1 3371 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
599b586d
DSH		 3372
3373 /* For Suite B need to match signature algorithm to curve */
c2041da8 3374 if (tls1_suiteb(s))
d8975dec
RL		 3375 curve = ssl_get_EC_curve_nid(s->cert->pkeys[SSL_PKEY_ECC]
3376 .privatekey);
0972bc5c
DSH		 3377
3378 /*
3379 * Find highest preference signature algorithm matching
3380 * cert type
3381 */
29948ac8
BK		 3382 for (i = 0; i < s->shared_sigalgslen; i++) {
3383 lu = s->shared_sigalgs[i];
7f6b466b
DSH		 3384
3385 if (s->server) {
b46867d7 3386 if ((sig_idx = tls12_get_cert_sigalg_idx(s, lu)) == -1)
7f6b466b 3387 continue;
b46867d7
DSH		 3388 } else {
3389 int cc_idx = s->cert->key - s->cert->pkeys;
3390
3391 sig_idx = lu->sig_idx;
c589c34e
BK		 3392 if (cc_idx != sig_idx)
3393 continue;
b2021556 3394 }
c589c34e
BK		 3395 /* Check that we have a cert, and sig_algs_cert */
3396 if (!has_usable_cert(s, lu, sig_idx))
3397 continue;
0fe3db25
NR		 3398 if (lu->sig == EVP_PKEY_RSA_PSS) {
3399 /* validate that key is large enough for the signature algorithm */
bcec0b94 3400 EVP_PKEY *pkey = s->cert->pkeys[sig_idx].privatekey;
0fe3db25 3401
38b051a1 3402 if (!rsa_pss_check_min_key_size(sctx, pkey, lu))
0fe3db25
NR		 3403 continue;
3404 }
7f6b466b 3405 if (curve == -1 || lu->curve == curve)
0972bc5c
DSH		 3406 break;
3407 }
db30f432
DB		 3408#ifndef OPENSSL_NO_GOST
3409 /*
3410 * Some Windows-based implementations do not send GOST algorithms indication
3411 * in supported_algorithms extension, so when we have GOST-based ciphersuite,
3412 * we have to assume GOST support.
3413 */
38b051a1
TM		 3414 if (i == s->shared_sigalgslen
3415 && (s->s3.tmp.new_cipher->algorithm_auth
3416 & (SSL_aGOST01 | SSL_aGOST12)) != 0) {
db30f432
DB		 3417 if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
3418 if (!fatalerrs)
3419 return 1;
3420 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
db30f432
DB		 3421 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
3422 return 0;
3423 } else {
3424 i = 0;
3425 sig_idx = lu->sig_idx;
3426 }
3427 }
3428#endif
29948ac8 3429 if (i == s->shared_sigalgslen) {
f63a17d6 3430 if (!fatalerrs)
717a265a 3431 return 1;
b8fef8ee 3432 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
b8fef8ee 3433 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
0972bc5c
DSH		 3434 return 0;
3435 }
3436 } else {
3437 /*
3438 * If we have no sigalg use defaults
3439 */
3440 const uint16_t *sent_sigs;
c589c34e 3441 size_t sent_sigslen;
0972bc5c 3442
7f6b466b 3443 if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
f63a17d6 3444 if (!fatalerrs)
717a265a 3445 return 1;
b4f1b7b6 3446 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
a70535f8 3447 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
0972bc5c
DSH		 3448 return 0;
3449 }
3450
3451 /* Check signature matches a type we sent */
3452 sent_sigslen = tls12_get_psigalgs(s, 1, &sent_sigs);
3453 for (i = 0; i < sent_sigslen; i++, sent_sigs++) {
c589c34e
BK		 3454 if (lu->sigalg == *sent_sigs
3455 && has_usable_cert(s, lu, lu->sig_idx))
0972bc5c
DSH		 3456 break;
3457 }
3458 if (i == sent_sigslen) {
f63a17d6 3459 if (!fatalerrs)
717a265a 3460 return 1;
b4f1b7b6 3461 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
f63a17d6 3462 SSL_R_WRONG_SIGNATURE_TYPE);
0972bc5c
DSH		 3463 return 0;
3464 }
3465 }
3466 } else {
7f6b466b 3467 if ((lu = tls1_get_legacy_sigalg(s, -1)) == NULL) {
f63a17d6 3468 if (!fatalerrs)
717a265a 3469 return 1;
c48ffbcc 3470 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
a70535f8 3471 SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
0972bc5c
DSH		 3472 return 0;
3473 }
3474 }
93a77f9e 3475 }
b46867d7
DSH		 3476 if (sig_idx == -1)
3477 sig_idx = lu->sig_idx;
555cbb32
TS		 3478 s->s3.tmp.cert = &s->cert->pkeys[sig_idx];
3479 s->cert->key = s->s3.tmp.cert;
3480 s->s3.tmp.sigalg = lu;
93a77f9e
DSH		 3481 return 1;
3482}
cf72c757
F		 3483
3484int SSL_CTX_set_tlsext_max_fragment_length(SSL_CTX *ctx, uint8_t mode)
3485{
3486 if (mode != TLSEXT_max_fragment_length_DISABLED
3487 && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) {
6849b73c 3488 ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
cf72c757
F		 3489 return 0;
3490 }
3491
3492 ctx->ext.max_fragment_len_mode = mode;
3493 return 1;
3494}
3495
3496int SSL_set_tlsext_max_fragment_length(SSL *ssl, uint8_t mode)
3497{
38b051a1
TM		 3498 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
3499
3500 if (sc == NULL)
3501 return 0;
3502
cf72c757
F		 3503 if (mode != TLSEXT_max_fragment_length_DISABLED
3504 && !IS_MAX_FRAGMENT_LENGTH_EXT_VALID(mode)) {
6849b73c 3505 ERR_raise(ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
cf72c757
F		 3506 return 0;
3507 }
3508
38b051a1 3509 sc->ext.max_fragment_len_mode = mode;
cf72c757
F		 3510 return 1;
3511}
3512
3513uint8_t SSL_SESSION_get_max_fragment_length(const SSL_SESSION *session)
3514{
3515 return session->ext.max_fragment_len_mode;
3516}
a76ce286
P		 3517
3518/*
3519 * Helper functions for HMAC access with legacy support included.
3520 */
3521SSL_HMAC *ssl_hmac_new(const SSL_CTX *ctx)
3522{
3523 SSL_HMAC *ret = OPENSSL_zalloc(sizeof(*ret));
3524 EVP_MAC *mac = NULL;
3525
3526 if (ret == NULL)
3527 return NULL;
3528#ifndef OPENSSL_NO_DEPRECATED_3_0
3529 if (ctx->ext.ticket_key_evp_cb == NULL
3530 && ctx->ext.ticket_key_cb != NULL) {
301fcb28 3531 if (!ssl_hmac_old_new(ret))
a76ce286
P		 3532 goto err;
3533 return ret;
3534 }
3535#endif
7f80980f 3536 mac = EVP_MAC_fetch(ctx->libctx, "HMAC", ctx->propq);
865adf97 3537 if (mac == NULL || (ret->ctx = EVP_MAC_CTX_new(mac)) == NULL)
a76ce286
P		 3538 goto err;
3539 EVP_MAC_free(mac);
3540 return ret;
3541 err:
865adf97 3542 EVP_MAC_CTX_free(ret->ctx);
a76ce286
P		 3543 EVP_MAC_free(mac);
3544 OPENSSL_free(ret);
3545 return NULL;
3546}
3547
3548void ssl_hmac_free(SSL_HMAC *ctx)
3549{
3550 if (ctx != NULL) {
865adf97 3551 EVP_MAC_CTX_free(ctx->ctx);
a76ce286 3552#ifndef OPENSSL_NO_DEPRECATED_3_0
301fcb28 3553 ssl_hmac_old_free(ctx);
a76ce286
P		 3554#endif
3555 OPENSSL_free(ctx);
3556 }
3557}
3558
a76ce286
P		 3559EVP_MAC_CTX *ssl_hmac_get0_EVP_MAC_CTX(SSL_HMAC *ctx)
3560{
3561 return ctx->ctx;
3562}
3563
3564int ssl_hmac_init(SSL_HMAC *ctx, void *key, size_t len, char *md)
3565{
0edb8194 3566 OSSL_PARAM params[2], *p = params;
a76ce286
P		 3567
3568 if (ctx->ctx != NULL) {
3569 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, md, 0);
a76ce286 3570 *p = OSSL_PARAM_construct_end();
0edb8194 3571 if (EVP_MAC_init(ctx->ctx, key, len, params))
a76ce286
P		 3572 return 1;
3573 }
3574#ifndef OPENSSL_NO_DEPRECATED_3_0
3575 if (ctx->old_ctx != NULL)
301fcb28 3576 return ssl_hmac_old_init(ctx, key, len, md);
a76ce286
P		 3577#endif
3578 return 0;
3579}
3580
3581int ssl_hmac_update(SSL_HMAC *ctx, const unsigned char *data, size_t len)
3582{
3583 if (ctx->ctx != NULL)
3584 return EVP_MAC_update(ctx->ctx, data, len);
3585#ifndef OPENSSL_NO_DEPRECATED_3_0
3586 if (ctx->old_ctx != NULL)
301fcb28 3587 return ssl_hmac_old_update(ctx, data, len);
a76ce286
P		 3588#endif
3589 return 0;
3590}
3591
3592int ssl_hmac_final(SSL_HMAC *ctx, unsigned char *md, size_t *len,
3593 size_t max_size)
3594{
3595 if (ctx->ctx != NULL)
3596 return EVP_MAC_final(ctx->ctx, md, len, max_size);
3597#ifndef OPENSSL_NO_DEPRECATED_3_0
301fcb28
MC		 3598 if (ctx->old_ctx != NULL)
3599 return ssl_hmac_old_final(ctx, md, len);
a76ce286
P		 3600#endif
3601 return 0;
3602}
3603
3604size_t ssl_hmac_size(const SSL_HMAC *ctx)
3605{
3606 if (ctx->ctx != NULL)
90a2576b 3607 return EVP_MAC_CTX_get_mac_size(ctx->ctx);
a76ce286
P		 3608#ifndef OPENSSL_NO_DEPRECATED_3_0
3609 if (ctx->old_ctx != NULL)
301fcb28 3610 return ssl_hmac_old_size(ctx);
a76ce286
P		 3611#endif
3612 return 0;
3613}
3614
d8975dec
RL		 3615int ssl_get_EC_curve_nid(const EVP_PKEY *pkey)
3616{
3617 char gname[OSSL_MAX_NAME_SIZE];
3618
3619 if (EVP_PKEY_get_group_name(pkey, gname, sizeof(gname), NULL) > 0)
3620 return OBJ_txt2nid(gname);
3621
3622 return NID_undef;
3623}
d5530efa
TM		 3624
3625__owur int tls13_set_encoded_pub_key(EVP_PKEY *pkey,
3626 const unsigned char *enckey,
3627 size_t enckeylen)
3628{
3629 if (EVP_PKEY_is_a(pkey, "DH")) {
3630 int bits = EVP_PKEY_get_bits(pkey);
3631
3632 if (bits <= 0 || enckeylen != (size_t)bits / 8)
3633 /* the encoded key must be padded to the length of the p */
3634 return 0;
3635 } else if (EVP_PKEY_is_a(pkey, "EC")) {
3636 if (enckeylen < 3 /* point format and at least 1 byte for x and y */
3637 || enckey[0] != 0x04)
3638 return 0;
3639 }
3640
3641 return EVP_PKEY_set1_encoded_public_key(pkey, enckey, enckeylen);
3642}
A mirror of the official openssl repository