]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * Copyright 2005 Nokia. All rights reserved. | |
4 | * | |
5 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
6 | * this file except in compliance with the License. You can obtain a copy | |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
9 | */ | |
10 | ||
11 | #include <stdio.h> | |
12 | #include "ssl_local.h" | |
13 | #include "record/record_local.h" | |
14 | #include "internal/ktls.h" | |
15 | #include "internal/cryptlib.h" | |
16 | #include <openssl/comp.h> | |
17 | #include <openssl/evp.h> | |
18 | #include <openssl/kdf.h> | |
19 | #include <openssl/rand.h> | |
20 | #include <openssl/obj_mac.h> | |
21 | #include <openssl/core_names.h> | |
22 | #include <openssl/trace.h> | |
23 | ||
24 | /* seed1 through seed5 are concatenated */ | |
25 | static int tls1_PRF(SSL *s, | |
26 | const void *seed1, size_t seed1_len, | |
27 | const void *seed2, size_t seed2_len, | |
28 | const void *seed3, size_t seed3_len, | |
29 | const void *seed4, size_t seed4_len, | |
30 | const void *seed5, size_t seed5_len, | |
31 | const unsigned char *sec, size_t slen, | |
32 | unsigned char *out, size_t olen, int fatal) | |
33 | { | |
34 | const EVP_MD *md = ssl_prf_md(s); | |
35 | EVP_KDF *kdf; | |
36 | EVP_KDF_CTX *kctx = NULL; | |
37 | OSSL_PARAM params[8], *p = params; | |
38 | const char *mdname; | |
39 | ||
40 | if (md == NULL) { | |
41 | /* Should never happen */ | |
42 | if (fatal) | |
43 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, | |
44 | ERR_R_INTERNAL_ERROR); | |
45 | else | |
46 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
47 | return 0; | |
48 | } | |
49 | kdf = EVP_KDF_fetch(NULL, OSSL_KDF_NAME_TLS1_PRF, NULL); | |
50 | if (kdf == NULL) | |
51 | goto err; | |
52 | kctx = EVP_KDF_CTX_new(kdf); | |
53 | EVP_KDF_free(kdf); | |
54 | if (kctx == NULL) | |
55 | goto err; | |
56 | mdname = EVP_MD_name(md); | |
57 | *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, | |
58 | (char *)mdname, strlen(mdname) + 1); | |
59 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, | |
60 | (unsigned char *)sec, | |
61 | (size_t)slen); | |
62 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
63 | (void *)seed1, (size_t)seed1_len); | |
64 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
65 | (void *)seed2, (size_t)seed2_len); | |
66 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
67 | (void *)seed3, (size_t)seed3_len); | |
68 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
69 | (void *)seed4, (size_t)seed4_len); | |
70 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, | |
71 | (void *)seed5, (size_t)seed5_len); | |
72 | *p = OSSL_PARAM_construct_end(); | |
73 | if (EVP_KDF_CTX_set_params(kctx, params) | |
74 | && EVP_KDF_derive(kctx, out, olen)) { | |
75 | EVP_KDF_CTX_free(kctx); | |
76 | return 1; | |
77 | } | |
78 | ||
79 | err: | |
80 | if (fatal) | |
81 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, | |
82 | ERR_R_INTERNAL_ERROR); | |
83 | else | |
84 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
85 | EVP_KDF_CTX_free(kctx); | |
86 | return 0; | |
87 | } | |
88 | ||
89 | static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) | |
90 | { | |
91 | int ret; | |
92 | ||
93 | /* Calls SSLfatal() as required */ | |
94 | ret = tls1_PRF(s, | |
95 | TLS_MD_KEY_EXPANSION_CONST, | |
96 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random, | |
97 | SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE, | |
98 | NULL, 0, NULL, 0, s->session->master_key, | |
99 | s->session->master_key_length, km, num, 1); | |
100 | ||
101 | return ret; | |
102 | } | |
103 | ||
104 | #ifndef OPENSSL_NO_KTLS | |
105 | /* | |
106 | * Count the number of records that were not processed yet from record boundary. | |
107 | * | |
108 | * This function assumes that there are only fully formed records read in the | |
109 | * record layer. If read_ahead is enabled, then this might be false and this | |
110 | * function will fail. | |
111 | */ | |
112 | static int count_unprocessed_records(SSL *s) | |
113 | { | |
114 | SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); | |
115 | PACKET pkt, subpkt; | |
116 | int count = 0; | |
117 | ||
118 | if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left)) | |
119 | return -1; | |
120 | ||
121 | while (PACKET_remaining(&pkt) > 0) { | |
122 | /* Skip record type and version */ | |
123 | if (!PACKET_forward(&pkt, 3)) | |
124 | return -1; | |
125 | ||
126 | /* Read until next record */ | |
127 | if (PACKET_get_length_prefixed_2(&pkt, &subpkt)) | |
128 | return -1; | |
129 | ||
130 | count += 1; | |
131 | } | |
132 | ||
133 | return count; | |
134 | } | |
135 | #endif | |
136 | ||
137 | int tls1_change_cipher_state(SSL *s, int which) | |
138 | { | |
139 | unsigned char *p, *mac_secret; | |
140 | unsigned char *ms, *key, *iv; | |
141 | EVP_CIPHER_CTX *dd; | |
142 | const EVP_CIPHER *c; | |
143 | #ifndef OPENSSL_NO_COMP | |
144 | const SSL_COMP *comp; | |
145 | #endif | |
146 | const EVP_MD *m; | |
147 | int mac_type; | |
148 | size_t *mac_secret_size; | |
149 | EVP_MD_CTX *mac_ctx; | |
150 | EVP_PKEY *mac_key; | |
151 | size_t n, i, j, k, cl; | |
152 | int reuse_dd = 0; | |
153 | #ifndef OPENSSL_NO_KTLS | |
154 | struct tls12_crypto_info_aes_gcm_128 crypto_info; | |
155 | BIO *bio; | |
156 | unsigned char geniv[12]; | |
157 | int count_unprocessed; | |
158 | int bit; | |
159 | #endif | |
160 | ||
161 | c = s->s3.tmp.new_sym_enc; | |
162 | m = s->s3.tmp.new_hash; | |
163 | mac_type = s->s3.tmp.new_mac_pkey_type; | |
164 | #ifndef OPENSSL_NO_COMP | |
165 | comp = s->s3.tmp.new_compression; | |
166 | #endif | |
167 | ||
168 | if (which & SSL3_CC_READ) { | |
169 | if (s->ext.use_etm) | |
170 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
171 | else | |
172 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
173 | ||
174 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) | |
175 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; | |
176 | else | |
177 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
178 | ||
179 | if (s->enc_read_ctx != NULL) { | |
180 | reuse_dd = 1; | |
181 | } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) { | |
182 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
183 | ERR_R_MALLOC_FAILURE); | |
184 | goto err; | |
185 | } else { | |
186 | /* | |
187 | * make sure it's initialised in case we exit later with an error | |
188 | */ | |
189 | EVP_CIPHER_CTX_reset(s->enc_read_ctx); | |
190 | } | |
191 | dd = s->enc_read_ctx; | |
192 | mac_ctx = ssl_replace_hash(&s->read_hash, NULL); | |
193 | if (mac_ctx == NULL) { | |
194 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
195 | ERR_R_INTERNAL_ERROR); | |
196 | goto err; | |
197 | } | |
198 | #ifndef OPENSSL_NO_COMP | |
199 | COMP_CTX_free(s->expand); | |
200 | s->expand = NULL; | |
201 | if (comp != NULL) { | |
202 | s->expand = COMP_CTX_new(comp->method); | |
203 | if (s->expand == NULL) { | |
204 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
205 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
206 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
207 | goto err; | |
208 | } | |
209 | } | |
210 | #endif | |
211 | /* | |
212 | * this is done by dtls1_reset_seq_numbers for DTLS | |
213 | */ | |
214 | if (!SSL_IS_DTLS(s)) | |
215 | RECORD_LAYER_reset_read_sequence(&s->rlayer); | |
216 | mac_secret = &(s->s3.read_mac_secret[0]); | |
217 | mac_secret_size = &(s->s3.read_mac_secret_size); | |
218 | } else { | |
219 | s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; | |
220 | if (s->ext.use_etm) | |
221 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
222 | else | |
223 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
224 | ||
225 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) | |
226 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
227 | else | |
228 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
229 | if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) { | |
230 | reuse_dd = 1; | |
231 | } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { | |
232 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
233 | ERR_R_MALLOC_FAILURE); | |
234 | goto err; | |
235 | } | |
236 | dd = s->enc_write_ctx; | |
237 | if (SSL_IS_DTLS(s)) { | |
238 | mac_ctx = EVP_MD_CTX_new(); | |
239 | if (mac_ctx == NULL) { | |
240 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
241 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
242 | ERR_R_MALLOC_FAILURE); | |
243 | goto err; | |
244 | } | |
245 | s->write_hash = mac_ctx; | |
246 | } else { | |
247 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); | |
248 | if (mac_ctx == NULL) { | |
249 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
250 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
251 | ERR_R_MALLOC_FAILURE); | |
252 | goto err; | |
253 | } | |
254 | } | |
255 | #ifndef OPENSSL_NO_COMP | |
256 | COMP_CTX_free(s->compress); | |
257 | s->compress = NULL; | |
258 | if (comp != NULL) { | |
259 | s->compress = COMP_CTX_new(comp->method); | |
260 | if (s->compress == NULL) { | |
261 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
262 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
263 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
264 | goto err; | |
265 | } | |
266 | } | |
267 | #endif | |
268 | /* | |
269 | * this is done by dtls1_reset_seq_numbers for DTLS | |
270 | */ | |
271 | if (!SSL_IS_DTLS(s)) | |
272 | RECORD_LAYER_reset_write_sequence(&s->rlayer); | |
273 | mac_secret = &(s->s3.write_mac_secret[0]); | |
274 | mac_secret_size = &(s->s3.write_mac_secret_size); | |
275 | } | |
276 | ||
277 | if (reuse_dd) | |
278 | EVP_CIPHER_CTX_reset(dd); | |
279 | ||
280 | p = s->s3.tmp.key_block; | |
281 | i = *mac_secret_size = s->s3.tmp.new_mac_secret_size; | |
282 | ||
283 | /* TODO(size_t): convert me */ | |
284 | cl = EVP_CIPHER_key_length(c); | |
285 | j = cl; | |
286 | /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ | |
287 | /* If GCM/CCM mode only part of IV comes from PRF */ | |
288 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) | |
289 | k = EVP_GCM_TLS_FIXED_IV_LEN; | |
290 | else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) | |
291 | k = EVP_CCM_TLS_FIXED_IV_LEN; | |
292 | else | |
293 | k = EVP_CIPHER_iv_length(c); | |
294 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || | |
295 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
296 | ms = &(p[0]); | |
297 | n = i + i; | |
298 | key = &(p[n]); | |
299 | n += j + j; | |
300 | iv = &(p[n]); | |
301 | n += k + k; | |
302 | } else { | |
303 | n = i; | |
304 | ms = &(p[n]); | |
305 | n += i + j; | |
306 | key = &(p[n]); | |
307 | n += j + k; | |
308 | iv = &(p[n]); | |
309 | n += k; | |
310 | } | |
311 | ||
312 | if (n > s->s3.tmp.key_block_length) { | |
313 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
314 | ERR_R_INTERNAL_ERROR); | |
315 | goto err; | |
316 | } | |
317 | ||
318 | memcpy(mac_secret, ms, i); | |
319 | ||
320 | if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { | |
321 | /* TODO(size_t): Convert this function */ | |
322 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, | |
323 | (int)*mac_secret_size); | |
324 | if (mac_key == NULL | |
325 | || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) { | |
326 | EVP_PKEY_free(mac_key); | |
327 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
328 | ERR_R_INTERNAL_ERROR); | |
329 | goto err; | |
330 | } | |
331 | EVP_PKEY_free(mac_key); | |
332 | } | |
333 | ||
334 | OSSL_TRACE_BEGIN(TLS) { | |
335 | BIO_printf(trc_out, "which = %04X, mac key:\n", which); | |
336 | BIO_dump_indent(trc_out, ms, i, 4); | |
337 | } OSSL_TRACE_END(TLS); | |
338 | ||
339 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { | |
340 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) | |
341 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, | |
342 | iv)) { | |
343 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
344 | ERR_R_INTERNAL_ERROR); | |
345 | goto err; | |
346 | } | |
347 | } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { | |
348 | int taglen; | |
349 | if (s->s3.tmp. | |
350 | new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) | |
351 | taglen = EVP_CCM8_TLS_TAG_LEN; | |
352 | else | |
353 | taglen = EVP_CCM_TLS_TAG_LEN; | |
354 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) | |
355 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) | |
356 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) | |
357 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) | |
358 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { | |
359 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
360 | ERR_R_INTERNAL_ERROR); | |
361 | goto err; | |
362 | } | |
363 | } else { | |
364 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
365 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
366 | ERR_R_INTERNAL_ERROR); | |
367 | goto err; | |
368 | } | |
369 | } | |
370 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ | |
371 | if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size | |
372 | && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, | |
373 | (int)*mac_secret_size, mac_secret)) { | |
374 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
375 | ERR_R_INTERNAL_ERROR); | |
376 | goto err; | |
377 | } | |
378 | #ifndef OPENSSL_NO_KTLS | |
379 | if (s->compress) | |
380 | goto skip_ktls; | |
381 | ||
382 | if (((which & SSL3_CC_READ) && (s->mode & SSL_MODE_NO_KTLS_RX)) | |
383 | || ((which & SSL3_CC_WRITE) && (s->mode & SSL_MODE_NO_KTLS_TX))) | |
384 | goto skip_ktls; | |
385 | ||
386 | /* ktls supports only the maximum fragment size */ | |
387 | if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH) | |
388 | goto skip_ktls; | |
389 | ||
390 | /* check that cipher is AES_GCM_128 */ | |
391 | if (EVP_CIPHER_nid(c) != NID_aes_128_gcm | |
392 | || EVP_CIPHER_mode(c) != EVP_CIPH_GCM_MODE | |
393 | || EVP_CIPHER_key_length(c) != TLS_CIPHER_AES_GCM_128_KEY_SIZE) | |
394 | goto skip_ktls; | |
395 | ||
396 | /* check version is 1.2 */ | |
397 | if (s->version != TLS1_2_VERSION) | |
398 | goto skip_ktls; | |
399 | ||
400 | if (which & SSL3_CC_WRITE) | |
401 | bio = s->wbio; | |
402 | else | |
403 | bio = s->rbio; | |
404 | ||
405 | if (!ossl_assert(bio != NULL)) { | |
406 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
407 | ERR_R_INTERNAL_ERROR); | |
408 | goto err; | |
409 | } | |
410 | ||
411 | /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */ | |
412 | if (which & SSL3_CC_WRITE) { | |
413 | if (BIO_flush(bio) <= 0) | |
414 | goto skip_ktls; | |
415 | } | |
416 | ||
417 | /* ktls doesn't support renegotiation */ | |
418 | if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) || | |
419 | (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) { | |
420 | SSLfatal(s, SSL_AD_NO_RENEGOTIATION, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
421 | ERR_R_INTERNAL_ERROR); | |
422 | goto err; | |
423 | } | |
424 | ||
425 | memset(&crypto_info, 0, sizeof(crypto_info)); | |
426 | crypto_info.info.cipher_type = TLS_CIPHER_AES_GCM_128; | |
427 | crypto_info.info.version = s->version; | |
428 | ||
429 | EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GET_IV, | |
430 | EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN, | |
431 | geniv); | |
432 | memcpy(crypto_info.iv, geniv + EVP_GCM_TLS_FIXED_IV_LEN, | |
433 | TLS_CIPHER_AES_GCM_128_IV_SIZE); | |
434 | memcpy(crypto_info.salt, geniv, TLS_CIPHER_AES_GCM_128_SALT_SIZE); | |
435 | memcpy(crypto_info.key, key, EVP_CIPHER_key_length(c)); | |
436 | if (which & SSL3_CC_WRITE) | |
437 | memcpy(crypto_info.rec_seq, &s->rlayer.write_sequence, | |
438 | TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); | |
439 | else | |
440 | memcpy(crypto_info.rec_seq, &s->rlayer.read_sequence, | |
441 | TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); | |
442 | ||
443 | if (which & SSL3_CC_READ) { | |
444 | count_unprocessed = count_unprocessed_records(s); | |
445 | if (count_unprocessed < 0) | |
446 | goto skip_ktls; | |
447 | ||
448 | /* increment the crypto_info record sequence */ | |
449 | while (count_unprocessed) { | |
450 | for (bit = 7; bit >= 0; bit--) { /* increment */ | |
451 | ++crypto_info.rec_seq[bit]; | |
452 | if (crypto_info.rec_seq[bit] != 0) | |
453 | break; | |
454 | } | |
455 | count_unprocessed--; | |
456 | } | |
457 | } | |
458 | ||
459 | /* ktls works with user provided buffers directly */ | |
460 | if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) { | |
461 | if (which & SSL3_CC_WRITE) | |
462 | ssl3_release_write_buffer(s); | |
463 | SSL_set_options(s, SSL_OP_NO_RENEGOTIATION); | |
464 | } | |
465 | ||
466 | skip_ktls: | |
467 | #endif /* OPENSSL_NO_KTLS */ | |
468 | s->statem.enc_write_state = ENC_WRITE_STATE_VALID; | |
469 | ||
470 | OSSL_TRACE_BEGIN(TLS) { | |
471 | BIO_printf(trc_out, "which = %04X, key:\n", which); | |
472 | BIO_dump_indent(trc_out, key, EVP_CIPHER_key_length(c), 4); | |
473 | BIO_printf(trc_out, "iv:\n"); | |
474 | BIO_dump_indent(trc_out, iv, k, 4); | |
475 | } OSSL_TRACE_END(TLS); | |
476 | ||
477 | return 1; | |
478 | err: | |
479 | return 0; | |
480 | } | |
481 | ||
482 | int tls1_setup_key_block(SSL *s) | |
483 | { | |
484 | unsigned char *p; | |
485 | const EVP_CIPHER *c; | |
486 | const EVP_MD *hash; | |
487 | SSL_COMP *comp; | |
488 | int mac_type = NID_undef; | |
489 | size_t num, mac_secret_size = 0; | |
490 | int ret = 0; | |
491 | ||
492 | if (s->s3.tmp.key_block_length != 0) | |
493 | return 1; | |
494 | ||
495 | if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, | |
496 | &comp, s->ext.use_etm)) { | |
497 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, | |
498 | SSL_R_CIPHER_OR_HASH_UNAVAILABLE); | |
499 | return 0; | |
500 | } | |
501 | ||
502 | s->s3.tmp.new_sym_enc = c; | |
503 | s->s3.tmp.new_hash = hash; | |
504 | s->s3.tmp.new_mac_pkey_type = mac_type; | |
505 | s->s3.tmp.new_mac_secret_size = mac_secret_size; | |
506 | num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c); | |
507 | num *= 2; | |
508 | ||
509 | ssl3_cleanup_key_block(s); | |
510 | ||
511 | if ((p = OPENSSL_malloc(num)) == NULL) { | |
512 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, | |
513 | ERR_R_MALLOC_FAILURE); | |
514 | goto err; | |
515 | } | |
516 | ||
517 | s->s3.tmp.key_block_length = num; | |
518 | s->s3.tmp.key_block = p; | |
519 | ||
520 | OSSL_TRACE_BEGIN(TLS) { | |
521 | BIO_printf(trc_out, "client random\n"); | |
522 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); | |
523 | BIO_printf(trc_out, "server random\n"); | |
524 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); | |
525 | BIO_printf(trc_out, "master key\n"); | |
526 | BIO_dump_indent(trc_out, | |
527 | s->session->master_key, | |
528 | s->session->master_key_length, 4); | |
529 | } OSSL_TRACE_END(TLS); | |
530 | ||
531 | if (!tls1_generate_key_block(s, p, num)) { | |
532 | /* SSLfatal() already called */ | |
533 | goto err; | |
534 | } | |
535 | ||
536 | OSSL_TRACE_BEGIN(TLS) { | |
537 | BIO_printf(trc_out, "key block\n"); | |
538 | BIO_dump_indent(trc_out, p, num, 4); | |
539 | } OSSL_TRACE_END(TLS); | |
540 | ||
541 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) | |
542 | && s->method->version <= TLS1_VERSION) { | |
543 | /* | |
544 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
545 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
546 | */ | |
547 | s->s3.need_empty_fragments = 1; | |
548 | ||
549 | if (s->session->cipher != NULL) { | |
550 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
551 | s->s3.need_empty_fragments = 0; | |
552 | ||
553 | #ifndef OPENSSL_NO_RC4 | |
554 | if (s->session->cipher->algorithm_enc == SSL_RC4) | |
555 | s->s3.need_empty_fragments = 0; | |
556 | #endif | |
557 | } | |
558 | } | |
559 | ||
560 | ret = 1; | |
561 | err: | |
562 | return ret; | |
563 | } | |
564 | ||
565 | size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, | |
566 | unsigned char *out) | |
567 | { | |
568 | size_t hashlen; | |
569 | unsigned char hash[EVP_MAX_MD_SIZE]; | |
570 | ||
571 | if (!ssl3_digest_cached_records(s, 0)) { | |
572 | /* SSLfatal() already called */ | |
573 | return 0; | |
574 | } | |
575 | ||
576 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { | |
577 | /* SSLfatal() already called */ | |
578 | return 0; | |
579 | } | |
580 | ||
581 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, | |
582 | s->session->master_key, s->session->master_key_length, | |
583 | out, TLS1_FINISH_MAC_LENGTH, 1)) { | |
584 | /* SSLfatal() already called */ | |
585 | return 0; | |
586 | } | |
587 | OPENSSL_cleanse(hash, hashlen); | |
588 | return TLS1_FINISH_MAC_LENGTH; | |
589 | } | |
590 | ||
591 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, | |
592 | size_t len, size_t *secret_size) | |
593 | { | |
594 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { | |
595 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; | |
596 | size_t hashlen; | |
597 | /* | |
598 | * Digest cached records keeping record buffer (if present): this wont | |
599 | * affect client auth because we're freezing the buffer at the same | |
600 | * point (after client key exchange and before certificate verify) | |
601 | */ | |
602 | if (!ssl3_digest_cached_records(s, 1) | |
603 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { | |
604 | /* SSLfatal() already called */ | |
605 | return 0; | |
606 | } | |
607 | OSSL_TRACE_BEGIN(TLS) { | |
608 | BIO_printf(trc_out, "Handshake hashes:\n"); | |
609 | BIO_dump(trc_out, (char *)hash, hashlen); | |
610 | } OSSL_TRACE_END(TLS); | |
611 | if (!tls1_PRF(s, | |
612 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
613 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
614 | hash, hashlen, | |
615 | NULL, 0, | |
616 | NULL, 0, | |
617 | NULL, 0, p, len, out, | |
618 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
619 | /* SSLfatal() already called */ | |
620 | return 0; | |
621 | } | |
622 | OPENSSL_cleanse(hash, hashlen); | |
623 | } else { | |
624 | if (!tls1_PRF(s, | |
625 | TLS_MD_MASTER_SECRET_CONST, | |
626 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
627 | s->s3.client_random, SSL3_RANDOM_SIZE, | |
628 | NULL, 0, | |
629 | s->s3.server_random, SSL3_RANDOM_SIZE, | |
630 | NULL, 0, p, len, out, | |
631 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
632 | /* SSLfatal() already called */ | |
633 | return 0; | |
634 | } | |
635 | } | |
636 | ||
637 | OSSL_TRACE_BEGIN(TLS) { | |
638 | BIO_printf(trc_out, "Premaster Secret:\n"); | |
639 | BIO_dump_indent(trc_out, p, len, 4); | |
640 | BIO_printf(trc_out, "Client Random:\n"); | |
641 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); | |
642 | BIO_printf(trc_out, "Server Random:\n"); | |
643 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); | |
644 | BIO_printf(trc_out, "Master Secret:\n"); | |
645 | BIO_dump_indent(trc_out, | |
646 | s->session->master_key, | |
647 | SSL3_MASTER_SECRET_SIZE, 4); | |
648 | } OSSL_TRACE_END(TLS); | |
649 | ||
650 | *secret_size = SSL3_MASTER_SECRET_SIZE; | |
651 | return 1; | |
652 | } | |
653 | ||
654 | int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, | |
655 | const char *label, size_t llen, | |
656 | const unsigned char *context, | |
657 | size_t contextlen, int use_context) | |
658 | { | |
659 | unsigned char *val = NULL; | |
660 | size_t vallen = 0, currentvalpos; | |
661 | int rv; | |
662 | ||
663 | /* | |
664 | * construct PRF arguments we construct the PRF argument ourself rather | |
665 | * than passing separate values into the TLS PRF to ensure that the | |
666 | * concatenation of values does not create a prohibited label. | |
667 | */ | |
668 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
669 | if (use_context) { | |
670 | vallen += 2 + contextlen; | |
671 | } | |
672 | ||
673 | val = OPENSSL_malloc(vallen); | |
674 | if (val == NULL) | |
675 | goto err2; | |
676 | currentvalpos = 0; | |
677 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
678 | currentvalpos += llen; | |
679 | memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE); | |
680 | currentvalpos += SSL3_RANDOM_SIZE; | |
681 | memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE); | |
682 | currentvalpos += SSL3_RANDOM_SIZE; | |
683 | ||
684 | if (use_context) { | |
685 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
686 | currentvalpos++; | |
687 | val[currentvalpos] = contextlen & 0xff; | |
688 | currentvalpos++; | |
689 | if ((contextlen > 0) || (context != NULL)) { | |
690 | memcpy(val + currentvalpos, context, contextlen); | |
691 | } | |
692 | } | |
693 | ||
694 | /* | |
695 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
696 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
697 | * the comparisons won't have buffer overflow | |
698 | */ | |
699 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
700 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
701 | goto err1; | |
702 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
703 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
704 | goto err1; | |
705 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
706 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
707 | goto err1; | |
708 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
709 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
710 | goto err1; | |
711 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, | |
712 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
713 | goto err1; | |
714 | ||
715 | rv = tls1_PRF(s, | |
716 | val, vallen, | |
717 | NULL, 0, | |
718 | NULL, 0, | |
719 | NULL, 0, | |
720 | NULL, 0, | |
721 | s->session->master_key, s->session->master_key_length, | |
722 | out, olen, 0); | |
723 | ||
724 | goto ret; | |
725 | err1: | |
726 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); | |
727 | rv = 0; | |
728 | goto ret; | |
729 | err2: | |
730 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); | |
731 | rv = 0; | |
732 | ret: | |
733 | OPENSSL_clear_free(val, vallen); | |
734 | return rv; | |
735 | } | |
736 | ||
737 | int tls1_alert_code(int code) | |
738 | { | |
739 | switch (code) { | |
740 | case SSL_AD_CLOSE_NOTIFY: | |
741 | return SSL3_AD_CLOSE_NOTIFY; | |
742 | case SSL_AD_UNEXPECTED_MESSAGE: | |
743 | return SSL3_AD_UNEXPECTED_MESSAGE; | |
744 | case SSL_AD_BAD_RECORD_MAC: | |
745 | return SSL3_AD_BAD_RECORD_MAC; | |
746 | case SSL_AD_DECRYPTION_FAILED: | |
747 | return TLS1_AD_DECRYPTION_FAILED; | |
748 | case SSL_AD_RECORD_OVERFLOW: | |
749 | return TLS1_AD_RECORD_OVERFLOW; | |
750 | case SSL_AD_DECOMPRESSION_FAILURE: | |
751 | return SSL3_AD_DECOMPRESSION_FAILURE; | |
752 | case SSL_AD_HANDSHAKE_FAILURE: | |
753 | return SSL3_AD_HANDSHAKE_FAILURE; | |
754 | case SSL_AD_NO_CERTIFICATE: | |
755 | return -1; | |
756 | case SSL_AD_BAD_CERTIFICATE: | |
757 | return SSL3_AD_BAD_CERTIFICATE; | |
758 | case SSL_AD_UNSUPPORTED_CERTIFICATE: | |
759 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; | |
760 | case SSL_AD_CERTIFICATE_REVOKED: | |
761 | return SSL3_AD_CERTIFICATE_REVOKED; | |
762 | case SSL_AD_CERTIFICATE_EXPIRED: | |
763 | return SSL3_AD_CERTIFICATE_EXPIRED; | |
764 | case SSL_AD_CERTIFICATE_UNKNOWN: | |
765 | return SSL3_AD_CERTIFICATE_UNKNOWN; | |
766 | case SSL_AD_ILLEGAL_PARAMETER: | |
767 | return SSL3_AD_ILLEGAL_PARAMETER; | |
768 | case SSL_AD_UNKNOWN_CA: | |
769 | return TLS1_AD_UNKNOWN_CA; | |
770 | case SSL_AD_ACCESS_DENIED: | |
771 | return TLS1_AD_ACCESS_DENIED; | |
772 | case SSL_AD_DECODE_ERROR: | |
773 | return TLS1_AD_DECODE_ERROR; | |
774 | case SSL_AD_DECRYPT_ERROR: | |
775 | return TLS1_AD_DECRYPT_ERROR; | |
776 | case SSL_AD_EXPORT_RESTRICTION: | |
777 | return TLS1_AD_EXPORT_RESTRICTION; | |
778 | case SSL_AD_PROTOCOL_VERSION: | |
779 | return TLS1_AD_PROTOCOL_VERSION; | |
780 | case SSL_AD_INSUFFICIENT_SECURITY: | |
781 | return TLS1_AD_INSUFFICIENT_SECURITY; | |
782 | case SSL_AD_INTERNAL_ERROR: | |
783 | return TLS1_AD_INTERNAL_ERROR; | |
784 | case SSL_AD_USER_CANCELLED: | |
785 | return TLS1_AD_USER_CANCELLED; | |
786 | case SSL_AD_NO_RENEGOTIATION: | |
787 | return TLS1_AD_NO_RENEGOTIATION; | |
788 | case SSL_AD_UNSUPPORTED_EXTENSION: | |
789 | return TLS1_AD_UNSUPPORTED_EXTENSION; | |
790 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: | |
791 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; | |
792 | case SSL_AD_UNRECOGNIZED_NAME: | |
793 | return TLS1_AD_UNRECOGNIZED_NAME; | |
794 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: | |
795 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; | |
796 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: | |
797 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; | |
798 | case SSL_AD_UNKNOWN_PSK_IDENTITY: | |
799 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; | |
800 | case SSL_AD_INAPPROPRIATE_FALLBACK: | |
801 | return TLS1_AD_INAPPROPRIATE_FALLBACK; | |
802 | case SSL_AD_NO_APPLICATION_PROTOCOL: | |
803 | return TLS1_AD_NO_APPLICATION_PROTOCOL; | |
804 | case SSL_AD_CERTIFICATE_REQUIRED: | |
805 | return SSL_AD_HANDSHAKE_FAILURE; | |
806 | default: | |
807 | return -1; | |
808 | } | |
809 | } |