]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * | |
4 | * Licensed under the OpenSSL license (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | /* ==================================================================== | |
11 | * Copyright 2005 Nokia. All rights reserved. | |
12 | * | |
13 | * The portions of the attached software ("Contribution") is developed by | |
14 | * Nokia Corporation and is licensed pursuant to the OpenSSL open source | |
15 | * license. | |
16 | * | |
17 | * The Contribution, originally written by Mika Kousa and Pasi Eronen of | |
18 | * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites | |
19 | * support (see RFC 4279) to OpenSSL. | |
20 | * | |
21 | * No patent licenses or other rights except those expressly stated in | |
22 | * the OpenSSL open source license shall be deemed granted or received | |
23 | * expressly, by implication, estoppel, or otherwise. | |
24 | * | |
25 | * No assurances are provided by Nokia that the Contribution does not | |
26 | * infringe the patent or other intellectual property rights of any third | |
27 | * party or that the license provides you with all the necessary rights | |
28 | * to make use of the Contribution. | |
29 | * | |
30 | * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN | |
31 | * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA | |
32 | * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY | |
33 | * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR | |
34 | * OTHERWISE. | |
35 | */ | |
36 | ||
37 | #include <stdio.h> | |
38 | #include "ssl_locl.h" | |
39 | #include <openssl/comp.h> | |
40 | #include <openssl/evp.h> | |
41 | #include <openssl/kdf.h> | |
42 | #include <openssl/rand.h> | |
43 | ||
44 | /* seed1 through seed5 are concatenated */ | |
45 | static int tls1_PRF(SSL *s, | |
46 | const void *seed1, size_t seed1_len, | |
47 | const void *seed2, size_t seed2_len, | |
48 | const void *seed3, size_t seed3_len, | |
49 | const void *seed4, size_t seed4_len, | |
50 | const void *seed5, size_t seed5_len, | |
51 | const unsigned char *sec, size_t slen, | |
52 | unsigned char *out, size_t olen) | |
53 | { | |
54 | const EVP_MD *md = ssl_prf_md(s); | |
55 | EVP_PKEY_CTX *pctx = NULL; | |
56 | ||
57 | int ret = 0; | |
58 | ||
59 | if (md == NULL) { | |
60 | /* Should never happen */ | |
61 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
62 | return 0; | |
63 | } | |
64 | pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); | |
65 | if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0 | |
66 | || EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) <= 0 | |
67 | || EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, (int)slen) <= 0) | |
68 | goto err; | |
69 | ||
70 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, (int)seed1_len) <= 0) | |
71 | goto err; | |
72 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, (int)seed2_len) <= 0) | |
73 | goto err; | |
74 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, (int)seed3_len) <= 0) | |
75 | goto err; | |
76 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed4, (int)seed4_len) <= 0) | |
77 | goto err; | |
78 | if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed5, (int)seed5_len) <= 0) | |
79 | goto err; | |
80 | ||
81 | if (EVP_PKEY_derive(pctx, out, &olen) <= 0) | |
82 | goto err; | |
83 | ret = 1; | |
84 | ||
85 | err: | |
86 | EVP_PKEY_CTX_free(pctx); | |
87 | return ret; | |
88 | } | |
89 | ||
90 | static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) | |
91 | { | |
92 | int ret; | |
93 | ret = tls1_PRF(s, | |
94 | TLS_MD_KEY_EXPANSION_CONST, | |
95 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3->server_random, | |
96 | SSL3_RANDOM_SIZE, s->s3->client_random, SSL3_RANDOM_SIZE, | |
97 | NULL, 0, NULL, 0, s->session->master_key, | |
98 | s->session->master_key_length, km, num); | |
99 | ||
100 | return ret; | |
101 | } | |
102 | ||
103 | int tls1_change_cipher_state(SSL *s, int which) | |
104 | { | |
105 | unsigned char *p, *mac_secret; | |
106 | unsigned char tmp1[EVP_MAX_KEY_LENGTH]; | |
107 | unsigned char tmp2[EVP_MAX_KEY_LENGTH]; | |
108 | unsigned char iv1[EVP_MAX_IV_LENGTH * 2]; | |
109 | unsigned char iv2[EVP_MAX_IV_LENGTH * 2]; | |
110 | unsigned char *ms, *key, *iv; | |
111 | EVP_CIPHER_CTX *dd; | |
112 | const EVP_CIPHER *c; | |
113 | #ifndef OPENSSL_NO_COMP | |
114 | const SSL_COMP *comp; | |
115 | #endif | |
116 | const EVP_MD *m; | |
117 | int mac_type; | |
118 | size_t *mac_secret_size; | |
119 | EVP_MD_CTX *mac_ctx; | |
120 | EVP_PKEY *mac_key; | |
121 | size_t n, i, j, k, cl; | |
122 | int reuse_dd = 0; | |
123 | ||
124 | c = s->s3->tmp.new_sym_enc; | |
125 | m = s->s3->tmp.new_hash; | |
126 | mac_type = s->s3->tmp.new_mac_pkey_type; | |
127 | #ifndef OPENSSL_NO_COMP | |
128 | comp = s->s3->tmp.new_compression; | |
129 | #endif | |
130 | ||
131 | if (which & SSL3_CC_READ) { | |
132 | if (s->ext.use_etm) | |
133 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
134 | else | |
135 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
136 | ||
137 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) | |
138 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; | |
139 | else | |
140 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
141 | ||
142 | if (s->enc_read_ctx != NULL) | |
143 | reuse_dd = 1; | |
144 | else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) | |
145 | goto err; | |
146 | else | |
147 | /* | |
148 | * make sure it's initialised in case we exit later with an error | |
149 | */ | |
150 | EVP_CIPHER_CTX_reset(s->enc_read_ctx); | |
151 | dd = s->enc_read_ctx; | |
152 | mac_ctx = ssl_replace_hash(&s->read_hash, NULL); | |
153 | if (mac_ctx == NULL) | |
154 | goto err; | |
155 | #ifndef OPENSSL_NO_COMP | |
156 | COMP_CTX_free(s->expand); | |
157 | s->expand = NULL; | |
158 | if (comp != NULL) { | |
159 | s->expand = COMP_CTX_new(comp->method); | |
160 | if (s->expand == NULL) { | |
161 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
162 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
163 | goto err2; | |
164 | } | |
165 | } | |
166 | #endif | |
167 | /* | |
168 | * this is done by dtls1_reset_seq_numbers for DTLS | |
169 | */ | |
170 | if (!SSL_IS_DTLS(s)) | |
171 | RECORD_LAYER_reset_read_sequence(&s->rlayer); | |
172 | mac_secret = &(s->s3->read_mac_secret[0]); | |
173 | mac_secret_size = &(s->s3->read_mac_secret_size); | |
174 | } else { | |
175 | if (s->ext.use_etm) | |
176 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
177 | else | |
178 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
179 | ||
180 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) | |
181 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
182 | else | |
183 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
184 | if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) | |
185 | reuse_dd = 1; | |
186 | else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) | |
187 | goto err; | |
188 | dd = s->enc_write_ctx; | |
189 | if (SSL_IS_DTLS(s)) { | |
190 | mac_ctx = EVP_MD_CTX_new(); | |
191 | if (mac_ctx == NULL) | |
192 | goto err; | |
193 | s->write_hash = mac_ctx; | |
194 | } else { | |
195 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); | |
196 | if (mac_ctx == NULL) | |
197 | goto err; | |
198 | } | |
199 | #ifndef OPENSSL_NO_COMP | |
200 | COMP_CTX_free(s->compress); | |
201 | s->compress = NULL; | |
202 | if (comp != NULL) { | |
203 | s->compress = COMP_CTX_new(comp->method); | |
204 | if (s->compress == NULL) { | |
205 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
206 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
207 | goto err2; | |
208 | } | |
209 | } | |
210 | #endif | |
211 | /* | |
212 | * this is done by dtls1_reset_seq_numbers for DTLS | |
213 | */ | |
214 | if (!SSL_IS_DTLS(s)) | |
215 | RECORD_LAYER_reset_write_sequence(&s->rlayer); | |
216 | mac_secret = &(s->s3->write_mac_secret[0]); | |
217 | mac_secret_size = &(s->s3->write_mac_secret_size); | |
218 | } | |
219 | ||
220 | if (reuse_dd) | |
221 | EVP_CIPHER_CTX_reset(dd); | |
222 | ||
223 | p = s->s3->tmp.key_block; | |
224 | i = *mac_secret_size = s->s3->tmp.new_mac_secret_size; | |
225 | ||
226 | /* TODO(size_t): convert me */ | |
227 | cl = EVP_CIPHER_key_length(c); | |
228 | j = cl; | |
229 | /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ | |
230 | /* If GCM/CCM mode only part of IV comes from PRF */ | |
231 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) | |
232 | k = EVP_GCM_TLS_FIXED_IV_LEN; | |
233 | else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) | |
234 | k = EVP_CCM_TLS_FIXED_IV_LEN; | |
235 | else | |
236 | k = EVP_CIPHER_iv_length(c); | |
237 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || | |
238 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
239 | ms = &(p[0]); | |
240 | n = i + i; | |
241 | key = &(p[n]); | |
242 | n += j + j; | |
243 | iv = &(p[n]); | |
244 | n += k + k; | |
245 | } else { | |
246 | n = i; | |
247 | ms = &(p[n]); | |
248 | n += i + j; | |
249 | key = &(p[n]); | |
250 | n += j + k; | |
251 | iv = &(p[n]); | |
252 | n += k; | |
253 | } | |
254 | ||
255 | if (n > s->s3->tmp.key_block_length) { | |
256 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
257 | goto err2; | |
258 | } | |
259 | ||
260 | memcpy(mac_secret, ms, i); | |
261 | ||
262 | if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { | |
263 | /* TODO(size_t): Convert this function */ | |
264 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, | |
265 | mac_secret, (int)*mac_secret_size); | |
266 | if (mac_key == NULL | |
267 | || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) { | |
268 | EVP_PKEY_free(mac_key); | |
269 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
270 | goto err2; | |
271 | } | |
272 | EVP_PKEY_free(mac_key); | |
273 | } | |
274 | #ifdef SSL_DEBUG | |
275 | printf("which = %04X\nmac key=", which); | |
276 | { | |
277 | size_t z; | |
278 | for (z = 0; z < i; z++) | |
279 | printf("%02X%c", ms[z], ((z + 1) % 16) ? ' ' : '\n'); | |
280 | } | |
281 | #endif | |
282 | ||
283 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { | |
284 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) | |
285 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, | |
286 | iv)) { | |
287 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
288 | goto err2; | |
289 | } | |
290 | } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { | |
291 | int taglen; | |
292 | if (s->s3->tmp. | |
293 | new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) | |
294 | taglen = EVP_CCM8_TLS_TAG_LEN; | |
295 | else | |
296 | taglen = EVP_CCM_TLS_TAG_LEN; | |
297 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) | |
298 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) | |
299 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) | |
300 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) | |
301 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { | |
302 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
303 | goto err2; | |
304 | } | |
305 | } else { | |
306 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
307 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
308 | goto err2; | |
309 | } | |
310 | } | |
311 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ | |
312 | if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size | |
313 | && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, | |
314 | (int)*mac_secret_size, mac_secret)) { | |
315 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); | |
316 | goto err2; | |
317 | } | |
318 | #ifdef OPENSSL_SSL_TRACE_CRYPTO | |
319 | if (s->msg_callback) { | |
320 | int wh = which & SSL3_CC_WRITE ? TLS1_RT_CRYPTO_WRITE : 0; | |
321 | if (*mac_secret_size) | |
322 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC, | |
323 | mac_secret, *mac_secret_size, | |
324 | s, s->msg_callback_arg); | |
325 | if (c->key_len) | |
326 | s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY, | |
327 | key, c->key_len, s, s->msg_callback_arg); | |
328 | if (k) { | |
329 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) | |
330 | wh |= TLS1_RT_CRYPTO_FIXED_IV; | |
331 | else | |
332 | wh |= TLS1_RT_CRYPTO_IV; | |
333 | s->msg_callback(2, s->version, wh, iv, k, s, s->msg_callback_arg); | |
334 | } | |
335 | } | |
336 | #endif | |
337 | ||
338 | #ifdef SSL_DEBUG | |
339 | printf("which = %04X\nkey=", which); | |
340 | { | |
341 | int z; | |
342 | for (z = 0; z < EVP_CIPHER_key_length(c); z++) | |
343 | printf("%02X%c", key[z], ((z + 1) % 16) ? ' ' : '\n'); | |
344 | } | |
345 | printf("\niv="); | |
346 | { | |
347 | size_t z; | |
348 | for (z = 0; z < k; z++) | |
349 | printf("%02X%c", iv[z], ((z + 1) % 16) ? ' ' : '\n'); | |
350 | } | |
351 | printf("\n"); | |
352 | #endif | |
353 | ||
354 | OPENSSL_cleanse(tmp1, sizeof(tmp1)); | |
355 | OPENSSL_cleanse(tmp2, sizeof(tmp1)); | |
356 | OPENSSL_cleanse(iv1, sizeof(iv1)); | |
357 | OPENSSL_cleanse(iv2, sizeof(iv2)); | |
358 | return (1); | |
359 | err: | |
360 | SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE); | |
361 | err2: | |
362 | OPENSSL_cleanse(tmp1, sizeof(tmp1)); | |
363 | OPENSSL_cleanse(tmp2, sizeof(tmp1)); | |
364 | OPENSSL_cleanse(iv1, sizeof(iv1)); | |
365 | OPENSSL_cleanse(iv2, sizeof(iv2)); | |
366 | return (0); | |
367 | } | |
368 | ||
369 | int tls1_setup_key_block(SSL *s) | |
370 | { | |
371 | unsigned char *p; | |
372 | const EVP_CIPHER *c; | |
373 | const EVP_MD *hash; | |
374 | SSL_COMP *comp; | |
375 | int mac_type = NID_undef; | |
376 | size_t num, mac_secret_size = 0; | |
377 | int ret = 0; | |
378 | ||
379 | if (s->s3->tmp.key_block_length != 0) | |
380 | return (1); | |
381 | ||
382 | if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, | |
383 | &comp, s->ext.use_etm)) { | |
384 | SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE); | |
385 | return (0); | |
386 | } | |
387 | ||
388 | s->s3->tmp.new_sym_enc = c; | |
389 | s->s3->tmp.new_hash = hash; | |
390 | s->s3->tmp.new_mac_pkey_type = mac_type; | |
391 | s->s3->tmp.new_mac_secret_size = mac_secret_size; | |
392 | num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c); | |
393 | num *= 2; | |
394 | ||
395 | ssl3_cleanup_key_block(s); | |
396 | ||
397 | if ((p = OPENSSL_malloc(num)) == NULL) { | |
398 | SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE); | |
399 | goto err; | |
400 | } | |
401 | ||
402 | s->s3->tmp.key_block_length = num; | |
403 | s->s3->tmp.key_block = p; | |
404 | ||
405 | #ifdef SSL_DEBUG | |
406 | printf("client random\n"); | |
407 | { | |
408 | int z; | |
409 | for (z = 0; z < SSL3_RANDOM_SIZE; z++) | |
410 | printf("%02X%c", s->s3->client_random[z], | |
411 | ((z + 1) % 16) ? ' ' : '\n'); | |
412 | } | |
413 | printf("server random\n"); | |
414 | { | |
415 | int z; | |
416 | for (z = 0; z < SSL3_RANDOM_SIZE; z++) | |
417 | printf("%02X%c", s->s3->server_random[z], | |
418 | ((z + 1) % 16) ? ' ' : '\n'); | |
419 | } | |
420 | printf("master key\n"); | |
421 | { | |
422 | size_t z; | |
423 | for (z = 0; z < s->session->master_key_length; z++) | |
424 | printf("%02X%c", s->session->master_key[z], | |
425 | ((z + 1) % 16) ? ' ' : '\n'); | |
426 | } | |
427 | #endif | |
428 | if (!tls1_generate_key_block(s, p, num)) | |
429 | goto err; | |
430 | #ifdef SSL_DEBUG | |
431 | printf("\nkey block\n"); | |
432 | { | |
433 | size_t z; | |
434 | for (z = 0; z < num; z++) | |
435 | printf("%02X%c", p[z], ((z + 1) % 16) ? ' ' : '\n'); | |
436 | } | |
437 | #endif | |
438 | ||
439 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) | |
440 | && s->method->version <= TLS1_VERSION) { | |
441 | /* | |
442 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
443 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
444 | */ | |
445 | s->s3->need_empty_fragments = 1; | |
446 | ||
447 | if (s->session->cipher != NULL) { | |
448 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
449 | s->s3->need_empty_fragments = 0; | |
450 | ||
451 | #ifndef OPENSSL_NO_RC4 | |
452 | if (s->session->cipher->algorithm_enc == SSL_RC4) | |
453 | s->s3->need_empty_fragments = 0; | |
454 | #endif | |
455 | } | |
456 | } | |
457 | ||
458 | ret = 1; | |
459 | err: | |
460 | return (ret); | |
461 | } | |
462 | ||
463 | size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, | |
464 | unsigned char *out) | |
465 | { | |
466 | size_t hashlen; | |
467 | unsigned char hash[EVP_MAX_MD_SIZE]; | |
468 | ||
469 | if (!ssl3_digest_cached_records(s, 0)) | |
470 | return 0; | |
471 | ||
472 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) | |
473 | return 0; | |
474 | ||
475 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, | |
476 | s->session->master_key, s->session->master_key_length, | |
477 | out, TLS1_FINISH_MAC_LENGTH)) | |
478 | return 0; | |
479 | OPENSSL_cleanse(hash, hashlen); | |
480 | return TLS1_FINISH_MAC_LENGTH; | |
481 | } | |
482 | ||
483 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, | |
484 | size_t len, size_t *secret_size) | |
485 | { | |
486 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { | |
487 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; | |
488 | size_t hashlen; | |
489 | /* | |
490 | * Digest cached records keeping record buffer (if present): this wont | |
491 | * affect client auth because we're freezing the buffer at the same | |
492 | * point (after client key exchange and before certificate verify) | |
493 | */ | |
494 | if (!ssl3_digest_cached_records(s, 1)) | |
495 | return 0; | |
496 | if(!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) | |
497 | return 0; | |
498 | #ifdef SSL_DEBUG | |
499 | fprintf(stderr, "Handshake hashes:\n"); | |
500 | BIO_dump_fp(stderr, (char *)hash, hashlen); | |
501 | #endif | |
502 | tls1_PRF(s, | |
503 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
504 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
505 | hash, hashlen, | |
506 | NULL, 0, | |
507 | NULL, 0, | |
508 | NULL, 0, p, len, s->session->master_key, | |
509 | SSL3_MASTER_SECRET_SIZE); | |
510 | OPENSSL_cleanse(hash, hashlen); | |
511 | } else { | |
512 | tls1_PRF(s, | |
513 | TLS_MD_MASTER_SECRET_CONST, | |
514 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
515 | s->s3->client_random, SSL3_RANDOM_SIZE, | |
516 | NULL, 0, | |
517 | s->s3->server_random, SSL3_RANDOM_SIZE, | |
518 | NULL, 0, p, len, s->session->master_key, | |
519 | SSL3_MASTER_SECRET_SIZE); | |
520 | } | |
521 | #ifdef SSL_DEBUG | |
522 | fprintf(stderr, "Premaster Secret:\n"); | |
523 | BIO_dump_fp(stderr, (char *)p, len); | |
524 | fprintf(stderr, "Client Random:\n"); | |
525 | BIO_dump_fp(stderr, (char *)s->s3->client_random, SSL3_RANDOM_SIZE); | |
526 | fprintf(stderr, "Server Random:\n"); | |
527 | BIO_dump_fp(stderr, (char *)s->s3->server_random, SSL3_RANDOM_SIZE); | |
528 | fprintf(stderr, "Master Secret:\n"); | |
529 | BIO_dump_fp(stderr, (char *)s->session->master_key, | |
530 | SSL3_MASTER_SECRET_SIZE); | |
531 | #endif | |
532 | ||
533 | #ifdef OPENSSL_SSL_TRACE_CRYPTO | |
534 | if (s->msg_callback) { | |
535 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_PREMASTER, | |
536 | p, len, s, s->msg_callback_arg); | |
537 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_CLIENT_RANDOM, | |
538 | s->s3->client_random, SSL3_RANDOM_SIZE, | |
539 | s, s->msg_callback_arg); | |
540 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_SERVER_RANDOM, | |
541 | s->s3->server_random, SSL3_RANDOM_SIZE, | |
542 | s, s->msg_callback_arg); | |
543 | s->msg_callback(2, s->version, TLS1_RT_CRYPTO_MASTER, | |
544 | s->session->master_key, | |
545 | SSL3_MASTER_SECRET_SIZE, s, s->msg_callback_arg); | |
546 | } | |
547 | #endif | |
548 | ||
549 | *secret_size = SSL3_MASTER_SECRET_SIZE; | |
550 | return 1; | |
551 | } | |
552 | ||
553 | int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, | |
554 | const char *label, size_t llen, | |
555 | const unsigned char *context, | |
556 | size_t contextlen, int use_context) | |
557 | { | |
558 | unsigned char *val = NULL; | |
559 | size_t vallen = 0, currentvalpos; | |
560 | int rv; | |
561 | ||
562 | /* | |
563 | * construct PRF arguments we construct the PRF argument ourself rather | |
564 | * than passing separate values into the TLS PRF to ensure that the | |
565 | * concatenation of values does not create a prohibited label. | |
566 | */ | |
567 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
568 | if (use_context) { | |
569 | vallen += 2 + contextlen; | |
570 | } | |
571 | ||
572 | val = OPENSSL_malloc(vallen); | |
573 | if (val == NULL) | |
574 | goto err2; | |
575 | currentvalpos = 0; | |
576 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
577 | currentvalpos += llen; | |
578 | memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE); | |
579 | currentvalpos += SSL3_RANDOM_SIZE; | |
580 | memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE); | |
581 | currentvalpos += SSL3_RANDOM_SIZE; | |
582 | ||
583 | if (use_context) { | |
584 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
585 | currentvalpos++; | |
586 | val[currentvalpos] = contextlen & 0xff; | |
587 | currentvalpos++; | |
588 | if ((contextlen > 0) || (context != NULL)) { | |
589 | memcpy(val + currentvalpos, context, contextlen); | |
590 | } | |
591 | } | |
592 | ||
593 | /* | |
594 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
595 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
596 | * the comparisons won't have buffer overflow | |
597 | */ | |
598 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
599 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
600 | goto err1; | |
601 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
602 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
603 | goto err1; | |
604 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
605 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
606 | goto err1; | |
607 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
608 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
609 | goto err1; | |
610 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, | |
611 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
612 | goto err1; | |
613 | ||
614 | rv = tls1_PRF(s, | |
615 | val, vallen, | |
616 | NULL, 0, | |
617 | NULL, 0, | |
618 | NULL, 0, | |
619 | NULL, 0, | |
620 | s->session->master_key, s->session->master_key_length, | |
621 | out, olen); | |
622 | ||
623 | goto ret; | |
624 | err1: | |
625 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); | |
626 | rv = 0; | |
627 | goto ret; | |
628 | err2: | |
629 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); | |
630 | rv = 0; | |
631 | ret: | |
632 | OPENSSL_clear_free(val, vallen); | |
633 | return (rv); | |
634 | } | |
635 | ||
636 | int tls1_alert_code(int code) | |
637 | { | |
638 | switch (code) { | |
639 | case SSL_AD_CLOSE_NOTIFY: | |
640 | return (SSL3_AD_CLOSE_NOTIFY); | |
641 | case SSL_AD_UNEXPECTED_MESSAGE: | |
642 | return (SSL3_AD_UNEXPECTED_MESSAGE); | |
643 | case SSL_AD_BAD_RECORD_MAC: | |
644 | return (SSL3_AD_BAD_RECORD_MAC); | |
645 | case SSL_AD_DECRYPTION_FAILED: | |
646 | return (TLS1_AD_DECRYPTION_FAILED); | |
647 | case SSL_AD_RECORD_OVERFLOW: | |
648 | return (TLS1_AD_RECORD_OVERFLOW); | |
649 | case SSL_AD_DECOMPRESSION_FAILURE: | |
650 | return (SSL3_AD_DECOMPRESSION_FAILURE); | |
651 | case SSL_AD_HANDSHAKE_FAILURE: | |
652 | return (SSL3_AD_HANDSHAKE_FAILURE); | |
653 | case SSL_AD_NO_CERTIFICATE: | |
654 | return (-1); | |
655 | case SSL_AD_BAD_CERTIFICATE: | |
656 | return (SSL3_AD_BAD_CERTIFICATE); | |
657 | case SSL_AD_UNSUPPORTED_CERTIFICATE: | |
658 | return (SSL3_AD_UNSUPPORTED_CERTIFICATE); | |
659 | case SSL_AD_CERTIFICATE_REVOKED: | |
660 | return (SSL3_AD_CERTIFICATE_REVOKED); | |
661 | case SSL_AD_CERTIFICATE_EXPIRED: | |
662 | return (SSL3_AD_CERTIFICATE_EXPIRED); | |
663 | case SSL_AD_CERTIFICATE_UNKNOWN: | |
664 | return (SSL3_AD_CERTIFICATE_UNKNOWN); | |
665 | case SSL_AD_ILLEGAL_PARAMETER: | |
666 | return (SSL3_AD_ILLEGAL_PARAMETER); | |
667 | case SSL_AD_UNKNOWN_CA: | |
668 | return (TLS1_AD_UNKNOWN_CA); | |
669 | case SSL_AD_ACCESS_DENIED: | |
670 | return (TLS1_AD_ACCESS_DENIED); | |
671 | case SSL_AD_DECODE_ERROR: | |
672 | return (TLS1_AD_DECODE_ERROR); | |
673 | case SSL_AD_DECRYPT_ERROR: | |
674 | return (TLS1_AD_DECRYPT_ERROR); | |
675 | case SSL_AD_EXPORT_RESTRICTION: | |
676 | return (TLS1_AD_EXPORT_RESTRICTION); | |
677 | case SSL_AD_PROTOCOL_VERSION: | |
678 | return (TLS1_AD_PROTOCOL_VERSION); | |
679 | case SSL_AD_INSUFFICIENT_SECURITY: | |
680 | return (TLS1_AD_INSUFFICIENT_SECURITY); | |
681 | case SSL_AD_INTERNAL_ERROR: | |
682 | return (TLS1_AD_INTERNAL_ERROR); | |
683 | case SSL_AD_USER_CANCELLED: | |
684 | return (TLS1_AD_USER_CANCELLED); | |
685 | case SSL_AD_NO_RENEGOTIATION: | |
686 | return (TLS1_AD_NO_RENEGOTIATION); | |
687 | case SSL_AD_UNSUPPORTED_EXTENSION: | |
688 | return (TLS1_AD_UNSUPPORTED_EXTENSION); | |
689 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: | |
690 | return (TLS1_AD_CERTIFICATE_UNOBTAINABLE); | |
691 | case SSL_AD_UNRECOGNIZED_NAME: | |
692 | return (TLS1_AD_UNRECOGNIZED_NAME); | |
693 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: | |
694 | return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE); | |
695 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: | |
696 | return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE); | |
697 | case SSL_AD_UNKNOWN_PSK_IDENTITY: | |
698 | return (TLS1_AD_UNKNOWN_PSK_IDENTITY); | |
699 | case SSL_AD_INAPPROPRIATE_FALLBACK: | |
700 | return (TLS1_AD_INAPPROPRIATE_FALLBACK); | |
701 | case SSL_AD_NO_APPLICATION_PROTOCOL: | |
702 | return (TLS1_AD_NO_APPLICATION_PROTOCOL); | |
703 | default: | |
704 | return (-1); | |
705 | } | |
706 | } |