2 * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright 2005 Nokia. All rights reserved.
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
13 #include "record/record_locl.h"
14 #include "internal/ktls.h"
15 #include "internal/cryptlib.h"
16 #include <openssl/comp.h>
17 #include <openssl/evp.h>
18 #include <openssl/kdf.h>
19 #include <openssl/rand.h>
20 #include <openssl/obj_mac.h>
21 #include <openssl/trace.h>
23 /* seed1 through seed5 are concatenated */
24 static int tls1_PRF(SSL
*s
,
25 const void *seed1
, size_t seed1_len
,
26 const void *seed2
, size_t seed2_len
,
27 const void *seed3
, size_t seed3_len
,
28 const void *seed4
, size_t seed4_len
,
29 const void *seed5
, size_t seed5_len
,
30 const unsigned char *sec
, size_t slen
,
31 unsigned char *out
, size_t olen
, int fatal
)
33 const EVP_MD
*md
= ssl_prf_md(s
);
34 EVP_KDF_CTX
*kctx
= NULL
;
38 /* Should never happen */
40 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_PRF
,
41 ERR_R_INTERNAL_ERROR
);
43 SSLerr(SSL_F_TLS1_PRF
, ERR_R_INTERNAL_ERROR
);
46 kctx
= EVP_KDF_CTX_new_id(EVP_PKEY_TLS1_PRF
);
48 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_SET_MD
, md
) <= 0
49 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_SET_TLS_SECRET
,
50 sec
, (size_t)slen
) <= 0
51 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_ADD_TLS_SEED
,
52 seed1
, (size_t)seed1_len
) <= 0
53 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_ADD_TLS_SEED
,
54 seed2
, (size_t)seed2_len
) <= 0
55 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_ADD_TLS_SEED
,
56 seed3
, (size_t)seed3_len
) <= 0
57 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_ADD_TLS_SEED
,
58 seed4
, (size_t)seed4_len
) <= 0
59 || EVP_KDF_ctrl(kctx
, EVP_KDF_CTRL_ADD_TLS_SEED
,
60 seed5
, (size_t)seed5_len
) <= 0
61 || EVP_KDF_derive(kctx
, out
, olen
) <= 0) {
63 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_PRF
,
64 ERR_R_INTERNAL_ERROR
);
66 SSLerr(SSL_F_TLS1_PRF
, ERR_R_INTERNAL_ERROR
);
73 EVP_KDF_CTX_free(kctx
);
77 static int tls1_generate_key_block(SSL
*s
, unsigned char *km
, size_t num
)
81 /* Calls SSLfatal() as required */
83 TLS_MD_KEY_EXPANSION_CONST
,
84 TLS_MD_KEY_EXPANSION_CONST_SIZE
, s
->s3
.server_random
,
85 SSL3_RANDOM_SIZE
, s
->s3
.client_random
, SSL3_RANDOM_SIZE
,
86 NULL
, 0, NULL
, 0, s
->session
->master_key
,
87 s
->session
->master_key_length
, km
, num
, 1);
92 #ifndef OPENSSL_NO_KTLS
94 * Count the number of records that were not processed yet from record boundary.
96 * This function assumes that there are only fully formed records read in the
97 * record layer. If read_ahead is enabled, then this might be false and this
100 static int count_unprocessed_records(SSL
*s
)
102 SSL3_BUFFER
*rbuf
= RECORD_LAYER_get_rbuf(&s
->rlayer
);
106 if (!PACKET_buf_init(&pkt
, rbuf
->buf
+ rbuf
->offset
, rbuf
->left
))
109 while (PACKET_remaining(&pkt
) > 0) {
110 /* Skip record type and version */
111 if (!PACKET_forward(&pkt
, 3))
114 /* Read until next record */
115 if (PACKET_get_length_prefixed_2(&pkt
, &subpkt
))
125 int tls1_change_cipher_state(SSL
*s
, int which
)
127 unsigned char *p
, *mac_secret
;
128 unsigned char *ms
, *key
, *iv
;
131 #ifndef OPENSSL_NO_COMP
132 const SSL_COMP
*comp
;
136 size_t *mac_secret_size
;
139 size_t n
, i
, j
, k
, cl
;
141 #ifndef OPENSSL_NO_KTLS
142 struct tls12_crypto_info_aes_gcm_128 crypto_info
;
144 unsigned char geniv
[12];
145 int count_unprocessed
;
149 c
= s
->s3
.tmp
.new_sym_enc
;
150 m
= s
->s3
.tmp
.new_hash
;
151 mac_type
= s
->s3
.tmp
.new_mac_pkey_type
;
152 #ifndef OPENSSL_NO_COMP
153 comp
= s
->s3
.tmp
.new_compression
;
156 if (which
& SSL3_CC_READ
) {
158 s
->s3
.flags
|= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ
;
160 s
->s3
.flags
&= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ
;
162 if (s
->s3
.tmp
.new_cipher
->algorithm2
& TLS1_STREAM_MAC
)
163 s
->mac_flags
|= SSL_MAC_FLAG_READ_MAC_STREAM
;
165 s
->mac_flags
&= ~SSL_MAC_FLAG_READ_MAC_STREAM
;
167 if (s
->enc_read_ctx
!= NULL
) {
169 } else if ((s
->enc_read_ctx
= EVP_CIPHER_CTX_new()) == NULL
) {
170 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
171 ERR_R_MALLOC_FAILURE
);
175 * make sure it's initialised in case we exit later with an error
177 EVP_CIPHER_CTX_reset(s
->enc_read_ctx
);
179 dd
= s
->enc_read_ctx
;
180 mac_ctx
= ssl_replace_hash(&s
->read_hash
, NULL
);
181 if (mac_ctx
== NULL
) {
182 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
183 ERR_R_INTERNAL_ERROR
);
186 #ifndef OPENSSL_NO_COMP
187 COMP_CTX_free(s
->expand
);
190 s
->expand
= COMP_CTX_new(comp
->method
);
191 if (s
->expand
== NULL
) {
192 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
193 SSL_F_TLS1_CHANGE_CIPHER_STATE
,
194 SSL_R_COMPRESSION_LIBRARY_ERROR
);
200 * this is done by dtls1_reset_seq_numbers for DTLS
203 RECORD_LAYER_reset_read_sequence(&s
->rlayer
);
204 mac_secret
= &(s
->s3
.read_mac_secret
[0]);
205 mac_secret_size
= &(s
->s3
.read_mac_secret_size
);
207 s
->statem
.enc_write_state
= ENC_WRITE_STATE_INVALID
;
209 s
->s3
.flags
|= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE
;
211 s
->s3
.flags
&= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE
;
213 if (s
->s3
.tmp
.new_cipher
->algorithm2
& TLS1_STREAM_MAC
)
214 s
->mac_flags
|= SSL_MAC_FLAG_WRITE_MAC_STREAM
;
216 s
->mac_flags
&= ~SSL_MAC_FLAG_WRITE_MAC_STREAM
;
217 if (s
->enc_write_ctx
!= NULL
&& !SSL_IS_DTLS(s
)) {
219 } else if ((s
->enc_write_ctx
= EVP_CIPHER_CTX_new()) == NULL
) {
220 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
221 ERR_R_MALLOC_FAILURE
);
224 dd
= s
->enc_write_ctx
;
225 if (SSL_IS_DTLS(s
)) {
226 mac_ctx
= EVP_MD_CTX_new();
227 if (mac_ctx
== NULL
) {
228 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
229 SSL_F_TLS1_CHANGE_CIPHER_STATE
,
230 ERR_R_MALLOC_FAILURE
);
233 s
->write_hash
= mac_ctx
;
235 mac_ctx
= ssl_replace_hash(&s
->write_hash
, NULL
);
236 if (mac_ctx
== NULL
) {
237 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
238 SSL_F_TLS1_CHANGE_CIPHER_STATE
,
239 ERR_R_MALLOC_FAILURE
);
243 #ifndef OPENSSL_NO_COMP
244 COMP_CTX_free(s
->compress
);
247 s
->compress
= COMP_CTX_new(comp
->method
);
248 if (s
->compress
== NULL
) {
249 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
250 SSL_F_TLS1_CHANGE_CIPHER_STATE
,
251 SSL_R_COMPRESSION_LIBRARY_ERROR
);
257 * this is done by dtls1_reset_seq_numbers for DTLS
260 RECORD_LAYER_reset_write_sequence(&s
->rlayer
);
261 mac_secret
= &(s
->s3
.write_mac_secret
[0]);
262 mac_secret_size
= &(s
->s3
.write_mac_secret_size
);
266 EVP_CIPHER_CTX_reset(dd
);
268 p
= s
->s3
.tmp
.key_block
;
269 i
= *mac_secret_size
= s
->s3
.tmp
.new_mac_secret_size
;
271 /* TODO(size_t): convert me */
272 cl
= EVP_CIPHER_key_length(c
);
274 /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
275 /* If GCM/CCM mode only part of IV comes from PRF */
276 if (EVP_CIPHER_mode(c
) == EVP_CIPH_GCM_MODE
)
277 k
= EVP_GCM_TLS_FIXED_IV_LEN
;
278 else if (EVP_CIPHER_mode(c
) == EVP_CIPH_CCM_MODE
)
279 k
= EVP_CCM_TLS_FIXED_IV_LEN
;
281 k
= EVP_CIPHER_iv_length(c
);
282 if ((which
== SSL3_CHANGE_CIPHER_CLIENT_WRITE
) ||
283 (which
== SSL3_CHANGE_CIPHER_SERVER_READ
)) {
300 if (n
> s
->s3
.tmp
.key_block_length
) {
301 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
302 ERR_R_INTERNAL_ERROR
);
306 memcpy(mac_secret
, ms
, i
);
308 if (!(EVP_CIPHER_flags(c
) & EVP_CIPH_FLAG_AEAD_CIPHER
)) {
309 /* TODO(size_t): Convert this function */
310 mac_key
= EVP_PKEY_new_mac_key(mac_type
, NULL
, mac_secret
,
311 (int)*mac_secret_size
);
313 || EVP_DigestSignInit(mac_ctx
, NULL
, m
, NULL
, mac_key
) <= 0) {
314 EVP_PKEY_free(mac_key
);
315 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
316 ERR_R_INTERNAL_ERROR
);
319 EVP_PKEY_free(mac_key
);
322 OSSL_TRACE_BEGIN(TLS
) {
323 BIO_printf(trc_out
, "which = %04X, mac key:\n", which
);
324 BIO_dump_indent(trc_out
, ms
, i
, 4);
325 } OSSL_TRACE_END(TLS
);
327 if (EVP_CIPHER_mode(c
) == EVP_CIPH_GCM_MODE
) {
328 if (!EVP_CipherInit_ex(dd
, c
, NULL
, key
, NULL
, (which
& SSL3_CC_WRITE
))
329 || !EVP_CIPHER_CTX_ctrl(dd
, EVP_CTRL_GCM_SET_IV_FIXED
, (int)k
,
331 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
332 ERR_R_INTERNAL_ERROR
);
335 } else if (EVP_CIPHER_mode(c
) == EVP_CIPH_CCM_MODE
) {
338 new_cipher
->algorithm_enc
& (SSL_AES128CCM8
| SSL_AES256CCM8
))
339 taglen
= EVP_CCM8_TLS_TAG_LEN
;
341 taglen
= EVP_CCM_TLS_TAG_LEN
;
342 if (!EVP_CipherInit_ex(dd
, c
, NULL
, NULL
, NULL
, (which
& SSL3_CC_WRITE
))
343 || !EVP_CIPHER_CTX_ctrl(dd
, EVP_CTRL_AEAD_SET_IVLEN
, 12, NULL
)
344 || !EVP_CIPHER_CTX_ctrl(dd
, EVP_CTRL_AEAD_SET_TAG
, taglen
, NULL
)
345 || !EVP_CIPHER_CTX_ctrl(dd
, EVP_CTRL_CCM_SET_IV_FIXED
, (int)k
, iv
)
346 || !EVP_CipherInit_ex(dd
, NULL
, NULL
, key
, NULL
, -1)) {
347 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
348 ERR_R_INTERNAL_ERROR
);
352 if (!EVP_CipherInit_ex(dd
, c
, NULL
, key
, iv
, (which
& SSL3_CC_WRITE
))) {
353 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
354 ERR_R_INTERNAL_ERROR
);
358 /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
359 if ((EVP_CIPHER_flags(c
) & EVP_CIPH_FLAG_AEAD_CIPHER
) && *mac_secret_size
360 && !EVP_CIPHER_CTX_ctrl(dd
, EVP_CTRL_AEAD_SET_MAC_KEY
,
361 (int)*mac_secret_size
, mac_secret
)) {
362 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
363 ERR_R_INTERNAL_ERROR
);
366 #ifndef OPENSSL_NO_KTLS
370 if (((which
& SSL3_CC_READ
) && (s
->mode
& SSL_MODE_NO_KTLS_RX
))
371 || ((which
& SSL3_CC_WRITE
) && (s
->mode
& SSL_MODE_NO_KTLS_TX
)))
374 /* ktls supports only the maximum fragment size */
375 if (ssl_get_max_send_fragment(s
) != SSL3_RT_MAX_PLAIN_LENGTH
)
378 /* check that cipher is AES_GCM_128 */
379 if (EVP_CIPHER_nid(c
) != NID_aes_128_gcm
380 || EVP_CIPHER_mode(c
) != EVP_CIPH_GCM_MODE
381 || EVP_CIPHER_key_length(c
) != TLS_CIPHER_AES_GCM_128_KEY_SIZE
)
384 /* check version is 1.2 */
385 if (s
->version
!= TLS1_2_VERSION
)
388 if (which
& SSL3_CC_WRITE
)
393 if (!ossl_assert(bio
!= NULL
)) {
394 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
395 ERR_R_INTERNAL_ERROR
);
399 /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
400 if (which
& SSL3_CC_WRITE
) {
401 if (BIO_flush(bio
) <= 0)
405 /* ktls doesn't support renegotiation */
406 if ((BIO_get_ktls_send(s
->wbio
) && (which
& SSL3_CC_WRITE
)) ||
407 (BIO_get_ktls_recv(s
->rbio
) && (which
& SSL3_CC_READ
))) {
408 SSLfatal(s
, SSL_AD_NO_RENEGOTIATION
, SSL_F_TLS1_CHANGE_CIPHER_STATE
,
409 ERR_R_INTERNAL_ERROR
);
413 memset(&crypto_info
, 0, sizeof(crypto_info
));
414 crypto_info
.info
.cipher_type
= TLS_CIPHER_AES_GCM_128
;
415 crypto_info
.info
.version
= s
->version
;
417 EVP_CIPHER_CTX_ctrl(dd
, EVP_CTRL_GET_IV
,
418 EVP_GCM_TLS_FIXED_IV_LEN
+ EVP_GCM_TLS_EXPLICIT_IV_LEN
,
420 memcpy(crypto_info
.iv
, geniv
+ EVP_GCM_TLS_FIXED_IV_LEN
,
421 TLS_CIPHER_AES_GCM_128_IV_SIZE
);
422 memcpy(crypto_info
.salt
, geniv
, TLS_CIPHER_AES_GCM_128_SALT_SIZE
);
423 memcpy(crypto_info
.key
, key
, EVP_CIPHER_key_length(c
));
424 if (which
& SSL3_CC_WRITE
)
425 memcpy(crypto_info
.rec_seq
, &s
->rlayer
.write_sequence
,
426 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE
);
428 memcpy(crypto_info
.rec_seq
, &s
->rlayer
.read_sequence
,
429 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE
);
431 if (which
& SSL3_CC_READ
) {
432 count_unprocessed
= count_unprocessed_records(s
);
433 if (count_unprocessed
< 0)
436 /* increment the crypto_info record sequence */
437 while (count_unprocessed
) {
438 for (bit
= 7; bit
>= 0; bit
--) { /* increment */
439 ++crypto_info
.rec_seq
[bit
];
440 if (crypto_info
.rec_seq
[bit
] != 0)
447 /* ktls works with user provided buffers directly */
448 if (BIO_set_ktls(bio
, &crypto_info
, which
& SSL3_CC_WRITE
)) {
449 if (which
& SSL3_CC_WRITE
)
450 ssl3_release_write_buffer(s
);
451 SSL_set_options(s
, SSL_OP_NO_RENEGOTIATION
);
455 #endif /* OPENSSL_NO_KTLS */
456 s
->statem
.enc_write_state
= ENC_WRITE_STATE_VALID
;
458 OSSL_TRACE_BEGIN(TLS
) {
459 BIO_printf(trc_out
, "which = %04X, key:\n", which
);
460 BIO_dump_indent(trc_out
, key
, EVP_CIPHER_key_length(c
), 4);
461 BIO_printf(trc_out
, "iv:\n");
462 BIO_dump_indent(trc_out
, iv
, k
, 4);
463 } OSSL_TRACE_END(TLS
);
470 int tls1_setup_key_block(SSL
*s
)
476 int mac_type
= NID_undef
;
477 size_t num
, mac_secret_size
= 0;
480 if (s
->s3
.tmp
.key_block_length
!= 0)
483 if (!ssl_cipher_get_evp(s
->session
, &c
, &hash
, &mac_type
, &mac_secret_size
,
484 &comp
, s
->ext
.use_etm
)) {
485 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_SETUP_KEY_BLOCK
,
486 SSL_R_CIPHER_OR_HASH_UNAVAILABLE
);
490 s
->s3
.tmp
.new_sym_enc
= c
;
491 s
->s3
.tmp
.new_hash
= hash
;
492 s
->s3
.tmp
.new_mac_pkey_type
= mac_type
;
493 s
->s3
.tmp
.new_mac_secret_size
= mac_secret_size
;
494 num
= EVP_CIPHER_key_length(c
) + mac_secret_size
+ EVP_CIPHER_iv_length(c
);
497 ssl3_cleanup_key_block(s
);
499 if ((p
= OPENSSL_malloc(num
)) == NULL
) {
500 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS1_SETUP_KEY_BLOCK
,
501 ERR_R_MALLOC_FAILURE
);
505 s
->s3
.tmp
.key_block_length
= num
;
506 s
->s3
.tmp
.key_block
= p
;
508 OSSL_TRACE_BEGIN(TLS
) {
509 BIO_printf(trc_out
, "client random\n");
510 BIO_dump_indent(trc_out
, s
->s3
.client_random
, SSL3_RANDOM_SIZE
, 4);
511 BIO_printf(trc_out
, "server random\n");
512 BIO_dump_indent(trc_out
, s
->s3
.server_random
, SSL3_RANDOM_SIZE
, 4);
513 BIO_printf(trc_out
, "master key\n");
514 BIO_dump_indent(trc_out
,
515 s
->session
->master_key
,
516 s
->session
->master_key_length
, 4);
517 } OSSL_TRACE_END(TLS
);
519 if (!tls1_generate_key_block(s
, p
, num
)) {
520 /* SSLfatal() already called */
524 OSSL_TRACE_BEGIN(TLS
) {
525 BIO_printf(trc_out
, "key block\n");
526 BIO_dump_indent(trc_out
, p
, num
, 4);
527 } OSSL_TRACE_END(TLS
);
529 if (!(s
->options
& SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
)
530 && s
->method
->version
<= TLS1_VERSION
) {
532 * enable vulnerability countermeasure for CBC ciphers with known-IV
533 * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
535 s
->s3
.need_empty_fragments
= 1;
537 if (s
->session
->cipher
!= NULL
) {
538 if (s
->session
->cipher
->algorithm_enc
== SSL_eNULL
)
539 s
->s3
.need_empty_fragments
= 0;
541 #ifndef OPENSSL_NO_RC4
542 if (s
->session
->cipher
->algorithm_enc
== SSL_RC4
)
543 s
->s3
.need_empty_fragments
= 0;
553 size_t tls1_final_finish_mac(SSL
*s
, const char *str
, size_t slen
,
557 unsigned char hash
[EVP_MAX_MD_SIZE
];
559 if (!ssl3_digest_cached_records(s
, 0)) {
560 /* SSLfatal() already called */
564 if (!ssl_handshake_hash(s
, hash
, sizeof(hash
), &hashlen
)) {
565 /* SSLfatal() already called */
569 if (!tls1_PRF(s
, str
, slen
, hash
, hashlen
, NULL
, 0, NULL
, 0, NULL
, 0,
570 s
->session
->master_key
, s
->session
->master_key_length
,
571 out
, TLS1_FINISH_MAC_LENGTH
, 1)) {
572 /* SSLfatal() already called */
575 OPENSSL_cleanse(hash
, hashlen
);
576 return TLS1_FINISH_MAC_LENGTH
;
579 int tls1_generate_master_secret(SSL
*s
, unsigned char *out
, unsigned char *p
,
580 size_t len
, size_t *secret_size
)
582 if (s
->session
->flags
& SSL_SESS_FLAG_EXTMS
) {
583 unsigned char hash
[EVP_MAX_MD_SIZE
* 2];
586 * Digest cached records keeping record buffer (if present): this wont
587 * affect client auth because we're freezing the buffer at the same
588 * point (after client key exchange and before certificate verify)
590 if (!ssl3_digest_cached_records(s
, 1)
591 || !ssl_handshake_hash(s
, hash
, sizeof(hash
), &hashlen
)) {
592 /* SSLfatal() already called */
595 OSSL_TRACE_BEGIN(TLS
) {
596 BIO_printf(trc_out
, "Handshake hashes:\n");
597 BIO_dump(trc_out
, (char *)hash
, hashlen
);
598 } OSSL_TRACE_END(TLS
);
600 TLS_MD_EXTENDED_MASTER_SECRET_CONST
,
601 TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE
,
605 NULL
, 0, p
, len
, out
,
606 SSL3_MASTER_SECRET_SIZE
, 1)) {
607 /* SSLfatal() already called */
610 OPENSSL_cleanse(hash
, hashlen
);
613 TLS_MD_MASTER_SECRET_CONST
,
614 TLS_MD_MASTER_SECRET_CONST_SIZE
,
615 s
->s3
.client_random
, SSL3_RANDOM_SIZE
,
617 s
->s3
.server_random
, SSL3_RANDOM_SIZE
,
618 NULL
, 0, p
, len
, out
,
619 SSL3_MASTER_SECRET_SIZE
, 1)) {
620 /* SSLfatal() already called */
625 OSSL_TRACE_BEGIN(TLS
) {
626 BIO_printf(trc_out
, "Premaster Secret:\n");
627 BIO_dump_indent(trc_out
, p
, len
, 4);
628 BIO_printf(trc_out
, "Client Random:\n");
629 BIO_dump_indent(trc_out
, s
->s3
.client_random
, SSL3_RANDOM_SIZE
, 4);
630 BIO_printf(trc_out
, "Server Random:\n");
631 BIO_dump_indent(trc_out
, s
->s3
.server_random
, SSL3_RANDOM_SIZE
, 4);
632 BIO_printf(trc_out
, "Master Secret:\n");
633 BIO_dump_indent(trc_out
,
634 s
->session
->master_key
,
635 SSL3_MASTER_SECRET_SIZE
, 4);
636 } OSSL_TRACE_END(TLS
);
638 *secret_size
= SSL3_MASTER_SECRET_SIZE
;
642 int tls1_export_keying_material(SSL
*s
, unsigned char *out
, size_t olen
,
643 const char *label
, size_t llen
,
644 const unsigned char *context
,
645 size_t contextlen
, int use_context
)
647 unsigned char *val
= NULL
;
648 size_t vallen
= 0, currentvalpos
;
652 * construct PRF arguments we construct the PRF argument ourself rather
653 * than passing separate values into the TLS PRF to ensure that the
654 * concatenation of values does not create a prohibited label.
656 vallen
= llen
+ SSL3_RANDOM_SIZE
* 2;
658 vallen
+= 2 + contextlen
;
661 val
= OPENSSL_malloc(vallen
);
665 memcpy(val
+ currentvalpos
, (unsigned char *)label
, llen
);
666 currentvalpos
+= llen
;
667 memcpy(val
+ currentvalpos
, s
->s3
.client_random
, SSL3_RANDOM_SIZE
);
668 currentvalpos
+= SSL3_RANDOM_SIZE
;
669 memcpy(val
+ currentvalpos
, s
->s3
.server_random
, SSL3_RANDOM_SIZE
);
670 currentvalpos
+= SSL3_RANDOM_SIZE
;
673 val
[currentvalpos
] = (contextlen
>> 8) & 0xff;
675 val
[currentvalpos
] = contextlen
& 0xff;
677 if ((contextlen
> 0) || (context
!= NULL
)) {
678 memcpy(val
+ currentvalpos
, context
, contextlen
);
683 * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited
684 * label len) = 15, so size of val > max(prohibited label len) = 15 and
685 * the comparisons won't have buffer overflow
687 if (memcmp(val
, TLS_MD_CLIENT_FINISH_CONST
,
688 TLS_MD_CLIENT_FINISH_CONST_SIZE
) == 0)
690 if (memcmp(val
, TLS_MD_SERVER_FINISH_CONST
,
691 TLS_MD_SERVER_FINISH_CONST_SIZE
) == 0)
693 if (memcmp(val
, TLS_MD_MASTER_SECRET_CONST
,
694 TLS_MD_MASTER_SECRET_CONST_SIZE
) == 0)
696 if (memcmp(val
, TLS_MD_EXTENDED_MASTER_SECRET_CONST
,
697 TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE
) == 0)
699 if (memcmp(val
, TLS_MD_KEY_EXPANSION_CONST
,
700 TLS_MD_KEY_EXPANSION_CONST_SIZE
) == 0)
709 s
->session
->master_key
, s
->session
->master_key_length
,
714 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL
, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL
);
718 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL
, ERR_R_MALLOC_FAILURE
);
721 OPENSSL_clear_free(val
, vallen
);
725 int tls1_alert_code(int code
)
728 case SSL_AD_CLOSE_NOTIFY
:
729 return SSL3_AD_CLOSE_NOTIFY
;
730 case SSL_AD_UNEXPECTED_MESSAGE
:
731 return SSL3_AD_UNEXPECTED_MESSAGE
;
732 case SSL_AD_BAD_RECORD_MAC
:
733 return SSL3_AD_BAD_RECORD_MAC
;
734 case SSL_AD_DECRYPTION_FAILED
:
735 return TLS1_AD_DECRYPTION_FAILED
;
736 case SSL_AD_RECORD_OVERFLOW
:
737 return TLS1_AD_RECORD_OVERFLOW
;
738 case SSL_AD_DECOMPRESSION_FAILURE
:
739 return SSL3_AD_DECOMPRESSION_FAILURE
;
740 case SSL_AD_HANDSHAKE_FAILURE
:
741 return SSL3_AD_HANDSHAKE_FAILURE
;
742 case SSL_AD_NO_CERTIFICATE
:
744 case SSL_AD_BAD_CERTIFICATE
:
745 return SSL3_AD_BAD_CERTIFICATE
;
746 case SSL_AD_UNSUPPORTED_CERTIFICATE
:
747 return SSL3_AD_UNSUPPORTED_CERTIFICATE
;
748 case SSL_AD_CERTIFICATE_REVOKED
:
749 return SSL3_AD_CERTIFICATE_REVOKED
;
750 case SSL_AD_CERTIFICATE_EXPIRED
:
751 return SSL3_AD_CERTIFICATE_EXPIRED
;
752 case SSL_AD_CERTIFICATE_UNKNOWN
:
753 return SSL3_AD_CERTIFICATE_UNKNOWN
;
754 case SSL_AD_ILLEGAL_PARAMETER
:
755 return SSL3_AD_ILLEGAL_PARAMETER
;
756 case SSL_AD_UNKNOWN_CA
:
757 return TLS1_AD_UNKNOWN_CA
;
758 case SSL_AD_ACCESS_DENIED
:
759 return TLS1_AD_ACCESS_DENIED
;
760 case SSL_AD_DECODE_ERROR
:
761 return TLS1_AD_DECODE_ERROR
;
762 case SSL_AD_DECRYPT_ERROR
:
763 return TLS1_AD_DECRYPT_ERROR
;
764 case SSL_AD_EXPORT_RESTRICTION
:
765 return TLS1_AD_EXPORT_RESTRICTION
;
766 case SSL_AD_PROTOCOL_VERSION
:
767 return TLS1_AD_PROTOCOL_VERSION
;
768 case SSL_AD_INSUFFICIENT_SECURITY
:
769 return TLS1_AD_INSUFFICIENT_SECURITY
;
770 case SSL_AD_INTERNAL_ERROR
:
771 return TLS1_AD_INTERNAL_ERROR
;
772 case SSL_AD_USER_CANCELLED
:
773 return TLS1_AD_USER_CANCELLED
;
774 case SSL_AD_NO_RENEGOTIATION
:
775 return TLS1_AD_NO_RENEGOTIATION
;
776 case SSL_AD_UNSUPPORTED_EXTENSION
:
777 return TLS1_AD_UNSUPPORTED_EXTENSION
;
778 case SSL_AD_CERTIFICATE_UNOBTAINABLE
:
779 return TLS1_AD_CERTIFICATE_UNOBTAINABLE
;
780 case SSL_AD_UNRECOGNIZED_NAME
:
781 return TLS1_AD_UNRECOGNIZED_NAME
;
782 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE
:
783 return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
;
784 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE
:
785 return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
;
786 case SSL_AD_UNKNOWN_PSK_IDENTITY
:
787 return TLS1_AD_UNKNOWN_PSK_IDENTITY
;
788 case SSL_AD_INAPPROPRIATE_FALLBACK
:
789 return TLS1_AD_INAPPROPRIATE_FALLBACK
;
790 case SSL_AD_NO_APPLICATION_PROTOCOL
:
791 return TLS1_AD_NO_APPLICATION_PROTOCOL
;
792 case SSL_AD_CERTIFICATE_REQUIRED
:
793 return SSL_AD_HANDSHAKE_FAILURE
;