From fe5e20fd267bae655c37ba8d67d74c0db566e088 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 22 Feb 2017 14:09:42 +0000 Subject: [PATCH] Fix changing of the cipher state when dealing with early data Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/2737) --- ssl/ssl_lib.c | 1 + ssl/ssl_locl.h | 1 + ssl/statem/statem.h | 1 + ssl/statem/statem_srvr.c | 18 +++++++++++++++--- ssl/tls13_enc.c | 13 +++++++++++++ 5 files changed, 31 insertions(+), 3 deletions(-) diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index a774452a61..2f62f4b0e1 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -1657,6 +1657,7 @@ int ssl_end_of_early_data_seen(SSL *s) { if (s->early_data_state == SSL_EARLY_DATA_READING) { s->early_data_state = SSL_EARLY_DATA_FINISHED_READING; + ossl_statem_finish_early_data(s); return 1; } diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 3175009d80..f8492789f1 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -1027,6 +1027,7 @@ struct ssl_st { unsigned char client_finished_secret[EVP_MAX_MD_SIZE]; unsigned char server_finished_secret[EVP_MAX_MD_SIZE]; unsigned char server_finished_hash[EVP_MAX_MD_SIZE]; + unsigned char handshake_traffic_hash[EVP_MAX_MD_SIZE]; unsigned char client_app_traffic_secret[EVP_MAX_MD_SIZE]; unsigned char server_app_traffic_secret[EVP_MAX_MD_SIZE]; EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */ diff --git a/ssl/statem/statem.h b/ssl/statem/statem.h index 5bb74d029f..c0c9cab144 100644 --- a/ssl/statem/statem.h +++ b/ssl/statem/statem.h @@ -129,3 +129,4 @@ __owur int ossl_statem_app_data_allowed(SSL *s); void ossl_statem_set_sctp_read_sock(SSL *s, int read_sock); __owur int ossl_statem_in_sctp_read_sock(SSL *s); #endif +int ossl_statem_finish_early_data(SSL *s); diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index 3d2d39b33d..0f68ddf504 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -787,10 +787,13 @@ WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst) if (SSL_IS_TLS13(s)) { if (!s->method->ssl3_enc->setup_key_block(s) || !s->method->ssl3_enc->change_cipher_state(s, - SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_SERVER_WRITE) - || !s->method->ssl3_enc->change_cipher_state(s, + SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_SERVER_WRITE)) + return WORK_ERROR; + + if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED + && !s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE |SSL3_CHANGE_CIPHER_SERVER_READ)) - return WORK_ERROR; + return WORK_ERROR; } break; @@ -1104,6 +1107,15 @@ WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst) return WORK_FINISHED_CONTINUE; } +int ossl_statem_finish_early_data(SSL *s) +{ + if (!s->method->ssl3_enc->change_cipher_state(s, + SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_SERVER_READ)) + return 0; + + return 1; +} + #ifndef OPENSSL_NO_SRP static int ssl_check_srp_ext_ClientHello(SSL *s, int *al) { diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c index 2dc7dad629..d42be60c67 100644 --- a/ssl/tls13_enc.c +++ b/ssl/tls13_enc.c @@ -422,6 +422,16 @@ int tls13_change_cipher_state(SSL *s, int which) label = client_handshake_traffic; labellen = sizeof(client_handshake_traffic) - 1; log_label = CLIENT_HANDSHAKE_LABEL; + /* + * The hanshake hash used for the server read handshake traffic + * secret is the same as the hash for the server write handshake + * traffic secret. However, if we processed early data then we delay + * changing the server read cipher state until later, and the + * handshake hashes have moved on. Therefore we use the value saved + * earlier when we did the server write change cipher state. + */ + if (s->server) + hash = s->handshake_traffic_hash; } else { insecret = s->master_secret; label = client_application_traffic; @@ -469,6 +479,9 @@ int tls13_change_cipher_state(SSL *s, int which) if (label == server_application_traffic) memcpy(s->server_finished_hash, hashval, hashlen); + if (s->server && label == server_handshake_traffic) + memcpy(s->handshake_traffic_hash, hashval, hashlen); + if (label == client_application_traffic) { /* * We also create the resumption master secret, but this time use the -- 2.39.2