]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/statem/statem_clnt.c
Add .[ch].in files to ctags
[thirdparty/openssl.git] / ssl / statem / statem_clnt.c
CommitLineData
846e33c7 1/*
0c679f55 2 * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
aa8f3d76 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
c80149d9 4 * Copyright 2005 Nokia. All rights reserved.
8c74b5e5 5 *
2c18d164 6 * Licensed under the Apache License 2.0 (the "License"). You may not use
846e33c7
RS
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
8c74b5e5 10 */
846e33c7 11
d02b48c6 12#include <stdio.h>
fc24f0bf 13#include <time.h>
dee0cc10 14#include <assert.h>
706457b7
DMSP
15#include "../ssl_local.h"
16#include "statem_local.h"
ec577822
BM
17#include <openssl/buffer.h>
18#include <openssl/rand.h>
19#include <openssl/objects.h>
20#include <openssl/evp.h>
dbad1690 21#include <openssl/md5.h>
3c27208f 22#include <openssl/dh.h>
d7e498ac 23#include <openssl/rsa.h>
d095b68d 24#include <openssl/bn.h>
3c27208f 25#include <openssl/engine.h>
49b26f54 26#include <openssl/trace.h>
1ee22dc2
MC
27#include <openssl/core_names.h>
28#include <openssl/param_build.h>
449bdf37 29#include "internal/cryptlib.h"
da9342ed 30#include "internal/comp.h"
bf553267 31#include "internal/ssl_unwrap.h"
f9b3bff6 32
38b051a1
TM
33static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s,
34 PACKET *pkt);
35static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s,
36 PACKET *pkt);
37
38static ossl_inline int cert_req_allowed(SSL_CONNECTION *s);
39static int key_exchange_expected(SSL_CONNECTION *s);
40static int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk,
ae2f7b37 41 WPACKET *pkt);
ea262260 42
3c95ef22
TS
43static ossl_inline int received_server_cert(SSL_CONNECTION *sc)
44{
45 return sc->session->peer_rpk != NULL || sc->session->peer != NULL;
46}
47
61ae935a
MC
48/*
49 * Is a CertificateRequest message allowed at the moment or not?
50 *
51 * Return values are:
52 * 1: Yes
53 * 0: No
54 */
38b051a1 55static ossl_inline int cert_req_allowed(SSL_CONNECTION *s)
61ae935a
MC
56{
57 /* TLS does not like anon-DH with client cert */
b7fa1f98 58 if ((s->version > SSL3_VERSION
555cbb32
TS
59 && (s->s3.tmp.new_cipher->algorithm_auth & SSL_aNULL))
60 || (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK)))
61ae935a
MC
61 return 0;
62
63 return 1;
64}
65
66/*
a455d0f6 67 * Should we expect the ServerKeyExchange message or not?
61ae935a
MC
68 *
69 * Return values are:
70 * 1: Yes
71 * 0: No
72 */
38b051a1 73static int key_exchange_expected(SSL_CONNECTION *s)
61ae935a 74{
555cbb32 75 long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
61ae935a
MC
76
77 /*
78 * Can't skip server key exchange if this is an ephemeral
a455d0f6 79 * ciphersuite or for SRP
61ae935a 80 */
a455d0f6
MC
81 if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK
82 | SSL_kSRP)) {
83 return 1;
61ae935a
MC
84 }
85
a455d0f6 86 return 0;
61ae935a
MC
87}
88
0f1e51ea
MC
89/*
90 * ossl_statem_client_read_transition() encapsulates the logic for the allowed
91 * handshake state transitions when a TLS1.3 client is reading messages from the
92 * server. The message type that the server has sent is provided in |mt|. The
93 * current state is in |s->statem.hand_state|.
94 *
94ed2c67
MC
95 * Return values are 1 for success (transition allowed) and 0 on error
96 * (transition not allowed)
0f1e51ea 97 */
38b051a1 98static int ossl_statem_client13_read_transition(SSL_CONNECTION *s, int mt)
0f1e51ea
MC
99{
100 OSSL_STATEM *st = &s->statem;
101
102 /*
103 * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't
104 * yet negotiated TLSv1.3 at that point so that is handled by
105 * ossl_statem_client_read_transition()
106 */
107
108 switch (st->hand_state) {
109 default:
110 break;
111
3847d426
MC
112 case TLS_ST_CW_CLNT_HELLO:
113 /*
114 * This must a ClientHello following a HelloRetryRequest, so the only
115 * thing we can get now is a ServerHello.
116 */
117 if (mt == SSL3_MT_SERVER_HELLO) {
118 st->hand_state = TLS_ST_CR_SRVR_HELLO;
119 return 1;
120 }
121 break;
122
0f1e51ea 123 case TLS_ST_CR_SRVR_HELLO:
e46f2334
MC
124 if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) {
125 st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS;
126 return 1;
127 }
128 break;
129
130 case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
0f1e51ea 131 if (s->hit) {
92760c21
MC
132 if (mt == SSL3_MT_FINISHED) {
133 st->hand_state = TLS_ST_CR_FINISHED;
0f1e51ea
MC
134 return 1;
135 }
136 } else {
92760c21
MC
137 if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
138 st->hand_state = TLS_ST_CR_CERT_REQ;
139 return 1;
f5ca0b04
MC
140 }
141 if (mt == SSL3_MT_CERTIFICATE) {
0f1e51ea
MC
142 st->hand_state = TLS_ST_CR_CERT;
143 return 1;
144 }
b67cb09f
TS
145#ifndef OPENSSL_NO_COMP_ALG
146 if (mt == SSL3_MT_COMPRESSED_CERTIFICATE
147 && s->ext.compress_certificate_sent) {
148 st->hand_state = TLS_ST_CR_COMP_CERT;
149 return 1;
150 }
151#endif
0f1e51ea
MC
152 }
153 break;
154
92760c21
MC
155 case TLS_ST_CR_CERT_REQ:
156 if (mt == SSL3_MT_CERTIFICATE) {
157 st->hand_state = TLS_ST_CR_CERT;
158 return 1;
159 }
b67cb09f
TS
160#ifndef OPENSSL_NO_COMP_ALG
161 if (mt == SSL3_MT_COMPRESSED_CERTIFICATE
162 && s->ext.compress_certificate_sent) {
163 st->hand_state = TLS_ST_CR_COMP_CERT;
164 return 1;
165 }
166#endif
92760c21
MC
167 break;
168
0f1e51ea 169 case TLS_ST_CR_CERT:
b67cb09f 170 case TLS_ST_CR_COMP_CERT:
2c5dfdc3
MC
171 if (mt == SSL3_MT_CERTIFICATE_VERIFY) {
172 st->hand_state = TLS_ST_CR_CERT_VRFY;
173 return 1;
174 }
175 break;
176
177 case TLS_ST_CR_CERT_VRFY:
0f1e51ea
MC
178 if (mt == SSL3_MT_FINISHED) {
179 st->hand_state = TLS_ST_CR_FINISHED;
180 return 1;
181 }
182 break;
cc2455bf
MC
183
184 case TLS_ST_OK:
185 if (mt == SSL3_MT_NEWSESSION_TICKET) {
186 st->hand_state = TLS_ST_CR_SESSION_TICKET;
187 return 1;
188 }
50a0af2e 189 if (mt == SSL3_MT_KEY_UPDATE && !SSL_IS_QUIC_HANDSHAKE(s)) {
e1c3de44
MC
190 st->hand_state = TLS_ST_CR_KEY_UPDATE;
191 return 1;
192 }
9d75dce3 193 if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
5c587fb6 194#if DTLS_MAX_VERSION_INTERNAL != DTLS1_2_VERSION
407820c0
P
195 /* Restore digest for PHA before adding message.*/
196# error Internal DTLS version error
9d75dce3 197#endif
38b051a1
TM
198 if (!SSL_CONNECTION_IS_DTLS(s)
199 && s->post_handshake_auth == SSL_PHA_EXT_SENT) {
9d75dce3
TS
200 s->post_handshake_auth = SSL_PHA_REQUESTED;
201 /*
202 * In TLS, this is called before the message is added to the
203 * digest. In DTLS, this is expected to be called after adding
204 * to the digest. Either move the digest restore, or add the
205 * message here after the swap, or do it after the clientFinished?
206 */
207 if (!tls13_restore_handshake_digest_for_pha(s)) {
208 /* SSLfatal() already called */
209 return 0;
210 }
211 st->hand_state = TLS_ST_CR_CERT_REQ;
212 return 1;
213 }
214 }
cc2455bf 215 break;
0f1e51ea
MC
216 }
217
0f1e51ea 218 /* No valid transition found */
0f1e51ea
MC
219 return 0;
220}
221
61ae935a 222/*
8481f583
MC
223 * ossl_statem_client_read_transition() encapsulates the logic for the allowed
224 * handshake state transitions when the client is reading messages from the
225 * server. The message type that the server has sent is provided in |mt|. The
226 * current state is in |s->statem.hand_state|.
61ae935a 227 *
94ed2c67
MC
228 * Return values are 1 for success (transition allowed) and 0 on error
229 * (transition not allowed)
61ae935a 230 */
38b051a1 231int ossl_statem_client_read_transition(SSL_CONNECTION *s, int mt)
61ae935a 232{
d6f1a6e9 233 OSSL_STATEM *st = &s->statem;
a455d0f6 234 int ske_expected;
61ae935a 235
0f1e51ea 236 /*
3847d426
MC
237 * Note that after writing the first ClientHello we don't know what version
238 * we are going to negotiate yet, so we don't take this branch until later.
0f1e51ea 239 */
38b051a1 240 if (SSL_CONNECTION_IS_TLS13(s)) {
5abeaf35
MC
241 if (!ossl_statem_client13_read_transition(s, mt))
242 goto err;
243 return 1;
244 }
0f1e51ea 245
a230b26e 246 switch (st->hand_state) {
f3b3d7f0
RS
247 default:
248 break;
249
61ae935a
MC
250 case TLS_ST_CW_CLNT_HELLO:
251 if (mt == SSL3_MT_SERVER_HELLO) {
252 st->hand_state = TLS_ST_CR_SRVR_HELLO;
253 return 1;
254 }
255
38b051a1 256 if (SSL_CONNECTION_IS_DTLS(s)) {
61ae935a
MC
257 if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {
258 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;
259 return 1;
260 }
261 }
262 break;
263
d7f8783f 264 case TLS_ST_EARLY_DATA:
4004ce5f
MC
265 /*
266 * We've not actually selected TLSv1.3 yet, but we have sent early
267 * data. The only thing allowed now is a ServerHello or a
268 * HelloRetryRequest.
269 */
270 if (mt == SSL3_MT_SERVER_HELLO) {
271 st->hand_state = TLS_ST_CR_SRVR_HELLO;
272 return 1;
273 }
4004ce5f
MC
274 break;
275
61ae935a
MC
276 case TLS_ST_CR_SRVR_HELLO:
277 if (s->hit) {
aff8c126 278 if (s->ext.ticket_expected) {
61ae935a
MC
279 if (mt == SSL3_MT_NEWSESSION_TICKET) {
280 st->hand_state = TLS_ST_CR_SESSION_TICKET;
281 return 1;
282 }
283 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
284 st->hand_state = TLS_ST_CR_CHANGE;
285 return 1;
286 }
287 } else {
38b051a1
TM
288 if (SSL_CONNECTION_IS_DTLS(s)
289 && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {
61ae935a
MC
290 st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;
291 return 1;
ad3819c2 292 } else if (s->version >= TLS1_VERSION
aff8c126
RS
293 && s->ext.session_secret_cb != NULL
294 && s->session->ext.tick != NULL
a230b26e 295 && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
ad3819c2
MC
296 /*
297 * Normally, we can tell if the server is resuming the session
298 * from the session ID. EAP-FAST (RFC 4851), however, relies on
299 * the next server message after the ServerHello to determine if
300 * the server is resuming.
301 */
302 s->hit = 1;
303 st->hand_state = TLS_ST_CR_CHANGE;
304 return 1;
555cbb32 305 } else if (!(s->s3.tmp.new_cipher->algorithm_auth
a230b26e 306 & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {
61ae935a
MC
307 if (mt == SSL3_MT_CERTIFICATE) {
308 st->hand_state = TLS_ST_CR_CERT;
309 return 1;
310 }
311 } else {
a455d0f6 312 ske_expected = key_exchange_expected(s);
a455d0f6
MC
313 /* SKE is optional for some PSK ciphersuites */
314 if (ske_expected
555cbb32 315 || ((s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK)
a230b26e 316 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {
a455d0f6
MC
317 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {
318 st->hand_state = TLS_ST_CR_KEY_EXCH;
319 return 1;
320 }
321 } else if (mt == SSL3_MT_CERTIFICATE_REQUEST
a230b26e
EK
322 && cert_req_allowed(s)) {
323 st->hand_state = TLS_ST_CR_CERT_REQ;
324 return 1;
a455d0f6 325 } else if (mt == SSL3_MT_SERVER_DONE) {
a230b26e
EK
326 st->hand_state = TLS_ST_CR_SRVR_DONE;
327 return 1;
61ae935a
MC
328 }
329 }
330 }
331 break;
332
333 case TLS_ST_CR_CERT:
b67cb09f 334 case TLS_ST_CR_COMP_CERT:
bb1aaab4
MC
335 /*
336 * The CertificateStatus message is optional even if
aff8c126 337 * |ext.status_expected| is set
bb1aaab4 338 */
aff8c126 339 if (s->ext.status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) {
bb1aaab4
MC
340 st->hand_state = TLS_ST_CR_CERT_STATUS;
341 return 1;
a455d0f6
MC
342 }
343 /* Fall through */
344
345 case TLS_ST_CR_CERT_STATUS:
346 ske_expected = key_exchange_expected(s);
a455d0f6 347 /* SKE is optional for some PSK ciphersuites */
555cbb32 348 if (ske_expected || ((s->s3.tmp.new_cipher->algorithm_mkey & SSL_PSK)
a230b26e 349 && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {
61ae935a
MC
350 if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {
351 st->hand_state = TLS_ST_CR_KEY_EXCH;
352 return 1;
61ae935a 353 }
672f3337 354 goto err;
61ae935a 355 }
a455d0f6 356 /* Fall through */
61ae935a 357
a455d0f6
MC
358 case TLS_ST_CR_KEY_EXCH:
359 if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
360 if (cert_req_allowed(s)) {
61ae935a
MC
361 st->hand_state = TLS_ST_CR_CERT_REQ;
362 return 1;
61ae935a 363 }
672f3337 364 goto err;
61ae935a 365 }
a455d0f6 366 /* Fall through */
61ae935a
MC
367
368 case TLS_ST_CR_CERT_REQ:
369 if (mt == SSL3_MT_SERVER_DONE) {
370 st->hand_state = TLS_ST_CR_SRVR_DONE;
371 return 1;
372 }
373 break;
374
375 case TLS_ST_CW_FINISHED:
aff8c126 376 if (s->ext.ticket_expected) {
c45d6b2b
DB
377 if (mt == SSL3_MT_NEWSESSION_TICKET) {
378 st->hand_state = TLS_ST_CR_SESSION_TICKET;
379 return 1;
380 }
61ae935a
MC
381 } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
382 st->hand_state = TLS_ST_CR_CHANGE;
383 return 1;
384 }
385 break;
386
387 case TLS_ST_CR_SESSION_TICKET:
388 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
389 st->hand_state = TLS_ST_CR_CHANGE;
390 return 1;
391 }
392 break;
393
394 case TLS_ST_CR_CHANGE:
395 if (mt == SSL3_MT_FINISHED) {
396 st->hand_state = TLS_ST_CR_FINISHED;
397 return 1;
398 }
399 break;
c7f47786
MC
400
401 case TLS_ST_OK:
4004ce5f 402 if (mt == SSL3_MT_HELLO_REQUEST) {
c7f47786
MC
403 st->hand_state = TLS_ST_CR_HELLO_REQ;
404 return 1;
405 }
406 break;
61ae935a
MC
407 }
408
672f3337 409 err:
61ae935a 410 /* No valid transition found */
38b051a1 411 if (SSL_CONNECTION_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
f20404fc
MC
412 BIO *rbio;
413
414 /*
415 * CCS messages don't have a message sequence number so this is probably
416 * because of an out-of-order CCS. We'll just drop it.
417 */
418 s->init_num = 0;
419 s->rwstate = SSL_READING;
38b051a1 420 rbio = SSL_get_rbio(SSL_CONNECTION_GET_SSL(s));
f20404fc
MC
421 BIO_clear_retry_flags(rbio);
422 BIO_set_retry_read(rbio);
423 return 0;
424 }
c48ffbcc 425 SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
61ae935a
MC
426 return 0;
427}
428
3c95ef22
TS
429static int do_compressed_cert(SSL_CONNECTION *sc)
430{
431 /* If we negotiated RPK, we won't try to compress it */
432 return sc->ext.client_cert_type == TLSEXT_cert_type_x509
433 && sc->ext.compress_certificate_from_peer[0] != TLSEXT_comp_cert_none;
434}
435
61ae935a 436/*
0f1e51ea
MC
437 * ossl_statem_client13_write_transition() works out what handshake state to
438 * move to next when the TLSv1.3 client is writing messages to be sent to the
439 * server.
0f1e51ea 440 */
38b051a1 441static WRITE_TRAN ossl_statem_client13_write_transition(SSL_CONNECTION *s)
0f1e51ea
MC
442{
443 OSSL_STATEM *st = &s->statem;
444
445 /*
3847d426
MC
446 * Note: There are no cases for TLS_ST_BEFORE because we haven't negotiated
447 * TLSv1.3 yet at that point. They are handled by
448 * ossl_statem_client_write_transition().
0f1e51ea
MC
449 */
450 switch (st->hand_state) {
e43e6b19
TS
451 default:
452 /* Shouldn't happen */
c48ffbcc 453 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
e43e6b19
TS
454 return WRITE_TRAN_ERROR;
455
9d75dce3
TS
456 case TLS_ST_CR_CERT_REQ:
457 if (s->post_handshake_auth == SSL_PHA_REQUESTED) {
3c95ef22 458 if (do_compressed_cert(s))
b67cb09f
TS
459 st->hand_state = TLS_ST_CW_COMP_CERT;
460 else
461 st->hand_state = TLS_ST_CW_CERT;
9d75dce3
TS
462 return WRITE_TRAN_CONTINUE;
463 }
1bf4cb0f
MC
464 /*
465 * We should only get here if we received a CertificateRequest after
466 * we already sent close_notify
467 */
468 if (!ossl_assert((s->shutdown & SSL_SENT_SHUTDOWN) != 0)) {
469 /* Shouldn't happen - same as default case */
c48ffbcc 470 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1bf4cb0f
MC
471 return WRITE_TRAN_ERROR;
472 }
473 st->hand_state = TLS_ST_OK;
474 return WRITE_TRAN_CONTINUE;
0f1e51ea 475
92760c21 476 case TLS_ST_CR_FINISHED:
ef6c191b
MC
477 if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY
478 || s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING)
d7f8783f 479 st->hand_state = TLS_ST_PENDING_EARLY_DATA_END;
4d02f870 480 else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0
fc7129dc 481 && s->hello_retry_request == SSL_HRR_NONE)
4d02f870 482 st->hand_state = TLS_ST_CW_CHANGE;
b67cb09f
TS
483 else if (s->s3.tmp.cert_req == 0)
484 st->hand_state = TLS_ST_CW_FINISHED;
3c95ef22 485 else if (do_compressed_cert(s))
b67cb09f 486 st->hand_state = TLS_ST_CW_COMP_CERT;
564547e4 487 else
b67cb09f 488 st->hand_state = TLS_ST_CW_CERT;
cee0628e
JC
489
490 s->ts_msg_read = ossl_time_now();
564547e4
MC
491 return WRITE_TRAN_CONTINUE;
492
d7f8783f 493 case TLS_ST_PENDING_EARLY_DATA_END:
1b3f27f9 494 if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED && !SSL_NO_EOED(s)) {
ef6c191b
MC
495 st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA;
496 return WRITE_TRAN_CONTINUE;
497 }
498 /* Fall through */
499
500 case TLS_ST_CW_END_OF_EARLY_DATA:
4d02f870 501 case TLS_ST_CW_CHANGE:
b67cb09f
TS
502 if (s->s3.tmp.cert_req == 0)
503 st->hand_state = TLS_ST_CW_FINISHED;
3c95ef22 504 else if (do_compressed_cert(s))
b67cb09f
TS
505 st->hand_state = TLS_ST_CW_COMP_CERT;
506 else
507 st->hand_state = TLS_ST_CW_CERT;
0f1e51ea
MC
508 return WRITE_TRAN_CONTINUE;
509
b67cb09f 510 case TLS_ST_CW_COMP_CERT:
0f1e51ea
MC
511 case TLS_ST_CW_CERT:
512 /* If a non-empty Certificate we also send CertificateVerify */
555cbb32 513 st->hand_state = (s->s3.tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY
92760c21 514 : TLS_ST_CW_FINISHED;
0f1e51ea
MC
515 return WRITE_TRAN_CONTINUE;
516
517 case TLS_ST_CW_CERT_VRFY:
0f1e51ea
MC
518 st->hand_state = TLS_ST_CW_FINISHED;
519 return WRITE_TRAN_CONTINUE;
520
e1c3de44 521 case TLS_ST_CR_KEY_UPDATE:
9412b3ad 522 case TLS_ST_CW_KEY_UPDATE:
cc2455bf 523 case TLS_ST_CR_SESSION_TICKET:
0f1e51ea 524 case TLS_ST_CW_FINISHED:
94ed2c67 525 st->hand_state = TLS_ST_OK;
94ed2c67 526 return WRITE_TRAN_CONTINUE;
cc2455bf
MC
527
528 case TLS_ST_OK:
9412b3ad
MC
529 if (s->key_update != SSL_KEY_UPDATE_NONE) {
530 st->hand_state = TLS_ST_CW_KEY_UPDATE;
531 return WRITE_TRAN_CONTINUE;
532 }
533
534 /* Try to read from the server instead */
cc2455bf 535 return WRITE_TRAN_FINISHED;
0f1e51ea
MC
536 }
537}
538
539/*
540 * ossl_statem_client_write_transition() works out what handshake state to
541 * move to next when the client is writing messages to be sent to the server.
61ae935a 542 */
38b051a1 543WRITE_TRAN ossl_statem_client_write_transition(SSL_CONNECTION *s)
61ae935a 544{
d6f1a6e9 545 OSSL_STATEM *st = &s->statem;
61ae935a 546
0f1e51ea
MC
547 /*
548 * Note that immediately before/after a ClientHello we don't know what
549 * version we are going to negotiate yet, so we don't take this branch until
550 * later
551 */
38b051a1 552 if (SSL_CONNECTION_IS_TLS13(s))
0f1e51ea
MC
553 return ossl_statem_client13_write_transition(s);
554
a230b26e 555 switch (st->hand_state) {
f3b3d7f0
RS
556 default:
557 /* Shouldn't happen */
c48ffbcc 558 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f3b3d7f0
RS
559 return WRITE_TRAN_ERROR;
560
a230b26e 561 case TLS_ST_OK:
c7f47786
MC
562 if (!s->renegotiate) {
563 /*
564 * We haven't requested a renegotiation ourselves so we must have
565 * received a message from the server. Better read it.
566 */
567 return WRITE_TRAN_FINISHED;
568 }
018fcbec
BE
569 /* Renegotiation */
570 /* fall thru */
a230b26e
EK
571 case TLS_ST_BEFORE:
572 st->hand_state = TLS_ST_CW_CLNT_HELLO;
573 return WRITE_TRAN_CONTINUE;
61ae935a 574
a230b26e 575 case TLS_ST_CW_CLNT_HELLO:
95051052
MC
576 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
577 && !SSL_IS_QUIC_HANDSHAKE(s)) {
49e7fe12
MC
578 /*
579 * We are assuming this is a TLSv1.3 connection, although we haven't
580 * actually selected a version yet.
581 */
066904cc
MC
582 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)
583 st->hand_state = TLS_ST_CW_CHANGE;
584 else
585 st->hand_state = TLS_ST_EARLY_DATA;
49e7fe12
MC
586 return WRITE_TRAN_CONTINUE;
587 }
a230b26e
EK
588 /*
589 * No transition at the end of writing because we don't know what
590 * we will be sent
591 */
cee0628e 592 s->ts_msg_write = ossl_time_now();
a230b26e 593 return WRITE_TRAN_FINISHED;
61ae935a 594
597c51bc 595 case TLS_ST_CR_SRVR_HELLO:
318d3c0e
MC
596 /*
597 * We only get here in TLSv1.3. We just received an HRR, so issue a
598 * CCS unless middlebox compat mode is off, or we already issued one
599 * because we did early data.
600 */
601 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0
602 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING)
603 st->hand_state = TLS_ST_CW_CHANGE;
604 else
605 st->hand_state = TLS_ST_CW_CLNT_HELLO;
a2b97bdf
MC
606 return WRITE_TRAN_CONTINUE;
607
d7f8783f 608 case TLS_ST_EARLY_DATA:
cee0628e 609 s->ts_msg_write = ossl_time_now();
4004ce5f
MC
610 return WRITE_TRAN_FINISHED;
611
a230b26e
EK
612 case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
613 st->hand_state = TLS_ST_CW_CLNT_HELLO;
614 return WRITE_TRAN_CONTINUE;
61ae935a 615
a230b26e 616 case TLS_ST_CR_SRVR_DONE:
cee0628e 617 s->ts_msg_read = ossl_time_now();
555cbb32 618 if (s->s3.tmp.cert_req)
a230b26e
EK
619 st->hand_state = TLS_ST_CW_CERT;
620 else
61ae935a 621 st->hand_state = TLS_ST_CW_KEY_EXCH;
a230b26e 622 return WRITE_TRAN_CONTINUE;
61ae935a 623
a230b26e
EK
624 case TLS_ST_CW_CERT:
625 st->hand_state = TLS_ST_CW_KEY_EXCH;
626 return WRITE_TRAN_CONTINUE;
61ae935a 627
a230b26e
EK
628 case TLS_ST_CW_KEY_EXCH:
629 /*
630 * For TLS, cert_req is set to 2, so a cert chain of nothing is
631 * sent, but no verify packet is sent
632 */
633 /*
634 * XXX: For now, we do not support client authentication in ECDH
635 * cipher suites with ECDH (rather than ECDSA) certificates. We
636 * need to skip the certificate verify message when client's
637 * ECDH public key is sent inside the client certificate.
638 */
555cbb32 639 if (s->s3.tmp.cert_req == 1) {
a230b26e
EK
640 st->hand_state = TLS_ST_CW_CERT_VRFY;
641 } else {
61ae935a 642 st->hand_state = TLS_ST_CW_CHANGE;
a230b26e 643 }
555cbb32 644 if (s->s3.flags & TLS1_FLAGS_SKIP_CERT_VERIFY) {
a230b26e
EK
645 st->hand_state = TLS_ST_CW_CHANGE;
646 }
647 return WRITE_TRAN_CONTINUE;
61ae935a 648
a230b26e
EK
649 case TLS_ST_CW_CERT_VRFY:
650 st->hand_state = TLS_ST_CW_CHANGE;
651 return WRITE_TRAN_CONTINUE;
652
653 case TLS_ST_CW_CHANGE:
318d3c0e
MC
654 if (s->hello_retry_request == SSL_HRR_PENDING) {
655 st->hand_state = TLS_ST_CW_CLNT_HELLO;
656 } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) {
066904cc
MC
657 st->hand_state = TLS_ST_EARLY_DATA;
658 } else {
61ae935a 659#if defined(OPENSSL_NO_NEXTPROTONEG)
a230b26e 660 st->hand_state = TLS_ST_CW_FINISHED;
066904cc 661#else
38b051a1 662 if (!SSL_CONNECTION_IS_DTLS(s) && s->s3.npn_seen)
066904cc
MC
663 st->hand_state = TLS_ST_CW_NEXT_PROTO;
664 else
665 st->hand_state = TLS_ST_CW_FINISHED;
61ae935a 666#endif
066904cc 667 }
a230b26e 668 return WRITE_TRAN_CONTINUE;
61ae935a
MC
669
670#if !defined(OPENSSL_NO_NEXTPROTONEG)
a230b26e
EK
671 case TLS_ST_CW_NEXT_PROTO:
672 st->hand_state = TLS_ST_CW_FINISHED;
673 return WRITE_TRAN_CONTINUE;
61ae935a
MC
674#endif
675
a230b26e
EK
676 case TLS_ST_CW_FINISHED:
677 if (s->hit) {
678 st->hand_state = TLS_ST_OK;
a230b26e
EK
679 return WRITE_TRAN_CONTINUE;
680 } else {
681 return WRITE_TRAN_FINISHED;
682 }
61ae935a 683
a230b26e
EK
684 case TLS_ST_CR_FINISHED:
685 if (s->hit) {
686 st->hand_state = TLS_ST_CW_CHANGE;
687 return WRITE_TRAN_CONTINUE;
688 } else {
689 st->hand_state = TLS_ST_OK;
a230b26e
EK
690 return WRITE_TRAN_CONTINUE;
691 }
c7f47786
MC
692
693 case TLS_ST_CR_HELLO_REQ:
694 /*
695 * If we can renegotiate now then do so, otherwise wait for a more
696 * convenient time.
697 */
38b051a1 698 if (ssl3_renegotiate_check(SSL_CONNECTION_GET_SSL(s), 1)) {
c7f47786 699 if (!tls_setup_handshake(s)) {
f63a17d6 700 /* SSLfatal() already called */
c7f47786
MC
701 return WRITE_TRAN_ERROR;
702 }
703 st->hand_state = TLS_ST_CW_CLNT_HELLO;
704 return WRITE_TRAN_CONTINUE;
705 }
706 st->hand_state = TLS_ST_OK;
c7f47786 707 return WRITE_TRAN_CONTINUE;
61ae935a
MC
708 }
709}
710
711/*
712 * Perform any pre work that needs to be done prior to sending a message from
713 * the client to the server.
714 */
38b051a1 715WORK_STATE ossl_statem_client_pre_work(SSL_CONNECTION *s, WORK_STATE wst)
61ae935a 716{
d6f1a6e9 717 OSSL_STATEM *st = &s->statem;
61ae935a 718
a230b26e 719 switch (st->hand_state) {
f3b3d7f0
RS
720 default:
721 /* No pre work to be done */
722 break;
723
61ae935a
MC
724 case TLS_ST_CW_CLNT_HELLO:
725 s->shutdown = 0;
38b051a1 726 if (SSL_CONNECTION_IS_DTLS(s)) {
61ae935a 727 /* every DTLS ClientHello resets Finished MAC */
2c4a056f 728 if (!ssl3_init_finished_mac(s)) {
f63a17d6 729 /* SSLfatal() already called */
2c4a056f
MC
730 return WORK_ERROR;
731 }
2c50d7fb
MC
732 } else if (s->ext.early_data == SSL_EARLY_DATA_REJECTED) {
733 /*
734 * This must be a second ClientHello after an HRR following an
735 * earlier rejected attempt to send early data. Since we were
736 * previously encrypting the early data we now need to reset the
737 * write record layer in order to write in plaintext again.
738 */
739 if (!ssl_set_new_record_layer(s,
740 TLS_ANY_VERSION,
741 OSSL_RECORD_DIRECTION_WRITE,
742 OSSL_RECORD_PROTECTION_LEVEL_NONE,
3f9175c7
MC
743 NULL, 0, NULL, 0, NULL, 0, NULL, 0,
744 NULL, 0, NID_undef, NULL, NULL,
745 NULL)) {
2c50d7fb
MC
746 /* SSLfatal already called */
747 return WORK_ERROR;
748 }
61ae935a
MC
749 }
750 break;
751
61ae935a 752 case TLS_ST_CW_CHANGE:
38b051a1 753 if (SSL_CONNECTION_IS_DTLS(s)) {
61ae935a
MC
754 if (s->hit) {
755 /*
756 * We're into the last flight so we don't retransmit these
757 * messages unless we need to.
758 */
759 st->use_timer = 0;
760 }
761#ifndef OPENSSL_NO_SCTP
38b051a1 762 if (BIO_dgram_is_sctp(SSL_get_wbio(SSL_CONNECTION_GET_SSL(s)))) {
a2c2e000 763 /* Calls SSLfatal() as required */
61ae935a 764 return dtls_wait_for_dry(s);
a2c2e000 765 }
61ae935a
MC
766#endif
767 }
f3b3d7f0 768 break;
61ae935a 769
d7f8783f 770 case TLS_ST_PENDING_EARLY_DATA_END:
ef6c191b
MC
771 /*
772 * If we've been called by SSL_do_handshake()/SSL_write(), or we did not
773 * attempt to write early data before calling SSL_read() then we press
774 * on with the handshake. Otherwise we pause here.
775 */
776 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING
777 || s->early_data_state == SSL_EARLY_DATA_NONE)
778 return WORK_FINISHED_CONTINUE;
779 /* Fall through */
780
781 case TLS_ST_EARLY_DATA:
2a8db717
MC
782 return tls_finish_handshake(s, wst, 0, 1);
783
61ae935a 784 case TLS_ST_OK:
a2c2e000 785 /* Calls SSLfatal() as required */
2a8db717 786 return tls_finish_handshake(s, wst, 1, 1);
61ae935a
MC
787 }
788
789 return WORK_FINISHED_CONTINUE;
790}
791
792/*
793 * Perform any work that needs to be done after sending a message from the
794 * client to the server.
795 */
38b051a1 796WORK_STATE ossl_statem_client_post_work(SSL_CONNECTION *s, WORK_STATE wst)
61ae935a 797{
d6f1a6e9 798 OSSL_STATEM *st = &s->statem;
38b051a1 799 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
61ae935a
MC
800
801 s->init_num = 0;
802
a230b26e 803 switch (st->hand_state) {
f3b3d7f0
RS
804 default:
805 /* No post work to be done */
806 break;
807
61ae935a 808 case TLS_ST_CW_CLNT_HELLO:
6cb42265 809 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
5cc807da 810 && s->max_early_data > 0) {
6cb42265
MC
811 /*
812 * We haven't selected TLSv1.3 yet so we don't call the change
813 * cipher state function associated with the SSL_METHOD. Instead
814 * we call tls13_change_cipher_state() directly.
815 */
5cc807da 816 if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0) {
5cc807da
MC
817 if (!tls13_change_cipher_state(s,
818 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
819 /* SSLfatal() already called */
820 return WORK_ERROR;
821 }
a2c2e000 822 }
5cc807da
MC
823 /* else we're in compat mode so we delay flushing until after CCS */
824 } else if (!statem_flush(s)) {
825 return WORK_MORE_A;
826 }
827
38b051a1 828 if (SSL_CONNECTION_IS_DTLS(s)) {
5cc807da
MC
829 /* Treat the next message as the first packet */
830 s->first_packet = 1;
6cb42265 831 }
61ae935a
MC
832 break;
833
834 case TLS_ST_CW_KEY_EXCH:
a2c2e000
MC
835 if (tls_client_key_exchange_post_work(s) == 0) {
836 /* SSLfatal() already called */
61ae935a 837 return WORK_ERROR;
a2c2e000 838 }
61ae935a
MC
839 break;
840
841 case TLS_ST_CW_CHANGE:
38b051a1
TM
842 if (SSL_CONNECTION_IS_TLS13(s)
843 || s->hello_retry_request == SSL_HRR_PENDING)
4d02f870 844 break;
066904cc
MC
845 if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
846 && s->max_early_data > 0) {
847 /*
848 * We haven't selected TLSv1.3 yet so we don't call the change
849 * cipher state function associated with the SSL_METHOD. Instead
850 * we call tls13_change_cipher_state() directly.
851 */
852 if (!tls13_change_cipher_state(s,
853 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE))
854 return WORK_ERROR;
855 break;
856 }
555cbb32 857 s->session->cipher = s->s3.tmp.new_cipher;
61ae935a
MC
858#ifdef OPENSSL_NO_COMP
859 s->session->compress_meth = 0;
860#else
555cbb32 861 if (s->s3.tmp.new_compression == NULL)
61ae935a
MC
862 s->session->compress_meth = 0;
863 else
555cbb32 864 s->session->compress_meth = s->s3.tmp.new_compression->id;
61ae935a 865#endif
38b051a1 866 if (!ssl->method->ssl3_enc->setup_key_block(s)) {
a2c2e000 867 /* SSLfatal() already called */
61ae935a 868 return WORK_ERROR;
a2c2e000 869 }
61ae935a 870
38b051a1 871 if (!ssl->method->ssl3_enc->change_cipher_state(s,
a2c2e000
MC
872 SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
873 /* SSLfatal() already called */
61ae935a 874 return WORK_ERROR;
a2c2e000 875 }
61ae935a 876
61ae935a 877#ifndef OPENSSL_NO_SCTP
4897bd20
FWH
878 if (SSL_CONNECTION_IS_DTLS(s) && s->hit) {
879 /*
880 * Change to new shared key of SCTP-Auth, will be ignored if
881 * no SCTP used.
882 */
883 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
884 0, NULL);
61ae935a 885 }
4897bd20 886#endif
61ae935a
MC
887 break;
888
889 case TLS_ST_CW_FINISHED:
890#ifndef OPENSSL_NO_SCTP
38b051a1 891 if (wst == WORK_MORE_A && SSL_CONNECTION_IS_DTLS(s) && s->hit == 0) {
61ae935a
MC
892 /*
893 * Change to new shared key of SCTP-Auth, will be ignored if
894 * no SCTP used.
895 */
38b051a1 896 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
61ae935a
MC
897 0, NULL);
898 }
899#endif
900 if (statem_flush(s) != 1)
901 return WORK_MORE_B;
92760c21 902
38b051a1 903 if (SSL_CONNECTION_IS_TLS13(s)) {
9d75dce3 904 if (!tls13_save_handshake_digest_for_pha(s)) {
a2c2e000
MC
905 /* SSLfatal() already called */
906 return WORK_ERROR;
907 }
9d75dce3 908 if (s->post_handshake_auth != SSL_PHA_REQUESTED) {
38b051a1 909 if (!ssl->method->ssl3_enc->change_cipher_state(s,
9d75dce3
TS
910 SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
911 /* SSLfatal() already called */
912 return WORK_ERROR;
913 }
098cfd21
MC
914 /*
915 * For QUIC we deferred setting up these keys until now so
916 * that we can ensure write keys are always set up before read
917 * keys.
918 */
919 if (SSL_IS_QUIC_HANDSHAKE(s)
920 && !ssl->method->ssl3_enc->change_cipher_state(s,
921 SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_READ)) {
922 /* SSLfatal() already called */
923 return WORK_ERROR;
924 }
9d75dce3 925 }
92760c21 926 }
61ae935a 927 break;
9412b3ad
MC
928
929 case TLS_ST_CW_KEY_UPDATE:
930 if (statem_flush(s) != 1)
931 return WORK_MORE_A;
a2c2e000
MC
932 if (!tls13_update_key(s, 1)) {
933 /* SSLfatal() already called */
57389a32 934 return WORK_ERROR;
a2c2e000 935 }
9412b3ad 936 break;
61ae935a
MC
937 }
938
939 return WORK_FINISHED_CONTINUE;
940}
941
942/*
6392fb8e
MC
943 * Get the message construction function and message type for sending from the
944 * client
61ae935a
MC
945 *
946 * Valid return values are:
947 * 1: Success
948 * 0: Error
949 */
38b051a1 950int ossl_statem_client_construct_message(SSL_CONNECTION *s,
a15c953f 951 confunc_f *confunc, int *mt)
61ae935a 952{
d6f1a6e9 953 OSSL_STATEM *st = &s->statem;
61ae935a 954
4a01c59f
MC
955 switch (st->hand_state) {
956 default:
957 /* Shouldn't happen */
c48ffbcc 958 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_STATE);
4a01c59f
MC
959 return 0;
960
961 case TLS_ST_CW_CHANGE:
38b051a1 962 if (SSL_CONNECTION_IS_DTLS(s))
6392fb8e 963 *confunc = dtls_construct_change_cipher_spec;
4a01c59f 964 else
6392fb8e
MC
965 *confunc = tls_construct_change_cipher_spec;
966 *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
4a01c59f
MC
967 break;
968
969 case TLS_ST_CW_CLNT_HELLO:
6392fb8e
MC
970 *confunc = tls_construct_client_hello;
971 *mt = SSL3_MT_CLIENT_HELLO;
4a01c59f
MC
972 break;
973
ef6c191b
MC
974 case TLS_ST_CW_END_OF_EARLY_DATA:
975 *confunc = tls_construct_end_of_early_data;
976 *mt = SSL3_MT_END_OF_EARLY_DATA;
977 break;
978
979 case TLS_ST_PENDING_EARLY_DATA_END:
980 *confunc = NULL;
981 *mt = SSL3_MT_DUMMY;
982 break;
983
4a01c59f 984 case TLS_ST_CW_CERT:
6392fb8e
MC
985 *confunc = tls_construct_client_certificate;
986 *mt = SSL3_MT_CERTIFICATE;
4a01c59f
MC
987 break;
988
b67cb09f
TS
989#ifndef OPENSSL_NO_COMP_ALG
990 case TLS_ST_CW_COMP_CERT:
991 *confunc = tls_construct_client_compressed_certificate;
992 *mt = SSL3_MT_COMPRESSED_CERTIFICATE;
993 break;
994#endif
995
4a01c59f 996 case TLS_ST_CW_KEY_EXCH:
6392fb8e
MC
997 *confunc = tls_construct_client_key_exchange;
998 *mt = SSL3_MT_CLIENT_KEY_EXCHANGE;
4a01c59f
MC
999 break;
1000
1001 case TLS_ST_CW_CERT_VRFY:
d8bc1399 1002 *confunc = tls_construct_cert_verify;
6392fb8e 1003 *mt = SSL3_MT_CERTIFICATE_VERIFY;
4a01c59f 1004 break;
61ae935a
MC
1005
1006#if !defined(OPENSSL_NO_NEXTPROTONEG)
4a01c59f 1007 case TLS_ST_CW_NEXT_PROTO:
6392fb8e
MC
1008 *confunc = tls_construct_next_proto;
1009 *mt = SSL3_MT_NEXT_PROTO;
4a01c59f 1010 break;
61ae935a 1011#endif
4a01c59f 1012 case TLS_ST_CW_FINISHED:
6392fb8e
MC
1013 *confunc = tls_construct_finished;
1014 *mt = SSL3_MT_FINISHED;
4a01c59f 1015 break;
9412b3ad
MC
1016
1017 case TLS_ST_CW_KEY_UPDATE:
1018 *confunc = tls_construct_key_update;
1019 *mt = SSL3_MT_KEY_UPDATE;
1020 break;
4a01c59f 1021 }
5923ad4b 1022
5923ad4b 1023 return 1;
61ae935a
MC
1024}
1025
1026/*
1027 * Returns the maximum allowed length for the current message that we are
1028 * reading. Excludes the message header.
1029 */
38b051a1 1030size_t ossl_statem_client_max_message_size(SSL_CONNECTION *s)
61ae935a 1031{
d6f1a6e9 1032 OSSL_STATEM *st = &s->statem;
61ae935a 1033
a230b26e 1034 switch (st->hand_state) {
f3b3d7f0
RS
1035 default:
1036 /* Shouldn't happen */
1037 return 0;
1038
a230b26e
EK
1039 case TLS_ST_CR_SRVR_HELLO:
1040 return SERVER_HELLO_MAX_LENGTH;
61ae935a 1041
a230b26e
EK
1042 case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
1043 return HELLO_VERIFY_REQUEST_MAX_LENGTH;
61ae935a 1044
b67cb09f 1045 case TLS_ST_CR_COMP_CERT:
a230b26e
EK
1046 case TLS_ST_CR_CERT:
1047 return s->max_cert_list;
61ae935a 1048
2c5dfdc3 1049 case TLS_ST_CR_CERT_VRFY:
c6d14bfd 1050 return CERTIFICATE_VERIFY_MAX_LENGTH;
2c5dfdc3 1051
a230b26e
EK
1052 case TLS_ST_CR_CERT_STATUS:
1053 return SSL3_RT_MAX_PLAIN_LENGTH;
61ae935a 1054
a230b26e
EK
1055 case TLS_ST_CR_KEY_EXCH:
1056 return SERVER_KEY_EXCH_MAX_LENGTH;
61ae935a 1057
a230b26e
EK
1058 case TLS_ST_CR_CERT_REQ:
1059 /*
1060 * Set to s->max_cert_list for compatibility with previous releases. In
1061 * practice these messages can get quite long if servers are configured
1062 * to provide a long list of acceptable CAs
1063 */
1064 return s->max_cert_list;
61ae935a 1065
a230b26e
EK
1066 case TLS_ST_CR_SRVR_DONE:
1067 return SERVER_HELLO_DONE_MAX_LENGTH;
61ae935a 1068
a230b26e
EK
1069 case TLS_ST_CR_CHANGE:
1070 if (s->version == DTLS1_BAD_VER)
1071 return 3;
1072 return CCS_MAX_LENGTH;
61ae935a 1073
a230b26e 1074 case TLS_ST_CR_SESSION_TICKET:
38b051a1
TM
1075 return (SSL_CONNECTION_IS_TLS13(s)) ? SESSION_TICKET_MAX_LENGTH_TLS13
1076 : SESSION_TICKET_MAX_LENGTH_TLS12;
61ae935a 1077
a230b26e
EK
1078 case TLS_ST_CR_FINISHED:
1079 return FINISHED_MAX_LENGTH;
e46f2334
MC
1080
1081 case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
1082 return ENCRYPTED_EXTENSIONS_MAX_LENGTH;
e1c3de44
MC
1083
1084 case TLS_ST_CR_KEY_UPDATE:
1085 return KEY_UPDATE_MAX_LENGTH;
61ae935a 1086 }
61ae935a
MC
1087}
1088
1089/*
0c3eb279 1090 * Process a message that the client has received from the server.
61ae935a 1091 */
38b051a1
TM
1092MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL_CONNECTION *s,
1093 PACKET *pkt)
61ae935a 1094{
d6f1a6e9 1095 OSSL_STATEM *st = &s->statem;
61ae935a 1096
a230b26e 1097 switch (st->hand_state) {
f3b3d7f0
RS
1098 default:
1099 /* Shouldn't happen */
c48ffbcc 1100 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f3b3d7f0
RS
1101 return MSG_PROCESS_ERROR;
1102
a230b26e
EK
1103 case TLS_ST_CR_SRVR_HELLO:
1104 return tls_process_server_hello(s, pkt);
61ae935a 1105
a230b26e
EK
1106 case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
1107 return dtls_process_hello_verify(s, pkt);
61ae935a 1108
a230b26e
EK
1109 case TLS_ST_CR_CERT:
1110 return tls_process_server_certificate(s, pkt);
61ae935a 1111
b67cb09f
TS
1112#ifndef OPENSSL_NO_COMP_ALG
1113 case TLS_ST_CR_COMP_CERT:
1114 return tls_process_server_compressed_certificate(s, pkt);
1115#endif
1116
2c5dfdc3
MC
1117 case TLS_ST_CR_CERT_VRFY:
1118 return tls_process_cert_verify(s, pkt);
1119
a230b26e
EK
1120 case TLS_ST_CR_CERT_STATUS:
1121 return tls_process_cert_status(s, pkt);
61ae935a 1122
a230b26e
EK
1123 case TLS_ST_CR_KEY_EXCH:
1124 return tls_process_key_exchange(s, pkt);
61ae935a 1125
a230b26e
EK
1126 case TLS_ST_CR_CERT_REQ:
1127 return tls_process_certificate_request(s, pkt);
61ae935a 1128
a230b26e
EK
1129 case TLS_ST_CR_SRVR_DONE:
1130 return tls_process_server_done(s, pkt);
61ae935a 1131
a230b26e
EK
1132 case TLS_ST_CR_CHANGE:
1133 return tls_process_change_cipher_spec(s, pkt);
61ae935a 1134
a230b26e
EK
1135 case TLS_ST_CR_SESSION_TICKET:
1136 return tls_process_new_session_ticket(s, pkt);
61ae935a 1137
a230b26e
EK
1138 case TLS_ST_CR_FINISHED:
1139 return tls_process_finished(s, pkt);
e46f2334 1140
c7f47786
MC
1141 case TLS_ST_CR_HELLO_REQ:
1142 return tls_process_hello_req(s, pkt);
1143
e46f2334
MC
1144 case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
1145 return tls_process_encrypted_extensions(s, pkt);
e1c3de44
MC
1146
1147 case TLS_ST_CR_KEY_UPDATE:
1148 return tls_process_key_update(s, pkt);
61ae935a 1149 }
61ae935a
MC
1150}
1151
1152/*
1153 * Perform any further processing required following the receipt of a message
1154 * from the server
1155 */
38b051a1
TM
1156WORK_STATE ossl_statem_client_post_process_message(SSL_CONNECTION *s,
1157 WORK_STATE wst)
61ae935a 1158{
d6f1a6e9 1159 OSSL_STATEM *st = &s->statem;
61ae935a 1160
a230b26e 1161 switch (st->hand_state) {
f3b3d7f0
RS
1162 default:
1163 /* Shouldn't happen */
c48ffbcc 1164 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f3b3d7f0
RS
1165 return WORK_ERROR;
1166
0c3eb279 1167 case TLS_ST_CR_CERT:
b67cb09f 1168 case TLS_ST_CR_COMP_CERT:
0c3eb279
DDO
1169 return tls_post_process_server_certificate(s, wst);
1170
e4562014 1171 case TLS_ST_CR_CERT_VRFY:
05c4f1d5
MC
1172 case TLS_ST_CR_CERT_REQ:
1173 return tls_prepare_client_certificate(s, wst);
61ae935a 1174 }
61ae935a
MC
1175}
1176
67ec6d2b 1177CON_FUNC_RETURN tls_construct_client_hello(SSL_CONNECTION *s, WPACKET *pkt)
0f113f3e 1178{
2c7b4dbc 1179 unsigned char *p;
ec60ccc1
MC
1180 size_t sess_id_len;
1181 int i, protverr;
09b6c2ef 1182#ifndef OPENSSL_NO_COMP
0f113f3e
MC
1183 SSL_COMP *comp;
1184#endif
b9908bf9 1185 SSL_SESSION *sess = s->session;
a5816a5a 1186 unsigned char *session_id;
38b051a1 1187 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
0f113f3e 1188
b9908bf9 1189 /* Work out what SSL/TLS/DTLS version to use */
4fa52141
VD
1190 protverr = ssl_set_client_hello_version(s);
1191 if (protverr != 0) {
c48ffbcc 1192 SSLfatal(s, SSL_AD_INTERNAL_ERROR, protverr);
67ec6d2b 1193 return CON_FUNC_ERROR;
4fa52141 1194 }
0f113f3e 1195
e586eac8 1196 if (sess == NULL
4fd12788 1197 || !ssl_version_supported(s, sess->ssl_version, NULL)
e586eac8 1198 || !SSL_SESSION_is_resumable(sess)) {
fc7129dc
MC
1199 if (s->hello_retry_request == SSL_HRR_NONE
1200 && !ssl_get_new_session(s, 0)) {
f63a17d6 1201 /* SSLfatal() already called */
67ec6d2b 1202 return CON_FUNC_ERROR;
f63a17d6 1203 }
b9908bf9
MC
1204 }
1205 /* else use the pre-loaded session */
0f113f3e 1206
555cbb32 1207 p = s->s3.client_random;
0f113f3e 1208
b9908bf9
MC
1209 /*
1210 * for DTLS if client_random is initialized, reuse it, we are
1211 * required to use same upon reply to HelloVerify
1212 */
38b051a1 1213 if (SSL_CONNECTION_IS_DTLS(s)) {
b9908bf9
MC
1214 size_t idx;
1215 i = 1;
555cbb32 1216 for (idx = 0; idx < sizeof(s->s3.client_random); idx++) {
b9908bf9
MC
1217 if (p[idx]) {
1218 i = 0;
1219 break;
0f113f3e 1220 }
0f113f3e 1221 }
751b26b1 1222 } else {
fc7129dc 1223 i = (s->hello_retry_request == SSL_HRR_NONE);
751b26b1 1224 }
0f113f3e 1225
555cbb32 1226 if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3.client_random),
f63a17d6 1227 DOWNGRADE_NONE) <= 0) {
c48ffbcc 1228 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1229 return CON_FUNC_ERROR;
f63a17d6 1230 }
b9908bf9 1231
b9908bf9
MC
1232 /*-
1233 * version indicates the negotiated version: for example from
1234 * an SSLv2/v3 compatible client hello). The client_version
1235 * field is the maximum version we permit and it is also
1236 * used in RSA encrypted premaster secrets. Some servers can
1237 * choke if we initially report a higher version then
1238 * renegotiate to a lower one in the premaster secret. This
1239 * didn't happen with TLS 1.0 as most servers supported it
1240 * but it can with TLS 1.1 or later if the server only supports
1241 * 1.0.
1242 *
1243 * Possible scenario with previous logic:
1244 * 1. Client hello indicates TLS 1.2
1245 * 2. Server hello says TLS 1.0
1246 * 3. RSA encrypted premaster secret uses 1.2.
8483a003 1247 * 4. Handshake proceeds using TLS 1.0.
b9908bf9
MC
1248 * 5. Server sends hello request to renegotiate.
1249 * 6. Client hello indicates TLS v1.0 as we now
1250 * know that is maximum server supports.
1251 * 7. Server chokes on RSA encrypted premaster secret
1252 * containing version 1.0.
1253 *
1254 * For interoperability it should be OK to always use the
1255 * maximum version we support in client hello and then rely
1256 * on the checking of version to ensure the servers isn't
1257 * being inconsistent: for example initially negotiating with
1258 * TLS 1.0 and renegotiating with TLS 1.2. We do this by using
1259 * client_version in client hello and not resetting it to
1260 * the negotiated version.
cd998837
MC
1261 *
1262 * For TLS 1.3 we always set the ClientHello version to 1.2 and rely on the
16bce0e0 1263 * supported_versions extension for the real supported versions.
b9908bf9 1264 */
7acb8b64 1265 if (!WPACKET_put_bytes_u16(pkt, s->client_version)
555cbb32 1266 || !WPACKET_memcpy(pkt, s->s3.client_random, SSL3_RANDOM_SIZE)) {
c48ffbcc 1267 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1268 return CON_FUNC_ERROR;
2c7b4dbc 1269 }
b9908bf9
MC
1270
1271 /* Session ID */
a5816a5a
MC
1272 session_id = s->session->session_id;
1273 if (s->new_session || s->session->ssl_version == TLS1_3_VERSION) {
1274 if (s->version == TLS1_3_VERSION
1275 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) {
1276 sess_id_len = sizeof(s->tmp_session_id);
1277 s->tmp_session_id_len = sess_id_len;
1278 session_id = s->tmp_session_id;
fc7129dc 1279 if (s->hello_retry_request == SSL_HRR_NONE
38b051a1 1280 && RAND_bytes_ex(sctx->libctx, s->tmp_session_id,
0f8815aa 1281 sess_id_len, 0) <= 0) {
c48ffbcc 1282 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1283 return CON_FUNC_ERROR;
a5816a5a
MC
1284 }
1285 } else {
1286 sess_id_len = 0;
1287 }
1288 } else {
dee0cc10 1289 assert(s->session->session_id_length <= sizeof(s->session->session_id));
ec60ccc1 1290 sess_id_len = s->session->session_id_length;
a5816a5a
MC
1291 if (s->version == TLS1_3_VERSION) {
1292 s->tmp_session_id_len = sess_id_len;
1293 memcpy(s->tmp_session_id, s->session->session_id, sess_id_len);
1294 }
1295 }
dee0cc10 1296 if (!WPACKET_start_sub_packet_u8(pkt)
a5816a5a 1297 || (sess_id_len != 0 && !WPACKET_memcpy(pkt, session_id,
ec60ccc1 1298 sess_id_len))
7cea05dc 1299 || !WPACKET_close(pkt)) {
c48ffbcc 1300 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1301 return CON_FUNC_ERROR;
b9908bf9 1302 }
0f113f3e 1303
b9908bf9 1304 /* cookie stuff for DTLS */
38b051a1 1305 if (SSL_CONNECTION_IS_DTLS(s)) {
2c7b4dbc 1306 if (s->d1->cookie_len > sizeof(s->d1->cookie)
7cea05dc 1307 || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie,
b2b3024e 1308 s->d1->cookie_len)) {
c48ffbcc 1309 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1310 return CON_FUNC_ERROR;
0f113f3e 1311 }
b9908bf9
MC
1312 }
1313
1314 /* Ciphers supported */
7cea05dc 1315 if (!WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 1316 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1317 return CON_FUNC_ERROR;
2c7b4dbc 1318 }
635c8f77 1319
38b051a1
TM
1320 if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s)),
1321 pkt)) {
f63a17d6 1322 /* SSLfatal() already called */
67ec6d2b 1323 return CON_FUNC_ERROR;
f63a17d6 1324 }
7cea05dc 1325 if (!WPACKET_close(pkt)) {
c48ffbcc 1326 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1327 return CON_FUNC_ERROR;
b9908bf9 1328 }
0f113f3e 1329
b9908bf9 1330 /* COMPRESSION */
7cea05dc 1331 if (!WPACKET_start_sub_packet_u8(pkt)) {
c48ffbcc 1332 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1333 return CON_FUNC_ERROR;
2c7b4dbc
MC
1334 }
1335#ifndef OPENSSL_NO_COMP
c19602b5 1336 if (ssl_allow_compression(s)
38b051a1
TM
1337 && sctx->comp_methods
1338 && (SSL_CONNECTION_IS_DTLS(s)
1339 || s->s3.tmp.max_ver < TLS1_3_VERSION)) {
1340 int compnum = sk_SSL_COMP_num(sctx->comp_methods);
2c7b4dbc 1341 for (i = 0; i < compnum; i++) {
38b051a1 1342 comp = sk_SSL_COMP_value(sctx->comp_methods, i);
7cea05dc 1343 if (!WPACKET_put_bytes_u8(pkt, comp->id)) {
c48ffbcc 1344 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1345 return CON_FUNC_ERROR;
2c7b4dbc
MC
1346 }
1347 }
b9908bf9 1348 }
09b6c2ef 1349#endif
2c7b4dbc 1350 /* Add the NULL method */
7cea05dc 1351 if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) {
c48ffbcc 1352 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 1353 return CON_FUNC_ERROR;
2c7b4dbc 1354 }
761772d7 1355
b9908bf9 1356 /* TLS extensions */
f63a17d6
MC
1357 if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0)) {
1358 /* SSLfatal() already called */
67ec6d2b 1359 return CON_FUNC_ERROR;
b9908bf9 1360 }
0f113f3e 1361
67ec6d2b 1362 return CON_FUNC_SUCCESS;
0f113f3e 1363}
d02b48c6 1364
38b051a1 1365MSG_PROCESS_RETURN dtls_process_hello_verify(SSL_CONNECTION *s, PACKET *pkt)
8ba708e5 1366{
cb150cbc 1367 size_t cookie_len;
8ba708e5
MC
1368 PACKET cookiepkt;
1369
1370 if (!PACKET_forward(pkt, 2)
a230b26e 1371 || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) {
c48ffbcc 1372 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 1373 return MSG_PROCESS_ERROR;
8ba708e5
MC
1374 }
1375
1376 cookie_len = PACKET_remaining(&cookiepkt);
1377 if (cookie_len > sizeof(s->d1->cookie)) {
c48ffbcc 1378 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_LENGTH_TOO_LONG);
f63a17d6 1379 return MSG_PROCESS_ERROR;
8ba708e5
MC
1380 }
1381
1382 if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) {
c48ffbcc 1383 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 1384 return MSG_PROCESS_ERROR;
8ba708e5
MC
1385 }
1386 s->d1->cookie_len = cookie_len;
1387
1388 return MSG_PROCESS_FINISHED_READING;
8ba708e5
MC
1389}
1390
38b051a1
TM
1391static int set_client_ciphersuite(SSL_CONNECTION *s,
1392 const unsigned char *cipherchars)
b9908bf9
MC
1393{
1394 STACK_OF(SSL_CIPHER) *sk;
1395 const SSL_CIPHER *c;
11c67eea 1396 int i;
38b051a1 1397 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
11c67eea
MC
1398
1399 c = ssl_get_cipher_by_char(s, cipherchars, 0);
1400 if (c == NULL) {
1401 /* unknown cipher */
c48ffbcc 1402 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CIPHER_RETURNED);
11c67eea
MC
1403 return 0;
1404 }
1405 /*
1406 * If it is a disabled cipher we either didn't send it in client hello,
1407 * or it's not allowed for the selected protocol. So we return an error.
1408 */
8af91fd9 1409 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK, 1)) {
c48ffbcc 1410 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED);
11c67eea
MC
1411 return 0;
1412 }
1413
1414 sk = ssl_get_ciphers_by_id(s);
1415 i = sk_SSL_CIPHER_find(sk, c);
1416 if (i < 0) {
1417 /* we did not say we would use this cipher */
c48ffbcc 1418 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED);
11c67eea
MC
1419 return 0;
1420 }
1421
38b051a1 1422 if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.new_cipher != NULL
555cbb32 1423 && s->s3.tmp.new_cipher->id != c->id) {
11c67eea 1424 /* ServerHello selected a different ciphersuite to that in the HRR */
c48ffbcc 1425 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED);
11c67eea
MC
1426 return 0;
1427 }
1428
1429 /*
1430 * Depending on the session caching (internal/external), the cipher
1431 * and/or cipher_id values may not be set. Make sure that cipher_id is
1432 * set and use it for comparison.
1433 */
1434 if (s->session->cipher != NULL)
1435 s->session->cipher_id = s->session->cipher->id;
1436 if (s->hit && (s->session->cipher_id != c->id)) {
38b051a1
TM
1437 if (SSL_CONNECTION_IS_TLS13(s)) {
1438 const EVP_MD *md = ssl_md(sctx, c->algorithm2);
b740012f 1439
9890cc42
AF
1440 if (!ossl_assert(s->session->cipher != NULL)) {
1441 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1442 return 0;
1443 }
a055a881
MC
1444 /*
1445 * In TLSv1.3 it is valid for the server to select a different
1446 * ciphersuite as long as the hash is the same.
1447 */
b740012f 1448 if (md == NULL
38b051a1 1449 || md != ssl_md(sctx, s->session->cipher->algorithm2)) {
f63a17d6 1450 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6 1451 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED);
a055a881
MC
1452 return 0;
1453 }
1454 } else {
1455 /*
1456 * Prior to TLSv1.3 resuming a session always meant using the same
1457 * ciphersuite.
1458 */
c48ffbcc 1459 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6 1460 SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
a055a881
MC
1461 return 0;
1462 }
11c67eea 1463 }
555cbb32 1464 s->s3.tmp.new_cipher = c;
11c67eea
MC
1465
1466 return 1;
1467}
1468
38b051a1 1469MSG_PROCESS_RETURN tls_process_server_hello(SSL_CONNECTION *s, PACKET *pkt)
11c67eea 1470{
332eb390 1471 PACKET session_id, extpkt;
b9908bf9 1472 size_t session_id_len;
b6981744 1473 const unsigned char *cipherchars;
597c51bc 1474 int hrr = 0;
b9908bf9 1475 unsigned int compression;
4fa52141 1476 unsigned int sversion;
3434f40b 1477 unsigned int context;
332eb390 1478 RAW_EXTENSION *extensions = NULL;
38b051a1 1479 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
dc84829c 1480 SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s);
b9908bf9
MC
1481#ifndef OPENSSL_NO_COMP
1482 SSL_COMP *comp;
1483#endif
1484
4fa52141 1485 if (!PACKET_get_net_2(pkt, &sversion)) {
c48ffbcc 1486 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 1487 goto err;
4fa52141 1488 }
50932c4a 1489
c3043dcd 1490 /* load the server random */
597c51bc
MC
1491 if (s->version == TLS1_3_VERSION
1492 && sversion == TLS1_2_VERSION
1493 && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE
1494 && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) {
d204a50b
TM
1495 if (s->hello_retry_request != SSL_HRR_NONE) {
1496 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
1497 goto err;
1498 }
fc7129dc 1499 s->hello_retry_request = SSL_HRR_PENDING;
9cd9e097 1500 /* Tell the record layer that we know we're going to get TLSv1.3 */
1d367677
MC
1501 if (!ssl_set_record_protocol_version(s, s->version)) {
1502 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1503 goto err;
1504 }
fc7129dc 1505 hrr = 1;
597c51bc 1506 if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) {
c48ffbcc 1507 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
597c51bc
MC
1508 goto err;
1509 }
1510 } else {
555cbb32 1511 if (!PACKET_copy_bytes(pkt, s->s3.server_random, SSL3_RANDOM_SIZE)) {
c48ffbcc 1512 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
597c51bc
MC
1513 goto err;
1514 }
c3043dcd
MC
1515 }
1516
88050dd1
MC
1517 /* Get the session-id. */
1518 if (!PACKET_get_length_prefixed_1(pkt, &session_id)) {
c48ffbcc 1519 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 1520 goto err;
0f113f3e 1521 }
88050dd1
MC
1522 session_id_len = PACKET_remaining(&session_id);
1523 if (session_id_len > sizeof(s->session->session_id)
1524 || session_id_len > SSL3_SESSION_ID_SIZE) {
c48ffbcc 1525 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_SSL3_SESSION_ID_TOO_LONG);
f63a17d6 1526 goto err;
524420d8
MC
1527 }
1528
73999b62 1529 if (!PACKET_get_bytes(pkt, &cipherchars, TLS_CIPHER_LEN)) {
c48ffbcc 1530 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 1531 goto err;
fc5ce51d
EK
1532 }
1533
88050dd1 1534 if (!PACKET_get_1(pkt, &compression)) {
c48ffbcc 1535 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
88050dd1 1536 goto err;
4ff65f77
MC
1537 }
1538
1539 /* TLS extensions */
597c51bc 1540 if (PACKET_remaining(pkt) == 0 && !hrr) {
4ff65f77 1541 PACKET_null_init(&extpkt);
26b9172a
MC
1542 } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt)
1543 || PACKET_remaining(pkt) != 0) {
c48ffbcc 1544 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
f63a17d6 1545 goto err;
4ff65f77
MC
1546 }
1547
597c51bc
MC
1548 if (!hrr) {
1549 if (!tls_collect_extensions(s, &extpkt,
1550 SSL_EXT_TLS1_2_SERVER_HELLO
1551 | SSL_EXT_TLS1_3_SERVER_HELLO,
1552 &extensions, NULL, 1)) {
1553 /* SSLfatal() already called */
1554 goto err;
1555 }
1556
1557 if (!ssl_choose_client_version(s, sversion, extensions)) {
1558 /* SSLfatal() already called */
1559 goto err;
1560 }
88050dd1
MC
1561 }
1562
38b051a1 1563 if (SSL_CONNECTION_IS_TLS13(s) || hrr) {
597c51bc
MC
1564 if (compression != 0) {
1565 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
597c51bc
MC
1566 SSL_R_INVALID_COMPRESSION_ALGORITHM);
1567 goto err;
1568 }
1569
1570 if (session_id_len != s->tmp_session_id_len
1571 || memcmp(PACKET_data(&session_id), s->tmp_session_id,
1572 session_id_len) != 0) {
c48ffbcc 1573 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_INVALID_SESSION_ID);
597c51bc
MC
1574 goto err;
1575 }
1576 }
1577
1578 if (hrr) {
1579 if (!set_client_ciphersuite(s, cipherchars)) {
1580 /* SSLfatal() already called */
1581 goto err;
1582 }
1583
1584 return tls_process_as_hello_retry_request(s, &extpkt);
88050dd1
MC
1585 }
1586
1587 /*
1588 * Now we have chosen the version we need to check again that the extensions
1589 * are appropriate for this version.
1590 */
38b051a1
TM
1591 context = SSL_CONNECTION_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO
1592 : SSL_EXT_TLS1_2_SERVER_HELLO;
88050dd1 1593 if (!tls_validate_all_contexts(s, context, extensions)) {
c48ffbcc 1594 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
88050dd1
MC
1595 goto err;
1596 }
1597
4ff65f77
MC
1598 s->hit = 0;
1599
38b051a1 1600 if (SSL_CONNECTION_IS_TLS13(s)) {
a5816a5a
MC
1601 /*
1602 * In TLSv1.3 a ServerHello message signals a key change so the end of
1603 * the message must be on a record boundary.
1604 */
1605 if (RECORD_LAYER_processed_read_pending(&s->rlayer)) {
1606 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
a5816a5a
MC
1607 SSL_R_NOT_ON_RECORD_BOUNDARY);
1608 goto err;
1609 }
1610
4ff65f77
MC
1611 /* This will set s->hit if we are resuming */
1612 if (!tls_parse_extension(s, TLSEXT_IDX_psk,
fe874d27 1613 SSL_EXT_TLS1_3_SERVER_HELLO,
88050dd1 1614 extensions, NULL, 0)) {
f63a17d6
MC
1615 /* SSLfatal() already called */
1616 goto err;
1617 }
4ff65f77 1618 } else {
8c1a5343 1619 /*
4ff65f77
MC
1620 * Check if we can resume the session based on external pre-shared
1621 * secret. EAP-FAST (RFC 4851) supports two types of session resumption.
1622 * Resumption based on server-side state works with session IDs.
1623 * Resumption based on pre-shared Protected Access Credentials (PACs)
1624 * works by overriding the SessionTicket extension at the application
1625 * layer, and does not send a session ID. (We do not know whether
1626 * EAP-FAST servers would honour the session ID.) Therefore, the session
1627 * ID alone is not a reliable indicator of session resumption, so we
1628 * first check if we can resume, and later peek at the next handshake
1629 * message to see if the server wants to resume.
8c1a5343 1630 */
4ff65f77
MC
1631 if (s->version >= TLS1_VERSION
1632 && s->ext.session_secret_cb != NULL && s->session->ext.tick) {
1633 const SSL_CIPHER *pref_cipher = NULL;
1634 /*
1635 * s->session->master_key_length is a size_t, but this is an int for
1636 * backwards compat reasons
1637 */
1638 int master_key_length;
38b051a1 1639
4ff65f77 1640 master_key_length = sizeof(s->session->master_key);
dc84829c 1641 if (s->ext.session_secret_cb(ussl, s->session->master_key,
4ff65f77
MC
1642 &master_key_length,
1643 NULL, &pref_cipher,
1644 s->ext.session_secret_cb_arg)
1645 && master_key_length > 0) {
1646 s->session->master_key_length = master_key_length;
1647 s->session->cipher = pref_cipher ?
60d685d1 1648 pref_cipher : ssl_get_cipher_by_char(s, cipherchars, 0);
4ff65f77 1649 } else {
c48ffbcc 1650 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f63a17d6 1651 goto err;
4ff65f77 1652 }
0f113f3e 1653 }
4ff65f77
MC
1654
1655 if (session_id_len != 0
1656 && session_id_len == s->session->session_id_length
1657 && memcmp(PACKET_data(&session_id), s->session->session_id,
1658 session_id_len) == 0)
1659 s->hit = 1;
50932c4a
MC
1660 }
1661
4ff65f77 1662 if (s->hit) {
0f113f3e 1663 if (s->sid_ctx_length != s->session->sid_ctx_length
4ff65f77 1664 || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) {
0f113f3e 1665 /* actually a client application bug */
f63a17d6 1666 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6
MC
1667 SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
1668 goto err;
0f113f3e 1669 }
6e3d0153 1670 } else {
0f113f3e 1671 /*
6e3d0153 1672 * If we were trying for session-id reuse but the server
4ff65f77 1673 * didn't resume, make a new SSL_SESSION.
6e3d0153
EK
1674 * In the case of EAP-FAST and PAC, we do not send a session ID,
1675 * so the PAC-based session secret is always preserved. It'll be
1676 * overwritten if the server refuses resumption.
0f113f3e 1677 */
c96ce52c 1678 if (s->session->session_id_length > 0) {
acce0557 1679 ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_miss);
0f113f3e 1680 if (!ssl_get_new_session(s, 0)) {
f63a17d6
MC
1681 /* SSLfatal() already called */
1682 goto err;
0f113f3e
MC
1683 }
1684 }
50932c4a 1685
ccae4a15 1686 s->session->ssl_version = s->version;
a5816a5a
MC
1687 /*
1688 * In TLSv1.2 and below we save the session id we were sent so we can
1689 * resume it later. In TLSv1.3 the session id we were sent is just an
1690 * echo of what we originally sent in the ClientHello and should not be
1691 * used for resumption.
1692 */
38b051a1 1693 if (!SSL_CONNECTION_IS_TLS13(s)) {
a5816a5a
MC
1694 s->session->session_id_length = session_id_len;
1695 /* session_id_len could be 0 */
1696 if (session_id_len > 0)
1697 memcpy(s->session->session_id, PACKET_data(&session_id),
1698 session_id_len);
1699 }
0f113f3e 1700 }
fc5ce51d 1701
ccae4a15
FI
1702 /* Session version and negotiated protocol version should match */
1703 if (s->version != s->session->ssl_version) {
c48ffbcc 1704 SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
f63a17d6
MC
1705 SSL_R_SSL_SESSION_VERSION_MISMATCH);
1706 goto err;
ccae4a15 1707 }
0f113f3e 1708 /*
3eb2aff4
KR
1709 * Now that we know the version, update the check to see if it's an allowed
1710 * version.
1711 */
555cbb32
TS
1712 s->s3.tmp.min_ver = s->version;
1713 s->s3.tmp.max_ver = s->version;
0f113f3e 1714
11c67eea 1715 if (!set_client_ciphersuite(s, cipherchars)) {
f63a17d6
MC
1716 /* SSLfatal() already called */
1717 goto err;
0f113f3e
MC
1718 }
1719
09b6c2ef 1720#ifdef OPENSSL_NO_COMP
fc5ce51d 1721 if (compression != 0) {
c48ffbcc 1722 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6
MC
1723 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
1724 goto err;
0f113f3e
MC
1725 }
1726 /*
1727 * If compression is disabled we'd better not try to resume a session
1728 * using compression.
1729 */
1730 if (s->session->compress_meth != 0) {
c48ffbcc 1731 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_COMPRESSION);
f63a17d6 1732 goto err;
0f113f3e 1733 }
09b6c2ef 1734#else
fc5ce51d 1735 if (s->hit && compression != s->session->compress_meth) {
c48ffbcc 1736 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
dd5a4279 1737 SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED);
f63a17d6 1738 goto err;
0f113f3e 1739 }
fc5ce51d 1740 if (compression == 0)
0f113f3e
MC
1741 comp = NULL;
1742 else if (!ssl_allow_compression(s)) {
c48ffbcc 1743 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COMPRESSION_DISABLED);
f63a17d6 1744 goto err;
fc5ce51d 1745 } else {
38b051a1
TM
1746 comp = ssl3_comp_find(SSL_CONNECTION_GET_CTX(s)->comp_methods,
1747 compression);
fc5ce51d 1748 }
0f113f3e 1749
fc5ce51d 1750 if (compression != 0 && comp == NULL) {
c48ffbcc 1751 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6
MC
1752 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
1753 goto err;
0f113f3e 1754 } else {
555cbb32 1755 s->s3.tmp.new_compression = comp;
0f113f3e 1756 }
09b6c2ef 1757#endif
761772d7 1758
f63a17d6
MC
1759 if (!tls_parse_all_extensions(s, context, extensions, NULL, 0, 1)) {
1760 /* SSLfatal() already called */
1761 goto err;
1762 }
332eb390 1763
8723588e 1764#ifndef OPENSSL_NO_SCTP
38b051a1 1765 if (SSL_CONNECTION_IS_DTLS(s) && s->hit) {
8723588e
MC
1766 unsigned char sctpauthkey[64];
1767 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
09d62b33 1768 size_t labellen;
8723588e
MC
1769
1770 /*
1771 * Add new shared key for SCTP-Auth, will be ignored if
1772 * no SCTP used.
1773 */
141eb8c6
MC
1774 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
1775 sizeof(DTLS1_SCTP_AUTH_LABEL));
8723588e 1776
09d62b33
MT
1777 /* Don't include the terminating zero. */
1778 labellen = sizeof(labelbuffer) - 1;
1779 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG)
1780 labellen += 1;
1781
38b051a1 1782 if (SSL_export_keying_material(ssl, sctpauthkey,
a230b26e
EK
1783 sizeof(sctpauthkey),
1784 labelbuffer,
09d62b33 1785 labellen, NULL, 0, 0) <= 0) {
c48ffbcc 1786 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f63a17d6
MC
1787 goto err;
1788 }
8723588e 1789
38b051a1 1790 BIO_ctrl(SSL_get_wbio(ssl),
8723588e
MC
1791 BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
1792 sizeof(sctpauthkey), sctpauthkey);
1793 }
1794#endif
1795
92760c21
MC
1796 /*
1797 * In TLSv1.3 we have some post-processing to change cipher state, otherwise
1798 * we're done with this message
1799 */
84a14925
MC
1800 if (SSL_CONNECTION_IS_TLS13(s)) {
1801 if (!ssl->method->ssl3_enc->setup_key_block(s)
86e75792 1802 || !tls13_store_handshake_traffic_hash(s)) {
84a14925
MC
1803 /* SSLfatal() already called */
1804 goto err;
1805 }
1806 /*
1807 * If we're not doing early-data and we're not going to send a dummy CCS
1808 * (i.e. no middlebox compat mode) then we can change the write keys
1809 * immediately. Otherwise we have to defer this until after all possible
23def9d3 1810 * early data is written. We could just always defer until the last
84a14925
MC
1811 * moment except QUIC needs it done at the same time as the read keys
1812 * are changed. Since QUIC doesn't do TLS early data or need middlebox
1813 * compat this doesn't cause a problem.
1814 */
86e75792
MC
1815 if (SSL_IS_QUIC_HANDSHAKE(s)
1816 || (s->early_data_state == SSL_EARLY_DATA_NONE
1817 && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0)) {
1818 if (!ssl->method->ssl3_enc->change_cipher_state(s,
84a14925 1819 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) {
86e75792
MC
1820 /* SSLfatal() already called */
1821 goto err;
1822 }
1823 }
1824 if (!ssl->method->ssl3_enc->change_cipher_state(s,
1825 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ)) {
84a14925
MC
1826 /* SSLfatal() already called */
1827 goto err;
1828 }
92760c21
MC
1829 }
1830
1b0286a3 1831 OPENSSL_free(extensions);
b9908bf9 1832 return MSG_PROCESS_CONTINUE_READING;
f63a17d6 1833 err:
1b0286a3 1834 OPENSSL_free(extensions);
b9908bf9 1835 return MSG_PROCESS_ERROR;
0f113f3e 1836}
d02b48c6 1837
38b051a1 1838static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s,
597c51bc 1839 PACKET *extpkt)
3847d426 1840{
3847d426 1841 RAW_EXTENSION *extensions = NULL;
3847d426 1842
d4504fe5 1843 /*
f471f60a
MC
1844 * If we were sending early_data then any alerts should not be sent using
1845 * the old wrlmethod.
d4504fe5 1846 */
f471f60a
MC
1847 if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING
1848 && !ssl_set_new_record_layer(s,
1849 TLS_ANY_VERSION,
1850 OSSL_RECORD_DIRECTION_WRITE,
1851 OSSL_RECORD_PROTECTION_LEVEL_NONE,
3f9175c7
MC
1852 NULL, 0, NULL, 0, NULL, 0, NULL, 0,
1853 NULL, 0, NID_undef, NULL, NULL, NULL)) {
f471f60a
MC
1854 /* SSLfatal already called */
1855 goto err;
1856 }
1857 /* We are definitely going to be using TLSv1.3 */
1858 s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, TLS1_3_VERSION);
d4504fe5 1859
597c51bc 1860 if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST,
f63a17d6 1861 &extensions, NULL, 1)
fe874d27 1862 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST,
f63a17d6
MC
1863 extensions, NULL, 0, 1)) {
1864 /* SSLfatal() already called */
1865 goto err;
1866 }
3847d426
MC
1867
1868 OPENSSL_free(extensions);
66d4bf6b
MC
1869 extensions = NULL;
1870
5b64ce89 1871 if (s->ext.tls13_cookie_len == 0 && s->s3.tmp.pkey != NULL) {
66d4bf6b
MC
1872 /*
1873 * We didn't receive a cookie or a new key_share so the next
1874 * ClientHello will not change
1875 */
c48ffbcc 1876 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CHANGE_FOLLOWING_HRR);
f63a17d6 1877 goto err;
66d4bf6b 1878 }
3847d426 1879
11c67eea
MC
1880 /*
1881 * Re-initialise the Transcript Hash. We're going to prepopulate it with
1882 * a synthetic message_hash in place of ClientHello1.
1883 */
43054d3d 1884 if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) {
f63a17d6
MC
1885 /* SSLfatal() already called */
1886 goto err;
11c67eea
MC
1887 }
1888
1889 /*
1890 * Add this message to the Transcript Hash. Normally this is done
1891 * automatically prior to the message processing stage. However due to the
1892 * need to create the synthetic message hash, we defer that step until now
1893 * for HRR messages.
1894 */
1895 if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
1896 s->init_num + SSL3_HM_HEADER_LENGTH)) {
f63a17d6
MC
1897 /* SSLfatal() already called */
1898 goto err;
11c67eea
MC
1899 }
1900
3847d426 1901 return MSG_PROCESS_FINISHED_READING;
f63a17d6 1902 err:
3847d426
MC
1903 OPENSSL_free(extensions);
1904 return MSG_PROCESS_ERROR;
1905}
1906
3c95ef22
TS
1907MSG_PROCESS_RETURN tls_process_server_rpk(SSL_CONNECTION *sc, PACKET *pkt)
1908{
d7af3f7a 1909 EVP_PKEY *peer_rpk = NULL;
3c95ef22
TS
1910
1911 if (!tls_process_rpk(sc, pkt, &peer_rpk)) {
1912 /* SSLfatal() already called */
1913 return MSG_PROCESS_ERROR;
1914 }
1915
1916 if (peer_rpk == NULL) {
1917 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_CERTIFICATE);
1918 return MSG_PROCESS_ERROR;
1919 }
1920
1921 EVP_PKEY_free(sc->session->peer_rpk);
1922 sc->session->peer_rpk = peer_rpk;
1923
1924 return MSG_PROCESS_CONTINUE_PROCESSING;
1925}
1926
1927static WORK_STATE tls_post_process_server_rpk(SSL_CONNECTION *sc,
1928 WORK_STATE wst)
1929{
1930 size_t certidx;
1931 const SSL_CERT_LOOKUP *clu;
6ae8e947 1932 int v_ok;
3c95ef22
TS
1933
1934 if (sc->session->peer_rpk == NULL) {
1935 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER,
1936 SSL_R_INVALID_RAW_PUBLIC_KEY);
1937 return WORK_ERROR;
1938 }
1939
1940 if (sc->rwstate == SSL_RETRY_VERIFY)
1941 sc->rwstate = SSL_NOTHING;
6ae8e947
VD
1942
1943 ERR_set_mark();
1944 v_ok = ssl_verify_rpk(sc, sc->session->peer_rpk);
1945 if (v_ok <= 0 && sc->verify_mode != SSL_VERIFY_NONE) {
1946 ERR_clear_last_mark();
1947 SSLfatal(sc, ssl_x509err2alert(sc->verify_result),
1948 SSL_R_CERTIFICATE_VERIFY_FAILED);
1949 return WORK_ERROR;
1950 }
1951 ERR_pop_to_mark(); /* but we keep s->verify_result */
1952 if (v_ok > 0 && sc->rwstate == SSL_RETRY_VERIFY) {
3c95ef22 1953 return WORK_MORE_A;
6ae8e947 1954 }
3c95ef22
TS
1955
1956 if ((clu = ssl_cert_lookup_by_pkey(sc->session->peer_rpk, &certidx,
1957 SSL_CONNECTION_GET_CTX(sc))) == NULL) {
1958 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1959 return WORK_ERROR;
1960 }
1961
1962 /*
1963 * Check certificate type is consistent with ciphersuite. For TLS 1.3
1964 * skip check since TLS 1.3 ciphersuites can be used with any certificate
1965 * type.
1966 */
1967 if (!SSL_CONNECTION_IS_TLS13(sc)) {
1968 if ((clu->amask & sc->s3.tmp.new_cipher->algorithm_auth) == 0) {
1969 SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_RPK_TYPE);
1970 return WORK_ERROR;
1971 }
1972 }
1973
1974 /* Ensure there is no peer/peer_chain */
1975 X509_free(sc->session->peer);
1976 sc->session->peer = NULL;
1977 sk_X509_pop_free(sc->session->peer_chain, X509_free);
1978 sc->session->peer_chain = NULL;
1979 sc->session->verify_result = sc->verify_result;
1980
1981 /* Save the current hash state for when we receive the CertificateVerify */
1982 if (SSL_CONNECTION_IS_TLS13(sc)
1983 && !ssl_handshake_hash(sc, sc->cert_verify_hash,
1984 sizeof(sc->cert_verify_hash),
1985 &sc->cert_verify_hash_len)) {
1986 /* SSLfatal() already called */
1987 return WORK_ERROR;
1988 }
1989
1990 return WORK_FINISHED_CONTINUE;
1991}
1992
3201abeb 1993/* prepare server cert verification by setting s->session->peer_chain from pkt */
38b051a1
TM
1994MSG_PROCESS_RETURN tls_process_server_certificate(SSL_CONNECTION *s,
1995 PACKET *pkt)
b9908bf9 1996{
b9908bf9
MC
1997 unsigned long cert_list_len, cert_len;
1998 X509 *x = NULL;
b6981744 1999 const unsigned char *certstart, *certbytes;
0c3eb279 2000 size_t chainidx;
e96e0f8e 2001 unsigned int context = 0;
38b051a1 2002 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
0f113f3e 2003
3c95ef22
TS
2004 if (s->ext.server_cert_type == TLSEXT_cert_type_rpk)
2005 return tls_process_server_rpk(s, pkt);
2006 if (s->ext.server_cert_type != TLSEXT_cert_type_x509) {
2007 SSLfatal(s, SSL_AD_UNSUPPORTED_CERTIFICATE,
2008 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
2009 goto err;
2010 }
2011
0c3eb279 2012 if ((s->session->peer_chain = sk_X509_new_null()) == NULL) {
e077455e 2013 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
cc273a93 2014 goto err;
0f113f3e
MC
2015 }
2016
38b051a1 2017 if ((SSL_CONNECTION_IS_TLS13(s) && !PACKET_get_1(pkt, &context))
e96e0f8e
MC
2018 || context != 0
2019 || !PACKET_get_net_3(pkt, &cert_list_len)
1a281aab
MC
2020 || PACKET_remaining(pkt) != cert_list_len
2021 || PACKET_remaining(pkt) == 0) {
c48ffbcc 2022 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2023 goto err;
0f113f3e 2024 }
d805a57b 2025 for (chainidx = 0; PACKET_remaining(pkt); chainidx++) {
73999b62 2026 if (!PACKET_get_net_3(pkt, &cert_len)
a230b26e 2027 || !PACKET_get_bytes(pkt, &certbytes, cert_len)) {
c48ffbcc 2028 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CERT_LENGTH_MISMATCH);
f63a17d6 2029 goto err;
0f113f3e
MC
2030 }
2031
df758a85 2032 certstart = certbytes;
38b051a1 2033 x = X509_new_ex(sctx->libctx, sctx->propq);
0f113f3e 2034 if (x == NULL) {
e077455e 2035 SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_ASN1_LIB);
6725682d
SL
2036 goto err;
2037 }
2038 if (d2i_X509(&x, (const unsigned char **)&certbytes,
2039 cert_len) == NULL) {
c48ffbcc 2040 SSLfatal(s, SSL_AD_BAD_CERTIFICATE, ERR_R_ASN1_LIB);
f63a17d6 2041 goto err;
0f113f3e 2042 }
6725682d 2043
df758a85 2044 if (certbytes != (certstart + cert_len)) {
c48ffbcc 2045 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CERT_LENGTH_MISMATCH);
f63a17d6 2046 goto err;
0f113f3e 2047 }
e96e0f8e 2048
38b051a1 2049 if (SSL_CONNECTION_IS_TLS13(s)) {
e96e0f8e
MC
2050 RAW_EXTENSION *rawexts = NULL;
2051 PACKET extensions;
2052
2053 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) {
c48ffbcc 2054 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
f63a17d6 2055 goto err;
e96e0f8e 2056 }
fe874d27
MC
2057 if (!tls_collect_extensions(s, &extensions,
2058 SSL_EXT_TLS1_3_CERTIFICATE, &rawexts,
f63a17d6 2059 NULL, chainidx == 0)
8e1634ec 2060 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE,
f63a17d6 2061 rawexts, x, chainidx,
8e1634ec 2062 PACKET_remaining(pkt) == 0)) {
5ee289ea 2063 OPENSSL_free(rawexts);
f63a17d6
MC
2064 /* SSLfatal already called */
2065 goto err;
5ee289ea
MC
2066 }
2067 OPENSSL_free(rawexts);
e96e0f8e
MC
2068 }
2069
0c3eb279 2070 if (!sk_X509_push(s->session->peer_chain, x)) {
e077455e 2071 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
cc273a93 2072 goto err;
0f113f3e
MC
2073 }
2074 x = NULL;
0f113f3e 2075 }
0c3eb279
DDO
2076 return MSG_PROCESS_CONTINUE_PROCESSING;
2077
2078 err:
2079 X509_free(x);
79b2a2f2 2080 OSSL_STACK_OF_X509_free(s->session->peer_chain);
0c3eb279
DDO
2081 s->session->peer_chain = NULL;
2082 return MSG_PROCESS_ERROR;
2083}
0f113f3e 2084
0c3eb279
DDO
2085/*
2086 * Verify the s->session->peer_chain and check server cert type.
2087 * On success set s->session->peer and s->session->verify_result.
2088 * Else the peer certificate verification callback may request retry.
2089 */
38b051a1
TM
2090WORK_STATE tls_post_process_server_certificate(SSL_CONNECTION *s,
2091 WORK_STATE wst)
0c3eb279
DDO
2092{
2093 X509 *x;
2094 EVP_PKEY *pkey = NULL;
2095 const SSL_CERT_LOOKUP *clu;
2096 size_t certidx;
2097 int i;
2098
3c95ef22
TS
2099 if (s->ext.server_cert_type == TLSEXT_cert_type_rpk)
2100 return tls_post_process_server_rpk(s, wst);
2101
dfb39f73
TM
2102 if (s->rwstate == SSL_RETRY_VERIFY)
2103 s->rwstate = SSL_NOTHING;
739c4b2e 2104
c8e2f98c
MC
2105 /*
2106 * The documented interface is that SSL_VERIFY_PEER should be set in order
2107 * for client side verification of the server certificate to take place.
2108 * However, historically the code has only checked that *any* flag is set
2109 * to cause server verification to take place. Use of the other flags makes
2110 * no sense in client mode. An attempt to clean up the semantics was
2111 * reverted because at least one application *only* set
2112 * SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Prior to the clean up this still caused
2113 * server verification to take place, after the clean up it silently did
2114 * nothing. SSL_CTX_set_verify()/SSL_set_verify() cannot validate the flags
2115 * sent to them because they are void functions. Therefore, we now use the
2116 * (less clean) historic behaviour of performing validation if any flag is
2117 * set. The *documented* interface remains the same.
2118 */
739c4b2e
VD
2119 ERR_set_mark();
2120 i = ssl_verify_cert_chain(s, s->session->peer_chain);
2121 if (i <= 0 && s->verify_mode != SSL_VERIFY_NONE) {
2122 ERR_clear_last_mark();
c6d38183 2123 SSLfatal(s, ssl_x509err2alert(s->verify_result),
f63a17d6 2124 SSL_R_CERTIFICATE_VERIFY_FAILED);
0c3eb279 2125 return WORK_ERROR;
0f113f3e 2126 }
739c4b2e
VD
2127 ERR_pop_to_mark(); /* but we keep s->verify_result */
2128 if (i > 0 && s->rwstate == SSL_RETRY_VERIFY)
2129 return WORK_MORE_A;
0f113f3e 2130
0f113f3e
MC
2131 /*
2132 * Inconsistency alert: cert_chain does include the peer's certificate,
d4d78943 2133 * which we don't include in statem_srvr.c
0f113f3e 2134 */
0c3eb279 2135 x = sk_X509_value(s->session->peer_chain, 0);
0f113f3e 2136
8382fd3a 2137 pkey = X509_get0_pubkey(x);
0f113f3e 2138
55a9a16f 2139 if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) {
c48ffbcc 2140 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
f63a17d6 2141 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
0c3eb279 2142 return WORK_ERROR;
0f113f3e
MC
2143 }
2144
ee58915c
MB
2145 if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx,
2146 SSL_CONNECTION_GET_CTX(s))) == NULL) {
c48ffbcc 2147 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
0c3eb279 2148 return WORK_ERROR;
0f113f3e 2149 }
05b8486e
DSH
2150 /*
2151 * Check certificate type is consistent with ciphersuite. For TLS 1.3
2152 * skip check since TLS 1.3 ciphersuites can be used with any certificate
2153 * type.
2154 */
38b051a1 2155 if (!SSL_CONNECTION_IS_TLS13(s)) {
555cbb32 2156 if ((clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0) {
c48ffbcc 2157 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CERTIFICATE_TYPE);
0c3eb279 2158 return WORK_ERROR;
05b8486e 2159 }
0f113f3e 2160 }
55a9a16f 2161
00fbc969
FWH
2162 if (!X509_up_ref(x)) {
2163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2164 return WORK_ERROR;
2165 }
2166
55a9a16f 2167 X509_free(s->session->peer);
55a9a16f 2168 s->session->peer = x;
0f113f3e 2169 s->session->verify_result = s->verify_result;
3c95ef22
TS
2170 /* Ensure there is no RPK */
2171 EVP_PKEY_free(s->session->peer_rpk);
2172 s->session->peer_rpk = NULL;
2c5dfdc3
MC
2173
2174 /* Save the current hash state for when we receive the CertificateVerify */
38b051a1 2175 if (SSL_CONNECTION_IS_TLS13(s)
2c5dfdc3
MC
2176 && !ssl_handshake_hash(s, s->cert_verify_hash,
2177 sizeof(s->cert_verify_hash),
2178 &s->cert_verify_hash_len)) {
f63a17d6 2179 /* SSLfatal() already called */;
0c3eb279 2180 return WORK_ERROR;
2c5dfdc3 2181 }
0c3eb279 2182 return WORK_FINISHED_CONTINUE;
0f113f3e 2183}
d02b48c6 2184
b67cb09f
TS
2185#ifndef OPENSSL_NO_COMP_ALG
2186MSG_PROCESS_RETURN tls_process_server_compressed_certificate(SSL_CONNECTION *sc, PACKET *pkt)
2187{
2188 MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR;
2189 PACKET tmppkt;
2190 BUF_MEM *buf = BUF_MEM_new();
2191
2192 if (tls13_process_compressed_certificate(sc, pkt, &tmppkt, buf) != MSG_PROCESS_ERROR)
2193 ret = tls_process_server_certificate(sc, &tmppkt);
2194
2195 BUF_MEM_free(buf);
2196 return ret;
2197}
2198#endif
2199
38b051a1 2200static int tls_process_ske_psk_preamble(SSL_CONNECTION *s, PACKET *pkt)
02a74590
MC
2201{
2202#ifndef OPENSSL_NO_PSK
7dc1c647 2203 PACKET psk_identity_hint;
02a74590 2204
7dc1c647
MC
2205 /* PSK ciphersuites are preceded by an identity hint */
2206
2207 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity_hint)) {
c48ffbcc 2208 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
7dc1c647
MC
2209 return 0;
2210 }
2211
2212 /*
2213 * Store PSK identity hint for later use, hint is used in
2214 * tls_construct_client_key_exchange. Assume that the maximum length of
2215 * a PSK identity hint can be as long as the maximum length of a PSK
2216 * identity.
2217 */
2218 if (PACKET_remaining(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN) {
c48ffbcc 2219 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_DATA_LENGTH_TOO_LONG);
7dc1c647
MC
2220 return 0;
2221 }
02a74590 2222
7dc1c647
MC
2223 if (PACKET_remaining(&psk_identity_hint) == 0) {
2224 OPENSSL_free(s->session->psk_identity_hint);
2225 s->session->psk_identity_hint = NULL;
2226 } else if (!PACKET_strndup(&psk_identity_hint,
a230b26e 2227 &s->session->psk_identity_hint)) {
c48ffbcc 2228 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
7dc1c647
MC
2229 return 0;
2230 }
2231
2232 return 1;
2233#else
c48ffbcc 2234 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
7dc1c647 2235 return 0;
02a74590
MC
2236#endif
2237}
2238
38b051a1 2239static int tls_process_ske_srp(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey)
25c6c10c
MC
2240{
2241#ifndef OPENSSL_NO_SRP
2242 PACKET prime, generator, salt, server_pub;
2243
2244 if (!PACKET_get_length_prefixed_2(pkt, &prime)
2245 || !PACKET_get_length_prefixed_2(pkt, &generator)
2246 || !PACKET_get_length_prefixed_1(pkt, &salt)
2247 || !PACKET_get_length_prefixed_2(pkt, &server_pub)) {
c48ffbcc 2248 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
25c6c10c
MC
2249 return 0;
2250 }
2251
2252 if ((s->srp_ctx.N =
2253 BN_bin2bn(PACKET_data(&prime),
348240c6 2254 (int)PACKET_remaining(&prime), NULL)) == NULL
25c6c10c
MC
2255 || (s->srp_ctx.g =
2256 BN_bin2bn(PACKET_data(&generator),
348240c6 2257 (int)PACKET_remaining(&generator), NULL)) == NULL
25c6c10c
MC
2258 || (s->srp_ctx.s =
2259 BN_bin2bn(PACKET_data(&salt),
348240c6 2260 (int)PACKET_remaining(&salt), NULL)) == NULL
25c6c10c
MC
2261 || (s->srp_ctx.B =
2262 BN_bin2bn(PACKET_data(&server_pub),
348240c6 2263 (int)PACKET_remaining(&server_pub), NULL)) == NULL) {
c48ffbcc 2264 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BN_LIB);
25c6c10c
MC
2265 return 0;
2266 }
2267
a2c2e000
MC
2268 if (!srp_verify_server_param(s)) {
2269 /* SSLfatal() already called */
25c6c10c
MC
2270 return 0;
2271 }
2272
2273 /* We must check if there is a certificate */
555cbb32 2274 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS))
3c95ef22 2275 *pkey = tls_get_peer_pkey(s);
25c6c10c
MC
2276
2277 return 1;
2278#else
c48ffbcc 2279 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
25c6c10c
MC
2280 return 0;
2281#endif
2282}
2283
38b051a1 2284static int tls_process_ske_dhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey)
e01a610d 2285{
e01a610d
MC
2286 PACKET prime, generator, pub_key;
2287 EVP_PKEY *peer_tmp = NULL;
e01a610d 2288 BIGNUM *p = NULL, *g = NULL, *bnpub_key = NULL;
1ee22dc2
MC
2289 EVP_PKEY_CTX *pctx = NULL;
2290 OSSL_PARAM *params = NULL;
2291 OSSL_PARAM_BLD *tmpl = NULL;
38b051a1 2292 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1ee22dc2 2293 int ret = 0;
26505153 2294
e01a610d
MC
2295 if (!PACKET_get_length_prefixed_2(pkt, &prime)
2296 || !PACKET_get_length_prefixed_2(pkt, &generator)
2297 || !PACKET_get_length_prefixed_2(pkt, &pub_key)) {
c48ffbcc 2298 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
e01a610d
MC
2299 return 0;
2300 }
2301
348240c6
MC
2302 p = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL);
2303 g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator),
2304 NULL);
2305 bnpub_key = BN_bin2bn(PACKET_data(&pub_key),
2306 (int)PACKET_remaining(&pub_key), NULL);
e01a610d 2307 if (p == NULL || g == NULL || bnpub_key == NULL) {
c48ffbcc 2308 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BN_LIB);
e01a610d
MC
2309 goto err;
2310 }
2311
1ee22dc2
MC
2312 tmpl = OSSL_PARAM_BLD_new();
2313 if (tmpl == NULL
2314 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_P, p)
2315 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G, g)
2316 || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_PUB_KEY,
2317 bnpub_key)
2318 || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) {
2319 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
e01a610d
MC
2320 goto err;
2321 }
e01a610d 2322
38b051a1 2323 pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq);
1ee22dc2
MC
2324 if (pctx == NULL) {
2325 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
26505153
RL
2326 goto err;
2327 }
2db985b7
SL
2328 if (EVP_PKEY_fromdata_init(pctx) <= 0
2329 || EVP_PKEY_fromdata(pctx, &peer_tmp, EVP_PKEY_KEYPAIR, params) <= 0) {
1ee22dc2 2330 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_DH_VALUE);
e01a610d
MC
2331 goto err;
2332 }
e01a610d 2333
1ee22dc2 2334 EVP_PKEY_CTX_free(pctx);
38b051a1 2335 pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, peer_tmp, sctx->propq);
1ee22dc2 2336 if (pctx == NULL
899e2564
MC
2337 /*
2338 * EVP_PKEY_param_check() will verify that the DH params are using
2339 * a safe prime. In this context, because we're using ephemeral DH,
2340 * we're ok with it not being a safe prime.
2341 * EVP_PKEY_param_check_quick() skips the safe prime check.
2342 */
2343 || EVP_PKEY_param_check_quick(pctx) != 1
1ee22dc2
MC
2344 || EVP_PKEY_public_check(pctx) != 1) {
2345 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_DH_VALUE);
e01a610d
MC
2346 goto err;
2347 }
2348
ed576acd
TM
2349 if (!ssl_security(s, SSL_SECOP_TMP_DH,
2350 EVP_PKEY_get_security_bits(peer_tmp),
47e81a1b 2351 0, peer_tmp)) {
c48ffbcc 2352 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_DH_KEY_TOO_SMALL);
ada66e78
P
2353 goto err;
2354 }
2355
555cbb32 2356 s->s3.peer_tmp = peer_tmp;
1ee22dc2 2357 peer_tmp = NULL;
e01a610d
MC
2358
2359 /*
2360 * FIXME: This makes assumptions about which ciphersuites come with
2361 * public keys. We should have a less ad-hoc way of doing this
2362 */
555cbb32 2363 if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS))
3c95ef22 2364 *pkey = tls_get_peer_pkey(s);
e01a610d
MC
2365 /* else anonymous DH, so no certificate or pkey. */
2366
1ee22dc2 2367 ret = 1;
e01a610d
MC
2368
2369 err:
1ee22dc2 2370 OSSL_PARAM_BLD_free(tmpl);
3f883c7c 2371 OSSL_PARAM_free(params);
1ee22dc2
MC
2372 EVP_PKEY_free(peer_tmp);
2373 EVP_PKEY_CTX_free(pctx);
e01a610d
MC
2374 BN_free(p);
2375 BN_free(g);
2376 BN_free(bnpub_key);
e01a610d 2377
1ee22dc2 2378 return ret;
e01a610d
MC
2379}
2380
38b051a1 2381static int tls_process_ske_ecdhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey)
ff74aeb1 2382{
ff74aeb1 2383 PACKET encoded_pt;
6447e818 2384 unsigned int curve_type, curve_id;
ff74aeb1
MC
2385
2386 /*
2387 * Extract elliptic curve parameters and the server's ephemeral ECDH
6447e818 2388 * public key. We only support named (not generic) curves and
ff74aeb1
MC
2389 * ECParameters in this case is just three bytes.
2390 */
6447e818 2391 if (!PACKET_get_1(pkt, &curve_type) || !PACKET_get_net_2(pkt, &curve_id)) {
c48ffbcc 2392 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT);
ff74aeb1
MC
2393 return 0;
2394 }
2395 /*
6447e818
DSH
2396 * Check curve is named curve type and one of our preferences, if not
2397 * server has sent an invalid curve.
ff74aeb1 2398 */
dcf8b01f
MC
2399 if (curve_type != NAMED_CURVE_TYPE
2400 || !tls1_check_group_id(s, curve_id, 1)) {
c48ffbcc 2401 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CURVE);
ff74aeb1
MC
2402 return 0;
2403 }
2404
ada66e78 2405 if ((s->s3.peer_tmp = ssl_generate_param_group(s, curve_id)) == NULL) {
c48ffbcc 2406 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
a2c2e000 2407 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
ff74aeb1
MC
2408 return 0;
2409 }
2410
ff74aeb1 2411 if (!PACKET_get_length_prefixed_1(pkt, &encoded_pt)) {
c48ffbcc 2412 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
ff74aeb1
MC
2413 return 0;
2414 }
2415
5ac8fb58
MC
2416 if (EVP_PKEY_set1_encoded_public_key(s->s3.peer_tmp,
2417 PACKET_data(&encoded_pt),
2418 PACKET_remaining(&encoded_pt)) <= 0) {
c48ffbcc 2419 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
ff74aeb1
MC
2420 return 0;
2421 }
2422
2423 /*
2424 * The ECC/TLS specification does not mention the use of DSA to sign
2425 * ECParameters in the server key exchange message. We do support RSA
2426 * and ECDSA.
2427 */
555cbb32 2428 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA)
3c95ef22 2429 *pkey = tls_get_peer_pkey(s);
555cbb32 2430 else if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aRSA)
3c95ef22 2431 *pkey = tls_get_peer_pkey(s);
ff74aeb1
MC
2432 /* else anonymous ECDH, so no certificate or pkey. */
2433
aa6bd216
BK
2434 /* Cache the agreed upon group in the SSL_SESSION */
2435 s->session->kex_group = curve_id;
ff74aeb1 2436 return 1;
ff74aeb1
MC
2437}
2438
38b051a1 2439MSG_PROCESS_RETURN tls_process_key_exchange(SSL_CONNECTION *s, PACKET *pkt)
b9908bf9 2440{
e1e588ac 2441 long alg_k;
b9908bf9 2442 EVP_PKEY *pkey = NULL;
fe3066ee
MC
2443 EVP_MD_CTX *md_ctx = NULL;
2444 EVP_PKEY_CTX *pctx = NULL;
73999b62 2445 PACKET save_param_start, signature;
38b051a1 2446 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
b9908bf9 2447
555cbb32 2448 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
b9908bf9 2449
73999b62 2450 save_param_start = *pkt;
8d92c1f8 2451
555cbb32
TS
2452 EVP_PKEY_free(s->s3.peer_tmp);
2453 s->s3.peer_tmp = NULL;
d02b48c6 2454
7689082b 2455 if (alg_k & SSL_PSK) {
a2c2e000
MC
2456 if (!tls_process_ske_psk_preamble(s, pkt)) {
2457 /* SSLfatal() already called */
7dc1c647 2458 goto err;
a2c2e000 2459 }
7689082b
DSH
2460 }
2461
2462 /* Nothing else to do for plain PSK or RSAPSK */
2463 if (alg_k & (SSL_kPSK | SSL_kRSAPSK)) {
25c6c10c 2464 } else if (alg_k & SSL_kSRP) {
a2c2e000
MC
2465 if (!tls_process_ske_srp(s, pkt, &pkey)) {
2466 /* SSLfatal() already called */
0f113f3e 2467 goto err;
a2c2e000 2468 }
e01a610d 2469 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
a2c2e000
MC
2470 if (!tls_process_ske_dhe(s, pkt, &pkey)) {
2471 /* SSLfatal() already called */
e01a610d 2472 goto err;
a2c2e000 2473 }
ff74aeb1 2474 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
a2c2e000
MC
2475 if (!tls_process_ske_ecdhe(s, pkt, &pkey)) {
2476 /* SSLfatal() already called */
ff74aeb1 2477 goto err;
a2c2e000 2478 }
0f113f3e 2479 } else if (alg_k) {
c48ffbcc 2480 SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
e1e588ac 2481 goto err;
0f113f3e 2482 }
0f113f3e 2483
0f113f3e
MC
2484 /* if it was signed, check the signature */
2485 if (pkey != NULL) {
32942870 2486 PACKET params;
be8dba2c 2487 const EVP_MD *md = NULL;
72ceb6a6
DSH
2488 unsigned char *tbs;
2489 size_t tbslen;
2490 int rv;
e1e588ac 2491
32942870
EK
2492 /*
2493 * |pkt| now points to the beginning of the signature, so the difference
2494 * equals the length of the parameters.
2495 */
2496 if (!PACKET_get_sub_packet(&save_param_start, &params,
2497 PACKET_remaining(&save_param_start) -
73999b62 2498 PACKET_remaining(pkt))) {
c48ffbcc 2499 SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR);
e1e588ac 2500 goto err;
32942870
EK
2501 }
2502
0f113f3e 2503 if (SSL_USE_SIGALGS(s)) {
703bcee0 2504 unsigned int sigalg;
703bcee0
MC
2505
2506 if (!PACKET_get_net_2(pkt, &sigalg)) {
c48ffbcc 2507 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT);
e1e588ac 2508 goto err;
0f113f3e 2509 }
f63a17d6
MC
2510 if (tls12_check_peer_sigalg(s, sigalg, pkey) <=0) {
2511 /* SSLfatal() already called */
0f113f3e 2512 goto err;
0f113f3e 2513 }
f365a3e2 2514 } else if (!tls1_set_peer_legacy_sigalg(s, pkey)) {
97b8db1a
TM
2515 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2516 SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED);
f365a3e2 2517 goto err;
32942870 2518 }
0f113f3e 2519
38b051a1 2520 if (!tls1_lookup_md(sctx, s->s3.tmp.peer_sigalg, &md)) {
c48ffbcc 2521 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
7cd1420b 2522 SSL_R_NO_SUITABLE_DIGEST_ALGORITHM);
b2021556
DSH
2523 goto err;
2524 }
44f23cd2 2525 if (SSL_USE_SIGALGS(s))
49b26f54 2526 OSSL_TRACE1(TLS, "USING TLSv1.2 HASH %s\n",
ed576acd 2527 md == NULL ? "n/a" : EVP_MD_get0_name(md));
f365a3e2 2528
73999b62
MC
2529 if (!PACKET_get_length_prefixed_2(pkt, &signature)
2530 || PACKET_remaining(pkt) != 0) {
c48ffbcc 2531 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
e1e588ac 2532 goto err;
0f113f3e 2533 }
e1e588ac
MC
2534
2535 md_ctx = EVP_MD_CTX_new();
2536 if (md_ctx == NULL) {
e077455e 2537 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
e1e588ac 2538 goto err;
0f113f3e 2539 }
e1e588ac 2540
d8652be0 2541 if (EVP_DigestVerifyInit_ex(md_ctx, &pctx,
ed576acd 2542 md == NULL ? NULL : EVP_MD_get0_name(md),
38b051a1 2543 sctx->libctx, sctx->propq, pkey,
d38b6ae9 2544 NULL) <= 0) {
c48ffbcc 2545 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
fe3066ee
MC
2546 goto err;
2547 }
5554facb 2548 if (SSL_USE_PSS(s)) {
fe3066ee 2549 if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
91410d40 2550 || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx,
968ae5b3 2551 RSA_PSS_SALTLEN_DIGEST) <= 0) {
c48ffbcc 2552 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
fe3066ee
MC
2553 goto err;
2554 }
2555 }
72ceb6a6
DSH
2556 tbslen = construct_key_exchange_tbs(s, &tbs, PACKET_data(&params),
2557 PACKET_remaining(&params));
2558 if (tbslen == 0) {
f63a17d6 2559 /* SSLfatal() already called */
e1e588ac 2560 goto err;
192e4bbb 2561 }
72ceb6a6
DSH
2562
2563 rv = EVP_DigestVerify(md_ctx, PACKET_data(&signature),
2564 PACKET_remaining(&signature), tbs, tbslen);
2565 OPENSSL_free(tbs);
cfba0675 2566 if (rv <= 0) {
c48ffbcc 2567 SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_R_BAD_SIGNATURE);
e1e588ac 2568 goto err;
0f113f3e 2569 }
e1e588ac 2570 EVP_MD_CTX_free(md_ctx);
fe3066ee 2571 md_ctx = NULL;
0f113f3e 2572 } else {
7689082b 2573 /* aNULL, aSRP or PSK do not need public keys */
555cbb32 2574 if (!(s->s3.tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
a230b26e 2575 && !(alg_k & SSL_PSK)) {
0f113f3e 2576 /* Might be wrong key type, check it */
e1e588ac 2577 if (ssl3_check_cert_and_algorithm(s)) {
c48ffbcc 2578 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_DATA);
e1e588ac 2579 }
a2c2e000 2580 /* else this shouldn't happen, SSLfatal() already called */
0f113f3e
MC
2581 goto err;
2582 }
2583 /* still data left over */
73999b62 2584 if (PACKET_remaining(pkt) != 0) {
c48ffbcc 2585 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_EXTRA_DATA_IN_MESSAGE);
e1e588ac 2586 goto err;
0f113f3e
MC
2587 }
2588 }
e1e588ac 2589
b9908bf9 2590 return MSG_PROCESS_CONTINUE_READING;
0f113f3e 2591 err:
fe3066ee 2592 EVP_MD_CTX_free(md_ctx);
b9908bf9 2593 return MSG_PROCESS_ERROR;
0f113f3e 2594}
d02b48c6 2595
38b051a1
TM
2596MSG_PROCESS_RETURN tls_process_certificate_request(SSL_CONNECTION *s,
2597 PACKET *pkt)
b9908bf9 2598{
32f66107 2599 /* Clear certificate validity flags */
ee58915c
MB
2600 if (s->s3.tmp.valid_flags != NULL)
2601 memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t));
2602 else
2603 s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t));
2604
2605 /* Give up for good if allocation didn't work */
2606 if (s->s3.tmp.valid_flags == NULL)
2607 return 0;
0f113f3e 2608
38b051a1 2609 if (SSL_CONNECTION_IS_TLS13(s)) {
32f66107
DSH
2610 PACKET reqctx, extensions;
2611 RAW_EXTENSION *rawexts = NULL;
03f44b97 2612
1bf4cb0f
MC
2613 if ((s->shutdown & SSL_SENT_SHUTDOWN) != 0) {
2614 /*
2615 * We already sent close_notify. This can only happen in TLSv1.3
2616 * post-handshake messages. We can't reasonably respond to this, so
2617 * we just ignore it
2618 */
2619 return MSG_PROCESS_FINISHED_READING;
2620 }
2621
03f44b97 2622 /* Free and zero certificate types: it is not present in TLS 1.3 */
555cbb32
TS
2623 OPENSSL_free(s->s3.tmp.ctype);
2624 s->s3.tmp.ctype = NULL;
2625 s->s3.tmp.ctype_len = 0;
9d75dce3
TS
2626 OPENSSL_free(s->pha_context);
2627 s->pha_context = NULL;
39a14059 2628 s->pha_context_len = 0;
32f66107 2629
9d75dce3
TS
2630 if (!PACKET_get_length_prefixed_1(pkt, &reqctx) ||
2631 !PACKET_memdup(&reqctx, &s->pha_context, &s->pha_context_len)) {
c48ffbcc 2632 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2633 return MSG_PROCESS_ERROR;
03f44b97 2634 }
32f66107
DSH
2635
2636 if (!PACKET_get_length_prefixed_2(pkt, &extensions)) {
c48ffbcc 2637 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
f63a17d6 2638 return MSG_PROCESS_ERROR;
32f66107
DSH
2639 }
2640 if (!tls_collect_extensions(s, &extensions,
fe874d27 2641 SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
f63a17d6 2642 &rawexts, NULL, 1)
fe874d27 2643 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
f63a17d6
MC
2644 rawexts, NULL, 0, 1)) {
2645 /* SSLfatal() already called */
32f66107 2646 OPENSSL_free(rawexts);
f63a17d6 2647 return MSG_PROCESS_ERROR;
32f66107
DSH
2648 }
2649 OPENSSL_free(rawexts);
2650 if (!tls1_process_sigalgs(s)) {
c48ffbcc 2651 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_LENGTH);
f63a17d6 2652 return MSG_PROCESS_ERROR;
32f66107 2653 }
03f44b97
DSH
2654 } else {
2655 PACKET ctypes;
75c13e78 2656
03f44b97
DSH
2657 /* get the certificate types */
2658 if (!PACKET_get_length_prefixed_1(pkt, &ctypes)) {
c48ffbcc 2659 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2660 return MSG_PROCESS_ERROR;
03f44b97
DSH
2661 }
2662
555cbb32 2663 if (!PACKET_memdup(&ctypes, &s->s3.tmp.ctype, &s->s3.tmp.ctype_len)) {
c48ffbcc 2664 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f63a17d6 2665 return MSG_PROCESS_ERROR;
03f44b97 2666 }
ac112332 2667
32f66107
DSH
2668 if (SSL_USE_SIGALGS(s)) {
2669 PACKET sigalgs;
703bcee0 2670
32f66107 2671 if (!PACKET_get_length_prefixed_2(pkt, &sigalgs)) {
c48ffbcc 2672 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2673 return MSG_PROCESS_ERROR;
32f66107 2674 }
ac112332 2675
c589c34e
BK
2676 /*
2677 * Despite this being for certificates, preserve compatibility
2678 * with pre-TLS 1.3 and use the regular sigalgs field.
2679 */
2680 if (!tls1_save_sigalgs(s, &sigalgs, 0)) {
f63a17d6 2681 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
f63a17d6
MC
2682 SSL_R_SIGNATURE_ALGORITHMS_ERROR);
2683 return MSG_PROCESS_ERROR;
32f66107
DSH
2684 }
2685 if (!tls1_process_sigalgs(s)) {
e077455e 2686 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
f63a17d6 2687 return MSG_PROCESS_ERROR;
32f66107 2688 }
0f113f3e 2689 }
0f113f3e 2690
32f66107 2691 /* get the CA RDNs */
f63a17d6
MC
2692 if (!parse_ca_names(s, pkt)) {
2693 /* SSLfatal() already called */
2694 return MSG_PROCESS_ERROR;
2695 }
03f44b97
DSH
2696 }
2697
2698 if (PACKET_remaining(pkt) != 0) {
c48ffbcc 2699 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2700 return MSG_PROCESS_ERROR;
03f44b97 2701 }
0f113f3e 2702
0f113f3e 2703 /* we should setup a certificate to return.... */
555cbb32 2704 s->s3.tmp.cert_req = 1;
0f113f3e 2705
e4562014
MC
2706 /*
2707 * In TLSv1.3 we don't prepare the client certificate yet. We wait until
2708 * after the CertificateVerify message has been received. This is because
2709 * in TLSv1.3 the CertificateRequest arrives before the Certificate message
2710 * but in TLSv1.2 it is the other way around. We want to make sure that
8c2bfd25 2711 * SSL_get1_peer_certificate() returns something sensible in
e4562014
MC
2712 * client_cert_cb.
2713 */
38b051a1
TM
2714 if (SSL_CONNECTION_IS_TLS13(s)
2715 && s->post_handshake_auth != SSL_PHA_REQUESTED)
e4562014
MC
2716 return MSG_PROCESS_CONTINUE_READING;
2717
f63a17d6 2718 return MSG_PROCESS_CONTINUE_PROCESSING;
0f113f3e
MC
2719}
2720
38b051a1
TM
2721MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s,
2722 PACKET *pkt)
b9908bf9 2723{
b9908bf9 2724 unsigned int ticklen;
9ac6244b 2725 unsigned long ticket_lifetime_hint, age_add = 0;
ec60ccc1 2726 unsigned int sess_len;
de1df7e9 2727 RAW_EXTENSION *exts = NULL;
9b6a8254 2728 PACKET nonce;
abd86cec 2729 EVP_MD *sha256 = NULL;
38b051a1 2730 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
b9908bf9 2731
6cf2dbd9
MC
2732 PACKET_null_init(&nonce);
2733
73999b62 2734 if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint)
38b051a1 2735 || (SSL_CONNECTION_IS_TLS13(s)
9b6a8254 2736 && (!PACKET_get_net_4(pkt, &age_add)
6cf2dbd9 2737 || !PACKET_get_length_prefixed_1(pkt, &nonce)))
a230b26e 2738 || !PACKET_get_net_2(pkt, &ticklen)
1cf2f823 2739 || (SSL_CONNECTION_IS_TLS13(s) ? (ticklen == 0
38b051a1
TM
2740 || PACKET_remaining(pkt) < ticklen)
2741 : PACKET_remaining(pkt) != ticklen)) {
c48ffbcc 2742 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2743 goto err;
e711da71
EK
2744 }
2745
de1df7e9
MC
2746 /*
2747 * Server is allowed to change its mind (in <=TLSv1.2) and send an empty
2748 * ticket. We already checked this TLSv1.3 case above, so it should never
2749 * be 0 here in that instance
2750 */
e711da71 2751 if (ticklen == 0)
c9de4a20 2752 return MSG_PROCESS_CONTINUE_READING;
e711da71 2753
150840b9
MC
2754 /*
2755 * Sessions must be immutable once they go into the session cache. Otherwise
2756 * we can get multi-thread problems. Therefore we don't "update" sessions,
2757 * we replace them with a duplicate. In TLSv1.3 we need to do this every
2758 * time a NewSessionTicket arrives because those messages arrive
2759 * post-handshake and the session may have already gone into the session
2760 * cache.
2761 */
38b051a1 2762 if (SSL_CONNECTION_IS_TLS13(s) || s->session->session_id_length > 0) {
98ece4ee 2763 SSL_SESSION *new_sess;
1f156321 2764
98ece4ee
MC
2765 /*
2766 * We reused an existing session, so we need to replace it with a new
2767 * one
2768 */
5d61491c 2769 if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
e077455e 2770 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
f63a17d6 2771 goto err;
5d61491c
MC
2772 }
2773
1f156321 2774 if ((s->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) != 0
38b051a1 2775 && !SSL_CONNECTION_IS_TLS13(s)) {
1f156321
MC
2776 /*
2777 * In TLSv1.2 and below the arrival of a new tickets signals that
2778 * any old ticket we were using is now out of date, so we remove the
2779 * old session from the cache. We carry on if this fails
2780 */
2781 SSL_CTX_remove_session(s->session_ctx, s->session);
2782 }
2783
98ece4ee
MC
2784 SSL_SESSION_free(s->session);
2785 s->session = new_sess;
2786 }
2787
f0131dc0 2788 s->session->time = ossl_time_now();
25959e04 2789 ssl_session_calculate_timeout(s->session);
fc24f0bf 2790
aff8c126
RS
2791 OPENSSL_free(s->session->ext.tick);
2792 s->session->ext.tick = NULL;
2793 s->session->ext.ticklen = 0;
e711da71 2794
aff8c126
RS
2795 s->session->ext.tick = OPENSSL_malloc(ticklen);
2796 if (s->session->ext.tick == NULL) {
e077455e 2797 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
0f113f3e
MC
2798 goto err;
2799 }
aff8c126 2800 if (!PACKET_copy_bytes(pkt, s->session->ext.tick, ticklen)) {
c48ffbcc 2801 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 2802 goto err;
561e12bb 2803 }
e711da71 2804
aff8c126 2805 s->session->ext.tick_lifetime_hint = ticket_lifetime_hint;
fc24f0bf 2806 s->session->ext.tick_age_add = age_add;
aff8c126 2807 s->session->ext.ticklen = ticklen;
de1df7e9 2808
38b051a1 2809 if (SSL_CONNECTION_IS_TLS13(s)) {
de1df7e9
MC
2810 PACKET extpkt;
2811
2812 if (!PACKET_as_length_prefixed_2(pkt, &extpkt)
1cde0259 2813 || PACKET_remaining(pkt) != 0) {
c48ffbcc 2814 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
1cde0259
MC
2815 goto err;
2816 }
2817
2818 if (!tls_collect_extensions(s, &extpkt,
2819 SSL_EXT_TLS1_3_NEW_SESSION_TICKET, &exts,
2820 NULL, 1)
fe874d27
MC
2821 || !tls_parse_all_extensions(s,
2822 SSL_EXT_TLS1_3_NEW_SESSION_TICKET,
f63a17d6
MC
2823 exts, NULL, 0, 1)) {
2824 /* SSLfatal() already called */
2825 goto err;
de1df7e9
MC
2826 }
2827 }
2828
0f113f3e
MC
2829 /*
2830 * There are two ways to detect a resumed ticket session. One is to set
2831 * an appropriate session ID and then the server must return a match in
2832 * ServerHello. This allows the normal client session ID matching to work
2833 * and we know much earlier that the ticket has been accepted. The
2834 * other way is to set zero length session ID when the ticket is
2835 * presented and rely on the handshake to determine session resumption.
2836 * We choose the former approach because this fits in with assumptions
abd86cec
MC
2837 * elsewhere in OpenSSL. The session ID is set to the SHA256 hash of the
2838 * ticket.
0f113f3e 2839 */
38b051a1 2840 sha256 = EVP_MD_fetch(sctx->libctx, "SHA2-256", sctx->propq);
abd86cec 2841 if (sha256 == NULL) {
5a2d0ef3
RL
2842 /* Error is already recorded */
2843 SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR);
abd86cec
MC
2844 goto err;
2845 }
ec60ccc1 2846 /*
407820c0 2847 * We use sess_len here because EVP_Digest expects an int
ec60ccc1
MC
2848 * but s->session->session_id_length is a size_t
2849 */
aff8c126 2850 if (!EVP_Digest(s->session->ext.tick, ticklen,
ec60ccc1 2851 s->session->session_id, &sess_len,
abd86cec 2852 sha256, NULL)) {
c48ffbcc 2853 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
d166ed8c
DSH
2854 goto err;
2855 }
abd86cec
MC
2856 EVP_MD_free(sha256);
2857 sha256 = NULL;
ec60ccc1 2858 s->session->session_id_length = sess_len;
4cb00457 2859 s->session->not_resumable = 0;
de1df7e9
MC
2860
2861 /* This is a standalone message in TLSv1.3, so there is no more to read */
38b051a1 2862 if (SSL_CONNECTION_IS_TLS13(s)) {
4ff1a526 2863 const EVP_MD *md = ssl_handshake_md(s);
ed576acd 2864 int hashleni = EVP_MD_get_size(md);
4ff1a526
MC
2865 size_t hashlen;
2866 static const unsigned char nonce_label[] = "resumption";
2867
2868 /* Ensure cast to size_t is safe */
14c45338 2869 if (!ossl_assert(hashleni > 0)) {
c48ffbcc 2870 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4ff1a526
MC
2871 goto err;
2872 }
2873 hashlen = (size_t)hashleni;
2874
2875 if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
2876 nonce_label,
2877 sizeof(nonce_label) - 1,
6cf2dbd9
MC
2878 PACKET_data(&nonce),
2879 PACKET_remaining(&nonce),
4ff1a526 2880 s->session->master_key,
0fb2815b 2881 hashlen, 1)) {
4ff1a526
MC
2882 /* SSLfatal() already called */
2883 goto err;
2884 }
2885 s->session->master_key_length = hashlen;
2886
33d93417 2887 OPENSSL_free(exts);
de1df7e9
MC
2888 ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
2889 return MSG_PROCESS_FINISHED_READING;
2890 }
2891
b9908bf9 2892 return MSG_PROCESS_CONTINUE_READING;
0f113f3e 2893 err:
abd86cec 2894 EVP_MD_free(sha256);
33d93417 2895 OPENSSL_free(exts);
b9908bf9 2896 return MSG_PROCESS_ERROR;
0f113f3e 2897}
67c8e7f4 2898
f63e4288
MC
2899/*
2900 * In TLSv1.3 this is called from the extensions code, otherwise it is used to
f63a17d6 2901 * parse a separate message. Returns 1 on success or 0 on failure
f63e4288 2902 */
38b051a1 2903int tls_process_cert_status_body(SSL_CONNECTION *s, PACKET *pkt)
b9908bf9 2904{
8b0e934a 2905 size_t resplen;
b9908bf9 2906 unsigned int type;
b9908bf9 2907
73999b62 2908 if (!PACKET_get_1(pkt, &type)
a230b26e 2909 || type != TLSEXT_STATUSTYPE_ocsp) {
c48ffbcc 2910 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_UNSUPPORTED_STATUS_TYPE);
f63e4288 2911 return 0;
0f113f3e 2912 }
56a26ce3
MC
2913 if (!PACKET_get_net_3_len(pkt, &resplen)
2914 || PACKET_remaining(pkt) != resplen) {
c48ffbcc 2915 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63e4288 2916 return 0;
0f113f3e 2917 }
8cbfcc70
RS
2918 s->ext.ocsp.resp = OPENSSL_malloc(resplen);
2919 if (s->ext.ocsp.resp == NULL) {
39a14059 2920 s->ext.ocsp.resp_len = 0;
e077455e 2921 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
f63e4288 2922 return 0;
0f113f3e 2923 }
39a14059 2924 s->ext.ocsp.resp_len = resplen;
8cbfcc70 2925 if (!PACKET_copy_bytes(pkt, s->ext.ocsp.resp, resplen)) {
c48ffbcc 2926 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63e4288 2927 return 0;
ac63710a 2928 }
f63e4288
MC
2929
2930 return 1;
2931}
2faa1b48 2932
f63e4288 2933
38b051a1 2934MSG_PROCESS_RETURN tls_process_cert_status(SSL_CONNECTION *s, PACKET *pkt)
f63e4288 2935{
f63a17d6
MC
2936 if (!tls_process_cert_status_body(s, pkt)) {
2937 /* SSLfatal() already called */
f63e4288
MC
2938 return MSG_PROCESS_ERROR;
2939 }
2940
b9908bf9 2941 return MSG_PROCESS_CONTINUE_READING;
0f113f3e 2942}
d02b48c6 2943
7776a36c
MC
2944/*
2945 * Perform miscellaneous checks and processing after we have received the
2946 * server's initial flight. In TLS1.3 this is after the Server Finished message.
6530c490
MC
2947 * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0
2948 * on failure.
7776a36c 2949 */
38b051a1 2950int tls_process_initial_server_flight(SSL_CONNECTION *s)
b9908bf9 2951{
38b051a1
TM
2952 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
2953
a455d0f6
MC
2954 /*
2955 * at this point we check that we have the required stuff from
2956 * the server
2957 */
2958 if (!ssl3_check_cert_and_algorithm(s)) {
f63a17d6 2959 /* SSLfatal() already called */
7776a36c 2960 return 0;
a455d0f6
MC
2961 }
2962
bb1aaab4 2963 /*
aff8c126
RS
2964 * Call the ocsp status callback if needed. The |ext.ocsp.resp| and
2965 * |ext.ocsp.resp_len| values will be set if we actually received a status
bb1aaab4
MC
2966 * message, or NULL and -1 otherwise
2967 */
aff8c126 2968 if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing
38b051a1 2969 && sctx->ext.status_cb != NULL) {
dc84829c 2970 int ret = sctx->ext.status_cb(SSL_CONNECTION_GET_USER_SSL(s),
38b051a1 2971 sctx->ext.status_arg);
aff8c126 2972
bb1aaab4 2973 if (ret == 0) {
f63a17d6 2974 SSLfatal(s, SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE,
f63a17d6 2975 SSL_R_INVALID_STATUS_RESPONSE);
7776a36c 2976 return 0;
bb1aaab4
MC
2977 }
2978 if (ret < 0) {
c0f4400c
DB
2979 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2980 SSL_R_OCSP_CALLBACK_FAILURE);
7776a36c 2981 return 0;
bb1aaab4
MC
2982 }
2983 }
ed29e82a
RP
2984#ifndef OPENSSL_NO_CT
2985 if (s->ct_validation_callback != NULL) {
43341433
VD
2986 /* Note we validate the SCTs whether or not we abort on error */
2987 if (!ssl_validate_ct(s) && (s->verify_mode & SSL_VERIFY_PEER)) {
f63a17d6 2988 /* SSLfatal() already called */
7776a36c 2989 return 0;
ed29e82a
RP
2990 }
2991 }
2992#endif
2993
7776a36c
MC
2994 return 1;
2995}
2996
38b051a1 2997MSG_PROCESS_RETURN tls_process_server_done(SSL_CONNECTION *s, PACKET *pkt)
7776a36c 2998{
7776a36c
MC
2999 if (PACKET_remaining(pkt) > 0) {
3000 /* should contain no data */
c48ffbcc 3001 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
f63a17d6 3002 return MSG_PROCESS_ERROR;
7776a36c
MC
3003 }
3004#ifndef OPENSSL_NO_SRP
555cbb32 3005 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
76cb077f 3006 if (ssl_srp_calc_a_param_intern(s) <= 0) {
c48ffbcc 3007 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_SRP_A_CALC);
f63a17d6 3008 return MSG_PROCESS_ERROR;
7776a36c
MC
3009 }
3010 }
3011#endif
3012
f63a17d6
MC
3013 if (!tls_process_initial_server_flight(s)) {
3014 /* SSLfatal() already called */
3015 return MSG_PROCESS_ERROR;
3016 }
7776a36c 3017
bd79bcb4 3018 return MSG_PROCESS_FINISHED_READING;
0f113f3e 3019}
176f31dd 3020
38b051a1 3021static int tls_construct_cke_psk_preamble(SSL_CONNECTION *s, WPACKET *pkt)
0f113f3e 3022{
7689082b 3023#ifndef OPENSSL_NO_PSK
13c0ec4a
MC
3024 int ret = 0;
3025 /*
3026 * The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes to return a
3027 * \0-terminated identity. The last byte is for us for simulating
3028 * strnlen.
3029 */
3030 char identity[PSK_MAX_IDENTITY_LEN + 1];
3031 size_t identitylen = 0;
3032 unsigned char psk[PSK_MAX_PSK_LEN];
3033 unsigned char *tmppsk = NULL;
3034 char *tmpidentity = NULL;
3035 size_t psklen = 0;
3036
3037 if (s->psk_client_callback == NULL) {
c48ffbcc 3038 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PSK_NO_CLIENT_CB);
13c0ec4a
MC
3039 goto err;
3040 }
d02b48c6 3041
13c0ec4a 3042 memset(identity, 0, sizeof(identity));
d02b48c6 3043
dc84829c 3044 psklen = s->psk_client_callback(SSL_CONNECTION_GET_USER_SSL(s),
38b051a1 3045 s->session->psk_identity_hint,
13c0ec4a
MC
3046 identity, sizeof(identity) - 1,
3047 psk, sizeof(psk));
7689082b 3048
13c0ec4a 3049 if (psklen > PSK_MAX_PSK_LEN) {
c48ffbcc 3050 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, ERR_R_INTERNAL_ERROR);
3de7f014 3051 psklen = PSK_MAX_PSK_LEN; /* Avoid overrunning the array on cleanse */
13c0ec4a
MC
3052 goto err;
3053 } else if (psklen == 0) {
c48ffbcc 3054 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_PSK_IDENTITY_NOT_FOUND);
13c0ec4a
MC
3055 goto err;
3056 }
7689082b 3057
13c0ec4a
MC
3058 identitylen = strlen(identity);
3059 if (identitylen > PSK_MAX_IDENTITY_LEN) {
c48ffbcc 3060 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
13c0ec4a
MC
3061 goto err;
3062 }
7689082b 3063
13c0ec4a
MC
3064 tmppsk = OPENSSL_memdup(psk, psklen);
3065 tmpidentity = OPENSSL_strdup(identity);
3066 if (tmppsk == NULL || tmpidentity == NULL) {
e077455e 3067 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
13c0ec4a
MC
3068 goto err;
3069 }
7689082b 3070
555cbb32
TS
3071 OPENSSL_free(s->s3.tmp.psk);
3072 s->s3.tmp.psk = tmppsk;
3073 s->s3.tmp.psklen = psklen;
13c0ec4a
MC
3074 tmppsk = NULL;
3075 OPENSSL_free(s->session->psk_identity);
3076 s->session->psk_identity = tmpidentity;
3077 tmpidentity = NULL;
f1ec23c0 3078
b2b3024e 3079 if (!WPACKET_sub_memcpy_u16(pkt, identity, identitylen)) {
c48ffbcc 3080 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0
MC
3081 goto err;
3082 }
7689082b 3083
13c0ec4a 3084 ret = 1;
0bce0b02 3085
13c0ec4a
MC
3086 err:
3087 OPENSSL_cleanse(psk, psklen);
3088 OPENSSL_cleanse(identity, sizeof(identity));
3089 OPENSSL_clear_free(tmppsk, psklen);
3090 OPENSSL_clear_free(tmpidentity, identitylen);
d02b48c6 3091
13c0ec4a
MC
3092 return ret;
3093#else
c48ffbcc 3094 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
13c0ec4a 3095 return 0;
b9908bf9 3096#endif
13c0ec4a 3097}
b9908bf9 3098
38b051a1 3099static int tls_construct_cke_rsa(SSL_CONNECTION *s, WPACKET *pkt)
13c0ec4a 3100{
f1ec23c0 3101 unsigned char *encdata = NULL;
13c0ec4a
MC
3102 EVP_PKEY *pkey = NULL;
3103 EVP_PKEY_CTX *pctx = NULL;
3104 size_t enclen;
3105 unsigned char *pms = NULL;
3106 size_t pmslen = 0;
38b051a1 3107 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
b9908bf9 3108
3c95ef22 3109 if (!received_server_cert(s)) {
13c0ec4a
MC
3110 /*
3111 * We should always have a server certificate with SSL_kRSA.
3112 */
c48ffbcc 3113 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
13c0ec4a
MC
3114 return 0;
3115 }
0f113f3e 3116
3c95ef22
TS
3117 if ((pkey = tls_get_peer_pkey(s)) == NULL) {
3118 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3119 return 0;
3120 }
3121
d7e498ac 3122 if (!EVP_PKEY_is_a(pkey, "RSA")) {
c48ffbcc 3123 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
13c0ec4a
MC
3124 return 0;
3125 }
0f113f3e 3126
13c0ec4a
MC
3127 pmslen = SSL_MAX_MASTER_KEY_LENGTH;
3128 pms = OPENSSL_malloc(pmslen);
3129 if (pms == NULL) {
e077455e 3130 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
13c0ec4a
MC
3131 return 0;
3132 }
0bce0b02 3133
13c0ec4a
MC
3134 pms[0] = s->client_version >> 8;
3135 pms[1] = s->client_version & 0xff;
38b051a1 3136 if (RAND_bytes_ex(sctx->libctx, pms + 2, pmslen - 2, 0) <= 0) {
e077455e 3137 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_RAND_LIB);
13c0ec4a
MC
3138 goto err;
3139 }
0f113f3e 3140
13c0ec4a 3141 /* Fix buf for TLS and beyond */
f1ec23c0 3142 if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 3143 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0
MC
3144 goto err;
3145 }
3aceb9ec 3146
38b051a1 3147 pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, pkey, sctx->propq);
13c0ec4a
MC
3148 if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
3149 || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
c48ffbcc 3150 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
13c0ec4a
MC
3151 goto err;
3152 }
f1ec23c0
MC
3153 if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)
3154 || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {
c48ffbcc 3155 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_RSA_ENCRYPT);
13c0ec4a
MC
3156 goto err;
3157 }
13c0ec4a
MC
3158 EVP_PKEY_CTX_free(pctx);
3159 pctx = NULL;
0f113f3e 3160
13c0ec4a 3161 /* Fix buf for TLS and beyond */
f1ec23c0 3162 if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {
c48ffbcc 3163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0 3164 goto err;
b9908bf9 3165 }
13c0ec4a 3166
2faa1b48 3167 /* Log the premaster secret, if logging is enabled. */
a2c2e000
MC
3168 if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) {
3169 /* SSLfatal() already called */
2faa1b48 3170 goto err;
a2c2e000 3171 }
2faa1b48 3172
555cbb32
TS
3173 s->s3.tmp.pms = pms;
3174 s->s3.tmp.pmslen = pmslen;
26fb4b03 3175
13c0ec4a
MC
3176 return 1;
3177 err:
3178 OPENSSL_clear_free(pms, pmslen);
3179 EVP_PKEY_CTX_free(pctx);
3180
3181 return 0;
13c0ec4a
MC
3182}
3183
38b051a1 3184static int tls_construct_cke_dhe(SSL_CONNECTION *s, WPACKET *pkt)
a8c1c704 3185{
a8c1c704 3186 EVP_PKEY *ckey = NULL, *skey = NULL;
f1ec23c0 3187 unsigned char *keybytes = NULL;
807b0a1d 3188 int prime_len;
cb5a427a
MC
3189 unsigned char *encoded_pub = NULL;
3190 size_t encoded_pub_len, pad_len;
3191 int ret = 0;
a8c1c704 3192
555cbb32 3193 skey = s->s3.peer_tmp;
a2c2e000 3194 if (skey == NULL) {
c48ffbcc 3195 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0 3196 goto err;
a2c2e000 3197 }
f1ec23c0 3198
0f00ed77 3199 ckey = ssl_generate_pkey(s, skey);
a2c2e000 3200 if (ckey == NULL) {
c48ffbcc 3201 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b599ce3b 3202 goto err;
a2c2e000 3203 }
b599ce3b 3204
a2c2e000
MC
3205 if (ssl_derive(s, ckey, skey, 0) == 0) {
3206 /* SSLfatal() already called */
f1ec23c0 3207 goto err;
a2c2e000 3208 }
a8c1c704
MC
3209
3210 /* send off the data */
cb5a427a
MC
3211
3212 /* Generate encoding of server key */
3213 encoded_pub_len = EVP_PKEY_get1_encoded_public_key(ckey, &encoded_pub);
3214 if (encoded_pub_len == 0) {
3215 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
10481d33 3216 EVP_PKEY_free(ckey);
cb5a427a
MC
3217 return EXT_RETURN_FAIL;
3218 }
3219
807b0a1d
FM
3220 /*
3221 * For interoperability with some versions of the Microsoft TLS
3222 * stack, we need to zero pad the DHE pub key to the same length
cb5a427a 3223 * as the prime.
807b0a1d 3224 */
ed576acd 3225 prime_len = EVP_PKEY_get_size(ckey);
cb5a427a
MC
3226 pad_len = prime_len - encoded_pub_len;
3227 if (pad_len > 0) {
3228 if (!WPACKET_sub_allocate_bytes_u16(pkt, pad_len, &keybytes)) {
3229 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3230 goto err;
3231 }
3232 memset(keybytes, 0, pad_len);
3233 }
3234
3235 if (!WPACKET_sub_memcpy_u16(pkt, encoded_pub, encoded_pub_len)) {
c48ffbcc 3236 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0 3237 goto err;
a2c2e000 3238 }
f1ec23c0 3239
cb5a427a 3240 ret = 1;
f1ec23c0 3241 err:
cb5a427a 3242 OPENSSL_free(encoded_pub);
f1ec23c0 3243 EVP_PKEY_free(ckey);
cb5a427a 3244 return ret;
a8c1c704
MC
3245}
3246
38b051a1 3247static int tls_construct_cke_ecdhe(SSL_CONNECTION *s, WPACKET *pkt)
67ad5aab 3248{
67ad5aab 3249 unsigned char *encodedPoint = NULL;
348240c6 3250 size_t encoded_pt_len = 0;
67ad5aab 3251 EVP_PKEY *ckey = NULL, *skey = NULL;
f1ec23c0 3252 int ret = 0;
67ad5aab 3253
555cbb32 3254 skey = s->s3.peer_tmp;
ec24630a 3255 if (skey == NULL) {
c48ffbcc 3256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ad5aab
MC
3257 return 0;
3258 }
3259
0f00ed77 3260 ckey = ssl_generate_pkey(s, skey);
b599ce3b 3261 if (ckey == NULL) {
e077455e 3262 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
b599ce3b
MC
3263 goto err;
3264 }
67ad5aab 3265
0f1e51ea 3266 if (ssl_derive(s, ckey, skey, 0) == 0) {
a2c2e000 3267 /* SSLfatal() already called */
67ad5aab
MC
3268 goto err;
3269 }
3270
3271 /* Generate encoding of client key */
5ac8fb58 3272 encoded_pt_len = EVP_PKEY_get1_encoded_public_key(ckey, &encodedPoint);
67ad5aab
MC
3273
3274 if (encoded_pt_len == 0) {
c48ffbcc 3275 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
67ad5aab
MC
3276 goto err;
3277 }
3278
b2b3024e 3279 if (!WPACKET_sub_memcpy_u8(pkt, encodedPoint, encoded_pt_len)) {
c48ffbcc 3280 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0
MC
3281 goto err;
3282 }
67ad5aab 3283
f1ec23c0 3284 ret = 1;
67ad5aab 3285 err:
f1ec23c0 3286 OPENSSL_free(encodedPoint);
67ad5aab 3287 EVP_PKEY_free(ckey);
f1ec23c0 3288 return ret;
67ad5aab
MC
3289}
3290
38b051a1 3291static int tls_construct_cke_gost(SSL_CONNECTION *s, WPACKET *pkt)
e00e0b3d
MC
3292{
3293#ifndef OPENSSL_NO_GOST
3294 /* GOST key exchange message creation */
3295 EVP_PKEY_CTX *pkey_ctx = NULL;
3c95ef22 3296 EVP_PKEY *pkey = NULL;
e00e0b3d
MC
3297 size_t msglen;
3298 unsigned int md_len;
3299 unsigned char shared_ukm[32], tmp[256];
3300 EVP_MD_CTX *ukm_hash = NULL;
3301 int dgst_nid = NID_id_GostR3411_94;
3302 unsigned char *pms = NULL;
3303 size_t pmslen = 0;
38b051a1 3304 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
e00e0b3d 3305
555cbb32 3306 if ((s->s3.tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0)
e00e0b3d
MC
3307 dgst_nid = NID_id_GostR3411_2012_256;
3308
3309 /*
1ee4b98e 3310 * Get server certificate PKEY and create ctx from it
e00e0b3d 3311 */
3c95ef22 3312 if ((pkey = tls_get_peer_pkey(s)) == NULL) {
c48ffbcc
RL
3313 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3314 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
e00e0b3d
MC
3315 return 0;
3316 }
3317
38b051a1 3318 pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx,
3c95ef22 3319 pkey,
38b051a1 3320 sctx->propq);
e00e0b3d 3321 if (pkey_ctx == NULL) {
e077455e 3322 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
e00e0b3d
MC
3323 return 0;
3324 }
3325 /*
3326 * If we have send a certificate, and certificate key
3327 * parameters match those of server certificate, use
3328 * certificate key for key exchange
3329 */
3330
3331 /* Otherwise, generate ephemeral key pair */
3332 pmslen = 32;
3333 pms = OPENSSL_malloc(pmslen);
3334 if (pms == NULL) {
e077455e 3335 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
2f3930bc 3336 goto err;
e00e0b3d
MC
3337 }
3338
3339 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0
348240c6 3340 /* Generate session key
348240c6 3341 */
38b051a1 3342 || RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) {
c48ffbcc 3343 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
e00e0b3d
MC
3344 goto err;
3345 };
e00e0b3d
MC
3346 /*
3347 * Compute shared IV and store it in algorithm-specific context
3348 * data
3349 */
3350 ukm_hash = EVP_MD_CTX_new();
3351 if (ukm_hash == NULL
a230b26e 3352 || EVP_DigestInit(ukm_hash, EVP_get_digestbynid(dgst_nid)) <= 0
555cbb32 3353 || EVP_DigestUpdate(ukm_hash, s->s3.client_random,
a230b26e 3354 SSL3_RANDOM_SIZE) <= 0
555cbb32 3355 || EVP_DigestUpdate(ukm_hash, s->s3.server_random,
a230b26e
EK
3356 SSL3_RANDOM_SIZE) <= 0
3357 || EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len) <= 0) {
c48ffbcc 3358 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
e00e0b3d
MC
3359 goto err;
3360 }
3361 EVP_MD_CTX_free(ukm_hash);
3362 ukm_hash = NULL;
3363 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
7b1264ba 3364 EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) <= 0) {
c48ffbcc 3365 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
e00e0b3d
MC
3366 goto err;
3367 }
3368 /* Make GOST keytransport blob message */
3369 /*
3370 * Encapsulate it into sequence
3371 */
e00e0b3d
MC
3372 msglen = 255;
3373 if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, pms, pmslen) <= 0) {
c48ffbcc 3374 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
e00e0b3d
MC
3375 goto err;
3376 }
f1ec23c0 3377
08029dfa
MC
3378 if (!WPACKET_put_bytes_u8(pkt, V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED)
3379 || (msglen >= 0x80 && !WPACKET_put_bytes_u8(pkt, 0x81))
b2b3024e 3380 || !WPACKET_sub_memcpy_u8(pkt, tmp, msglen)) {
c48ffbcc 3381 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f1ec23c0 3382 goto err;
e00e0b3d 3383 }
f1ec23c0 3384
e00e0b3d 3385 EVP_PKEY_CTX_free(pkey_ctx);
555cbb32
TS
3386 s->s3.tmp.pms = pms;
3387 s->s3.tmp.pmslen = pmslen;
e00e0b3d
MC
3388
3389 return 1;
3390 err:
3391 EVP_PKEY_CTX_free(pkey_ctx);
3392 OPENSSL_clear_free(pms, pmslen);
3393 EVP_MD_CTX_free(ukm_hash);
3394 return 0;
3395#else
c48ffbcc 3396 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
e00e0b3d
MC
3397 return 0;
3398#endif
3399}
3400
5a5530a2 3401#ifndef OPENSSL_NO_GOST
38b051a1 3402int ossl_gost18_cke_cipher_nid(const SSL_CONNECTION *s)
5a5530a2
DB
3403{
3404 if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_MAGMA) != 0)
3405 return NID_magma_ctr;
3406 else if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_KUZNYECHIK) != 0)
3407 return NID_kuznyechik_ctr;
3408
3409 return NID_undef;
3410}
3411
38b051a1 3412int ossl_gost_ukm(const SSL_CONNECTION *s, unsigned char *dgst_buf)
5a5530a2 3413{
bbaeadb0 3414 EVP_MD_CTX *hash = NULL;
5a5530a2 3415 unsigned int md_len;
38b051a1
TM
3416 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
3417 const EVP_MD *md = ssl_evp_md_fetch(sctx->libctx, NID_id_GostR3411_2012_256,
3418 sctx->propq);
5a5530a2
DB
3419
3420 if (md == NULL)
3421 return 0;
3422
3423 if ((hash = EVP_MD_CTX_new()) == NULL
3424 || EVP_DigestInit(hash, md) <= 0
3425 || EVP_DigestUpdate(hash, s->s3.client_random, SSL3_RANDOM_SIZE) <= 0
3426 || EVP_DigestUpdate(hash, s->s3.server_random, SSL3_RANDOM_SIZE) <= 0
3427 || EVP_DigestFinal_ex(hash, dgst_buf, &md_len) <= 0) {
3428 EVP_MD_CTX_free(hash);
3429 ssl_evp_md_free(md);
3430 return 0;
3431 }
3432
3433 EVP_MD_CTX_free(hash);
3434 ssl_evp_md_free(md);
3435 return 1;
3436}
3437#endif
3438
38b051a1 3439static int tls_construct_cke_gost18(SSL_CONNECTION *s, WPACKET *pkt)
5a5530a2
DB
3440{
3441#ifndef OPENSSL_NO_GOST
3442 /* GOST 2018 key exchange message creation */
2b5e8999
DB
3443 unsigned char rnd_dgst[32];
3444 unsigned char *encdata = NULL;
5a5530a2 3445 EVP_PKEY_CTX *pkey_ctx = NULL;
3c95ef22 3446 EVP_PKEY *pkey;
5a5530a2
DB
3447 unsigned char *pms = NULL;
3448 size_t pmslen = 0;
3449 size_t msglen;
6dd4b77a 3450 int cipher_nid = ossl_gost18_cke_cipher_nid(s);
38b051a1 3451 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
5a5530a2
DB
3452
3453 if (cipher_nid == NID_undef) {
c48ffbcc 3454 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5a5530a2
DB
3455 return 0;
3456 }
3457
6dd4b77a 3458 if (ossl_gost_ukm(s, rnd_dgst) <= 0) {
c48ffbcc 3459 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5a5530a2
DB
3460 goto err;
3461 }
3462
3463 /* Pre-master secret - random bytes */
3464 pmslen = 32;
3465 pms = OPENSSL_malloc(pmslen);
3466 if (pms == NULL) {
e077455e 3467 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
5a5530a2
DB
3468 goto err;
3469 }
3470
38b051a1 3471 if (RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) {
c48ffbcc 3472 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5a5530a2
DB
3473 goto err;
3474 }
3475
3476 /* Get server certificate PKEY and create ctx from it */
3c95ef22 3477 if ((pkey = tls_get_peer_pkey(s)) == NULL) {
c48ffbcc
RL
3478 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3479 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
1b87116a 3480 goto err;
5a5530a2
DB
3481 }
3482
38b051a1 3483 pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx,
3c95ef22 3484 pkey,
38b051a1 3485 sctx->propq);
5a5530a2 3486 if (pkey_ctx == NULL) {
e077455e 3487 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
1b87116a 3488 goto err;
5a5530a2
DB
3489 }
3490
1287dabd 3491 if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0) {
c48ffbcc 3492 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5a5530a2
DB
3493 goto err;
3494 };
3495
3496 /* Reuse EVP_PKEY_CTRL_SET_IV, make choice in engine code */
3497 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
7b1264ba 3498 EVP_PKEY_CTRL_SET_IV, 32, rnd_dgst) <= 0) {
c48ffbcc 3499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
5a5530a2
DB
3500 goto err;
3501 }
3502
3503 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
7b1264ba 3504 EVP_PKEY_CTRL_CIPHER, cipher_nid, NULL) <= 0) {
c48ffbcc 3505 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_LIBRARY_BUG);
5a5530a2
DB
3506 goto err;
3507 }
3508
2b5e8999
DB
3509 if (EVP_PKEY_encrypt(pkey_ctx, NULL, &msglen, pms, pmslen) <= 0) {
3510 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
5a5530a2
DB
3511 goto err;
3512 }
3513
2b5e8999
DB
3514 if (!WPACKET_allocate_bytes(pkt, msglen, &encdata)
3515 || EVP_PKEY_encrypt(pkey_ctx, encdata, &msglen, pms, pmslen) <= 0) {
3516 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
5a5530a2
DB
3517 goto err;
3518 }
3519
3520 EVP_PKEY_CTX_free(pkey_ctx);
2b5e8999 3521 pkey_ctx = NULL;
5a5530a2
DB
3522 s->s3.tmp.pms = pms;
3523 s->s3.tmp.pmslen = pmslen;
3524
3525 return 1;
3526 err:
3527 EVP_PKEY_CTX_free(pkey_ctx);
3528 OPENSSL_clear_free(pms, pmslen);
3529 return 0;
3530#else
c48ffbcc 3531 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5a5530a2
DB
3532 return 0;
3533#endif
3534}
3535
38b051a1 3536static int tls_construct_cke_srp(SSL_CONNECTION *s, WPACKET *pkt)
840a2bf8 3537{
8b9546c7 3538#ifndef OPENSSL_NO_SRP
f1ec23c0
MC
3539 unsigned char *abytes = NULL;
3540
3541 if (s->srp_ctx.A == NULL
b2b3024e
MC
3542 || !WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(s->srp_ctx.A),
3543 &abytes)) {
c48ffbcc 3544 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
840a2bf8
MC
3545 return 0;
3546 }
f1ec23c0
MC
3547 BN_bn2bin(s->srp_ctx.A, abytes);
3548
840a2bf8
MC
3549 OPENSSL_free(s->session->srp_username);
3550 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);
3551 if (s->session->srp_username == NULL) {
e077455e 3552 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
840a2bf8
MC
3553 return 0;
3554 }
3555
3556 return 1;
3557#else
c48ffbcc 3558 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
840a2bf8
MC
3559 return 0;
3560#endif
3561}
3562
67ec6d2b
MC
3563CON_FUNC_RETURN tls_construct_client_key_exchange(SSL_CONNECTION *s,
3564 WPACKET *pkt)
13c0ec4a 3565{
13c0ec4a 3566 unsigned long alg_k;
13c0ec4a 3567
555cbb32 3568 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
13c0ec4a 3569
a2c2e000
MC
3570 /*
3571 * All of the construct functions below call SSLfatal() if necessary so
3572 * no need to do so here.
3573 */
13c0ec4a 3574 if ((alg_k & SSL_PSK)
a2c2e000 3575 && !tls_construct_cke_psk_preamble(s, pkt))
13c0ec4a
MC
3576 goto err;
3577
f1ec23c0 3578 if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) {
a2c2e000 3579 if (!tls_construct_cke_rsa(s, pkt))
13c0ec4a 3580 goto err;
a8c1c704 3581 } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
a2c2e000 3582 if (!tls_construct_cke_dhe(s, pkt))
b9908bf9 3583 goto err;
67ad5aab 3584 } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
a2c2e000 3585 if (!tls_construct_cke_ecdhe(s, pkt))
ce0c1f2b 3586 goto err;
e00e0b3d 3587 } else if (alg_k & SSL_kGOST) {
a2c2e000 3588 if (!tls_construct_cke_gost(s, pkt))
a71edf3b 3589 goto err;
5a5530a2
DB
3590 } else if (alg_k & SSL_kGOST18) {
3591 if (!tls_construct_cke_gost18(s, pkt))
3592 goto err;
840a2bf8 3593 } else if (alg_k & SSL_kSRP) {
a2c2e000 3594 if (!tls_construct_cke_srp(s, pkt))
69f68237 3595 goto err;
4a424545 3596 } else if (!(alg_k & SSL_kPSK)) {
c48ffbcc 3597 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b9908bf9
MC
3598 goto err;
3599 }
3600
67ec6d2b 3601 return CON_FUNC_SUCCESS;
0f113f3e 3602 err:
555cbb32
TS
3603 OPENSSL_clear_free(s->s3.tmp.pms, s->s3.tmp.pmslen);
3604 s->s3.tmp.pms = NULL;
39a14059 3605 s->s3.tmp.pmslen = 0;
7689082b 3606#ifndef OPENSSL_NO_PSK
555cbb32
TS
3607 OPENSSL_clear_free(s->s3.tmp.psk, s->s3.tmp.psklen);
3608 s->s3.tmp.psk = NULL;
39a14059 3609 s->s3.tmp.psklen = 0;
0f113f3e 3610#endif
67ec6d2b 3611 return CON_FUNC_ERROR;
b9908bf9
MC
3612}
3613
38b051a1 3614int tls_client_key_exchange_post_work(SSL_CONNECTION *s)
b9908bf9
MC
3615{
3616 unsigned char *pms = NULL;
3617 size_t pmslen = 0;
3618
555cbb32
TS
3619 pms = s->s3.tmp.pms;
3620 pmslen = s->s3.tmp.pmslen;
6f137370 3621
b9908bf9
MC
3622#ifndef OPENSSL_NO_SRP
3623 /* Check for SRP */
555cbb32 3624 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
b9908bf9 3625 if (!srp_generate_client_master_secret(s)) {
a2c2e000 3626 /* SSLfatal() already called */
b9908bf9
MC
3627 goto err;
3628 }
3629 return 1;
3630 }
3631#endif
b9908bf9 3632
555cbb32 3633 if (pms == NULL && !(s->s3.tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
e077455e 3634 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_PASSED_INVALID_ARGUMENT);
b9908bf9
MC
3635 goto err;
3636 }
3637 if (!ssl_generate_master_secret(s, pms, pmslen, 1)) {
a2c2e000 3638 /* SSLfatal() already called */
6f137370
MC
3639 /* ssl_generate_master_secret frees the pms even on error */
3640 pms = NULL;
3641 pmslen = 0;
b9908bf9
MC
3642 goto err;
3643 }
6f137370
MC
3644 pms = NULL;
3645 pmslen = 0;
473483d4
MC
3646
3647#ifndef OPENSSL_NO_SCTP
38b051a1 3648 if (SSL_CONNECTION_IS_DTLS(s)) {
473483d4
MC
3649 unsigned char sctpauthkey[64];
3650 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
09d62b33 3651 size_t labellen;
38b051a1 3652 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
473483d4
MC
3653
3654 /*
3655 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
3656 * used.
3657 */
141eb8c6
MC
3658 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
3659 sizeof(DTLS1_SCTP_AUTH_LABEL));
473483d4 3660
09d62b33
MT
3661 /* Don't include the terminating zero. */
3662 labellen = sizeof(labelbuffer) - 1;
3663 if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG)
3664 labellen += 1;
3665
38b051a1 3666 if (SSL_export_keying_material(ssl, sctpauthkey,
a230b26e 3667 sizeof(sctpauthkey), labelbuffer,
09d62b33 3668 labellen, NULL, 0, 0) <= 0) {
c48ffbcc 3669 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
473483d4 3670 goto err;
a2c2e000 3671 }
473483d4 3672
38b051a1 3673 BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
473483d4
MC
3674 sizeof(sctpauthkey), sctpauthkey);
3675 }
3676#endif
3677
b9908bf9
MC
3678 return 1;
3679 err:
3680 OPENSSL_clear_free(pms, pmslen);
555cbb32 3681 s->s3.tmp.pms = NULL;
39a14059 3682 s->s3.tmp.pmslen = 0;
b9908bf9 3683 return 0;
0f113f3e 3684}
d02b48c6 3685
0f113f3e
MC
3686/*
3687 * Check a certificate can be used for client authentication. Currently check
3688 * cert exists, if we have a suitable digest for TLS 1.2 if static DH client
3689 * certificates can be used and optionally checks suitability for Suite B.
0d609395 3690 */
38b051a1 3691static int ssl3_check_client_certificate(SSL_CONNECTION *s)
0f113f3e 3692{
0f113f3e 3693 /* If no suitable signature algorithm can't use certificate */
555cbb32 3694 if (!tls_choose_sigalg(s, 0) || s->s3.tmp.sigalg == NULL)
0f113f3e
MC
3695 return 0;
3696 /*
3697 * If strict mode check suitability of chain before using it. This also
3698 * adjusts suite B digest if necessary.
3699 */
3700 if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT &&
3701 !tls1_check_chain(s, NULL, NULL, NULL, -2))
3702 return 0;
0f113f3e
MC
3703 return 1;
3704}
0d609395 3705
38b051a1 3706WORK_STATE tls_prepare_client_certificate(SSL_CONNECTION *s, WORK_STATE wst)
0f113f3e
MC
3707{
3708 X509 *x509 = NULL;
3709 EVP_PKEY *pkey = NULL;
3710 int i;
38b051a1 3711 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
0f113f3e 3712
b9908bf9 3713 if (wst == WORK_MORE_A) {
0f113f3e
MC
3714 /* Let cert callback update client certificates if required */
3715 if (s->cert->cert_cb) {
38b051a1 3716 i = s->cert->cert_cb(ssl, s->cert->cert_cb_arg);
0f113f3e
MC
3717 if (i < 0) {
3718 s->rwstate = SSL_X509_LOOKUP;
b9908bf9 3719 return WORK_MORE_A;
0f113f3e
MC
3720 }
3721 if (i == 0) {
c48ffbcc 3722 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_CALLBACK_FAILED);
eb5fd03b 3723 return WORK_ERROR;
0f113f3e
MC
3724 }
3725 s->rwstate = SSL_NOTHING;
3726 }
9d75dce3
TS
3727 if (ssl3_check_client_certificate(s)) {
3728 if (s->post_handshake_auth == SSL_PHA_REQUESTED) {
3729 return WORK_FINISHED_STOP;
3730 }
b9908bf9 3731 return WORK_FINISHED_CONTINUE;
9d75dce3 3732 }
b9908bf9
MC
3733
3734 /* Fall through to WORK_MORE_B */
3735 wst = WORK_MORE_B;
0f113f3e
MC
3736 }
3737
3738 /* We need to get a client cert */
b9908bf9 3739 if (wst == WORK_MORE_B) {
0f113f3e
MC
3740 /*
3741 * If we get an error, we need to ssl->rwstate=SSL_X509_LOOKUP;
3742 * return(-1); We then get retied later
3743 */
0f113f3e
MC
3744 i = ssl_do_client_cert_cb(s, &x509, &pkey);
3745 if (i < 0) {
3746 s->rwstate = SSL_X509_LOOKUP;
b9908bf9 3747 return WORK_MORE_B;
0f113f3e
MC
3748 }
3749 s->rwstate = SSL_NOTHING;
3750 if ((i == 1) && (pkey != NULL) && (x509 != NULL)) {
38b051a1
TM
3751 if (!SSL_use_certificate(ssl, x509)
3752 || !SSL_use_PrivateKey(ssl, pkey))
0f113f3e
MC
3753 i = 0;
3754 } else if (i == 1) {
3755 i = 0;
6849b73c 3756 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
0f113f3e
MC
3757 }
3758
222561fe 3759 X509_free(x509);
25aaa98a 3760 EVP_PKEY_free(pkey);
0f113f3e
MC
3761 if (i && !ssl3_check_client_certificate(s))
3762 i = 0;
3763 if (i == 0) {
3764 if (s->version == SSL3_VERSION) {
555cbb32 3765 s->s3.tmp.cert_req = 0;
0f113f3e 3766 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE);
b9908bf9 3767 return WORK_FINISHED_CONTINUE;
0f113f3e 3768 } else {
555cbb32 3769 s->s3.tmp.cert_req = 2;
b67cb09f 3770 s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none;
124037fd 3771 if (!ssl3_digest_cached_records(s, 0)) {
f63a17d6 3772 /* SSLfatal() already called */
eb5fd03b 3773 return WORK_ERROR;
dab18ab5 3774 }
0f113f3e
MC
3775 }
3776 }
3777
b67cb09f
TS
3778 if (!SSL_CONNECTION_IS_TLS13(s)
3779 || (s->options & SSL_OP_NO_TX_CERTIFICATE_COMPRESSION) != 0)
3780 s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none;
3781
9d75dce3
TS
3782 if (s->post_handshake_auth == SSL_PHA_REQUESTED)
3783 return WORK_FINISHED_STOP;
b9908bf9 3784 return WORK_FINISHED_CONTINUE;
0f113f3e
MC
3785 }
3786
b9908bf9 3787 /* Shouldn't ever get here */
c48ffbcc 3788 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b9908bf9
MC
3789 return WORK_ERROR;
3790}
3791
67ec6d2b
MC
3792CON_FUNC_RETURN tls_construct_client_certificate(SSL_CONNECTION *s,
3793 WPACKET *pkt)
b9908bf9 3794{
3c95ef22 3795 CERT_PKEY *cpk = NULL;
38b051a1
TM
3796 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
3797
3798 if (SSL_CONNECTION_IS_TLS13(s)) {
9d75dce3
TS
3799 if (s->pha_context == NULL) {
3800 /* no context available, add 0-length context */
3801 if (!WPACKET_put_bytes_u8(pkt, 0)) {
c48ffbcc 3802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 3803 return CON_FUNC_ERROR;
9d75dce3
TS
3804 }
3805 } else if (!WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) {
c48ffbcc 3806 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 3807 return CON_FUNC_ERROR;
9d75dce3 3808 }
f63a17d6 3809 }
3c95ef22
TS
3810 if (s->s3.tmp.cert_req != 2)
3811 cpk = s->cert->key;
3812 switch (s->ext.client_cert_type) {
3813 case TLSEXT_cert_type_rpk:
3814 if (!tls_output_rpk(s, pkt, cpk)) {
3815 /* SSLfatal() already called */
3816 return CON_FUNC_ERROR;
3817 }
3818 break;
3819 case TLSEXT_cert_type_x509:
3820 if (!ssl3_output_cert_chain(s, pkt, cpk, 0)) {
3821 /* SSLfatal() already called */
3822 return CON_FUNC_ERROR;
3823 }
3824 break;
3825 default:
3826 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 3827 return CON_FUNC_ERROR;
f7e393be
MC
3828 }
3829
84a14925
MC
3830 /*
3831 * If we attempted to write early data or we're in middlebox compat mode
3832 * then we deferred changing the handshake write keys to the last possible
3833 * moment. We need to do it now.
3834 */
38b051a1 3835 if (SSL_CONNECTION_IS_TLS13(s)
86e75792 3836 && !SSL_IS_QUIC_HANDSHAKE(s)
f7e393be 3837 && SSL_IS_FIRST_HANDSHAKE(s)
84a14925
MC
3838 && (s->early_data_state != SSL_EARLY_DATA_NONE
3839 || (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)
38b051a1 3840 && (!ssl->method->ssl3_enc->change_cipher_state(s,
f7e393be 3841 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) {
c31ad0bb 3842 /*
a2c2e000 3843 * This is a fatal error, which leaves enc_write_ctx in an inconsistent
f63a17d6 3844 * state and thus ssl3_send_alert may crash.
c31ad0bb 3845 */
c48ffbcc 3846 SSLfatal(s, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER);
67ec6d2b 3847 return CON_FUNC_ERROR;
0f113f3e 3848 }
b9908bf9 3849
67ec6d2b 3850 return CON_FUNC_SUCCESS;
0f113f3e
MC
3851}
3852
b67cb09f
TS
3853#ifndef OPENSSL_NO_COMP_ALG
3854CON_FUNC_RETURN tls_construct_client_compressed_certificate(SSL_CONNECTION *sc,
3855 WPACKET *pkt)
3856{
3857 SSL *ssl = SSL_CONNECTION_GET_SSL(sc);
3858 WPACKET tmppkt;
3859 BUF_MEM *buf = NULL;
3860 size_t length;
3861 size_t max_length;
3862 COMP_METHOD *method;
3863 COMP_CTX *comp = NULL;
3864 int comp_len;
3865 int ret = 0;
3866 int alg = sc->ext.compress_certificate_from_peer[0];
3867
3868 /* Note that sc->s3.tmp.cert_req == 2 is checked in write transition */
3869
3870 if ((buf = BUF_MEM_new()) == NULL || !WPACKET_init(&tmppkt, buf))
3871 goto err;
3872
3873 /* Use the |tmppkt| for the to-be-compressed data */
3874 if (sc->pha_context == NULL) {
3875 /* no context available, add 0-length context */
3876 if (!WPACKET_put_bytes_u8(&tmppkt, 0))
3877 goto err;
3878 } else if (!WPACKET_sub_memcpy_u8(&tmppkt, sc->pha_context, sc->pha_context_len))
3879 goto err;
3880
72620ac7 3881 if (!ssl3_output_cert_chain(sc, &tmppkt, sc->cert->key, 0)) {
b67cb09f
TS
3882 /* SSLfatal() already called */
3883 goto out;
3884 }
3885
3886 /* continue with the real |pkt| */
3887 if (!WPACKET_put_bytes_u16(pkt, alg)
3888 || !WPACKET_get_total_written(&tmppkt, &length)
3889 || !WPACKET_put_bytes_u24(pkt, length))
3890 goto err;
3891
3892 switch (alg) {
3893 case TLSEXT_comp_cert_zlib:
3840271e 3894 method = COMP_zlib_oneshot();
b67cb09f
TS
3895 break;
3896 case TLSEXT_comp_cert_brotli:
3897 method = COMP_brotli_oneshot();
3898 break;
3899 case TLSEXT_comp_cert_zstd:
3900 method = COMP_zstd_oneshot();
3901 break;
3902 default:
3903 goto err;
3904 }
3905 max_length = ossl_calculate_comp_expansion(alg, length);
3906
7e3cacac
TS
3907 if ((comp = COMP_CTX_new(method)) == NULL
3908 || !WPACKET_start_sub_packet_u24(pkt)
3909 || !WPACKET_reserve_bytes(pkt, max_length, NULL))
b67cb09f
TS
3910 goto err;
3911
abdbad37
TM
3912 comp_len = COMP_compress_block(comp, WPACKET_get_curr(pkt), (int)max_length,
3913 (unsigned char *)buf->data, (int)length);
b67cb09f
TS
3914 if (comp_len <= 0)
3915 goto err;
3916
3917 if (!WPACKET_allocate_bytes(pkt, comp_len, NULL)
3918 || !WPACKET_close(pkt))
3919 goto err;
3920
84a14925
MC
3921 /*
3922 * If we attempted to write early data or we're in middlebox compat mode
3923 * then we deferred changing the handshake write keys to the last possible
3924 * moment. We need to do it now.
3925 */
b67cb09f 3926 if (SSL_IS_FIRST_HANDSHAKE(sc)
86e75792 3927 && !SSL_IS_QUIC_HANDSHAKE(sc)
84a14925
MC
3928 && (sc->early_data_state != SSL_EARLY_DATA_NONE
3929 || (sc->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0)
b67cb09f
TS
3930 && (!ssl->method->ssl3_enc->change_cipher_state(sc,
3931 SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) {
3932 /*
3933 * This is a fatal error, which leaves sc->enc_write_ctx in an
3934 * inconsistent state and thus ssl3_send_alert may crash.
3935 */
3936 SSLfatal(sc, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER);
3937 goto out;
3938 }
3939 ret = 1;
3940 goto out;
3941
3942 err:
3943 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
3944 out:
d06d5d6b
TS
3945 if (buf != NULL) {
3946 /* If |buf| is NULL, then |tmppkt| could not have been initialized */
3947 WPACKET_cleanup(&tmppkt);
3948 }
b67cb09f
TS
3949 BUF_MEM_free(buf);
3950 COMP_CTX_free(comp);
3951 return ret;
3952}
3953#endif
3954
38b051a1 3955int ssl3_check_cert_and_algorithm(SSL_CONNECTION *s)
0f113f3e 3956{
dd24857b
DSH
3957 const SSL_CERT_LOOKUP *clu;
3958 size_t idx;
0f113f3e 3959 long alg_k, alg_a;
3c95ef22 3960 EVP_PKEY *pkey;
d02b48c6 3961
555cbb32
TS
3962 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
3963 alg_a = s->s3.tmp.new_cipher->algorithm_auth;
d02b48c6 3964
0f113f3e 3965 /* we don't have a certificate */
dd24857b
DSH
3966 if (!(alg_a & SSL_aCERT))
3967 return 1;
d02b48c6 3968
0f113f3e 3969 /* This is the passed certificate */
3c95ef22
TS
3970 pkey = tls_get_peer_pkey(s);
3971 clu = ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s));
d02b48c6 3972
dd24857b
DSH
3973 /* Check certificate is recognised and suitable for cipher */
3974 if (clu == NULL || (alg_a & clu->amask) == 0) {
c48ffbcc 3975 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_MISSING_SIGNING_CERT);
f63a17d6 3976 return 0;
0f113f3e 3977 }
0f113f3e 3978
dd24857b 3979 if (alg_k & (SSL_kRSA | SSL_kRSAPSK) && idx != SSL_PKEY_RSA) {
f63a17d6 3980 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
f63a17d6
MC
3981 SSL_R_MISSING_RSA_ENCRYPTING_CERT);
3982 return 0;
0f113f3e 3983 }
5b64ce89 3984
555cbb32 3985 if ((alg_k & SSL_kDHE) && (s->s3.peer_tmp == NULL)) {
c48ffbcc 3986 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f63a17d6 3987 return 0;
0f113f3e 3988 }
d02b48c6 3989
3c95ef22
TS
3990 /* Early out to skip the checks below */
3991 if (s->session->peer_rpk != NULL)
3992 return 1;
3993
3994 if (clu->amask & SSL_aECDSA) {
3995 if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s))
3996 return 1;
3997 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_ECC_CERT);
3998 return 0;
3999 }
4000
dd24857b 4001 return 1;
0f113f3e
MC
4002}
4003
e481f9b9 4004#ifndef OPENSSL_NO_NEXTPROTONEG
67ec6d2b 4005CON_FUNC_RETURN tls_construct_next_proto(SSL_CONNECTION *s, WPACKET *pkt)
b9908bf9 4006{
15e6be6c
MC
4007 size_t len, padding_len;
4008 unsigned char *padding = NULL;
15e6be6c 4009
aff8c126 4010 len = s->ext.npn_len;
b9908bf9 4011 padding_len = 32 - ((len + 2) % 32);
15e6be6c 4012
aff8c126 4013 if (!WPACKET_sub_memcpy_u8(pkt, s->ext.npn, len)
7cea05dc 4014 || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) {
c48ffbcc 4015 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
67ec6d2b 4016 return CON_FUNC_ERROR;
15e6be6c
MC
4017 }
4018
4019 memset(padding, 0, padding_len);
4020
67ec6d2b 4021 return CON_FUNC_SUCCESS;
b9908bf9 4022}
6434abbf 4023#endif
368888bc 4024
38b051a1 4025MSG_PROCESS_RETURN tls_process_hello_req(SSL_CONNECTION *s, PACKET *pkt)
c7f47786 4026{
38b051a1
TM
4027 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
4028
c7f47786
MC
4029 if (PACKET_remaining(pkt) > 0) {
4030 /* should contain no data */
c48ffbcc 4031 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
c7f47786
MC
4032 return MSG_PROCESS_ERROR;
4033 }
4034
db0f35dd
TS
4035 if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
4036 ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
4037 return MSG_PROCESS_FINISHED_READING;
4038 }
4039
c7f47786 4040 /*
1f04f23e
MC
4041 * This is a historical discrepancy (not in the RFC) maintained for
4042 * compatibility reasons. If a TLS client receives a HelloRequest it will
4043 * attempt an abbreviated handshake. However if a DTLS client receives a
4044 * HelloRequest it will do a full handshake. Either behaviour is reasonable
4045 * but doing one for TLS and another for DTLS is odd.
c7f47786 4046 */
38b051a1
TM
4047 if (SSL_CONNECTION_IS_DTLS(s))
4048 SSL_renegotiate(ssl);
c7f47786 4049 else
38b051a1 4050 SSL_renegotiate_abbreviated(ssl);
c7f47786
MC
4051
4052 return MSG_PROCESS_FINISHED_READING;
4053}
4054
38b051a1
TM
4055static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s,
4056 PACKET *pkt)
e46f2334 4057{
e46f2334 4058 PACKET extensions;
3434f40b 4059 RAW_EXTENSION *rawexts = NULL;
e46f2334 4060
26b9172a
MC
4061 if (!PACKET_as_length_prefixed_2(pkt, &extensions)
4062 || PACKET_remaining(pkt) != 0) {
c48ffbcc 4063 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
e46f2334
MC
4064 goto err;
4065 }
4066
fe874d27
MC
4067 if (!tls_collect_extensions(s, &extensions,
4068 SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, &rawexts,
f63a17d6 4069 NULL, 1)
fe874d27 4070 || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
f63a17d6
MC
4071 rawexts, NULL, 0, 1)) {
4072 /* SSLfatal() already called */
3434f40b 4073 goto err;
f63a17d6 4074 }
3434f40b 4075
1b0286a3 4076 OPENSSL_free(rawexts);
e46f2334
MC
4077 return MSG_PROCESS_CONTINUE_READING;
4078
4079 err:
1b0286a3 4080 OPENSSL_free(rawexts);
e46f2334
MC
4081 return MSG_PROCESS_ERROR;
4082}
4083
38b051a1 4084int ssl_do_client_cert_cb(SSL_CONNECTION *s, X509 **px509, EVP_PKEY **ppkey)
0f113f3e
MC
4085{
4086 int i = 0;
38b051a1
TM
4087 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
4088
368888bc 4089#ifndef OPENSSL_NO_ENGINE
38b051a1 4090 if (sctx->client_cert_engine) {
301fcb28 4091 i = tls_engine_load_ssl_client_cert(s, px509, ppkey);
0f113f3e
MC
4092 if (i != 0)
4093 return i;
4094 }
4095#endif
38b051a1 4096 if (sctx->client_cert_cb)
dc84829c 4097 i = sctx->client_cert_cb(SSL_CONNECTION_GET_USER_SSL(s), px509, ppkey);
0f113f3e
MC
4098 return i;
4099}
d45ba43d 4100
38b051a1
TM
4101int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk,
4102 WPACKET *pkt)
d45ba43d 4103{
2c7b4dbc 4104 int i;
aafec89c 4105 size_t totlen = 0, len, maxlen, maxverok = 0;
1eef26bd 4106 int empty_reneg_info_scsv = !s->renegotiate
972ee925
TP
4107 && !SSL_CONNECTION_IS_DTLS(s)
4108 && ssl_security(s, SSL_SECOP_VERSION, 0, TLS1_VERSION, NULL)
4109 && s->min_proto_version <= TLS1_VERSION;
38b051a1 4110 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1d0c08b4 4111
d45ba43d 4112 /* Set disabled masks for this session */
1d0c08b4 4113 if (!ssl_set_client_disabled(s)) {
c48ffbcc 4114 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_PROTOCOLS_AVAILABLE);
1d0c08b4
MC
4115 return 0;
4116 }
d45ba43d 4117
f63a17d6 4118 if (sk == NULL) {
c48ffbcc 4119 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
26a7d938 4120 return 0;
f63a17d6 4121 }
d45ba43d 4122
2c7b4dbc
MC
4123#ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH
4124# if OPENSSL_MAX_TLS1_2_CIPHER_LENGTH < 6
4125# error Max cipher length too short
4126# endif
4127 /*
4128 * Some servers hang if client hello > 256 bytes as hack workaround
4129 * chop number of supported ciphers to keep it well below this if we
4130 * use TLS v1.2
4131 */
38b051a1 4132 if (TLS1_get_version(ssl) >= TLS1_2_VERSION)
2c7b4dbc
MC
4133 maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;
4134 else
4135#endif
4136 /* Maximum length that can be stored in 2 bytes. Length must be even */
4137 maxlen = 0xfffe;
4138
4139 if (empty_reneg_info_scsv)
4140 maxlen -= 2;
4141 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV)
4142 maxlen -= 2;
4143
4144 for (i = 0; i < sk_SSL_CIPHER_num(sk) && totlen < maxlen; i++) {
4145 const SSL_CIPHER *c;
4146
d45ba43d
MC
4147 c = sk_SSL_CIPHER_value(sk, i);
4148 /* Skip disabled ciphers */
8af91fd9 4149 if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
d45ba43d 4150 continue;
2c7b4dbc 4151
38b051a1 4152 if (!ssl->method->put_cipher_by_char(c, pkt, &len)) {
c48ffbcc 4153 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2c7b4dbc
MC
4154 return 0;
4155 }
4156
aafec89c
MC
4157 /* Sanity check that the maximum version we offer has ciphers enabled */
4158 if (!maxverok) {
6fd37948
FWH
4159 int minproto = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls;
4160 int maxproto = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls;
4161
4162 if (ssl_version_cmp(s, maxproto, s->s3.tmp.max_ver) >= 0
4163 && ssl_version_cmp(s, minproto, s->s3.tmp.max_ver) <= 0)
4164 maxverok = 1;
aafec89c
MC
4165 }
4166
2c7b4dbc 4167 totlen += len;
d45ba43d 4168 }
2c7b4dbc 4169
aafec89c 4170 if (totlen == 0 || !maxverok) {
c48ffbcc
RL
4171 const char *maxvertext =
4172 !maxverok
4173 ? "No ciphers enabled for max supported SSL/TLS version"
4174 : NULL;
aafec89c 4175
c48ffbcc
RL
4176 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_CIPHERS_AVAILABLE,
4177 maxvertext);
2c7b4dbc
MC
4178 return 0;
4179 }
4180
4181 if (totlen != 0) {
d45ba43d 4182 if (empty_reneg_info_scsv) {
c30aee71 4183 static const SSL_CIPHER scsv = {
bbb4ceb8 4184 0, NULL, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
d45ba43d 4185 };
38b051a1 4186 if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) {
c48ffbcc 4187 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2c7b4dbc
MC
4188 return 0;
4189 }
d45ba43d
MC
4190 }
4191 if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) {
c30aee71 4192 static const SSL_CIPHER scsv = {
bbb4ceb8 4193 0, NULL, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
d45ba43d 4194 };
38b051a1 4195 if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) {
c48ffbcc 4196 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2c7b4dbc
MC
4197 return 0;
4198 }
d45ba43d
MC
4199 }
4200 }
4201
2c7b4dbc 4202 return 1;
d45ba43d 4203}
ef6c191b 4204
67ec6d2b 4205CON_FUNC_RETURN tls_construct_end_of_early_data(SSL_CONNECTION *s, WPACKET *pkt)
ef6c191b
MC
4206{
4207 if (s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY
4208 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) {
c48ffbcc 4209 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
67ec6d2b 4210 return CON_FUNC_ERROR;
ef6c191b
MC
4211 }
4212
4213 s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
67ec6d2b 4214 return CON_FUNC_SUCCESS;
ef6c191b 4215}