]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
b0edda11 | 2 | * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. |
c80149d9 | 3 | * Copyright 2005 Nokia. All rights reserved. |
82b0bf0b | 4 | * |
2c18d164 | 5 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
6 | * this file except in compliance with the License. You can obtain a copy |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
82b0bf0b | 9 | */ |
846e33c7 | 10 | |
58964a49 | 11 | #include <stdio.h> |
7b63c0fa | 12 | #include "ssl_locl.h" |
50ec7505 BP |
13 | #include "record/record_locl.h" |
14 | #include "internal/ktls.h" | |
15 | #include "internal/cryptlib.h" | |
3c27208f | 16 | #include <openssl/comp.h> |
ec577822 | 17 | #include <openssl/evp.h> |
b7d60e76 | 18 | #include <openssl/kdf.h> |
637f374a | 19 | #include <openssl/rand.h> |
50ec7505 | 20 | #include <openssl/obj_mac.h> |
49b26f54 | 21 | #include <openssl/trace.h> |
58964a49 | 22 | |
b7d60e76 | 23 | /* seed1 through seed5 are concatenated */ |
28ba2541 | 24 | static int tls1_PRF(SSL *s, |
6db6bc5a MC |
25 | const void *seed1, size_t seed1_len, |
26 | const void *seed2, size_t seed2_len, | |
27 | const void *seed3, size_t seed3_len, | |
28 | const void *seed4, size_t seed4_len, | |
29 | const void *seed5, size_t seed5_len, | |
30 | const unsigned char *sec, size_t slen, | |
d4d2f3a4 | 31 | unsigned char *out, size_t olen, int fatal) |
0f113f3e | 32 | { |
28ba2541 | 33 | const EVP_MD *md = ssl_prf_md(s); |
b7d60e76 | 34 | EVP_PKEY_CTX *pctx = NULL; |
b7d60e76 | 35 | int ret = 0; |
0f113f3e | 36 | |
28ba2541 | 37 | if (md == NULL) { |
668f6f08 | 38 | /* Should never happen */ |
d4d2f3a4 MC |
39 | if (fatal) |
40 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, | |
41 | ERR_R_INTERNAL_ERROR); | |
42 | else | |
43 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
28ba2541 | 44 | return 0; |
668f6f08 | 45 | } |
b7d60e76 DSH |
46 | pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); |
47 | if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0 | |
48 | || EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) <= 0 | |
d4d2f3a4 MC |
49 | || EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, (int)slen) <= 0 |
50 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, (int)seed1_len) <= 0 | |
51 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, (int)seed2_len) <= 0 | |
52 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, (int)seed3_len) <= 0 | |
53 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed4, (int)seed4_len) <= 0 | |
54 | || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed5, (int)seed5_len) <= 0 | |
55 | || EVP_PKEY_derive(pctx, out, &olen) <= 0) { | |
56 | if (fatal) | |
57 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, | |
58 | ERR_R_INTERNAL_ERROR); | |
59 | else | |
60 | SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); | |
b7d60e76 | 61 | goto err; |
d4d2f3a4 | 62 | } |
b7d60e76 | 63 | |
b7d60e76 DSH |
64 | ret = 1; |
65 | ||
a230b26e | 66 | err: |
b7d60e76 DSH |
67 | EVP_PKEY_CTX_free(pctx); |
68 | return ret; | |
81025661 | 69 | } |
0f113f3e | 70 | |
8c1a5343 | 71 | static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) |
0f113f3e MC |
72 | { |
73 | int ret; | |
d4d2f3a4 MC |
74 | |
75 | /* Calls SSLfatal() as required */ | |
28ba2541 | 76 | ret = tls1_PRF(s, |
0f113f3e MC |
77 | TLS_MD_KEY_EXPANSION_CONST, |
78 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3->server_random, | |
79 | SSL3_RANDOM_SIZE, s->s3->client_random, SSL3_RANDOM_SIZE, | |
80 | NULL, 0, NULL, 0, s->session->master_key, | |
d4d2f3a4 | 81 | s->session->master_key_length, km, num, 1); |
55a9a16f | 82 | |
0f113f3e MC |
83 | return ret; |
84 | } | |
58964a49 | 85 | |
6b691a5c | 86 | int tls1_change_cipher_state(SSL *s, int which) |
0f113f3e | 87 | { |
0f113f3e | 88 | unsigned char *p, *mac_secret; |
0f113f3e | 89 | unsigned char *ms, *key, *iv; |
0f113f3e MC |
90 | EVP_CIPHER_CTX *dd; |
91 | const EVP_CIPHER *c; | |
09b6c2ef | 92 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 93 | const SSL_COMP *comp; |
09b6c2ef | 94 | #endif |
0f113f3e MC |
95 | const EVP_MD *m; |
96 | int mac_type; | |
b43d1cbb | 97 | size_t *mac_secret_size; |
0f113f3e MC |
98 | EVP_MD_CTX *mac_ctx; |
99 | EVP_PKEY *mac_key; | |
b43d1cbb | 100 | size_t n, i, j, k, cl; |
0f113f3e | 101 | int reuse_dd = 0; |
50ec7505 BP |
102 | #ifndef OPENSSL_NO_KTLS |
103 | struct tls12_crypto_info_aes_gcm_128 crypto_info; | |
104 | BIO *wbio; | |
105 | unsigned char geniv[12]; | |
106 | #endif | |
0f113f3e | 107 | |
0f113f3e MC |
108 | c = s->s3->tmp.new_sym_enc; |
109 | m = s->s3->tmp.new_hash; | |
110 | mac_type = s->s3->tmp.new_mac_pkey_type; | |
09b6c2ef | 111 | #ifndef OPENSSL_NO_COMP |
0f113f3e | 112 | comp = s->s3->tmp.new_compression; |
09b6c2ef | 113 | #endif |
58964a49 | 114 | |
0f113f3e | 115 | if (which & SSL3_CC_READ) { |
28a31a0a MC |
116 | if (s->ext.use_etm) |
117 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
118 | else | |
119 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; | |
120 | ||
0f113f3e MC |
121 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
122 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; | |
123 | else | |
124 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; | |
125 | ||
f63a17d6 | 126 | if (s->enc_read_ctx != NULL) { |
0f113f3e | 127 | reuse_dd = 1; |
f63a17d6 MC |
128 | } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
129 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
130 | ERR_R_MALLOC_FAILURE); | |
0f113f3e | 131 | goto err; |
f63a17d6 | 132 | } else { |
0f113f3e | 133 | /* |
f430ba31 | 134 | * make sure it's initialised in case we exit later with an error |
0f113f3e | 135 | */ |
846ec07d | 136 | EVP_CIPHER_CTX_reset(s->enc_read_ctx); |
f63a17d6 | 137 | } |
0f113f3e MC |
138 | dd = s->enc_read_ctx; |
139 | mac_ctx = ssl_replace_hash(&s->read_hash, NULL); | |
157af9be MC |
140 | if (mac_ctx == NULL) { |
141 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
142 | ERR_R_INTERNAL_ERROR); | |
5f3d93e4 | 143 | goto err; |
157af9be | 144 | } |
09b6c2ef | 145 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
146 | COMP_CTX_free(s->expand); |
147 | s->expand = NULL; | |
0f113f3e MC |
148 | if (comp != NULL) { |
149 | s->expand = COMP_CTX_new(comp->method); | |
150 | if (s->expand == NULL) { | |
f63a17d6 MC |
151 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
152 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
153 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
154 | goto err; | |
0f113f3e | 155 | } |
0f113f3e | 156 | } |
09b6c2ef | 157 | #endif |
0f113f3e | 158 | /* |
d5d0a1cb | 159 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 160 | */ |
d5d0a1cb | 161 | if (!SSL_IS_DTLS(s)) |
de07f311 | 162 | RECORD_LAYER_reset_read_sequence(&s->rlayer); |
0f113f3e MC |
163 | mac_secret = &(s->s3->read_mac_secret[0]); |
164 | mac_secret_size = &(s->s3->read_mac_secret_size); | |
165 | } else { | |
7426cd34 | 166 | s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; |
28a31a0a MC |
167 | if (s->ext.use_etm) |
168 | s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
169 | else | |
170 | s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; | |
171 | ||
0f113f3e MC |
172 | if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
173 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
174 | else | |
175 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; | |
f63a17d6 | 176 | if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) { |
0f113f3e | 177 | reuse_dd = 1; |
f63a17d6 MC |
178 | } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { |
179 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
180 | ERR_R_MALLOC_FAILURE); | |
0f113f3e | 181 | goto err; |
f63a17d6 | 182 | } |
0f113f3e MC |
183 | dd = s->enc_write_ctx; |
184 | if (SSL_IS_DTLS(s)) { | |
bfb0641f | 185 | mac_ctx = EVP_MD_CTX_new(); |
f63a17d6 MC |
186 | if (mac_ctx == NULL) { |
187 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
188 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
189 | ERR_R_MALLOC_FAILURE); | |
0f113f3e | 190 | goto err; |
f63a17d6 | 191 | } |
0f113f3e | 192 | s->write_hash = mac_ctx; |
5f3d93e4 | 193 | } else { |
0f113f3e | 194 | mac_ctx = ssl_replace_hash(&s->write_hash, NULL); |
f63a17d6 MC |
195 | if (mac_ctx == NULL) { |
196 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, | |
197 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
198 | ERR_R_MALLOC_FAILURE); | |
5f3d93e4 | 199 | goto err; |
f63a17d6 | 200 | } |
5f3d93e4 | 201 | } |
09b6c2ef | 202 | #ifndef OPENSSL_NO_COMP |
efa7dd64 RS |
203 | COMP_CTX_free(s->compress); |
204 | s->compress = NULL; | |
0f113f3e MC |
205 | if (comp != NULL) { |
206 | s->compress = COMP_CTX_new(comp->method); | |
207 | if (s->compress == NULL) { | |
f63a17d6 MC |
208 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, |
209 | SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
210 | SSL_R_COMPRESSION_LIBRARY_ERROR); | |
211 | goto err; | |
0f113f3e MC |
212 | } |
213 | } | |
09b6c2ef | 214 | #endif |
0f113f3e | 215 | /* |
d5d0a1cb | 216 | * this is done by dtls1_reset_seq_numbers for DTLS |
0f113f3e | 217 | */ |
d5d0a1cb | 218 | if (!SSL_IS_DTLS(s)) |
de07f311 | 219 | RECORD_LAYER_reset_write_sequence(&s->rlayer); |
0f113f3e MC |
220 | mac_secret = &(s->s3->write_mac_secret[0]); |
221 | mac_secret_size = &(s->s3->write_mac_secret_size); | |
222 | } | |
223 | ||
224 | if (reuse_dd) | |
846ec07d | 225 | EVP_CIPHER_CTX_reset(dd); |
0f113f3e MC |
226 | |
227 | p = s->s3->tmp.key_block; | |
228 | i = *mac_secret_size = s->s3->tmp.new_mac_secret_size; | |
229 | ||
b43d1cbb | 230 | /* TODO(size_t): convert me */ |
0f113f3e | 231 | cl = EVP_CIPHER_key_length(c); |
361a1191 | 232 | j = cl; |
0f113f3e | 233 | /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ |
e75c5a79 | 234 | /* If GCM/CCM mode only part of IV comes from PRF */ |
0f113f3e MC |
235 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) |
236 | k = EVP_GCM_TLS_FIXED_IV_LEN; | |
e75c5a79 DSH |
237 | else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) |
238 | k = EVP_CCM_TLS_FIXED_IV_LEN; | |
0f113f3e MC |
239 | else |
240 | k = EVP_CIPHER_iv_length(c); | |
241 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || | |
242 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { | |
243 | ms = &(p[0]); | |
244 | n = i + i; | |
245 | key = &(p[n]); | |
246 | n += j + j; | |
247 | iv = &(p[n]); | |
248 | n += k + k; | |
0f113f3e MC |
249 | } else { |
250 | n = i; | |
251 | ms = &(p[n]); | |
252 | n += i + j; | |
253 | key = &(p[n]); | |
254 | n += j + k; | |
255 | iv = &(p[n]); | |
256 | n += k; | |
0f113f3e MC |
257 | } |
258 | ||
259 | if (n > s->s3->tmp.key_block_length) { | |
f63a17d6 MC |
260 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
261 | ERR_R_INTERNAL_ERROR); | |
262 | goto err; | |
0f113f3e MC |
263 | } |
264 | ||
265 | memcpy(mac_secret, ms, i); | |
266 | ||
267 | if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { | |
348240c6 | 268 | /* TODO(size_t): Convert this function */ |
7b4d3ffa | 269 | mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, |
f929439f | 270 | (int)*mac_secret_size); |
5f3d93e4 | 271 | if (mac_key == NULL |
a230b26e | 272 | || EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key) <= 0) { |
5f3d93e4 | 273 | EVP_PKEY_free(mac_key); |
f63a17d6 MC |
274 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
275 | ERR_R_INTERNAL_ERROR); | |
276 | goto err; | |
5f3d93e4 | 277 | } |
0f113f3e MC |
278 | EVP_PKEY_free(mac_key); |
279 | } | |
49b26f54 RL |
280 | |
281 | OSSL_TRACE_BEGIN(TLS) { | |
282 | BIO_printf(trc_out, "which = %04X, mac key:\n", which); | |
283 | BIO_dump_indent(trc_out, ms, i, 4); | |
284 | } OSSL_TRACE_END(TLS); | |
0f113f3e MC |
285 | |
286 | if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { | |
eadf70d2 | 287 | if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) |
348240c6 MC |
288 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, |
289 | iv)) { | |
f63a17d6 MC |
290 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
291 | ERR_R_INTERNAL_ERROR); | |
292 | goto err; | |
eadf70d2 | 293 | } |
e75c5a79 | 294 | } else if (EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) { |
3d3701ea | 295 | int taglen; |
a230b26e EK |
296 | if (s->s3->tmp. |
297 | new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) | |
ec07b1d8 | 298 | taglen = EVP_CCM8_TLS_TAG_LEN; |
3d3701ea | 299 | else |
ec07b1d8 | 300 | taglen = EVP_CCM_TLS_TAG_LEN; |
e75c5a79 DSH |
301 | if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) |
302 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) | |
303 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) | |
348240c6 | 304 | || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) |
e75c5a79 | 305 | || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { |
f63a17d6 MC |
306 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
307 | ERR_R_INTERNAL_ERROR); | |
308 | goto err; | |
e75c5a79 | 309 | } |
eadf70d2 MC |
310 | } else { |
311 | if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { | |
f63a17d6 MC |
312 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
313 | ERR_R_INTERNAL_ERROR); | |
314 | goto err; | |
eadf70d2 MC |
315 | } |
316 | } | |
0f113f3e | 317 | /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ |
eadf70d2 MC |
318 | if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size |
319 | && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, | |
348240c6 | 320 | (int)*mac_secret_size, mac_secret)) { |
f63a17d6 MC |
321 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, |
322 | ERR_R_INTERNAL_ERROR); | |
323 | goto err; | |
eadf70d2 | 324 | } |
50ec7505 BP |
325 | #ifndef OPENSSL_NO_KTLS |
326 | if (s->compress) | |
327 | goto skip_ktls; | |
328 | ||
329 | if ((which & SSL3_CC_READ) || | |
330 | ((which & SSL3_CC_WRITE) && (s->mode & SSL_MODE_NO_KTLS_TX))) | |
331 | goto skip_ktls; | |
332 | ||
333 | /* ktls supports only the maximum fragment size */ | |
334 | if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH) | |
335 | goto skip_ktls; | |
336 | ||
337 | /* check that cipher is AES_GCM_128 */ | |
338 | if (EVP_CIPHER_nid(c) != NID_aes_128_gcm | |
339 | || EVP_CIPHER_mode(c) != EVP_CIPH_GCM_MODE | |
340 | || EVP_CIPHER_key_length(c) != TLS_CIPHER_AES_GCM_128_KEY_SIZE) | |
341 | goto skip_ktls; | |
342 | ||
343 | /* check version is 1.2 */ | |
344 | if (s->version != TLS1_2_VERSION) | |
345 | goto skip_ktls; | |
346 | ||
347 | wbio = s->wbio; | |
348 | if (!ossl_assert(wbio != NULL)) { | |
349 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
350 | ERR_R_INTERNAL_ERROR); | |
351 | goto err; | |
352 | } | |
353 | ||
354 | /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */ | |
355 | if (BIO_flush(wbio) <= 0) | |
356 | goto skip_ktls; | |
357 | ||
358 | /* ktls doesn't support renegotiation */ | |
359 | if (BIO_get_ktls_send(s->wbio)) { | |
360 | SSLfatal(s, SSL_AD_NO_RENEGOTIATION, SSL_F_TLS1_CHANGE_CIPHER_STATE, | |
361 | ERR_R_INTERNAL_ERROR); | |
362 | goto err; | |
363 | } | |
364 | ||
365 | memset(&crypto_info, 0, sizeof(crypto_info)); | |
366 | crypto_info.info.cipher_type = TLS_CIPHER_AES_GCM_128; | |
367 | crypto_info.info.version = s->version; | |
368 | ||
369 | EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GET_IV, | |
370 | EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN, | |
371 | geniv); | |
372 | memcpy(crypto_info.iv, geniv + EVP_GCM_TLS_FIXED_IV_LEN, | |
373 | TLS_CIPHER_AES_GCM_128_IV_SIZE); | |
374 | memcpy(crypto_info.salt, geniv, TLS_CIPHER_AES_GCM_128_SALT_SIZE); | |
375 | memcpy(crypto_info.key, key, EVP_CIPHER_key_length(c)); | |
376 | memcpy(crypto_info.rec_seq, &s->rlayer.write_sequence, | |
377 | TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); | |
378 | ||
379 | /* ktls works with user provided buffers directly */ | |
380 | if (BIO_set_ktls(wbio, &crypto_info, which & SSL3_CC_WRITE)) { | |
381 | ssl3_release_write_buffer(s); | |
382 | SSL_set_options(s, SSL_OP_NO_RENEGOTIATION); | |
383 | } | |
384 | ||
385 | skip_ktls: | |
386 | #endif /* OPENSSL_NO_KTLS */ | |
7426cd34 | 387 | s->statem.enc_write_state = ENC_WRITE_STATE_VALID; |
1cf218bc | 388 | |
49b26f54 RL |
389 | OSSL_TRACE_BEGIN(TLS) { |
390 | BIO_printf(trc_out, "which = %04X, key:\n", which); | |
391 | BIO_dump_indent(trc_out, key, EVP_CIPHER_key_length(c), 4); | |
392 | BIO_printf(trc_out, "iv:\n"); | |
393 | BIO_dump_indent(trc_out, iv, k, 4); | |
394 | } OSSL_TRACE_END(TLS); | |
58964a49 | 395 | |
208fb891 | 396 | return 1; |
0f113f3e | 397 | err: |
26a7d938 | 398 | return 0; |
0f113f3e | 399 | } |
58964a49 | 400 | |
6b691a5c | 401 | int tls1_setup_key_block(SSL *s) |
0f113f3e | 402 | { |
b7d60e76 | 403 | unsigned char *p; |
0f113f3e MC |
404 | const EVP_CIPHER *c; |
405 | const EVP_MD *hash; | |
0f113f3e | 406 | SSL_COMP *comp; |
8c1a5343 MC |
407 | int mac_type = NID_undef; |
408 | size_t num, mac_secret_size = 0; | |
0f113f3e | 409 | int ret = 0; |
58964a49 | 410 | |
0f113f3e | 411 | if (s->s3->tmp.key_block_length != 0) |
208fb891 | 412 | return 1; |
0f113f3e | 413 | |
28a31a0a MC |
414 | if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, |
415 | &comp, s->ext.use_etm)) { | |
f63a17d6 MC |
416 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, |
417 | SSL_R_CIPHER_OR_HASH_UNAVAILABLE); | |
26a7d938 | 418 | return 0; |
0f113f3e MC |
419 | } |
420 | ||
421 | s->s3->tmp.new_sym_enc = c; | |
422 | s->s3->tmp.new_hash = hash; | |
423 | s->s3->tmp.new_mac_pkey_type = mac_type; | |
424 | s->s3->tmp.new_mac_secret_size = mac_secret_size; | |
a230b26e | 425 | num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c); |
0f113f3e MC |
426 | num *= 2; |
427 | ||
428 | ssl3_cleanup_key_block(s); | |
429 | ||
b7d60e76 | 430 | if ((p = OPENSSL_malloc(num)) == NULL) { |
f63a17d6 MC |
431 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_SETUP_KEY_BLOCK, |
432 | ERR_R_MALLOC_FAILURE); | |
0f113f3e MC |
433 | goto err; |
434 | } | |
435 | ||
436 | s->s3->tmp.key_block_length = num; | |
b7d60e76 | 437 | s->s3->tmp.key_block = p; |
0f113f3e | 438 | |
49b26f54 RL |
439 | OSSL_TRACE_BEGIN(TLS) { |
440 | BIO_printf(trc_out, "client random\n"); | |
441 | BIO_dump_indent(trc_out, s->s3->client_random, SSL3_RANDOM_SIZE, 4); | |
442 | BIO_printf(trc_out, "server random\n"); | |
443 | BIO_dump_indent(trc_out, s->s3->server_random, SSL3_RANDOM_SIZE, 4); | |
444 | BIO_printf(trc_out, "master key\n"); | |
445 | BIO_dump_indent(trc_out, | |
446 | s->session->master_key, | |
447 | s->session->master_key_length, 4); | |
448 | } OSSL_TRACE_END(TLS); | |
449 | ||
d4d2f3a4 MC |
450 | if (!tls1_generate_key_block(s, p, num)) { |
451 | /* SSLfatal() already called */ | |
0f113f3e | 452 | goto err; |
d4d2f3a4 | 453 | } |
49b26f54 RL |
454 | |
455 | OSSL_TRACE_BEGIN(TLS) { | |
456 | BIO_printf(trc_out, "key block\n"); | |
457 | BIO_dump_indent(trc_out, p, num, 4); | |
458 | } OSSL_TRACE_END(TLS); | |
58964a49 | 459 | |
0f113f3e MC |
460 | if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
461 | && s->method->version <= TLS1_VERSION) { | |
462 | /* | |
463 | * enable vulnerability countermeasure for CBC ciphers with known-IV | |
464 | * problem (http://www.openssl.org/~bodo/tls-cbc.txt) | |
465 | */ | |
466 | s->s3->need_empty_fragments = 1; | |
467 | ||
468 | if (s->session->cipher != NULL) { | |
469 | if (s->session->cipher->algorithm_enc == SSL_eNULL) | |
470 | s->s3->need_empty_fragments = 0; | |
471 | ||
d1d0be3c | 472 | #ifndef OPENSSL_NO_RC4 |
0f113f3e MC |
473 | if (s->session->cipher->algorithm_enc == SSL_RC4) |
474 | s->s3->need_empty_fragments = 0; | |
82b0bf0b | 475 | #endif |
0f113f3e MC |
476 | } |
477 | } | |
478 | ||
479 | ret = 1; | |
480 | err: | |
26a7d938 | 481 | return ret; |
0f113f3e | 482 | } |
58964a49 | 483 | |
6db6bc5a MC |
484 | size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, |
485 | unsigned char *out) | |
0f113f3e | 486 | { |
8c1a5343 | 487 | size_t hashlen; |
28ba2541 | 488 | unsigned char hash[EVP_MAX_MD_SIZE]; |
0f113f3e | 489 | |
d4d2f3a4 MC |
490 | if (!ssl3_digest_cached_records(s, 0)) { |
491 | /* SSLfatal() already called */ | |
124037fd | 492 | return 0; |
d4d2f3a4 | 493 | } |
0f113f3e | 494 | |
d4d2f3a4 MC |
495 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
496 | /* SSLfatal() already called */ | |
48fbcbac | 497 | return 0; |
d4d2f3a4 | 498 | } |
0f113f3e | 499 | |
b7d60e76 | 500 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
0f113f3e | 501 | s->session->master_key, s->session->master_key_length, |
d4d2f3a4 MC |
502 | out, TLS1_FINISH_MAC_LENGTH, 1)) { |
503 | /* SSLfatal() already called */ | |
0f113f3e | 504 | return 0; |
d4d2f3a4 | 505 | } |
c9dd49a7 | 506 | OPENSSL_cleanse(hash, hashlen); |
b7d60e76 | 507 | return TLS1_FINISH_MAC_LENGTH; |
0f113f3e | 508 | } |
58964a49 | 509 | |
6b691a5c | 510 | int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, |
8c1a5343 | 511 | size_t len, size_t *secret_size) |
0f113f3e | 512 | { |
329114f9 | 513 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
0cfb0e75 | 514 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
8c1a5343 | 515 | size_t hashlen; |
a230b26e EK |
516 | /* |
517 | * Digest cached records keeping record buffer (if present): this wont | |
518 | * affect client auth because we're freezing the buffer at the same | |
519 | * point (after client key exchange and before certificate verify) | |
124037fd | 520 | */ |
f63a17d6 MC |
521 | if (!ssl3_digest_cached_records(s, 1) |
522 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { | |
523 | /* SSLfatal() already called */ | |
8c1a5343 | 524 | return 0; |
f63a17d6 | 525 | } |
49b26f54 RL |
526 | OSSL_TRACE_BEGIN(TLS) { |
527 | BIO_printf(trc_out, "Handshake hashes:\n"); | |
528 | BIO_dump(trc_out, (char *)hash, hashlen); | |
529 | } OSSL_TRACE_END(TLS); | |
d4d2f3a4 MC |
530 | if (!tls1_PRF(s, |
531 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, | |
532 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, | |
533 | hash, hashlen, | |
534 | NULL, 0, | |
535 | NULL, 0, | |
536 | NULL, 0, p, len, out, | |
537 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
538 | /* SSLfatal() already called */ | |
539 | return 0; | |
540 | } | |
0cfb0e75 DSH |
541 | OPENSSL_cleanse(hash, hashlen); |
542 | } else { | |
d4d2f3a4 MC |
543 | if (!tls1_PRF(s, |
544 | TLS_MD_MASTER_SECRET_CONST, | |
545 | TLS_MD_MASTER_SECRET_CONST_SIZE, | |
546 | s->s3->client_random, SSL3_RANDOM_SIZE, | |
547 | NULL, 0, | |
548 | s->s3->server_random, SSL3_RANDOM_SIZE, | |
549 | NULL, 0, p, len, out, | |
550 | SSL3_MASTER_SECRET_SIZE, 1)) { | |
551 | /* SSLfatal() already called */ | |
552 | return 0; | |
553 | } | |
0cfb0e75 | 554 | } |
49b26f54 RL |
555 | |
556 | OSSL_TRACE_BEGIN(TLS) { | |
557 | BIO_printf(trc_out, "Premaster Secret:\n"); | |
558 | BIO_dump_indent(trc_out, p, len, 4); | |
559 | BIO_printf(trc_out, "Client Random:\n"); | |
560 | BIO_dump_indent(trc_out, s->s3->client_random, SSL3_RANDOM_SIZE, 4); | |
561 | BIO_printf(trc_out, "Server Random:\n"); | |
562 | BIO_dump_indent(trc_out, s->s3->server_random, SSL3_RANDOM_SIZE, 4); | |
563 | BIO_printf(trc_out, "Master Secret:\n"); | |
564 | BIO_dump_indent(trc_out, | |
565 | s->session->master_key, | |
566 | SSL3_MASTER_SECRET_SIZE, 4); | |
567 | } OSSL_TRACE_END(TLS); | |
761772d7 | 568 | |
8c1a5343 MC |
569 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
570 | return 1; | |
0f113f3e | 571 | } |
58964a49 | 572 | |
74b4b494 | 573 | int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, |
0f113f3e MC |
574 | const char *label, size_t llen, |
575 | const unsigned char *context, | |
576 | size_t contextlen, int use_context) | |
577 | { | |
0f113f3e | 578 | unsigned char *val = NULL; |
1c8a527c | 579 | size_t vallen = 0, currentvalpos; |
0f113f3e | 580 | int rv; |
e0af0405 | 581 | |
0f113f3e MC |
582 | /* |
583 | * construct PRF arguments we construct the PRF argument ourself rather | |
584 | * than passing separate values into the TLS PRF to ensure that the | |
585 | * concatenation of values does not create a prohibited label. | |
586 | */ | |
587 | vallen = llen + SSL3_RANDOM_SIZE * 2; | |
588 | if (use_context) { | |
589 | vallen += 2 + contextlen; | |
590 | } | |
591 | ||
592 | val = OPENSSL_malloc(vallen); | |
593 | if (val == NULL) | |
594 | goto err2; | |
595 | currentvalpos = 0; | |
596 | memcpy(val + currentvalpos, (unsigned char *)label, llen); | |
597 | currentvalpos += llen; | |
598 | memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE); | |
599 | currentvalpos += SSL3_RANDOM_SIZE; | |
600 | memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE); | |
601 | currentvalpos += SSL3_RANDOM_SIZE; | |
602 | ||
603 | if (use_context) { | |
604 | val[currentvalpos] = (contextlen >> 8) & 0xff; | |
605 | currentvalpos++; | |
606 | val[currentvalpos] = contextlen & 0xff; | |
607 | currentvalpos++; | |
608 | if ((contextlen > 0) || (context != NULL)) { | |
609 | memcpy(val + currentvalpos, context, contextlen); | |
610 | } | |
611 | } | |
612 | ||
613 | /* | |
614 | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited | |
615 | * label len) = 15, so size of val > max(prohibited label len) = 15 and | |
616 | * the comparisons won't have buffer overflow | |
617 | */ | |
618 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, | |
619 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) | |
620 | goto err1; | |
621 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, | |
622 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) | |
623 | goto err1; | |
624 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, | |
625 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) | |
626 | goto err1; | |
0cfb0e75 DSH |
627 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
628 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) | |
629 | goto err1; | |
0f113f3e MC |
630 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
631 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) | |
632 | goto err1; | |
633 | ||
28ba2541 | 634 | rv = tls1_PRF(s, |
0f113f3e MC |
635 | val, vallen, |
636 | NULL, 0, | |
637 | NULL, 0, | |
638 | NULL, 0, | |
639 | NULL, 0, | |
640 | s->session->master_key, s->session->master_key_length, | |
d4d2f3a4 | 641 | out, olen, 0); |
e0af0405 | 642 | |
0f113f3e MC |
643 | goto ret; |
644 | err1: | |
a230b26e | 645 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
0f113f3e MC |
646 | rv = 0; |
647 | goto ret; | |
648 | err2: | |
649 | SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); | |
650 | rv = 0; | |
651 | ret: | |
05c7b163 | 652 | OPENSSL_clear_free(val, vallen); |
26a7d938 | 653 | return rv; |
0f113f3e | 654 | } |
e0af0405 | 655 | |
6b691a5c | 656 | int tls1_alert_code(int code) |
0f113f3e MC |
657 | { |
658 | switch (code) { | |
659 | case SSL_AD_CLOSE_NOTIFY: | |
26a7d938 | 660 | return SSL3_AD_CLOSE_NOTIFY; |
0f113f3e | 661 | case SSL_AD_UNEXPECTED_MESSAGE: |
26a7d938 | 662 | return SSL3_AD_UNEXPECTED_MESSAGE; |
0f113f3e | 663 | case SSL_AD_BAD_RECORD_MAC: |
26a7d938 | 664 | return SSL3_AD_BAD_RECORD_MAC; |
0f113f3e | 665 | case SSL_AD_DECRYPTION_FAILED: |
26a7d938 | 666 | return TLS1_AD_DECRYPTION_FAILED; |
0f113f3e | 667 | case SSL_AD_RECORD_OVERFLOW: |
26a7d938 | 668 | return TLS1_AD_RECORD_OVERFLOW; |
0f113f3e | 669 | case SSL_AD_DECOMPRESSION_FAILURE: |
26a7d938 | 670 | return SSL3_AD_DECOMPRESSION_FAILURE; |
0f113f3e | 671 | case SSL_AD_HANDSHAKE_FAILURE: |
26a7d938 | 672 | return SSL3_AD_HANDSHAKE_FAILURE; |
0f113f3e | 673 | case SSL_AD_NO_CERTIFICATE: |
26a7d938 | 674 | return -1; |
0f113f3e | 675 | case SSL_AD_BAD_CERTIFICATE: |
26a7d938 | 676 | return SSL3_AD_BAD_CERTIFICATE; |
0f113f3e | 677 | case SSL_AD_UNSUPPORTED_CERTIFICATE: |
26a7d938 | 678 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; |
0f113f3e | 679 | case SSL_AD_CERTIFICATE_REVOKED: |
26a7d938 | 680 | return SSL3_AD_CERTIFICATE_REVOKED; |
0f113f3e | 681 | case SSL_AD_CERTIFICATE_EXPIRED: |
26a7d938 | 682 | return SSL3_AD_CERTIFICATE_EXPIRED; |
0f113f3e | 683 | case SSL_AD_CERTIFICATE_UNKNOWN: |
26a7d938 | 684 | return SSL3_AD_CERTIFICATE_UNKNOWN; |
0f113f3e | 685 | case SSL_AD_ILLEGAL_PARAMETER: |
26a7d938 | 686 | return SSL3_AD_ILLEGAL_PARAMETER; |
0f113f3e | 687 | case SSL_AD_UNKNOWN_CA: |
26a7d938 | 688 | return TLS1_AD_UNKNOWN_CA; |
0f113f3e | 689 | case SSL_AD_ACCESS_DENIED: |
26a7d938 | 690 | return TLS1_AD_ACCESS_DENIED; |
0f113f3e | 691 | case SSL_AD_DECODE_ERROR: |
26a7d938 | 692 | return TLS1_AD_DECODE_ERROR; |
0f113f3e | 693 | case SSL_AD_DECRYPT_ERROR: |
26a7d938 | 694 | return TLS1_AD_DECRYPT_ERROR; |
0f113f3e | 695 | case SSL_AD_EXPORT_RESTRICTION: |
26a7d938 | 696 | return TLS1_AD_EXPORT_RESTRICTION; |
0f113f3e | 697 | case SSL_AD_PROTOCOL_VERSION: |
26a7d938 | 698 | return TLS1_AD_PROTOCOL_VERSION; |
0f113f3e | 699 | case SSL_AD_INSUFFICIENT_SECURITY: |
26a7d938 | 700 | return TLS1_AD_INSUFFICIENT_SECURITY; |
0f113f3e | 701 | case SSL_AD_INTERNAL_ERROR: |
26a7d938 | 702 | return TLS1_AD_INTERNAL_ERROR; |
0f113f3e | 703 | case SSL_AD_USER_CANCELLED: |
26a7d938 | 704 | return TLS1_AD_USER_CANCELLED; |
0f113f3e | 705 | case SSL_AD_NO_RENEGOTIATION: |
26a7d938 | 706 | return TLS1_AD_NO_RENEGOTIATION; |
0f113f3e | 707 | case SSL_AD_UNSUPPORTED_EXTENSION: |
26a7d938 | 708 | return TLS1_AD_UNSUPPORTED_EXTENSION; |
0f113f3e | 709 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: |
26a7d938 | 710 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; |
0f113f3e | 711 | case SSL_AD_UNRECOGNIZED_NAME: |
26a7d938 | 712 | return TLS1_AD_UNRECOGNIZED_NAME; |
0f113f3e | 713 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: |
26a7d938 | 714 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; |
0f113f3e | 715 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: |
26a7d938 | 716 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; |
0f113f3e | 717 | case SSL_AD_UNKNOWN_PSK_IDENTITY: |
26a7d938 | 718 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; |
0f113f3e | 719 | case SSL_AD_INAPPROPRIATE_FALLBACK: |
26a7d938 | 720 | return TLS1_AD_INAPPROPRIATE_FALLBACK; |
06217867 | 721 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
26a7d938 | 722 | return TLS1_AD_NO_APPLICATION_PROTOCOL; |
42c28b63 MC |
723 | case SSL_AD_CERTIFICATE_REQUIRED: |
724 | return SSL_AD_HANDSHAKE_FAILURE; | |
0f113f3e | 725 | default: |
26a7d938 | 726 | return -1; |
0f113f3e MC |
727 | } |
728 | } |