ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 #include <stdio.h>
  60 #include <openssl/objects.h>
  61 #include <openssl/evp.h>
  62 #include <openssl/hmac.h>
  63 #include "ssl_locl.h"
  64
  65 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
  66
  67 #ifndef OPENSSL_NO_TLSEXT
  68 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
  69                                 const unsigned char *sess_id, int sesslen,
  70                                 SSL_SESSION **psess);
  71 #endif
  72
  73 SSL3_ENC_METHOD TLSv1_enc_data={
  74         tls1_enc,
  75         tls1_mac,
  76         tls1_setup_key_block,
  77         tls1_generate_master_secret,
  78         tls1_change_cipher_state,
  79         tls1_final_finish_mac,
  80         TLS1_FINISH_MAC_LENGTH,
  81         tls1_cert_verify_mac,
  82         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
  83         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
  84         tls1_alert_code,
  85         };
  86
  87 long tls1_default_timeout(void)
  88         {
  89         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
  90          * is way too long for http, the cache would over fill */
  91         return(60*60*2);
  92         }
  93
  94 IMPLEMENT_tls1_meth_func(tlsv1_base_method,
  95                         ssl_undefined_function,
  96                         ssl_undefined_function,
  97                         ssl_bad_method)
  98
  99 int tls1_new(SSL *s)
 100         {
 101         if (!ssl3_new(s)) return(0);
 102         s->method->ssl_clear(s);
 103         return(1);
 104         }
 105
 106 void tls1_free(SSL *s)
 107         {
 108         ssl3_free(s);
 109         }
 110
 111 void tls1_clear(SSL *s)
 112         {
 113         ssl3_clear(s);
 114         s->version=TLS1_VERSION;
 115         }
 116
 117 #if 0
 118 long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
 119         {
 120         return(0);
 121         }
 122
 123 long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
 124         {
 125         return(0);
 126         }
 127 #endif
 128
 129 #ifndef OPENSSL_NO_TLSEXT
 130 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 131         {
 132         int extdatalen=0;
 133         unsigned char *ret = p;
 134
 135         ret+=2;
 136
 137         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 138
 139         if (s->tlsext_hostname != NULL)
 140                 {
 141                 /* Add TLS extension servername to the Client Hello message */
 142                 unsigned long size_str;
 143                 long lenmax;
 144
 145                 /* check for enough space.
 146                    4 for the servername type and entension length
 147                    2 for servernamelist length
 148                    1 for the hostname type
 149                    2 for hostname length
 150                    + hostname length
 151                 */
 152
 153                 if ((lenmax = limit - p - 9) < 0
 154                 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 155                         return NULL;
 156
 157                 /* extension type and length */
 158                 s2n(TLSEXT_TYPE_server_name,ret);
 159                 s2n(size_str+5,ret);
 160
 161                 /* length of servername list */
 162                 s2n(size_str+3,ret);
 163
 164                 /* hostname type, length and hostname */
 165                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 166                 s2n(size_str,ret);
 167                 memcpy(ret, s->tlsext_hostname, size_str);
 168                 ret+=size_str;
 169
 170                 }
 171
 172         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 173                 {
 174                 int ticklen;
 175                 if (s->session && s->session->tlsext_tick)
 176                         ticklen = s->session->tlsext_ticklen;
 177                 else
 178                         ticklen = 0;
 179                 /* Check for enough room 2 for extension type, 2 for len
 180                  * rest for ticket
 181                  */
 182                 if (limit - p - 4 - ticklen < 0)
 183                         return NULL;
 184                 s2n(TLSEXT_TYPE_session_ticket,ret);
 185                 s2n(ticklen,ret);
 186                 if (ticklen)
 187                         {
 188                         memcpy(ret, s->session->tlsext_tick, ticklen);
 189                         ret += ticklen;
 190                         }
 191                 }
 192
 193         if ((extdatalen = ret-p-2)== 0)
 194                 return p;
 195
 196         s2n(extdatalen,p);
 197         return ret;
 198         }
 199
 200 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 201         {
 202         int extdatalen=0;
 203         unsigned char *ret = p;
 204
 205         ret+=2;
 206         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 207
 208         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 209                 {
 210                 if (limit - p - 4 < 0) return NULL;
 211
 212                 s2n(TLSEXT_TYPE_server_name,ret);
 213                 s2n(0,ret);
 214                 }
 215
 216         if (s->tlsext_ticket_expected
 217                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 218                 {
 219                 if (limit - p - 4 < 0) return NULL;
 220                 s2n(TLSEXT_TYPE_session_ticket,ret);
 221                 s2n(0,ret);
 222                 }
 223
 224         if ((extdatalen = ret-p-2)== 0)
 225                 return p;
 226
 227         s2n(extdatalen,p);
 228         return ret;
 229         }
 230
 231 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 232         {
 233         unsigned short type;
 234         unsigned short size;
 235         unsigned short len;
 236         unsigned char *data = *p;
 237         s->servername_done = 0;
 238
 239         if (data >= (d+n-2))
 240                 return 1;
 241         n2s(data,len);
 242
 243         if (data > (d+n-len))
 244                 return 1;
 245
 246         while (data <= (d+n-4))
 247                 {
 248                 n2s(data,type);
 249                 n2s(data,size);
 250
 251                 if (data+size > (d+n))
 252                         return 1;
 253
 254                 if (s->tlsext_debug_cb)
 255                         s->tlsext_debug_cb(s, 0, type, data, size,
 256                                                 s->tlsext_debug_arg);
 257 /* The servername extension is treated as follows:
 258
 259    - Only the hostname type is supported with a maximum length of 255.
 260    - The servername is rejected if too long or if it contains zeros,
 261      in which case an fatal alert is generated.
 262    - The servername field is maintained together with the session cache.
 263    - When a session is resumed, the servername call back invoked in order
 264      to allow the application to position itself to the right context.
 265    - The servername is acknowledged if it is new for a session or when
 266      it is identical to a previously used for the same session.
 267      Applications can control the behaviour.  They can at any time
 268      set a 'desirable' servername for a new SSL object. This can be the
 269      case for example with HTTPS when a Host: header field is received and
 270      a renegotiation is requested. In this case, a possible servername
 271      presented in the new client hello is only acknowledged if it matches
 272      the value of the Host: field.
 273    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 274      if they provide for changing an explicit servername context for the session,
 275      i.e. when the session has been established with a servername extension.
 276    - On session reconnect, the servername extension may be absent.
 277
 278 */
 279
 280                 if (type == TLSEXT_TYPE_server_name)
 281                         {
 282                         unsigned char *sdata;
 283                         int servname_type;
 284                         int dsize;
 285
 286                         if (size < 2)
 287                                 {
 288                                 *al = SSL_AD_DECODE_ERROR;
 289                                 return 0;
 290                                 }
 291                         n2s(data,dsize);
 292                         size -= 2;
 293                         if (dsize > size  )
 294                                 {
 295                                 *al = SSL_AD_DECODE_ERROR;
 296                                 return 0;
 297                                 }
 298
 299                         sdata = data;
 300                         while (dsize > 3)
 301                                 {
 302                                 servname_type = *(sdata++);
 303                                 n2s(sdata,len);
 304                                 dsize -= 3;
 305
 306                                 if (len > dsize)
 307                                         {
 308                                         *al = SSL_AD_DECODE_ERROR;
 309                                         return 0;
 310                                         }
 311                                 if (s->servername_done == 0)
 312                                 switch (servname_type)
 313                                         {
 314                                 case TLSEXT_NAMETYPE_host_name:
 315                                         if (s->session->tlsext_hostname == NULL)
 316                                                 {
 317                                                 if (len > TLSEXT_MAXLEN_host_name ||
 318                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 319                                                         {
 320                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 321                                                         return 0;
 322                                                         }
 323                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 324                                                 s->session->tlsext_hostname[len]='\0';
 325                                                 if (strlen(s->session->tlsext_hostname) != len) {
 326                                                         OPENSSL_free(s->session->tlsext_hostname);
 327                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 328                                                         return 0;
 329                                                 }
 330                                                 s->servername_done = 1;
 331
 332                                                 }
 333                                         else
 334                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 335                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 336
 337                                         break;
 338
 339                                 default:
 340                                         break;
 341                                         }
 342
 343                                 dsize -= len;
 344                                 }
 345                         if (dsize != 0)
 346                                 {
 347                                 *al = SSL_AD_DECODE_ERROR;
 348                                 return 0;
 349                                 }
 350
 351                         }
 352                 /* session ticket processed earlier */
 353
 354                 data+=size;
 355                 }
 356
 357         *p = data;
 358         return 1;
 359         }
 360
 361 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 362         {
 363         unsigned short type;
 364         unsigned short size;
 365         unsigned short len;
 366         unsigned char *data = *p;
 367
 368         int tlsext_servername = 0;
 369
 370         if (data >= (d+n-2))
 371                 return 1;
 372
 373         n2s(data,len);
 374
 375         while(data <= (d+n-4))
 376                 {
 377                 n2s(data,type);
 378                 n2s(data,size);
 379
 380                 if (data+size > (d+n))
 381                         return 1;
 382
 383                 if (s->tlsext_debug_cb)
 384                         s->tlsext_debug_cb(s, 1, type, data, size,
 385                                                 s->tlsext_debug_arg);
 386
 387                 if (type == TLSEXT_TYPE_server_name)
 388                         {
 389                         if (s->tlsext_hostname == NULL || size > 0)
 390                                 {
 391                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
 392                                 return 0;
 393                                 }
 394                         tlsext_servername = 1;
 395                         }
 396                 else if (type == TLSEXT_TYPE_session_ticket)
 397                         {
 398                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 399                                 || (size > 0))
 400                                 {
 401                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 402                                 return 0;
 403                                 }
 404                         s->tlsext_ticket_expected = 1;
 405                         }
 406
 407                 data+=size;
 408                 }
 409
 410         if (data != d+n)
 411                 {
 412                 *al = SSL_AD_DECODE_ERROR;
 413                 return 0;
 414                 }
 415
 416         if (!s->hit && tlsext_servername == 1)
 417                 {
 418                 if (s->tlsext_hostname)
 419                         {
 420                         if (s->session->tlsext_hostname == NULL)
 421                                 {
 422                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
 423                                 if (!s->session->tlsext_hostname)
 424                                         {
 425                                         *al = SSL_AD_UNRECOGNIZED_NAME;
 426                                         return 0;
 427                                         }
 428                                 }
 429                         else
 430                                 {
 431                                 *al = SSL_AD_DECODE_ERROR;
 432                                 return 0;
 433                                 }
 434                         }
 435                 }
 436
 437         *p = data;
 438         return 1;
 439         }
 440
 441 int ssl_check_clienthello_tlsext(SSL *s)
 442         {
 443         int ret=SSL_TLSEXT_ERR_NOACK;
 444         int al = SSL_AD_UNRECOGNIZED_NAME;
 445
 446         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 447                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 448         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 449                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 450
 451         switch (ret)
 452                 {
 453                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 454                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 455                         return -1;
 456
 457                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 458                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 459                         return 1;
 460
 461                 case SSL_TLSEXT_ERR_NOACK:
 462                         s->servername_done=0;
 463                         default:
 464                 return 1;
 465                 }
 466         }
 467
 468 int ssl_check_serverhello_tlsext(SSL *s)
 469         {
 470         int ret=SSL_TLSEXT_ERR_NOACK;
 471         int al = SSL_AD_UNRECOGNIZED_NAME;
 472
 473         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 474                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 475         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 476                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 477
 478         switch (ret)
 479                 {
 480                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 481                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 482                         return -1;
 483
 484                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 485                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 486                         return 1;
 487
 488                 case SSL_TLSEXT_ERR_NOACK:
 489                         s->servername_done=0;
 490                         default:
 491                 return 1;
 492                 }
 493         }
 494
 495 /* Since the server cache lookup is done early on in the processing of client
 496  * hello and other operations depend on the result we need to handle any TLS
 497  * session ticket extension at the same time.
 498  */
 499
 500 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
 501                                 const unsigned char *limit, SSL_SESSION **ret)
 502         {
 503         /* Point after session ID in client hello */
 504         const unsigned char *p = session_id + len;
 505         unsigned short i;
 506         if ((s->version <= SSL3_VERSION) || !limit)
 507                 return 1;
 508         if (p >= limit)
 509                 return -1;
 510         /* Skip past cipher list */
 511         n2s(p, i);
 512         p+= i;
 513         if (p >= limit)
 514                 return -1;
 515         /* Skip past compression algorithm list */
 516         i = *(p++);
 517         p += i;
 518         if (p > limit)
 519                 return -1;
 520         /* Now at start of extensions */
 521         if ((p + 2) >= limit)
 522                 return 1;
 523         n2s(p, i);
 524         while ((p + 4) <= limit)
 525                 {
 526                 unsigned short type, size;
 527                 n2s(p, type);
 528                 n2s(p, size);
 529                 if (p + size > limit)
 530                         return 1;
 531                 if (type == TLSEXT_TYPE_session_ticket)
 532                         {
 533                         /* If tickets disabled indicate cache miss which will
 534                          * trigger a full handshake
 535                          */
 536                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
 537                                 return 0;
 538                         /* If zero length not client will accept a ticket
 539                          * and indicate cache miss to trigger full handshake
 540                          */
 541                         if (size == 0)
 542                                 {
 543                                 s->tlsext_ticket_expected = 1;
 544                                 return 0;       /* Cache miss */
 545                                 }
 546                         return tls_decrypt_ticket(s, p, size, session_id, len,
 547                                                                         ret);
 548                         }
 549                 p += size;
 550                 }
 551         return 1;
 552         }
 553
 554 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
 555                                 const unsigned char *sess_id, int sesslen,
 556                                 SSL_SESSION **psess)
 557         {
 558         SSL_SESSION *sess;
 559         unsigned char *sdec;
 560         const unsigned char *p;
 561         int slen, mlen;
 562         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
 563         HMAC_CTX hctx;
 564         EVP_CIPHER_CTX ctx;
 565         /* Attempt to process session ticket, first conduct sanity and
 566          * integrity checks on ticket.
 567          */
 568         mlen = EVP_MD_size(tlsext_tick_md());
 569         eticklen -= mlen;
 570         /* Need at least keyname + iv + some encrypted data */
 571         if (eticklen < 48)
 572                 goto tickerr;
 573         /* Check key name matches */
 574         if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
 575                 goto tickerr;
 576         /* Check HMAC of encrypted ticket */
 577         HMAC_CTX_init(&hctx);
 578         HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
 579                                 tlsext_tick_md(), NULL);
 580         HMAC_Update(&hctx, etick, eticklen);
 581         HMAC_Final(&hctx, tick_hmac, NULL);
 582         HMAC_CTX_cleanup(&hctx);
 583         if (memcmp(tick_hmac, etick + eticklen, mlen))
 584                 goto tickerr;
 585         /* Set p to start of IV */
 586         p = etick + 16;
 587         EVP_CIPHER_CTX_init(&ctx);
 588         /* Attempt to decrypt session data */
 589         EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
 590                                         s->ctx->tlsext_tick_aes_key, p);
 591         /* Move p after IV to start of encrypted ticket, update length */
 592         p += 16;
 593         eticklen -= 32;
 594         sdec = OPENSSL_malloc(eticklen);
 595         if (!sdec)
 596                 {
 597                 EVP_CIPHER_CTX_cleanup(&ctx);
 598                 return -1;
 599                 }
 600         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
 601         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
 602                 goto tickerr;
 603         slen += mlen;
 604         EVP_CIPHER_CTX_cleanup(&ctx);
 605         p = sdec;
 606
 607         sess = d2i_SSL_SESSION(NULL, &p, slen);
 608         OPENSSL_free(sdec);
 609         if (sess)
 610                 {
 611                 /* The session ID if non-empty is used by some clients to
 612                  * detect that the ticket has been accepted. So we copy it to
 613                  * the session structure. If it is empty set length to zero
 614                  * as required by standard.
 615                  */
 616                 if (sesslen)
 617                         memcpy(sess->session_id, sess_id, sesslen);
 618                 sess->session_id_length = sesslen;
 619                 *psess = sess;
 620                 return 1;
 621                 }
 622         /* If session decrypt failure indicate a cache miss and set state to
 623          * send a new ticket
 624          */
 625         tickerr:
 626         s->tlsext_ticket_expected = 1;
 627         return 0;
 628         }
 629
 630 #endif