diff --git a/UPDATING b/UPDATING index b33065306a1e..dcb82fbcf4a6 100644 --- a/UPDATING +++ b/UPDATING @@ -1,2131 +1,2135 @@ Updating Information for FreeBSD stable/12 users. This file is maintained and copyrighted by M. Warner Losh . See end of file for further details. For commonly done items, please see the COMMON ITEMS: section later in the file. These instructions assume that you basically know what you are doing. If not, then please consult the FreeBSD handbook: https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. NOTE: FreeBSD has switched from gcc to clang. If you have trouble bootstrapping from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20210325: p5 FreeBSD-SA-21:07.openssl + + Fix multiple OpenSSL issues [SA-21:07.openssl] + 20210223: p4 FreeBSD-SA-21:03.pam_login_access FreeBSD-SA-21:04.jail_remove FreeBSD-SA-21:05.jail_chdir FreeBSD-SA-21:06.xen FreeBSD-EN-21:06.microcode FreeBSD-EN-21:07.caroot FreeBSD-EN-21:08.freebsd-update login.access fails to apply rules [SA-21:03.pam_login_access] jail_remove(2) fails to kill all jailed processes [SA-21:04.jail_remove] jail_attach(2) relies on the caller to change the cwd [SA-21:05.jail_chdir] Xen grant mapping error handling issues [SA-21:06.xen] Boot-time microcode loading causes a boot hang [EN-21:06.microcode] Root certificate bundle update [EN-21:07.caroot] freebsd-update passwd regeneration [EN-21:08.freebsd-update] 20210128: p3 FreeBSD-EN-21:01.tzdata FreeBSD-EN-21:03.vnet FreeBSD-EN-21:04.zfs FreeBSD-SA-21:01.fsdisclosure FreeBSD-SA-21:02.xenoom Update timezone database information [EN-21:01.tzdata] Panic when destroying VNET and epair simultaneously [EN-21:03.vnet] zfs recv fails to propagate snapshot deletion [EN-21:04.zfs] Uninitialized file system kernel stack leaks [SA-21:01.fsdisclosure] Xen guest-triggered out of memory [SA-21:02.xenoom] 20201208: p2 FreeBSD-SA-20:33.openssl Fix OpenSSL NULL pointer de-reference. [SA-20:33.openssl] 20201201: p1 FreeBSD-EN-20:19.audit FreeBSD-EN-20:20.tzdata FreeBSD-EN-20:21.ipfw FreeBSD-EN-20:22.callout FreeBSD-SA-20:31.icmp6 FreeBSD-SA-20:32.rtsold Fix execve/fexecve system call auditing. [EN-20:19.audit] Update timezone database information. [EN-20:20.tzdata] Fix uninitialized variable in ipfw. [EN-20:21.ipfw] Fix race condition in callout CPU migration. [EN-20:22.callout] Fix ICMPv6 use-after-free in error message handling. [SA-20:31.icmp6] Fix multiple vulnerabilities in rtsold. [SA-20:32.rtsold] 20201027: 12.2-RELEASE. 20200915: p1 FreeBSD-SA-20:27.ure FreeBSD-SA-20:28.bhyve_vmcs FreeBSD-SA-20:29.bhyve_svm FreeBSD-SA-20:30.ftpd Fix ure device driver susceptible to packet-in-packet attack. [SA-20:27.ure] Fix bhyve privilege escalation via VMCS access. [SA-20:28.bhyve_vmcs] Fix bhyve SVM guest escape. [SA-20:29.bhyve_svm] Fix ftpd privilege escalation via ftpchroot. [SA-20:30.ftpd] 20200912: The make.conf(5) MALLOC_PRODUCTION variable, used for disabling and enabling assertions and statistics gathering in malloc(3), has been migrated to a src.conf(5) WITH/WITHOUT_MALLOC_PRODUCTION option. On stable branches, WITH_MALLOC_PRODUCTION is set by default, which means that malloc(3) has assertions and statistics gathering disabled, for improved performance. For backwards compatibility, the make.conf(5) MALLOC_PRODUCTION is still honored, but it is now deprecated and undocumented. 20200909: The resume code now notifies devd with the 'kernel' system rather than the old 'kern' subsystem to be consistent with other use. The old notification will be created as well, but will be removed prior to FreeBSD 14.0. 20200722: Clang, llvm, lld, lldb, compiler-rt, libc++, libunwind and openmp have been upgraded to 10.0.1. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20200708: read(2) of a directory fd is now rejected by default. root may re-enable it for the entire system with the security.bsd.allow_read_dir sysctl(8) MIB. It may be advised to setup aliases for grep to default to `-d skip` if commonly non-recursively grepping a list that includes directories and the potential for the resulting stderr output is not tolerable. Example aliases are now installed, commented out, in /root/.cshrc. 20200414: Upstream DTS from Linux 5.6 was merged and they now have the SID and THS (Secure ID controller and THermal Sensor) node present. The DTB overlays have now been removed from the tree for the H3/H5 and A64 SoCs and the aw_sid and aw_thermal driver have been updated to deal with upstream DTS. If you are using those overlays you need to remove them from loader.conf and update the DTBs on the FAT partition. 20200501: Clang, llvm, lld, lldb, compiler-rt, libc++, libunwind and openmp have been upgraded to 10.0.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20200430: The root certificates of the Mozilla CA Certificate Store have been imported into the base system and can be managed with the certctl(8) utility. If you have installed the security/ca_root_nss port or package with the ETCSYMLINK option (the default), be advised that there may be differences between those included in the port and those included in base due to differences in nss branch used as well as general update frequency. Note also that certctl(8) cannot manage certs in the format used by the security/ca_root_nss port. 20200107: Clang, llvm, lld, lldb, compiler-rt, libc++, libunwind and openmp have been upgraded to 9.0.1. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20191107: The nctgpio and wbwd drivers have been moved to the superio bus. If you have one of these drivers in a kernel configuration, then you should add device superio to it. If you use one of these drivers as a module and you compile a custom set of modules, then you should add superio to the set. 20191024: The tap(4) driver has been folded into tun(4), and the module has been renamed to tuntap. You should update any kld_list="if_tap" or kld_list="if_tun" entries in /etc/rc.conf, if_tap_load="YES" or if_tun_load="YES" entries in /boot/loader.conf to load the if_tuntap module instead, and "device tap" or "device tun" entries in kernel config files to select the tuntap device instead. 20190913: ntpd no longer by default locks its pages in memory, allowing them to be paged out by the kernel. Use rlimit memlock to restore historic BSD behaviour. For example, add "rlimit memlock 32" to ntp.conf to lock up to 32 MB of ntpd address space in memory. 20190914: The vfs.fusefs.sync_unmount and vfs.fusefs.init_backgrounded sysctls and the "-o sync_unmount" and "-o init_backgrounded" mount options have been removed from mount_fusefs(8). You can safely remove them from your scripts, because they had no effect. The vfs.fusefs.fix_broken_io, vfs.fusefs.sync_resize, vfs.fusefs.refresh_size, vfs.fusefs.mmap_enable, vfs.fusefs.reclaim_revoked, and vfs.fusefs.data_cache_invalidate sysctls have been removed. If you felt the need to set any of them to a non-default value, please tell asomers@FreeBSD.org why. 20190906: The fuse(4) module has been renamed to fusefs(4) for consistency with other filesystems. You should update any kld_load="fuse" entries in /etc/rc.conf, fuse_load="YES" entries in /boot/loader.conf, and "options FUSE" enties in kernel config files. 20190811: Default permissions on the /var/account/acct file (and copies of it rotated by periodic daily scripts) are changed from 0644 to 0640 because the file contains sensitive information that should not be world-readable. If the /var/account directory must be created by rc.d/accounting, the mode used is now 0750. Admins who use the accounting feature are encouraged to change the mode of an existing /var/account directory to 0750 or 0700. 20190723: Clang, llvm, lld, lldb, compiler-rt, libc++, libunwind and openmp have been upgraded to 8.0.1. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20190413: Now Clang 8 has been merged (see the 20190412 entry below), the ifunc functionality needed for the RETPOLINE option should work properly again. The RETPOLINE option has been removed from BROKEN_OPTIONS. 20190412: Clang, llvm, lld, lldb, compiler-rt and libc++ have been upgraded to 8.0.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20190307: The RETPOLINE option produces non-functional ifunc-using binaries with Clang 7.0.1, and has been forced off (via BROKEN_OPTIONS). Once Clang 8 is merged it may be enabled again. 20190216: Clang, llvm, lld, lldb, compiler-rt and libc++ have been upgraded to 7.0.1. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20190226: geom_uzip(4) depends on the new module xz. If geom_uzip is statically compiled into your custom kernel, add 'device xz' statement to the kernel config. 20190214: Iflib is no longer unconditionally compiled into the kernel. Drivers using iflib and statically compiled into the kernel, now require the 'device iflib' config option. For the same drivers loaded as modules on kernels not having 'device iflib', the iflib.ko module is loaded automatically. 20181228: r342561 modifies the NFSv4 server so that it obeys vfs.nfsd.nfs_privport in the same as it is applied to NFSv2 and 3. This implies that NFSv4 servers that have vfs.nfsd.nfs_privport set will only allow mounts from clients using a reserved port#. Since both the FreeBSD and Linux NFSv4 clients use reserved port#s by default, this should not affect most NFSv4 mounts. 20181129: On amd64, arm64 and armv7 (architectures that install LLVM's ld.lld linker as /usr/bin/ld) GNU ld is no longer installed as ld.bfd, as it produces broken binaries when ifuncs are in use. Users needing GNU ld should install the binutils port or package. 20181115: The set of CTM commands (ctm, ctm_smail, ctm_rmail, ctm_dequeue) has been converted to a port (misc/ctm) and will be removed from FreeBSD-13. A depreciation warning will be printed to stderr by the ctm command, but the functionality will remain in base for all FreeBSD-12 releases. 20181019: The stable/12 branch has been created in subversion from head revision r339432. 20181015: Ports for the DRM modules have been simplified. Now, amd64 users should just install the drm-kmod port. All others should install drm-legacy-kmod. Graphics hardware that's newer than about 2010 usually works with drm-kmod. For hardware older than 2013, however, some users will need to use drm-legacy-kmod if drm-kmod doesn't work for them. Hardware older than 2008 usually only works in drm-legacy-kmod. The graphics team can only commit to hardware made since 2013 due to the complexity of the market and difficulty to test all the older cards effectively. If you have hardware supported by drm-kmod, you are strongly encouraged to use that as you will get better support. Other than KPI chasing, drm-legacy-kmod will not be updated. As outlined elsewhere, the drm and drm2 modules will be eliminated from the src base soon (with a limited exception for arm). Please update to the package asap and report any issues to x11@freebsd.org. Generally, anybody using the drm*-kmod packages should add WITHOUT_DRM_MODULE=t and WITHOUT_DRM2_MODULE=t to avoid nasty cross-threading surprises, especially with automatic driver loading from X11 startup. These will become the defaults in 13-current shortly. 20181012: The ixlv(4) driver has been renamed to iavf(4). As a consequence, custom kernel and module loading configuration files must be updated accordingly. Moreover, interfaces previous presented as ixlvN to the system are now exposed as iavfN and network configuration files must be adjusted as necessary. 20181009: OpenSSL has been updated to version 1.1.1. This update included additional various API changes througout the base system. It is important to rebuild third-party software after upgrading. The value of __FreeBSD_version has been bumped accordingly. 20181006: The legacy DRM modules and drivers have now been added to the loader's module blacklist, in favor of loading them with kld_list in rc.conf(5). The module blacklist may be overridden with the loader.conf(5) 'module_blacklist' variable, but loading them via rc.conf(5) is strongly encouraged. 20181002: The cam(4) based nda(4) driver will be used over nvd(4) by default on powerpc64. You may set 'options NVME_USE_NVD=1' in your kernel conf or loader tunable 'hw.nvme.use_nvd=1' if you wish to use the existing driver. Make sure to edit /boot/etc/kboot.conf and fstab to use the nda device name. 20180913: Reproducible build mode is now on by default, in preparation for FreeBSD 12.0. This eliminates build metadata such as the user, host, and time from the kernel (and uname), unless the working tree corresponds to a modified checkout from a version control system. The previous behavior can be obtained by setting the /etc/src.conf knob WITHOUT_REPRODUCIBLE_BUILD. 20180826: The Yarrow CSPRNG has been removed from the kernel as it has not been supported by its designers since at least 2003. Fortuna has been the default since FreeBSD-11. 20180822: devctl freeze/thaw have gone into the tree, the rc scripts have been updated to use them and devmatch has been changed. You should update kernel, userland and rc scripts all at the same time. 20180818: The default interpreter has been switched from 4th to Lua. LOADER_DEFAULT_INTERP, documented in build(7), will override the default interpreter. If you have custom FORTH code you will need to set LOADER_DEFAULT_INTERP=4th (valid values are 4th, lua or simp) in src.conf for the build. This will create default hard links between loader and loader_4th instead of loader and loader_lua, the new default. If you are using UEFI it will create the proper hard link to loader.efi. bhyve uses userboot.so. It remains 4th-only until some issues are solved regarding coexisting with multiple versions of FreeBSD are resolved. 20180815: ls(1) now respects the COLORTERM environment variable used in other systems and software to indicate that a colored terminal is both supported and desired. If ls(1) is suddenly emitting colors, they may be disabled again by either removing the unwanted COLORTERM from your environment, or using `ls --color=never`. The ls(1) specific CLICOLOR may not be observed in a future release. 20180808: The default pager for most commands has been changed to "less". To restore the old behavior, set PAGER="more" and MANPAGER="more -s" in your environment. 20180731: The jedec_ts(4) driver has been removed. A superset of its functionality is available in the jedec_dimm(4) driver, and the manpage for that driver includes migration instructions. If you have "device jedec_ts" in your kernel configuration file, it must be removed. 20180730: amd64/GENERIC now has EFI runtime services, EFIRT, enabled by default. This should have no effect if the kernel is booted via BIOS/legacy boot. EFIRT may be disabled via a loader tunable, efi.rt.disabled, if a system has a buggy firmware that prevents a successful boot due to use of runtime services. 20180727: Atmel AT91RM9200 and AT91SAM9, Cavium CNS 11xx and XScale support has been removed from the tree. These ports were obsolete and/or known to be broken for many years. 20180723: loader.efi has been augmented to participate more fully in the UEFI boot manager protocol. loader.efi will now look at the BootXXXX environment variable to determine if a specific kernel or root partition was specified. XXXX is derived from BootCurrent. efibootmgr(8) manages these standard UEFI variables. 20180720: zfsloader's functionality has now been folded into loader. zfsloader is no longer necessary once you've updated your boot blocks. For a transition period, we will install a hardlink for zfsloader to loader to allow a smooth transition until the boot blocks can be updated (hard link because old zfs boot blocks don't understand symlinks). 20180719: ARM64 now have efifb support, if you want to have serial console on your arm64 board when an screen is connected and the bootloader setup a frambuffer for us to use, just add : boot_serial=YES boot_multicons=YES in /boot/loader.conf For Raspberry Pi 3 (RPI) users, this is needed even if you don't have an screen connected as the firmware will setup a framebuffer are that u-boot will expose as an EFI framebuffer. 20180719: New uid:gid added, ntpd:ntpd (123:123). Be sure to run mergemaster or take steps to update /etc/passwd before doing installworld on existing systems. Do not skip the "mergemaster -Fp" step before installworld, as described in the update procedures near the bottom of this document. Also, rc.d/ntpd now starts ntpd(8) as user ntpd if the new mac_ntpd(4) policy is available, unless ntpd_flags or the ntp config file contain options that change file/dir locations. When such options (e.g., "statsdir" or "crypto") are used, ntpd can still be run as non-root by setting ntpd_user=ntpd in rc.conf, after taking steps to ensure that all required files/dirs are accessible by the ntpd user. 20180717: Big endian arm support has been removed. 20180711: The static environment setup in kernel configs is no longer mutually exclusive with the loader(8) environment by default. In order to restore the previous default behavior of disabling the loader(8) environment if a static environment is present, you must specify loader_env.disabled=1 in the static environment. 20180705: The ABI of syscalls used by management tools like sockstat and netstat has been broken to allow 32-bit binaries to work on 64-bit kernels without modification. These programs will need to match the kernel in order to function. External programs may require minor modifications to accommodate a change of type in structures from pointers to 64-bit virtual addresses. 20180702: On i386 and amd64 atomics are now inlined. Out of tree modules using atomics will need to be rebuilt. 20180701: The '%I' format in the kern.corefile sysctl limits the number of core files that a process can generate to the number stored in the debug.ncores sysctl. The '%I' format is replaced by the single digit index. Previously, if all indexes were taken the kernel would overwrite only a core file with the highest index in a filename. Currently the system will create a new core file if there is a free index or if all slots are taken it will overwrite the oldest one. 20180630: Clang, llvm, lld, lldb, compiler-rt and libc++ have been upgraded to 6.0.1. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20180628: r335753 introduced a new quoting method. However, etc/devd/devmatch.conf needed to be changed to work with it. This change was made with r335763 and requires a mergemaster / etcupdate / etc to update the installed file. 20180612: r334930 changed the interface between the NFS modules, so they all need to be rebuilt. r335018 did a __FreeBSD_version bump for this. 20180530: As of r334391 lld is the default amd64 system linker; it is installed as /usr/bin/ld. Kernel build workarounds (see 20180510 entry) are no longer necessary. 20180530: The kernel / userland interface for devinfo changed, so you'll need a new kernel and userland as a pair for it to work (rebuilding lib/libdevinfo is all that's required). devinfo and devmatch will not work, but everything else will when there's a mismatch. 20180523: The on-disk format for hwpmc callchain records has changed to include threadid corresponding to a given record. This changes the field offsets and thus requires that libpmcstat be rebuilt before using a kernel later than r334108. 20180517: The vxge(4) driver has been removed. This driver was introduced into HEAD one week before the Exar left the Ethernet market and is not known to be used. If you have device vxge in your kernel config file it must be removed. 20180510: The amd64 kernel now requires a ld that supports ifunc to produce a working kernel, either lld or a newer binutils. lld is built by default on amd64, and the 'buildkernel' target uses it automatically. However, it is not the default linker, so building the kernel the traditional way requires LD=ld.lld on the command line (or LD=/usr/local/bin/ld for binutils port/package). lld will soon be default, and this requirement will go away. NOTE: As of r334391 lld is the default system linker on amd64, and no workaround is necessary. 20180508: The nxge(4) driver has been removed. This driver was for PCI-X 10g cards made by s2io/Neterion. The company was aquired by Exar and no longer sells or supports Ethernet products. If you have device nxge in your kernel config file it must be removed. 20180504: The tz database (tzdb) has been updated to 2018e. This version more correctly models time stamps in time zones with negative DST such as Europe/Dublin (from 1971 on), Europe/Prague (1946/7), and Africa/Windhoek (1994/2017). This does not affect the UT offsets, only time zone abbreviations and the tm_isdst flag. 20180502: The ixgb(4) driver has been removed. This driver was for an early and uncommon legacy PCI 10GbE for a single ASIC, Intel 82597EX. Intel quickly shifted to the long lived ixgbe family. If you have device ixgb in your kernel config file it must be removed. 20180501: The lmc(4) driver has been removed. This was a WAN interface card that was already reportedly rare in 2003, and had an ambiguous license. If you have device lmc in your kernel config file it must be removed. 20180413: Support for Arcnet networks has been removed. If you have device arcnet or device cm in your kernel config file they must be removed. 20180411: Support for FDDI networks has been removed. If you have device fddi or device fpa in your kernel config file they must be removed. 20180406: In addition to supporting RFC 3164 formatted messages, the syslogd(8) service is now capable of parsing RFC 5424 formatted log messages. The main benefit of using RFC 5424 is that clients may now send log messages with timestamps containing year numbers, microseconds and time zone offsets. Similarly, the syslog(3) C library function has been altered to send RFC 5424 formatted messages to the local system logging daemon. On systems using syslogd(8), this change should have no negative impact, as long as syslogd(8) and the C library are updated at the same time. On systems using a different system logging daemon, it may be necessary to make configuration adjustments, depending on the software used. When using syslog-ng, add the 'syslog-protocol' flag to local input sources to enable parsing of RFC 5424 formatted messages: source src { unix-dgram("/var/run/log" flags(syslog-protocol)); } When using rsyslog, disable the 'SysSock.UseSpecialParser' option of the 'imuxsock' module to let messages be processed by the regular RFC 3164/5424 parsing pipeline: module(load="imuxsock" SysSock.UseSpecialParser="off") Do note that these changes only affect communication between local applications and syslogd(8). The format that syslogd(8) uses to store messages on disk or forward messages to other systems remains unchanged. syslogd(8) still uses RFC 3164 for these purposes. Options to customize this behaviour will be added in the future. Utilities that process log files stored in /var/log are thus expected to continue to function as before. __FreeBSD_version has been incremented to 1200061 to denote this change. 20180328: Support for token ring networks has been removed. If you have "device token" in your kernel config you should remove it. No device drivers supported token ring. 20180323: makefs was modified to be able to tag ISO9660 El Torito boot catalog entries as EFI instead of overloading the i386 tag as done previously. The amd64 mkisoimages.sh script used to build amd64 ISO images for release was updated to use this. This may mean that makefs must be updated before "make cdrom" can be run in the release directory. This should be as simple as: $ cd $SRCDIR/usr.sbin/makefs $ make depend all install 20180212: FreeBSD boot loader enhanced with Lua scripting. It's purely opt-in for now by building WITH_LOADER_LUA and WITHOUT_FORTH in /etc/src.conf. Co-existance for the transition period will come shortly. Booting is a complex environment and test coverage for Lua-enabled loaders has been thin, so it would be prudent to assume it might not work and make provisions for backup boot methods. 20180211: devmatch functionality has been turned on in devd. It will automatically load drivers for unattached devices. This may cause unexpected drivers to be loaded. Please report any problems to current@ and imp@freebsd.org. 20180114: Clang, llvm, lld, lldb, compiler-rt and libc++ have been upgraded to 6.0.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20180110: LLVM's lld linker is now used as the FreeBSD/amd64 bootstrap linker. This means it is used to link the kernel and userland libraries and executables, but is not yet installed as /usr/bin/ld by default. To revert to ld.bfd as the bootstrap linker, in /etc/src.conf set WITHOUT_LLD_BOOTSTRAP=yes 20180110: On i386, pmtimer has been removed. Its functionality has been folded into apm. It was a no-op on ACPI in current for a while now (but was still needed on i386 in FreeBSD 11 and earlier). Users may need to remove it from kernel config files. 20180104: The use of RSS hash from the network card aka flowid has been disabled by default for lagg(4) as it's currently incompatible with the lacp and loadbalance protocols. This can be re-enabled by setting the following in loader.conf: net.link.lagg.default_use_flowid="1" 20180102: The SW_WATCHDOG option is no longer necessary to enable the hardclock-based software watchdog if no hardware watchdog is configured. As before, SW_WATCHDOG will cause the software watchdog to be enabled even if a hardware watchdog is configured. 20171215: r326887 fixes the issue described in the 20171214 UPDATING entry. r326888 flips the switch back to building GELI support always. 20171214: r362593 broke ZFS + GELI support for reasons unknown. However, it also broke ZFS support generally, so GELI has been turned off by default as the lesser evil in r326857. If you boot off ZFS and/or GELI, it might not be a good time to update. 20171125: PowerPC users must update loader(8) by rebuilding world before installing a new kernel, as the protocol connecting them has changed. Without the update, loader metadata will not be passed successfully to the kernel and users will have to enter their root partition at the kernel mountroot prompt to continue booting. Newer versions of loader can boot old kernels without issue. 20171110: The LOADER_FIREWIRE_SUPPORT build variable as been renamed to WITH/OUT_LOADER_FIREWIRE. LOADER_{NO_,}GELI_SUPPORT has been renamed to WITH/OUT_LOADER_GELI. 20171106: The naive and non-compliant support of posix_fallocate(2) in ZFS has been removed as of r325320. The system call now returns EINVAL when used on a ZFS file. Although the new behavior complies with the standard, some consumers are not prepared to cope with it. One known victim is lld prior to r325420. 20171102: Building in a FreeBSD src checkout will automatically create object directories now rather than store files in the current directory if 'make obj' was not ran. Calling 'make obj' is no longer necessary. This feature can be disabled by setting WITHOUT_AUTO_OBJ=yes in /etc/src-env.conf (not /etc/src.conf), or passing the option in the environment. 20171101: The default MAKEOBJDIR has changed from /usr/obj/ for native builds, and /usr/obj// for cross-builds, to a unified /usr/obj//. This behavior can be changed to the old format by setting WITHOUT_UNIFIED_OBJDIR=yes in /etc/src-env.conf, the environment, or with -DWITHOUT_UNIFIED_OBJDIR when building. The UNIFIED_OBJDIR option is a transitional feature that will be removed for 12.0 release; please migrate to the new format for any tools by looking up the OBJDIR used by 'make -V .OBJDIR' means rather than hardcoding paths. 20171028: The native-xtools target no longer installs the files by default to the OBJDIR. Use the native-xtools-install target with a DESTDIR to install to ${DESTDIR}/${NXTP} where NXTP defaults to /nxb-bin. 20171021: As part of the boot loader infrastructure cleanup, LOADER_*_SUPPORT options are changing from controlling the build if defined / undefined to controlling the build with explicit 'yes' or 'no' values. They will shift to WITH/WITHOUT options to match other options in the system. 20171010: libstand has turned into a private library for sys/boot use only. It is no longer supported as a public interface outside of sys/boot. 20171005: The arm port has split armv6 into armv6 and armv7. armv7 is now a valid TARGET_ARCH/MACHINE_ARCH setting. If you have an armv7 system and are running a kernel from before r324363, you will need to add MACHINE_ARCH=armv7 to 'make buildworld' to do a native build. 20171003: When building multiple kernels using KERNCONF, non-existent KERNCONF files will produce an error and buildkernel will fail. Previously missing KERNCONF files silently failed giving no indication as to why, only to subsequently discover during installkernel that the desired kernel was never built in the first place. 20170912: The default serial number format for CTL LUNs has changed. This will affect users who use /dev/diskid/* device nodes, or whose FibreChannel or iSCSI clients care about their LUNs' serial numbers. Users who require serial number stability should hardcode serial numbers in /etc/ctl.conf . 20170912: For 32-bit arm compiled for hard-float support, soft-floating point binaries now always get their shared libraries from LD_SOFT_LIBRARY_PATH (in the past, this was only used if /usr/libsoft also existed). Only users with a hard-float ld.so, but soft-float everything else should be affected. 20170826: The geli password typed at boot is now hidden. To restore the previous behavior, see geli(8) for configuration options. 20170825: Move PMTUD blackhole counters to TCPSTATS and remove them from bare sysctl values. Minor nit, but requires a rebuild of both world/kernel to complete. 20170814: "make check" behavior (made in ^/head@r295380) has been changed to execute from a limited sandbox, as opposed to executing from ${TESTSDIR}. Behavioral changes: - The "beforecheck" and "aftercheck" targets are now specified. - ${CHECKDIR} (added in commit noted above) has been removed. - Legacy behavior can be enabled by setting WITHOUT_MAKE_CHECK_USE_SANDBOX in src.conf(5) or the environment. If the limited sandbox mode is enabled, "make check" will execute "make distribution", then install, execute the tests, and clean up the sandbox if successful. The "make distribution" and "make install" targets are typically run as root to set appropriate permissions and ownership at installation time. The end-user should set "WITH_INSTALL_AS_USER" in src.conf(5) or the environment if executing "make check" with limited sandbox mode using an unprivileged user. 20170808: Since the switch to GPT disk labels, fsck for UFS/FFS has been unable to automatically find alternate superblocks. As of r322297, the information needed to find alternate superblocks has been moved to the end of the area reserved for the boot block. Filesystems created with a newfs of this vintage or later will create the recovery information. If you have a filesystem created prior to this change and wish to have a recovery block created for your filesystem, you can do so by running fsck in foreground mode (i.e., do not use the -p or -y options). As it starts, fsck will ask ``SAVE DATA TO FIND ALTERNATE SUPERBLOCKS'' to which you should answer yes. 20170728: As of r321665, an NFSv4 server configuration that services Kerberos mounts or clients that do not support the uid/gid in owner/owner_group string capability, must explicitly enable the nfsuserd daemon by adding nfsuserd_enable="YES" to the machine's /etc/rc.conf file. 20170722: Clang, llvm, lldb, compiler-rt and libc++ have been upgraded to 5.0.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20170701: WITHOUT_RCMDS is now the default. Set WITH_RCMDS if you need the r-commands (rlogin, rsh, etc.) to be built with the base system. 20170625: The FreeBSD/powerpc platform now uses a 64-bit type for time_t. This is a very major ABI incompatible change, so users of FreeBSD/powerpc must be careful when performing source upgrades. It is best to run 'make installworld' from an alternate root system, either a live CD/memory stick, or a temporary root partition. Additionally, all ports must be recompiled. powerpc64 is largely unaffected, except in the case of 32-bit compatibility. All 32-bit binaries will be affected. 20170623: Forward compatibility for the "ino64" project have been committed. This will allow most new binaries to run on older kernels in a limited fashion. This prevents many of the common foot-shooting actions in the upgrade as well as the limited ability to roll back the kernel across the ino64 upgrade. Complicated use cases may not work properly, though enough simpler ones work to allow recovery in most situations. 20170620: Switch back to the BSDL dtc (Device Tree Compiler). Set WITH_GPL_DTC if you require the GPL compiler. 20170618: The internal ABI used for communication between the NFS kernel modules was changed by r320085, so __FreeBSD_version was bumped to ensure all the NFS related modules are updated together. 20170617: The ABI of struct event was changed by extending the data member to 64bit and adding ext fields. For upgrade, same precautions as for the entry 20170523 "ino64" must be followed. 20170531: The GNU roff toolchain has been removed from base. To render manpages which are not supported by mandoc(1), man(1) can fallback on GNU roff from ports (and recommends to install it). To render roff(7) documents, consider using GNU roff from ports or the heirloom doctools roff toolchain from ports via pkg install groff or via pkg install heirloom-doctools. 20170524: The ath(4) and ath_hal(4) modules now build piecemeal to allow for smaller runtime footprint builds. This is useful for embedded systems which only require one chipset support. If you load it as a module, make sure this is in /boot/loader.conf: if_ath_load="YES" This will load the HAL, all chip/RF backends and if_ath_pci. If you have if_ath_pci in /boot/loader.conf, ensure it is after if_ath or it will not load any HAL chipset support. If you want to selectively load things (eg on ye cheape ARM/MIPS platforms where RAM is at a premium) you should: * load ath_hal * load the chip modules in question * load ath_rate, ath_dfs * load ath_main * load if_ath_pci and/or if_ath_ahb depending upon your particular bus bind type - this is where probe/attach is done. For further comments/feedback, poke adrian@ . 20170523: The "ino64" 64-bit inode project has been committed, which extends a number of types to 64 bits. Upgrading in place requires care and adherence to the documented upgrade procedure. If using a custom kernel configuration ensure that the COMPAT_FREEBSD11 option is included (as during the upgrade the system will be running the ino64 kernel with the existing world). For the safest in-place upgrade begin by removing previous build artifacts via "rm -rf /usr/obj/*". Then, carefully follow the full procedure documented below under the heading "To rebuild everything and install it on the current system." Specifically, a reboot is required after installing the new kernel before installing world. 20170424: The NATM framework including the en(4), fatm(4), hatm(4), and patm(4) devices has been removed. Consumers should plan a migration before the end-of-life date for FreeBSD 11. 20170420: GNU diff has been replaced by a BSD licensed diff. Some features of GNU diff has not been implemented, if those are needed a newer version of GNU diff is available via the diffutils package under the gdiff name. 20170413: As of r316810 for ipfilter, keep frags is no longer assumed when keep state is specified in a rule. r316810 aligns ipfilter with documentation in man pages separating keep frags from keep state. This allows keep state to be specified without forcing keep frags and allows keep frags to be specified independently of keep state. To maintain previous behaviour, also specify keep frags with keep state (as documented in ipf.conf.5). 20170407: arm64 builds now use the base system LLD 4.0.0 linker by default, instead of requiring that the aarch64-binutils port or package be installed. To continue using aarch64-binutils, set CROSS_BINUTILS_PREFIX=/usr/local/aarch64-freebsd/bin . 20170405: The UDP optimization in entry 20160818 that added the sysctl net.inet.udp.require_l2_bcast has been reverted. L2 broadcast packets will no longer be treated as L3 broadcast packets. 20170331: Binds and sends to the loopback addresses, IPv6 and IPv4, will now use any explicitly assigned loopback address available in the jail instead of using the first assigned address of the jail. 20170329: The ctl.ko module no longer implements the iSCSI target frontend: cfiscsi.ko does instead. If building cfiscsi.ko as a kernel module, the module can be loaded via one of the following methods: - `cfiscsi_load="YES"` in loader.conf(5). - Add `cfiscsi` to `$kld_list` in rc.conf(5). - ctladm(8)/ctld(8), when compiled with iSCSI support (`WITH_ISCSI=yes` in src.conf(5)) Please see cfiscsi(4) for more details. 20170316: The mmcsd.ko module now additionally depends on geom_flashmap.ko. Also, mmc.ko and mmcsd.ko need to be a matching pair built from the same source (previously, the dependency of mmcsd.ko on mmc.ko was missing, but mmcsd.ko now will refuse to load if it is incompatible with mmc.ko). 20170315: The syntax of ipfw(8) named states was changed to avoid ambiguity. If you have used named states in the firewall rules, you need to modify them after installworld and before rebooting. Now named states must be prefixed with colon. 20170311: The old drm (sys/dev/drm/) drivers for i915 and radeon have been removed as the userland we provide cannot use them. The KMS version (sys/dev/drm2) supports the same hardware. 20170302: Clang, llvm, lldb, compiler-rt and libc++ have been upgraded to 4.0.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20170221: The code that provides support for ZFS .zfs/ directory functionality has been reimplemented. It's not possible now to create a snapshot by mkdir under .zfs/snapshot/. That should be the only user visible change. 20170216: EISA bus support has been removed. The WITH_EISA option is no longer valid. 20170215: MCA bus support has been removed. 20170127: The WITH_LLD_AS_LD / WITHOUT_LLD_AS_LD build knobs have been renamed WITH_LLD_IS_LD / WITHOUT_LLD_IS_LD, for consistency with CLANG_IS_CC. 20170112: The EM_MULTIQUEUE kernel configuration option is deprecated now that the em(4) driver conforms to iflib specifications. 20170109: The igb(4), em(4) and lem(4) ethernet drivers are now implemented via IFLIB. If you have a custom kernel configuration that excludes em(4) but you use igb(4), you need to re-add em(4) to your custom configuration. 20161217: Clang, llvm, lldb, compiler-rt and libc++ have been upgraded to 3.9.1. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20161124: Clang, llvm, lldb, compiler-rt and libc++ have been upgraded to 3.9.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20161119: The layout of the pmap structure has changed for powerpc to put the pmap statistics at the front for all CPU variations. libkvm(3) and all tools that link against it need to be recompiled. 20161030: isl(4) and cyapa(4) drivers now require a new driver, chromebook_platform(4), to work properly on Chromebook-class hardware. On other types of hardware the drivers may need to be configured using device hints. Please see the corresponding manual pages for details. 20161017: The urtwn(4) driver was merged into rtwn(4) and now consists of rtwn(4) main module + rtwn_usb(4) and rtwn_pci(4) bus-specific parts. Also, firmware for RTL8188CE was renamed due to possible name conflict (rtwnrtl8192cU(B) -> rtwnrtl8192cE(B)) 20161015: GNU rcs has been removed from base. It is available as packages: - rcs: Latest GPLv3 GNU rcs version. - rcs57: Copy of the latest version of GNU rcs (GPLv2) before it was removed from base. 20161008: Use of the cc_cdg, cc_chd, cc_hd, or cc_vegas congestion control modules now requires that the kernel configuration contain the TCP_HHOOK option. (This option is included in the GENERIC kernel.) 20161003: The WITHOUT_ELFCOPY_AS_OBJCOPY src.conf(5) knob has been retired. ELF Tool Chain's elfcopy is always installed as /usr/bin/objcopy. 20160924: Relocatable object files with the extension of .So have been renamed to use an extension of .pico instead. The purpose of this change is to avoid a name clash with shared libraries on case-insensitive file systems. On those file systems, foo.So is the same file as foo.so. 20160918: GNU rcs has been turned off by default. It can (temporarily) be built again by adding WITH_RCS knob in src.conf. Otherwise, GNU rcs is available from packages: - rcs: Latest GPLv3 GNU rcs version. - rcs57: Copy of the latest version of GNU rcs (GPLv2) from base. 20160918: The backup_uses_rcs functionality has been removed from rc.subr. 20160908: The queue(3) debugging macro, QUEUE_MACRO_DEBUG, has been split into two separate components, QUEUE_MACRO_DEBUG_TRACE and QUEUE_MACRO_DEBUG_TRASH. Define both for the original QUEUE_MACRO_DEBUG behavior. 20160824: r304787 changed some ioctl interfaces between the iSCSI userspace programs and the kernel. ctladm, ctld, iscsictl, and iscsid must be rebuilt to work with new kernels. __FreeBSD_version has been bumped to 1200005. 20160818: The UDP receive code has been updated to only treat incoming UDP packets that were addressed to an L2 broadcast address as L3 broadcast packets. It is not expected that this will affect any standards-conforming UDP application. The new behaviour can be disabled by setting the sysctl net.inet.udp.require_l2_bcast to 0. 20160818: Remove the openbsd_poll system call. __FreeBSD_version has been bumped because of this. 20160708: The stable/11 branch has been created from head@r302406. 20160622: The libc stub for the pipe(2) system call has been replaced with a wrapper that calls the pipe2(2) system call and the pipe(2) system call is now only implemented by the kernels that include "options COMPAT_FREEBSD10" in their config file (this is the default). Users should ensure that this option is enabled in their kernel or upgrade userspace to r302092 before upgrading their kernel. 20160527: CAM will now strip leading spaces from SCSI disks' serial numbers. This will affect users who create UFS filesystems on SCSI disks using those disk's diskid device nodes. For example, if /etc/fstab previously contained a line like "/dev/diskid/DISK-%20%20%20%20%20%20%20ABCDEFG0123456", you should change it to "/dev/diskid/DISK-ABCDEFG0123456". Users of geom transforms like gmirror may also be affected. ZFS users should generally be fine. 20160523: The bitstring(3) API has been updated with new functionality and improved performance. But it is binary-incompatible with the old API. Objects built with the new headers may not be linked against objects built with the old headers. 20160520: The brk and sbrk functions have been removed from libc on arm64. Binutils from ports has been updated to not link to these functions and should be updated to the latest version before installing a new libc. 20160517: The armv6 port now defaults to hard float ABI. Limited support for running both hardfloat and soft float on the same system is available using the libraries installed with -DWITH_LIBSOFT. This has only been tested as an upgrade path for installworld and packages may fail or need manual intervention to run. New packages will be needed. To update an existing self-hosted armv6hf system, you must add TARGET_ARCH=armv6 on the make command line for both the build and the install steps. 20160510: Kernel modules compiled outside of a kernel build now default to installing to /boot/modules instead of /boot/kernel. Many kernel modules built this way (such as those in ports) already overrode KMODDIR explicitly to install into /boot/modules. However, manually building and installing a module from /sys/modules will now install to /boot/modules instead of /boot/kernel. 20160414: The CAM I/O scheduler has been committed to the kernel. There should be no user visible impact. This does enable NCQ Trim on ada SSDs. While the list of known rogues that claim support for this but actually corrupt data is believed to be complete, be on the lookout for data corruption. The known rogue list is believed to be complete: o Crucial MX100, M550 drives with MU01 firmware. o Micron M510 and M550 drives with MU01 firmware. o Micron M500 prior to MU07 firmware o Samsung 830, 840, and 850 all firmwares o FCCT M500 all firmwares Crucial has firmware http://www.crucial.com/usa/en/support-ssd-firmware with working NCQ TRIM. For Micron branded drives, see your sales rep for updated firmware. Black listed drives will work correctly because these drives work correctly so long as no NCQ TRIMs are sent to them. Given this list is the same as found in Linux, it's believed there are no other rogues in the market place. All other models from the above vendors work. To be safe, if you are at all concerned, you can quirk each of your drives to prevent NCQ from being sent by setting: kern.cam.ada.X.quirks="0x2" in loader.conf. If the drive requires the 4k sector quirk, set the quirks entry to 0x3. 20160330: The FAST_DEPEND build option has been removed and its functionality is now the one true way. The old mkdep(1) style of 'make depend' has been removed. See 20160311 for further details. 20160317: Resource range types have grown from unsigned long to uintmax_t. All drivers, and anything using libdevinfo, need to be recompiled. 20160311: WITH_FAST_DEPEND is now enabled by default for in-tree and out-of-tree builds. It no longer runs mkdep(1) during 'make depend', and the 'make depend' stage can safely be skipped now as it is auto ran when building 'make all' and will generate all SRCS and DPSRCS before building anything else. Dependencies are gathered at compile time with -MF flags kept in separate .depend files per object file. Users should run 'make cleandepend' once if using -DNO_CLEAN to clean out older stale .depend files. 20160306: On amd64, clang 3.8.0 can now insert sections of type AMD64_UNWIND into kernel modules. Therefore, if you load any kernel modules at boot time, please install the boot loaders after you install the kernel, but before rebooting, e.g.: make buildworld make buildkernel KERNCONF=YOUR_KERNEL_HERE make installkernel KERNCONF=YOUR_KERNEL_HERE make -C sys/boot install Then follow the usual steps, described in the General Notes section, below. 20160305: Clang, llvm, lldb and compiler-rt have been upgraded to 3.8.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20160301: The AIO subsystem is now a standard part of the kernel. The VFS_AIO kernel option and aio.ko kernel module have been removed. Due to stability concerns, asynchronous I/O requests are only permitted on sockets and raw disks by default. To enable asynchronous I/O requests on all file types, set the vfs.aio.enable_unsafe sysctl to a non-zero value. 20160226: The ELF object manipulation tool objcopy is now provided by the ELF Tool Chain project rather than by GNU binutils. It should be a drop-in replacement, with the addition of arm64 support. The (temporary) src.conf knob WITHOUT_ELFCOPY_AS_OBJCOPY knob may be set to obtain the GNU version if necessary. 20160129: Building ZFS pools on top of zvols is prohibited by default. That feature has never worked safely; it's always been prone to deadlocks. Using a zvol as the backing store for a VM guest's virtual disk will still work, even if the guest is using ZFS. Legacy behavior can be restored by setting vfs.zfs.vol.recursive=1. 20160119: The NONE and HPN patches has been removed from OpenSSH. They are still available in the security/openssh-portable port. 20160113: With the addition of ypldap(8), a new _ypldap user is now required during installworld. "mergemaster -p" can be used to add the user prior to installworld, as documented in the handbook. 20151216: The tftp loader (pxeboot) now uses the option root-path directive. As a consequence it no longer looks for a pxeboot.4th file on the tftp server. Instead it uses the regular /boot infrastructure as with the other loaders. 20151211: The code to start recording plug and play data into the modules has been committed. While the old tools will properly build a new kernel, a number of warnings about "unknown metadata record 4" will be produced for an older kldxref. To avoid such warnings, make sure to rebuild the kernel toolchain (or world). Make sure that you have r292078 or later when trying to build 292077 or later before rebuilding. 20151207: Debug data files are now built by default with 'make buildworld' and installed with 'make installworld'. This facilitates debugging but requires more disk space both during the build and for the installed world. Debug files may be disabled by setting WITHOUT_DEBUG_FILES=yes in src.conf(5). 20151130: r291527 changed the internal interface between the nfsd.ko and nfscommon.ko modules. As such, they must both be upgraded to-gether. __FreeBSD_version has been bumped because of this. 20151108: Add support for unicode collation strings leads to a change of order of files listed by ls(1) for example. To get back to the old behaviour, set LC_COLLATE environment variable to "C". Databases administrators will need to reindex their databases given collation results will be different. Due to a bug in install(1) it is recommended to remove the ancient locales before running make installworld. rm -rf /usr/share/locale/* 20151030: The OpenSSL has been upgraded to 1.0.2d. Any binaries requiring libcrypto.so.7 or libssl.so.7 must be recompiled. 20151020: Qlogic 24xx/25xx firmware images were updated from 5.5.0 to 7.3.0. Kernel modules isp_2400_multi and isp_2500_multi were removed and should be replaced with isp_2400 and isp_2500 modules respectively. 20151017: The build previously allowed using 'make -n' to not recurse into sub-directories while showing what commands would be executed, and 'make -n -n' to recursively show commands. Now 'make -n' will recurse and 'make -N' will not. 20151012: If you specify SENDMAIL_MC or SENDMAIL_CF in make.conf, mergemaster and etcupdate will now use this file. A custom sendmail.cf is now updated via this mechanism rather than via installworld. If you had excluded sendmail.cf in mergemaster.rc or etcupdate.conf, you may want to remove the exclusion or change it to "always install". /etc/mail/sendmail.cf is now managed the same way regardless of whether SENDMAIL_MC/SENDMAIL_CF is used. If you are not using SENDMAIL_MC/SENDMAIL_CF there should be no change in behavior. 20151011: Compatibility shims for legacy ATA device names have been removed. It includes ATA_STATIC_ID kernel option, kern.cam.ada.legacy_aliases and kern.geom.raid.legacy_aliases loader tunables, kern.devalias.* environment variables, /dev/ad* and /dev/ar* symbolic links. 20151006: Clang, llvm, lldb, compiler-rt and libc++ have been upgraded to 3.7.0. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using clang 3.5.0 or higher. 20150924: Kernel debug files have been moved to /usr/lib/debug/boot/kernel/, and renamed from .symbols to .debug. This reduces the size requirements on the boot partition or file system and provides consistency with userland debug files. When using the supported kernel installation method the /usr/lib/debug/boot/kernel directory will be renamed (to kernel.old) as is done with /boot/kernel. Developers wishing to maintain the historical behavior of installing debug files in /boot/kernel/ can set KERN_DEBUGDIR="" in src.conf(5). 20150827: The wireless drivers had undergone changes that remove the 'parent interface' from the ifconfig -l output. The rc.d network scripts used to check presence of a parent interface in the list, so old scripts would fail to start wireless networking. Thus, etcupdate(3) or mergemaster(8) run is required after kernel update, to update your rc.d scripts in /etc. 20150827: pf no longer supports 'scrub fragment crop' or 'scrub fragment drop-ovl' These configurations are now automatically interpreted as 'scrub fragment reassemble'. 20150817: Kernel-loadable modules for the random(4) device are back. To use them, the kernel must have device random options RANDOM_LOADABLE kldload(8) can then be used to load random_fortuna.ko or random_yarrow.ko. Please note that due to the indirect function calls that the loadable modules need to provide, the build-in variants will be slightly more efficient. The random(4) kernel option RANDOM_DUMMY has been retired due to unpopularity. It was not all that useful anyway. 20150813: The WITHOUT_ELFTOOLCHAIN_TOOLS src.conf(5) knob has been retired. Control over building the ELF Tool Chain tools is now provided by the WITHOUT_TOOLCHAIN knob. 20150810: The polarity of Pulse Per Second (PPS) capture events with the uart(4) driver has been corrected. Prior to this change the PPS "assert" event corresponded to the trailing edge of a positive PPS pulse and the "clear" event was the leading edge of the next pulse. As the width of a PPS pulse in a typical GPS receiver is on the order of 1 millisecond, most users will not notice any significant difference with this change. Anyone who has compensated for the historical polarity reversal by configuring a negative offset equal to the pulse width will need to remove that workaround. 20150809: The default group assigned to /dev/dri entries has been changed from 'wheel' to 'video' with the id of '44'. If you want to have access to the dri devices please add yourself to the video group with: # pw groupmod video -m $USER 20150806: The menu.rc and loader.rc files will now be replaced during upgrades. Please migrate local changes to menu.rc.local and loader.rc.local instead. 20150805: GNU Binutils versions of addr2line, c++filt, nm, readelf, size, strings and strip have been removed. The src.conf(5) knob WITHOUT_ELFTOOLCHAIN_TOOLS no longer provides the binutils tools. 20150728: As ZFS requires more kernel stack pages than is the default on some architectures e.g. i386, it now warns if KSTACK_PAGES is less than ZFS_MIN_KSTACK_PAGES (which is 4 at the time of writing). Please consider using 'options KSTACK_PAGES=X' where X is greater than or equal to ZFS_MIN_KSTACK_PAGES i.e. 4 in such configurations. 20150706: sendmail has been updated to 8.15.2. Starting with FreeBSD 11.0 and sendmail 8.15, sendmail uses uncompressed IPv6 addresses by default, i.e., they will not contain "::". For example, instead of ::1, it will be 0:0:0:0:0:0:0:1. This permits a zero subnet to have a more specific match, such as different map entries for IPv6:0:0 vs IPv6:0. This change requires that configuration data (including maps, files, classes, custom ruleset, etc.) must use the same format, so make certain such configuration data is upgrading. As a very simple check search for patterns like 'IPv6:[0-9a-fA-F:]*::' and 'IPv6::'. To return to the old behavior, set the m4 option confUSE_COMPRESSED_IPV6_ADDRESSES or the cf option UseCompressedIPv6Addresses. 20150630: The default kernel entropy-processing algorithm is now Fortuna, replacing Yarrow. Assuming you have 'device random' in your kernel config file, the configurations allow a kernel option to override this default. You may choose *ONE* of: options RANDOM_YARROW # Legacy /dev/random algorithm. options RANDOM_DUMMY # Blocking-only driver. If you have neither, you get Fortuna. For most people, read no further, Fortuna will give a /dev/random that works like it always used to, and the difference will be irrelevant. If you remove 'device random', you get *NO* kernel-processed entropy at all. This may be acceptable to folks building embedded systems, but has complications. Carry on reading, and it is assumed you know what you need. *PLEASE* read random(4) and random(9) if you are in the habit of tweaking kernel configs, and/or if you are a member of the embedded community, wanting specific and not-usual behaviour from your security subsystems. NOTE!! If you use RANDOM_DUMMY and/or have no 'device random', you will NOT have a functioning /dev/random, and many cryptographic features will not work, including SSH. You may also find strange behaviour from the random(3) set of library functions, in particular sranddev(3), srandomdev(3) and arc4random(3). The reason for this is that the KERN_ARND sysctl only returns entropy if it thinks it has some to share, and with RANDOM_DUMMY or no 'device random' this will never happen. 20150623: An additional fix for the issue described in the 20150614 sendmail entry below has been committed in revision 284717. 20150616: FreeBSD's old make (fmake) has been removed from the system. It is available as the devel/fmake port or via pkg install fmake. 20150615: The fix for the issue described in the 20150614 sendmail entry below has been committed in revision 284436. The work around described in that entry is no longer needed unless the default setting is overridden by a confDH_PARAMETERS configuration setting of '5' or pointing to a 512 bit DH parameter file. 20150614: ALLOW_DEPRECATED_ATF_TOOLS/ATFFILE support has been removed from atf.test.mk (included from bsd.test.mk). Please upgrade devel/atf and devel/kyua to version 0.20+ and adjust any calling code to work with Kyuafile and kyua. 20150614: The import of openssl to address the FreeBSD-SA-15:10.openssl security advisory includes a change which rejects handshakes with DH parameters below 768 bits. sendmail releases prior to 8.15.2 (not yet released), defaulted to a 512 bit DH parameter setting for client connections. To work around this interoperability, sendmail can be configured to use a 2048 bit DH parameter by: 1. Edit /etc/mail/`hostname`.mc 2. If a setting for confDH_PARAMETERS does not exist or exists and is set to a string beginning with '5', replace it with '2'. 3. If a setting for confDH_PARAMETERS exists and is set to a file path, create a new file with: openssl dhparam -out /path/to/file 2048 4. Rebuild the .cf file: cd /etc/mail/; make; make install 5. Restart sendmail: cd /etc/mail/; make restart A sendmail patch is coming, at which time this file will be updated. 20150604: Generation of legacy formatted entries have been disabled by default in pwd_mkdb(8), as all base system consumers of the legacy formatted entries were converted to use the new format by default when the new, machine independent format have been added and supported since FreeBSD 5.x. Please see the pwd_mkdb(8) manual page for further details. 20150525: Clang and llvm have been upgraded to 3.6.1 release. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using 3.5.0 or higher. 20150521: TI platform code switched to using vendor DTS files and this update may break existing systems running on Beaglebone, Beaglebone Black, and Pandaboard: - dtb files should be regenerated/reinstalled. Filenames are the same but content is different now - GPIO addressing was changed, now each GPIO bank (32 pins per bank) has its own /dev/gpiocX device, e.g. pin 121 on /dev/gpioc0 in old addressing scheme is now pin 25 on /dev/gpioc3. - Pandaboard: /etc/ttys should be updated, serial console device is now /dev/ttyu2, not /dev/ttyu0 20150501: soelim(1) from gnu/usr.bin/groff has been replaced by usr.bin/soelim. If you need the GNU extension from groff soelim(1), install groff from package: pkg install groff, or via ports: textproc/groff. 20150423: chmod, chflags, chown and chgrp now affect symlinks in -R mode as defined in symlink(7); previously symlinks were silently ignored. 20150415: The const qualifier has been removed from iconv(3) to comply with POSIX. The ports tree is aware of this from r384038 onwards. 20150416: Libraries specified by LIBADD in Makefiles must have a corresponding DPADD_ variable to ensure correct dependencies. This is now enforced in src.libnames.mk. 20150324: From legacy ata(4) driver was removed support for SATA controllers supported by more functional drivers ahci(4), siis(4) and mvs(4). Kernel modules ataahci and ataadaptec were removed completely, replaced by ahci and mvs modules respectively. 20150315: Clang, llvm and lldb have been upgraded to 3.6.0 release. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using 3.5.0 or higher. 20150307: The 32-bit PowerPC kernel has been changed to a position-independent executable. This can only be booted with a version of loader(8) newer than January 31, 2015, so make sure to update both world and kernel before rebooting. 20150217: If you are running a -CURRENT kernel since r273872 (Oct 30th, 2014), but before r278950, the RNG was not seeded properly. Immediately upgrade the kernel to r278950 or later and regenerate any keys (e.g. ssh keys or openssl keys) that were generated w/ a kernel from that range. This does not affect programs that directly used /dev/random or /dev/urandom. All userland uses of arc4random(3) are affected. 20150210: The autofs(4) ABI was changed in order to restore binary compatibility with 10.1-RELEASE. The automountd(8) daemon needs to be rebuilt to work with the new kernel. 20150131: The powerpc64 kernel has been changed to a position-independent executable. This can only be booted with a new version of loader(8), so make sure to update both world and kernel before rebooting. 20150118: Clang and llvm have been upgraded to 3.5.1 release. This is a bugfix only release, no new features have been added. Please see the 20141231 entry below for information about prerequisites and upgrading, if you are not already using 3.5.0. 20150107: ELF tools addr2line, elfcopy (strip), nm, size, and strings are now taken from the ELF Tool Chain project rather than GNU binutils. They should be drop-in replacements, with the addition of arm64 support. The WITHOUT_ELFTOOLCHAIN_TOOLS= knob may be used to obtain the binutils tools, if necessary. See 20150805 for updated information. 20150105: The default Unbound configuration now enables remote control using a local socket. Users who have already enabled the local_unbound service should regenerate their configuration by running "service local_unbound setup" as root. 20150102: The GNU texinfo and GNU info pages have been removed. To be able to view GNU info pages please install texinfo from ports. 20141231: Clang, llvm and lldb have been upgraded to 3.5.0 release. As of this release, a prerequisite for building clang, llvm and lldb is a C++11 capable compiler and C++11 standard library. This means that to be able to successfully build the cross-tools stage of buildworld, with clang as the bootstrap compiler, your system compiler or cross compiler should either be clang 3.3 or later, or gcc 4.8 or later, and your system C++ library should be libc++, or libdstdc++ from gcc 4.8 or later. On any standard FreeBSD 10.x or 11.x installation, where clang and libc++ are on by default (that is, on x86 or arm), this should work out of the box. On 9.x installations where clang is enabled by default, e.g. on x86 and powerpc, libc++ will not be enabled by default, so libc++ should be built (with clang) and installed first. If both clang and libc++ are missing, build clang first, then use it to build libc++. On 8.x and earlier installations, upgrade to 9.x first, and then follow the instructions for 9.x above. Sparc64 and mips users are unaffected, as they still use gcc 4.2.1 by default, and do not build clang. Many embedded systems are resource constrained, and will not be able to build clang in a reasonable time, or in some cases at all. In those cases, cross building bootable systems on amd64 is a workaround. This new version of clang introduces a number of new warnings, of which the following are most likely to appear: -Wabsolute-value This warns in two cases, for both C and C++: * When the code is trying to take the absolute value of an unsigned quantity, which is effectively a no-op, and almost never what was intended. The code should be fixed, if at all possible. If you are sure that the unsigned quantity can be safely cast to signed, without loss of information or undefined behavior, you can add an explicit cast, or disable the warning. * When the code is trying to take an absolute value, but the called abs() variant is for the wrong type, which can lead to truncation. If you want to disable the warning instead of fixing the code, please make sure that truncation will not occur, or it might lead to unwanted side-effects. -Wtautological-undefined-compare and -Wundefined-bool-conversion These warn when C++ code is trying to compare 'this' against NULL, while 'this' should never be NULL in well-defined C++ code. However, there is some legacy (pre C++11) code out there, which actively abuses this feature, which was less strictly defined in previous C++ versions. Squid and openjdk do this, for example. The warning can be turned off for C++98 and earlier, but compiling the code in C++11 mode might result in unexpected behavior; for example, the parts of the program that are unreachable could be optimized away. 20141222: The old NFS client and server (kernel options NFSCLIENT, NFSSERVER) kernel sources have been removed. The .h files remain, since some utilities include them. This will need to be fixed later. If "mount -t oldnfs ..." is attempted, it will fail. If the "-o" option on mountd(8), nfsd(8) or nfsstat(1) is used, the utilities will report errors. 20141121: The handling of LOCAL_LIB_DIRS has been altered to skip addition of directories to top level SUBDIR variable when their parent directory is included in LOCAL_DIRS. Users with build systems with such hierarchies and without SUBDIR entries in the parent directory Makefiles should add them or add the directories to LOCAL_DIRS. 20141109: faith(4) and faithd(8) have been removed from the base system. Faith has been obsolete for a very long time. 20141104: vt(4), the new console driver, is enabled by default. It brings support for Unicode and double-width characters, as well as support for UEFI and integration with the KMS kernel video drivers. You may need to update your console settings in /etc/rc.conf, most probably the keymap. During boot, /etc/rc.d/syscons will indicate what you need to do. vt(4) still has issues and lacks some features compared to syscons(4). See the wiki for up-to-date information: https://wiki.freebsd.org/Newcons If you want to keep using syscons(4), you can do so by adding the following line to /boot/loader.conf: kern.vty=sc 20141102: pjdfstest has been integrated into kyua as an opt-in test suite. Please see share/doc/pjdfstest/README for more details on how to execute it. 20141009: gperf has been removed from the base system for architectures that use clang. Ports that require gperf will obtain it from the devel/gperf port. 20140923: pjdfstest has been moved from tools/regression/pjdfstest to contrib/pjdfstest . 20140922: At svn r271982, The default linux compat kernel ABI has been adjusted to 2.6.18 in support of the linux-c6 compat ports infrastructure update. If you wish to continue using the linux-f10 compat ports, add compat.linux.osrelease=2.6.16 to your local sysctl.conf. Users are encouraged to update their linux-compat packages to linux-c6 during their next update cycle. 20140729: The ofwfb driver, used to provide a graphics console on PowerPC when using vt(4), no longer allows mmap() of all physical memory. This will prevent Xorg on PowerPC with some ATI graphics cards from initializing properly unless x11-servers/xorg-server is updated to 1.12.4_8 or newer. 20140723: The xdev targets have been converted to using TARGET and TARGET_ARCH instead of XDEV and XDEV_ARCH. 20140719: The default unbound configuration has been modified to address issues with reverse lookups on networks that use private address ranges. If you use the local_unbound service, run "service local_unbound setup" as root to regenerate your configuration, then "service local_unbound reload" to load the new configuration. 20140709: The GNU texinfo and GNU info pages are not built and installed anymore, WITH_INFO knob has been added to allow to built and install them again. UPDATE: see 20150102 entry on texinfo's removal 20140708: The GNU readline library is now an INTERNALLIB - that is, it is statically linked into consumers (GDB and variants) in the base system, and the shared library is no longer installed. The devel/readline port is available for third party software that requires readline. 20140702: The Itanium architecture (ia64) has been removed from the list of known architectures. This is the first step in the removal of the architecture. 20140701: Commit r268115 has added NFSv4.1 server support, merged from projects/nfsv4.1-server. Since this includes changes to the internal interfaces between the NFS related modules, a full build of the kernel and modules will be necessary. __FreeBSD_version has been bumped. 20140629: The WITHOUT_VT_SUPPORT kernel config knob has been renamed WITHOUT_VT. (The other _SUPPORT knobs have a consistent meaning which differs from the behaviour controlled by this knob.) 20140619: Maximal length of the serial number in CTL was increased from 16 to 64 chars, that breaks ABI. All CTL-related tools, such as ctladm and ctld, need to be rebuilt to work with a new kernel. 20140606: The libatf-c and libatf-c++ major versions were downgraded to 0 and 1 respectively to match the upstream numbers. They were out of sync because, when they were originally added to FreeBSD, the upstream versions were not respected. These libraries are private and not yet built by default, so renumbering them should be a non-issue. However, unclean source trees will yield broken test programs once the operator executes "make delete-old-libs" after a "make installworld". Additionally, the atf-sh binary was made private by moving it into /usr/libexec/. Already-built shell test programs will keep the path to the old binary so they will break after "make delete-old" is run. If you are using WITH_TESTS=yes (not the default), wipe the object tree and rebuild from scratch to prevent spurious test failures. This is only needed once: the misnumbered libraries and misplaced binaries have been added to OptionalObsoleteFiles.inc so they will be removed during a clean upgrade. 20140512: Clang and llvm have been upgraded to 3.4.1 release. 20140508: We bogusly installed src.opts.mk in /usr/share/mk. This file should be removed to avoid issues in the future (and has been added to ObsoleteFiles.inc). 20140505: /etc/src.conf now affects only builds of the FreeBSD src tree. In the past, it affected all builds that used the bsd.*.mk files. The old behavior was a bug, but people may have relied upon it. To get this behavior back, you can .include /etc/src.conf from /etc/make.conf (which is still global and isn't changed). This also changes the behavior of incremental builds inside the tree of individual directories. Set MAKESYSPATH to ".../share/mk" to do that. Although this has survived make universe and some upgrade scenarios, other upgrade scenarios may have broken. At least one form of temporary breakage was fixed with MAKESYSPATH settings for buildworld as well... In cases where MAKESYSPATH isn't working with this setting, you'll need to set it to the full path to your tree. One side effect of all this cleaning up is that bsd.compiler.mk is no longer implicitly included by bsd.own.mk. If you wish to use COMPILER_TYPE, you must now explicitly include bsd.compiler.mk as well. 20140430: The lindev device has been removed since /dev/full has been made a standard device. __FreeBSD_version has been bumped. 20140424: The knob WITHOUT_VI was added to the base system, which controls building ex(1), vi(1), etc. Older releases of FreeBSD required ex(1) in order to reorder files share/termcap and didn't build ex(1) as a build tool, so building/installing with WITH_VI is highly advised for build hosts for older releases. This issue has been fixed in stable/9 and stable/10 in r277022 and r276991, respectively. 20140418: The YES_HESIOD knob has been removed. It has been obsolete for a decade. Please move to using WITH_HESIOD instead or your builds will silently lack HESIOD. 20140405: The uart(4) driver has been changed with respect to its handling of the low-level console. Previously the uart(4) driver prevented any process from changing the baudrate or the CLOCAL and HUPCL control flags. By removing the restrictions, operators can make changes to the serial console port without having to reboot. However, when getty(8) is started on the serial device that is associated with the low-level console, a misconfigured terminal line in /etc/ttys will now have a real impact. Before upgrading the kernel, make sure that /etc/ttys has the serial console device configured as 3wire without baudrate to preserve the previous behaviour. E.g: ttyu0 "/usr/libexec/getty 3wire" vt100 on secure 20140306: Support for libwrap (TCP wrappers) in rpcbind was disabled by default to improve performance. To re-enable it, if needed, run rpcbind with command line option -W. 20140226: Switched back to the GPL dtc compiler due to updates in the upstream dts files not being supported by the BSDL dtc compiler. You will need to rebuild your kernel toolchain to pick up the new compiler. Core dumps may result while building dtb files during a kernel build if you fail to do so. Set WITHOUT_GPL_DTC if you require the BSDL compiler. 20140216: Clang and llvm have been upgraded to 3.4 release. 20140216: The nve(4) driver has been removed. Please use the nfe(4) driver for NVIDIA nForce MCP Ethernet adapters instead. 20140212: An ABI incompatibility crept into the libc++ 3.4 import in r261283. This could cause certain C++ applications using shared libraries built against the previous version of libc++ to crash. The incompatibility has now been fixed, but any C++ applications or shared libraries built between r261283 and r261801 should be recompiled. 20140204: OpenSSH will now ignore errors caused by kernel lacking of Capsicum capability mode support. Please note that enabling the feature in kernel is still highly recommended. 20140131: OpenSSH is now built with sandbox support, and will use sandbox as the default privilege separation method. This requires Capsicum capability mode support in kernel. 20140128: The libelf and libdwarf libraries have been updated to newer versions from upstream. Shared library version numbers for these two libraries were bumped. Any ports or binaries requiring these two libraries should be recompiled. __FreeBSD_version is bumped to 1100006. 20140110: If a Makefile in a tests/ directory was auto-generating a Kyuafile instead of providing an explicit one, this would prevent such Makefile from providing its own Kyuafile in the future during NO_CLEAN builds. This has been fixed in the Makefiles but manual intervention is needed to clean an objdir if you use NO_CLEAN: # find /usr/obj -name Kyuafile | xargs rm -f 20131213: The behavior of gss_pseudo_random() for the krb5 mechanism has changed, for applications requesting a longer random string than produced by the underlying enctype's pseudo-random() function. In particular, the random string produced from a session key of enctype aes256-cts-hmac-sha1-96 or aes256-cts-hmac-sha1-96 will be different at the 17th octet and later, after this change. The counter used in the PRF+ construction is now encoded as a big-endian integer in accordance with RFC 4402. __FreeBSD_version is bumped to 1100004. 20131108: The WITHOUT_ATF build knob has been removed and its functionality has been subsumed into the more generic WITHOUT_TESTS. If you were using the former to disable the build of the ATF libraries, you should change your settings to use the latter. 20131025: The default version of mtree is nmtree which is obtained from NetBSD. The output is generally the same, but may vary slightly. If you found you need identical output adding "-F freebsd9" to the command line should do the trick. For the time being, the old mtree is available as fmtree. 20131014: libbsdyml has been renamed to libyaml and moved to /usr/lib/private. This will break ports-mgmt/pkg. Rebuild the port, or upgrade to pkg 1.1.4_8 and verify bsdyml not linked in, before running "make delete-old-libs": # make -C /usr/ports/ports-mgmt/pkg build deinstall install clean or # pkg install pkg; ldd /usr/local/sbin/pkg | grep bsdyml 20131010: The stable/10 branch has been created in subversion from head revision r256279. COMMON ITEMS: General Notes ------------- Avoid using make -j when upgrading. While generally safe, there are sometimes problems using -j to upgrade. If your upgrade fails with -j, please try again without -j. From time to time in the past there have been problems using -j with buildworld and/or installworld. This is especially true when upgrading between "distant" versions (eg one that cross a major release boundary or several minor releases, or when several months have passed on the -current branch). Sometimes, obscure build problems are the result of environment poisoning. This can happen because the make utility reads its environment when searching for values for global variables. To run your build attempts in an "environmental clean room", prefix all make commands with 'env -i '. See the env(1) manual page for more details. When upgrading from one major version to another it is generally best to upgrade to the latest code in the currently installed branch first, then do an upgrade to the new branch. This is the best-tested upgrade path, and has the highest probability of being successful. Please try this approach if you encounter problems with a major version upgrade. Since the stable 4.x branch point, one has generally been able to upgrade from anywhere in the most recent stable branch to head / current (or even the last couple of stable branches). See the top of this file when there's an exception. When upgrading a live system, having a root shell around before installing anything can help undo problems. Not having a root shell around can lead to problems if pam has changed too much from your starting point to allow continued authentication after the upgrade. This file should be read as a log of events. When a later event changes information of a prior event, the prior event should not be deleted. Instead, a pointer to the entry with the new information should be placed in the old entry. Readers of this file should also sanity check older entries before relying on them blindly. Authors of new entries should write them with this in mind. ZFS notes --------- When upgrading the boot ZFS pool to a new version, always follow these two steps: 1.) recompile and reinstall the ZFS boot loader and boot block (this is part of "make buildworld" and "make installworld") 2.) update the ZFS boot block on your boot drive The following example updates the ZFS boot block on the first partition (freebsd-boot) of a GPT partitioned drive ada0: "gpart bootcode -p /boot/gptzfsboot -i 1 ada0" Non-boot pools do not need these updates. To build a kernel ----------------- If you are updating from a prior version of FreeBSD (even one just a few days old), you should follow this procedure. It is the most failsafe as it uses a /usr/obj tree with a fresh mini-buildworld, make kernel-toolchain make -DALWAYS_CHECK_MAKE buildkernel KERNCONF=YOUR_KERNEL_HERE make -DALWAYS_CHECK_MAKE installkernel KERNCONF=YOUR_KERNEL_HERE To test a kernel once --------------------- If you just want to boot a kernel once (because you are not sure if it works, or if you want to boot a known bad kernel to provide debugging information) run make installkernel KERNCONF=YOUR_KERNEL_HERE KODIR=/boot/testkernel nextboot -k testkernel To rebuild everything and install it on the current system. ----------------------------------------------------------- # Note: sometimes if you are running current you gotta do more than # is listed here if you are upgrading from a really old current. make buildworld make buildkernel KERNCONF=YOUR_KERNEL_HERE make installkernel KERNCONF=YOUR_KERNEL_HERE [1] [3] mergemaster -Fp [5] make installworld mergemaster -Fi [4] make delete-old [6] To cross-install current onto a separate partition -------------------------------------------------- # In this approach we use a separate partition to hold # current's root, 'usr', and 'var' directories. A partition # holding "/", "/usr" and "/var" should be about 2GB in # size. make buildworld make buildkernel KERNCONF=YOUR_KERNEL_HERE make installworld DESTDIR=${CURRENT_ROOT} -DDB_FROM_SRC make distribution DESTDIR=${CURRENT_ROOT} # if newfs'd make installkernel KERNCONF=YOUR_KERNEL_HERE DESTDIR=${CURRENT_ROOT} cp /etc/fstab ${CURRENT_ROOT}/etc/fstab # if newfs'd To upgrade in-place from stable to current ---------------------------------------------- make buildworld [9] make buildkernel KERNCONF=YOUR_KERNEL_HERE [8] make installkernel KERNCONF=YOUR_KERNEL_HERE [1] [3] mergemaster -Fp [5] make installworld mergemaster -Fi [4] make delete-old [6] Make sure that you've read the UPDATING file to understand the tweaks to various things you need. At this point in the life cycle of current, things change often and you are on your own to cope. The defaults can also change, so please read ALL of the UPDATING entries. Also, if you are tracking -current, you must be subscribed to freebsd-current@freebsd.org. Make sure that before you update your sources that you have read and understood all the recent messages there. If in doubt, please track -stable which has much fewer pitfalls. [1] If you have third party modules, such as vmware, you should disable them at this point so they don't crash your system on reboot. [3] From the bootblocks, boot -s, and then do fsck -p mount -u / mount -a cd src adjkerntz -i # if CMOS is wall time Also, when doing a major release upgrade, it is required that you boot into single user mode to do the installworld. [4] Note: This step is non-optional. Failure to do this step can result in a significant reduction in the functionality of the system. Attempting to do it by hand is not recommended and those that pursue this avenue should read this file carefully, as well as the archives of freebsd-current and freebsd-hackers mailing lists for potential gotchas. The -U option is also useful to consider. See mergemaster(8) for more information. [5] Usually this step is a no-op. However, from time to time you may need to do this if you get unknown user in the following step. It never hurts to do it all the time. You may need to install a new mergemaster (cd src/usr.sbin/mergemaster && make install) after the buildworld before this step if you last updated from current before 20130425 or from -stable before 20130430. [6] This only deletes old files and directories. Old libraries can be deleted by "make delete-old-libs", but you have to make sure that no program is using those libraries anymore. [8] The new kernel must be able to run existing binaries used by an installworld. When upgrading across major versions, the new kernel's configuration must include the correct COMPAT_FREEBSD option for existing binaries (e.g. COMPAT_FREEBSD11 to run 11.x binaries). Failure to do so may leave you with a system that is hard to boot to recover. A GENERIC kernel will include suitable compatibility options to run binaries from older branches. Make sure that you merge any new devices from GENERIC since the last time you updated your kernel config file. [9] If CPUTYPE is defined in your /etc/make.conf, make sure to use the "?=" instead of the "=" assignment operator, so that buildworld can override the CPUTYPE if it needs to. MAKEOBJDIRPREFIX must be defined in an environment variable, and not on the command line, or in /etc/make.conf. buildworld will warn if it is improperly defined. FORMAT: This file contains a list, in reverse chronological order, of major breakages in tracking -current. It is not guaranteed to be a complete list of such breakages, and only contains entries since September 23, 2011. If you need to see UPDATING entries from before that date, you will need to fetch an UPDATING file from an older FreeBSD release. Copyright information: Copyright 1998-2009 M. Warner Losh. All Rights Reserved. Redistribution, publication, translation and use, with or without modification, in full or in part, in any form or format of this document are permitted without further permission from the author. THIS DOCUMENT IS PROVIDED BY WARNER LOSH ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WARNER LOSH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Contact Warner Losh if you have any questions about your use of this document. $FreeBSD$ diff --git a/crypto/openssl/crypto/x509/x509_vfy.c b/crypto/openssl/crypto/x509/x509_vfy.c index 801055f5a087..4d1f37a8212e 100644 --- a/crypto/openssl/crypto/x509/x509_vfy.c +++ b/crypto/openssl/crypto/x509/x509_vfy.c @@ -1,3371 +1,3375 @@ /* * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include #include #include #include "crypto/ctype.h" #include "internal/cryptlib.h" #include #include #include #include #include #include #include #include "internal/dane.h" #include "crypto/x509.h" #include "x509_local.h" /* CRL score values */ /* No unhandled critical extensions */ #define CRL_SCORE_NOCRITICAL 0x100 /* certificate is within CRL scope */ #define CRL_SCORE_SCOPE 0x080 /* CRL times valid */ #define CRL_SCORE_TIME 0x040 /* Issuer name matches certificate */ #define CRL_SCORE_ISSUER_NAME 0x020 /* If this score or above CRL is probably valid */ #define CRL_SCORE_VALID (CRL_SCORE_NOCRITICAL|CRL_SCORE_TIME|CRL_SCORE_SCOPE) /* CRL issuer is certificate issuer */ #define CRL_SCORE_ISSUER_CERT 0x018 /* CRL issuer is on certificate path */ #define CRL_SCORE_SAME_PATH 0x008 /* CRL issuer matches CRL AKID */ #define CRL_SCORE_AKID 0x004 /* Have a delta CRL with valid times */ #define CRL_SCORE_TIME_DELTA 0x002 static int build_chain(X509_STORE_CTX *ctx); static int verify_chain(X509_STORE_CTX *ctx); static int dane_verify(X509_STORE_CTX *ctx); static int null_callback(int ok, X509_STORE_CTX *e); static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); static int check_chain_extensions(X509_STORE_CTX *ctx); static int check_name_constraints(X509_STORE_CTX *ctx); static int check_id(X509_STORE_CTX *ctx); static int check_trust(X509_STORE_CTX *ctx, int num_untrusted); static int check_revocation(X509_STORE_CTX *ctx); static int check_cert(X509_STORE_CTX *ctx); static int check_policy(X509_STORE_CTX *ctx); static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); static int check_dane_issuer(X509_STORE_CTX *ctx, int depth); static int check_key_level(X509_STORE_CTX *ctx, X509 *cert); static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert); static int check_curve(X509 *cert); static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, unsigned int *preasons, X509_CRL *crl, X509 *x); static int get_crl_delta(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x); static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pcrl_score, X509_CRL *base, STACK_OF(X509_CRL) *crls); static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, int *pcrl_score); static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, unsigned int *preasons); static int check_crl_path(X509_STORE_CTX *ctx, X509 *x); static int check_crl_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *cert_path, STACK_OF(X509) *crl_path); static int internal_verify(X509_STORE_CTX *ctx); static int null_callback(int ok, X509_STORE_CTX *e) { return ok; } /* * Return 1 if given cert is considered self-signed, 0 if not or on error. * This does not verify self-signedness but relies on x509v3_cache_extensions() * matching issuer and subject names (i.e., the cert being self-issued) and any * present authority key identifier matching the subject key identifier, etc. */ static int cert_self_signed(X509 *x) { if (X509_check_purpose(x, -1, 0) != 1) return 0; if (x->ex_flags & EXFLAG_SS) return 1; else return 0; } /* Given a certificate try and find an exact match in the store */ static X509 *lookup_cert_match(X509_STORE_CTX *ctx, X509 *x) { STACK_OF(X509) *certs; X509 *xtmp = NULL; int i; /* Lookup all certs with matching subject name */ certs = ctx->lookup_certs(ctx, X509_get_subject_name(x)); if (certs == NULL) return NULL; /* Look for exact match */ for (i = 0; i < sk_X509_num(certs); i++) { xtmp = sk_X509_value(certs, i); if (!X509_cmp(xtmp, x)) break; xtmp = NULL; } if (xtmp != NULL && !X509_up_ref(xtmp)) xtmp = NULL; sk_X509_pop_free(certs, X509_free); return xtmp; } /*- * Inform the verify callback of an error. * If B is not NULL it is the error cert, otherwise use the chain cert at * B. * If B is not X509_V_OK, that's the error value, otherwise leave * unchanged (presumably set by the caller). * * Returns 0 to abort verification with an error, non-zero to continue. */ static int verify_cb_cert(X509_STORE_CTX *ctx, X509 *x, int depth, int err) { ctx->error_depth = depth; ctx->current_cert = (x != NULL) ? x : sk_X509_value(ctx->chain, depth); if (err != X509_V_OK) ctx->error = err; return ctx->verify_cb(0, ctx); } /*- * Inform the verify callback of an error, CRL-specific variant. Here, the * error depth and certificate are already set, we just specify the error * number. * * Returns 0 to abort verification with an error, non-zero to continue. */ static int verify_cb_crl(X509_STORE_CTX *ctx, int err) { ctx->error = err; return ctx->verify_cb(0, ctx); } static int check_auth_level(X509_STORE_CTX *ctx) { int i; int num = sk_X509_num(ctx->chain); if (ctx->param->auth_level <= 0) return 1; for (i = 0; i < num; ++i) { X509 *cert = sk_X509_value(ctx->chain, i); /* * We've already checked the security of the leaf key, so here we only * check the security of issuer keys. */ if (i > 0 && !check_key_level(ctx, cert) && verify_cb_cert(ctx, cert, i, X509_V_ERR_CA_KEY_TOO_SMALL) == 0) return 0; /* * We also check the signature algorithm security of all certificates * except those of the trust anchor at index num-1. */ if (i < num - 1 && !check_sig_level(ctx, cert) && verify_cb_cert(ctx, cert, i, X509_V_ERR_CA_MD_TOO_WEAK) == 0) return 0; } return 1; } static int verify_chain(X509_STORE_CTX *ctx) { int err; int ok; /* * Before either returning with an error, or continuing with CRL checks, * instantiate chain public key parameters. */ if ((ok = build_chain(ctx)) == 0 || (ok = check_chain_extensions(ctx)) == 0 || (ok = check_auth_level(ctx)) == 0 || (ok = check_id(ctx)) == 0 || 1) X509_get_pubkey_parameters(NULL, ctx->chain); if (ok == 0 || (ok = ctx->check_revocation(ctx)) == 0) return ok; err = X509_chain_check_suiteb(&ctx->error_depth, NULL, ctx->chain, ctx->param->flags); if (err != X509_V_OK) { if ((ok = verify_cb_cert(ctx, NULL, ctx->error_depth, err)) == 0) return ok; } /* Verify chain signatures and expiration times */ ok = (ctx->verify != NULL) ? ctx->verify(ctx) : internal_verify(ctx); if (!ok) return ok; if ((ok = check_name_constraints(ctx)) == 0) return ok; #ifndef OPENSSL_NO_RFC3779 /* RFC 3779 path validation, now that CRL check has been done */ if ((ok = X509v3_asid_validate_path(ctx)) == 0) return ok; if ((ok = X509v3_addr_validate_path(ctx)) == 0) return ok; #endif /* If we get this far evaluate policies */ if (ctx->param->flags & X509_V_FLAG_POLICY_CHECK) ok = ctx->check_policy(ctx); return ok; } int X509_verify_cert(X509_STORE_CTX *ctx) { SSL_DANE *dane = ctx->dane; int ret; if (ctx->cert == NULL) { X509err(X509_F_X509_VERIFY_CERT, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY); ctx->error = X509_V_ERR_INVALID_CALL; return -1; } if (ctx->chain != NULL) { /* * This X509_STORE_CTX has already been used to verify a cert. We * cannot do another one. */ X509err(X509_F_X509_VERIFY_CERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ctx->error = X509_V_ERR_INVALID_CALL; return -1; } if (!X509_up_ref(ctx->cert)) { X509err(X509_F_X509_VERIFY_CERT, ERR_R_INTERNAL_ERROR); ctx->error = X509_V_ERR_UNSPECIFIED; return -1; } /* * first we make sure the chain we are going to build is present and that * the first entry is in place */ if ((ctx->chain = sk_X509_new_null()) == NULL || !sk_X509_push(ctx->chain, ctx->cert)) { X509_free(ctx->cert); X509err(X509_F_X509_VERIFY_CERT, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return -1; } ctx->num_untrusted = 1; /* If the peer's public key is too weak, we can stop early. */ if (!check_key_level(ctx, ctx->cert) && !verify_cb_cert(ctx, ctx->cert, 0, X509_V_ERR_EE_KEY_TOO_SMALL)) return 0; if (DANETLS_ENABLED(dane)) ret = dane_verify(ctx); else ret = verify_chain(ctx); /* * Safety-net. If we are returning an error, we must also set ctx->error, * so that the chain is not considered verified should the error be ignored * (e.g. TLS with SSL_VERIFY_NONE). */ if (ret <= 0 && ctx->error == X509_V_OK) ctx->error = X509_V_ERR_UNSPECIFIED; return ret; } /* * Given a STACK_OF(X509) find the issuer of cert (if any) */ static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x) { int i; X509 *issuer, *rv = NULL; for (i = 0; i < sk_X509_num(sk); i++) { issuer = sk_X509_value(sk, i); if (ctx->check_issued(ctx, x, issuer)) { rv = issuer; if (x509_check_cert_time(ctx, rv, -1)) break; } } return rv; } /* * Check that the given certificate 'x' is issued by the certificate 'issuer' * and the issuer is not yet in ctx->chain, where the exceptional case * that 'x' is self-issued and ctx->chain has just one element is allowed. */ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer) { if (x509_likely_issued(issuer, x) != X509_V_OK) return 0; if ((x->ex_flags & EXFLAG_SI) == 0 || sk_X509_num(ctx->chain) != 1) { int i; X509 *ch; for (i = 0; i < sk_X509_num(ctx->chain); i++) { ch = sk_X509_value(ctx->chain, i); if (ch == issuer || X509_cmp(ch, issuer) == 0) return 0; } } return 1; } /* Alternative lookup method: look from a STACK stored in other_ctx */ static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) { *issuer = find_issuer(ctx, ctx->other_ctx, x); if (*issuer == NULL || !X509_up_ref(*issuer)) goto err; return 1; err: *issuer = NULL; return 0; } static STACK_OF(X509) *lookup_certs_sk(X509_STORE_CTX *ctx, X509_NAME *nm) { STACK_OF(X509) *sk = NULL; X509 *x; int i; for (i = 0; i < sk_X509_num(ctx->other_ctx); i++) { x = sk_X509_value(ctx->other_ctx, i); if (X509_NAME_cmp(nm, X509_get_subject_name(x)) == 0) { if (!X509_up_ref(x)) { sk_X509_pop_free(sk, X509_free); X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_INTERNAL_ERROR); ctx->error = X509_V_ERR_UNSPECIFIED; return NULL; } if (sk == NULL) sk = sk_X509_new_null(); if (sk == NULL || !sk_X509_push(sk, x)) { X509_free(x); sk_X509_pop_free(sk, X509_free); X509err(X509_F_LOOKUP_CERTS_SK, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return NULL; } } } return sk; } /* * Check EE or CA certificate purpose. For trusted certificates explicit local * auxiliary trust can be used to override EKU-restrictions. */ static int check_purpose(X509_STORE_CTX *ctx, X509 *x, int purpose, int depth, int must_be_ca) { int tr_ok = X509_TRUST_UNTRUSTED; /* * For trusted certificates we want to see whether any auxiliary trust * settings trump the purpose constraints. * * This is complicated by the fact that the trust ordinals in * ctx->param->trust are entirely independent of the purpose ordinals in * ctx->param->purpose! * * What connects them is their mutual initialization via calls from * X509_STORE_CTX_set_default() into X509_VERIFY_PARAM_lookup() which sets * related values of both param->trust and param->purpose. It is however * typically possible to infer associated trust values from a purpose value * via the X509_PURPOSE API. * * Therefore, we can only check for trust overrides when the purpose we're * checking is the same as ctx->param->purpose and ctx->param->trust is * also set. */ if (depth >= ctx->num_untrusted && purpose == ctx->param->purpose) tr_ok = X509_check_trust(x, ctx->param->trust, X509_TRUST_NO_SS_COMPAT); switch (tr_ok) { case X509_TRUST_TRUSTED: return 1; case X509_TRUST_REJECTED: break; default: switch (X509_check_purpose(x, purpose, must_be_ca > 0)) { case 1: return 1; case 0: break; default: if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) == 0) return 1; } break; } return verify_cb_cert(ctx, x, depth, X509_V_ERR_INVALID_PURPOSE); } /* * Check a certificate chains extensions for consistency with the supplied * purpose */ static int check_chain_extensions(X509_STORE_CTX *ctx) { int i, must_be_ca, plen = 0; X509 *x; int proxy_path_length = 0; int purpose; int allow_proxy_certs; int num = sk_X509_num(ctx->chain); /*- * must_be_ca can have 1 of 3 values: * -1: we accept both CA and non-CA certificates, to allow direct * use of self-signed certificates (which are marked as CA). * 0: we only accept non-CA certificates. This is currently not * used, but the possibility is present for future extensions. * 1: we only accept CA certificates. This is currently used for * all certificates in the chain except the leaf certificate. */ must_be_ca = -1; /* CRL path validation */ if (ctx->parent) { allow_proxy_certs = 0; purpose = X509_PURPOSE_CRL_SIGN; } else { allow_proxy_certs = ! !(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS); purpose = ctx->param->purpose; } for (i = 0; i < num; i++) { int ret; x = sk_X509_value(ctx->chain, i); if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) && (x->ex_flags & EXFLAG_CRITICAL)) { if (!verify_cb_cert(ctx, x, i, X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION)) return 0; } if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY)) { if (!verify_cb_cert(ctx, x, i, X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED)) return 0; } ret = X509_check_ca(x); switch (must_be_ca) { case -1: if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) && (ret != 1) && (ret != 0)) { ret = 0; ctx->error = X509_V_ERR_INVALID_CA; } else ret = 1; break; case 0: if (ret != 0) { ret = 0; ctx->error = X509_V_ERR_INVALID_NON_CA; } else ret = 1; break; default: /* X509_V_FLAG_X509_STRICT is implicit for intermediate CAs */ if ((ret == 0) || ((i + 1 < num || ctx->param->flags & X509_V_FLAG_X509_STRICT) && (ret != 1))) { ret = 0; ctx->error = X509_V_ERR_INVALID_CA; } else ret = 1; break; } - if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) && num > 1) { + if (ret > 0 + && (ctx->param->flags & X509_V_FLAG_X509_STRICT) && num > 1) { /* Check for presence of explicit elliptic curve parameters */ ret = check_curve(x); - if (ret < 0) + if (ret < 0) { ctx->error = X509_V_ERR_UNSPECIFIED; - else if (ret == 0) + ret = 0; + } else if (ret == 0) { ctx->error = X509_V_ERR_EC_KEY_EXPLICIT_PARAMS; + } } - if ((x->ex_flags & EXFLAG_CA) == 0 + if (ret > 0 + && (x->ex_flags & EXFLAG_CA) == 0 && x->ex_pathlen != -1 && (ctx->param->flags & X509_V_FLAG_X509_STRICT)) { ctx->error = X509_V_ERR_INVALID_EXTENSION; ret = 0; } if (ret == 0 && !verify_cb_cert(ctx, x, i, X509_V_OK)) return 0; /* check_purpose() makes the callback as needed */ if (purpose > 0 && !check_purpose(ctx, x, purpose, i, must_be_ca)) return 0; /* Check pathlen */ if ((i > 1) && (x->ex_pathlen != -1) && (plen > (x->ex_pathlen + proxy_path_length))) { if (!verify_cb_cert(ctx, x, i, X509_V_ERR_PATH_LENGTH_EXCEEDED)) return 0; } /* Increment path length if not a self issued intermediate CA */ if (i > 0 && (x->ex_flags & EXFLAG_SI) == 0) plen++; /* * If this certificate is a proxy certificate, the next certificate * must be another proxy certificate or a EE certificate. If not, * the next certificate must be a CA certificate. */ if (x->ex_flags & EXFLAG_PROXY) { /* * RFC3820, 4.1.3 (b)(1) stipulates that if pCPathLengthConstraint * is less than max_path_length, the former should be copied to * the latter, and 4.1.4 (a) stipulates that max_path_length * should be verified to be larger than zero and decrement it. * * Because we're checking the certs in the reverse order, we start * with verifying that proxy_path_length isn't larger than pcPLC, * and copy the latter to the former if it is, and finally, * increment proxy_path_length. */ if (x->ex_pcpathlen != -1) { if (proxy_path_length > x->ex_pcpathlen) { if (!verify_cb_cert(ctx, x, i, X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED)) return 0; } proxy_path_length = x->ex_pcpathlen; } proxy_path_length++; must_be_ca = 0; } else must_be_ca = 1; } return 1; } static int has_san_id(X509 *x, int gtype) { int i; int ret = 0; GENERAL_NAMES *gs = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL); if (gs == NULL) return 0; for (i = 0; i < sk_GENERAL_NAME_num(gs); i++) { GENERAL_NAME *g = sk_GENERAL_NAME_value(gs, i); if (g->type == gtype) { ret = 1; break; } } GENERAL_NAMES_free(gs); return ret; } static int check_name_constraints(X509_STORE_CTX *ctx) { int i; /* Check name constraints for all certificates */ for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) { X509 *x = sk_X509_value(ctx->chain, i); int j; /* Ignore self issued certs unless last in chain */ if (i && (x->ex_flags & EXFLAG_SI)) continue; /* * Proxy certificates policy has an extra constraint, where the * certificate subject MUST be the issuer with a single CN entry * added. * (RFC 3820: 3.4, 4.1.3 (a)(4)) */ if (x->ex_flags & EXFLAG_PROXY) { X509_NAME *tmpsubject = X509_get_subject_name(x); X509_NAME *tmpissuer = X509_get_issuer_name(x); X509_NAME_ENTRY *tmpentry = NULL; int last_object_nid = 0; int err = X509_V_OK; int last_object_loc = X509_NAME_entry_count(tmpsubject) - 1; /* Check that there are at least two RDNs */ if (last_object_loc < 1) { err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; goto proxy_name_done; } /* * Check that there is exactly one more RDN in subject as * there is in issuer. */ if (X509_NAME_entry_count(tmpsubject) != X509_NAME_entry_count(tmpissuer) + 1) { err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; goto proxy_name_done; } /* * Check that the last subject component isn't part of a * multivalued RDN */ if (X509_NAME_ENTRY_set(X509_NAME_get_entry(tmpsubject, last_object_loc)) == X509_NAME_ENTRY_set(X509_NAME_get_entry(tmpsubject, last_object_loc - 1))) { err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; goto proxy_name_done; } /* * Check that the last subject RDN is a commonName, and that * all the previous RDNs match the issuer exactly */ tmpsubject = X509_NAME_dup(tmpsubject); if (tmpsubject == NULL) { X509err(X509_F_CHECK_NAME_CONSTRAINTS, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return 0; } tmpentry = X509_NAME_delete_entry(tmpsubject, last_object_loc); last_object_nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(tmpentry)); if (last_object_nid != NID_commonName || X509_NAME_cmp(tmpsubject, tmpissuer) != 0) { err = X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION; } X509_NAME_ENTRY_free(tmpentry); X509_NAME_free(tmpsubject); proxy_name_done: if (err != X509_V_OK && !verify_cb_cert(ctx, x, i, err)) return 0; } /* * Check against constraints for all certificates higher in chain * including trust anchor. Trust anchor not strictly speaking needed * but if it includes constraints it is to be assumed it expects them * to be obeyed. */ for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) { NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc; if (nc) { int rv = NAME_CONSTRAINTS_check(x, nc); /* If EE certificate check commonName too */ if (rv == X509_V_OK && i == 0 && (ctx->param->hostflags & X509_CHECK_FLAG_NEVER_CHECK_SUBJECT) == 0 && ((ctx->param->hostflags & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT) != 0 || !has_san_id(x, GEN_DNS))) rv = NAME_CONSTRAINTS_check_CN(x, nc); switch (rv) { case X509_V_OK: break; case X509_V_ERR_OUT_OF_MEM: return 0; default: if (!verify_cb_cert(ctx, x, i, rv)) return 0; break; } } } } return 1; } static int check_id_error(X509_STORE_CTX *ctx, int errcode) { return verify_cb_cert(ctx, ctx->cert, 0, errcode); } static int check_hosts(X509 *x, X509_VERIFY_PARAM *vpm) { int i; int n = sk_OPENSSL_STRING_num(vpm->hosts); char *name; if (vpm->peername != NULL) { OPENSSL_free(vpm->peername); vpm->peername = NULL; } for (i = 0; i < n; ++i) { name = sk_OPENSSL_STRING_value(vpm->hosts, i); if (X509_check_host(x, name, 0, vpm->hostflags, &vpm->peername) > 0) return 1; } return n == 0; } static int check_id(X509_STORE_CTX *ctx) { X509_VERIFY_PARAM *vpm = ctx->param; X509 *x = ctx->cert; if (vpm->hosts && check_hosts(x, vpm) <= 0) { if (!check_id_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH)) return 0; } if (vpm->email && X509_check_email(x, vpm->email, vpm->emaillen, 0) <= 0) { if (!check_id_error(ctx, X509_V_ERR_EMAIL_MISMATCH)) return 0; } if (vpm->ip && X509_check_ip(x, vpm->ip, vpm->iplen, 0) <= 0) { if (!check_id_error(ctx, X509_V_ERR_IP_ADDRESS_MISMATCH)) return 0; } return 1; } static int check_trust(X509_STORE_CTX *ctx, int num_untrusted) { int i; X509 *x = NULL; X509 *mx; SSL_DANE *dane = ctx->dane; int num = sk_X509_num(ctx->chain); int trust; /* * Check for a DANE issuer at depth 1 or greater, if it is a DANE-TA(2) * match, we're done, otherwise we'll merely record the match depth. */ if (DANETLS_HAS_TA(dane) && num_untrusted > 0 && num_untrusted < num) { switch (trust = check_dane_issuer(ctx, num_untrusted)) { case X509_TRUST_TRUSTED: case X509_TRUST_REJECTED: return trust; } } /* * Check trusted certificates in chain at depth num_untrusted and up. * Note, that depths 0..num_untrusted-1 may also contain trusted * certificates, but the caller is expected to have already checked those, * and wants to incrementally check just any added since. */ for (i = num_untrusted; i < num; i++) { x = sk_X509_value(ctx->chain, i); trust = X509_check_trust(x, ctx->param->trust, 0); /* If explicitly trusted return trusted */ if (trust == X509_TRUST_TRUSTED) goto trusted; if (trust == X509_TRUST_REJECTED) goto rejected; } /* * If we are looking at a trusted certificate, and accept partial chains, * the chain is PKIX trusted. */ if (num_untrusted < num) { if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) goto trusted; return X509_TRUST_UNTRUSTED; } if (num_untrusted == num && ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { /* * Last-resort call with no new trusted certificates, check the leaf * for a direct trust store match. */ i = 0; x = sk_X509_value(ctx->chain, i); mx = lookup_cert_match(ctx, x); if (!mx) return X509_TRUST_UNTRUSTED; /* * Check explicit auxiliary trust/reject settings. If none are set, * we'll accept X509_TRUST_UNTRUSTED when not self-signed. */ trust = X509_check_trust(mx, ctx->param->trust, 0); if (trust == X509_TRUST_REJECTED) { X509_free(mx); goto rejected; } /* Replace leaf with trusted match */ (void) sk_X509_set(ctx->chain, 0, mx); X509_free(x); ctx->num_untrusted = 0; goto trusted; } /* * If no trusted certs in chain at all return untrusted and allow * standard (no issuer cert) etc errors to be indicated. */ return X509_TRUST_UNTRUSTED; rejected: if (!verify_cb_cert(ctx, x, i, X509_V_ERR_CERT_REJECTED)) return X509_TRUST_REJECTED; return X509_TRUST_UNTRUSTED; trusted: if (!DANETLS_ENABLED(dane)) return X509_TRUST_TRUSTED; if (dane->pdpth < 0) dane->pdpth = num_untrusted; /* With DANE, PKIX alone is not trusted until we have both */ if (dane->mdpth >= 0) return X509_TRUST_TRUSTED; return X509_TRUST_UNTRUSTED; } static int check_revocation(X509_STORE_CTX *ctx) { int i = 0, last = 0, ok = 0; if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK)) return 1; if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) last = sk_X509_num(ctx->chain) - 1; else { /* If checking CRL paths this isn't the EE certificate */ if (ctx->parent) return 1; last = 0; } for (i = 0; i <= last; i++) { ctx->error_depth = i; ok = check_cert(ctx); if (!ok) return ok; } return 1; } static int check_cert(X509_STORE_CTX *ctx) { X509_CRL *crl = NULL, *dcrl = NULL; int ok = 0; int cnum = ctx->error_depth; X509 *x = sk_X509_value(ctx->chain, cnum); ctx->current_cert = x; ctx->current_issuer = NULL; ctx->current_crl_score = 0; ctx->current_reasons = 0; if (x->ex_flags & EXFLAG_PROXY) return 1; while (ctx->current_reasons != CRLDP_ALL_REASONS) { unsigned int last_reasons = ctx->current_reasons; /* Try to retrieve relevant CRL */ if (ctx->get_crl) ok = ctx->get_crl(ctx, &crl, x); else ok = get_crl_delta(ctx, &crl, &dcrl, x); /* * If error looking up CRL, nothing we can do except notify callback */ if (!ok) { ok = verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL); goto done; } ctx->current_crl = crl; ok = ctx->check_crl(ctx, crl); if (!ok) goto done; if (dcrl) { ok = ctx->check_crl(ctx, dcrl); if (!ok) goto done; ok = ctx->cert_crl(ctx, dcrl, x); if (!ok) goto done; } else ok = 1; /* Don't look in full CRL if delta reason is removefromCRL */ if (ok != 2) { ok = ctx->cert_crl(ctx, crl, x); if (!ok) goto done; } X509_CRL_free(crl); X509_CRL_free(dcrl); crl = NULL; dcrl = NULL; /* * If reasons not updated we won't get anywhere by another iteration, * so exit loop. */ if (last_reasons == ctx->current_reasons) { ok = verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL); goto done; } } done: X509_CRL_free(crl); X509_CRL_free(dcrl); ctx->current_crl = NULL; return ok; } /* Check CRL times against values in X509_STORE_CTX */ static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify) { time_t *ptime; int i; if (notify) ctx->current_crl = crl; if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) ptime = &ctx->param->check_time; else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) return 1; else ptime = NULL; i = X509_cmp_time(X509_CRL_get0_lastUpdate(crl), ptime); if (i == 0) { if (!notify) return 0; if (!verify_cb_crl(ctx, X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD)) return 0; } if (i > 0) { if (!notify) return 0; if (!verify_cb_crl(ctx, X509_V_ERR_CRL_NOT_YET_VALID)) return 0; } if (X509_CRL_get0_nextUpdate(crl)) { i = X509_cmp_time(X509_CRL_get0_nextUpdate(crl), ptime); if (i == 0) { if (!notify) return 0; if (!verify_cb_crl(ctx, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD)) return 0; } /* Ignore expiry of base CRL is delta is valid */ if ((i < 0) && !(ctx->current_crl_score & CRL_SCORE_TIME_DELTA)) { if (!notify) return 0; if (!verify_cb_crl(ctx, X509_V_ERR_CRL_HAS_EXPIRED)) return 0; } } if (notify) ctx->current_crl = NULL; return 1; } static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, X509 **pissuer, int *pscore, unsigned int *preasons, STACK_OF(X509_CRL) *crls) { int i, crl_score, best_score = *pscore; unsigned int reasons, best_reasons = 0; X509 *x = ctx->current_cert; X509_CRL *crl, *best_crl = NULL; X509 *crl_issuer = NULL, *best_crl_issuer = NULL; for (i = 0; i < sk_X509_CRL_num(crls); i++) { crl = sk_X509_CRL_value(crls, i); reasons = *preasons; crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x); if (crl_score < best_score || crl_score == 0) continue; /* If current CRL is equivalent use it if it is newer */ if (crl_score == best_score && best_crl != NULL) { int day, sec; if (ASN1_TIME_diff(&day, &sec, X509_CRL_get0_lastUpdate(best_crl), X509_CRL_get0_lastUpdate(crl)) == 0) continue; /* * ASN1_TIME_diff never returns inconsistent signs for |day| * and |sec|. */ if (day <= 0 && sec <= 0) continue; } best_crl = crl; best_crl_issuer = crl_issuer; best_score = crl_score; best_reasons = reasons; } if (best_crl) { X509_CRL_free(*pcrl); *pcrl = best_crl; *pissuer = best_crl_issuer; *pscore = best_score; *preasons = best_reasons; X509_CRL_up_ref(best_crl); X509_CRL_free(*pdcrl); *pdcrl = NULL; get_delta_sk(ctx, pdcrl, pscore, best_crl, crls); } if (best_score >= CRL_SCORE_VALID) return 1; return 0; } /* * Compare two CRL extensions for delta checking purposes. They should be * both present or both absent. If both present all fields must be identical. */ static int crl_extension_match(X509_CRL *a, X509_CRL *b, int nid) { ASN1_OCTET_STRING *exta, *extb; int i; i = X509_CRL_get_ext_by_NID(a, nid, -1); if (i >= 0) { /* Can't have multiple occurrences */ if (X509_CRL_get_ext_by_NID(a, nid, i) != -1) return 0; exta = X509_EXTENSION_get_data(X509_CRL_get_ext(a, i)); } else exta = NULL; i = X509_CRL_get_ext_by_NID(b, nid, -1); if (i >= 0) { if (X509_CRL_get_ext_by_NID(b, nid, i) != -1) return 0; extb = X509_EXTENSION_get_data(X509_CRL_get_ext(b, i)); } else extb = NULL; if (!exta && !extb) return 1; if (!exta || !extb) return 0; if (ASN1_OCTET_STRING_cmp(exta, extb)) return 0; return 1; } /* See if a base and delta are compatible */ static int check_delta_base(X509_CRL *delta, X509_CRL *base) { /* Delta CRL must be a delta */ if (!delta->base_crl_number) return 0; /* Base must have a CRL number */ if (!base->crl_number) return 0; /* Issuer names must match */ if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(delta))) return 0; /* AKID and IDP must match */ if (!crl_extension_match(delta, base, NID_authority_key_identifier)) return 0; if (!crl_extension_match(delta, base, NID_issuing_distribution_point)) return 0; /* Delta CRL base number must not exceed Full CRL number. */ if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0) return 0; /* Delta CRL number must exceed full CRL number */ if (ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0) return 1; return 0; } /* * For a given base CRL find a delta... maybe extend to delta scoring or * retrieve a chain of deltas... */ static void get_delta_sk(X509_STORE_CTX *ctx, X509_CRL **dcrl, int *pscore, X509_CRL *base, STACK_OF(X509_CRL) *crls) { X509_CRL *delta; int i; if (!(ctx->param->flags & X509_V_FLAG_USE_DELTAS)) return; if (!((ctx->current_cert->ex_flags | base->flags) & EXFLAG_FRESHEST)) return; for (i = 0; i < sk_X509_CRL_num(crls); i++) { delta = sk_X509_CRL_value(crls, i); if (check_delta_base(delta, base)) { if (check_crl_time(ctx, delta, 0)) *pscore |= CRL_SCORE_TIME_DELTA; X509_CRL_up_ref(delta); *dcrl = delta; return; } } *dcrl = NULL; } /* * For a given CRL return how suitable it is for the supplied certificate * 'x'. The return value is a mask of several criteria. If the issuer is not * the certificate issuer this is returned in *pissuer. The reasons mask is * also used to determine if the CRL is suitable: if no new reasons the CRL * is rejected, otherwise reasons is updated. */ static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer, unsigned int *preasons, X509_CRL *crl, X509 *x) { int crl_score = 0; unsigned int tmp_reasons = *preasons, crl_reasons; /* First see if we can reject CRL straight away */ /* Invalid IDP cannot be processed */ if (crl->idp_flags & IDP_INVALID) return 0; /* Reason codes or indirect CRLs need extended CRL support */ if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) { if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS)) return 0; } else if (crl->idp_flags & IDP_REASONS) { /* If no new reasons reject */ if (!(crl->idp_reasons & ~tmp_reasons)) return 0; } /* Don't process deltas at this stage */ else if (crl->base_crl_number) return 0; /* If issuer name doesn't match certificate need indirect CRL */ if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl))) { if (!(crl->idp_flags & IDP_INDIRECT)) return 0; } else crl_score |= CRL_SCORE_ISSUER_NAME; if (!(crl->flags & EXFLAG_CRITICAL)) crl_score |= CRL_SCORE_NOCRITICAL; /* Check expiry */ if (check_crl_time(ctx, crl, 0)) crl_score |= CRL_SCORE_TIME; /* Check authority key ID and locate certificate issuer */ crl_akid_check(ctx, crl, pissuer, &crl_score); /* If we can't locate certificate issuer at this point forget it */ if (!(crl_score & CRL_SCORE_AKID)) return 0; /* Check cert for matching CRL distribution points */ if (crl_crldp_check(x, crl, crl_score, &crl_reasons)) { /* If no new reasons reject */ if (!(crl_reasons & ~tmp_reasons)) return 0; tmp_reasons |= crl_reasons; crl_score |= CRL_SCORE_SCOPE; } *preasons = tmp_reasons; return crl_score; } static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl, X509 **pissuer, int *pcrl_score) { X509 *crl_issuer = NULL; X509_NAME *cnm = X509_CRL_get_issuer(crl); int cidx = ctx->error_depth; int i; if (cidx != sk_X509_num(ctx->chain) - 1) cidx++; crl_issuer = sk_X509_value(ctx->chain, cidx); if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { if (*pcrl_score & CRL_SCORE_ISSUER_NAME) { *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_ISSUER_CERT; *pissuer = crl_issuer; return; } } for (cidx++; cidx < sk_X509_num(ctx->chain); cidx++) { crl_issuer = sk_X509_value(ctx->chain, cidx); if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) continue; if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { *pcrl_score |= CRL_SCORE_AKID | CRL_SCORE_SAME_PATH; *pissuer = crl_issuer; return; } } /* Anything else needs extended CRL support */ if (!(ctx->param->flags & X509_V_FLAG_EXTENDED_CRL_SUPPORT)) return; /* * Otherwise the CRL issuer is not on the path. Look for it in the set of * untrusted certificates. */ for (i = 0; i < sk_X509_num(ctx->untrusted); i++) { crl_issuer = sk_X509_value(ctx->untrusted, i); if (X509_NAME_cmp(X509_get_subject_name(crl_issuer), cnm)) continue; if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK) { *pissuer = crl_issuer; *pcrl_score |= CRL_SCORE_AKID; return; } } } /* * Check the path of a CRL issuer certificate. This creates a new * X509_STORE_CTX and populates it with most of the parameters from the * parent. This could be optimised somewhat since a lot of path checking will * be duplicated by the parent, but this will rarely be used in practice. */ static int check_crl_path(X509_STORE_CTX *ctx, X509 *x) { X509_STORE_CTX crl_ctx; int ret; /* Don't allow recursive CRL path validation */ if (ctx->parent) return 0; if (!X509_STORE_CTX_init(&crl_ctx, ctx->ctx, x, ctx->untrusted)) return -1; crl_ctx.crls = ctx->crls; /* Copy verify params across */ X509_STORE_CTX_set0_param(&crl_ctx, ctx->param); crl_ctx.parent = ctx; crl_ctx.verify_cb = ctx->verify_cb; /* Verify CRL issuer */ ret = X509_verify_cert(&crl_ctx); if (ret <= 0) goto err; /* Check chain is acceptable */ ret = check_crl_chain(ctx, ctx->chain, crl_ctx.chain); err: X509_STORE_CTX_cleanup(&crl_ctx); return ret; } /* * RFC3280 says nothing about the relationship between CRL path and * certificate path, which could lead to situations where a certificate could * be revoked or validated by a CA not authorised to do so. RFC5280 is more * strict and states that the two paths must end in the same trust anchor, * though some discussions remain... until this is resolved we use the * RFC5280 version */ static int check_crl_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *cert_path, STACK_OF(X509) *crl_path) { X509 *cert_ta, *crl_ta; cert_ta = sk_X509_value(cert_path, sk_X509_num(cert_path) - 1); crl_ta = sk_X509_value(crl_path, sk_X509_num(crl_path) - 1); if (!X509_cmp(cert_ta, crl_ta)) return 1; return 0; } /*- * Check for match between two dist point names: three separate cases. * 1. Both are relative names and compare X509_NAME types. * 2. One full, one relative. Compare X509_NAME to GENERAL_NAMES. * 3. Both are full names and compare two GENERAL_NAMES. * 4. One is NULL: automatic match. */ static int idp_check_dp(DIST_POINT_NAME *a, DIST_POINT_NAME *b) { X509_NAME *nm = NULL; GENERAL_NAMES *gens = NULL; GENERAL_NAME *gena, *genb; int i, j; if (!a || !b) return 1; if (a->type == 1) { if (!a->dpname) return 0; /* Case 1: two X509_NAME */ if (b->type == 1) { if (!b->dpname) return 0; if (!X509_NAME_cmp(a->dpname, b->dpname)) return 1; else return 0; } /* Case 2: set name and GENERAL_NAMES appropriately */ nm = a->dpname; gens = b->name.fullname; } else if (b->type == 1) { if (!b->dpname) return 0; /* Case 2: set name and GENERAL_NAMES appropriately */ gens = a->name.fullname; nm = b->dpname; } /* Handle case 2 with one GENERAL_NAMES and one X509_NAME */ if (nm) { for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) { gena = sk_GENERAL_NAME_value(gens, i); if (gena->type != GEN_DIRNAME) continue; if (!X509_NAME_cmp(nm, gena->d.directoryName)) return 1; } return 0; } /* Else case 3: two GENERAL_NAMES */ for (i = 0; i < sk_GENERAL_NAME_num(a->name.fullname); i++) { gena = sk_GENERAL_NAME_value(a->name.fullname, i); for (j = 0; j < sk_GENERAL_NAME_num(b->name.fullname); j++) { genb = sk_GENERAL_NAME_value(b->name.fullname, j); if (!GENERAL_NAME_cmp(gena, genb)) return 1; } } return 0; } static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score) { int i; X509_NAME *nm = X509_CRL_get_issuer(crl); /* If no CRLissuer return is successful iff don't need a match */ if (!dp->CRLissuer) return ! !(crl_score & CRL_SCORE_ISSUER_NAME); for (i = 0; i < sk_GENERAL_NAME_num(dp->CRLissuer); i++) { GENERAL_NAME *gen = sk_GENERAL_NAME_value(dp->CRLissuer, i); if (gen->type != GEN_DIRNAME) continue; if (!X509_NAME_cmp(gen->d.directoryName, nm)) return 1; } return 0; } /* Check CRLDP and IDP */ static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score, unsigned int *preasons) { int i; if (crl->idp_flags & IDP_ONLYATTR) return 0; if (x->ex_flags & EXFLAG_CA) { if (crl->idp_flags & IDP_ONLYUSER) return 0; } else { if (crl->idp_flags & IDP_ONLYCA) return 0; } *preasons = crl->idp_reasons; for (i = 0; i < sk_DIST_POINT_num(x->crldp); i++) { DIST_POINT *dp = sk_DIST_POINT_value(x->crldp, i); if (crldp_check_crlissuer(dp, crl, crl_score)) { if (!crl->idp || idp_check_dp(dp->distpoint, crl->idp->distpoint)) { *preasons &= dp->dp_reasons; return 1; } } } if ((!crl->idp || !crl->idp->distpoint) && (crl_score & CRL_SCORE_ISSUER_NAME)) return 1; return 0; } /* * Retrieve CRL corresponding to current certificate. If deltas enabled try * to find a delta CRL too */ static int get_crl_delta(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, X509 *x) { int ok; X509 *issuer = NULL; int crl_score = 0; unsigned int reasons; X509_CRL *crl = NULL, *dcrl = NULL; STACK_OF(X509_CRL) *skcrl; X509_NAME *nm = X509_get_issuer_name(x); reasons = ctx->current_reasons; ok = get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, ctx->crls); if (ok) goto done; /* Lookup CRLs from store */ skcrl = ctx->lookup_crls(ctx, nm); /* If no CRLs found and a near match from get_crl_sk use that */ if (!skcrl && crl) goto done; get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl); sk_X509_CRL_pop_free(skcrl, X509_CRL_free); done: /* If we got any kind of CRL use it and return success */ if (crl) { ctx->current_issuer = issuer; ctx->current_crl_score = crl_score; ctx->current_reasons = reasons; *pcrl = crl; *pdcrl = dcrl; return 1; } return 0; } /* Check CRL validity */ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) { X509 *issuer = NULL; EVP_PKEY *ikey = NULL; int cnum = ctx->error_depth; int chnum = sk_X509_num(ctx->chain) - 1; /* if we have an alternative CRL issuer cert use that */ if (ctx->current_issuer) issuer = ctx->current_issuer; /* * Else find CRL issuer: if not last certificate then issuer is next * certificate in chain. */ else if (cnum < chnum) issuer = sk_X509_value(ctx->chain, cnum + 1); else { issuer = sk_X509_value(ctx->chain, chnum); /* If not self signed, can't check signature */ if (!ctx->check_issued(ctx, issuer, issuer) && !verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER)) return 0; } if (issuer == NULL) return 1; /* * Skip most tests for deltas because they have already been done */ if (!crl->base_crl_number) { /* Check for cRLSign bit if keyUsage present */ if ((issuer->ex_flags & EXFLAG_KUSAGE) && !(issuer->ex_kusage & KU_CRL_SIGN) && !verify_cb_crl(ctx, X509_V_ERR_KEYUSAGE_NO_CRL_SIGN)) return 0; if (!(ctx->current_crl_score & CRL_SCORE_SCOPE) && !verify_cb_crl(ctx, X509_V_ERR_DIFFERENT_CRL_SCOPE)) return 0; if (!(ctx->current_crl_score & CRL_SCORE_SAME_PATH) && check_crl_path(ctx, ctx->current_issuer) <= 0 && !verify_cb_crl(ctx, X509_V_ERR_CRL_PATH_VALIDATION_ERROR)) return 0; if ((crl->idp_flags & IDP_INVALID) && !verify_cb_crl(ctx, X509_V_ERR_INVALID_EXTENSION)) return 0; } if (!(ctx->current_crl_score & CRL_SCORE_TIME) && !check_crl_time(ctx, crl, 1)) return 0; /* Attempt to get issuer certificate public key */ ikey = X509_get0_pubkey(issuer); if (!ikey && !verify_cb_crl(ctx, X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY)) return 0; if (ikey) { int rv = X509_CRL_check_suiteb(crl, ikey, ctx->param->flags); if (rv != X509_V_OK && !verify_cb_crl(ctx, rv)) return 0; /* Verify CRL signature */ if (X509_CRL_verify(crl, ikey) <= 0 && !verify_cb_crl(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE)) return 0; } return 1; } /* Check certificate against CRL */ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) { X509_REVOKED *rev; /* * The rules changed for this... previously if a CRL contained unhandled * critical extensions it could still be used to indicate a certificate * was revoked. This has since been changed since critical extensions can * change the meaning of CRL entries. */ if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL) && (crl->flags & EXFLAG_CRITICAL) && !verify_cb_crl(ctx, X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION)) return 0; /* * Look for serial number of certificate in CRL. If found, make sure * reason is not removeFromCRL. */ if (X509_CRL_get0_by_cert(crl, &rev, x)) { if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) return 2; if (!verify_cb_crl(ctx, X509_V_ERR_CERT_REVOKED)) return 0; } return 1; } static int check_policy(X509_STORE_CTX *ctx) { int ret; if (ctx->parent) return 1; /* * With DANE, the trust anchor might be a bare public key, not a * certificate! In that case our chain does not have the trust anchor * certificate as a top-most element. This comports well with RFC5280 * chain verification, since there too, the trust anchor is not part of the * chain to be verified. In particular, X509_policy_check() does not look * at the TA cert, but assumes that it is present as the top-most chain * element. We therefore temporarily push a NULL cert onto the chain if it * was verified via a bare public key, and pop it off right after the * X509_policy_check() call. */ if (ctx->bare_ta_signed && !sk_X509_push(ctx->chain, NULL)) { X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return 0; } ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain, ctx->param->policies, ctx->param->flags); if (ctx->bare_ta_signed) sk_X509_pop(ctx->chain); if (ret == X509_PCY_TREE_INTERNAL) { X509err(X509_F_CHECK_POLICY, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return 0; } /* Invalid or inconsistent extensions */ if (ret == X509_PCY_TREE_INVALID) { int i; /* Locate certificates with bad extensions and notify callback. */ for (i = 1; i < sk_X509_num(ctx->chain); i++) { X509 *x = sk_X509_value(ctx->chain, i); if (!(x->ex_flags & EXFLAG_INVALID_POLICY)) continue; if (!verify_cb_cert(ctx, x, i, X509_V_ERR_INVALID_POLICY_EXTENSION)) return 0; } return 1; } if (ret == X509_PCY_TREE_FAILURE) { ctx->current_cert = NULL; ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY; return ctx->verify_cb(0, ctx); } if (ret != X509_PCY_TREE_VALID) { X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR); return 0; } if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY) { ctx->current_cert = NULL; /* * Verification errors need to be "sticky", a callback may have allowed * an SSL handshake to continue despite an error, and we must then * remain in an error state. Therefore, we MUST NOT clear earlier * verification errors by setting the error to X509_V_OK. */ if (!ctx->verify_cb(2, ctx)) return 0; } return 1; } /*- * Check certificate validity times. * If depth >= 0, invoke verification callbacks on error, otherwise just return * the validation status. * * Return 1 on success, 0 otherwise. */ int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth) { time_t *ptime; int i; if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) ptime = &ctx->param->check_time; else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) return 1; else ptime = NULL; i = X509_cmp_time(X509_get0_notBefore(x), ptime); if (i >= 0 && depth < 0) return 0; if (i == 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD)) return 0; if (i > 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_CERT_NOT_YET_VALID)) return 0; i = X509_cmp_time(X509_get0_notAfter(x), ptime); if (i <= 0 && depth < 0) return 0; if (i == 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD)) return 0; if (i < 0 && !verify_cb_cert(ctx, x, depth, X509_V_ERR_CERT_HAS_EXPIRED)) return 0; return 1; } /* verify the issuer signatures and cert times of ctx->chain */ static int internal_verify(X509_STORE_CTX *ctx) { int n = sk_X509_num(ctx->chain) - 1; X509 *xi = sk_X509_value(ctx->chain, n); X509 *xs; /* * With DANE-verified bare public key TA signatures, it remains only to * check the timestamps of the top certificate. We report the issuer as * NULL, since all we have is a bare key. */ if (ctx->bare_ta_signed) { xs = xi; xi = NULL; goto check_cert; } if (ctx->check_issued(ctx, xi, xi)) xs = xi; /* the typical case: last cert in the chain is self-issued */ else { if (ctx->param->flags & X509_V_FLAG_PARTIAL_CHAIN) { xs = xi; goto check_cert; } if (n <= 0) return verify_cb_cert(ctx, xi, 0, X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE); n--; ctx->error_depth = n; xs = sk_X509_value(ctx->chain, n); } /* * Do not clear ctx->error=0, it must be "sticky", only the user's callback * is allowed to reset errors (at its own peril). */ while (n >= 0) { /* * For each iteration of this loop: * n is the subject depth * xs is the subject cert, for which the signature is to be checked * xi is the supposed issuer cert containing the public key to use * Initially xs == xi if the last cert in the chain is self-issued. * * Skip signature check for self-signed certificates unless explicitly * asked for because it does not add any security and just wastes time. */ if (xs != xi || ((ctx->param->flags & X509_V_FLAG_CHECK_SS_SIGNATURE) && (xi->ex_flags & EXFLAG_SS) != 0)) { EVP_PKEY *pkey; /* * If the issuer's public key is not available or its key usage * does not support issuing the subject cert, report the issuer * cert and its depth (rather than n, the depth of the subject). */ int issuer_depth = n + (xs == xi ? 0 : 1); /* * According to https://tools.ietf.org/html/rfc5280#section-6.1.4 * step (n) we must check any given key usage extension in a CA cert * when preparing the verification of a certificate issued by it. * According to https://tools.ietf.org/html/rfc5280#section-4.2.1.3 * we must not verify a certifiate signature if the key usage of the * CA certificate that issued the certificate prohibits signing. * In case the 'issuing' certificate is the last in the chain and is * not a CA certificate but a 'self-issued' end-entity cert (i.e., * xs == xi && !(xi->ex_flags & EXFLAG_CA)) RFC 5280 does not apply * (see https://tools.ietf.org/html/rfc6818#section-2) and thus * we are free to ignore any key usage restrictions on such certs. */ int ret = xs == xi && (xi->ex_flags & EXFLAG_CA) == 0 ? X509_V_OK : x509_signing_allowed(xi, xs); if (ret != X509_V_OK && !verify_cb_cert(ctx, xi, issuer_depth, ret)) return 0; if ((pkey = X509_get0_pubkey(xi)) == NULL) { ret = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY; if (!verify_cb_cert(ctx, xi, issuer_depth, ret)) return 0; } else if (X509_verify(xs, pkey) <= 0) { ret = X509_V_ERR_CERT_SIGNATURE_FAILURE; if (!verify_cb_cert(ctx, xs, n, ret)) return 0; } } check_cert: /* Calls verify callback as needed */ if (!x509_check_cert_time(ctx, xs, n)) return 0; /* * Signal success at this depth. However, the previous error (if any) * is retained. */ ctx->current_issuer = xi; ctx->current_cert = xs; ctx->error_depth = n; if (!ctx->verify_cb(1, ctx)) return 0; if (--n >= 0) { xi = xs; xs = sk_X509_value(ctx->chain, n); } } return 1; } int X509_cmp_current_time(const ASN1_TIME *ctm) { return X509_cmp_time(ctm, NULL); } int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) { static const size_t utctime_length = sizeof("YYMMDDHHMMSSZ") - 1; static const size_t generalizedtime_length = sizeof("YYYYMMDDHHMMSSZ") - 1; ASN1_TIME *asn1_cmp_time = NULL; int i, day, sec, ret = 0; #ifdef CHARSET_EBCDIC const char upper_z = 0x5A; #else const char upper_z = 'Z'; #endif /* * Note that ASN.1 allows much more slack in the time format than RFC5280. * In RFC5280, the representation is fixed: * UTCTime: YYMMDDHHMMSSZ * GeneralizedTime: YYYYMMDDHHMMSSZ * * We do NOT currently enforce the following RFC 5280 requirement: * "CAs conforming to this profile MUST always encode certificate * validity dates through the year 2049 as UTCTime; certificate validity * dates in 2050 or later MUST be encoded as GeneralizedTime." */ switch (ctm->type) { case V_ASN1_UTCTIME: if (ctm->length != (int)(utctime_length)) return 0; break; case V_ASN1_GENERALIZEDTIME: if (ctm->length != (int)(generalizedtime_length)) return 0; break; default: return 0; } /** * Verify the format: the ASN.1 functions we use below allow a more * flexible format than what's mandated by RFC 5280. * Digit and date ranges will be verified in the conversion methods. */ for (i = 0; i < ctm->length - 1; i++) { if (!ascii_isdigit(ctm->data[i])) return 0; } if (ctm->data[ctm->length - 1] != upper_z) return 0; /* * There is ASN1_UTCTIME_cmp_time_t but no * ASN1_GENERALIZEDTIME_cmp_time_t or ASN1_TIME_cmp_time_t, * so we go through ASN.1 */ asn1_cmp_time = X509_time_adj(NULL, 0, cmp_time); if (asn1_cmp_time == NULL) goto err; if (!ASN1_TIME_diff(&day, &sec, ctm, asn1_cmp_time)) goto err; /* * X509_cmp_time comparison is <=. * The return value 0 is reserved for errors. */ ret = (day >= 0 && sec >= 0) ? -1 : 1; err: ASN1_TIME_free(asn1_cmp_time); return ret; } ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj) { return X509_time_adj(s, adj, NULL); } ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm) { return X509_time_adj_ex(s, 0, offset_sec, in_tm); } ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec, time_t *in_tm) { time_t t; if (in_tm) t = *in_tm; else time(&t); if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) { if (s->type == V_ASN1_UTCTIME) return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec); if (s->type == V_ASN1_GENERALIZEDTIME) return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec); } return ASN1_TIME_adj(s, t, offset_day, offset_sec); } int X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain) { EVP_PKEY *ktmp = NULL, *ktmp2; int i, j; if ((pkey != NULL) && !EVP_PKEY_missing_parameters(pkey)) return 1; for (i = 0; i < sk_X509_num(chain); i++) { ktmp = X509_get0_pubkey(sk_X509_value(chain, i)); if (ktmp == NULL) { X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY); return 0; } if (!EVP_PKEY_missing_parameters(ktmp)) break; } if (ktmp == NULL) { X509err(X509_F_X509_GET_PUBKEY_PARAMETERS, X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN); return 0; } /* first, populate the other certs */ for (j = i - 1; j >= 0; j--) { ktmp2 = X509_get0_pubkey(sk_X509_value(chain, j)); EVP_PKEY_copy_parameters(ktmp2, ktmp); } if (pkey != NULL) EVP_PKEY_copy_parameters(pkey, ktmp); return 1; } /* Make a delta CRL as the diff between two full CRLs */ X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, EVP_PKEY *skey, const EVP_MD *md, unsigned int flags) { X509_CRL *crl = NULL; int i; STACK_OF(X509_REVOKED) *revs = NULL; /* CRLs can't be delta already */ if (base->base_crl_number || newer->base_crl_number) { X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_ALREADY_DELTA); return NULL; } /* Base and new CRL must have a CRL number */ if (!base->crl_number || !newer->crl_number) { X509err(X509_F_X509_CRL_DIFF, X509_R_NO_CRL_NUMBER); return NULL; } /* Issuer names must match */ if (X509_NAME_cmp(X509_CRL_get_issuer(base), X509_CRL_get_issuer(newer))) { X509err(X509_F_X509_CRL_DIFF, X509_R_ISSUER_MISMATCH); return NULL; } /* AKID and IDP must match */ if (!crl_extension_match(base, newer, NID_authority_key_identifier)) { X509err(X509_F_X509_CRL_DIFF, X509_R_AKID_MISMATCH); return NULL; } if (!crl_extension_match(base, newer, NID_issuing_distribution_point)) { X509err(X509_F_X509_CRL_DIFF, X509_R_IDP_MISMATCH); return NULL; } /* Newer CRL number must exceed full CRL number */ if (ASN1_INTEGER_cmp(newer->crl_number, base->crl_number) <= 0) { X509err(X509_F_X509_CRL_DIFF, X509_R_NEWER_CRL_NOT_NEWER); return NULL; } /* CRLs must verify */ if (skey && (X509_CRL_verify(base, skey) <= 0 || X509_CRL_verify(newer, skey) <= 0)) { X509err(X509_F_X509_CRL_DIFF, X509_R_CRL_VERIFY_FAILURE); return NULL; } /* Create new CRL */ crl = X509_CRL_new(); if (crl == NULL || !X509_CRL_set_version(crl, 1)) goto memerr; /* Set issuer name */ if (!X509_CRL_set_issuer_name(crl, X509_CRL_get_issuer(newer))) goto memerr; if (!X509_CRL_set1_lastUpdate(crl, X509_CRL_get0_lastUpdate(newer))) goto memerr; if (!X509_CRL_set1_nextUpdate(crl, X509_CRL_get0_nextUpdate(newer))) goto memerr; /* Set base CRL number: must be critical */ if (!X509_CRL_add1_ext_i2d(crl, NID_delta_crl, base->crl_number, 1, 0)) goto memerr; /* * Copy extensions across from newest CRL to delta: this will set CRL * number to correct value too. */ for (i = 0; i < X509_CRL_get_ext_count(newer); i++) { X509_EXTENSION *ext; ext = X509_CRL_get_ext(newer, i); if (!X509_CRL_add_ext(crl, ext, -1)) goto memerr; } /* Go through revoked entries, copying as needed */ revs = X509_CRL_get_REVOKED(newer); for (i = 0; i < sk_X509_REVOKED_num(revs); i++) { X509_REVOKED *rvn, *rvtmp; rvn = sk_X509_REVOKED_value(revs, i); /* * Add only if not also in base. TODO: need something cleverer here * for some more complex CRLs covering multiple CAs. */ if (!X509_CRL_get0_by_serial(base, &rvtmp, &rvn->serialNumber)) { rvtmp = X509_REVOKED_dup(rvn); if (!rvtmp) goto memerr; if (!X509_CRL_add0_revoked(crl, rvtmp)) { X509_REVOKED_free(rvtmp); goto memerr; } } } /* TODO: optionally prune deleted entries */ if (skey && md && !X509_CRL_sign(crl, skey, md)) goto memerr; return crl; memerr: X509err(X509_F_X509_CRL_DIFF, ERR_R_MALLOC_FAILURE); X509_CRL_free(crl); return NULL; } int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data) { return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); } void *X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx, int idx) { return CRYPTO_get_ex_data(&ctx->ex_data, idx); } int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx) { return ctx->error; } void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx, int err) { ctx->error = err; } int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx) { return ctx->error_depth; } void X509_STORE_CTX_set_error_depth(X509_STORE_CTX *ctx, int depth) { ctx->error_depth = depth; } X509 *X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx) { return ctx->current_cert; } void X509_STORE_CTX_set_current_cert(X509_STORE_CTX *ctx, X509 *x) { ctx->current_cert = x; } STACK_OF(X509) *X509_STORE_CTX_get0_chain(X509_STORE_CTX *ctx) { return ctx->chain; } STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx) { if (!ctx->chain) return NULL; return X509_chain_up_ref(ctx->chain); } X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx) { return ctx->current_issuer; } X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx) { return ctx->current_crl; } X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx) { return ctx->parent; } void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *x) { ctx->cert = x; } void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk) { ctx->crls = sk; } int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose) { /* * XXX: Why isn't this function always used to set the associated trust? * Should there even be a VPM->trust field at all? Or should the trust * always be inferred from the purpose by X509_STORE_CTX_init(). */ return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0); } int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust) { /* * XXX: See above, this function would only be needed when the default * trust for the purpose needs an override in a corner case. */ return X509_STORE_CTX_purpose_inherit(ctx, 0, 0, trust); } /* * This function is used to set the X509_STORE_CTX purpose and trust values. * This is intended to be used when another structure has its own trust and * purpose values which (if set) will be inherited by the ctx. If they aren't * set then we will usually have a default purpose in mind which should then * be used to set the trust value. An example of this is SSL use: an SSL * structure will have its own purpose and trust settings which the * application can set: if they aren't set then we use the default of SSL * client/server. */ int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose, int purpose, int trust) { int idx; /* If purpose not set use default */ if (!purpose) purpose = def_purpose; /* If we have a purpose then check it is valid */ if (purpose) { X509_PURPOSE *ptmp; idx = X509_PURPOSE_get_by_id(purpose); if (idx == -1) { X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, X509_R_UNKNOWN_PURPOSE_ID); return 0; } ptmp = X509_PURPOSE_get0(idx); if (ptmp->trust == X509_TRUST_DEFAULT) { idx = X509_PURPOSE_get_by_id(def_purpose); /* * XXX: In the two callers above def_purpose is always 0, which is * not a known value, so idx will always be -1. How is the * X509_TRUST_DEFAULT case actually supposed to be handled? */ if (idx == -1) { X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, X509_R_UNKNOWN_PURPOSE_ID); return 0; } ptmp = X509_PURPOSE_get0(idx); } /* If trust not set then get from purpose default */ if (!trust) trust = ptmp->trust; } if (trust) { idx = X509_TRUST_get_by_id(trust); if (idx == -1) { X509err(X509_F_X509_STORE_CTX_PURPOSE_INHERIT, X509_R_UNKNOWN_TRUST_ID); return 0; } } if (purpose && !ctx->param->purpose) ctx->param->purpose = purpose; if (trust && !ctx->param->trust) ctx->param->trust = trust; return 1; } X509_STORE_CTX *X509_STORE_CTX_new(void) { X509_STORE_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx)); if (ctx == NULL) { X509err(X509_F_X509_STORE_CTX_NEW, ERR_R_MALLOC_FAILURE); return NULL; } return ctx; } void X509_STORE_CTX_free(X509_STORE_CTX *ctx) { if (ctx == NULL) return; X509_STORE_CTX_cleanup(ctx); OPENSSL_free(ctx); } int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, STACK_OF(X509) *chain) { int ret = 1; ctx->ctx = store; ctx->cert = x509; ctx->untrusted = chain; ctx->crls = NULL; ctx->num_untrusted = 0; ctx->other_ctx = NULL; ctx->valid = 0; ctx->chain = NULL; ctx->error = 0; ctx->explicit_policy = 0; ctx->error_depth = 0; ctx->current_cert = NULL; ctx->current_issuer = NULL; ctx->current_crl = NULL; ctx->current_crl_score = 0; ctx->current_reasons = 0; ctx->tree = NULL; ctx->parent = NULL; ctx->dane = NULL; ctx->bare_ta_signed = 0; /* Zero ex_data to make sure we're cleanup-safe */ memset(&ctx->ex_data, 0, sizeof(ctx->ex_data)); /* store->cleanup is always 0 in OpenSSL, if set must be idempotent */ if (store) ctx->cleanup = store->cleanup; else ctx->cleanup = 0; if (store && store->check_issued) ctx->check_issued = store->check_issued; else ctx->check_issued = check_issued; if (store && store->get_issuer) ctx->get_issuer = store->get_issuer; else ctx->get_issuer = X509_STORE_CTX_get1_issuer; if (store && store->verify_cb) ctx->verify_cb = store->verify_cb; else ctx->verify_cb = null_callback; if (store && store->verify) ctx->verify = store->verify; else ctx->verify = internal_verify; if (store && store->check_revocation) ctx->check_revocation = store->check_revocation; else ctx->check_revocation = check_revocation; if (store && store->get_crl) ctx->get_crl = store->get_crl; else ctx->get_crl = NULL; if (store && store->check_crl) ctx->check_crl = store->check_crl; else ctx->check_crl = check_crl; if (store && store->cert_crl) ctx->cert_crl = store->cert_crl; else ctx->cert_crl = cert_crl; if (store && store->check_policy) ctx->check_policy = store->check_policy; else ctx->check_policy = check_policy; if (store && store->lookup_certs) ctx->lookup_certs = store->lookup_certs; else ctx->lookup_certs = X509_STORE_CTX_get1_certs; if (store && store->lookup_crls) ctx->lookup_crls = store->lookup_crls; else ctx->lookup_crls = X509_STORE_CTX_get1_crls; ctx->param = X509_VERIFY_PARAM_new(); if (ctx->param == NULL) { X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); goto err; } /* * Inherit callbacks and flags from X509_STORE if not set use defaults. */ if (store) ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param); else ctx->param->inh_flags |= X509_VP_FLAG_DEFAULT | X509_VP_FLAG_ONCE; if (ret) ret = X509_VERIFY_PARAM_inherit(ctx->param, X509_VERIFY_PARAM_lookup("default")); if (ret == 0) { X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); goto err; } /* * XXX: For now, continue to inherit trust from VPM, but infer from the * purpose if this still yields the default value. */ if (ctx->param->trust == X509_TRUST_DEFAULT) { int idx = X509_PURPOSE_get_by_id(ctx->param->purpose); X509_PURPOSE *xp = X509_PURPOSE_get0(idx); if (xp != NULL) ctx->param->trust = X509_PURPOSE_get_trust(xp); } if (CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, &ctx->ex_data)) return 1; X509err(X509_F_X509_STORE_CTX_INIT, ERR_R_MALLOC_FAILURE); err: /* * On error clean up allocated storage, if the store context was not * allocated with X509_STORE_CTX_new() this is our last chance to do so. */ X509_STORE_CTX_cleanup(ctx); return 0; } /* * Set alternative lookup method: just a STACK of trusted certificates. This * avoids X509_STORE nastiness where it isn't needed. */ void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) { ctx->other_ctx = sk; ctx->get_issuer = get_issuer_sk; ctx->lookup_certs = lookup_certs_sk; } void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) { /* * We need to be idempotent because, unfortunately, free() also calls * cleanup(), so the natural call sequence new(), init(), cleanup(), free() * calls cleanup() for the same object twice! Thus we must zero the * pointers below after they're freed! */ /* Seems to always be 0 in OpenSSL, do this at most once. */ if (ctx->cleanup != NULL) { ctx->cleanup(ctx); ctx->cleanup = NULL; } if (ctx->param != NULL) { if (ctx->parent == NULL) X509_VERIFY_PARAM_free(ctx->param); ctx->param = NULL; } X509_policy_tree_free(ctx->tree); ctx->tree = NULL; sk_X509_pop_free(ctx->chain, X509_free); ctx->chain = NULL; CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE_CTX, ctx, &(ctx->ex_data)); memset(&ctx->ex_data, 0, sizeof(ctx->ex_data)); } void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth) { X509_VERIFY_PARAM_set_depth(ctx->param, depth); } void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags) { X509_VERIFY_PARAM_set_flags(ctx->param, flags); } void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, time_t t) { X509_VERIFY_PARAM_set_time(ctx->param, t); } X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx) { return ctx->cert; } STACK_OF(X509) *X509_STORE_CTX_get0_untrusted(X509_STORE_CTX *ctx) { return ctx->untrusted; } void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) { ctx->untrusted = sk; } void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk) { sk_X509_pop_free(ctx->chain, X509_free); ctx->chain = sk; } void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, X509_STORE_CTX_verify_cb verify_cb) { ctx->verify_cb = verify_cb; } X509_STORE_CTX_verify_cb X509_STORE_CTX_get_verify_cb(X509_STORE_CTX *ctx) { return ctx->verify_cb; } void X509_STORE_CTX_set_verify(X509_STORE_CTX *ctx, X509_STORE_CTX_verify_fn verify) { ctx->verify = verify; } X509_STORE_CTX_verify_fn X509_STORE_CTX_get_verify(X509_STORE_CTX *ctx) { return ctx->verify; } X509_STORE_CTX_get_issuer_fn X509_STORE_CTX_get_get_issuer(X509_STORE_CTX *ctx) { return ctx->get_issuer; } X509_STORE_CTX_check_issued_fn X509_STORE_CTX_get_check_issued(X509_STORE_CTX *ctx) { return ctx->check_issued; } X509_STORE_CTX_check_revocation_fn X509_STORE_CTX_get_check_revocation(X509_STORE_CTX *ctx) { return ctx->check_revocation; } X509_STORE_CTX_get_crl_fn X509_STORE_CTX_get_get_crl(X509_STORE_CTX *ctx) { return ctx->get_crl; } X509_STORE_CTX_check_crl_fn X509_STORE_CTX_get_check_crl(X509_STORE_CTX *ctx) { return ctx->check_crl; } X509_STORE_CTX_cert_crl_fn X509_STORE_CTX_get_cert_crl(X509_STORE_CTX *ctx) { return ctx->cert_crl; } X509_STORE_CTX_check_policy_fn X509_STORE_CTX_get_check_policy(X509_STORE_CTX *ctx) { return ctx->check_policy; } X509_STORE_CTX_lookup_certs_fn X509_STORE_CTX_get_lookup_certs(X509_STORE_CTX *ctx) { return ctx->lookup_certs; } X509_STORE_CTX_lookup_crls_fn X509_STORE_CTX_get_lookup_crls(X509_STORE_CTX *ctx) { return ctx->lookup_crls; } X509_STORE_CTX_cleanup_fn X509_STORE_CTX_get_cleanup(X509_STORE_CTX *ctx) { return ctx->cleanup; } X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx) { return ctx->tree; } int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx) { return ctx->explicit_policy; } int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx) { return ctx->num_untrusted; } int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) { const X509_VERIFY_PARAM *param; param = X509_VERIFY_PARAM_lookup(name); if (!param) return 0; return X509_VERIFY_PARAM_inherit(ctx->param, param); } X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx) { return ctx->param; } void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param) { X509_VERIFY_PARAM_free(ctx->param); ctx->param = param; } void X509_STORE_CTX_set0_dane(X509_STORE_CTX *ctx, SSL_DANE *dane) { ctx->dane = dane; } static unsigned char *dane_i2d( X509 *cert, uint8_t selector, unsigned int *i2dlen) { unsigned char *buf = NULL; int len; /* * Extract ASN.1 DER form of certificate or public key. */ switch (selector) { case DANETLS_SELECTOR_CERT: len = i2d_X509(cert, &buf); break; case DANETLS_SELECTOR_SPKI: len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &buf); break; default: X509err(X509_F_DANE_I2D, X509_R_BAD_SELECTOR); return NULL; } if (len < 0 || buf == NULL) { X509err(X509_F_DANE_I2D, ERR_R_MALLOC_FAILURE); return NULL; } *i2dlen = (unsigned int)len; return buf; } #define DANETLS_NONE 256 /* impossible uint8_t */ static int dane_match(X509_STORE_CTX *ctx, X509 *cert, int depth) { SSL_DANE *dane = ctx->dane; unsigned usage = DANETLS_NONE; unsigned selector = DANETLS_NONE; unsigned ordinal = DANETLS_NONE; unsigned mtype = DANETLS_NONE; unsigned char *i2dbuf = NULL; unsigned int i2dlen = 0; unsigned char mdbuf[EVP_MAX_MD_SIZE]; unsigned char *cmpbuf = NULL; unsigned int cmplen = 0; int i; int recnum; int matched = 0; danetls_record *t = NULL; uint32_t mask; mask = (depth == 0) ? DANETLS_EE_MASK : DANETLS_TA_MASK; /* * The trust store is not applicable with DANE-TA(2) */ if (depth >= ctx->num_untrusted) mask &= DANETLS_PKIX_MASK; /* * If we've previously matched a PKIX-?? record, no need to test any * further PKIX-?? records, it remains to just build the PKIX chain. * Had the match been a DANE-?? record, we'd be done already. */ if (dane->mdpth >= 0) mask &= ~DANETLS_PKIX_MASK; /*- * https://tools.ietf.org/html/rfc7671#section-5.1 * https://tools.ietf.org/html/rfc7671#section-5.2 * https://tools.ietf.org/html/rfc7671#section-5.3 * https://tools.ietf.org/html/rfc7671#section-5.4 * * We handle DANE-EE(3) records first as they require no chain building * and no expiration or hostname checks. We also process digests with * higher ordinals first and ignore lower priorities except Full(0) which * is always processed (last). If none match, we then process PKIX-EE(1). * * NOTE: This relies on DANE usages sorting before the corresponding PKIX * usages in SSL_dane_tlsa_add(), and also on descending sorting of digest * priorities. See twin comment in ssl/ssl_lib.c. * * We expect that most TLSA RRsets will have just a single usage, so we * don't go out of our way to cache multiple selector-specific i2d buffers * across usages, but if the selector happens to remain the same as switch * usages, that's OK. Thus, a set of "3 1 1", "3 0 1", "1 1 1", "1 0 1", * records would result in us generating each of the certificate and public * key DER forms twice, but more typically we'd just see multiple "3 1 1" * or multiple "3 0 1" records. * * As soon as we find a match at any given depth, we stop, because either * we've matched a DANE-?? record and the peer is authenticated, or, after * exhausting all DANE-?? records, we've matched a PKIX-?? record, which is * sufficient for DANE, and what remains to do is ordinary PKIX validation. */ recnum = (dane->umask & mask) ? sk_danetls_record_num(dane->trecs) : 0; for (i = 0; matched == 0 && i < recnum; ++i) { t = sk_danetls_record_value(dane->trecs, i); if ((DANETLS_USAGE_BIT(t->usage) & mask) == 0) continue; if (t->usage != usage) { usage = t->usage; /* Reset digest agility for each usage/selector pair */ mtype = DANETLS_NONE; ordinal = dane->dctx->mdord[t->mtype]; } if (t->selector != selector) { selector = t->selector; /* Update per-selector state */ OPENSSL_free(i2dbuf); i2dbuf = dane_i2d(cert, selector, &i2dlen); if (i2dbuf == NULL) return -1; /* Reset digest agility for each usage/selector pair */ mtype = DANETLS_NONE; ordinal = dane->dctx->mdord[t->mtype]; } else if (t->mtype != DANETLS_MATCHING_FULL) { /*- * Digest agility: * * * * For a fixed selector, after processing all records with the * highest mtype ordinal, ignore all mtypes with lower ordinals * other than "Full". */ if (dane->dctx->mdord[t->mtype] < ordinal) continue; } /* * Each time we hit a (new selector or) mtype, re-compute the relevant * digest, more complex caching is not worth the code space. */ if (t->mtype != mtype) { const EVP_MD *md = dane->dctx->mdevp[mtype = t->mtype]; cmpbuf = i2dbuf; cmplen = i2dlen; if (md != NULL) { cmpbuf = mdbuf; if (!EVP_Digest(i2dbuf, i2dlen, cmpbuf, &cmplen, md, 0)) { matched = -1; break; } } } /* * Squirrel away the certificate and depth if we have a match. Any * DANE match is dispositive, but with PKIX we still need to build a * full chain. */ if (cmplen == t->dlen && memcmp(cmpbuf, t->data, cmplen) == 0) { if (DANETLS_USAGE_BIT(usage) & DANETLS_DANE_MASK) matched = 1; if (matched || dane->mdpth < 0) { dane->mdpth = depth; dane->mtlsa = t; OPENSSL_free(dane->mcert); dane->mcert = cert; X509_up_ref(cert); } break; } } /* Clear the one-element DER cache */ OPENSSL_free(i2dbuf); return matched; } static int check_dane_issuer(X509_STORE_CTX *ctx, int depth) { SSL_DANE *dane = ctx->dane; int matched = 0; X509 *cert; if (!DANETLS_HAS_TA(dane) || depth == 0) return X509_TRUST_UNTRUSTED; /* * Record any DANE trust-anchor matches, for the first depth to test, if * there's one at that depth. (This'll be false for length 1 chains looking * for an exact match for the leaf certificate). */ cert = sk_X509_value(ctx->chain, depth); if (cert != NULL && (matched = dane_match(ctx, cert, depth)) < 0) return X509_TRUST_REJECTED; if (matched > 0) { ctx->num_untrusted = depth - 1; return X509_TRUST_TRUSTED; } return X509_TRUST_UNTRUSTED; } static int check_dane_pkeys(X509_STORE_CTX *ctx) { SSL_DANE *dane = ctx->dane; danetls_record *t; int num = ctx->num_untrusted; X509 *cert = sk_X509_value(ctx->chain, num - 1); int recnum = sk_danetls_record_num(dane->trecs); int i; for (i = 0; i < recnum; ++i) { t = sk_danetls_record_value(dane->trecs, i); if (t->usage != DANETLS_USAGE_DANE_TA || t->selector != DANETLS_SELECTOR_SPKI || t->mtype != DANETLS_MATCHING_FULL || X509_verify(cert, t->spki) <= 0) continue; /* Clear any PKIX-?? matches that failed to extend to a full chain */ X509_free(dane->mcert); dane->mcert = NULL; /* Record match via a bare TA public key */ ctx->bare_ta_signed = 1; dane->mdpth = num - 1; dane->mtlsa = t; /* Prune any excess chain certificates */ num = sk_X509_num(ctx->chain); for (; num > ctx->num_untrusted; --num) X509_free(sk_X509_pop(ctx->chain)); return X509_TRUST_TRUSTED; } return X509_TRUST_UNTRUSTED; } static void dane_reset(SSL_DANE *dane) { /* * Reset state to verify another chain, or clear after failure. */ X509_free(dane->mcert); dane->mcert = NULL; dane->mtlsa = NULL; dane->mdpth = -1; dane->pdpth = -1; } static int check_leaf_suiteb(X509_STORE_CTX *ctx, X509 *cert) { int err = X509_chain_check_suiteb(NULL, cert, NULL, ctx->param->flags); if (err == X509_V_OK) return 1; return verify_cb_cert(ctx, cert, 0, err); } static int dane_verify(X509_STORE_CTX *ctx) { X509 *cert = ctx->cert; SSL_DANE *dane = ctx->dane; int matched; int done; dane_reset(dane); /*- * When testing the leaf certificate, if we match a DANE-EE(3) record, * dane_match() returns 1 and we're done. If however we match a PKIX-EE(1) * record, the match depth and matching TLSA record are recorded, but the * return value is 0, because we still need to find a PKIX trust-anchor. * Therefore, when DANE authentication is enabled (required), we're done * if: * + matched < 0, internal error. * + matched == 1, we matched a DANE-EE(3) record * + matched == 0, mdepth < 0 (no PKIX-EE match) and there are no * DANE-TA(2) or PKIX-TA(0) to test. */ matched = dane_match(ctx, ctx->cert, 0); done = matched != 0 || (!DANETLS_HAS_TA(dane) && dane->mdpth < 0); if (done) X509_get_pubkey_parameters(NULL, ctx->chain); if (matched > 0) { /* Callback invoked as needed */ if (!check_leaf_suiteb(ctx, cert)) return 0; /* Callback invoked as needed */ if ((dane->flags & DANE_FLAG_NO_DANE_EE_NAMECHECKS) == 0 && !check_id(ctx)) return 0; /* Bypass internal_verify(), issue depth 0 success callback */ ctx->error_depth = 0; ctx->current_cert = cert; return ctx->verify_cb(1, ctx); } if (matched < 0) { ctx->error_depth = 0; ctx->current_cert = cert; ctx->error = X509_V_ERR_OUT_OF_MEM; return -1; } if (done) { /* Fail early, TA-based success is not possible */ if (!check_leaf_suiteb(ctx, cert)) return 0; return verify_cb_cert(ctx, cert, 0, X509_V_ERR_DANE_NO_MATCH); } /* * Chain verification for usages 0/1/2. TLSA record matching of depth > 0 * certificates happens in-line with building the rest of the chain. */ return verify_chain(ctx); } /* Get issuer, without duplicate suppression */ static int get_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *cert) { STACK_OF(X509) *saved_chain = ctx->chain; int ok; ctx->chain = NULL; ok = ctx->get_issuer(issuer, ctx, cert); ctx->chain = saved_chain; return ok; } static int build_chain(X509_STORE_CTX *ctx) { SSL_DANE *dane = ctx->dane; int num = sk_X509_num(ctx->chain); X509 *cert = sk_X509_value(ctx->chain, num - 1); int ss = cert_self_signed(cert); STACK_OF(X509) *sktmp = NULL; unsigned int search; int may_trusted = 0; int may_alternate = 0; int trust = X509_TRUST_UNTRUSTED; int alt_untrusted = 0; int depth; int ok = 0; int i; /* Our chain starts with a single untrusted element. */ if (!ossl_assert(num == 1 && ctx->num_untrusted == num)) { X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); ctx->error = X509_V_ERR_UNSPECIFIED; return 0; } #define S_DOUNTRUSTED (1 << 0) /* Search untrusted chain */ #define S_DOTRUSTED (1 << 1) /* Search trusted store */ #define S_DOALTERNATE (1 << 2) /* Retry with pruned alternate chain */ /* * Set up search policy, untrusted if possible, trusted-first if enabled. * If we're doing DANE and not doing PKIX-TA/PKIX-EE, we never look in the * trust_store, otherwise we might look there first. If not trusted-first, * and alternate chains are not disabled, try building an alternate chain * if no luck with untrusted first. */ search = (ctx->untrusted != NULL) ? S_DOUNTRUSTED : 0; if (DANETLS_HAS_PKIX(dane) || !DANETLS_HAS_DANE(dane)) { if (search == 0 || ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) search |= S_DOTRUSTED; else if (!(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) may_alternate = 1; may_trusted = 1; } /* * Shallow-copy the stack of untrusted certificates (with TLS, this is * typically the content of the peer's certificate message) so can make * multiple passes over it, while free to remove elements as we go. */ if (ctx->untrusted && (sktmp = sk_X509_dup(ctx->untrusted)) == NULL) { X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return 0; } /* * If we got any "DANE-TA(2) Cert(0) Full(0)" trust-anchors from DNS, add * them to our working copy of the untrusted certificate stack. Since the * caller of X509_STORE_CTX_init() may have provided only a leaf cert with * no corresponding stack of untrusted certificates, we may need to create * an empty stack first. [ At present only the ssl library provides DANE * support, and ssl_verify_cert_chain() always provides a non-null stack * containing at least the leaf certificate, but we must be prepared for * this to change. ] */ if (DANETLS_ENABLED(dane) && dane->certs != NULL) { if (sktmp == NULL && (sktmp = sk_X509_new_null()) == NULL) { X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return 0; } for (i = 0; i < sk_X509_num(dane->certs); ++i) { if (!sk_X509_push(sktmp, sk_X509_value(dane->certs, i))) { sk_X509_free(sktmp); X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); ctx->error = X509_V_ERR_OUT_OF_MEM; return 0; } } } /* * Still absurdly large, but arithmetically safe, a lower hard upper bound * might be reasonable. */ if (ctx->param->depth > INT_MAX/2) ctx->param->depth = INT_MAX/2; /* * Try to Extend the chain until we reach an ultimately trusted issuer. * Build chains up to one longer the limit, later fail if we hit the limit, * with an X509_V_ERR_CERT_CHAIN_TOO_LONG error code. */ depth = ctx->param->depth + 1; while (search != 0) { X509 *x; X509 *xtmp = NULL; /* * Look in the trust store if enabled for first lookup, or we've run * out of untrusted issuers and search here is not disabled. When we * reach the depth limit, we stop extending the chain, if by that point * we've not found a trust-anchor, any trusted chain would be too long. * * The error reported to the application verify callback is at the * maximal valid depth with the current certificate equal to the last * not ultimately-trusted issuer. For example, with verify_depth = 0, * the callback will report errors at depth=1 when the immediate issuer * of the leaf certificate is not a trust anchor. No attempt will be * made to locate an issuer for that certificate, since such a chain * would be a-priori too long. */ if ((search & S_DOTRUSTED) != 0) { i = num = sk_X509_num(ctx->chain); if ((search & S_DOALTERNATE) != 0) { /* * As high up the chain as we can, look for an alternative * trusted issuer of an untrusted certificate that currently * has an untrusted issuer. We use the alt_untrusted variable * to track how far up the chain we find the first match. It * is only if and when we find a match, that we prune the chain * and reset ctx->num_untrusted to the reduced count of * untrusted certificates. While we're searching for such a * match (which may never be found), it is neither safe nor * wise to preemptively modify either the chain or * ctx->num_untrusted. * * Note, like ctx->num_untrusted, alt_untrusted is a count of * untrusted certificates, not a "depth". */ i = alt_untrusted; } x = sk_X509_value(ctx->chain, i-1); ok = (depth < num) ? 0 : get_issuer(&xtmp, ctx, x); if (ok < 0) { trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_STORE_LOOKUP; search = 0; continue; } if (ok > 0) { /* * Alternative trusted issuer for a mid-chain untrusted cert? * Pop the untrusted cert's successors and retry. We might now * be able to complete a valid chain via the trust store. Note * that despite the current trust-store match we might still * fail complete the chain to a suitable trust-anchor, in which * case we may prune some more untrusted certificates and try * again. Thus the S_DOALTERNATE bit may yet be turned on * again with an even shorter untrusted chain! * * If in the process we threw away our matching PKIX-TA trust * anchor, reset DANE trust. We might find a suitable trusted * certificate among the ones from the trust store. */ if ((search & S_DOALTERNATE) != 0) { if (!ossl_assert(num > i && i > 0 && ss == 0)) { X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); X509_free(xtmp); trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_UNSPECIFIED; search = 0; continue; } search &= ~S_DOALTERNATE; for (; num > i; --num) X509_free(sk_X509_pop(ctx->chain)); ctx->num_untrusted = num; if (DANETLS_ENABLED(dane) && dane->mdpth >= ctx->num_untrusted) { dane->mdpth = -1; X509_free(dane->mcert); dane->mcert = NULL; } if (DANETLS_ENABLED(dane) && dane->pdpth >= ctx->num_untrusted) dane->pdpth = -1; } /* * Self-signed untrusted certificates get replaced by their * trusted matching issuer. Otherwise, grow the chain. */ if (ss == 0) { if (!sk_X509_push(ctx->chain, x = xtmp)) { X509_free(xtmp); X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_OUT_OF_MEM; search = 0; continue; } ss = cert_self_signed(x); } else if (num == ctx->num_untrusted) { /* * We have a self-signed certificate that has the same * subject name (and perhaps keyid and/or serial number) as * a trust-anchor. We must have an exact match to avoid * possible impersonation via key substitution etc. */ if (X509_cmp(x, xtmp) != 0) { /* Self-signed untrusted mimic. */ X509_free(xtmp); ok = 0; } else { X509_free(x); ctx->num_untrusted = --num; (void) sk_X509_set(ctx->chain, num, x = xtmp); } } /* * We've added a new trusted certificate to the chain, recheck * trust. If not done, and not self-signed look deeper. * Whether or not we're doing "trusted first", we no longer * look for untrusted certificates from the peer's chain. * * At this point ctx->num_trusted and num must reflect the * correct number of untrusted certificates, since the DANE * logic in check_trust() depends on distinguishing CAs from * "the wire" from CAs from the trust store. In particular, the * certificate at depth "num" should be the new trusted * certificate with ctx->num_untrusted <= num. */ if (ok) { if (!ossl_assert(ctx->num_untrusted <= num)) { X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_UNSPECIFIED; search = 0; continue; } search &= ~S_DOUNTRUSTED; switch (trust = check_trust(ctx, num)) { case X509_TRUST_TRUSTED: case X509_TRUST_REJECTED: search = 0; continue; } if (ss == 0) continue; } } /* * No dispositive decision, and either self-signed or no match, if * we were doing untrusted-first, and alt-chains are not disabled, * do that, by repeatedly losing one untrusted element at a time, * and trying to extend the shorted chain. */ if ((search & S_DOUNTRUSTED) == 0) { /* Continue search for a trusted issuer of a shorter chain? */ if ((search & S_DOALTERNATE) != 0 && --alt_untrusted > 0) continue; /* Still no luck and no fallbacks left? */ if (!may_alternate || (search & S_DOALTERNATE) != 0 || ctx->num_untrusted < 2) break; /* Search for a trusted issuer of a shorter chain */ search |= S_DOALTERNATE; alt_untrusted = ctx->num_untrusted - 1; ss = 0; } } /* * Extend chain with peer-provided certificates */ if ((search & S_DOUNTRUSTED) != 0) { num = sk_X509_num(ctx->chain); if (!ossl_assert(num == ctx->num_untrusted)) { X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_UNSPECIFIED; search = 0; continue; } x = sk_X509_value(ctx->chain, num-1); /* * Once we run out of untrusted issuers, we stop looking for more * and start looking only in the trust store if enabled. */ xtmp = (ss || depth < num) ? NULL : find_issuer(ctx, sktmp, x); if (xtmp == NULL) { search &= ~S_DOUNTRUSTED; if (may_trusted) search |= S_DOTRUSTED; continue; } /* Drop this issuer from future consideration */ (void) sk_X509_delete_ptr(sktmp, xtmp); if (!X509_up_ref(xtmp)) { X509err(X509_F_BUILD_CHAIN, ERR_R_INTERNAL_ERROR); trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_UNSPECIFIED; search = 0; continue; } if (!sk_X509_push(ctx->chain, xtmp)) { X509_free(xtmp); X509err(X509_F_BUILD_CHAIN, ERR_R_MALLOC_FAILURE); trust = X509_TRUST_REJECTED; ctx->error = X509_V_ERR_OUT_OF_MEM; search = 0; continue; } x = xtmp; ++ctx->num_untrusted; ss = cert_self_signed(xtmp); /* * Check for DANE-TA trust of the topmost untrusted certificate. */ switch (trust = check_dane_issuer(ctx, ctx->num_untrusted - 1)) { case X509_TRUST_TRUSTED: case X509_TRUST_REJECTED: search = 0; continue; } } } sk_X509_free(sktmp); /* * Last chance to make a trusted chain, either bare DANE-TA public-key * signers, or else direct leaf PKIX trust. */ num = sk_X509_num(ctx->chain); if (num <= depth) { if (trust == X509_TRUST_UNTRUSTED && DANETLS_HAS_DANE_TA(dane)) trust = check_dane_pkeys(ctx); if (trust == X509_TRUST_UNTRUSTED && num == ctx->num_untrusted) trust = check_trust(ctx, num); } switch (trust) { case X509_TRUST_TRUSTED: return 1; case X509_TRUST_REJECTED: /* Callback already issued */ return 0; case X509_TRUST_UNTRUSTED: default: num = sk_X509_num(ctx->chain); if (num > depth) return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_CERT_CHAIN_TOO_LONG); if (DANETLS_ENABLED(dane) && (!DANETLS_HAS_PKIX(dane) || dane->pdpth >= 0)) return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_DANE_NO_MATCH); if (ss && sk_X509_num(ctx->chain) == 1) return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT); if (ss) return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN); if (ctx->num_untrusted < num) return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT); return verify_cb_cert(ctx, NULL, num-1, X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY); } } static const int minbits_table[] = { 80, 112, 128, 192, 256 }; static const int NUM_AUTH_LEVELS = OSSL_NELEM(minbits_table); /* * Check whether the public key of ``cert`` meets the security level of * ``ctx``. * * Returns 1 on success, 0 otherwise. */ static int check_key_level(X509_STORE_CTX *ctx, X509 *cert) { EVP_PKEY *pkey = X509_get0_pubkey(cert); int level = ctx->param->auth_level; /* * At security level zero, return without checking for a supported public * key type. Some engines support key types not understood outside the * engine, and we only need to understand the key when enforcing a security * floor. */ if (level <= 0) return 1; /* Unsupported or malformed keys are not secure */ if (pkey == NULL) return 0; if (level > NUM_AUTH_LEVELS) level = NUM_AUTH_LEVELS; return EVP_PKEY_security_bits(pkey) >= minbits_table[level - 1]; } /* * Check whether the public key of ``cert`` does not use explicit params * for an elliptic curve. * * Returns 1 on success, 0 if check fails, -1 for other errors. */ static int check_curve(X509 *cert) { #ifndef OPENSSL_NO_EC EVP_PKEY *pkey = X509_get0_pubkey(cert); /* Unsupported or malformed key */ if (pkey == NULL) return -1; if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) { int ret; ret = EC_KEY_decoded_from_explicit_params(EVP_PKEY_get0_EC_KEY(pkey)); return ret < 0 ? ret : !ret; } #endif return 1; } /* * Check whether the signature digest algorithm of ``cert`` meets the security * level of ``ctx``. Should not be checked for trust anchors (whether * self-signed or otherwise). * * Returns 1 on success, 0 otherwise. */ static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert) { int secbits = -1; int level = ctx->param->auth_level; if (level <= 0) return 1; if (level > NUM_AUTH_LEVELS) level = NUM_AUTH_LEVELS; if (!X509_get_signature_info(cert, NULL, NULL, &secbits, NULL)) return 0; return secbits >= minbits_table[level - 1]; } diff --git a/crypto/openssl/ssl/s3_lib.c b/crypto/openssl/ssl/s3_lib.c index a987604bcd0e..d97b4310c607 100644 --- a/crypto/openssl/ssl/s3_lib.c +++ b/crypto/openssl/ssl/s3_lib.c @@ -1,4864 +1,4867 @@ /* * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include #include "internal/nelem.h" #include "ssl_local.h" #include #include #include #include "internal/cryptlib.h" #define TLS13_NUM_CIPHERS OSSL_NELEM(tls13_ciphers) #define SSL3_NUM_CIPHERS OSSL_NELEM(ssl3_ciphers) #define SSL3_NUM_SCSVS OSSL_NELEM(ssl3_scsvs) /* TLSv1.3 downgrade protection sentinel values */ const unsigned char tls11downgrade[] = { 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x00 }; const unsigned char tls12downgrade[] = { 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x01 }; /* The list of available TLSv1.3 ciphers */ static SSL_CIPHER tls13_ciphers[] = { { 1, TLS1_3_RFC_AES_128_GCM_SHA256, TLS1_3_RFC_AES_128_GCM_SHA256, TLS1_3_CK_AES_128_GCM_SHA256, SSL_kANY, SSL_aANY, SSL_AES128GCM, SSL_AEAD, TLS1_3_VERSION, TLS1_3_VERSION, 0, 0, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256, 128, 128, }, { 1, TLS1_3_RFC_AES_256_GCM_SHA384, TLS1_3_RFC_AES_256_GCM_SHA384, TLS1_3_CK_AES_256_GCM_SHA384, SSL_kANY, SSL_aANY, SSL_AES256GCM, SSL_AEAD, TLS1_3_VERSION, TLS1_3_VERSION, 0, 0, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384, 256, 256, }, #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) { 1, TLS1_3_RFC_CHACHA20_POLY1305_SHA256, TLS1_3_RFC_CHACHA20_POLY1305_SHA256, TLS1_3_CK_CHACHA20_POLY1305_SHA256, SSL_kANY, SSL_aANY, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_3_VERSION, TLS1_3_VERSION, 0, 0, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256, 256, 256, }, #endif { 1, TLS1_3_RFC_AES_128_CCM_SHA256, TLS1_3_RFC_AES_128_CCM_SHA256, TLS1_3_CK_AES_128_CCM_SHA256, SSL_kANY, SSL_aANY, SSL_AES128CCM, SSL_AEAD, TLS1_3_VERSION, TLS1_3_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256, 128, 128, }, { 1, TLS1_3_RFC_AES_128_CCM_8_SHA256, TLS1_3_RFC_AES_128_CCM_8_SHA256, TLS1_3_CK_AES_128_CCM_8_SHA256, SSL_kANY, SSL_aANY, SSL_AES128CCM8, SSL_AEAD, TLS1_3_VERSION, TLS1_3_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256, 128, 128, } }; /* * The list of available ciphers, mostly organized into the following * groups: * Always there * EC * PSK * SRP (within that: RSA EC PSK) * Cipher families: Chacha/poly, Camellia, Gost, IDEA, SEED * Weak ciphers */ static SSL_CIPHER ssl3_ciphers[] = { { 1, SSL3_TXT_RSA_NULL_MD5, SSL3_RFC_RSA_NULL_MD5, SSL3_CK_RSA_NULL_MD5, SSL_kRSA, SSL_aRSA, SSL_eNULL, SSL_MD5, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, SSL3_TXT_RSA_NULL_SHA, SSL3_RFC_RSA_NULL_SHA, SSL3_CK_RSA_NULL_SHA, SSL_kRSA, SSL_aRSA, SSL_eNULL, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, SSL3_TXT_RSA_DES_192_CBC3_SHA, SSL3_RFC_RSA_DES_192_CBC3_SHA, SSL3_CK_RSA_DES_192_CBC3_SHA, SSL_kRSA, SSL_aRSA, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, { 1, SSL3_TXT_DHE_DSS_DES_192_CBC3_SHA, SSL3_RFC_DHE_DSS_DES_192_CBC3_SHA, SSL3_CK_DHE_DSS_DES_192_CBC3_SHA, SSL_kDHE, SSL_aDSS, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, { 1, SSL3_TXT_DHE_RSA_DES_192_CBC3_SHA, SSL3_RFC_DHE_RSA_DES_192_CBC3_SHA, SSL3_CK_DHE_RSA_DES_192_CBC3_SHA, SSL_kDHE, SSL_aRSA, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, { 1, SSL3_TXT_ADH_DES_192_CBC_SHA, SSL3_RFC_ADH_DES_192_CBC_SHA, SSL3_CK_ADH_DES_192_CBC_SHA, SSL_kDHE, SSL_aNULL, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, #endif { 1, TLS1_TXT_RSA_WITH_AES_128_SHA, TLS1_RFC_RSA_WITH_AES_128_SHA, TLS1_CK_RSA_WITH_AES_128_SHA, SSL_kRSA, SSL_aRSA, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, TLS1_RFC_DHE_DSS_WITH_AES_128_SHA, TLS1_CK_DHE_DSS_WITH_AES_128_SHA, SSL_kDHE, SSL_aDSS, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, TLS1_RFC_DHE_RSA_WITH_AES_128_SHA, TLS1_CK_DHE_RSA_WITH_AES_128_SHA, SSL_kDHE, SSL_aRSA, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ADH_WITH_AES_128_SHA, TLS1_RFC_ADH_WITH_AES_128_SHA, TLS1_CK_ADH_WITH_AES_128_SHA, SSL_kDHE, SSL_aNULL, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_AES_256_SHA, TLS1_RFC_RSA_WITH_AES_256_SHA, TLS1_CK_RSA_WITH_AES_256_SHA, SSL_kRSA, SSL_aRSA, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, TLS1_RFC_DHE_DSS_WITH_AES_256_SHA, TLS1_CK_DHE_DSS_WITH_AES_256_SHA, SSL_kDHE, SSL_aDSS, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, TLS1_RFC_DHE_RSA_WITH_AES_256_SHA, TLS1_CK_DHE_RSA_WITH_AES_256_SHA, SSL_kDHE, SSL_aRSA, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ADH_WITH_AES_256_SHA, TLS1_RFC_ADH_WITH_AES_256_SHA, TLS1_CK_ADH_WITH_AES_256_SHA, SSL_kDHE, SSL_aNULL, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_RSA_WITH_NULL_SHA256, TLS1_RFC_RSA_WITH_NULL_SHA256, TLS1_CK_RSA_WITH_NULL_SHA256, SSL_kRSA, SSL_aRSA, SSL_eNULL, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_RSA_WITH_AES_128_SHA256, TLS1_RFC_RSA_WITH_AES_128_SHA256, TLS1_CK_RSA_WITH_AES_128_SHA256, SSL_kRSA, SSL_aRSA, SSL_AES128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_AES_256_SHA256, TLS1_RFC_RSA_WITH_AES_256_SHA256, TLS1_CK_RSA_WITH_AES_256_SHA256, SSL_kRSA, SSL_aRSA, SSL_AES256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256, TLS1_RFC_DHE_DSS_WITH_AES_128_SHA256, TLS1_CK_DHE_DSS_WITH_AES_128_SHA256, SSL_kDHE, SSL_aDSS, SSL_AES128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256, TLS1_RFC_DHE_RSA_WITH_AES_128_SHA256, TLS1_CK_DHE_RSA_WITH_AES_128_SHA256, SSL_kDHE, SSL_aRSA, SSL_AES128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256, TLS1_RFC_DHE_DSS_WITH_AES_256_SHA256, TLS1_CK_DHE_DSS_WITH_AES_256_SHA256, SSL_kDHE, SSL_aDSS, SSL_AES256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256, TLS1_RFC_DHE_RSA_WITH_AES_256_SHA256, TLS1_CK_DHE_RSA_WITH_AES_256_SHA256, SSL_kDHE, SSL_aRSA, SSL_AES256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ADH_WITH_AES_128_SHA256, TLS1_RFC_ADH_WITH_AES_128_SHA256, TLS1_CK_ADH_WITH_AES_128_SHA256, SSL_kDHE, SSL_aNULL, SSL_AES128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ADH_WITH_AES_256_SHA256, TLS1_RFC_ADH_WITH_AES_256_SHA256, TLS1_CK_ADH_WITH_AES_256_SHA256, SSL_kDHE, SSL_aNULL, SSL_AES256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256, TLS1_RFC_RSA_WITH_AES_128_GCM_SHA256, TLS1_CK_RSA_WITH_AES_128_GCM_SHA256, SSL_kRSA, SSL_aRSA, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384, TLS1_RFC_RSA_WITH_AES_256_GCM_SHA384, TLS1_CK_RSA_WITH_AES_256_GCM_SHA384, SSL_kRSA, SSL_aRSA, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS1_RFC_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256, SSL_kDHE, SSL_aRSA, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS1_RFC_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384, SSL_kDHE, SSL_aRSA, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS1_RFC_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256, SSL_kDHE, SSL_aDSS, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS1_RFC_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384, SSL_kDHE, SSL_aDSS, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256, TLS1_RFC_ADH_WITH_AES_128_GCM_SHA256, TLS1_CK_ADH_WITH_AES_128_GCM_SHA256, SSL_kDHE, SSL_aNULL, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384, TLS1_RFC_ADH_WITH_AES_256_GCM_SHA384, TLS1_CK_ADH_WITH_AES_256_GCM_SHA384, SSL_kDHE, SSL_aNULL, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_RSA_WITH_AES_128_CCM, TLS1_RFC_RSA_WITH_AES_128_CCM, TLS1_CK_RSA_WITH_AES_128_CCM, SSL_kRSA, SSL_aRSA, SSL_AES128CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_AES_256_CCM, TLS1_RFC_RSA_WITH_AES_256_CCM, TLS1_CK_RSA_WITH_AES_256_CCM, SSL_kRSA, SSL_aRSA, SSL_AES256CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_128_CCM, TLS1_RFC_DHE_RSA_WITH_AES_128_CCM, TLS1_CK_DHE_RSA_WITH_AES_128_CCM, SSL_kDHE, SSL_aRSA, SSL_AES128CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_256_CCM, TLS1_RFC_DHE_RSA_WITH_AES_256_CCM, TLS1_CK_DHE_RSA_WITH_AES_256_CCM, SSL_kDHE, SSL_aRSA, SSL_AES256CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_RSA_WITH_AES_128_CCM_8, TLS1_RFC_RSA_WITH_AES_128_CCM_8, TLS1_CK_RSA_WITH_AES_128_CCM_8, SSL_kRSA, SSL_aRSA, SSL_AES128CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_AES_256_CCM_8, TLS1_RFC_RSA_WITH_AES_256_CCM_8, TLS1_CK_RSA_WITH_AES_256_CCM_8, SSL_kRSA, SSL_aRSA, SSL_AES256CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_128_CCM_8, TLS1_RFC_DHE_RSA_WITH_AES_128_CCM_8, TLS1_CK_DHE_RSA_WITH_AES_128_CCM_8, SSL_kDHE, SSL_aRSA, SSL_AES128CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_AES_256_CCM_8, TLS1_RFC_DHE_RSA_WITH_AES_256_CCM_8, TLS1_CK_DHE_RSA_WITH_AES_256_CCM_8, SSL_kDHE, SSL_aRSA, SSL_AES256CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_AES_128_CCM, TLS1_RFC_PSK_WITH_AES_128_CCM, TLS1_CK_PSK_WITH_AES_128_CCM, SSL_kPSK, SSL_aPSK, SSL_AES128CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_AES_256_CCM, TLS1_RFC_PSK_WITH_AES_256_CCM, TLS1_CK_PSK_WITH_AES_256_CCM, SSL_kPSK, SSL_aPSK, SSL_AES256CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_128_CCM, TLS1_RFC_DHE_PSK_WITH_AES_128_CCM, TLS1_CK_DHE_PSK_WITH_AES_128_CCM, SSL_kDHEPSK, SSL_aPSK, SSL_AES128CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_256_CCM, TLS1_RFC_DHE_PSK_WITH_AES_256_CCM, TLS1_CK_DHE_PSK_WITH_AES_256_CCM, SSL_kDHEPSK, SSL_aPSK, SSL_AES256CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_AES_128_CCM_8, TLS1_RFC_PSK_WITH_AES_128_CCM_8, TLS1_CK_PSK_WITH_AES_128_CCM_8, SSL_kPSK, SSL_aPSK, SSL_AES128CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_AES_256_CCM_8, TLS1_RFC_PSK_WITH_AES_256_CCM_8, TLS1_CK_PSK_WITH_AES_256_CCM_8, SSL_kPSK, SSL_aPSK, SSL_AES256CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_128_CCM_8, TLS1_RFC_DHE_PSK_WITH_AES_128_CCM_8, TLS1_CK_DHE_PSK_WITH_AES_128_CCM_8, SSL_kDHEPSK, SSL_aPSK, SSL_AES128CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_256_CCM_8, TLS1_RFC_DHE_PSK_WITH_AES_256_CCM_8, TLS1_CK_DHE_PSK_WITH_AES_256_CCM_8, SSL_kDHEPSK, SSL_aPSK, SSL_AES256CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM, TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM, TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM, SSL_kECDHE, SSL_aECDSA, SSL_AES128CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM, TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM, TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM, SSL_kECDHE, SSL_aECDSA, SSL_AES256CCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM_8, TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM_8, TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM_8, SSL_kECDHE, SSL_aECDSA, SSL_AES128CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM_8, TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM_8, TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM_8, SSL_kECDHE, SSL_aECDSA, SSL_AES256CCM8, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA, TLS1_RFC_ECDHE_ECDSA_WITH_NULL_SHA, TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA, SSL_kECDHE, SSL_aECDSA, SSL_eNULL, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, TLS1_RFC_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA, SSL_kECDHE, SSL_aECDSA, SSL_3DES, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_kECDHE, SSL_aECDSA, SSL_AES128, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_kECDHE, SSL_aECDSA, SSL_AES256, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA, TLS1_RFC_ECDHE_RSA_WITH_NULL_SHA, TLS1_CK_ECDHE_RSA_WITH_NULL_SHA, SSL_kECDHE, SSL_aRSA, SSL_eNULL, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA, TLS1_RFC_ECDHE_RSA_WITH_DES_192_CBC3_SHA, TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA, SSL_kECDHE, SSL_aRSA, SSL_3DES, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS1_RFC_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_kECDHE, SSL_aRSA, SSL_AES128, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS1_RFC_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_kECDHE, SSL_aRSA, SSL_AES256, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ECDH_anon_WITH_NULL_SHA, TLS1_RFC_ECDH_anon_WITH_NULL_SHA, TLS1_CK_ECDH_anon_WITH_NULL_SHA, SSL_kECDHE, SSL_aNULL, SSL_eNULL, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA, TLS1_RFC_ECDH_anon_WITH_DES_192_CBC3_SHA, TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA, SSL_kECDHE, SSL_aNULL, SSL_3DES, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA, TLS1_RFC_ECDH_anon_WITH_AES_128_CBC_SHA, TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA, SSL_kECDHE, SSL_aNULL, SSL_AES128, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA, TLS1_RFC_ECDH_anon_WITH_AES_256_CBC_SHA, TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA, SSL_kECDHE, SSL_aNULL, SSL_AES256, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256, TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_SHA256, TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256, SSL_kECDHE, SSL_aECDSA, SSL_AES128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384, TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_SHA384, TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384, SSL_kECDHE, SSL_aECDSA, SSL_AES256, SSL_SHA384, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256, TLS1_RFC_ECDHE_RSA_WITH_AES_128_SHA256, TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256, SSL_kECDHE, SSL_aRSA, SSL_AES128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384, TLS1_RFC_ECDHE_RSA_WITH_AES_256_SHA384, TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384, SSL_kECDHE, SSL_aRSA, SSL_AES256, SSL_SHA384, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, SSL_kECDHE, SSL_aECDSA, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, SSL_kECDHE, SSL_aECDSA, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS1_RFC_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSL_kECDHE, SSL_aRSA, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS1_RFC_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384, SSL_kECDHE, SSL_aRSA, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_NULL_SHA, TLS1_RFC_PSK_WITH_NULL_SHA, TLS1_CK_PSK_WITH_NULL_SHA, SSL_kPSK, SSL_aPSK, SSL_eNULL, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_DHE_PSK_WITH_NULL_SHA, TLS1_RFC_DHE_PSK_WITH_NULL_SHA, TLS1_CK_DHE_PSK_WITH_NULL_SHA, SSL_kDHEPSK, SSL_aPSK, SSL_eNULL, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_RSA_PSK_WITH_NULL_SHA, TLS1_RFC_RSA_PSK_WITH_NULL_SHA, TLS1_CK_RSA_PSK_WITH_NULL_SHA, SSL_kRSAPSK, SSL_aRSA, SSL_eNULL, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA, SSL_kPSK, SSL_aPSK, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_PSK_WITH_AES_128_CBC_SHA, TLS1_RFC_PSK_WITH_AES_128_CBC_SHA, TLS1_CK_PSK_WITH_AES_128_CBC_SHA, SSL_kPSK, SSL_aPSK, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_AES_256_CBC_SHA, TLS1_RFC_PSK_WITH_AES_256_CBC_SHA, TLS1_CK_PSK_WITH_AES_256_CBC_SHA, SSL_kPSK, SSL_aPSK, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_DHE_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_DHE_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_CK_DHE_PSK_WITH_3DES_EDE_CBC_SHA, SSL_kDHEPSK, SSL_aPSK, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA, TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA, TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA, SSL_kDHEPSK, SSL_aPSK, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA, TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA, TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA, SSL_kDHEPSK, SSL_aPSK, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_RSA_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_RSA_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_CK_RSA_PSK_WITH_3DES_EDE_CBC_SHA, SSL_kRSAPSK, SSL_aRSA, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA, TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA, TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA, SSL_kRSAPSK, SSL_aRSA, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA, TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA, TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA, SSL_kRSAPSK, SSL_aRSA, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256, TLS1_RFC_PSK_WITH_AES_128_GCM_SHA256, TLS1_CK_PSK_WITH_AES_128_GCM_SHA256, SSL_kPSK, SSL_aPSK, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384, TLS1_RFC_PSK_WITH_AES_256_GCM_SHA384, TLS1_CK_PSK_WITH_AES_256_GCM_SHA384, SSL_kPSK, SSL_aPSK, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_128_GCM_SHA256, TLS1_RFC_DHE_PSK_WITH_AES_128_GCM_SHA256, TLS1_CK_DHE_PSK_WITH_AES_128_GCM_SHA256, SSL_kDHEPSK, SSL_aPSK, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_256_GCM_SHA384, TLS1_RFC_DHE_PSK_WITH_AES_256_GCM_SHA384, TLS1_CK_DHE_PSK_WITH_AES_256_GCM_SHA384, SSL_kDHEPSK, SSL_aPSK, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_RSA_PSK_WITH_AES_128_GCM_SHA256, TLS1_RFC_RSA_PSK_WITH_AES_128_GCM_SHA256, TLS1_CK_RSA_PSK_WITH_AES_128_GCM_SHA256, SSL_kRSAPSK, SSL_aRSA, SSL_AES128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_PSK_WITH_AES_256_GCM_SHA384, TLS1_RFC_RSA_PSK_WITH_AES_256_GCM_SHA384, TLS1_CK_RSA_PSK_WITH_AES_256_GCM_SHA384, SSL_kRSAPSK, SSL_aRSA, SSL_AES256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_AES_128_CBC_SHA256, TLS1_RFC_PSK_WITH_AES_128_CBC_SHA256, TLS1_CK_PSK_WITH_AES_128_CBC_SHA256, SSL_kPSK, SSL_aPSK, SSL_AES128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_AES_256_CBC_SHA384, TLS1_RFC_PSK_WITH_AES_256_CBC_SHA384, TLS1_CK_PSK_WITH_AES_256_CBC_SHA384, SSL_kPSK, SSL_aPSK, SSL_AES256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_NULL_SHA256, TLS1_RFC_PSK_WITH_NULL_SHA256, TLS1_CK_PSK_WITH_NULL_SHA256, SSL_kPSK, SSL_aPSK, SSL_eNULL, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_PSK_WITH_NULL_SHA384, TLS1_RFC_PSK_WITH_NULL_SHA384, TLS1_CK_PSK_WITH_NULL_SHA384, SSL_kPSK, SSL_aPSK, SSL_eNULL, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 0, 0, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA256, TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA256, TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA256, SSL_kDHEPSK, SSL_aPSK, SSL_AES128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA384, TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA384, TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA384, SSL_kDHEPSK, SSL_aPSK, SSL_AES256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_NULL_SHA256, TLS1_RFC_DHE_PSK_WITH_NULL_SHA256, TLS1_CK_DHE_PSK_WITH_NULL_SHA256, SSL_kDHEPSK, SSL_aPSK, SSL_eNULL, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_DHE_PSK_WITH_NULL_SHA384, TLS1_RFC_DHE_PSK_WITH_NULL_SHA384, TLS1_CK_DHE_PSK_WITH_NULL_SHA384, SSL_kDHEPSK, SSL_aPSK, SSL_eNULL, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 0, 0, }, { 1, TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA256, TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA256, TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA256, SSL_kRSAPSK, SSL_aRSA, SSL_AES128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA384, TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA384, TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA384, SSL_kRSAPSK, SSL_aRSA, SSL_AES256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_RSA_PSK_WITH_NULL_SHA256, TLS1_RFC_RSA_PSK_WITH_NULL_SHA256, TLS1_CK_RSA_PSK_WITH_NULL_SHA256, SSL_kRSAPSK, SSL_aRSA, SSL_eNULL, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_RSA_PSK_WITH_NULL_SHA384, TLS1_RFC_RSA_PSK_WITH_NULL_SHA384, TLS1_CK_RSA_PSK_WITH_NULL_SHA384, SSL_kRSAPSK, SSL_aRSA, SSL_eNULL, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 0, 0, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA, TLS1_CK_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA, SSL_kECDHEPSK, SSL_aPSK, SSL_3DES, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA, TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA, TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA, SSL_kECDHEPSK, SSL_aPSK, SSL_AES128, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA, TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA, TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA, SSL_kECDHEPSK, SSL_aPSK, SSL_AES256, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA256, TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA256, TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA256, SSL_kECDHEPSK, SSL_aPSK, SSL_AES128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA384, TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA384, TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA384, SSL_kECDHEPSK, SSL_aPSK, SSL_AES256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA, TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA, TLS1_CK_ECDHE_PSK_WITH_NULL_SHA, SSL_kECDHEPSK, SSL_aPSK, SSL_eNULL, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA256, TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA256, TLS1_CK_ECDHE_PSK_WITH_NULL_SHA256, SSL_kECDHEPSK, SSL_aPSK, SSL_eNULL, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 0, 0, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA384, TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA384, TLS1_CK_ECDHE_PSK_WITH_NULL_SHA384, SSL_kECDHEPSK, SSL_aPSK, SSL_eNULL, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_STRONG_NONE | SSL_FIPS, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 0, 0, }, # ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_SRP_SHA_WITH_3DES_EDE_CBC_SHA, TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA, SSL_kSRP, SSL_aSRP, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, { 1, TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA, TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA, SSL_kSRP, SSL_aRSA, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, { 1, TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA, TLS1_RFC_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA, TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA, SSL_kSRP, SSL_aDSS, SSL_3DES, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 112, 168, }, # endif { 1, TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA, TLS1_RFC_SRP_SHA_WITH_AES_128_CBC_SHA, TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA, SSL_kSRP, SSL_aSRP, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA, TLS1_RFC_SRP_SHA_RSA_WITH_AES_128_CBC_SHA, TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA, SSL_kSRP, SSL_aRSA, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA, TLS1_RFC_SRP_SHA_DSS_WITH_AES_128_CBC_SHA, TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA, SSL_kSRP, SSL_aDSS, SSL_AES128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA, TLS1_RFC_SRP_SHA_WITH_AES_256_CBC_SHA, TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA, SSL_kSRP, SSL_aSRP, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA, TLS1_RFC_SRP_SHA_RSA_WITH_AES_256_CBC_SHA, TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA, SSL_kSRP, SSL_aRSA, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA, TLS1_RFC_SRP_SHA_DSS_WITH_AES_256_CBC_SHA, TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA, SSL_kSRP, SSL_aDSS, SSL_AES256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) { 1, TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305, TLS1_RFC_DHE_RSA_WITH_CHACHA20_POLY1305, TLS1_CK_DHE_RSA_WITH_CHACHA20_POLY1305, SSL_kDHE, SSL_aRSA, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS1_RFC_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305, SSL_kECDHE, SSL_aRSA, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS1_RFC_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, SSL_kECDHE, SSL_aECDSA, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_CHACHA20_POLY1305, TLS1_RFC_PSK_WITH_CHACHA20_POLY1305, TLS1_CK_PSK_WITH_CHACHA20_POLY1305, SSL_kPSK, SSL_aPSK, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305, TLS1_RFC_ECDHE_PSK_WITH_CHACHA20_POLY1305, TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305, SSL_kECDHEPSK, SSL_aPSK, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_CHACHA20_POLY1305, TLS1_RFC_DHE_PSK_WITH_CHACHA20_POLY1305, TLS1_CK_DHE_PSK_WITH_CHACHA20_POLY1305, SSL_kDHEPSK, SSL_aPSK, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_RSA_PSK_WITH_CHACHA20_POLY1305, TLS1_RFC_RSA_PSK_WITH_CHACHA20_POLY1305, TLS1_CK_RSA_PSK_WITH_CHACHA20_POLY1305, SSL_kRSAPSK, SSL_aRSA, SSL_CHACHA20POLY1305, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, #endif /* !defined(OPENSSL_NO_CHACHA) && * !defined(OPENSSL_NO_POLY1305) */ #ifndef OPENSSL_NO_CAMELLIA { 1, TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256, SSL_kRSA, SSL_aRSA, SSL_CAMELLIA128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256, SSL_kEDH, SSL_aDSS, SSL_CAMELLIA128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, SSL_kEDH, SSL_aRSA, SSL_CAMELLIA128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256, SSL_kEDH, SSL_aNULL, SSL_CAMELLIA128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256, TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA256, TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256, SSL_kRSA, SSL_aRSA, SSL_CAMELLIA256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256, TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256, TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256, SSL_kEDH, SSL_aDSS, SSL_CAMELLIA256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256, TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256, TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256, SSL_kEDH, SSL_aRSA, SSL_CAMELLIA256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256, TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA256, TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256, SSL_kEDH, SSL_aNULL, SSL_CAMELLIA256, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 256, 256, }, { 1, TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA, TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA, TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kRSA, SSL_aRSA, SSL_CAMELLIA256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_kDHE, SSL_aDSS, SSL_CAMELLIA256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_kDHE, SSL_aRSA, SSL_CAMELLIA256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA, TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA, TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA, SSL_kDHE, SSL_aNULL, SSL_CAMELLIA256, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 256, 256, }, { 1, TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kRSA, SSL_aRSA, SSL_CAMELLIA128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_kDHE, SSL_aDSS, SSL_CAMELLIA128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_kDHE, SSL_aRSA, SSL_CAMELLIA128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA, TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA, TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA, SSL_kDHE, SSL_aNULL, SSL_CAMELLIA128, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256, SSL_kECDHE, SSL_aECDSA, SSL_CAMELLIA128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384, TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384, TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384, SSL_kECDHE, SSL_aECDSA, SSL_CAMELLIA256, SSL_SHA384, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, SSL_kECDHE, SSL_aRSA, SSL_CAMELLIA128, SSL_SHA256, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384, TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384, TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384, SSL_kECDHE, SSL_aRSA, SSL_CAMELLIA256, SSL_SHA384, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_PSK_WITH_CAMELLIA_128_CBC_SHA256, SSL_kPSK, SSL_aPSK, SSL_CAMELLIA128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_RFC_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_CK_PSK_WITH_CAMELLIA_256_CBC_SHA384, SSL_kPSK, SSL_aPSK, SSL_CAMELLIA256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, SSL_kDHEPSK, SSL_aPSK, SSL_CAMELLIA128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_RFC_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_CK_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, SSL_kDHEPSK, SSL_aPSK, SSL_CAMELLIA256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256, SSL_kRSAPSK, SSL_aRSA, SSL_CAMELLIA128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_RFC_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_CK_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384, SSL_kRSAPSK, SSL_aRSA, SSL_CAMELLIA256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, SSL_kECDHEPSK, SSL_aPSK, SSL_CAMELLIA128, SSL_SHA256, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, SSL_kECDHEPSK, SSL_aPSK, SSL_CAMELLIA256, SSL_SHA384, TLS1_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, #endif /* OPENSSL_NO_CAMELLIA */ #ifndef OPENSSL_NO_GOST { 1, "GOST2001-GOST89-GOST89", "TLS_GOSTR341001_WITH_28147_CNT_IMIT", 0x3000081, SSL_kGOST, SSL_aGOST01, SSL_eGOST2814789CNT, SSL_GOST89MAC, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_HIGH, SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC, 256, 256, }, { 1, "GOST2001-NULL-GOST94", "TLS_GOSTR341001_WITH_NULL_GOSTR3411", 0x3000083, SSL_kGOST, SSL_aGOST01, SSL_eNULL, SSL_GOST94, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_STRONG_NONE, SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94, 0, 0, }, { 1, "GOST2012-GOST8912-GOST8912", NULL, 0x0300ff85, SSL_kGOST, SSL_aGOST12 | SSL_aGOST01, SSL_eGOST2814789CNT12, SSL_GOST89MAC12, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_HIGH, SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC, 256, 256, }, { 1, "GOST2012-NULL-GOST12", NULL, 0x0300ff87, SSL_kGOST, SSL_aGOST12 | SSL_aGOST01, SSL_eNULL, SSL_GOST12_256, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_STRONG_NONE, SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC, 0, 0, }, #endif /* OPENSSL_NO_GOST */ #ifndef OPENSSL_NO_IDEA { 1, SSL3_TXT_RSA_IDEA_128_SHA, SSL3_RFC_RSA_IDEA_128_SHA, SSL3_CK_RSA_IDEA_128_SHA, SSL_kRSA, SSL_aRSA, SSL_IDEA, SSL_SHA1, SSL3_VERSION, TLS1_1_VERSION, DTLS1_BAD_VER, DTLS1_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, #endif #ifndef OPENSSL_NO_SEED { 1, TLS1_TXT_RSA_WITH_SEED_SHA, TLS1_RFC_RSA_WITH_SEED_SHA, TLS1_CK_RSA_WITH_SEED_SHA, SSL_kRSA, SSL_aRSA, SSL_SEED, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_SEED_SHA, TLS1_RFC_DHE_DSS_WITH_SEED_SHA, TLS1_CK_DHE_DSS_WITH_SEED_SHA, SSL_kDHE, SSL_aDSS, SSL_SEED, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_SEED_SHA, TLS1_RFC_DHE_RSA_WITH_SEED_SHA, TLS1_CK_DHE_RSA_WITH_SEED_SHA, SSL_kDHE, SSL_aRSA, SSL_SEED, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ADH_WITH_SEED_SHA, TLS1_RFC_ADH_WITH_SEED_SHA, TLS1_CK_ADH_WITH_SEED_SHA, SSL_kDHE, SSL_aNULL, SSL_SEED, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, DTLS1_BAD_VER, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, #endif /* OPENSSL_NO_SEED */ #ifndef OPENSSL_NO_WEAK_SSL_CIPHERS { 1, SSL3_TXT_RSA_RC4_128_MD5, SSL3_RFC_RSA_RC4_128_MD5, SSL3_CK_RSA_RC4_128_MD5, SSL_kRSA, SSL_aRSA, SSL_RC4, SSL_MD5, SSL3_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, SSL3_TXT_RSA_RC4_128_SHA, SSL3_RFC_RSA_RC4_128_SHA, SSL3_CK_RSA_RC4_128_SHA, SSL_kRSA, SSL_aRSA, SSL_RC4, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, SSL3_TXT_ADH_RC4_128_MD5, SSL3_RFC_ADH_RC4_128_MD5, SSL3_CK_ADH_RC4_128_MD5, SSL_kDHE, SSL_aNULL, SSL_RC4, SSL_MD5, SSL3_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA, TLS1_RFC_ECDHE_PSK_WITH_RC4_128_SHA, TLS1_CK_ECDHE_PSK_WITH_RC4_128_SHA, SSL_kECDHEPSK, SSL_aPSK, SSL_RC4, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA, TLS1_RFC_ECDH_anon_WITH_RC4_128_SHA, TLS1_CK_ECDH_anon_WITH_RC4_128_SHA, SSL_kECDHE, SSL_aNULL, SSL_RC4, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS1_RFC_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_kECDHE, SSL_aECDSA, SSL_RC4, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA, TLS1_RFC_ECDHE_RSA_WITH_RC4_128_SHA, TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA, SSL_kECDHE, SSL_aRSA, SSL_RC4, SSL_SHA1, TLS1_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_RC4_128_SHA, TLS1_RFC_PSK_WITH_RC4_128_SHA, TLS1_CK_PSK_WITH_RC4_128_SHA, SSL_kPSK, SSL_aPSK, SSL_RC4, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA, TLS1_RFC_RSA_PSK_WITH_RC4_128_SHA, TLS1_CK_RSA_PSK_WITH_RC4_128_SHA, SSL_kRSAPSK, SSL_aRSA, SSL_RC4, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_RC4_128_SHA, TLS1_RFC_DHE_PSK_WITH_RC4_128_SHA, TLS1_CK_DHE_PSK_WITH_RC4_128_SHA, SSL_kDHEPSK, SSL_aPSK, SSL_RC4, SSL_SHA1, SSL3_VERSION, TLS1_2_VERSION, 0, 0, SSL_NOT_DEFAULT | SSL_MEDIUM, SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF, 128, 128, }, #endif /* OPENSSL_NO_WEAK_SSL_CIPHERS */ #ifndef OPENSSL_NO_ARIA { 1, TLS1_TXT_RSA_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_RSA_WITH_ARIA_128_GCM_SHA256, TLS1_CK_RSA_WITH_ARIA_128_GCM_SHA256, SSL_kRSA, SSL_aRSA, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_RSA_WITH_ARIA_256_GCM_SHA384, TLS1_CK_RSA_WITH_ARIA_256_GCM_SHA384, SSL_kRSA, SSL_aRSA, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_RSA_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_DHE_RSA_WITH_ARIA_128_GCM_SHA256, TLS1_CK_DHE_RSA_WITH_ARIA_128_GCM_SHA256, SSL_kDHE, SSL_aRSA, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_RSA_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_DHE_RSA_WITH_ARIA_256_GCM_SHA384, TLS1_CK_DHE_RSA_WITH_ARIA_256_GCM_SHA384, SSL_kDHE, SSL_aRSA, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_DSS_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_DHE_DSS_WITH_ARIA_128_GCM_SHA256, TLS1_CK_DHE_DSS_WITH_ARIA_128_GCM_SHA256, SSL_kDHE, SSL_aDSS, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_DSS_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_DHE_DSS_WITH_ARIA_256_GCM_SHA384, TLS1_CK_DHE_DSS_WITH_ARIA_256_GCM_SHA384, SSL_kDHE, SSL_aDSS, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256, TLS1_CK_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256, SSL_kECDHE, SSL_aECDSA, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384, TLS1_CK_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384, SSL_kECDHE, SSL_aECDSA, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256, TLS1_CK_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256, SSL_kECDHE, SSL_aRSA, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384, TLS1_CK_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384, SSL_kECDHE, SSL_aRSA, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_PSK_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_PSK_WITH_ARIA_128_GCM_SHA256, TLS1_CK_PSK_WITH_ARIA_128_GCM_SHA256, SSL_kPSK, SSL_aPSK, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_PSK_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_PSK_WITH_ARIA_256_GCM_SHA384, TLS1_CK_PSK_WITH_ARIA_256_GCM_SHA384, SSL_kPSK, SSL_aPSK, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_DHE_PSK_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_DHE_PSK_WITH_ARIA_128_GCM_SHA256, TLS1_CK_DHE_PSK_WITH_ARIA_128_GCM_SHA256, SSL_kDHEPSK, SSL_aPSK, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_DHE_PSK_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_DHE_PSK_WITH_ARIA_256_GCM_SHA384, TLS1_CK_DHE_PSK_WITH_ARIA_256_GCM_SHA384, SSL_kDHEPSK, SSL_aPSK, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, { 1, TLS1_TXT_RSA_PSK_WITH_ARIA_128_GCM_SHA256, TLS1_RFC_RSA_PSK_WITH_ARIA_128_GCM_SHA256, TLS1_CK_RSA_PSK_WITH_ARIA_128_GCM_SHA256, SSL_kRSAPSK, SSL_aRSA, SSL_ARIA128GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256, 128, 128, }, { 1, TLS1_TXT_RSA_PSK_WITH_ARIA_256_GCM_SHA384, TLS1_RFC_RSA_PSK_WITH_ARIA_256_GCM_SHA384, TLS1_CK_RSA_PSK_WITH_ARIA_256_GCM_SHA384, SSL_kRSAPSK, SSL_aRSA, SSL_ARIA256GCM, SSL_AEAD, TLS1_2_VERSION, TLS1_2_VERSION, DTLS1_2_VERSION, DTLS1_2_VERSION, SSL_NOT_DEFAULT | SSL_HIGH, SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384, 256, 256, }, #endif /* OPENSSL_NO_ARIA */ }; /* * The list of known Signalling Cipher-Suite Value "ciphers", non-valid * values stuffed into the ciphers field of the wire protocol for signalling * purposes. */ static SSL_CIPHER ssl3_scsvs[] = { { 0, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, { 0, "TLS_FALLBACK_SCSV", "TLS_FALLBACK_SCSV", SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, }; static int cipher_compare(const void *a, const void *b) { const SSL_CIPHER *ap = (const SSL_CIPHER *)a; const SSL_CIPHER *bp = (const SSL_CIPHER *)b; if (ap->id == bp->id) return 0; return ap->id < bp->id ? -1 : 1; } void ssl_sort_cipher_list(void) { qsort(tls13_ciphers, TLS13_NUM_CIPHERS, sizeof(tls13_ciphers[0]), cipher_compare); qsort(ssl3_ciphers, SSL3_NUM_CIPHERS, sizeof(ssl3_ciphers[0]), cipher_compare); qsort(ssl3_scsvs, SSL3_NUM_SCSVS, sizeof(ssl3_scsvs[0]), cipher_compare); } static int ssl_undefined_function_1(SSL *ssl, unsigned char *r, size_t s, const char * t, size_t u, const unsigned char * v, size_t w, int x) { (void)r; (void)s; (void)t; (void)u; (void)v; (void)w; (void)x; return ssl_undefined_function(ssl); } const SSL3_ENC_METHOD SSLv3_enc_data = { ssl3_enc, n_ssl3_mac, ssl3_setup_key_block, ssl3_generate_master_secret, ssl3_change_cipher_state, ssl3_final_finish_mac, SSL3_MD_CLIENT_FINISHED_CONST, 4, SSL3_MD_SERVER_FINISHED_CONST, 4, ssl3_alert_code, ssl_undefined_function_1, 0, ssl3_set_handshake_header, tls_close_construct_packet, ssl3_handshake_write }; long ssl3_default_timeout(void) { /* * 2 hours, the 24 hours mentioned in the SSLv3 spec is way too long for * http, the cache would over fill */ return (60 * 60 * 2); } int ssl3_num_ciphers(void) { return SSL3_NUM_CIPHERS; } const SSL_CIPHER *ssl3_get_cipher(unsigned int u) { if (u < SSL3_NUM_CIPHERS) return &(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]); else return NULL; } int ssl3_set_handshake_header(SSL *s, WPACKET *pkt, int htype) { /* No header in the event of a CCS */ if (htype == SSL3_MT_CHANGE_CIPHER_SPEC) return 1; /* Set the content type and 3 bytes for the message len */ if (!WPACKET_put_bytes_u8(pkt, htype) || !WPACKET_start_sub_packet_u24(pkt)) return 0; return 1; } int ssl3_handshake_write(SSL *s) { return ssl3_do_write(s, SSL3_RT_HANDSHAKE); } int ssl3_new(SSL *s) { SSL3_STATE *s3; if ((s3 = OPENSSL_zalloc(sizeof(*s3))) == NULL) goto err; s->s3 = s3; #ifndef OPENSSL_NO_SRP if (!SSL_SRP_CTX_init(s)) goto err; #endif if (!s->method->ssl_clear(s)) return 0; return 1; err: return 0; } void ssl3_free(SSL *s) { if (s == NULL || s->s3 == NULL) return; ssl3_cleanup_key_block(s); #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) EVP_PKEY_free(s->s3->peer_tmp); s->s3->peer_tmp = NULL; EVP_PKEY_free(s->s3->tmp.pkey); s->s3->tmp.pkey = NULL; #endif OPENSSL_free(s->s3->tmp.ctype); sk_X509_NAME_pop_free(s->s3->tmp.peer_ca_names, X509_NAME_free); OPENSSL_free(s->s3->tmp.ciphers_raw); OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen); OPENSSL_free(s->s3->tmp.peer_sigalgs); OPENSSL_free(s->s3->tmp.peer_cert_sigalgs); ssl3_free_digest_list(s); OPENSSL_free(s->s3->alpn_selected); OPENSSL_free(s->s3->alpn_proposed); #ifndef OPENSSL_NO_SRP SSL_SRP_CTX_free(s); #endif OPENSSL_clear_free(s->s3, sizeof(*s->s3)); s->s3 = NULL; } int ssl3_clear(SSL *s) { ssl3_cleanup_key_block(s); OPENSSL_free(s->s3->tmp.ctype); sk_X509_NAME_pop_free(s->s3->tmp.peer_ca_names, X509_NAME_free); OPENSSL_free(s->s3->tmp.ciphers_raw); OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen); OPENSSL_free(s->s3->tmp.peer_sigalgs); OPENSSL_free(s->s3->tmp.peer_cert_sigalgs); #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) EVP_PKEY_free(s->s3->tmp.pkey); EVP_PKEY_free(s->s3->peer_tmp); #endif /* !OPENSSL_NO_EC */ ssl3_free_digest_list(s); OPENSSL_free(s->s3->alpn_selected); OPENSSL_free(s->s3->alpn_proposed); /* NULL/zero-out everything in the s3 struct */ memset(s->s3, 0, sizeof(*s->s3)); if (!ssl_free_wbio_buffer(s)) return 0; s->version = SSL3_VERSION; #if !defined(OPENSSL_NO_NEXTPROTONEG) OPENSSL_free(s->ext.npn); s->ext.npn = NULL; s->ext.npn_len = 0; #endif return 1; } #ifndef OPENSSL_NO_SRP static char *srp_password_from_info_cb(SSL *s, void *arg) { return OPENSSL_strdup(s->srp_ctx.info); } #endif static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len); long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) { int ret = 0; switch (cmd) { case SSL_CTRL_GET_CLIENT_CERT_REQUEST: break; case SSL_CTRL_GET_NUM_RENEGOTIATIONS: ret = s->s3->num_renegotiations; break; case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS: ret = s->s3->num_renegotiations; s->s3->num_renegotiations = 0; break; case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS: ret = s->s3->total_renegotiations; break; case SSL_CTRL_GET_FLAGS: ret = (int)(s->s3->flags); break; #ifndef OPENSSL_NO_DH case SSL_CTRL_SET_TMP_DH: { DH *dh = (DH *)parg; EVP_PKEY *pkdh = NULL; if (dh == NULL) { SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); return ret; } pkdh = ssl_dh_to_pkey(dh); if (pkdh == NULL) { SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE); return 0; } if (!ssl_security(s, SSL_SECOP_TMP_DH, EVP_PKEY_security_bits(pkdh), 0, pkdh)) { SSLerr(SSL_F_SSL3_CTRL, SSL_R_DH_KEY_TOO_SMALL); EVP_PKEY_free(pkdh); return ret; } EVP_PKEY_free(s->cert->dh_tmp); s->cert->dh_tmp = pkdh; ret = 1; } break; case SSL_CTRL_SET_TMP_DH_CB: { SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return ret; } case SSL_CTRL_SET_DH_AUTO: s->cert->dh_tmp_auto = larg; return 1; #endif #ifndef OPENSSL_NO_EC case SSL_CTRL_SET_TMP_ECDH: { const EC_GROUP *group = NULL; int nid; if (parg == NULL) { SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER); return 0; } group = EC_KEY_get0_group((const EC_KEY *)parg); if (group == NULL) { SSLerr(SSL_F_SSL3_CTRL, EC_R_MISSING_PARAMETERS); return 0; } nid = EC_GROUP_get_curve_name(group); if (nid == NID_undef) return 0; return tls1_set_groups(&s->ext.supportedgroups, &s->ext.supportedgroups_len, &nid, 1); } break; #endif /* !OPENSSL_NO_EC */ case SSL_CTRL_SET_TLSEXT_HOSTNAME: /* * TODO(OpenSSL1.2) * This API is only used for a client to set what SNI it will request * from the server, but we currently allow it to be used on servers * as well, which is a programming error. Currently we just clear * the field in SSL_do_handshake() for server SSLs, but when we can * make ABI-breaking changes, we may want to make use of this API * an error on server SSLs. */ if (larg == TLSEXT_NAMETYPE_host_name) { size_t len; OPENSSL_free(s->ext.hostname); s->ext.hostname = NULL; ret = 1; if (parg == NULL) break; len = strlen((char *)parg); if (len == 0 || len > TLSEXT_MAXLEN_host_name) { SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME); return 0; } if ((s->ext.hostname = OPENSSL_strdup((char *)parg)) == NULL) { SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR); return 0; } } else { SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE); return 0; } break; case SSL_CTRL_SET_TLSEXT_DEBUG_ARG: s->ext.debug_arg = parg; ret = 1; break; case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE: ret = s->ext.status_type; break; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE: s->ext.status_type = larg; ret = 1; break; case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS: *(STACK_OF(X509_EXTENSION) **)parg = s->ext.ocsp.exts; ret = 1; break; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS: s->ext.ocsp.exts = parg; ret = 1; break; case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS: *(STACK_OF(OCSP_RESPID) **)parg = s->ext.ocsp.ids; ret = 1; break; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS: s->ext.ocsp.ids = parg; ret = 1; break; case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP: *(unsigned char **)parg = s->ext.ocsp.resp; if (s->ext.ocsp.resp_len == 0 || s->ext.ocsp.resp_len > LONG_MAX) return -1; return (long)s->ext.ocsp.resp_len; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP: OPENSSL_free(s->ext.ocsp.resp); s->ext.ocsp.resp = parg; s->ext.ocsp.resp_len = larg; ret = 1; break; #ifndef OPENSSL_NO_HEARTBEATS case SSL_CTRL_DTLS_EXT_SEND_HEARTBEAT: case SSL_CTRL_GET_DTLS_EXT_HEARTBEAT_PENDING: case SSL_CTRL_SET_DTLS_EXT_HEARTBEAT_NO_REQUESTS: break; #endif case SSL_CTRL_CHAIN: if (larg) return ssl_cert_set1_chain(s, NULL, (STACK_OF(X509) *)parg); else return ssl_cert_set0_chain(s, NULL, (STACK_OF(X509) *)parg); case SSL_CTRL_CHAIN_CERT: if (larg) return ssl_cert_add1_chain_cert(s, NULL, (X509 *)parg); else return ssl_cert_add0_chain_cert(s, NULL, (X509 *)parg); case SSL_CTRL_GET_CHAIN_CERTS: *(STACK_OF(X509) **)parg = s->cert->key->chain; ret = 1; break; case SSL_CTRL_SELECT_CURRENT_CERT: return ssl_cert_select_current(s->cert, (X509 *)parg); case SSL_CTRL_SET_CURRENT_CERT: if (larg == SSL_CERT_SET_SERVER) { const SSL_CIPHER *cipher; if (!s->server) return 0; cipher = s->s3->tmp.new_cipher; if (cipher == NULL) return 0; /* * No certificate for unauthenticated ciphersuites or using SRP * authentication */ if (cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP)) return 2; if (s->s3->tmp.cert == NULL) return 0; s->cert->key = s->s3->tmp.cert; return 1; } return ssl_cert_set_current(s->cert, larg); #ifndef OPENSSL_NO_EC case SSL_CTRL_GET_GROUPS: { uint16_t *clist; size_t clistlen; if (!s->session) return 0; clist = s->ext.peer_supportedgroups; clistlen = s->ext.peer_supportedgroups_len; if (parg) { size_t i; int *cptr = parg; for (i = 0; i < clistlen; i++) { const TLS_GROUP_INFO *cinf = tls1_group_id_lookup(clist[i]); if (cinf != NULL) cptr[i] = cinf->nid; else cptr[i] = TLSEXT_nid_unknown | clist[i]; } } return (int)clistlen; } case SSL_CTRL_SET_GROUPS: return tls1_set_groups(&s->ext.supportedgroups, &s->ext.supportedgroups_len, parg, larg); case SSL_CTRL_SET_GROUPS_LIST: return tls1_set_groups_list(&s->ext.supportedgroups, &s->ext.supportedgroups_len, parg); case SSL_CTRL_GET_SHARED_GROUP: { uint16_t id = tls1_shared_group(s, larg); if (larg != -1) { const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(id); return ginf == NULL ? 0 : ginf->nid; } return id; } #endif case SSL_CTRL_SET_SIGALGS: return tls1_set_sigalgs(s->cert, parg, larg, 0); case SSL_CTRL_SET_SIGALGS_LIST: return tls1_set_sigalgs_list(s->cert, parg, 0); case SSL_CTRL_SET_CLIENT_SIGALGS: return tls1_set_sigalgs(s->cert, parg, larg, 1); case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: return tls1_set_sigalgs_list(s->cert, parg, 1); case SSL_CTRL_GET_CLIENT_CERT_TYPES: { const unsigned char **pctype = parg; if (s->server || !s->s3->tmp.cert_req) return 0; if (pctype) *pctype = s->s3->tmp.ctype; return s->s3->tmp.ctype_len; } case SSL_CTRL_SET_CLIENT_CERT_TYPES: if (!s->server) return 0; return ssl3_set_req_cert_type(s->cert, parg, larg); case SSL_CTRL_BUILD_CERT_CHAIN: return ssl_build_cert_chain(s, NULL, larg); case SSL_CTRL_SET_VERIFY_CERT_STORE: return ssl_cert_set_cert_store(s->cert, parg, 0, larg); case SSL_CTRL_SET_CHAIN_CERT_STORE: return ssl_cert_set_cert_store(s->cert, parg, 1, larg); case SSL_CTRL_GET_PEER_SIGNATURE_NID: if (s->s3->tmp.peer_sigalg == NULL) return 0; *(int *)parg = s->s3->tmp.peer_sigalg->hash; return 1; case SSL_CTRL_GET_SIGNATURE_NID: if (s->s3->tmp.sigalg == NULL) return 0; *(int *)parg = s->s3->tmp.sigalg->hash; return 1; case SSL_CTRL_GET_PEER_TMP_KEY: #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC) if (s->session == NULL || s->s3->peer_tmp == NULL) { return 0; } else { EVP_PKEY_up_ref(s->s3->peer_tmp); *(EVP_PKEY **)parg = s->s3->peer_tmp; return 1; } #else return 0; #endif case SSL_CTRL_GET_TMP_KEY: #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC) if (s->session == NULL || s->s3->tmp.pkey == NULL) { return 0; } else { EVP_PKEY_up_ref(s->s3->tmp.pkey); *(EVP_PKEY **)parg = s->s3->tmp.pkey; return 1; } #else return 0; #endif #ifndef OPENSSL_NO_EC case SSL_CTRL_GET_EC_POINT_FORMATS: { const unsigned char **pformat = parg; if (s->ext.peer_ecpointformats == NULL) return 0; *pformat = s->ext.peer_ecpointformats; return (int)s->ext.peer_ecpointformats_len; } #endif default: break; } return ret; } long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp) (void)) { int ret = 0; switch (cmd) { #ifndef OPENSSL_NO_DH case SSL_CTRL_SET_TMP_DH_CB: { s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; } break; #endif case SSL_CTRL_SET_TLSEXT_DEBUG_CB: s->ext.debug_cb = (void (*)(SSL *, int, int, const unsigned char *, int, void *))fp; break; case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB: { s->not_resumable_session_cb = (int (*)(SSL *, int))fp; } break; default: break; } return ret; } long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) { switch (cmd) { #ifndef OPENSSL_NO_DH case SSL_CTRL_SET_TMP_DH: { DH *dh = (DH *)parg; EVP_PKEY *pkdh = NULL; if (dh == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_PASSED_NULL_PARAMETER); return 0; } pkdh = ssl_dh_to_pkey(dh); if (pkdh == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE); return 0; } if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH, EVP_PKEY_security_bits(pkdh), 0, pkdh)) { SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_DH_KEY_TOO_SMALL); EVP_PKEY_free(pkdh); return 0; } EVP_PKEY_free(ctx->cert->dh_tmp); ctx->cert->dh_tmp = pkdh; return 1; } case SSL_CTRL_SET_TMP_DH_CB: { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } case SSL_CTRL_SET_DH_AUTO: ctx->cert->dh_tmp_auto = larg; return 1; #endif #ifndef OPENSSL_NO_EC case SSL_CTRL_SET_TMP_ECDH: { const EC_GROUP *group = NULL; int nid; if (parg == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_PASSED_NULL_PARAMETER); return 0; } group = EC_KEY_get0_group((const EC_KEY *)parg); if (group == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, EC_R_MISSING_PARAMETERS); return 0; } nid = EC_GROUP_get_curve_name(group); if (nid == NID_undef) return 0; return tls1_set_groups(&ctx->ext.supportedgroups, &ctx->ext.supportedgroups_len, &nid, 1); } #endif /* !OPENSSL_NO_EC */ case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG: ctx->ext.servername_arg = parg; break; case SSL_CTRL_SET_TLSEXT_TICKET_KEYS: case SSL_CTRL_GET_TLSEXT_TICKET_KEYS: { unsigned char *keys = parg; long tick_keylen = (sizeof(ctx->ext.tick_key_name) + sizeof(ctx->ext.secure->tick_hmac_key) + sizeof(ctx->ext.secure->tick_aes_key)); if (keys == NULL) return tick_keylen; if (larg != tick_keylen) { SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH); return 0; } if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) { memcpy(ctx->ext.tick_key_name, keys, sizeof(ctx->ext.tick_key_name)); memcpy(ctx->ext.secure->tick_hmac_key, keys + sizeof(ctx->ext.tick_key_name), sizeof(ctx->ext.secure->tick_hmac_key)); memcpy(ctx->ext.secure->tick_aes_key, keys + sizeof(ctx->ext.tick_key_name) + sizeof(ctx->ext.secure->tick_hmac_key), sizeof(ctx->ext.secure->tick_aes_key)); } else { memcpy(keys, ctx->ext.tick_key_name, sizeof(ctx->ext.tick_key_name)); memcpy(keys + sizeof(ctx->ext.tick_key_name), ctx->ext.secure->tick_hmac_key, sizeof(ctx->ext.secure->tick_hmac_key)); memcpy(keys + sizeof(ctx->ext.tick_key_name) + sizeof(ctx->ext.secure->tick_hmac_key), ctx->ext.secure->tick_aes_key, sizeof(ctx->ext.secure->tick_aes_key)); } return 1; } case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE: return ctx->ext.status_type; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE: ctx->ext.status_type = larg; break; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG: ctx->ext.status_arg = parg; return 1; case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG: *(void**)parg = ctx->ext.status_arg; break; case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB: *(int (**)(SSL*, void*))parg = ctx->ext.status_cb; break; #ifndef OPENSSL_NO_SRP case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME: ctx->srp_ctx.srp_Mask |= SSL_kSRP; OPENSSL_free(ctx->srp_ctx.login); ctx->srp_ctx.login = NULL; if (parg == NULL) break; if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1) { SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME); return 0; } if ((ctx->srp_ctx.login = OPENSSL_strdup((char *)parg)) == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR); return 0; } break; case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD: ctx->srp_ctx.SRP_give_srp_client_pwd_callback = srp_password_from_info_cb; if (ctx->srp_ctx.info != NULL) OPENSSL_free(ctx->srp_ctx.info); if ((ctx->srp_ctx.info = BUF_strdup((char *)parg)) == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR); return 0; } break; case SSL_CTRL_SET_SRP_ARG: ctx->srp_ctx.srp_Mask |= SSL_kSRP; ctx->srp_ctx.SRP_cb_arg = parg; break; case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH: ctx->srp_ctx.strength = larg; break; #endif #ifndef OPENSSL_NO_EC case SSL_CTRL_SET_GROUPS: return tls1_set_groups(&ctx->ext.supportedgroups, &ctx->ext.supportedgroups_len, parg, larg); case SSL_CTRL_SET_GROUPS_LIST: return tls1_set_groups_list(&ctx->ext.supportedgroups, &ctx->ext.supportedgroups_len, parg); #endif case SSL_CTRL_SET_SIGALGS: return tls1_set_sigalgs(ctx->cert, parg, larg, 0); case SSL_CTRL_SET_SIGALGS_LIST: return tls1_set_sigalgs_list(ctx->cert, parg, 0); case SSL_CTRL_SET_CLIENT_SIGALGS: return tls1_set_sigalgs(ctx->cert, parg, larg, 1); case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: return tls1_set_sigalgs_list(ctx->cert, parg, 1); case SSL_CTRL_SET_CLIENT_CERT_TYPES: return ssl3_set_req_cert_type(ctx->cert, parg, larg); case SSL_CTRL_BUILD_CERT_CHAIN: return ssl_build_cert_chain(NULL, ctx, larg); case SSL_CTRL_SET_VERIFY_CERT_STORE: return ssl_cert_set_cert_store(ctx->cert, parg, 0, larg); case SSL_CTRL_SET_CHAIN_CERT_STORE: return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg); /* A Thawte special :-) */ case SSL_CTRL_EXTRA_CHAIN_CERT: if (ctx->extra_certs == NULL) { if ((ctx->extra_certs = sk_X509_new_null()) == NULL) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE); return 0; } } if (!sk_X509_push(ctx->extra_certs, (X509 *)parg)) { SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE); return 0; } break; case SSL_CTRL_GET_EXTRA_CHAIN_CERTS: if (ctx->extra_certs == NULL && larg == 0) *(STACK_OF(X509) **)parg = ctx->cert->key->chain; else *(STACK_OF(X509) **)parg = ctx->extra_certs; break; case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS: sk_X509_pop_free(ctx->extra_certs, X509_free); ctx->extra_certs = NULL; break; case SSL_CTRL_CHAIN: if (larg) return ssl_cert_set1_chain(NULL, ctx, (STACK_OF(X509) *)parg); else return ssl_cert_set0_chain(NULL, ctx, (STACK_OF(X509) *)parg); case SSL_CTRL_CHAIN_CERT: if (larg) return ssl_cert_add1_chain_cert(NULL, ctx, (X509 *)parg); else return ssl_cert_add0_chain_cert(NULL, ctx, (X509 *)parg); case SSL_CTRL_GET_CHAIN_CERTS: *(STACK_OF(X509) **)parg = ctx->cert->key->chain; break; case SSL_CTRL_SELECT_CURRENT_CERT: return ssl_cert_select_current(ctx->cert, (X509 *)parg); case SSL_CTRL_SET_CURRENT_CERT: return ssl_cert_set_current(ctx->cert, larg); default: return 0; } return 1; } long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void)) { switch (cmd) { #ifndef OPENSSL_NO_DH case SSL_CTRL_SET_TMP_DH_CB: { ctx->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; } break; #endif case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB: ctx->ext.servername_cb = (int (*)(SSL *, int *, void *))fp; break; case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB: ctx->ext.status_cb = (int (*)(SSL *, void *))fp; break; case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB: ctx->ext.ticket_key_cb = (int (*)(SSL *, unsigned char *, unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int))fp; break; #ifndef OPENSSL_NO_SRP case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB: ctx->srp_ctx.srp_Mask |= SSL_kSRP; ctx->srp_ctx.SRP_verify_param_callback = (int (*)(SSL *, void *))fp; break; case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB: ctx->srp_ctx.srp_Mask |= SSL_kSRP; ctx->srp_ctx.TLS_ext_srp_username_callback = (int (*)(SSL *, int *, void *))fp; break; case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB: ctx->srp_ctx.srp_Mask |= SSL_kSRP; ctx->srp_ctx.SRP_give_srp_client_pwd_callback = (char *(*)(SSL *, void *))fp; break; #endif case SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB: { ctx->not_resumable_session_cb = (int (*)(SSL *, int))fp; } break; default: return 0; } return 1; } const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id) { SSL_CIPHER c; const SSL_CIPHER *cp; c.id = id; cp = OBJ_bsearch_ssl_cipher_id(&c, tls13_ciphers, TLS13_NUM_CIPHERS); if (cp != NULL) return cp; cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS); if (cp != NULL) return cp; return OBJ_bsearch_ssl_cipher_id(&c, ssl3_scsvs, SSL3_NUM_SCSVS); } const SSL_CIPHER *ssl3_get_cipher_by_std_name(const char *stdname) { SSL_CIPHER *c = NULL, *tbl; SSL_CIPHER *alltabs[] = {tls13_ciphers, ssl3_ciphers}; size_t i, j, tblsize[] = {TLS13_NUM_CIPHERS, SSL3_NUM_CIPHERS}; /* this is not efficient, necessary to optimize this? */ for (j = 0; j < OSSL_NELEM(alltabs); j++) { for (i = 0, tbl = alltabs[j]; i < tblsize[j]; i++, tbl++) { if (tbl->stdname == NULL) continue; if (strcmp(stdname, tbl->stdname) == 0) { c = tbl; break; } } } if (c == NULL) { tbl = ssl3_scsvs; for (i = 0; i < SSL3_NUM_SCSVS; i++, tbl++) { if (strcmp(stdname, tbl->stdname) == 0) { c = tbl; break; } } } return c; } /* * This function needs to check if the ciphers required are actually * available */ const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p) { return ssl3_get_cipher_by_id(SSL3_CK_CIPHERSUITE_FLAG | ((uint32_t)p[0] << 8L) | (uint32_t)p[1]); } int ssl3_put_cipher_by_char(const SSL_CIPHER *c, WPACKET *pkt, size_t *len) { if ((c->id & 0xff000000) != SSL3_CK_CIPHERSUITE_FLAG) { *len = 0; return 1; } if (!WPACKET_put_bytes_u16(pkt, c->id & 0xffff)) return 0; *len = 2; return 1; } /* * ssl3_choose_cipher - choose a cipher from those offered by the client * @s: SSL connection * @clnt: ciphers offered by the client * @srvr: ciphers enabled on the server? * * Returns the selected cipher or NULL when no common ciphers. */ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt, STACK_OF(SSL_CIPHER) *srvr) { const SSL_CIPHER *c, *ret = NULL; STACK_OF(SSL_CIPHER) *prio, *allow; int i, ii, ok, prefer_sha256 = 0; unsigned long alg_k = 0, alg_a = 0, mask_k = 0, mask_a = 0; const EVP_MD *mdsha256 = EVP_sha256(); #ifndef OPENSSL_NO_CHACHA STACK_OF(SSL_CIPHER) *prio_chacha = NULL; #endif /* Let's see which ciphers we can support */ /* * Do not set the compare functions, because this may lead to a * reordering by "id". We want to keep the original ordering. We may pay * a price in performance during sk_SSL_CIPHER_find(), but would have to * pay with the price of sk_SSL_CIPHER_dup(). */ #ifdef CIPHER_DEBUG fprintf(stderr, "Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), (void *)srvr); for (i = 0; i < sk_SSL_CIPHER_num(srvr); ++i) { c = sk_SSL_CIPHER_value(srvr, i); fprintf(stderr, "%p:%s\n", (void *)c, c->name); } fprintf(stderr, "Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), (void *)clnt); for (i = 0; i < sk_SSL_CIPHER_num(clnt); ++i) { c = sk_SSL_CIPHER_value(clnt, i); fprintf(stderr, "%p:%s\n", (void *)c, c->name); } #endif /* SUITE-B takes precedence over server preference and ChaCha priortiy */ if (tls1_suiteb(s)) { prio = srvr; allow = clnt; } else if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) { prio = srvr; allow = clnt; #ifndef OPENSSL_NO_CHACHA /* If ChaCha20 is at the top of the client preference list, and there are ChaCha20 ciphers in the server list, then temporarily prioritize all ChaCha20 ciphers in the servers list. */ if (s->options & SSL_OP_PRIORITIZE_CHACHA && sk_SSL_CIPHER_num(clnt) > 0) { c = sk_SSL_CIPHER_value(clnt, 0); if (c->algorithm_enc == SSL_CHACHA20POLY1305) { /* ChaCha20 is client preferred, check server... */ int num = sk_SSL_CIPHER_num(srvr); int found = 0; for (i = 0; i < num; i++) { c = sk_SSL_CIPHER_value(srvr, i); if (c->algorithm_enc == SSL_CHACHA20POLY1305) { found = 1; break; } } if (found) { prio_chacha = sk_SSL_CIPHER_new_reserve(NULL, num); /* if reserve fails, then there's likely a memory issue */ if (prio_chacha != NULL) { /* Put all ChaCha20 at the top, starting with the one we just found */ sk_SSL_CIPHER_push(prio_chacha, c); for (i++; i < num; i++) { c = sk_SSL_CIPHER_value(srvr, i); if (c->algorithm_enc == SSL_CHACHA20POLY1305) sk_SSL_CIPHER_push(prio_chacha, c); } /* Pull in the rest */ for (i = 0; i < num; i++) { c = sk_SSL_CIPHER_value(srvr, i); if (c->algorithm_enc != SSL_CHACHA20POLY1305) sk_SSL_CIPHER_push(prio_chacha, c); } prio = prio_chacha; } } } } # endif } else { prio = clnt; allow = srvr; } if (SSL_IS_TLS13(s)) { #ifndef OPENSSL_NO_PSK int j; /* * If we allow "old" style PSK callbacks, and we have no certificate (so * we're not going to succeed without a PSK anyway), and we're in * TLSv1.3 then the default hash for a PSK is SHA-256 (as per the * TLSv1.3 spec). Therefore we should prioritise ciphersuites using * that. */ if (s->psk_server_callback != NULL) { for (j = 0; j < SSL_PKEY_NUM && !ssl_has_cert(s, j); j++); if (j == SSL_PKEY_NUM) { /* There are no certificates */ prefer_sha256 = 1; } } #endif } else { tls1_set_cert_validity(s); ssl_set_masks(s); } for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) { c = sk_SSL_CIPHER_value(prio, i); /* Skip ciphers not supported by the protocol version */ if (!SSL_IS_DTLS(s) && ((s->version < c->min_tls) || (s->version > c->max_tls))) continue; if (SSL_IS_DTLS(s) && (DTLS_VERSION_LT(s->version, c->min_dtls) || DTLS_VERSION_GT(s->version, c->max_dtls))) continue; /* * Since TLS 1.3 ciphersuites can be used with any auth or * key exchange scheme skip tests. */ if (!SSL_IS_TLS13(s)) { mask_k = s->s3->tmp.mask_k; mask_a = s->s3->tmp.mask_a; #ifndef OPENSSL_NO_SRP if (s->srp_ctx.srp_Mask & SSL_kSRP) { mask_k |= SSL_kSRP; mask_a |= SSL_aSRP; } #endif alg_k = c->algorithm_mkey; alg_a = c->algorithm_auth; #ifndef OPENSSL_NO_PSK /* with PSK there must be server callback set */ if ((alg_k & SSL_PSK) && s->psk_server_callback == NULL) continue; #endif /* OPENSSL_NO_PSK */ ok = (alg_k & mask_k) && (alg_a & mask_a); #ifdef CIPHER_DEBUG fprintf(stderr, "%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n", ok, alg_k, alg_a, mask_k, mask_a, (void *)c, c->name); #endif #ifndef OPENSSL_NO_EC /* * if we are considering an ECC cipher suite that uses an ephemeral * EC key check it */ if (alg_k & SSL_kECDHE) ok = ok && tls1_check_ec_tmp_key(s, c->id); #endif /* OPENSSL_NO_EC */ if (!ok) continue; } ii = sk_SSL_CIPHER_find(allow, c); if (ii >= 0) { /* Check security callback permits this cipher */ if (!ssl_security(s, SSL_SECOP_CIPHER_SHARED, c->strength_bits, 0, (void *)c)) continue; #if !defined(OPENSSL_NO_EC) if ((alg_k & SSL_kECDHE) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari) { if (!ret) ret = sk_SSL_CIPHER_value(allow, ii); continue; } #endif if (prefer_sha256) { const SSL_CIPHER *tmp = sk_SSL_CIPHER_value(allow, ii); if (ssl_md(tmp->algorithm2) == mdsha256) { ret = tmp; break; } if (ret == NULL) ret = tmp; continue; } ret = sk_SSL_CIPHER_value(allow, ii); break; } } #ifndef OPENSSL_NO_CHACHA sk_SSL_CIPHER_free(prio_chacha); #endif return ret; } int ssl3_get_req_cert_type(SSL *s, WPACKET *pkt) { uint32_t alg_k, alg_a = 0; /* If we have custom certificate types set, use them */ if (s->cert->ctype) return WPACKET_memcpy(pkt, s->cert->ctype, s->cert->ctype_len); /* Get mask of algorithms disabled by signature list */ ssl_set_sig_mask(&alg_a, s, SSL_SECOP_SIGALG_MASK); alg_k = s->s3->tmp.new_cipher->algorithm_mkey; #ifndef OPENSSL_NO_GOST if (s->version >= TLS1_VERSION && (alg_k & SSL_kGOST)) return WPACKET_put_bytes_u8(pkt, TLS_CT_GOST01_SIGN) && WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_SIGN) && WPACKET_put_bytes_u8(pkt, TLS_CT_GOST12_512_SIGN); #endif if ((s->version == SSL3_VERSION) && (alg_k & SSL_kDHE)) { #ifndef OPENSSL_NO_DH # ifndef OPENSSL_NO_RSA if (!WPACKET_put_bytes_u8(pkt, SSL3_CT_RSA_EPHEMERAL_DH)) return 0; # endif # ifndef OPENSSL_NO_DSA if (!WPACKET_put_bytes_u8(pkt, SSL3_CT_DSS_EPHEMERAL_DH)) return 0; # endif #endif /* !OPENSSL_NO_DH */ } #ifndef OPENSSL_NO_RSA if (!(alg_a & SSL_aRSA) && !WPACKET_put_bytes_u8(pkt, SSL3_CT_RSA_SIGN)) return 0; #endif #ifndef OPENSSL_NO_DSA if (!(alg_a & SSL_aDSS) && !WPACKET_put_bytes_u8(pkt, SSL3_CT_DSS_SIGN)) return 0; #endif #ifndef OPENSSL_NO_EC /* * ECDSA certs can be used with RSA cipher suites too so we don't * need to check for SSL_kECDH or SSL_kECDHE */ if (s->version >= TLS1_VERSION && !(alg_a & SSL_aECDSA) && !WPACKET_put_bytes_u8(pkt, TLS_CT_ECDSA_SIGN)) return 0; #endif return 1; } static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len) { OPENSSL_free(c->ctype); c->ctype = NULL; c->ctype_len = 0; if (p == NULL || len == 0) return 1; if (len > 0xff) return 0; c->ctype = OPENSSL_memdup(p, len); if (c->ctype == NULL) return 0; c->ctype_len = len; return 1; } int ssl3_shutdown(SSL *s) { int ret; /* * Don't do anything much if we have not done the handshake or we don't * want to send messages :-) */ if (s->quiet_shutdown || SSL_in_before(s)) { s->shutdown = (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN); return 1; } if (!(s->shutdown & SSL_SENT_SHUTDOWN)) { s->shutdown |= SSL_SENT_SHUTDOWN; ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY); /* * our shutdown alert has been sent now, and if it still needs to be * written, s->s3->alert_dispatch will be true */ if (s->s3->alert_dispatch) return -1; /* return WANT_WRITE */ } else if (s->s3->alert_dispatch) { /* resend it if not sent */ ret = s->method->ssl_dispatch_alert(s); if (ret == -1) { /* * we only get to return -1 here the 2nd/Nth invocation, we must * have already signalled return 0 upon a previous invocation, * return WANT_WRITE */ return ret; } } else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) { size_t readbytes; /* * If we are waiting for a close from our peer, we are closed */ s->method->ssl_read_bytes(s, 0, NULL, NULL, 0, 0, &readbytes); if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) { return -1; /* return WANT_READ */ } } if ((s->shutdown == (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN)) && !s->s3->alert_dispatch) return 1; else return 0; } int ssl3_write(SSL *s, const void *buf, size_t len, size_t *written) { clear_sys_error(); if (s->s3->renegotiate) ssl3_renegotiate_check(s, 0); return s->method->ssl_write_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, written); } static int ssl3_read_internal(SSL *s, void *buf, size_t len, int peek, size_t *readbytes) { int ret; clear_sys_error(); if (s->s3->renegotiate) ssl3_renegotiate_check(s, 0); s->s3->in_read_app_data = 1; ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, NULL, buf, len, peek, readbytes); if ((ret == -1) && (s->s3->in_read_app_data == 2)) { /* * ssl3_read_bytes decided to call s->handshake_func, which called * ssl3_read_bytes to read handshake data. However, ssl3_read_bytes * actually found application data and thinks that application data * makes sense here; so disable handshake processing and try to read * application data again. */ ossl_statem_set_in_handshake(s, 1); ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, NULL, buf, len, peek, readbytes); ossl_statem_set_in_handshake(s, 0); } else s->s3->in_read_app_data = 0; return ret; } int ssl3_read(SSL *s, void *buf, size_t len, size_t *readbytes) { return ssl3_read_internal(s, buf, len, 0, readbytes); } int ssl3_peek(SSL *s, void *buf, size_t len, size_t *readbytes) { return ssl3_read_internal(s, buf, len, 1, readbytes); } int ssl3_renegotiate(SSL *s) { if (s->handshake_func == NULL) return 1; s->s3->renegotiate = 1; return 1; } /* * Check if we are waiting to do a renegotiation and if so whether now is a * good time to do it. If |initok| is true then we are being called from inside * the state machine so ignore the result of SSL_in_init(s). Otherwise we * should not do a renegotiation if SSL_in_init(s) is true. Returns 1 if we * should do a renegotiation now and sets up the state machine for it. Otherwise * returns 0. */ int ssl3_renegotiate_check(SSL *s, int initok) { int ret = 0; if (s->s3->renegotiate) { if (!RECORD_LAYER_read_pending(&s->rlayer) && !RECORD_LAYER_write_pending(&s->rlayer) && (initok || !SSL_in_init(s))) { /* * if we are the server, and we have sent a 'RENEGOTIATE' * message, we need to set the state machine into the renegotiate * state. */ ossl_statem_set_renegotiate(s); s->s3->renegotiate = 0; s->s3->num_renegotiations++; s->s3->total_renegotiations++; ret = 1; } } return ret; } /* * If we are using default SHA1+MD5 algorithms switch to new SHA256 PRF and * handshake macs if required. * * If PSK and using SHA384 for TLS < 1.2 switch to default. */ long ssl_get_algorithm2(SSL *s) { long alg2; if (s->s3 == NULL || s->s3->tmp.new_cipher == NULL) return -1; alg2 = s->s3->tmp.new_cipher->algorithm2; if (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_SHA256_PRF) { if (alg2 == (SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF)) return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256; } else if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK) { if (alg2 == (SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384)) return SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF; } return alg2; } /* * Fill a ClientRandom or ServerRandom field of length len. Returns <= 0 on * failure, 1 on success. */ int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, size_t len, DOWNGRADE dgrd) { int send_time = 0, ret; if (len < 4) return 0; if (server) send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0; else send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0; if (send_time) { unsigned long Time = (unsigned long)time(NULL); unsigned char *p = result; l2n(Time, p); ret = RAND_bytes(p, len - 4); } else { ret = RAND_bytes(result, len); } if (ret > 0) { if (!ossl_assert(sizeof(tls11downgrade) < len) || !ossl_assert(sizeof(tls12downgrade) < len)) return 0; if (dgrd == DOWNGRADE_TO_1_2) memcpy(result + len - sizeof(tls12downgrade), tls12downgrade, sizeof(tls12downgrade)); else if (dgrd == DOWNGRADE_TO_1_1) memcpy(result + len - sizeof(tls11downgrade), tls11downgrade, sizeof(tls11downgrade)); } return ret; } int ssl_generate_master_secret(SSL *s, unsigned char *pms, size_t pmslen, int free_pms) { unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; int ret = 0; if (alg_k & SSL_PSK) { #ifndef OPENSSL_NO_PSK unsigned char *pskpms, *t; size_t psklen = s->s3->tmp.psklen; size_t pskpmslen; /* create PSK premaster_secret */ /* For plain PSK "other_secret" is psklen zeroes */ if (alg_k & SSL_kPSK) pmslen = psklen; pskpmslen = 4 + pmslen + psklen; pskpms = OPENSSL_malloc(pskpmslen); if (pskpms == NULL) goto err; t = pskpms; s2n(pmslen, t); if (alg_k & SSL_kPSK) memset(t, 0, pmslen); else memcpy(t, pms, pmslen); t += pmslen; s2n(psklen, t); memcpy(t, s->s3->tmp.psk, psklen); OPENSSL_clear_free(s->s3->tmp.psk, psklen); s->s3->tmp.psk = NULL; + s->s3->tmp.psklen = 0; if (!s->method->ssl3_enc->generate_master_secret(s, s->session->master_key, pskpms, pskpmslen, &s->session->master_key_length)) { OPENSSL_clear_free(pskpms, pskpmslen); /* SSLfatal() already called */ goto err; } OPENSSL_clear_free(pskpms, pskpmslen); #else /* Should never happen */ goto err; #endif } else { if (!s->method->ssl3_enc->generate_master_secret(s, s->session->master_key, pms, pmslen, &s->session->master_key_length)) { /* SSLfatal() already called */ goto err; } } ret = 1; err: if (pms) { if (free_pms) OPENSSL_clear_free(pms, pmslen); else OPENSSL_cleanse(pms, pmslen); } - if (s->server == 0) + if (s->server == 0) { s->s3->tmp.pms = NULL; + s->s3->tmp.pmslen = 0; + } return ret; } /* Generate a private key from parameters */ EVP_PKEY *ssl_generate_pkey(EVP_PKEY *pm) { EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *pkey = NULL; if (pm == NULL) return NULL; pctx = EVP_PKEY_CTX_new(pm, NULL); if (pctx == NULL) goto err; if (EVP_PKEY_keygen_init(pctx) <= 0) goto err; if (EVP_PKEY_keygen(pctx, &pkey) <= 0) { EVP_PKEY_free(pkey); pkey = NULL; } err: EVP_PKEY_CTX_free(pctx); return pkey; } #ifndef OPENSSL_NO_EC /* Generate a private key from a group ID */ EVP_PKEY *ssl_generate_pkey_group(SSL *s, uint16_t id) { EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *pkey = NULL; const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(id); uint16_t gtype; if (ginf == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP, ERR_R_INTERNAL_ERROR); goto err; } gtype = ginf->flags & TLS_CURVE_TYPE; if (gtype == TLS_CURVE_CUSTOM) pctx = EVP_PKEY_CTX_new_id(ginf->nid, NULL); else pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); if (pctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP, ERR_R_MALLOC_FAILURE); goto err; } if (EVP_PKEY_keygen_init(pctx) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP, ERR_R_EVP_LIB); goto err; } if (gtype != TLS_CURVE_CUSTOM && EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, ginf->nid) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP, ERR_R_EVP_LIB); goto err; } if (EVP_PKEY_keygen(pctx, &pkey) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_GENERATE_PKEY_GROUP, ERR_R_EVP_LIB); EVP_PKEY_free(pkey); pkey = NULL; } err: EVP_PKEY_CTX_free(pctx); return pkey; } /* * Generate parameters from a group ID */ EVP_PKEY *ssl_generate_param_group(uint16_t id) { EVP_PKEY_CTX *pctx = NULL; EVP_PKEY *pkey = NULL; const TLS_GROUP_INFO *ginf = tls1_group_id_lookup(id); if (ginf == NULL) goto err; if ((ginf->flags & TLS_CURVE_TYPE) == TLS_CURVE_CUSTOM) { pkey = EVP_PKEY_new(); if (pkey != NULL && EVP_PKEY_set_type(pkey, ginf->nid)) return pkey; EVP_PKEY_free(pkey); return NULL; } pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); if (pctx == NULL) goto err; if (EVP_PKEY_paramgen_init(pctx) <= 0) goto err; if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, ginf->nid) <= 0) goto err; if (EVP_PKEY_paramgen(pctx, &pkey) <= 0) { EVP_PKEY_free(pkey); pkey = NULL; } err: EVP_PKEY_CTX_free(pctx); return pkey; } #endif /* Derive secrets for ECDH/DH */ int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey, int gensecret) { int rv = 0; unsigned char *pms = NULL; size_t pmslen = 0; EVP_PKEY_CTX *pctx; if (privkey == NULL || pubkey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE, ERR_R_INTERNAL_ERROR); return 0; } pctx = EVP_PKEY_CTX_new(privkey, NULL); if (EVP_PKEY_derive_init(pctx) <= 0 || EVP_PKEY_derive_set_peer(pctx, pubkey) <= 0 || EVP_PKEY_derive(pctx, NULL, &pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE, ERR_R_INTERNAL_ERROR); goto err; } pms = OPENSSL_malloc(pmslen); if (pms == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE, ERR_R_MALLOC_FAILURE); goto err; } if (EVP_PKEY_derive(pctx, pms, &pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_DERIVE, ERR_R_INTERNAL_ERROR); goto err; } if (gensecret) { /* SSLfatal() called as appropriate in the below functions */ if (SSL_IS_TLS13(s)) { /* * If we are resuming then we already generated the early secret * when we created the ClientHello, so don't recreate it. */ if (!s->hit) rv = tls13_generate_secret(s, ssl_handshake_md(s), NULL, NULL, 0, (unsigned char *)&s->early_secret); else rv = 1; rv = rv && tls13_generate_handshake_secret(s, pms, pmslen); } else { rv = ssl_generate_master_secret(s, pms, pmslen, 0); } } else { /* Save premaster secret */ s->s3->tmp.pms = pms; s->s3->tmp.pmslen = pmslen; pms = NULL; rv = 1; } err: OPENSSL_clear_free(pms, pmslen); EVP_PKEY_CTX_free(pctx); return rv; } #ifndef OPENSSL_NO_DH EVP_PKEY *ssl_dh_to_pkey(DH *dh) { EVP_PKEY *ret; if (dh == NULL) return NULL; ret = EVP_PKEY_new(); if (EVP_PKEY_set1_DH(ret, dh) <= 0) { EVP_PKEY_free(ret); return NULL; } return ret; } #endif diff --git a/crypto/openssl/ssl/ssl_lib.c b/crypto/openssl/ssl/ssl_lib.c index b1df374817c7..05f8d4dda6ce 100644 --- a/crypto/openssl/ssl/ssl_lib.c +++ b/crypto/openssl/ssl/ssl_lib.c @@ -1,5638 +1,5646 @@ /* * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include "ssl_local.h" #include #include #include #include #include #include #include #include #include #include "internal/cryptlib.h" #include "internal/refcount.h" const char SSL_version_str[] = OPENSSL_VERSION_TEXT; static int ssl_undefined_function_1(SSL *ssl, SSL3_RECORD *r, size_t s, int t) { (void)r; (void)s; (void)t; return ssl_undefined_function(ssl); } static int ssl_undefined_function_2(SSL *ssl, SSL3_RECORD *r, unsigned char *s, int t) { (void)r; (void)s; (void)t; return ssl_undefined_function(ssl); } static int ssl_undefined_function_3(SSL *ssl, unsigned char *r, unsigned char *s, size_t t, size_t *u) { (void)r; (void)s; (void)t; (void)u; return ssl_undefined_function(ssl); } static int ssl_undefined_function_4(SSL *ssl, int r) { (void)r; return ssl_undefined_function(ssl); } static size_t ssl_undefined_function_5(SSL *ssl, const char *r, size_t s, unsigned char *t) { (void)r; (void)s; (void)t; return ssl_undefined_function(ssl); } static int ssl_undefined_function_6(int r) { (void)r; return ssl_undefined_function(NULL); } static int ssl_undefined_function_7(SSL *ssl, unsigned char *r, size_t s, const char *t, size_t u, const unsigned char *v, size_t w, int x) { (void)r; (void)s; (void)t; (void)u; (void)v; (void)w; (void)x; return ssl_undefined_function(ssl); } SSL3_ENC_METHOD ssl3_undef_enc_method = { ssl_undefined_function_1, ssl_undefined_function_2, ssl_undefined_function, ssl_undefined_function_3, ssl_undefined_function_4, ssl_undefined_function_5, NULL, /* client_finished_label */ 0, /* client_finished_label_len */ NULL, /* server_finished_label */ 0, /* server_finished_label_len */ ssl_undefined_function_6, ssl_undefined_function_7, }; struct ssl_async_args { SSL *s; void *buf; size_t num; enum { READFUNC, WRITEFUNC, OTHERFUNC } type; union { int (*func_read) (SSL *, void *, size_t, size_t *); int (*func_write) (SSL *, const void *, size_t, size_t *); int (*func_other) (SSL *); } f; }; static const struct { uint8_t mtype; uint8_t ord; int nid; } dane_mds[] = { { DANETLS_MATCHING_FULL, 0, NID_undef }, { DANETLS_MATCHING_2256, 1, NID_sha256 }, { DANETLS_MATCHING_2512, 2, NID_sha512 }, }; static int dane_ctx_enable(struct dane_ctx_st *dctx) { const EVP_MD **mdevp; uint8_t *mdord; uint8_t mdmax = DANETLS_MATCHING_LAST; int n = ((int)mdmax) + 1; /* int to handle PrivMatch(255) */ size_t i; if (dctx->mdevp != NULL) return 1; mdevp = OPENSSL_zalloc(n * sizeof(*mdevp)); mdord = OPENSSL_zalloc(n * sizeof(*mdord)); if (mdord == NULL || mdevp == NULL) { OPENSSL_free(mdord); OPENSSL_free(mdevp); SSLerr(SSL_F_DANE_CTX_ENABLE, ERR_R_MALLOC_FAILURE); return 0; } /* Install default entries */ for (i = 0; i < OSSL_NELEM(dane_mds); ++i) { const EVP_MD *md; if (dane_mds[i].nid == NID_undef || (md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL) continue; mdevp[dane_mds[i].mtype] = md; mdord[dane_mds[i].mtype] = dane_mds[i].ord; } dctx->mdevp = mdevp; dctx->mdord = mdord; dctx->mdmax = mdmax; return 1; } static void dane_ctx_final(struct dane_ctx_st *dctx) { OPENSSL_free(dctx->mdevp); dctx->mdevp = NULL; OPENSSL_free(dctx->mdord); dctx->mdord = NULL; dctx->mdmax = 0; } static void tlsa_free(danetls_record *t) { if (t == NULL) return; OPENSSL_free(t->data); EVP_PKEY_free(t->spki); OPENSSL_free(t); } static void dane_final(SSL_DANE *dane) { sk_danetls_record_pop_free(dane->trecs, tlsa_free); dane->trecs = NULL; sk_X509_pop_free(dane->certs, X509_free); dane->certs = NULL; X509_free(dane->mcert); dane->mcert = NULL; dane->mtlsa = NULL; dane->mdpth = -1; dane->pdpth = -1; } /* * dane_copy - Copy dane configuration, sans verification state. */ static int ssl_dane_dup(SSL *to, SSL *from) { int num; int i; if (!DANETLS_ENABLED(&from->dane)) return 1; num = sk_danetls_record_num(from->dane.trecs); dane_final(&to->dane); to->dane.flags = from->dane.flags; to->dane.dctx = &to->ctx->dane; to->dane.trecs = sk_danetls_record_new_reserve(NULL, num); if (to->dane.trecs == NULL) { SSLerr(SSL_F_SSL_DANE_DUP, ERR_R_MALLOC_FAILURE); return 0; } for (i = 0; i < num; ++i) { danetls_record *t = sk_danetls_record_value(from->dane.trecs, i); if (SSL_dane_tlsa_add(to, t->usage, t->selector, t->mtype, t->data, t->dlen) <= 0) return 0; } return 1; } static int dane_mtype_set(struct dane_ctx_st *dctx, const EVP_MD *md, uint8_t mtype, uint8_t ord) { int i; if (mtype == DANETLS_MATCHING_FULL && md != NULL) { SSLerr(SSL_F_DANE_MTYPE_SET, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL); return 0; } if (mtype > dctx->mdmax) { const EVP_MD **mdevp; uint8_t *mdord; int n = ((int)mtype) + 1; mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp)); if (mdevp == NULL) { SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE); return -1; } dctx->mdevp = mdevp; mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord)); if (mdord == NULL) { SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE); return -1; } dctx->mdord = mdord; /* Zero-fill any gaps */ for (i = dctx->mdmax + 1; i < mtype; ++i) { mdevp[i] = NULL; mdord[i] = 0; } dctx->mdmax = mtype; } dctx->mdevp[mtype] = md; /* Coerce ordinal of disabled matching types to 0 */ dctx->mdord[mtype] = (md == NULL) ? 0 : ord; return 1; } static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype) { if (mtype > dane->dctx->mdmax) return NULL; return dane->dctx->mdevp[mtype]; } static int dane_tlsa_add(SSL_DANE *dane, uint8_t usage, uint8_t selector, uint8_t mtype, unsigned const char *data, size_t dlen) { danetls_record *t; const EVP_MD *md = NULL; int ilen = (int)dlen; int i; int num; if (dane->trecs == NULL) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_NOT_ENABLED); return -1; } if (ilen < 0 || dlen != (size_t)ilen) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DATA_LENGTH); return 0; } if (usage > DANETLS_USAGE_LAST) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE); return 0; } if (selector > DANETLS_SELECTOR_LAST) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_SELECTOR); return 0; } if (mtype != DANETLS_MATCHING_FULL) { md = tlsa_md_get(dane, mtype); if (md == NULL) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE); return 0; } } if (md != NULL && dlen != (size_t)EVP_MD_size(md)) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH); return 0; } if (!data) { SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_NULL_DATA); return 0; } if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) { SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE); return -1; } t->usage = usage; t->selector = selector; t->mtype = mtype; t->data = OPENSSL_malloc(dlen); if (t->data == NULL) { tlsa_free(t); SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE); return -1; } memcpy(t->data, data, dlen); t->dlen = dlen; /* Validate and cache full certificate or public key */ if (mtype == DANETLS_MATCHING_FULL) { const unsigned char *p = data; X509 *cert = NULL; EVP_PKEY *pkey = NULL; switch (selector) { case DANETLS_SELECTOR_CERT: if (!d2i_X509(&cert, &p, ilen) || p < data || dlen != (size_t)(p - data)) { tlsa_free(t); SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE); return 0; } if (X509_get0_pubkey(cert) == NULL) { tlsa_free(t); SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE); return 0; } if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) { X509_free(cert); break; } /* * For usage DANE-TA(2), we support authentication via "2 0 0" TLSA * records that contain full certificates of trust-anchors that are * not present in the wire chain. For usage PKIX-TA(0), we augment * the chain with untrusted Full(0) certificates from DNS, in case * they are missing from the chain. */ if ((dane->certs == NULL && (dane->certs = sk_X509_new_null()) == NULL) || !sk_X509_push(dane->certs, cert)) { SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE); X509_free(cert); tlsa_free(t); return -1; } break; case DANETLS_SELECTOR_SPKI: if (!d2i_PUBKEY(&pkey, &p, ilen) || p < data || dlen != (size_t)(p - data)) { tlsa_free(t); SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY); return 0; } /* * For usage DANE-TA(2), we support authentication via "2 1 0" TLSA * records that contain full bare keys of trust-anchors that are * not present in the wire chain. */ if (usage == DANETLS_USAGE_DANE_TA) t->spki = pkey; else EVP_PKEY_free(pkey); break; } } /*- * Find the right insertion point for the new record. * * See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that * they can be processed first, as they require no chain building, and no * expiration or hostname checks. Because DANE-EE(3) is numerically * largest, this is accomplished via descending sort by "usage". * * We also sort in descending order by matching ordinal to simplify * the implementation of digest agility in the verification code. * * The choice of order for the selector is not significant, so we * use the same descending order for consistency. */ num = sk_danetls_record_num(dane->trecs); for (i = 0; i < num; ++i) { danetls_record *rec = sk_danetls_record_value(dane->trecs, i); if (rec->usage > usage) continue; if (rec->usage < usage) break; if (rec->selector > selector) continue; if (rec->selector < selector) break; if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype]) continue; break; } if (!sk_danetls_record_insert(dane->trecs, t, i)) { tlsa_free(t); SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE); return -1; } dane->umask |= DANETLS_USAGE_BIT(usage); return 1; } /* * Return 0 if there is only one version configured and it was disabled * at configure time. Return 1 otherwise. */ static int ssl_check_allowed_versions(int min_version, int max_version) { int minisdtls = 0, maxisdtls = 0; /* Figure out if we're doing DTLS versions or TLS versions */ if (min_version == DTLS1_BAD_VER || min_version >> 8 == DTLS1_VERSION_MAJOR) minisdtls = 1; if (max_version == DTLS1_BAD_VER || max_version >> 8 == DTLS1_VERSION_MAJOR) maxisdtls = 1; /* A wildcard version of 0 could be DTLS or TLS. */ if ((minisdtls && !maxisdtls && max_version != 0) || (maxisdtls && !minisdtls && min_version != 0)) { /* Mixing DTLS and TLS versions will lead to sadness; deny it. */ return 0; } if (minisdtls || maxisdtls) { /* Do DTLS version checks. */ if (min_version == 0) /* Ignore DTLS1_BAD_VER */ min_version = DTLS1_VERSION; if (max_version == 0) max_version = DTLS1_2_VERSION; #ifdef OPENSSL_NO_DTLS1_2 if (max_version == DTLS1_2_VERSION) max_version = DTLS1_VERSION; #endif #ifdef OPENSSL_NO_DTLS1 if (min_version == DTLS1_VERSION) min_version = DTLS1_2_VERSION; #endif /* Done massaging versions; do the check. */ if (0 #ifdef OPENSSL_NO_DTLS1 || (DTLS_VERSION_GE(min_version, DTLS1_VERSION) && DTLS_VERSION_GE(DTLS1_VERSION, max_version)) #endif #ifdef OPENSSL_NO_DTLS1_2 || (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION) && DTLS_VERSION_GE(DTLS1_2_VERSION, max_version)) #endif ) return 0; } else { /* Regular TLS version checks. */ if (min_version == 0) min_version = SSL3_VERSION; if (max_version == 0) max_version = TLS1_3_VERSION; #ifdef OPENSSL_NO_TLS1_3 if (max_version == TLS1_3_VERSION) max_version = TLS1_2_VERSION; #endif #ifdef OPENSSL_NO_TLS1_2 if (max_version == TLS1_2_VERSION) max_version = TLS1_1_VERSION; #endif #ifdef OPENSSL_NO_TLS1_1 if (max_version == TLS1_1_VERSION) max_version = TLS1_VERSION; #endif #ifdef OPENSSL_NO_TLS1 if (max_version == TLS1_VERSION) max_version = SSL3_VERSION; #endif #ifdef OPENSSL_NO_SSL3 if (min_version == SSL3_VERSION) min_version = TLS1_VERSION; #endif #ifdef OPENSSL_NO_TLS1 if (min_version == TLS1_VERSION) min_version = TLS1_1_VERSION; #endif #ifdef OPENSSL_NO_TLS1_1 if (min_version == TLS1_1_VERSION) min_version = TLS1_2_VERSION; #endif #ifdef OPENSSL_NO_TLS1_2 if (min_version == TLS1_2_VERSION) min_version = TLS1_3_VERSION; #endif /* Done massaging versions; do the check. */ if (0 #ifdef OPENSSL_NO_SSL3 || (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version) #endif #ifdef OPENSSL_NO_TLS1 || (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version) #endif #ifdef OPENSSL_NO_TLS1_1 || (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version) #endif #ifdef OPENSSL_NO_TLS1_2 || (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version) #endif #ifdef OPENSSL_NO_TLS1_3 || (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version) #endif ) return 0; } return 1; } static void clear_ciphers(SSL *s) { /* clear the current cipher */ ssl_clear_cipher_ctx(s); ssl_clear_hash_ctx(&s->read_hash); ssl_clear_hash_ctx(&s->write_hash); } int SSL_clear(SSL *s) { if (s->method == NULL) { SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED); return 0; } if (ssl_clear_bad_session(s)) { SSL_SESSION_free(s->session); s->session = NULL; } SSL_SESSION_free(s->psksession); s->psksession = NULL; OPENSSL_free(s->psksession_id); s->psksession_id = NULL; s->psksession_id_len = 0; s->hello_retry_request = 0; s->sent_tickets = 0; s->error = 0; s->hit = 0; s->shutdown = 0; if (s->renegotiate) { SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR); return 0; } ossl_statem_clear(s); s->version = s->method->version; s->client_version = s->version; s->rwstate = SSL_NOTHING; BUF_MEM_free(s->init_buf); s->init_buf = NULL; clear_ciphers(s); s->first_packet = 0; s->key_update = SSL_KEY_UPDATE_NONE; EVP_MD_CTX_free(s->pha_dgst); s->pha_dgst = NULL; /* Reset DANE verification result state */ s->dane.mdpth = -1; s->dane.pdpth = -1; X509_free(s->dane.mcert); s->dane.mcert = NULL; s->dane.mtlsa = NULL; /* Clear the verification result peername */ X509_VERIFY_PARAM_move_peername(s->param, NULL); /* Clear any shared connection state */ OPENSSL_free(s->shared_sigalgs); s->shared_sigalgs = NULL; s->shared_sigalgslen = 0; /* * Check to see if we were changed into a different method, if so, revert * back. */ if (s->method != s->ctx->method) { s->method->ssl_free(s); s->method = s->ctx->method; if (!s->method->ssl_new(s)) return 0; } else { if (!s->method->ssl_clear(s)) return 0; } RECORD_LAYER_clear(&s->rlayer); return 1; } /** Used to change an SSL_CTXs default SSL method type */ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) { STACK_OF(SSL_CIPHER) *sk; ctx->method = meth; if (!SSL_CTX_set_ciphersuites(ctx, TLS_DEFAULT_CIPHERSUITES)) { SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); return 0; } sk = ssl_create_cipher_list(ctx->method, ctx->tls13_ciphersuites, &(ctx->cipher_list), &(ctx->cipher_list_by_id), SSL_DEFAULT_CIPHER_LIST, ctx->cert); if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) { SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); return 0; } return 1; } SSL *SSL_new(SSL_CTX *ctx) { SSL *s; if (ctx == NULL) { SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX); return NULL; } if (ctx->method == NULL) { SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); return NULL; } s = OPENSSL_zalloc(sizeof(*s)); if (s == NULL) goto err; s->references = 1; s->lock = CRYPTO_THREAD_lock_new(); if (s->lock == NULL) { OPENSSL_free(s); s = NULL; goto err; } RECORD_LAYER_init(&s->rlayer, s); s->options = ctx->options; s->dane.flags = ctx->dane.flags; s->min_proto_version = ctx->min_proto_version; s->max_proto_version = ctx->max_proto_version; s->mode = ctx->mode; s->max_cert_list = ctx->max_cert_list; s->max_early_data = ctx->max_early_data; s->recv_max_early_data = ctx->recv_max_early_data; s->num_tickets = ctx->num_tickets; s->pha_enabled = ctx->pha_enabled; /* Shallow copy of the ciphersuites stack */ s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites); if (s->tls13_ciphersuites == NULL) goto err; /* * Earlier library versions used to copy the pointer to the CERT, not * its contents; only when setting new parameters for the per-SSL * copy, ssl_cert_new would be called (and the direct reference to * the per-SSL_CTX settings would be lost, but those still were * indirectly accessed for various purposes, and for that reason they * used to be known as s->ctx->default_cert). Now we don't look at the * SSL_CTX's CERT after having duplicated it once. */ s->cert = ssl_cert_dup(ctx->cert); if (s->cert == NULL) goto err; RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead); s->msg_callback = ctx->msg_callback; s->msg_callback_arg = ctx->msg_callback_arg; s->verify_mode = ctx->verify_mode; s->not_resumable_session_cb = ctx->not_resumable_session_cb; s->record_padding_cb = ctx->record_padding_cb; s->record_padding_arg = ctx->record_padding_arg; s->block_padding = ctx->block_padding; s->sid_ctx_length = ctx->sid_ctx_length; if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx))) goto err; memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx)); s->verify_callback = ctx->default_verify_callback; s->generate_session_id = ctx->generate_session_id; s->param = X509_VERIFY_PARAM_new(); if (s->param == NULL) goto err; X509_VERIFY_PARAM_inherit(s->param, ctx->param); s->quiet_shutdown = ctx->quiet_shutdown; s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode; s->max_send_fragment = ctx->max_send_fragment; s->split_send_fragment = ctx->split_send_fragment; s->max_pipelines = ctx->max_pipelines; if (s->max_pipelines > 1) RECORD_LAYER_set_read_ahead(&s->rlayer, 1); if (ctx->default_read_buf_len > 0) SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len); SSL_CTX_up_ref(ctx); s->ctx = ctx; s->ext.debug_cb = 0; s->ext.debug_arg = NULL; s->ext.ticket_expected = 0; s->ext.status_type = ctx->ext.status_type; s->ext.status_expected = 0; s->ext.ocsp.ids = NULL; s->ext.ocsp.exts = NULL; s->ext.ocsp.resp = NULL; s->ext.ocsp.resp_len = 0; SSL_CTX_up_ref(ctx); s->session_ctx = ctx; #ifndef OPENSSL_NO_EC if (ctx->ext.ecpointformats) { s->ext.ecpointformats = OPENSSL_memdup(ctx->ext.ecpointformats, ctx->ext.ecpointformats_len); - if (!s->ext.ecpointformats) + if (!s->ext.ecpointformats) { + s->ext.ecpointformats_len = 0; goto err; + } s->ext.ecpointformats_len = ctx->ext.ecpointformats_len; } if (ctx->ext.supportedgroups) { s->ext.supportedgroups = OPENSSL_memdup(ctx->ext.supportedgroups, ctx->ext.supportedgroups_len * sizeof(*ctx->ext.supportedgroups)); - if (!s->ext.supportedgroups) + if (!s->ext.supportedgroups) { + s->ext.supportedgroups_len = 0; goto err; + } s->ext.supportedgroups_len = ctx->ext.supportedgroups_len; } #endif #ifndef OPENSSL_NO_NEXTPROTONEG s->ext.npn = NULL; #endif if (s->ctx->ext.alpn) { s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len); - if (s->ext.alpn == NULL) + if (s->ext.alpn == NULL) { + s->ext.alpn_len = 0; goto err; + } memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len); s->ext.alpn_len = s->ctx->ext.alpn_len; } s->verified_chain = NULL; s->verify_result = X509_V_OK; s->default_passwd_callback = ctx->default_passwd_callback; s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata; s->method = ctx->method; s->key_update = SSL_KEY_UPDATE_NONE; s->allow_early_data_cb = ctx->allow_early_data_cb; s->allow_early_data_cb_data = ctx->allow_early_data_cb_data; if (!s->method->ssl_new(s)) goto err; s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1; if (!SSL_clear(s)) goto err; if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data)) goto err; #ifndef OPENSSL_NO_PSK s->psk_client_callback = ctx->psk_client_callback; s->psk_server_callback = ctx->psk_server_callback; #endif s->psk_find_session_cb = ctx->psk_find_session_cb; s->psk_use_session_cb = ctx->psk_use_session_cb; s->job = NULL; #ifndef OPENSSL_NO_CT if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback, ctx->ct_validation_callback_arg)) goto err; #endif return s; err: SSL_free(s); SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE); return NULL; } int SSL_is_dtls(const SSL *s) { return SSL_IS_DTLS(s) ? 1 : 0; } int SSL_up_ref(SSL *s) { int i; if (CRYPTO_UP_REF(&s->references, &i, s->lock) <= 0) return 0; REF_PRINT_COUNT("SSL", s); REF_ASSERT_ISNT(i < 2); return ((i > 1) ? 1 : 0); } int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx, unsigned int sid_ctx_len) { if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); return 0; } ctx->sid_ctx_length = sid_ctx_len; memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len); return 1; } int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx, unsigned int sid_ctx_len) { if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); return 0; } ssl->sid_ctx_length = sid_ctx_len; memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len); return 1; } int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb) { CRYPTO_THREAD_write_lock(ctx->lock); ctx->generate_session_id = cb; CRYPTO_THREAD_unlock(ctx->lock); return 1; } int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb) { CRYPTO_THREAD_write_lock(ssl->lock); ssl->generate_session_id = cb; CRYPTO_THREAD_unlock(ssl->lock); return 1; } int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, unsigned int id_len) { /* * A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how * we can "construct" a session to give us the desired check - i.e. to * find if there's a session in the hash table that would conflict with * any new session built out of this id/id_len and the ssl_version in use * by this SSL. */ SSL_SESSION r, *p; if (id_len > sizeof(r.session_id)) return 0; r.ssl_version = ssl->version; r.session_id_length = id_len; memcpy(r.session_id, id, id_len); CRYPTO_THREAD_read_lock(ssl->session_ctx->lock); p = lh_SSL_SESSION_retrieve(ssl->session_ctx->sessions, &r); CRYPTO_THREAD_unlock(ssl->session_ctx->lock); return (p != NULL); } int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) { return X509_VERIFY_PARAM_set_purpose(s->param, purpose); } int SSL_set_purpose(SSL *s, int purpose) { return X509_VERIFY_PARAM_set_purpose(s->param, purpose); } int SSL_CTX_set_trust(SSL_CTX *s, int trust) { return X509_VERIFY_PARAM_set_trust(s->param, trust); } int SSL_set_trust(SSL *s, int trust) { return X509_VERIFY_PARAM_set_trust(s->param, trust); } int SSL_set1_host(SSL *s, const char *hostname) { return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0); } int SSL_add1_host(SSL *s, const char *hostname) { return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0); } void SSL_set_hostflags(SSL *s, unsigned int flags) { X509_VERIFY_PARAM_set_hostflags(s->param, flags); } const char *SSL_get0_peername(SSL *s) { return X509_VERIFY_PARAM_get0_peername(s->param); } int SSL_CTX_dane_enable(SSL_CTX *ctx) { return dane_ctx_enable(&ctx->dane); } unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags) { unsigned long orig = ctx->dane.flags; ctx->dane.flags |= flags; return orig; } unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags) { unsigned long orig = ctx->dane.flags; ctx->dane.flags &= ~flags; return orig; } int SSL_dane_enable(SSL *s, const char *basedomain) { SSL_DANE *dane = &s->dane; if (s->ctx->dane.mdmax == 0) { SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_CONTEXT_NOT_DANE_ENABLED); return 0; } if (dane->trecs != NULL) { SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_DANE_ALREADY_ENABLED); return 0; } /* * Default SNI name. This rejects empty names, while set1_host below * accepts them and disables host name checks. To avoid side-effects with * invalid input, set the SNI name first. */ if (s->ext.hostname == NULL) { if (!SSL_set_tlsext_host_name(s, basedomain)) { SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); return -1; } } /* Primary RFC6125 reference identifier */ if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, 0)) { SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); return -1; } dane->mdpth = -1; dane->pdpth = -1; dane->dctx = &s->ctx->dane; dane->trecs = sk_danetls_record_new_null(); if (dane->trecs == NULL) { SSLerr(SSL_F_SSL_DANE_ENABLE, ERR_R_MALLOC_FAILURE); return -1; } return 1; } unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags) { unsigned long orig = ssl->dane.flags; ssl->dane.flags |= flags; return orig; } unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags) { unsigned long orig = ssl->dane.flags; ssl->dane.flags &= ~flags; return orig; } int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki) { SSL_DANE *dane = &s->dane; if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK) return -1; if (dane->mtlsa) { if (mcert) *mcert = dane->mcert; if (mspki) *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL; } return dane->mdpth; } int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector, uint8_t *mtype, unsigned const char **data, size_t *dlen) { SSL_DANE *dane = &s->dane; if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK) return -1; if (dane->mtlsa) { if (usage) *usage = dane->mtlsa->usage; if (selector) *selector = dane->mtlsa->selector; if (mtype) *mtype = dane->mtlsa->mtype; if (data) *data = dane->mtlsa->data; if (dlen) *dlen = dane->mtlsa->dlen; } return dane->mdpth; } SSL_DANE *SSL_get0_dane(SSL *s) { return &s->dane; } int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector, uint8_t mtype, unsigned const char *data, size_t dlen) { return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen); } int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, uint8_t mtype, uint8_t ord) { return dane_mtype_set(&ctx->dane, md, mtype, ord); } int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) { return X509_VERIFY_PARAM_set1(ctx->param, vpm); } int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) { return X509_VERIFY_PARAM_set1(ssl->param, vpm); } X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx) { return ctx->param; } X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl) { return ssl->param; } void SSL_certs_clear(SSL *s) { ssl_cert_clear_certs(s->cert); } void SSL_free(SSL *s) { int i; if (s == NULL) return; CRYPTO_DOWN_REF(&s->references, &i, s->lock); REF_PRINT_COUNT("SSL", s); if (i > 0) return; REF_ASSERT_ISNT(i < 0); X509_VERIFY_PARAM_free(s->param); dane_final(&s->dane); CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); /* Ignore return value */ ssl_free_wbio_buffer(s); BIO_free_all(s->wbio); BIO_free_all(s->rbio); BUF_MEM_free(s->init_buf); /* add extra stuff */ sk_SSL_CIPHER_free(s->cipher_list); sk_SSL_CIPHER_free(s->cipher_list_by_id); sk_SSL_CIPHER_free(s->tls13_ciphersuites); sk_SSL_CIPHER_free(s->peer_ciphers); /* Make the next call work :-) */ if (s->session != NULL) { ssl_clear_bad_session(s); SSL_SESSION_free(s->session); } SSL_SESSION_free(s->psksession); OPENSSL_free(s->psksession_id); clear_ciphers(s); ssl_cert_free(s->cert); OPENSSL_free(s->shared_sigalgs); /* Free up if allocated */ OPENSSL_free(s->ext.hostname); SSL_CTX_free(s->session_ctx); #ifndef OPENSSL_NO_EC OPENSSL_free(s->ext.ecpointformats); OPENSSL_free(s->ext.peer_ecpointformats); OPENSSL_free(s->ext.supportedgroups); OPENSSL_free(s->ext.peer_supportedgroups); #endif /* OPENSSL_NO_EC */ sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free); #ifndef OPENSSL_NO_OCSP sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free); #endif #ifndef OPENSSL_NO_CT SCT_LIST_free(s->scts); OPENSSL_free(s->ext.scts); #endif OPENSSL_free(s->ext.ocsp.resp); OPENSSL_free(s->ext.alpn); OPENSSL_free(s->ext.tls13_cookie); if (s->clienthello != NULL) OPENSSL_free(s->clienthello->pre_proc_exts); OPENSSL_free(s->clienthello); OPENSSL_free(s->pha_context); EVP_MD_CTX_free(s->pha_dgst); sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free); sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free); sk_X509_pop_free(s->verified_chain, X509_free); if (s->method != NULL) s->method->ssl_free(s); RECORD_LAYER_release(&s->rlayer); SSL_CTX_free(s->ctx); ASYNC_WAIT_CTX_free(s->waitctx); #if !defined(OPENSSL_NO_NEXTPROTONEG) OPENSSL_free(s->ext.npn); #endif #ifndef OPENSSL_NO_SRTP sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles); #endif CRYPTO_THREAD_lock_free(s->lock); OPENSSL_free(s); } void SSL_set0_rbio(SSL *s, BIO *rbio) { BIO_free_all(s->rbio); s->rbio = rbio; } void SSL_set0_wbio(SSL *s, BIO *wbio) { /* * If the output buffering BIO is still in place, remove it */ if (s->bbio != NULL) s->wbio = BIO_pop(s->wbio); BIO_free_all(s->wbio); s->wbio = wbio; /* Re-attach |bbio| to the new |wbio|. */ if (s->bbio != NULL) s->wbio = BIO_push(s->bbio, s->wbio); } void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio) { /* * For historical reasons, this function has many different cases in * ownership handling. */ /* If nothing has changed, do nothing */ if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s)) return; /* * If the two arguments are equal then one fewer reference is granted by the * caller than we want to take */ if (rbio != NULL && rbio == wbio) BIO_up_ref(rbio); /* * If only the wbio is changed only adopt one reference. */ if (rbio == SSL_get_rbio(s)) { SSL_set0_wbio(s, wbio); return; } /* * There is an asymmetry here for historical reasons. If only the rbio is * changed AND the rbio and wbio were originally different, then we only * adopt one reference. */ if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) { SSL_set0_rbio(s, rbio); return; } /* Otherwise, adopt both references. */ SSL_set0_rbio(s, rbio); SSL_set0_wbio(s, wbio); } BIO *SSL_get_rbio(const SSL *s) { return s->rbio; } BIO *SSL_get_wbio(const SSL *s) { if (s->bbio != NULL) { /* * If |bbio| is active, the true caller-configured BIO is its * |next_bio|. */ return BIO_next(s->bbio); } return s->wbio; } int SSL_get_fd(const SSL *s) { return SSL_get_rfd(s); } int SSL_get_rfd(const SSL *s) { int ret = -1; BIO *b, *r; b = SSL_get_rbio(s); r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR); if (r != NULL) BIO_get_fd(r, &ret); return ret; } int SSL_get_wfd(const SSL *s) { int ret = -1; BIO *b, *r; b = SSL_get_wbio(s); r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR); if (r != NULL) BIO_get_fd(r, &ret); return ret; } #ifndef OPENSSL_NO_SOCK int SSL_set_fd(SSL *s, int fd) { int ret = 0; BIO *bio = NULL; bio = BIO_new(BIO_s_socket()); if (bio == NULL) { SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB); goto err; } BIO_set_fd(bio, fd, BIO_NOCLOSE); SSL_set_bio(s, bio, bio); ret = 1; err: return ret; } int SSL_set_wfd(SSL *s, int fd) { BIO *rbio = SSL_get_rbio(s); if (rbio == NULL || BIO_method_type(rbio) != BIO_TYPE_SOCKET || (int)BIO_get_fd(rbio, NULL) != fd) { BIO *bio = BIO_new(BIO_s_socket()); if (bio == NULL) { SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB); return 0; } BIO_set_fd(bio, fd, BIO_NOCLOSE); SSL_set0_wbio(s, bio); } else { BIO_up_ref(rbio); SSL_set0_wbio(s, rbio); } return 1; } int SSL_set_rfd(SSL *s, int fd) { BIO *wbio = SSL_get_wbio(s); if (wbio == NULL || BIO_method_type(wbio) != BIO_TYPE_SOCKET || ((int)BIO_get_fd(wbio, NULL) != fd)) { BIO *bio = BIO_new(BIO_s_socket()); if (bio == NULL) { SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB); return 0; } BIO_set_fd(bio, fd, BIO_NOCLOSE); SSL_set0_rbio(s, bio); } else { BIO_up_ref(wbio); SSL_set0_rbio(s, wbio); } return 1; } #endif /* return length of latest Finished message we sent, copy to 'buf' */ size_t SSL_get_finished(const SSL *s, void *buf, size_t count) { size_t ret = 0; if (s->s3 != NULL) { ret = s->s3->tmp.finish_md_len; if (count > ret) count = ret; memcpy(buf, s->s3->tmp.finish_md, count); } return ret; } /* return length of latest Finished message we expected, copy to 'buf' */ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count) { size_t ret = 0; if (s->s3 != NULL) { ret = s->s3->tmp.peer_finish_md_len; if (count > ret) count = ret; memcpy(buf, s->s3->tmp.peer_finish_md, count); } return ret; } int SSL_get_verify_mode(const SSL *s) { return s->verify_mode; } int SSL_get_verify_depth(const SSL *s) { return X509_VERIFY_PARAM_get_depth(s->param); } int (*SSL_get_verify_callback(const SSL *s)) (int, X509_STORE_CTX *) { return s->verify_callback; } int SSL_CTX_get_verify_mode(const SSL_CTX *ctx) { return ctx->verify_mode; } int SSL_CTX_get_verify_depth(const SSL_CTX *ctx) { return X509_VERIFY_PARAM_get_depth(ctx->param); } int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx)) (int, X509_STORE_CTX *) { return ctx->default_verify_callback; } void SSL_set_verify(SSL *s, int mode, int (*callback) (int ok, X509_STORE_CTX *ctx)) { s->verify_mode = mode; if (callback != NULL) s->verify_callback = callback; } void SSL_set_verify_depth(SSL *s, int depth) { X509_VERIFY_PARAM_set_depth(s->param, depth); } void SSL_set_read_ahead(SSL *s, int yes) { RECORD_LAYER_set_read_ahead(&s->rlayer, yes); } int SSL_get_read_ahead(const SSL *s) { return RECORD_LAYER_get_read_ahead(&s->rlayer); } int SSL_pending(const SSL *s) { size_t pending = s->method->ssl_pending(s); /* * SSL_pending cannot work properly if read-ahead is enabled * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is * impossible to fix since SSL_pending cannot report errors that may be * observed while scanning the new data. (Note that SSL_pending() is * often used as a boolean value, so we'd better not return -1.) * * SSL_pending also cannot work properly if the value >INT_MAX. In that case * we just return INT_MAX. */ return pending < INT_MAX ? (int)pending : INT_MAX; } int SSL_has_pending(const SSL *s) { /* * Similar to SSL_pending() but returns a 1 to indicate that we have * unprocessed data available or 0 otherwise (as opposed to the number of * bytes available). Unlike SSL_pending() this will take into account * read_ahead data. A 1 return simply indicates that we have unprocessed * data. That data may not result in any application data, or we may fail * to parse the records for some reason. */ if (RECORD_LAYER_processed_read_pending(&s->rlayer)) return 1; return RECORD_LAYER_read_pending(&s->rlayer); } X509 *SSL_get_peer_certificate(const SSL *s) { X509 *r; if ((s == NULL) || (s->session == NULL)) r = NULL; else r = s->session->peer; if (r == NULL) return r; X509_up_ref(r); return r; } STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s) { STACK_OF(X509) *r; if ((s == NULL) || (s->session == NULL)) r = NULL; else r = s->session->peer_chain; /* * If we are a client, cert_chain includes the peer's own certificate; if * we are a server, it does not. */ return r; } /* * Now in theory, since the calling process own 't' it should be safe to * modify. We need to be able to read f without being hassled */ int SSL_copy_session_id(SSL *t, const SSL *f) { int i; /* Do we need to to SSL locking? */ if (!SSL_set_session(t, SSL_get_session(f))) { return 0; } /* * what if we are setup for one protocol version but want to talk another */ if (t->method != f->method) { t->method->ssl_free(t); t->method = f->method; if (t->method->ssl_new(t) == 0) return 0; } CRYPTO_UP_REF(&f->cert->references, &i, f->cert->lock); ssl_cert_free(t->cert); t->cert = f->cert; if (!SSL_set_session_id_context(t, f->sid_ctx, (int)f->sid_ctx_length)) { return 0; } return 1; } /* Fix this so it checks all the valid key/cert options */ int SSL_CTX_check_private_key(const SSL_CTX *ctx) { if ((ctx == NULL) || (ctx->cert->key->x509 == NULL)) { SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED); return 0; } if (ctx->cert->key->privatekey == NULL) { SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED); return 0; } return X509_check_private_key (ctx->cert->key->x509, ctx->cert->key->privatekey); } /* Fix this function so that it takes an optional type parameter */ int SSL_check_private_key(const SSL *ssl) { if (ssl == NULL) { SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, ERR_R_PASSED_NULL_PARAMETER); return 0; } if (ssl->cert->key->x509 == NULL) { SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED); return 0; } if (ssl->cert->key->privatekey == NULL) { SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED); return 0; } return X509_check_private_key(ssl->cert->key->x509, ssl->cert->key->privatekey); } int SSL_waiting_for_async(SSL *s) { if (s->job) return 1; return 0; } int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds) { ASYNC_WAIT_CTX *ctx = s->waitctx; if (ctx == NULL) return 0; return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds); } int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds, OSSL_ASYNC_FD *delfd, size_t *numdelfds) { ASYNC_WAIT_CTX *ctx = s->waitctx; if (ctx == NULL) return 0; return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd, numdelfds); } int SSL_accept(SSL *s) { if (s->handshake_func == NULL) { /* Not properly initialized yet */ SSL_set_accept_state(s); } return SSL_do_handshake(s); } int SSL_connect(SSL *s) { if (s->handshake_func == NULL) { /* Not properly initialized yet */ SSL_set_connect_state(s); } return SSL_do_handshake(s); } long SSL_get_default_timeout(const SSL *s) { return s->method->get_timeout(); } static int ssl_start_async_job(SSL *s, struct ssl_async_args *args, int (*func) (void *)) { int ret; if (s->waitctx == NULL) { s->waitctx = ASYNC_WAIT_CTX_new(); if (s->waitctx == NULL) return -1; } switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args, sizeof(struct ssl_async_args))) { case ASYNC_ERR: s->rwstate = SSL_NOTHING; SSLerr(SSL_F_SSL_START_ASYNC_JOB, SSL_R_FAILED_TO_INIT_ASYNC); return -1; case ASYNC_PAUSE: s->rwstate = SSL_ASYNC_PAUSED; return -1; case ASYNC_NO_JOBS: s->rwstate = SSL_ASYNC_NO_JOBS; return -1; case ASYNC_FINISH: s->job = NULL; return ret; default: s->rwstate = SSL_NOTHING; SSLerr(SSL_F_SSL_START_ASYNC_JOB, ERR_R_INTERNAL_ERROR); /* Shouldn't happen */ return -1; } } static int ssl_io_intern(void *vargs) { struct ssl_async_args *args; SSL *s; void *buf; size_t num; args = (struct ssl_async_args *)vargs; s = args->s; buf = args->buf; num = args->num; switch (args->type) { case READFUNC: return args->f.func_read(s, buf, num, &s->asyncrw); case WRITEFUNC: return args->f.func_write(s, buf, num, &s->asyncrw); case OTHERFUNC: return args->f.func_other(s); } return -1; } int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes) { if (s->handshake_func == NULL) { SSLerr(SSL_F_SSL_READ_INTERNAL, SSL_R_UNINITIALIZED); return -1; } if (s->shutdown & SSL_RECEIVED_SHUTDOWN) { s->rwstate = SSL_NOTHING; return 0; } if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) { SSLerr(SSL_F_SSL_READ_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } /* * If we are a client and haven't received the ServerHello etc then we * better do that */ ossl_statem_check_finish_init(s, 0); if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { struct ssl_async_args args; int ret; args.s = s; args.buf = buf; args.num = num; args.type = READFUNC; args.f.func_read = s->method->ssl_read; ret = ssl_start_async_job(s, &args, ssl_io_intern); *readbytes = s->asyncrw; return ret; } else { return s->method->ssl_read(s, buf, num, readbytes); } } int SSL_read(SSL *s, void *buf, int num) { int ret; size_t readbytes; if (num < 0) { SSLerr(SSL_F_SSL_READ, SSL_R_BAD_LENGTH); return -1; } ret = ssl_read_internal(s, buf, (size_t)num, &readbytes); /* * The cast is safe here because ret should be <= INT_MAX because num is * <= INT_MAX */ if (ret > 0) ret = (int)readbytes; return ret; } int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes) { int ret = ssl_read_internal(s, buf, num, readbytes); if (ret < 0) ret = 0; return ret; } int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes) { int ret; if (!s->server) { SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return SSL_READ_EARLY_DATA_ERROR; } switch (s->early_data_state) { case SSL_EARLY_DATA_NONE: if (!SSL_in_before(s)) { SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return SSL_READ_EARLY_DATA_ERROR; } /* fall through */ case SSL_EARLY_DATA_ACCEPT_RETRY: s->early_data_state = SSL_EARLY_DATA_ACCEPTING; ret = SSL_accept(s); if (ret <= 0) { /* NBIO or error */ s->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY; return SSL_READ_EARLY_DATA_ERROR; } /* fall through */ case SSL_EARLY_DATA_READ_RETRY: if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { s->early_data_state = SSL_EARLY_DATA_READING; ret = SSL_read_ex(s, buf, num, readbytes); /* * State machine will update early_data_state to * SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData * message */ if (ret > 0 || (ret <= 0 && s->early_data_state != SSL_EARLY_DATA_FINISHED_READING)) { s->early_data_state = SSL_EARLY_DATA_READ_RETRY; return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS : SSL_READ_EARLY_DATA_ERROR; } } else { s->early_data_state = SSL_EARLY_DATA_FINISHED_READING; } *readbytes = 0; return SSL_READ_EARLY_DATA_FINISH; default: SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return SSL_READ_EARLY_DATA_ERROR; } } int SSL_get_early_data_status(const SSL *s) { return s->ext.early_data; } static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes) { if (s->handshake_func == NULL) { SSLerr(SSL_F_SSL_PEEK_INTERNAL, SSL_R_UNINITIALIZED); return -1; } if (s->shutdown & SSL_RECEIVED_SHUTDOWN) { return 0; } if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { struct ssl_async_args args; int ret; args.s = s; args.buf = buf; args.num = num; args.type = READFUNC; args.f.func_read = s->method->ssl_peek; ret = ssl_start_async_job(s, &args, ssl_io_intern); *readbytes = s->asyncrw; return ret; } else { return s->method->ssl_peek(s, buf, num, readbytes); } } int SSL_peek(SSL *s, void *buf, int num) { int ret; size_t readbytes; if (num < 0) { SSLerr(SSL_F_SSL_PEEK, SSL_R_BAD_LENGTH); return -1; } ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes); /* * The cast is safe here because ret should be <= INT_MAX because num is * <= INT_MAX */ if (ret > 0) ret = (int)readbytes; return ret; } int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes) { int ret = ssl_peek_internal(s, buf, num, readbytes); if (ret < 0) ret = 0; return ret; } int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written) { if (s->handshake_func == NULL) { SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_UNINITIALIZED); return -1; } if (s->shutdown & SSL_SENT_SHUTDOWN) { s->rwstate = SSL_NOTHING; SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_PROTOCOL_IS_SHUTDOWN); return -1; } if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY || s->early_data_state == SSL_EARLY_DATA_READ_RETRY) { SSLerr(SSL_F_SSL_WRITE_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } /* If we are a client and haven't sent the Finished we better do that */ ossl_statem_check_finish_init(s, 1); if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { int ret; struct ssl_async_args args; args.s = s; args.buf = (void *)buf; args.num = num; args.type = WRITEFUNC; args.f.func_write = s->method->ssl_write; ret = ssl_start_async_job(s, &args, ssl_io_intern); *written = s->asyncrw; return ret; } else { return s->method->ssl_write(s, buf, num, written); } } int SSL_write(SSL *s, const void *buf, int num) { int ret; size_t written; if (num < 0) { SSLerr(SSL_F_SSL_WRITE, SSL_R_BAD_LENGTH); return -1; } ret = ssl_write_internal(s, buf, (size_t)num, &written); /* * The cast is safe here because ret should be <= INT_MAX because num is * <= INT_MAX */ if (ret > 0) ret = (int)written; return ret; } int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written) { int ret = ssl_write_internal(s, buf, num, written); if (ret < 0) ret = 0; return ret; } int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written) { int ret, early_data_state; size_t writtmp; uint32_t partialwrite; switch (s->early_data_state) { case SSL_EARLY_DATA_NONE: if (s->server || !SSL_in_before(s) || ((s->session == NULL || s->session->ext.max_early_data == 0) && (s->psk_use_session_cb == NULL))) { SSLerr(SSL_F_SSL_WRITE_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } /* fall through */ case SSL_EARLY_DATA_CONNECT_RETRY: s->early_data_state = SSL_EARLY_DATA_CONNECTING; ret = SSL_connect(s); if (ret <= 0) { /* NBIO or error */ s->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY; return 0; } /* fall through */ case SSL_EARLY_DATA_WRITE_RETRY: s->early_data_state = SSL_EARLY_DATA_WRITING; /* * We disable partial write for early data because we don't keep track * of how many bytes we've written between the SSL_write_ex() call and * the flush if the flush needs to be retried) */ partialwrite = s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE; s->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE; ret = SSL_write_ex(s, buf, num, &writtmp); s->mode |= partialwrite; if (!ret) { s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY; return ret; } s->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH; /* fall through */ case SSL_EARLY_DATA_WRITE_FLUSH: /* The buffering BIO is still in place so we need to flush it */ if (statem_flush(s) != 1) return 0; *written = num; s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY; return 1; case SSL_EARLY_DATA_FINISHED_READING: case SSL_EARLY_DATA_READ_RETRY: early_data_state = s->early_data_state; /* We are a server writing to an unauthenticated client */ s->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING; ret = SSL_write_ex(s, buf, num, written); /* The buffering BIO is still in place */ if (ret) (void)BIO_flush(s->wbio); s->early_data_state = early_data_state; return ret; default: SSLerr(SSL_F_SSL_WRITE_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } } int SSL_shutdown(SSL *s) { /* * Note that this function behaves differently from what one might * expect. Return values are 0 for no success (yet), 1 for success; but * calling it once is usually not enough, even if blocking I/O is used * (see ssl3_shutdown). */ if (s->handshake_func == NULL) { SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED); return -1; } if (!SSL_in_init(s)) { if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { struct ssl_async_args args; args.s = s; args.type = OTHERFUNC; args.f.func_other = s->method->ssl_shutdown; return ssl_start_async_job(s, &args, ssl_io_intern); } else { return s->method->ssl_shutdown(s); } } else { SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_SHUTDOWN_WHILE_IN_INIT); return -1; } } int SSL_key_update(SSL *s, int updatetype) { /* * TODO(TLS1.3): How will applications know whether TLSv1.3 has been * negotiated, and that it is appropriate to call SSL_key_update() instead * of SSL_renegotiate(). */ if (!SSL_IS_TLS13(s)) { SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_WRONG_SSL_VERSION); return 0; } if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED && updatetype != SSL_KEY_UPDATE_REQUESTED) { SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_INVALID_KEY_UPDATE_TYPE); return 0; } if (!SSL_is_init_finished(s)) { SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_STILL_IN_INIT); return 0; } ossl_statem_set_in_init(s, 1); s->key_update = updatetype; return 1; } int SSL_get_key_update_type(const SSL *s) { return s->key_update; } int SSL_renegotiate(SSL *s) { if (SSL_IS_TLS13(s)) { SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_WRONG_SSL_VERSION); return 0; } if ((s->options & SSL_OP_NO_RENEGOTIATION)) { SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_NO_RENEGOTIATION); return 0; } s->renegotiate = 1; s->new_session = 1; return s->method->ssl_renegotiate(s); } int SSL_renegotiate_abbreviated(SSL *s) { if (SSL_IS_TLS13(s)) { SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_WRONG_SSL_VERSION); return 0; } if ((s->options & SSL_OP_NO_RENEGOTIATION)) { SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_NO_RENEGOTIATION); return 0; } s->renegotiate = 1; s->new_session = 0; return s->method->ssl_renegotiate(s); } int SSL_renegotiate_pending(const SSL *s) { /* * becomes true when negotiation is requested; false again once a * handshake has finished */ return (s->renegotiate != 0); } long SSL_ctrl(SSL *s, int cmd, long larg, void *parg) { long l; switch (cmd) { case SSL_CTRL_GET_READ_AHEAD: return RECORD_LAYER_get_read_ahead(&s->rlayer); case SSL_CTRL_SET_READ_AHEAD: l = RECORD_LAYER_get_read_ahead(&s->rlayer); RECORD_LAYER_set_read_ahead(&s->rlayer, larg); return l; case SSL_CTRL_SET_MSG_CALLBACK_ARG: s->msg_callback_arg = parg; return 1; case SSL_CTRL_MODE: return (s->mode |= larg); case SSL_CTRL_CLEAR_MODE: return (s->mode &= ~larg); case SSL_CTRL_GET_MAX_CERT_LIST: return (long)s->max_cert_list; case SSL_CTRL_SET_MAX_CERT_LIST: if (larg < 0) return 0; l = (long)s->max_cert_list; s->max_cert_list = (size_t)larg; return l; case SSL_CTRL_SET_MAX_SEND_FRAGMENT: if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) return 0; s->max_send_fragment = larg; if (s->max_send_fragment < s->split_send_fragment) s->split_send_fragment = s->max_send_fragment; return 1; case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT: if ((size_t)larg > s->max_send_fragment || larg == 0) return 0; s->split_send_fragment = larg; return 1; case SSL_CTRL_SET_MAX_PIPELINES: if (larg < 1 || larg > SSL_MAX_PIPELINES) return 0; s->max_pipelines = larg; if (larg > 1) RECORD_LAYER_set_read_ahead(&s->rlayer, 1); return 1; case SSL_CTRL_GET_RI_SUPPORT: if (s->s3) return s->s3->send_connection_binding; else return 0; case SSL_CTRL_CERT_FLAGS: return (s->cert->cert_flags |= larg); case SSL_CTRL_CLEAR_CERT_FLAGS: return (s->cert->cert_flags &= ~larg); case SSL_CTRL_GET_RAW_CIPHERLIST: if (parg) { if (s->s3->tmp.ciphers_raw == NULL) return 0; *(unsigned char **)parg = s->s3->tmp.ciphers_raw; return (int)s->s3->tmp.ciphers_rawlen; } else { return TLS_CIPHER_LEN; } case SSL_CTRL_GET_EXTMS_SUPPORT: if (!s->session || SSL_in_init(s) || ossl_statem_get_in_handshake(s)) return -1; if (s->session->flags & SSL_SESS_FLAG_EXTMS) return 1; else return 0; case SSL_CTRL_SET_MIN_PROTO_VERSION: return ssl_check_allowed_versions(larg, s->max_proto_version) && ssl_set_version_bound(s->ctx->method->version, (int)larg, &s->min_proto_version); case SSL_CTRL_GET_MIN_PROTO_VERSION: return s->min_proto_version; case SSL_CTRL_SET_MAX_PROTO_VERSION: return ssl_check_allowed_versions(s->min_proto_version, larg) && ssl_set_version_bound(s->ctx->method->version, (int)larg, &s->max_proto_version); case SSL_CTRL_GET_MAX_PROTO_VERSION: return s->max_proto_version; default: return s->method->ssl_ctrl(s, cmd, larg, parg); } } long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void)) { switch (cmd) { case SSL_CTRL_SET_MSG_CALLBACK: s->msg_callback = (void (*) (int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); return 1; default: return s->method->ssl_callback_ctrl(s, cmd, fp); } } LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx) { return ctx->sessions; } long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) { long l; /* For some cases with ctx == NULL perform syntax checks */ if (ctx == NULL) { switch (cmd) { #ifndef OPENSSL_NO_EC case SSL_CTRL_SET_GROUPS_LIST: return tls1_set_groups_list(NULL, NULL, parg); #endif case SSL_CTRL_SET_SIGALGS_LIST: case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: return tls1_set_sigalgs_list(NULL, parg, 0); default: return 0; } } switch (cmd) { case SSL_CTRL_GET_READ_AHEAD: return ctx->read_ahead; case SSL_CTRL_SET_READ_AHEAD: l = ctx->read_ahead; ctx->read_ahead = larg; return l; case SSL_CTRL_SET_MSG_CALLBACK_ARG: ctx->msg_callback_arg = parg; return 1; case SSL_CTRL_GET_MAX_CERT_LIST: return (long)ctx->max_cert_list; case SSL_CTRL_SET_MAX_CERT_LIST: if (larg < 0) return 0; l = (long)ctx->max_cert_list; ctx->max_cert_list = (size_t)larg; return l; case SSL_CTRL_SET_SESS_CACHE_SIZE: if (larg < 0) return 0; l = (long)ctx->session_cache_size; ctx->session_cache_size = (size_t)larg; return l; case SSL_CTRL_GET_SESS_CACHE_SIZE: return (long)ctx->session_cache_size; case SSL_CTRL_SET_SESS_CACHE_MODE: l = ctx->session_cache_mode; ctx->session_cache_mode = larg; return l; case SSL_CTRL_GET_SESS_CACHE_MODE: return ctx->session_cache_mode; case SSL_CTRL_SESS_NUMBER: return lh_SSL_SESSION_num_items(ctx->sessions); case SSL_CTRL_SESS_CONNECT: return tsan_load(&ctx->stats.sess_connect); case SSL_CTRL_SESS_CONNECT_GOOD: return tsan_load(&ctx->stats.sess_connect_good); case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: return tsan_load(&ctx->stats.sess_connect_renegotiate); case SSL_CTRL_SESS_ACCEPT: return tsan_load(&ctx->stats.sess_accept); case SSL_CTRL_SESS_ACCEPT_GOOD: return tsan_load(&ctx->stats.sess_accept_good); case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE: return tsan_load(&ctx->stats.sess_accept_renegotiate); case SSL_CTRL_SESS_HIT: return tsan_load(&ctx->stats.sess_hit); case SSL_CTRL_SESS_CB_HIT: return tsan_load(&ctx->stats.sess_cb_hit); case SSL_CTRL_SESS_MISSES: return tsan_load(&ctx->stats.sess_miss); case SSL_CTRL_SESS_TIMEOUTS: return tsan_load(&ctx->stats.sess_timeout); case SSL_CTRL_SESS_CACHE_FULL: return tsan_load(&ctx->stats.sess_cache_full); case SSL_CTRL_MODE: return (ctx->mode |= larg); case SSL_CTRL_CLEAR_MODE: return (ctx->mode &= ~larg); case SSL_CTRL_SET_MAX_SEND_FRAGMENT: if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) return 0; ctx->max_send_fragment = larg; if (ctx->max_send_fragment < ctx->split_send_fragment) ctx->split_send_fragment = ctx->max_send_fragment; return 1; case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT: if ((size_t)larg > ctx->max_send_fragment || larg == 0) return 0; ctx->split_send_fragment = larg; return 1; case SSL_CTRL_SET_MAX_PIPELINES: if (larg < 1 || larg > SSL_MAX_PIPELINES) return 0; ctx->max_pipelines = larg; return 1; case SSL_CTRL_CERT_FLAGS: return (ctx->cert->cert_flags |= larg); case SSL_CTRL_CLEAR_CERT_FLAGS: return (ctx->cert->cert_flags &= ~larg); case SSL_CTRL_SET_MIN_PROTO_VERSION: return ssl_check_allowed_versions(larg, ctx->max_proto_version) && ssl_set_version_bound(ctx->method->version, (int)larg, &ctx->min_proto_version); case SSL_CTRL_GET_MIN_PROTO_VERSION: return ctx->min_proto_version; case SSL_CTRL_SET_MAX_PROTO_VERSION: return ssl_check_allowed_versions(ctx->min_proto_version, larg) && ssl_set_version_bound(ctx->method->version, (int)larg, &ctx->max_proto_version); case SSL_CTRL_GET_MAX_PROTO_VERSION: return ctx->max_proto_version; default: return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg); } } long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void)) { switch (cmd) { case SSL_CTRL_SET_MSG_CALLBACK: ctx->msg_callback = (void (*) (int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); return 1; default: return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp); } } int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b) { if (a->id > b->id) return 1; if (a->id < b->id) return -1; return 0; } int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, const SSL_CIPHER *const *bp) { if ((*ap)->id > (*bp)->id) return 1; if ((*ap)->id < (*bp)->id) return -1; return 0; } /** return a STACK of the ciphers available for the SSL and in order of * preference */ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s) { if (s != NULL) { if (s->cipher_list != NULL) { return s->cipher_list; } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) { return s->ctx->cipher_list; } } return NULL; } STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s) { if ((s == NULL) || !s->server) return NULL; return s->peer_ciphers; } STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s) { STACK_OF(SSL_CIPHER) *sk = NULL, *ciphers; int i; ciphers = SSL_get_ciphers(s); if (!ciphers) return NULL; if (!ssl_set_client_disabled(s)) return NULL; for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) { const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i); if (!ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) { if (!sk) sk = sk_SSL_CIPHER_new_null(); if (!sk) return NULL; if (!sk_SSL_CIPHER_push(sk, c)) { sk_SSL_CIPHER_free(sk); return NULL; } } } return sk; } /** return a STACK of the ciphers available for the SSL and in order of * algorithm id */ STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s) { if (s != NULL) { if (s->cipher_list_by_id != NULL) { return s->cipher_list_by_id; } else if ((s->ctx != NULL) && (s->ctx->cipher_list_by_id != NULL)) { return s->ctx->cipher_list_by_id; } } return NULL; } /** The old interface to get the same thing as SSL_get_ciphers() */ const char *SSL_get_cipher_list(const SSL *s, int n) { const SSL_CIPHER *c; STACK_OF(SSL_CIPHER) *sk; if (s == NULL) return NULL; sk = SSL_get_ciphers(s); if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n)) return NULL; c = sk_SSL_CIPHER_value(sk, n); if (c == NULL) return NULL; return c->name; } /** return a STACK of the ciphers available for the SSL_CTX and in order of * preference */ STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) { if (ctx != NULL) return ctx->cipher_list; return NULL; } /* * Distinguish between ciphers controlled by set_ciphersuite() and * set_cipher_list() when counting. */ static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk) { int i, num = 0; const SSL_CIPHER *c; if (sk == NULL) return 0; for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) { c = sk_SSL_CIPHER_value(sk, i); if (c->min_tls >= TLS1_3_VERSION) continue; num++; } return num; } /** specify the ciphers to be used by default by the SSL_CTX */ int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) { STACK_OF(SSL_CIPHER) *sk; sk = ssl_create_cipher_list(ctx->method, ctx->tls13_ciphersuites, &ctx->cipher_list, &ctx->cipher_list_by_id, str, ctx->cert); /* * ssl_create_cipher_list may return an empty stack if it was unable to * find a cipher matching the given rule string (for example if the rule * string specifies a cipher which has been disabled). This is not an * error as far as ssl_create_cipher_list is concerned, and hence * ctx->cipher_list and ctx->cipher_list_by_id has been updated. */ if (sk == NULL) return 0; else if (cipher_list_tls12_num(sk) == 0) { SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); return 0; } return 1; } /** specify the ciphers to be used by the SSL */ int SSL_set_cipher_list(SSL *s, const char *str) { STACK_OF(SSL_CIPHER) *sk; sk = ssl_create_cipher_list(s->ctx->method, s->tls13_ciphersuites, &s->cipher_list, &s->cipher_list_by_id, str, s->cert); /* see comment in SSL_CTX_set_cipher_list */ if (sk == NULL) return 0; else if (cipher_list_tls12_num(sk) == 0) { SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); return 0; } return 1; } char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size) { char *p; STACK_OF(SSL_CIPHER) *clntsk, *srvrsk; const SSL_CIPHER *c; int i; if (!s->server || s->peer_ciphers == NULL || size < 2) return NULL; p = buf; clntsk = s->peer_ciphers; srvrsk = SSL_get_ciphers(s); if (clntsk == NULL || srvrsk == NULL) return NULL; if (sk_SSL_CIPHER_num(clntsk) == 0 || sk_SSL_CIPHER_num(srvrsk) == 0) return NULL; for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) { int n; c = sk_SSL_CIPHER_value(clntsk, i); if (sk_SSL_CIPHER_find(srvrsk, c) < 0) continue; n = strlen(c->name); if (n + 1 > size) { if (p != buf) --p; *p = '\0'; return buf; } strcpy(p, c->name); p += n; *(p++) = ':'; size -= n + 1; } p[-1] = '\0'; return buf; } /** * Return the requested servername (SNI) value. Note that the behaviour varies * depending on: * - whether this is called by the client or the server, * - if we are before or during/after the handshake, * - if a resumption or normal handshake is being attempted/has occurred * - whether we have negotiated TLSv1.2 (or below) or TLSv1.3 * * Note that only the host_name type is defined (RFC 3546). */ const char *SSL_get_servername(const SSL *s, const int type) { /* * If we don't know if we are the client or the server yet then we assume * client. */ int server = s->handshake_func == NULL ? 0 : s->server; if (type != TLSEXT_NAMETYPE_host_name) return NULL; if (server) { /** * Server side * In TLSv1.3 on the server SNI is not associated with the session * but in TLSv1.2 or below it is. * * Before the handshake: * - return NULL * * During/after the handshake (TLSv1.2 or below resumption occurred): * - If a servername was accepted by the server in the original * handshake then it will return that servername, or NULL otherwise. * * During/after the handshake (TLSv1.2 or below resumption did not occur): * - The function will return the servername requested by the client in * this handshake or NULL if none was requested. */ if (s->hit && !SSL_IS_TLS13(s)) return s->session->ext.hostname; } else { /** * Client side * * Before the handshake: * - If a servername has been set via a call to * SSL_set_tlsext_host_name() then it will return that servername * - If one has not been set, but a TLSv1.2 resumption is being * attempted and the session from the original handshake had a * servername accepted by the server then it will return that * servername * - Otherwise it returns NULL * * During/after the handshake (TLSv1.2 or below resumption occurred): * - If the session from the orignal handshake had a servername accepted * by the server then it will return that servername. * - Otherwise it returns the servername set via * SSL_set_tlsext_host_name() (or NULL if it was not called). * * During/after the handshake (TLSv1.2 or below resumption did not occur): * - It will return the servername set via SSL_set_tlsext_host_name() * (or NULL if it was not called). */ if (SSL_in_before(s)) { if (s->ext.hostname == NULL && s->session != NULL && s->session->ssl_version != TLS1_3_VERSION) return s->session->ext.hostname; } else { if (!SSL_IS_TLS13(s) && s->hit && s->session->ext.hostname != NULL) return s->session->ext.hostname; } } return s->ext.hostname; } int SSL_get_servername_type(const SSL *s) { if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL) return TLSEXT_NAMETYPE_host_name; return -1; } /* * SSL_select_next_proto implements the standard protocol selection. It is * expected that this function is called from the callback set by * SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a * vector of 8-bit, length prefixed byte strings. The length byte itself is * not included in the length. A byte string of length 0 is invalid. No byte * string may be truncated. The current, but experimental algorithm for * selecting the protocol is: 1) If the server doesn't support NPN then this * is indicated to the callback. In this case, the client application has to * abort the connection or have a default application level protocol. 2) If * the server supports NPN, but advertises an empty list then the client * selects the first protocol in its list, but indicates via the API that this * fallback case was enacted. 3) Otherwise, the client finds the first * protocol in the server's list that it supports and selects this protocol. * This is because it's assumed that the server has better information about * which protocol a client should use. 4) If the client doesn't support any * of the server's advertised protocols, then this is treated the same as * case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was * found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. */ int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *server, unsigned int server_len, const unsigned char *client, unsigned int client_len) { unsigned int i, j; const unsigned char *result; int status = OPENSSL_NPN_UNSUPPORTED; /* * For each protocol in server preference order, see if we support it. */ for (i = 0; i < server_len;) { for (j = 0; j < client_len;) { if (server[i] == client[j] && memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) { /* We found a match */ result = &server[i]; status = OPENSSL_NPN_NEGOTIATED; goto found; } j += client[j]; j++; } i += server[i]; i++; } /* There's no overlap between our protocols and the server's list. */ result = client; status = OPENSSL_NPN_NO_OVERLAP; found: *out = (unsigned char *)result + 1; *outlen = result[0]; return status; } #ifndef OPENSSL_NO_NEXTPROTONEG /* * SSL_get0_next_proto_negotiated sets *data and *len to point to the * client's requested protocol for this connection and returns 0. If the * client didn't request any protocol, then *data is set to NULL. Note that * the client can request any protocol it chooses. The value returned from * this function need not be a member of the list of supported protocols * provided by the callback. */ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, unsigned *len) { *data = s->ext.npn; if (!*data) { *len = 0; } else { *len = (unsigned int)s->ext.npn_len; } } /* * SSL_CTX_set_npn_advertised_cb sets a callback that is called when * a TLS server needs a list of supported protocols for Next Protocol * Negotiation. The returned list must be in wire format. The list is * returned by setting |out| to point to it and |outlen| to its length. This * memory will not be modified, but one should assume that the SSL* keeps a * reference to it. The callback should return SSL_TLSEXT_ERR_OK if it * wishes to advertise. Otherwise, no such extension will be included in the * ServerHello. */ void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx, SSL_CTX_npn_advertised_cb_func cb, void *arg) { ctx->ext.npn_advertised_cb = cb; ctx->ext.npn_advertised_cb_arg = arg; } /* * SSL_CTX_set_next_proto_select_cb sets a callback that is called when a * client needs to select a protocol from the server's provided list. |out| * must be set to point to the selected protocol (which may be within |in|). * The length of the protocol name must be written into |outlen|. The * server's advertised protocols are provided in |in| and |inlen|. The * callback can assume that |in| is syntactically valid. The client must * select a protocol. It is fatal to the connection if this callback returns * a value other than SSL_TLSEXT_ERR_OK. */ void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx, SSL_CTX_npn_select_cb_func cb, void *arg) { ctx->ext.npn_select_cb = cb; ctx->ext.npn_select_cb_arg = arg; } #endif /* * SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|. * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit * length-prefixed strings). Returns 0 on success. */ int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, unsigned int protos_len) { OPENSSL_free(ctx->ext.alpn); ctx->ext.alpn = OPENSSL_memdup(protos, protos_len); if (ctx->ext.alpn == NULL) { + ctx->ext.alpn_len = 0; SSLerr(SSL_F_SSL_CTX_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE); return 1; } ctx->ext.alpn_len = protos_len; return 0; } /* * SSL_set_alpn_protos sets the ALPN protocol list on |ssl| to |protos|. * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit * length-prefixed strings). Returns 0 on success. */ int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos, unsigned int protos_len) { OPENSSL_free(ssl->ext.alpn); ssl->ext.alpn = OPENSSL_memdup(protos, protos_len); if (ssl->ext.alpn == NULL) { + ssl->ext.alpn_len = 0; SSLerr(SSL_F_SSL_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE); return 1; } ssl->ext.alpn_len = protos_len; return 0; } /* * SSL_CTX_set_alpn_select_cb sets a callback function on |ctx| that is * called during ClientHello processing in order to select an ALPN protocol * from the client's list of offered protocols. */ void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, SSL_CTX_alpn_select_cb_func cb, void *arg) { ctx->ext.alpn_select_cb = cb; ctx->ext.alpn_select_cb_arg = arg; } /* * SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from |ssl|. * On return it sets |*data| to point to |*len| bytes of protocol name * (not including the leading length-prefix byte). If the server didn't * respond with a negotiated protocol then |*len| will be zero. */ void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, unsigned int *len) { *data = NULL; if (ssl->s3) *data = ssl->s3->alpn_selected; if (*data == NULL) *len = 0; else *len = (unsigned int)ssl->s3->alpn_selected_len; } int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, const char *label, size_t llen, const unsigned char *context, size_t contextlen, int use_context) { if (s->session == NULL || (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER)) return -1; return s->method->ssl3_enc->export_keying_material(s, out, olen, label, llen, context, contextlen, use_context); } int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen, const char *label, size_t llen, const unsigned char *context, size_t contextlen) { if (s->version != TLS1_3_VERSION) return 0; return tls13_export_keying_material_early(s, out, olen, label, llen, context, contextlen); } static unsigned long ssl_session_hash(const SSL_SESSION *a) { const unsigned char *session_id = a->session_id; unsigned long l; unsigned char tmp_storage[4]; if (a->session_id_length < sizeof(tmp_storage)) { memset(tmp_storage, 0, sizeof(tmp_storage)); memcpy(tmp_storage, a->session_id, a->session_id_length); session_id = tmp_storage; } l = (unsigned long) ((unsigned long)session_id[0]) | ((unsigned long)session_id[1] << 8L) | ((unsigned long)session_id[2] << 16L) | ((unsigned long)session_id[3] << 24L); return l; } /* * NB: If this function (or indeed the hash function which uses a sort of * coarser function than this one) is changed, ensure * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on * being able to construct an SSL_SESSION that will collide with any existing * session with a matching session ID. */ static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b) { if (a->ssl_version != b->ssl_version) return 1; if (a->session_id_length != b->session_id_length) return 1; return memcmp(a->session_id, b->session_id, a->session_id_length); } /* * These wrapper functions should remain rather than redeclaring * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each * variable. The reason is that the functions aren't static, they're exposed * via ssl.h. */ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) { SSL_CTX *ret = NULL; if (meth == NULL) { SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED); return NULL; } if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL)) return NULL; if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); goto err; } ret = OPENSSL_zalloc(sizeof(*ret)); if (ret == NULL) goto err; ret->method = meth; ret->min_proto_version = 0; ret->max_proto_version = 0; ret->mode = SSL_MODE_AUTO_RETRY; ret->session_cache_mode = SSL_SESS_CACHE_SERVER; ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT; /* We take the system default. */ ret->session_timeout = meth->get_timeout(); ret->references = 1; ret->lock = CRYPTO_THREAD_lock_new(); if (ret->lock == NULL) { SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE); OPENSSL_free(ret); return NULL; } ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT; ret->verify_mode = SSL_VERIFY_NONE; if ((ret->cert = ssl_cert_new()) == NULL) goto err; ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp); if (ret->sessions == NULL) goto err; ret->cert_store = X509_STORE_new(); if (ret->cert_store == NULL) goto err; #ifndef OPENSSL_NO_CT ret->ctlog_store = CTLOG_STORE_new(); if (ret->ctlog_store == NULL) goto err; #endif if (!SSL_CTX_set_ciphersuites(ret, TLS_DEFAULT_CIPHERSUITES)) goto err; if (!ssl_create_cipher_list(ret->method, ret->tls13_ciphersuites, &ret->cipher_list, &ret->cipher_list_by_id, SSL_DEFAULT_CIPHER_LIST, ret->cert) || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) { SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS); goto err2; } ret->param = X509_VERIFY_PARAM_new(); if (ret->param == NULL) goto err; if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) { SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES); goto err2; } if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) { SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES); goto err2; } if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL) goto err; if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL) goto err; if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data)) goto err; if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL) goto err; /* No compression for DTLS */ if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)) ret->comp_methods = SSL_COMP_get_compression_methods(); ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; /* Setup RFC5077 ticket keys */ if ((RAND_bytes(ret->ext.tick_key_name, sizeof(ret->ext.tick_key_name)) <= 0) || (RAND_priv_bytes(ret->ext.secure->tick_hmac_key, sizeof(ret->ext.secure->tick_hmac_key)) <= 0) || (RAND_priv_bytes(ret->ext.secure->tick_aes_key, sizeof(ret->ext.secure->tick_aes_key)) <= 0)) ret->options |= SSL_OP_NO_TICKET; if (RAND_priv_bytes(ret->ext.cookie_hmac_key, sizeof(ret->ext.cookie_hmac_key)) <= 0) goto err; #ifndef OPENSSL_NO_SRP if (!SSL_CTX_SRP_CTX_init(ret)) goto err; #endif #ifndef OPENSSL_NO_ENGINE # ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO # define eng_strx(x) #x # define eng_str(x) eng_strx(x) /* Use specific client engine automatically... ignore errors */ { ENGINE *eng; eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); if (!eng) { ERR_clear_error(); ENGINE_load_builtin_engines(); eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); } if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) ERR_clear_error(); } # endif #endif /* * Default is to connect to non-RI servers. When RI is more widely * deployed might change this. */ ret->options |= SSL_OP_LEGACY_SERVER_CONNECT; /* * Disable compression by default to prevent CRIME. Applications can * re-enable compression by configuring * SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION); * or by using the SSL_CONF library. Similarly we also enable TLSv1.3 * middlebox compatibility by default. This may be disabled by default in * a later OpenSSL version. */ ret->options |= SSL_OP_NO_COMPRESSION | SSL_OP_ENABLE_MIDDLEBOX_COMPAT; ret->ext.status_type = TLSEXT_STATUSTYPE_nothing; /* * We cannot usefully set a default max_early_data here (which gets * propagated in SSL_new(), for the following reason: setting the * SSL field causes tls_construct_stoc_early_data() to tell the * client that early data will be accepted when constructing a TLS 1.3 * session ticket, and the client will accordingly send us early data * when using that ticket (if the client has early data to send). * However, in order for the early data to actually be consumed by * the application, the application must also have calls to * SSL_read_early_data(); otherwise we'll just skip past the early data * and ignore it. So, since the application must add calls to * SSL_read_early_data(), we also require them to add * calls to SSL_CTX_set_max_early_data() in order to use early data, * eliminating the bandwidth-wasting early data in the case described * above. */ ret->max_early_data = 0; /* * Default recv_max_early_data is a fully loaded single record. Could be * split across multiple records in practice. We set this differently to * max_early_data so that, in the default case, we do not advertise any * support for early_data, but if a client were to send us some (e.g. * because of an old, stale ticket) then we will tolerate it and skip over * it. */ ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH; /* By default we send two session tickets automatically in TLSv1.3 */ ret->num_tickets = 2; ssl_ctx_system_config(ret); return ret; err: SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE); err2: SSL_CTX_free(ret); return NULL; } int SSL_CTX_up_ref(SSL_CTX *ctx) { int i; if (CRYPTO_UP_REF(&ctx->references, &i, ctx->lock) <= 0) return 0; REF_PRINT_COUNT("SSL_CTX", ctx); REF_ASSERT_ISNT(i < 2); return ((i > 1) ? 1 : 0); } void SSL_CTX_free(SSL_CTX *a) { int i; if (a == NULL) return; CRYPTO_DOWN_REF(&a->references, &i, a->lock); REF_PRINT_COUNT("SSL_CTX", a); if (i > 0) return; REF_ASSERT_ISNT(i < 0); X509_VERIFY_PARAM_free(a->param); dane_ctx_final(&a->dane); /* * Free internal session cache. However: the remove_cb() may reference * the ex_data of SSL_CTX, thus the ex_data store can only be removed * after the sessions were flushed. * As the ex_data handling routines might also touch the session cache, * the most secure solution seems to be: empty (flush) the cache, then * free ex_data, then finally free the cache. * (See ticket [openssl.org #212].) */ if (a->sessions != NULL) SSL_CTX_flush_sessions(a, 0); CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); lh_SSL_SESSION_free(a->sessions); X509_STORE_free(a->cert_store); #ifndef OPENSSL_NO_CT CTLOG_STORE_free(a->ctlog_store); #endif sk_SSL_CIPHER_free(a->cipher_list); sk_SSL_CIPHER_free(a->cipher_list_by_id); sk_SSL_CIPHER_free(a->tls13_ciphersuites); ssl_cert_free(a->cert); sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free); sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free); sk_X509_pop_free(a->extra_certs, X509_free); a->comp_methods = NULL; #ifndef OPENSSL_NO_SRTP sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles); #endif #ifndef OPENSSL_NO_SRP SSL_CTX_SRP_CTX_free(a); #endif #ifndef OPENSSL_NO_ENGINE ENGINE_finish(a->client_cert_engine); #endif #ifndef OPENSSL_NO_EC OPENSSL_free(a->ext.ecpointformats); OPENSSL_free(a->ext.supportedgroups); #endif OPENSSL_free(a->ext.alpn); OPENSSL_secure_free(a->ext.secure); CRYPTO_THREAD_lock_free(a->lock); OPENSSL_free(a); } void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) { ctx->default_passwd_callback = cb; } void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u) { ctx->default_passwd_callback_userdata = u; } pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx) { return ctx->default_passwd_callback; } void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx) { return ctx->default_passwd_callback_userdata; } void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb) { s->default_passwd_callback = cb; } void SSL_set_default_passwd_cb_userdata(SSL *s, void *u) { s->default_passwd_callback_userdata = u; } pem_password_cb *SSL_get_default_passwd_cb(SSL *s) { return s->default_passwd_callback; } void *SSL_get_default_passwd_cb_userdata(SSL *s) { return s->default_passwd_callback_userdata; } void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb) (X509_STORE_CTX *, void *), void *arg) { ctx->app_verify_callback = cb; ctx->app_verify_arg = arg; } void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*cb) (int, X509_STORE_CTX *)) { ctx->verify_mode = mode; ctx->default_verify_callback = cb; } void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth) { X509_VERIFY_PARAM_set_depth(ctx->param, depth); } void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg), void *arg) { ssl_cert_set_cert_cb(c->cert, cb, arg); } void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg) { ssl_cert_set_cert_cb(s->cert, cb, arg); } void ssl_set_masks(SSL *s) { CERT *c = s->cert; uint32_t *pvalid = s->s3->tmp.valid_flags; int rsa_enc, rsa_sign, dh_tmp, dsa_sign; unsigned long mask_k, mask_a; #ifndef OPENSSL_NO_EC int have_ecc_cert, ecdsa_ok; #endif if (c == NULL) return; #ifndef OPENSSL_NO_DH dh_tmp = (c->dh_tmp != NULL || c->dh_tmp_cb != NULL || c->dh_tmp_auto); #else dh_tmp = 0; #endif rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID; rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID; dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID; #ifndef OPENSSL_NO_EC have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID; #endif mask_k = 0; mask_a = 0; #ifdef CIPHER_DEBUG fprintf(stderr, "dht=%d re=%d rs=%d ds=%d\n", dh_tmp, rsa_enc, rsa_sign, dsa_sign); #endif #ifndef OPENSSL_NO_GOST if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) { mask_k |= SSL_kGOST; mask_a |= SSL_aGOST12; } if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) { mask_k |= SSL_kGOST; mask_a |= SSL_aGOST12; } if (ssl_has_cert(s, SSL_PKEY_GOST01)) { mask_k |= SSL_kGOST; mask_a |= SSL_aGOST01; } #endif if (rsa_enc) mask_k |= SSL_kRSA; if (dh_tmp) mask_k |= SSL_kDHE; /* * If we only have an RSA-PSS certificate allow RSA authentication * if TLS 1.2 and peer supports it. */ if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN) && pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN && TLS1_get_version(s) == TLS1_2_VERSION)) mask_a |= SSL_aRSA; if (dsa_sign) { mask_a |= SSL_aDSS; } mask_a |= SSL_aNULL; /* * An ECC certificate may be usable for ECDH and/or ECDSA cipher suites * depending on the key usage extension. */ #ifndef OPENSSL_NO_EC if (have_ecc_cert) { uint32_t ex_kusage; ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509); ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE; if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN)) ecdsa_ok = 0; if (ecdsa_ok) mask_a |= SSL_aECDSA; } /* Allow Ed25519 for TLS 1.2 if peer supports it */ if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519) && pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN && TLS1_get_version(s) == TLS1_2_VERSION) mask_a |= SSL_aECDSA; /* Allow Ed448 for TLS 1.2 if peer supports it */ if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448) && pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN && TLS1_get_version(s) == TLS1_2_VERSION) mask_a |= SSL_aECDSA; #endif #ifndef OPENSSL_NO_EC mask_k |= SSL_kECDHE; #endif #ifndef OPENSSL_NO_PSK mask_k |= SSL_kPSK; mask_a |= SSL_aPSK; if (mask_k & SSL_kRSA) mask_k |= SSL_kRSAPSK; if (mask_k & SSL_kDHE) mask_k |= SSL_kDHEPSK; if (mask_k & SSL_kECDHE) mask_k |= SSL_kECDHEPSK; #endif s->s3->tmp.mask_k = mask_k; s->s3->tmp.mask_a = mask_a; } #ifndef OPENSSL_NO_EC int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s) { if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA) { /* key usage, if present, must allow signing */ if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) { SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING); return 0; } } return 1; /* all checks are ok */ } #endif int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo, size_t *serverinfo_length) { CERT_PKEY *cpk = s->s3->tmp.cert; *serverinfo_length = 0; if (cpk == NULL || cpk->serverinfo == NULL) return 0; *serverinfo = cpk->serverinfo; *serverinfo_length = cpk->serverinfo_length; return 1; } void ssl_update_cache(SSL *s, int mode) { int i; /* * If the session_id_length is 0, we are not supposed to cache it, and it * would be rather hard to do anyway :-) */ if (s->session->session_id_length == 0) return; /* * If sid_ctx_length is 0 there is no specific application context * associated with this session, so when we try to resume it and * SSL_VERIFY_PEER is requested to verify the client identity, we have no * indication that this is actually a session for the proper application * context, and the *handshake* will fail, not just the resumption attempt. * Do not cache (on the server) these sessions that are not resumable * (clients can set SSL_VERIFY_PEER without needing a sid_ctx set). */ if (s->server && s->session->sid_ctx_length == 0 && (s->verify_mode & SSL_VERIFY_PEER) != 0) return; i = s->session_ctx->session_cache_mode; if ((i & mode) != 0 && (!s->hit || SSL_IS_TLS13(s))) { /* * Add the session to the internal cache. In server side TLSv1.3 we * normally don't do this because by default it's a full stateless ticket * with only a dummy session id so there is no reason to cache it, * unless: * - we are doing early_data, in which case we cache so that we can * detect replays * - the application has set a remove_session_cb so needs to know about * session timeout events * - SSL_OP_NO_TICKET is set in which case it is a stateful ticket */ if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0 && (!SSL_IS_TLS13(s) || !s->server || (s->max_early_data > 0 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0) || s->session_ctx->remove_session_cb != NULL || (s->options & SSL_OP_NO_TICKET) != 0)) SSL_CTX_add_session(s->session_ctx, s->session); /* * Add the session to the external cache. We do this even in server side * TLSv1.3 without early data because some applications just want to * know about the creation of a session and aren't doing a full cache. */ if (s->session_ctx->new_session_cb != NULL) { SSL_SESSION_up_ref(s->session); if (!s->session_ctx->new_session_cb(s, s->session)) SSL_SESSION_free(s->session); } } /* auto flush every 255 connections */ if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) { TSAN_QUALIFIER int *stat; if (mode & SSL_SESS_CACHE_CLIENT) stat = &s->session_ctx->stats.sess_connect_good; else stat = &s->session_ctx->stats.sess_accept_good; if ((tsan_load(stat) & 0xff) == 0xff) SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL)); } } const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx) { return ctx->method; } const SSL_METHOD *SSL_get_ssl_method(const SSL *s) { return s->method; } int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth) { int ret = 1; if (s->method != meth) { const SSL_METHOD *sm = s->method; int (*hf) (SSL *) = s->handshake_func; if (sm->version == meth->version) s->method = meth; else { sm->ssl_free(s); s->method = meth; ret = s->method->ssl_new(s); } if (hf == sm->ssl_connect) s->handshake_func = meth->ssl_connect; else if (hf == sm->ssl_accept) s->handshake_func = meth->ssl_accept; } return ret; } int SSL_get_error(const SSL *s, int i) { int reason; unsigned long l; BIO *bio; if (i > 0) return SSL_ERROR_NONE; /* * Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc, * where we do encode the error */ if ((l = ERR_peek_error()) != 0) { if (ERR_GET_LIB(l) == ERR_LIB_SYS) return SSL_ERROR_SYSCALL; else return SSL_ERROR_SSL; } if (SSL_want_read(s)) { bio = SSL_get_rbio(s); if (BIO_should_read(bio)) return SSL_ERROR_WANT_READ; else if (BIO_should_write(bio)) /* * This one doesn't make too much sense ... We never try to write * to the rbio, and an application program where rbio and wbio * are separate couldn't even know what it should wait for. * However if we ever set s->rwstate incorrectly (so that we have * SSL_want_read(s) instead of SSL_want_write(s)) and rbio and * wbio *are* the same, this test works around that bug; so it * might be safer to keep it. */ return SSL_ERROR_WANT_WRITE; else if (BIO_should_io_special(bio)) { reason = BIO_get_retry_reason(bio); if (reason == BIO_RR_CONNECT) return SSL_ERROR_WANT_CONNECT; else if (reason == BIO_RR_ACCEPT) return SSL_ERROR_WANT_ACCEPT; else return SSL_ERROR_SYSCALL; /* unknown */ } } if (SSL_want_write(s)) { /* Access wbio directly - in order to use the buffered bio if present */ bio = s->wbio; if (BIO_should_write(bio)) return SSL_ERROR_WANT_WRITE; else if (BIO_should_read(bio)) /* * See above (SSL_want_read(s) with BIO_should_write(bio)) */ return SSL_ERROR_WANT_READ; else if (BIO_should_io_special(bio)) { reason = BIO_get_retry_reason(bio); if (reason == BIO_RR_CONNECT) return SSL_ERROR_WANT_CONNECT; else if (reason == BIO_RR_ACCEPT) return SSL_ERROR_WANT_ACCEPT; else return SSL_ERROR_SYSCALL; } } if (SSL_want_x509_lookup(s)) return SSL_ERROR_WANT_X509_LOOKUP; if (SSL_want_async(s)) return SSL_ERROR_WANT_ASYNC; if (SSL_want_async_job(s)) return SSL_ERROR_WANT_ASYNC_JOB; if (SSL_want_client_hello_cb(s)) return SSL_ERROR_WANT_CLIENT_HELLO_CB; if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) && (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY)) return SSL_ERROR_ZERO_RETURN; return SSL_ERROR_SYSCALL; } static int ssl_do_handshake_intern(void *vargs) { struct ssl_async_args *args; SSL *s; args = (struct ssl_async_args *)vargs; s = args->s; return s->handshake_func(s); } int SSL_do_handshake(SSL *s) { int ret = 1; if (s->handshake_func == NULL) { SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET); return -1; } ossl_statem_check_finish_init(s, -1); s->method->ssl_renegotiate_check(s, 0); if (SSL_in_init(s) || SSL_in_before(s)) { if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { struct ssl_async_args args; args.s = s; ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern); } else { ret = s->handshake_func(s); } } return ret; } void SSL_set_accept_state(SSL *s) { s->server = 1; s->shutdown = 0; ossl_statem_clear(s); s->handshake_func = s->method->ssl_accept; clear_ciphers(s); } void SSL_set_connect_state(SSL *s) { s->server = 0; s->shutdown = 0; ossl_statem_clear(s); s->handshake_func = s->method->ssl_connect; clear_ciphers(s); } int ssl_undefined_function(SSL *s) { SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } int ssl_undefined_void_function(void) { SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } int ssl_undefined_const_function(const SSL *s) { return 0; } const SSL_METHOD *ssl_bad_method(int ver) { SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return NULL; } const char *ssl_protocol_to_string(int version) { switch(version) { case TLS1_3_VERSION: return "TLSv1.3"; case TLS1_2_VERSION: return "TLSv1.2"; case TLS1_1_VERSION: return "TLSv1.1"; case TLS1_VERSION: return "TLSv1"; case SSL3_VERSION: return "SSLv3"; case DTLS1_BAD_VER: return "DTLSv0.9"; case DTLS1_VERSION: return "DTLSv1"; case DTLS1_2_VERSION: return "DTLSv1.2"; default: return "unknown"; } } const char *SSL_get_version(const SSL *s) { return ssl_protocol_to_string(s->version); } static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src) { STACK_OF(X509_NAME) *sk; X509_NAME *xn; int i; if (src == NULL) { *dst = NULL; return 1; } if ((sk = sk_X509_NAME_new_null()) == NULL) return 0; for (i = 0; i < sk_X509_NAME_num(src); i++) { xn = X509_NAME_dup(sk_X509_NAME_value(src, i)); if (xn == NULL) { sk_X509_NAME_pop_free(sk, X509_NAME_free); return 0; } if (sk_X509_NAME_insert(sk, xn, i) == 0) { X509_NAME_free(xn); sk_X509_NAME_pop_free(sk, X509_NAME_free); return 0; } } *dst = sk; return 1; } SSL *SSL_dup(SSL *s) { SSL *ret; int i; /* If we're not quiescent, just up_ref! */ if (!SSL_in_init(s) || !SSL_in_before(s)) { CRYPTO_UP_REF(&s->references, &i, s->lock); return s; } /* * Otherwise, copy configuration state, and session if set. */ if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL) return NULL; if (s->session != NULL) { /* * Arranges to share the same session via up_ref. This "copies" * session-id, SSL_METHOD, sid_ctx, and 'cert' */ if (!SSL_copy_session_id(ret, s)) goto err; } else { /* * No session has been established yet, so we have to expect that * s->cert or ret->cert will be changed later -- they should not both * point to the same object, and thus we can't use * SSL_copy_session_id. */ if (!SSL_set_ssl_method(ret, s->method)) goto err; if (s->cert != NULL) { ssl_cert_free(ret->cert); ret->cert = ssl_cert_dup(s->cert); if (ret->cert == NULL) goto err; } if (!SSL_set_session_id_context(ret, s->sid_ctx, (int)s->sid_ctx_length)) goto err; } if (!ssl_dane_dup(ret, s)) goto err; ret->version = s->version; ret->options = s->options; ret->min_proto_version = s->min_proto_version; ret->max_proto_version = s->max_proto_version; ret->mode = s->mode; SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s)); SSL_set_read_ahead(ret, SSL_get_read_ahead(s)); ret->msg_callback = s->msg_callback; ret->msg_callback_arg = s->msg_callback_arg; SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s)); SSL_set_verify_depth(ret, SSL_get_verify_depth(s)); ret->generate_session_id = s->generate_session_id; SSL_set_info_callback(ret, SSL_get_info_callback(s)); /* copy app data, a little dangerous perhaps */ if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data)) goto err; ret->server = s->server; if (s->handshake_func) { if (s->server) SSL_set_accept_state(ret); else SSL_set_connect_state(ret); } ret->shutdown = s->shutdown; ret->hit = s->hit; ret->default_passwd_callback = s->default_passwd_callback; ret->default_passwd_callback_userdata = s->default_passwd_callback_userdata; X509_VERIFY_PARAM_inherit(ret->param, s->param); /* dup the cipher_list and cipher_list_by_id stacks */ if (s->cipher_list != NULL) { if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL) goto err; } if (s->cipher_list_by_id != NULL) if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id)) == NULL) goto err; /* Dup the client_CA list */ if (!dup_ca_names(&ret->ca_names, s->ca_names) || !dup_ca_names(&ret->client_ca_names, s->client_ca_names)) goto err; return ret; err: SSL_free(ret); return NULL; } void ssl_clear_cipher_ctx(SSL *s) { if (s->enc_read_ctx != NULL) { EVP_CIPHER_CTX_free(s->enc_read_ctx); s->enc_read_ctx = NULL; } if (s->enc_write_ctx != NULL) { EVP_CIPHER_CTX_free(s->enc_write_ctx); s->enc_write_ctx = NULL; } #ifndef OPENSSL_NO_COMP COMP_CTX_free(s->expand); s->expand = NULL; COMP_CTX_free(s->compress); s->compress = NULL; #endif } X509 *SSL_get_certificate(const SSL *s) { if (s->cert != NULL) return s->cert->key->x509; else return NULL; } EVP_PKEY *SSL_get_privatekey(const SSL *s) { if (s->cert != NULL) return s->cert->key->privatekey; else return NULL; } X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx) { if (ctx->cert != NULL) return ctx->cert->key->x509; else return NULL; } EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx) { if (ctx->cert != NULL) return ctx->cert->key->privatekey; else return NULL; } const SSL_CIPHER *SSL_get_current_cipher(const SSL *s) { if ((s->session != NULL) && (s->session->cipher != NULL)) return s->session->cipher; return NULL; } const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s) { return s->s3->tmp.new_cipher; } const COMP_METHOD *SSL_get_current_compression(const SSL *s) { #ifndef OPENSSL_NO_COMP return s->compress ? COMP_CTX_get_method(s->compress) : NULL; #else return NULL; #endif } const COMP_METHOD *SSL_get_current_expansion(const SSL *s) { #ifndef OPENSSL_NO_COMP return s->expand ? COMP_CTX_get_method(s->expand) : NULL; #else return NULL; #endif } int ssl_init_wbio_buffer(SSL *s) { BIO *bbio; if (s->bbio != NULL) { /* Already buffered. */ return 1; } bbio = BIO_new(BIO_f_buffer()); if (bbio == NULL || !BIO_set_read_buffer_size(bbio, 1)) { BIO_free(bbio); SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB); return 0; } s->bbio = bbio; s->wbio = BIO_push(bbio, s->wbio); return 1; } int ssl_free_wbio_buffer(SSL *s) { /* callers ensure s is never null */ if (s->bbio == NULL) return 1; s->wbio = BIO_pop(s->wbio); BIO_free(s->bbio); s->bbio = NULL; return 1; } void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode) { ctx->quiet_shutdown = mode; } int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) { return ctx->quiet_shutdown; } void SSL_set_quiet_shutdown(SSL *s, int mode) { s->quiet_shutdown = mode; } int SSL_get_quiet_shutdown(const SSL *s) { return s->quiet_shutdown; } void SSL_set_shutdown(SSL *s, int mode) { s->shutdown = mode; } int SSL_get_shutdown(const SSL *s) { return s->shutdown; } int SSL_version(const SSL *s) { return s->version; } int SSL_client_version(const SSL *s) { return s->client_version; } SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) { return ssl->ctx; } SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) { CERT *new_cert; if (ssl->ctx == ctx) return ssl->ctx; if (ctx == NULL) ctx = ssl->session_ctx; new_cert = ssl_cert_dup(ctx->cert); if (new_cert == NULL) { return NULL; } if (!custom_exts_copy_flags(&new_cert->custext, &ssl->cert->custext)) { ssl_cert_free(new_cert); return NULL; } ssl_cert_free(ssl->cert); ssl->cert = new_cert; /* * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH), * so setter APIs must prevent invalid lengths from entering the system. */ if (!ossl_assert(ssl->sid_ctx_length <= sizeof(ssl->sid_ctx))) return NULL; /* * If the session ID context matches that of the parent SSL_CTX, * inherit it from the new SSL_CTX as well. If however the context does * not match (i.e., it was set per-ssl with SSL_set_session_id_context), * leave it unchanged. */ if ((ssl->ctx != NULL) && (ssl->sid_ctx_length == ssl->ctx->sid_ctx_length) && (memcmp(ssl->sid_ctx, ssl->ctx->sid_ctx, ssl->sid_ctx_length) == 0)) { ssl->sid_ctx_length = ctx->sid_ctx_length; memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx)); } SSL_CTX_up_ref(ctx); SSL_CTX_free(ssl->ctx); /* decrement reference count */ ssl->ctx = ctx; return ssl->ctx; } int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) { return X509_STORE_set_default_paths(ctx->cert_store); } int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx) { X509_LOOKUP *lookup; lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir()); if (lookup == NULL) return 0; X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT); /* Clear any errors if the default directory does not exist */ ERR_clear_error(); return 1; } int SSL_CTX_set_default_verify_file(SSL_CTX *ctx) { X509_LOOKUP *lookup; lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file()); if (lookup == NULL) return 0; X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT); /* Clear any errors if the default file does not exist */ ERR_clear_error(); return 1; } int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath) { return X509_STORE_load_locations(ctx->cert_store, CAfile, CApath); } void SSL_set_info_callback(SSL *ssl, void (*cb) (const SSL *ssl, int type, int val)) { ssl->info_callback = cb; } /* * One compiler (Diab DCC) doesn't like argument names in returned function * pointer. */ void (*SSL_get_info_callback(const SSL *ssl)) (const SSL * /* ssl */ , int /* type */ , int /* val */ ) { return ssl->info_callback; } void SSL_set_verify_result(SSL *ssl, long arg) { ssl->verify_result = arg; } long SSL_get_verify_result(const SSL *ssl) { return ssl->verify_result; } size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen) { if (outlen == 0) return sizeof(ssl->s3->client_random); if (outlen > sizeof(ssl->s3->client_random)) outlen = sizeof(ssl->s3->client_random); memcpy(out, ssl->s3->client_random, outlen); return outlen; } size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen) { if (outlen == 0) return sizeof(ssl->s3->server_random); if (outlen > sizeof(ssl->s3->server_random)) outlen = sizeof(ssl->s3->server_random); memcpy(out, ssl->s3->server_random, outlen); return outlen; } size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, unsigned char *out, size_t outlen) { if (outlen == 0) return session->master_key_length; if (outlen > session->master_key_length) outlen = session->master_key_length; memcpy(out, session->master_key, outlen); return outlen; } int SSL_SESSION_set1_master_key(SSL_SESSION *sess, const unsigned char *in, size_t len) { if (len > sizeof(sess->master_key)) return 0; memcpy(sess->master_key, in, len); sess->master_key_length = len; return 1; } int SSL_set_ex_data(SSL *s, int idx, void *arg) { return CRYPTO_set_ex_data(&s->ex_data, idx, arg); } void *SSL_get_ex_data(const SSL *s, int idx) { return CRYPTO_get_ex_data(&s->ex_data, idx); } int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg) { return CRYPTO_set_ex_data(&s->ex_data, idx, arg); } void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx) { return CRYPTO_get_ex_data(&s->ex_data, idx); } X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx) { return ctx->cert_store; } void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store) { X509_STORE_free(ctx->cert_store); ctx->cert_store = store; } void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) { if (store != NULL) X509_STORE_up_ref(store); SSL_CTX_set_cert_store(ctx, store); } int SSL_want(const SSL *s) { return s->rwstate; } /** * \brief Set the callback for generating temporary DH keys. * \param ctx the SSL context. * \param dh the callback */ #ifndef OPENSSL_NO_DH void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, DH *(*dh) (SSL *ssl, int is_export, int keylength)) { SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_DH_CB, (void (*)(void))dh); } void SSL_set_tmp_dh_callback(SSL *ssl, DH *(*dh) (SSL *ssl, int is_export, int keylength)) { SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_DH_CB, (void (*)(void))dh); } #endif #ifndef OPENSSL_NO_PSK int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) { if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); return 0; } OPENSSL_free(ctx->cert->psk_identity_hint); if (identity_hint != NULL) { ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint); if (ctx->cert->psk_identity_hint == NULL) return 0; } else ctx->cert->psk_identity_hint = NULL; return 1; } int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) { if (s == NULL) return 0; if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); return 0; } OPENSSL_free(s->cert->psk_identity_hint); if (identity_hint != NULL) { s->cert->psk_identity_hint = OPENSSL_strdup(identity_hint); if (s->cert->psk_identity_hint == NULL) return 0; } else s->cert->psk_identity_hint = NULL; return 1; } const char *SSL_get_psk_identity_hint(const SSL *s) { if (s == NULL || s->session == NULL) return NULL; return s->session->psk_identity_hint; } const char *SSL_get_psk_identity(const SSL *s) { if (s == NULL || s->session == NULL) return NULL; return s->session->psk_identity; } void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb) { s->psk_client_callback = cb; } void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb) { ctx->psk_client_callback = cb; } void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb) { s->psk_server_callback = cb; } void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb) { ctx->psk_server_callback = cb; } #endif void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb) { s->psk_find_session_cb = cb; } void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx, SSL_psk_find_session_cb_func cb) { ctx->psk_find_session_cb = cb; } void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb) { s->psk_use_session_cb = cb; } void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx, SSL_psk_use_session_cb_func cb) { ctx->psk_use_session_cb = cb; } void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb) (int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) { SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); } void SSL_set_msg_callback(SSL *ssl, void (*cb) (int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) { SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); } void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb) (SSL *ssl, int is_forward_secure)) { SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB, (void (*)(void))cb); } void SSL_set_not_resumable_session_callback(SSL *ssl, int (*cb) (SSL *ssl, int is_forward_secure)) { SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB, (void (*)(void))cb); } void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, size_t (*cb) (SSL *ssl, int type, size_t len, void *arg)) { ctx->record_padding_cb = cb; } void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg) { ctx->record_padding_arg = arg; } void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx) { return ctx->record_padding_arg; } int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size) { /* block size of 0 or 1 is basically no padding */ if (block_size == 1) ctx->block_padding = 0; else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH) ctx->block_padding = block_size; else return 0; return 1; } void SSL_set_record_padding_callback(SSL *ssl, size_t (*cb) (SSL *ssl, int type, size_t len, void *arg)) { ssl->record_padding_cb = cb; } void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg) { ssl->record_padding_arg = arg; } void *SSL_get_record_padding_callback_arg(const SSL *ssl) { return ssl->record_padding_arg; } int SSL_set_block_padding(SSL *ssl, size_t block_size) { /* block size of 0 or 1 is basically no padding */ if (block_size == 1) ssl->block_padding = 0; else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH) ssl->block_padding = block_size; else return 0; return 1; } int SSL_set_num_tickets(SSL *s, size_t num_tickets) { s->num_tickets = num_tickets; return 1; } size_t SSL_get_num_tickets(const SSL *s) { return s->num_tickets; } int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets) { ctx->num_tickets = num_tickets; return 1; } size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx) { return ctx->num_tickets; } /* * Allocates new EVP_MD_CTX and sets pointer to it into given pointer * variable, freeing EVP_MD_CTX previously stored in that variable, if any. * If EVP_MD pointer is passed, initializes ctx with this |md|. * Returns the newly allocated ctx; */ EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md) { ssl_clear_hash_ctx(hash); *hash = EVP_MD_CTX_new(); if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) { EVP_MD_CTX_free(*hash); *hash = NULL; return NULL; } return *hash; } void ssl_clear_hash_ctx(EVP_MD_CTX **hash) { EVP_MD_CTX_free(*hash); *hash = NULL; } /* Retrieve handshake hashes */ int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen, size_t *hashlen) { EVP_MD_CTX *ctx = NULL; EVP_MD_CTX *hdgst = s->s3->handshake_dgst; int hashleni = EVP_MD_CTX_size(hdgst); int ret = 0; if (hashleni < 0 || (size_t)hashleni > outlen) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH, ERR_R_INTERNAL_ERROR); goto err; } ctx = EVP_MD_CTX_new(); if (ctx == NULL) goto err; if (!EVP_MD_CTX_copy_ex(ctx, hdgst) || EVP_DigestFinal_ex(ctx, out, NULL) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH, ERR_R_INTERNAL_ERROR); goto err; } *hashlen = hashleni; ret = 1; err: EVP_MD_CTX_free(ctx); return ret; } int SSL_session_reused(const SSL *s) { return s->hit; } int SSL_is_server(const SSL *s) { return s->server; } #if OPENSSL_API_COMPAT < 0x10100000L void SSL_set_debug(SSL *s, int debug) { /* Old function was do-nothing anyway... */ (void)s; (void)debug; } #endif void SSL_set_security_level(SSL *s, int level) { s->cert->sec_level = level; } int SSL_get_security_level(const SSL *s) { return s->cert->sec_level; } void SSL_set_security_callback(SSL *s, int (*cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid, void *other, void *ex)) { s->cert->sec_cb = cb; } int (*SSL_get_security_callback(const SSL *s)) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid, void *other, void *ex) { return s->cert->sec_cb; } void SSL_set0_security_ex_data(SSL *s, void *ex) { s->cert->sec_ex = ex; } void *SSL_get0_security_ex_data(const SSL *s) { return s->cert->sec_ex; } void SSL_CTX_set_security_level(SSL_CTX *ctx, int level) { ctx->cert->sec_level = level; } int SSL_CTX_get_security_level(const SSL_CTX *ctx) { return ctx->cert->sec_level; } void SSL_CTX_set_security_callback(SSL_CTX *ctx, int (*cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid, void *other, void *ex)) { ctx->cert->sec_cb = cb; } int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid, void *other, void *ex) { return ctx->cert->sec_cb; } void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex) { ctx->cert->sec_ex = ex; } void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx) { return ctx->cert->sec_ex; } /* * Get/Set/Clear options in SSL_CTX or SSL, formerly macros, now functions that * can return unsigned long, instead of the generic long return value from the * control interface. */ unsigned long SSL_CTX_get_options(const SSL_CTX *ctx) { return ctx->options; } unsigned long SSL_get_options(const SSL *s) { return s->options; } unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long op) { return ctx->options |= op; } unsigned long SSL_set_options(SSL *s, unsigned long op) { return s->options |= op; } unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op) { return ctx->options &= ~op; } unsigned long SSL_clear_options(SSL *s, unsigned long op) { return s->options &= ~op; } STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s) { return s->verified_chain; } IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id); #ifndef OPENSSL_NO_CT /* * Moves SCTs from the |src| stack to the |dst| stack. * The source of each SCT will be set to |origin|. * If |dst| points to a NULL pointer, a new stack will be created and owned by * the caller. * Returns the number of SCTs moved, or a negative integer if an error occurs. */ static int ct_move_scts(STACK_OF(SCT) **dst, STACK_OF(SCT) *src, sct_source_t origin) { int scts_moved = 0; SCT *sct = NULL; if (*dst == NULL) { *dst = sk_SCT_new_null(); if (*dst == NULL) { SSLerr(SSL_F_CT_MOVE_SCTS, ERR_R_MALLOC_FAILURE); goto err; } } while ((sct = sk_SCT_pop(src)) != NULL) { if (SCT_set_source(sct, origin) != 1) goto err; if (sk_SCT_push(*dst, sct) <= 0) goto err; scts_moved += 1; } return scts_moved; err: if (sct != NULL) sk_SCT_push(src, sct); /* Put the SCT back */ return -1; } /* * Look for data collected during ServerHello and parse if found. * Returns the number of SCTs extracted. */ static int ct_extract_tls_extension_scts(SSL *s) { int scts_extracted = 0; if (s->ext.scts != NULL) { const unsigned char *p = s->ext.scts; STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len); scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION); SCT_LIST_free(scts); } return scts_extracted; } /* * Checks for an OCSP response and then attempts to extract any SCTs found if it * contains an SCT X509 extension. They will be stored in |s->scts|. * Returns: * - The number of SCTs extracted, assuming an OCSP response exists. * - 0 if no OCSP response exists or it contains no SCTs. * - A negative integer if an error occurs. */ static int ct_extract_ocsp_response_scts(SSL *s) { # ifndef OPENSSL_NO_OCSP int scts_extracted = 0; const unsigned char *p; OCSP_BASICRESP *br = NULL; OCSP_RESPONSE *rsp = NULL; STACK_OF(SCT) *scts = NULL; int i; if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0) goto err; p = s->ext.ocsp.resp; rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len); if (rsp == NULL) goto err; br = OCSP_response_get1_basic(rsp); if (br == NULL) goto err; for (i = 0; i < OCSP_resp_count(br); ++i) { OCSP_SINGLERESP *single = OCSP_resp_get0(br, i); if (single == NULL) continue; scts = OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL); scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE); if (scts_extracted < 0) goto err; } err: SCT_LIST_free(scts); OCSP_BASICRESP_free(br); OCSP_RESPONSE_free(rsp); return scts_extracted; # else /* Behave as if no OCSP response exists */ return 0; # endif } /* * Attempts to extract SCTs from the peer certificate. * Return the number of SCTs extracted, or a negative integer if an error * occurs. */ static int ct_extract_x509v3_extension_scts(SSL *s) { int scts_extracted = 0; X509 *cert = s->session != NULL ? s->session->peer : NULL; if (cert != NULL) { STACK_OF(SCT) *scts = X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL); scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION); SCT_LIST_free(scts); } return scts_extracted; } /* * Attempts to find all received SCTs by checking TLS extensions, the OCSP * response (if it exists) and X509v3 extensions in the certificate. * Returns NULL if an error occurs. */ const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s) { if (!s->scts_parsed) { if (ct_extract_tls_extension_scts(s) < 0 || ct_extract_ocsp_response_scts(s) < 0 || ct_extract_x509v3_extension_scts(s) < 0) goto err; s->scts_parsed = 1; } return s->scts; err: return NULL; } static int ct_permissive(const CT_POLICY_EVAL_CTX * ctx, const STACK_OF(SCT) *scts, void *unused_arg) { return 1; } static int ct_strict(const CT_POLICY_EVAL_CTX * ctx, const STACK_OF(SCT) *scts, void *unused_arg) { int count = scts != NULL ? sk_SCT_num(scts) : 0; int i; for (i = 0; i < count; ++i) { SCT *sct = sk_SCT_value(scts, i); int status = SCT_get_validation_status(sct); if (status == SCT_VALIDATION_STATUS_VALID) return 1; } SSLerr(SSL_F_CT_STRICT, SSL_R_NO_VALID_SCTS); return 0; } int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback, void *arg) { /* * Since code exists that uses the custom extension handler for CT, look * for this and throw an error if they have already registered to use CT. */ if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx, TLSEXT_TYPE_signed_certificate_timestamp)) { SSLerr(SSL_F_SSL_SET_CT_VALIDATION_CALLBACK, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED); return 0; } if (callback != NULL) { /* * If we are validating CT, then we MUST accept SCTs served via OCSP */ if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp)) return 0; } s->ct_validation_callback = callback; s->ct_validation_callback_arg = arg; return 1; } int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx, ssl_ct_validation_cb callback, void *arg) { /* * Since code exists that uses the custom extension handler for CT, look for * this and throw an error if they have already registered to use CT. */ if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx, TLSEXT_TYPE_signed_certificate_timestamp)) { SSLerr(SSL_F_SSL_CTX_SET_CT_VALIDATION_CALLBACK, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED); return 0; } ctx->ct_validation_callback = callback; ctx->ct_validation_callback_arg = arg; return 1; } int SSL_ct_is_enabled(const SSL *s) { return s->ct_validation_callback != NULL; } int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx) { return ctx->ct_validation_callback != NULL; } int ssl_validate_ct(SSL *s) { int ret = 0; X509 *cert = s->session != NULL ? s->session->peer : NULL; X509 *issuer; SSL_DANE *dane = &s->dane; CT_POLICY_EVAL_CTX *ctx = NULL; const STACK_OF(SCT) *scts; /* * If no callback is set, the peer is anonymous, or its chain is invalid, * skip SCT validation - just return success. Applications that continue * handshakes without certificates, with unverified chains, or pinned leaf * certificates are outside the scope of the WebPKI and CT. * * The above exclusions notwithstanding the vast majority of peers will * have rather ordinary certificate chains validated by typical * applications that perform certificate verification and therefore will * process SCTs when enabled. */ if (s->ct_validation_callback == NULL || cert == NULL || s->verify_result != X509_V_OK || s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1) return 1; /* * CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3) * trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2 */ if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) { switch (dane->mtlsa->usage) { case DANETLS_USAGE_DANE_TA: case DANETLS_USAGE_DANE_EE: return 1; } } ctx = CT_POLICY_EVAL_CTX_new(); if (ctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_VALIDATE_CT, ERR_R_MALLOC_FAILURE); goto end; } issuer = sk_X509_value(s->verified_chain, 1); CT_POLICY_EVAL_CTX_set1_cert(ctx, cert); CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer); CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, s->ctx->ctlog_store); CT_POLICY_EVAL_CTX_set_time( ctx, (uint64_t)SSL_SESSION_get_time(SSL_get0_session(s)) * 1000); scts = SSL_get0_peer_scts(s); /* * This function returns success (> 0) only when all the SCTs are valid, 0 * when some are invalid, and < 0 on various internal errors (out of * memory, etc.). Having some, or even all, invalid SCTs is not sufficient * reason to abort the handshake, that decision is up to the callback. * Therefore, we error out only in the unexpected case that the return * value is negative. * * XXX: One might well argue that the return value of this function is an * unfortunate design choice. Its job is only to determine the validation * status of each of the provided SCTs. So long as it correctly separates * the wheat from the chaff it should return success. Failure in this case * ought to correspond to an inability to carry out its duties. */ if (SCT_LIST_validate(scts, ctx) < 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT, SSL_R_SCT_VERIFICATION_FAILED); goto end; } ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg); if (ret < 0) ret = 0; /* This function returns 0 on failure */ if (!ret) SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT, SSL_R_CALLBACK_FAILED); end: CT_POLICY_EVAL_CTX_free(ctx); /* * With SSL_VERIFY_NONE the session may be cached and re-used despite a * failure return code here. Also the application may wish the complete * the handshake, and then disconnect cleanly at a higher layer, after * checking the verification status of the completed connection. * * We therefore force a certificate verification failure which will be * visible via SSL_get_verify_result() and cached as part of any resumed * session. * * Note: the permissive callback is for information gathering only, always * returns success, and does not affect verification status. Only the * strict callback or a custom application-specified callback can trigger * connection failure or record a verification error. */ if (ret <= 0) s->verify_result = X509_V_ERR_NO_VALID_SCTS; return ret; } int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode) { switch (validation_mode) { default: SSLerr(SSL_F_SSL_CTX_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE); return 0; case SSL_CT_VALIDATION_PERMISSIVE: return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL); case SSL_CT_VALIDATION_STRICT: return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL); } } int SSL_enable_ct(SSL *s, int validation_mode) { switch (validation_mode) { default: SSLerr(SSL_F_SSL_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE); return 0; case SSL_CT_VALIDATION_PERMISSIVE: return SSL_set_ct_validation_callback(s, ct_permissive, NULL); case SSL_CT_VALIDATION_STRICT: return SSL_set_ct_validation_callback(s, ct_strict, NULL); } } int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx) { return CTLOG_STORE_load_default_file(ctx->ctlog_store); } int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path) { return CTLOG_STORE_load_file(ctx->ctlog_store, path); } void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE * logs) { CTLOG_STORE_free(ctx->ctlog_store); ctx->ctlog_store = logs; } const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx) { return ctx->ctlog_store; } #endif /* OPENSSL_NO_CT */ void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb, void *arg) { c->client_hello_cb = cb; c->client_hello_cb_arg = arg; } int SSL_client_hello_isv2(SSL *s) { if (s->clienthello == NULL) return 0; return s->clienthello->isv2; } unsigned int SSL_client_hello_get0_legacy_version(SSL *s) { if (s->clienthello == NULL) return 0; return s->clienthello->legacy_version; } size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out) { if (s->clienthello == NULL) return 0; if (out != NULL) *out = s->clienthello->random; return SSL3_RANDOM_SIZE; } size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out) { if (s->clienthello == NULL) return 0; if (out != NULL) *out = s->clienthello->session_id; return s->clienthello->session_id_len; } size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out) { if (s->clienthello == NULL) return 0; if (out != NULL) *out = PACKET_data(&s->clienthello->ciphersuites); return PACKET_remaining(&s->clienthello->ciphersuites); } size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out) { if (s->clienthello == NULL) return 0; if (out != NULL) *out = s->clienthello->compressions; return s->clienthello->compressions_len; } int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen) { RAW_EXTENSION *ext; int *present; size_t num = 0, i; if (s->clienthello == NULL || out == NULL || outlen == NULL) return 0; for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) { ext = s->clienthello->pre_proc_exts + i; if (ext->present) num++; } if (num == 0) { *out = NULL; *outlen = 0; return 1; } if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) { SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT, ERR_R_MALLOC_FAILURE); return 0; } for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) { ext = s->clienthello->pre_proc_exts + i; if (ext->present) { if (ext->received_order >= num) goto err; present[ext->received_order] = ext->type; } } *out = present; *outlen = num; return 1; err: OPENSSL_free(present); return 0; } int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out, size_t *outlen) { size_t i; RAW_EXTENSION *r; if (s->clienthello == NULL) return 0; for (i = 0; i < s->clienthello->pre_proc_exts_len; ++i) { r = s->clienthello->pre_proc_exts + i; if (r->present && r->type == type) { if (out != NULL) *out = PACKET_data(&r->data); if (outlen != NULL) *outlen = PACKET_remaining(&r->data); return 1; } } return 0; } int SSL_free_buffers(SSL *ssl) { RECORD_LAYER *rl = &ssl->rlayer; if (RECORD_LAYER_read_pending(rl) || RECORD_LAYER_write_pending(rl)) return 0; RECORD_LAYER_release(rl); return 1; } int SSL_alloc_buffers(SSL *ssl) { return ssl3_setup_buffers(ssl); } void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb) { ctx->keylog_callback = cb; } SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx) { return ctx->keylog_callback; } static int nss_keylog_int(const char *prefix, SSL *ssl, const uint8_t *parameter_1, size_t parameter_1_len, const uint8_t *parameter_2, size_t parameter_2_len) { char *out = NULL; char *cursor = NULL; size_t out_len = 0; size_t i; size_t prefix_len; if (ssl->ctx->keylog_callback == NULL) return 1; /* * Our output buffer will contain the following strings, rendered with * space characters in between, terminated by a NULL character: first the * prefix, then the first parameter, then the second parameter. The * meaning of each parameter depends on the specific key material being * logged. Note that the first and second parameters are encoded in * hexadecimal, so we need a buffer that is twice their lengths. */ prefix_len = strlen(prefix); out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3; if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) { SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE); return 0; } strcpy(cursor, prefix); cursor += prefix_len; *cursor++ = ' '; for (i = 0; i < parameter_1_len; i++) { sprintf(cursor, "%02x", parameter_1[i]); cursor += 2; } *cursor++ = ' '; for (i = 0; i < parameter_2_len; i++) { sprintf(cursor, "%02x", parameter_2[i]); cursor += 2; } *cursor = '\0'; ssl->ctx->keylog_callback(ssl, (const char *)out); OPENSSL_clear_free(out, out_len); return 1; } int ssl_log_rsa_client_key_exchange(SSL *ssl, const uint8_t *encrypted_premaster, size_t encrypted_premaster_len, const uint8_t *premaster, size_t premaster_len) { if (encrypted_premaster_len < 8) { SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); return 0; } /* We only want the first 8 bytes of the encrypted premaster as a tag. */ return nss_keylog_int("RSA", ssl, encrypted_premaster, 8, premaster, premaster_len); } int ssl_log_secret(SSL *ssl, const char *label, const uint8_t *secret, size_t secret_len) { return nss_keylog_int(label, ssl, ssl->s3->client_random, SSL3_RANDOM_SIZE, secret, secret_len); } #define SSLV2_CIPHER_LEN 3 int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format) { int n; n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; if (PACKET_remaining(cipher_suites) == 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL_CACHE_CIPHERLIST, SSL_R_NO_CIPHERS_SPECIFIED); return 0; } if (PACKET_remaining(cipher_suites) % n != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); return 0; } OPENSSL_free(s->s3->tmp.ciphers_raw); s->s3->tmp.ciphers_raw = NULL; s->s3->tmp.ciphers_rawlen = 0; if (sslv2format) { size_t numciphers = PACKET_remaining(cipher_suites) / n; PACKET sslv2ciphers = *cipher_suites; unsigned int leadbyte; unsigned char *raw; /* * We store the raw ciphers list in SSLv3+ format so we need to do some * preprocessing to convert the list first. If there are any SSLv2 only * ciphersuites with a non-zero leading byte then we are going to * slightly over allocate because we won't store those. But that isn't a * problem. */ raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN); s->s3->tmp.ciphers_raw = raw; if (raw == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST, ERR_R_MALLOC_FAILURE); return 0; } for (s->s3->tmp.ciphers_rawlen = 0; PACKET_remaining(&sslv2ciphers) > 0; raw += TLS_CIPHER_LEN) { if (!PACKET_get_1(&sslv2ciphers, &leadbyte) || (leadbyte == 0 && !PACKET_copy_bytes(&sslv2ciphers, raw, TLS_CIPHER_LEN)) || (leadbyte != 0 && !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST, SSL_R_BAD_PACKET); OPENSSL_free(s->s3->tmp.ciphers_raw); s->s3->tmp.ciphers_raw = NULL; s->s3->tmp.ciphers_rawlen = 0; return 0; } if (leadbyte == 0) s->s3->tmp.ciphers_rawlen += TLS_CIPHER_LEN; } } else if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw, &s->s3->tmp.ciphers_rawlen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST, ERR_R_INTERNAL_ERROR); return 0; } return 1; } int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len, int isv2format, STACK_OF(SSL_CIPHER) **sk, STACK_OF(SSL_CIPHER) **scsvs) { PACKET pkt; if (!PACKET_buf_init(&pkt, bytes, len)) return 0; return bytes_to_cipher_list(s, &pkt, sk, scsvs, isv2format, 0); } int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites, STACK_OF(SSL_CIPHER) **skp, STACK_OF(SSL_CIPHER) **scsvs_out, int sslv2format, int fatal) { const SSL_CIPHER *c; STACK_OF(SSL_CIPHER) *sk = NULL; STACK_OF(SSL_CIPHER) *scsvs = NULL; int n; /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */ unsigned char cipher[SSLV2_CIPHER_LEN]; n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; if (PACKET_remaining(cipher_suites) == 0) { if (fatal) SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED); else SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED); return 0; } if (PACKET_remaining(cipher_suites) % n != 0) { if (fatal) SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); else SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); return 0; } sk = sk_SSL_CIPHER_new_null(); scsvs = sk_SSL_CIPHER_new_null(); if (sk == NULL || scsvs == NULL) { if (fatal) SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); else SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); goto err; } while (PACKET_copy_bytes(cipher_suites, cipher, n)) { /* * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the * first byte set to zero, while true SSLv2 ciphers have a non-zero * first byte. We don't support any true SSLv2 ciphers, so skip them. */ if (sslv2format && cipher[0] != '\0') continue; /* For SSLv2-compat, ignore leading 0-byte. */ c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1); if (c != NULL) { if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) || (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) { if (fatal) SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); else SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); goto err; } } } if (PACKET_remaining(cipher_suites) > 0) { if (fatal) SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_BAD_LENGTH); else SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_BAD_LENGTH); goto err; } if (skp != NULL) *skp = sk; else sk_SSL_CIPHER_free(sk); if (scsvs_out != NULL) *scsvs_out = scsvs; else sk_SSL_CIPHER_free(scsvs); return 1; err: sk_SSL_CIPHER_free(sk); sk_SSL_CIPHER_free(scsvs); return 0; } int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data) { ctx->max_early_data = max_early_data; return 1; } uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx) { return ctx->max_early_data; } int SSL_set_max_early_data(SSL *s, uint32_t max_early_data) { s->max_early_data = max_early_data; return 1; } uint32_t SSL_get_max_early_data(const SSL *s) { return s->max_early_data; } int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data) { ctx->recv_max_early_data = recv_max_early_data; return 1; } uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx) { return ctx->recv_max_early_data; } int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data) { s->recv_max_early_data = recv_max_early_data; return 1; } uint32_t SSL_get_recv_max_early_data(const SSL *s) { return s->recv_max_early_data; } __owur unsigned int ssl_get_max_send_fragment(const SSL *ssl) { /* Return any active Max Fragment Len extension */ if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session)) return GET_MAX_FRAGMENT_LENGTH(ssl->session); /* return current SSL connection setting */ return ssl->max_send_fragment; } __owur unsigned int ssl_get_split_send_fragment(const SSL *ssl) { /* Return a value regarding an active Max Fragment Len extension */ if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session) && ssl->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(ssl->session)) return GET_MAX_FRAGMENT_LENGTH(ssl->session); /* else limit |split_send_fragment| to current |max_send_fragment| */ if (ssl->split_send_fragment > ssl->max_send_fragment) return ssl->max_send_fragment; /* return current SSL connection setting */ return ssl->split_send_fragment; } int SSL_stateless(SSL *s) { int ret; /* Ensure there is no state left over from a previous invocation */ if (!SSL_clear(s)) return 0; ERR_clear_error(); s->s3->flags |= TLS1_FLAGS_STATELESS; ret = SSL_accept(s); s->s3->flags &= ~TLS1_FLAGS_STATELESS; if (ret > 0 && s->ext.cookieok) return 1; if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s)) return 0; return -1; } void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val) { ctx->pha_enabled = val; } void SSL_set_post_handshake_auth(SSL *ssl, int val) { ssl->pha_enabled = val; } int SSL_verify_client_post_handshake(SSL *ssl) { if (!SSL_IS_TLS13(ssl)) { SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_WRONG_SSL_VERSION); return 0; } if (!ssl->server) { SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_NOT_SERVER); return 0; } if (!SSL_is_init_finished(ssl)) { SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_STILL_IN_INIT); return 0; } switch (ssl->post_handshake_auth) { case SSL_PHA_NONE: SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_EXTENSION_NOT_RECEIVED); return 0; default: case SSL_PHA_EXT_SENT: SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, ERR_R_INTERNAL_ERROR); return 0; case SSL_PHA_EXT_RECEIVED: break; case SSL_PHA_REQUEST_PENDING: SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_PENDING); return 0; case SSL_PHA_REQUESTED: SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_SENT); return 0; } ssl->post_handshake_auth = SSL_PHA_REQUEST_PENDING; /* checks verify_mode and algorithm_auth */ if (!send_certificate_request(ssl)) { ssl->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */ SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_INVALID_CONFIG); return 0; } ossl_statem_set_in_init(ssl, 1); return 1; } int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, SSL_CTX_generate_session_ticket_fn gen_cb, SSL_CTX_decrypt_session_ticket_fn dec_cb, void *arg) { ctx->generate_ticket_cb = gen_cb; ctx->decrypt_ticket_cb = dec_cb; ctx->ticket_cb_data = arg; return 1; } void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx, SSL_allow_early_data_cb_fn cb, void *arg) { ctx->allow_early_data_cb = cb; ctx->allow_early_data_cb_data = arg; } void SSL_set_allow_early_data_cb(SSL *s, SSL_allow_early_data_cb_fn cb, void *arg) { s->allow_early_data_cb = cb; s->allow_early_data_cb_data = arg; } diff --git a/crypto/openssl/ssl/statem/extensions.c b/crypto/openssl/ssl/statem/extensions.c index c785ab785d38..3f3062fe86c0 100644 --- a/crypto/openssl/ssl/statem/extensions.c +++ b/crypto/openssl/ssl/statem/extensions.c @@ -1,1715 +1,1717 @@ /* * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include "internal/nelem.h" #include "internal/cryptlib.h" #include "../ssl_local.h" #include "statem_local.h" #include "internal/cryptlib.h" static int final_renegotiate(SSL *s, unsigned int context, int sent); static int init_server_name(SSL *s, unsigned int context); static int final_server_name(SSL *s, unsigned int context, int sent); #ifndef OPENSSL_NO_EC static int final_ec_pt_formats(SSL *s, unsigned int context, int sent); #endif static int init_session_ticket(SSL *s, unsigned int context); #ifndef OPENSSL_NO_OCSP static int init_status_request(SSL *s, unsigned int context); #endif #ifndef OPENSSL_NO_NEXTPROTONEG static int init_npn(SSL *s, unsigned int context); #endif static int init_alpn(SSL *s, unsigned int context); static int final_alpn(SSL *s, unsigned int context, int sent); static int init_sig_algs_cert(SSL *s, unsigned int context); static int init_sig_algs(SSL *s, unsigned int context); static int init_certificate_authorities(SSL *s, unsigned int context); static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx); static int tls_parse_certificate_authorities(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx); #ifndef OPENSSL_NO_SRP static int init_srp(SSL *s, unsigned int context); #endif static int init_etm(SSL *s, unsigned int context); static int init_ems(SSL *s, unsigned int context); static int final_ems(SSL *s, unsigned int context, int sent); static int init_psk_kex_modes(SSL *s, unsigned int context); #ifndef OPENSSL_NO_EC static int final_key_share(SSL *s, unsigned int context, int sent); #endif #ifndef OPENSSL_NO_SRTP static int init_srtp(SSL *s, unsigned int context); #endif static int final_sig_algs(SSL *s, unsigned int context, int sent); static int final_early_data(SSL *s, unsigned int context, int sent); static int final_maxfragmentlen(SSL *s, unsigned int context, int sent); static int init_post_handshake_auth(SSL *s, unsigned int context); /* Structure to define a built-in extension */ typedef struct extensions_definition_st { /* The defined type for the extension */ unsigned int type; /* * The context that this extension applies to, e.g. what messages and * protocol versions */ unsigned int context; /* * Initialise extension before parsing. Always called for relevant contexts * even if extension not present */ int (*init)(SSL *s, unsigned int context); /* Parse extension sent from client to server */ int (*parse_ctos)(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx); /* Parse extension send from server to client */ int (*parse_stoc)(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx); /* Construct extension sent from server to client */ EXT_RETURN (*construct_stoc)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx); /* Construct extension sent from client to server */ EXT_RETURN (*construct_ctos)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx); /* * Finalise extension after parsing. Always called where an extensions was * initialised even if the extension was not present. |sent| is set to 1 if * the extension was seen, or 0 otherwise. */ int (*final)(SSL *s, unsigned int context, int sent); } EXTENSION_DEFINITION; /* * Definitions of all built-in extensions. NOTE: Changes in the number or order * of these extensions should be mirrored with equivalent changes to the * indexes ( TLSEXT_IDX_* ) defined in ssl_local.h. * Each extension has an initialiser, a client and * server side parser and a finaliser. The initialiser is called (if the * extension is relevant to the given context) even if we did not see the * extension in the message that we received. The parser functions are only * called if we see the extension in the message. The finalisers are always * called if the initialiser was called. * There are also server and client side constructor functions which are always * called during message construction if the extension is relevant for the * given context. * The initialisation, parsing, finalisation and construction functions are * always called in the order defined in this list. Some extensions may depend * on others having been processed first, so the order of this list is * significant. * The extension context is defined by a series of flags which specify which * messages the extension is relevant to. These flags also specify whether the * extension is relevant to a particular protocol or protocol version. * * TODO(TLS1.3): Make sure we have a test to check the consistency of these * * NOTE: WebSphere Application Server 7+ cannot handle empty extensions at * the end, keep these extensions before signature_algorithm. */ #define INVALID_EXTENSION { 0x10000, 0, NULL, NULL, NULL, NULL, NULL, NULL } static const EXTENSION_DEFINITION ext_defs[] = { { TLSEXT_TYPE_renegotiate, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_SSL3_ALLOWED | SSL_EXT_TLS1_2_AND_BELOW_ONLY, NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate, tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate, final_renegotiate }, { TLSEXT_TYPE_server_name, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, init_server_name, tls_parse_ctos_server_name, tls_parse_stoc_server_name, tls_construct_stoc_server_name, tls_construct_ctos_server_name, final_server_name }, { TLSEXT_TYPE_max_fragment_length, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, NULL, tls_parse_ctos_maxfragmentlen, tls_parse_stoc_maxfragmentlen, tls_construct_stoc_maxfragmentlen, tls_construct_ctos_maxfragmentlen, final_maxfragmentlen }, #ifndef OPENSSL_NO_SRP { TLSEXT_TYPE_srp, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL }, #else INVALID_EXTENSION, #endif #ifndef OPENSSL_NO_EC { TLSEXT_TYPE_ec_point_formats, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, NULL, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats, tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats, final_ec_pt_formats }, { /* * "supported_groups" is spread across several specifications. * It was originally specified as "elliptic_curves" in RFC 4492, * and broadened to include named FFDH groups by RFC 7919. * Both RFCs 4492 and 7919 do not include a provision for the server * to indicate to the client the complete list of groups supported * by the server, with the server instead just indicating the * selected group for this connection in the ServerKeyExchange * message. TLS 1.3 adds a scheme for the server to indicate * to the client its list of supported groups in the * EncryptedExtensions message, but none of the relevant * specifications permit sending supported_groups in the ServerHello. * Nonetheless (possibly due to the close proximity to the * "ec_point_formats" extension, which is allowed in the ServerHello), * there are several servers that send this extension in the * ServerHello anyway. Up to and including the 1.1.0 release, * we did not check for the presence of nonpermitted extensions, * so to avoid a regression, we must permit this extension in the * TLS 1.2 ServerHello as well. * * Note that there is no tls_parse_stoc_supported_groups function, * so we do not perform any additional parsing, validation, or * processing on the server's group list -- this is just a minimal * change to preserve compatibility with these misbehaving servers. */ TLSEXT_TYPE_supported_groups, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_TLS1_2_SERVER_HELLO, NULL, tls_parse_ctos_supported_groups, NULL, tls_construct_stoc_supported_groups, tls_construct_ctos_supported_groups, NULL }, #else INVALID_EXTENSION, INVALID_EXTENSION, #endif { TLSEXT_TYPE_session_ticket, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, init_session_ticket, tls_parse_ctos_session_ticket, tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket, tls_construct_ctos_session_ticket, NULL }, #ifndef OPENSSL_NO_OCSP { TLSEXT_TYPE_status_request, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, init_status_request, tls_parse_ctos_status_request, tls_parse_stoc_status_request, tls_construct_stoc_status_request, tls_construct_ctos_status_request, NULL }, #else INVALID_EXTENSION, #endif #ifndef OPENSSL_NO_NEXTPROTONEG { TLSEXT_TYPE_next_proto_neg, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn, tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL }, #else INVALID_EXTENSION, #endif { /* * Must appear in this list after server_name so that finalisation * happens after server_name callbacks */ TLSEXT_TYPE_application_layer_protocol_negotiation, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn, tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn }, #ifndef OPENSSL_NO_SRTP { TLSEXT_TYPE_use_srtp, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_DTLS_ONLY, init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp, tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL }, #else INVALID_EXTENSION, #endif { TLSEXT_TYPE_encrypt_then_mac, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm, tls_construct_stoc_etm, tls_construct_ctos_etm, NULL }, #ifndef OPENSSL_NO_CT { TLSEXT_TYPE_signed_certificate_timestamp, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, NULL, /* * No server side support for this, but can be provided by a custom * extension. This is an exception to the rule that custom extensions * cannot override built in ones. */ NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct, NULL }, #else INVALID_EXTENSION, #endif { TLSEXT_TYPE_extended_master_secret, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems, tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems }, { TLSEXT_TYPE_signature_algorithms_cert, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, init_sig_algs_cert, tls_parse_ctos_sig_algs_cert, tls_parse_ctos_sig_algs_cert, /* We do not generate signature_algorithms_cert at present. */ NULL, NULL, NULL }, { TLSEXT_TYPE_post_handshake_auth, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY, init_post_handshake_auth, tls_parse_ctos_post_handshake_auth, NULL, NULL, tls_construct_ctos_post_handshake_auth, NULL, }, { TLSEXT_TYPE_signature_algorithms, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, init_sig_algs, tls_parse_ctos_sig_algs, tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs, tls_construct_ctos_sig_algs, final_sig_algs }, { TLSEXT_TYPE_supported_versions, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY, NULL, /* Processed inline as part of version selection */ NULL, tls_parse_stoc_supported_versions, tls_construct_stoc_supported_versions, tls_construct_ctos_supported_versions, NULL }, { TLSEXT_TYPE_psk_kex_modes, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL, tls_construct_ctos_psk_kex_modes, NULL }, #ifndef OPENSSL_NO_EC { /* * Must be in this list after supported_groups. We need that to have * been parsed before we do this one. */ TLSEXT_TYPE_key_share, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share, tls_construct_stoc_key_share, tls_construct_ctos_key_share, final_key_share }, #endif { /* Must be after key_share */ TLSEXT_TYPE_cookie, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, NULL, tls_parse_ctos_cookie, tls_parse_stoc_cookie, tls_construct_stoc_cookie, tls_construct_ctos_cookie, NULL }, { /* * Special unsolicited ServerHello extension only used when * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set. We allow it in a ClientHello but * ignore it. */ TLSEXT_TYPE_cryptopro_bug, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY, NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL }, { TLSEXT_TYPE_early_data, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_TLS1_3_NEW_SESSION_TICKET | SSL_EXT_TLS1_3_ONLY, NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data, tls_construct_stoc_early_data, tls_construct_ctos_early_data, final_early_data }, { TLSEXT_TYPE_certificate_authorities, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | SSL_EXT_TLS1_3_ONLY, init_certificate_authorities, tls_parse_certificate_authorities, tls_parse_certificate_authorities, tls_construct_certificate_authorities, tls_construct_certificate_authorities, NULL, }, { /* Must be immediately before pre_shared_key */ TLSEXT_TYPE_padding, SSL_EXT_CLIENT_HELLO, NULL, /* We send this, but don't read it */ NULL, NULL, NULL, tls_construct_ctos_padding, NULL }, { /* Required by the TLSv1.3 spec to always be the last extension */ TLSEXT_TYPE_psk, SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY, NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk, tls_construct_ctos_psk, NULL } }; /* Check whether an extension's context matches the current context */ static int validate_context(SSL *s, unsigned int extctx, unsigned int thisctx) { /* Check we're allowed to use this extension in this context */ if ((thisctx & extctx) == 0) return 0; if (SSL_IS_DTLS(s)) { if ((extctx & SSL_EXT_TLS_ONLY) != 0) return 0; } else if ((extctx & SSL_EXT_DTLS_ONLY) != 0) { return 0; } return 1; } int tls_validate_all_contexts(SSL *s, unsigned int thisctx, RAW_EXTENSION *exts) { size_t i, num_exts, builtin_num = OSSL_NELEM(ext_defs), offset; RAW_EXTENSION *thisext; unsigned int context; ENDPOINT role = ENDPOINT_BOTH; if ((thisctx & SSL_EXT_CLIENT_HELLO) != 0) role = ENDPOINT_SERVER; else if ((thisctx & SSL_EXT_TLS1_2_SERVER_HELLO) != 0) role = ENDPOINT_CLIENT; /* Calculate the number of extensions in the extensions list */ num_exts = builtin_num + s->cert->custext.meths_count; for (thisext = exts, i = 0; i < num_exts; i++, thisext++) { if (!thisext->present) continue; if (i < builtin_num) { context = ext_defs[i].context; } else { custom_ext_method *meth = NULL; meth = custom_ext_find(&s->cert->custext, role, thisext->type, &offset); if (!ossl_assert(meth != NULL)) return 0; context = meth->context; } if (!validate_context(s, context, thisctx)) return 0; } return 1; } /* * Verify whether we are allowed to use the extension |type| in the current * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to * indicate the extension is not allowed. If returning 1 then |*found| is set to * the definition for the extension we found. */ static int verify_extension(SSL *s, unsigned int context, unsigned int type, custom_ext_methods *meths, RAW_EXTENSION *rawexlist, RAW_EXTENSION **found) { size_t i; size_t builtin_num = OSSL_NELEM(ext_defs); const EXTENSION_DEFINITION *thisext; for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) { if (type == thisext->type) { if (!validate_context(s, thisext->context, context)) return 0; *found = &rawexlist[i]; return 1; } } /* Check the custom extensions */ if (meths != NULL) { size_t offset = 0; ENDPOINT role = ENDPOINT_BOTH; custom_ext_method *meth = NULL; if ((context & SSL_EXT_CLIENT_HELLO) != 0) role = ENDPOINT_SERVER; else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0) role = ENDPOINT_CLIENT; meth = custom_ext_find(meths, role, type, &offset); if (meth != NULL) { if (!validate_context(s, meth->context, context)) return 0; *found = &rawexlist[offset + builtin_num]; return 1; } } /* Unknown extension. We allow it */ *found = NULL; return 1; } /* * Check whether the context defined for an extension |extctx| means whether * the extension is relevant for the current context |thisctx| or not. Returns * 1 if the extension is relevant for this context, and 0 otherwise */ int extension_is_relevant(SSL *s, unsigned int extctx, unsigned int thisctx) { int is_tls13; /* * For HRR we haven't selected the version yet but we know it will be * TLSv1.3 */ if ((thisctx & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) is_tls13 = 1; else is_tls13 = SSL_IS_TLS13(s); if ((SSL_IS_DTLS(s) && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0) || (s->version == SSL3_VERSION && (extctx & SSL_EXT_SSL3_ALLOWED) == 0) /* * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated", * which is never true when generating the ClientHello. * However, version negotiation *has* occurred by the time the * ClientHello extensions are being parsed. * Be careful to allow TLS 1.3-only extensions when generating * the ClientHello. */ || (is_tls13 && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0) || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0 && (thisctx & SSL_EXT_CLIENT_HELLO) == 0) || (s->server && !is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0) || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0)) return 0; return 1; } /* * Gather a list of all the extensions from the data in |packet]. |context| * tells us which message this extension is for. The raw extension data is * stored in |*res| on success. We don't actually process the content of the * extensions yet, except to check their types. This function also runs the * initialiser functions for all known extensions if |init| is nonzero (whether * we have collected them or not). If successful the caller is responsible for * freeing the contents of |*res|. * * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be * more than one extension of the same type in a ClientHello or ServerHello. * This function returns 1 if all extensions are unique and we have parsed their * types, and 0 if the extensions contain duplicates, could not be successfully * found, or an internal error occurred. We only check duplicates for * extensions that we know about. We ignore others. */ int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context, RAW_EXTENSION **res, size_t *len, int init) { PACKET extensions = *packet; size_t i = 0; size_t num_exts; custom_ext_methods *exts = &s->cert->custext; RAW_EXTENSION *raw_extensions = NULL; const EXTENSION_DEFINITION *thisexd; *res = NULL; /* * Initialise server side custom extensions. Client side is done during * construction of extensions for the ClientHello. */ if ((context & SSL_EXT_CLIENT_HELLO) != 0) custom_ext_init(&s->cert->custext); num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0); raw_extensions = OPENSSL_zalloc(num_exts * sizeof(*raw_extensions)); if (raw_extensions == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_COLLECT_EXTENSIONS, ERR_R_MALLOC_FAILURE); return 0; } i = 0; while (PACKET_remaining(&extensions) > 0) { unsigned int type, idx; PACKET extension; RAW_EXTENSION *thisex; if (!PACKET_get_net_2(&extensions, &type) || !PACKET_get_length_prefixed_2(&extensions, &extension)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION); goto err; } /* * Verify this extension is allowed. We only check duplicates for * extensions that we recognise. We also have a special case for the * PSK extension, which must be the last one in the ClientHello. */ if (!verify_extension(s, context, type, exts, raw_extensions, &thisex) || (thisex != NULL && thisex->present == 1) || (type == TLSEXT_TYPE_psk && (context & SSL_EXT_CLIENT_HELLO) != 0 && PACKET_remaining(&extensions) != 0)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION); goto err; } idx = thisex - raw_extensions; /*- * Check that we requested this extension (if appropriate). Requests can * be sent in the ClientHello and CertificateRequest. Unsolicited * extensions can be sent in the NewSessionTicket. We only do this for * the built-in extensions. Custom extensions have a different but * similar check elsewhere. * Special cases: * - The HRR cookie extension is unsolicited * - The renegotiate extension is unsolicited (the client signals * support via an SCSV) * - The signed_certificate_timestamp extension can be provided by a * custom extension or by the built-in version. We let the extension * itself handle unsolicited response checks. */ if (idx < OSSL_NELEM(ext_defs) && (context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) == 0 && type != TLSEXT_TYPE_cookie && type != TLSEXT_TYPE_renegotiate && type != TLSEXT_TYPE_signed_certificate_timestamp && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0 #ifndef OPENSSL_NO_GOST && !((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 && type == TLSEXT_TYPE_cryptopro_bug) #endif ) { SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_UNSOLICITED_EXTENSION); goto err; } if (thisex != NULL) { thisex->data = extension; thisex->present = 1; thisex->type = type; thisex->received_order = i++; if (s->ext.debug_cb) s->ext.debug_cb(s, !s->server, thisex->type, PACKET_data(&thisex->data), PACKET_remaining(&thisex->data), s->ext.debug_arg); } } if (init) { /* * Initialise all known extensions relevant to this context, * whether we have found them or not */ for (thisexd = ext_defs, i = 0; i < OSSL_NELEM(ext_defs); i++, thisexd++) { if (thisexd->init != NULL && (thisexd->context & context) != 0 && extension_is_relevant(s, thisexd->context, context) && !thisexd->init(s, context)) { /* SSLfatal() already called */ goto err; } } } *res = raw_extensions; if (len != NULL) *len = num_exts; return 1; err: OPENSSL_free(raw_extensions); return 0; } /* * Runs the parser for a given extension with index |idx|. |exts| contains the * list of all parsed extensions previously collected by * tls_collect_extensions(). The parser is only run if it is applicable for the * given |context| and the parser has not already been run. If this is for a * Certificate message, then we also provide the parser with the relevant * Certificate |x| and its position in the |chainidx| with 0 being the first * Certificate. Returns 1 on success or 0 on failure. If an extension is not * present this counted as success. */ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context, RAW_EXTENSION *exts, X509 *x, size_t chainidx) { RAW_EXTENSION *currext = &exts[idx]; int (*parser)(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) = NULL; /* Skip if the extension is not present */ if (!currext->present) return 1; /* Skip if we've already parsed this extension */ if (currext->parsed) return 1; currext->parsed = 1; if (idx < OSSL_NELEM(ext_defs)) { /* We are handling a built-in extension */ const EXTENSION_DEFINITION *extdef = &ext_defs[idx]; /* Check if extension is defined for our protocol. If not, skip */ if (!extension_is_relevant(s, extdef->context, context)) return 1; parser = s->server ? extdef->parse_ctos : extdef->parse_stoc; if (parser != NULL) return parser(s, &currext->data, context, x, chainidx); /* * If the parser is NULL we fall through to the custom extension * processing */ } /* Parse custom extensions */ return custom_ext_parse(s, context, currext->type, PACKET_data(&currext->data), PACKET_remaining(&currext->data), x, chainidx); } /* * Parse all remaining extensions that have not yet been parsed. Also calls the * finalisation for all extensions at the end if |fin| is nonzero, whether we * collected them or not. Returns 1 for success or 0 for failure. If we are * working on a Certificate message then we also pass the Certificate |x| and * its position in the |chainidx|, with 0 being the first certificate. */ int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts, X509 *x, size_t chainidx, int fin) { size_t i, numexts = OSSL_NELEM(ext_defs); const EXTENSION_DEFINITION *thisexd; /* Calculate the number of extensions in the extensions list */ numexts += s->cert->custext.meths_count; /* Parse each extension in turn */ for (i = 0; i < numexts; i++) { if (!tls_parse_extension(s, i, context, exts, x, chainidx)) { /* SSLfatal() already called */ return 0; } } if (fin) { /* * Finalise all known extensions relevant to this context, * whether we have found them or not */ for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) { if (thisexd->final != NULL && (thisexd->context & context) != 0 && !thisexd->final(s, context, exts[i].present)) { /* SSLfatal() already called */ return 0; } } } return 1; } int should_add_extension(SSL *s, unsigned int extctx, unsigned int thisctx, int max_version) { /* Skip if not relevant for our context */ if ((extctx & thisctx) == 0) return 0; /* Check if this extension is defined for our protocol. If not, skip */ if (!extension_is_relevant(s, extctx, thisctx) || ((extctx & SSL_EXT_TLS1_3_ONLY) != 0 && (thisctx & SSL_EXT_CLIENT_HELLO) != 0 && (SSL_IS_DTLS(s) || max_version < TLS1_3_VERSION))) return 0; return 1; } /* * Construct all the extensions relevant to the current |context| and write * them to |pkt|. If this is an extension for a Certificate in a Certificate * message, then |x| will be set to the Certificate we are handling, and * |chainidx| will indicate the position in the chainidx we are processing (with * 0 being the first in the chain). Returns 1 on success or 0 on failure. On a * failure construction stops at the first extension to fail to construct. */ int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { size_t i; int min_version, max_version = 0, reason; const EXTENSION_DEFINITION *thisexd; if (!WPACKET_start_sub_packet_u16(pkt) /* * If extensions are of zero length then we don't even add the * extensions length bytes to a ClientHello/ServerHello * (for non-TLSv1.3). */ || ((context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0 && !WPACKET_set_flags(pkt, WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR); return 0; } if ((context & SSL_EXT_CLIENT_HELLO) != 0) { reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); if (reason != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS, reason); return 0; } } /* Add custom extensions first */ if ((context & SSL_EXT_CLIENT_HELLO) != 0) { /* On the server side with initialise during ClientHello parsing */ custom_ext_init(&s->cert->custext); } if (!custom_ext_add(s, context, pkt, x, chainidx, max_version)) { /* SSLfatal() already called */ return 0; } for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) { EXT_RETURN (*construct)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx); EXT_RETURN ret; /* Skip if not relevant for our context */ if (!should_add_extension(s, thisexd->context, context, max_version)) continue; construct = s->server ? thisexd->construct_stoc : thisexd->construct_ctos; if (construct == NULL) continue; ret = construct(s, pkt, context, x, chainidx); if (ret == EXT_RETURN_FAIL) { /* SSLfatal() already called */ return 0; } if (ret == EXT_RETURN_SENT && (context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) != 0) s->ext.extflags[i] |= SSL_EXT_FLAG_SENT; } if (!WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR); return 0; } return 1; } /* * Built in extension finalisation and initialisation functions. All initialise * or finalise the associated extension type for the given |context|. For * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0 * otherwise. These functions return 1 on success or 0 on failure. */ static int final_renegotiate(SSL *s, unsigned int context, int sent) { if (!s->server) { /* * Check if we can connect to a server that doesn't support safe * renegotiation */ if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT) && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) && !sent) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_RENEGOTIATE, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); return 0; } return 1; } /* Need RI if renegotiating */ if (s->renegotiate && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) && !sent) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_RENEGOTIATE, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); return 0; } return 1; } static int init_server_name(SSL *s, unsigned int context) { if (s->server) { s->servername_done = 0; OPENSSL_free(s->ext.hostname); s->ext.hostname = NULL; } return 1; } static int final_server_name(SSL *s, unsigned int context, int sent) { int ret = SSL_TLSEXT_ERR_NOACK; int altmp = SSL_AD_UNRECOGNIZED_NAME; int was_ticket = (SSL_get_options(s) & SSL_OP_NO_TICKET) == 0; if (!ossl_assert(s->ctx != NULL) || !ossl_assert(s->session_ctx != NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME, ERR_R_INTERNAL_ERROR); return 0; } if (s->ctx->ext.servername_cb != NULL) ret = s->ctx->ext.servername_cb(s, &altmp, s->ctx->ext.servername_arg); else if (s->session_ctx->ext.servername_cb != NULL) ret = s->session_ctx->ext.servername_cb(s, &altmp, s->session_ctx->ext.servername_arg); /* * For servers, propagate the SNI hostname from the temporary * storage in the SSL to the persistent SSL_SESSION, now that we * know we accepted it. * Clients make this copy when parsing the server's response to * the extension, which is when they find out that the negotiation * was successful. */ if (s->server) { if (sent && ret == SSL_TLSEXT_ERR_OK && !s->hit) { /* Only store the hostname in the session if we accepted it. */ OPENSSL_free(s->session->ext.hostname); s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); if (s->session->ext.hostname == NULL && s->ext.hostname != NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME, ERR_R_INTERNAL_ERROR); } } } /* * If we switched contexts (whether here or in the client_hello callback), * move the sess_accept increment from the session_ctx to the new * context, to avoid the confusing situation of having sess_accept_good * exceed sess_accept (zero) for the new context. */ if (SSL_IS_FIRST_HANDSHAKE(s) && s->ctx != s->session_ctx) { tsan_counter(&s->ctx->stats.sess_accept); tsan_decr(&s->session_ctx->stats.sess_accept); } /* * If we're expecting to send a ticket, and tickets were previously enabled, * and now tickets are disabled, then turn off expected ticket. * Also, if this is not a resumption, create a new session ID */ if (ret == SSL_TLSEXT_ERR_OK && s->ext.ticket_expected && was_ticket && (SSL_get_options(s) & SSL_OP_NO_TICKET) != 0) { s->ext.ticket_expected = 0; if (!s->hit) { SSL_SESSION* ss = SSL_get_session(s); if (ss != NULL) { OPENSSL_free(ss->ext.tick); ss->ext.tick = NULL; ss->ext.ticklen = 0; ss->ext.tick_lifetime_hint = 0; ss->ext.tick_age_add = 0; if (!ssl_generate_session_id(s, ss)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME, ERR_R_INTERNAL_ERROR); return 0; } } else { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME, ERR_R_INTERNAL_ERROR); return 0; } } } switch (ret) { case SSL_TLSEXT_ERR_ALERT_FATAL: SSLfatal(s, altmp, SSL_F_FINAL_SERVER_NAME, SSL_R_CALLBACK_FAILED); return 0; case SSL_TLSEXT_ERR_ALERT_WARNING: /* TLSv1.3 doesn't have warning alerts so we suppress this */ if (!SSL_IS_TLS13(s)) ssl3_send_alert(s, SSL3_AL_WARNING, altmp); s->servername_done = 0; return 1; case SSL_TLSEXT_ERR_NOACK: s->servername_done = 0; return 1; default: return 1; } } #ifndef OPENSSL_NO_EC static int final_ec_pt_formats(SSL *s, unsigned int context, int sent) { unsigned long alg_k, alg_a; if (s->server) return 1; alg_k = s->s3->tmp.new_cipher->algorithm_mkey; alg_a = s->s3->tmp.new_cipher->algorithm_auth; /* * If we are client and using an elliptic curve cryptography cipher * suite, then if server returns an EC point formats lists extension it * must contain uncompressed. */ if (s->ext.ecpointformats != NULL && s->ext.ecpointformats_len > 0 && s->ext.peer_ecpointformats != NULL && s->ext.peer_ecpointformats_len > 0 && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) { /* we are using an ECC cipher */ size_t i; unsigned char *list = s->ext.peer_ecpointformats; for (i = 0; i < s->ext.peer_ecpointformats_len; i++) { if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed) break; } if (i == s->ext.peer_ecpointformats_len) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_FINAL_EC_PT_FORMATS, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); return 0; } } return 1; } #endif static int init_session_ticket(SSL *s, unsigned int context) { if (!s->server) s->ext.ticket_expected = 0; return 1; } #ifndef OPENSSL_NO_OCSP static int init_status_request(SSL *s, unsigned int context) { if (s->server) { s->ext.status_type = TLSEXT_STATUSTYPE_nothing; } else { /* * Ensure we get sensible values passed to tlsext_status_cb in the event * that we don't receive a status message */ OPENSSL_free(s->ext.ocsp.resp); s->ext.ocsp.resp = NULL; s->ext.ocsp.resp_len = 0; } return 1; } #endif #ifndef OPENSSL_NO_NEXTPROTONEG static int init_npn(SSL *s, unsigned int context) { s->s3->npn_seen = 0; return 1; } #endif static int init_alpn(SSL *s, unsigned int context) { OPENSSL_free(s->s3->alpn_selected); s->s3->alpn_selected = NULL; s->s3->alpn_selected_len = 0; if (s->server) { OPENSSL_free(s->s3->alpn_proposed); s->s3->alpn_proposed = NULL; s->s3->alpn_proposed_len = 0; } return 1; } static int final_alpn(SSL *s, unsigned int context, int sent) { if (!s->server && !sent && s->session->ext.alpn_selected != NULL) s->ext.early_data_ok = 0; if (!s->server || !SSL_IS_TLS13(s)) return 1; /* * Call alpn_select callback if needed. Has to be done after SNI and * cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3 * we also have to do this before we decide whether to accept early_data. * In TLSv1.3 we've already negotiated our cipher so we do this call now. * For < TLSv1.3 we defer it until after cipher negotiation. * * On failure SSLfatal() already called. */ return tls_handle_alpn(s); } static int init_sig_algs(SSL *s, unsigned int context) { /* Clear any signature algorithms extension received */ OPENSSL_free(s->s3->tmp.peer_sigalgs); s->s3->tmp.peer_sigalgs = NULL; + s->s3->tmp.peer_sigalgslen = 0; return 1; } static int init_sig_algs_cert(SSL *s, unsigned int context) { /* Clear any signature algorithms extension received */ OPENSSL_free(s->s3->tmp.peer_cert_sigalgs); s->s3->tmp.peer_cert_sigalgs = NULL; + s->s3->tmp.peer_cert_sigalgslen = 0; return 1; } #ifndef OPENSSL_NO_SRP static int init_srp(SSL *s, unsigned int context) { OPENSSL_free(s->srp_ctx.login); s->srp_ctx.login = NULL; return 1; } #endif static int init_etm(SSL *s, unsigned int context) { s->ext.use_etm = 0; return 1; } static int init_ems(SSL *s, unsigned int context) { if (s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) { s->s3->flags &= ~TLS1_FLAGS_RECEIVED_EXTMS; s->s3->flags |= TLS1_FLAGS_REQUIRED_EXTMS; } return 1; } static int final_ems(SSL *s, unsigned int context, int sent) { /* * Check extended master secret extension is not dropped on * renegotiation. */ if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) && (s->s3->flags & TLS1_FLAGS_REQUIRED_EXTMS)) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_EMS, SSL_R_INCONSISTENT_EXTMS); return 0; } if (!s->server && s->hit) { /* * Check extended master secret extension is consistent with * original session. */ if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) != !(s->session->flags & SSL_SESS_FLAG_EXTMS)) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_EMS, SSL_R_INCONSISTENT_EXTMS); return 0; } } return 1; } static int init_certificate_authorities(SSL *s, unsigned int context) { sk_X509_NAME_pop_free(s->s3->tmp.peer_ca_names, X509_NAME_free); s->s3->tmp.peer_ca_names = NULL; return 1; } static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { const STACK_OF(X509_NAME) *ca_sk = get_ca_names(s); if (ca_sk == NULL || sk_X509_NAME_num(ca_sk) == 0) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_certificate_authorities) || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } if (!construct_ca_names(s, ca_sk, pkt)) { /* SSLfatal() already called */ return EXT_RETURN_FAIL; } if (!WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } static int tls_parse_certificate_authorities(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (!parse_ca_names(s, pkt)) return 0; if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CERTIFICATE_AUTHORITIES, SSL_R_BAD_EXTENSION); return 0; } return 1; } #ifndef OPENSSL_NO_SRTP static int init_srtp(SSL *s, unsigned int context) { if (s->server) s->srtp_profile = NULL; return 1; } #endif static int final_sig_algs(SSL *s, unsigned int context, int sent) { if (!sent && SSL_IS_TLS13(s) && !s->hit) { SSLfatal(s, TLS13_AD_MISSING_EXTENSION, SSL_F_FINAL_SIG_ALGS, SSL_R_MISSING_SIGALGS_EXTENSION); return 0; } return 1; } #ifndef OPENSSL_NO_EC static int final_key_share(SSL *s, unsigned int context, int sent) { if (!SSL_IS_TLS13(s)) return 1; /* Nothing to do for key_share in an HRR */ if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) return 1; /* * If * we are a client * AND * we have no key_share * AND * (we are not resuming * OR the kex_mode doesn't allow non key_share resumes) * THEN * fail; */ if (!s->server && !sent && (!s->hit || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0)) { /* Nothing left we can do - just fail */ SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_F_FINAL_KEY_SHARE, SSL_R_NO_SUITABLE_KEY_SHARE); return 0; } /* * IF * we are a server * THEN * IF * we have a suitable key_share * THEN * IF * we are stateless AND we have no cookie * THEN * send a HelloRetryRequest * ELSE * IF * we didn't already send a HelloRetryRequest * AND * the client sent a key_share extension * AND * (we are not resuming * OR the kex_mode allows key_share resumes) * AND * a shared group exists * THEN * send a HelloRetryRequest * ELSE IF * we are not resuming * OR * the kex_mode doesn't allow non key_share resumes * THEN * fail * ELSE IF * we are stateless AND we have no cookie * THEN * send a HelloRetryRequest */ if (s->server) { if (s->s3->peer_tmp != NULL) { /* We have a suitable key_share */ if ((s->s3->flags & TLS1_FLAGS_STATELESS) != 0 && !s->ext.cookieok) { if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) { /* * If we are stateless then we wouldn't know about any * previously sent HRR - so how can this be anything other * than 0? */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_KEY_SHARE, ERR_R_INTERNAL_ERROR); return 0; } s->hello_retry_request = SSL_HRR_PENDING; return 1; } } else { /* No suitable key_share */ if (s->hello_retry_request == SSL_HRR_NONE && sent && (!s->hit || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) != 0)) { const uint16_t *pgroups, *clntgroups; size_t num_groups, clnt_num_groups, i; unsigned int group_id = 0; /* Check if a shared group exists */ /* Get the clients list of supported groups. */ tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups); tls1_get_supported_groups(s, &pgroups, &num_groups); /* * Find the first group we allow that is also in client's list */ for (i = 0; i < num_groups; i++) { group_id = pgroups[i]; if (check_in_list(s, group_id, clntgroups, clnt_num_groups, 1)) break; } if (i < num_groups) { /* A shared group exists so send a HelloRetryRequest */ s->s3->group_id = group_id; s->hello_retry_request = SSL_HRR_PENDING; return 1; } } if (!s->hit || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0) { /* Nothing left we can do - just fail */ SSLfatal(s, sent ? SSL_AD_HANDSHAKE_FAILURE : SSL_AD_MISSING_EXTENSION, SSL_F_FINAL_KEY_SHARE, SSL_R_NO_SUITABLE_KEY_SHARE); return 0; } if ((s->s3->flags & TLS1_FLAGS_STATELESS) != 0 && !s->ext.cookieok) { if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) { /* * If we are stateless then we wouldn't know about any * previously sent HRR - so how can this be anything other * than 0? */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_KEY_SHARE, ERR_R_INTERNAL_ERROR); return 0; } s->hello_retry_request = SSL_HRR_PENDING; return 1; } } /* * We have a key_share so don't send any more HelloRetryRequest * messages */ if (s->hello_retry_request == SSL_HRR_PENDING) s->hello_retry_request = SSL_HRR_COMPLETE; } else { /* * For a client side resumption with no key_share we need to generate * the handshake secret (otherwise this is done during key_share * processing). */ if (!sent && !tls13_generate_handshake_secret(s, NULL, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_KEY_SHARE, ERR_R_INTERNAL_ERROR); return 0; } } return 1; } #endif static int init_psk_kex_modes(SSL *s, unsigned int context) { s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_NONE; return 1; } int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart, size_t binderoffset, const unsigned char *binderin, unsigned char *binderout, SSL_SESSION *sess, int sign, int external) { EVP_PKEY *mackey = NULL; EVP_MD_CTX *mctx = NULL; unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE]; unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE]; unsigned char *early_secret; #ifdef CHARSET_EBCDIC static const unsigned char resumption_label[] = { 0x72, 0x65, 0x73, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 }; static const unsigned char external_label[] = { 0x65, 0x78, 0x74, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 }; #else static const unsigned char resumption_label[] = "res binder"; static const unsigned char external_label[] = "ext binder"; #endif const unsigned char *label; size_t bindersize, labelsize, hashsize; int hashsizei = EVP_MD_size(md); int ret = -1; int usepskfored = 0; /* Ensure cast to size_t is safe */ if (!ossl_assert(hashsizei >= 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } hashsize = (size_t)hashsizei; if (external && s->early_data_state == SSL_EARLY_DATA_CONNECTING && s->session->ext.max_early_data == 0 && sess->ext.max_early_data > 0) usepskfored = 1; if (external) { label = external_label; labelsize = sizeof(external_label) - 1; } else { label = resumption_label; labelsize = sizeof(resumption_label) - 1; } /* * Generate the early_secret. On the server side we've selected a PSK to * resume with (internal or external) so we always do this. On the client * side we do this for a non-external (i.e. resumption) PSK or external PSK * that will be used for early_data so that it is in place for sending early * data. For client side external PSK not being used for early_data we * generate it but store it away for later use. */ if (s->server || !external || usepskfored) early_secret = (unsigned char *)s->early_secret; else early_secret = (unsigned char *)sess->early_secret; if (!tls13_generate_secret(s, md, NULL, sess->master_key, sess->master_key_length, early_secret)) { /* SSLfatal() already called */ goto err; } /* * Create the handshake hash for the binder key...the messages so far are * empty! */ mctx = EVP_MD_CTX_new(); if (mctx == NULL || EVP_DigestInit_ex(mctx, md, NULL) <= 0 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } /* Generate the binder key */ if (!tls13_hkdf_expand(s, md, early_secret, label, labelsize, hash, hashsize, binderkey, hashsize, 1)) { /* SSLfatal() already called */ goto err; } /* Generate the finished key */ if (!tls13_derive_finishedkey(s, md, binderkey, finishedkey, hashsize)) { /* SSLfatal() already called */ goto err; } if (EVP_DigestInit_ex(mctx, md, NULL) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } /* * Get a hash of the ClientHello up to the start of the binders. If we are * following a HelloRetryRequest then this includes the hash of the first * ClientHello and the HelloRetryRequest itself. */ if (s->hello_retry_request == SSL_HRR_PENDING) { size_t hdatalen; long hdatalen_l; void *hdata; hdatalen = hdatalen_l = BIO_get_mem_data(s->s3->handshake_buffer, &hdata); if (hdatalen_l <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, SSL_R_BAD_HANDSHAKE_LENGTH); goto err; } /* * For servers the handshake buffer data will include the second * ClientHello - which we don't want - so we need to take that bit off. */ if (s->server) { PACKET hashprefix, msg; /* Find how many bytes are left after the first two messages */ if (!PACKET_buf_init(&hashprefix, hdata, hdatalen) || !PACKET_forward(&hashprefix, 1) || !PACKET_get_length_prefixed_3(&hashprefix, &msg) || !PACKET_forward(&hashprefix, 1) || !PACKET_get_length_prefixed_3(&hashprefix, &msg)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } hdatalen -= PACKET_remaining(&hashprefix); } if (EVP_DigestUpdate(mctx, hdata, hdatalen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } } if (EVP_DigestUpdate(mctx, msgstart, binderoffset) <= 0 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } mackey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, finishedkey, hashsize); if (mackey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } if (!sign) binderout = tmpbinder; bindersize = hashsize; if (EVP_DigestSignInit(mctx, NULL, md, NULL, mackey) <= 0 || EVP_DigestSignUpdate(mctx, hash, hashsize) <= 0 || EVP_DigestSignFinal(mctx, binderout, &bindersize) <= 0 || bindersize != hashsize) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER, ERR_R_INTERNAL_ERROR); goto err; } if (sign) { ret = 1; } else { /* HMAC keys can't do EVP_DigestVerify* - use CRYPTO_memcmp instead */ ret = (CRYPTO_memcmp(binderin, binderout, hashsize) == 0); if (!ret) SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PSK_DO_BINDER, SSL_R_BINDER_DOES_NOT_VERIFY); } err: OPENSSL_cleanse(binderkey, sizeof(binderkey)); OPENSSL_cleanse(finishedkey, sizeof(finishedkey)); EVP_PKEY_free(mackey); EVP_MD_CTX_free(mctx); return ret; } static int final_early_data(SSL *s, unsigned int context, int sent) { if (!sent) return 1; if (!s->server) { if (context == SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS && sent && !s->ext.early_data_ok) { /* * If we get here then the server accepted our early_data but we * later realised that it shouldn't have done (e.g. inconsistent * ALPN) */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_FINAL_EARLY_DATA, SSL_R_BAD_EARLY_DATA); return 0; } return 1; } if (s->max_early_data == 0 || !s->hit || s->early_data_state != SSL_EARLY_DATA_ACCEPTING || !s->ext.early_data_ok || s->hello_retry_request != SSL_HRR_NONE || (s->allow_early_data_cb != NULL && !s->allow_early_data_cb(s, s->allow_early_data_cb_data))) { s->ext.early_data = SSL_EARLY_DATA_REJECTED; } else { s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; if (!tls13_change_cipher_state(s, SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) { /* SSLfatal() already called */ return 0; } } return 1; } static int final_maxfragmentlen(SSL *s, unsigned int context, int sent) { /* * Session resumption on server-side with MFL extension active * BUT MFL extension packet was not resent (i.e. sent == 0) */ if (s->server && s->hit && USE_MAX_FRAGMENT_LENGTH_EXT(s->session) && !sent ) { SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_F_FINAL_MAXFRAGMENTLEN, SSL_R_BAD_EXTENSION); return 0; } /* Current SSL buffer is lower than requested MFL */ if (s->session && USE_MAX_FRAGMENT_LENGTH_EXT(s->session) && s->max_send_fragment < GET_MAX_FRAGMENT_LENGTH(s->session)) /* trigger a larger buffer reallocation */ if (!ssl3_setup_buffers(s)) { /* SSLfatal() already called */ return 0; } return 1; } static int init_post_handshake_auth(SSL *s, unsigned int context) { s->post_handshake_auth = SSL_PHA_NONE; return 1; } diff --git a/crypto/openssl/ssl/statem/extensions_clnt.c b/crypto/openssl/ssl/statem/extensions_clnt.c index bcce0f1d9534..00a902ac79e9 100644 --- a/crypto/openssl/ssl/statem/extensions_clnt.c +++ b/crypto/openssl/ssl/statem/extensions_clnt.c @@ -1,2001 +1,2011 @@ /* * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include "../ssl_local.h" #include "internal/cryptlib.h" #include "statem_local.h" EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { /* Add RI if renegotiating */ if (!s->renegotiate) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished, s->s3->previous_client_finished_len) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->ext.hostname == NULL) return EXT_RETURN_NOT_SENT; /* Add TLS extension servername to the Client Hello message */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) /* Sub-packet for server_name extension */ || !WPACKET_start_sub_packet_u16(pkt) /* Sub-packet for servername list (always 1 hostname)*/ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name) || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname, strlen(s->ext.hostname)) || !WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } /* Push a Max Fragment Len extension into ClientHello */ EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED) return EXT_RETURN_NOT_SENT; /* Add Max Fragment Length extension if client enabled it. */ /*- * 4 bytes for this extension type and extension length * 1 byte for the Max Fragment Length code value. */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) /* Sub-packet for Max Fragment Length extension (1 byte) */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_SRP EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { /* Add SRP username if there is one */ if (s->srp_ctx.login == NULL) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp) /* Sub-packet for SRP extension */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u8(pkt) /* login must not be zero...internal error if so */ || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) || !WPACKET_memcpy(pkt, s->srp_ctx.login, strlen(s->srp_ctx.login)) || !WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #endif #ifndef OPENSSL_NO_EC static int use_ecc(SSL *s) { int i, end, ret = 0; unsigned long alg_k, alg_a; STACK_OF(SSL_CIPHER) *cipher_stack = NULL; /* See if we support any ECC ciphersuites */ if (s->version == SSL3_VERSION) return 0; cipher_stack = SSL_get1_supported_ciphers(s); end = sk_SSL_CIPHER_num(cipher_stack); for (i = 0; i < end; i++) { const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); alg_k = c->algorithm_mkey; alg_a = c->algorithm_auth; if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) || (alg_a & SSL_aECDSA) || c->min_tls >= TLS1_3_VERSION) { ret = 1; break; } } sk_SSL_CIPHER_free(cipher_stack); return ret; } EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { const unsigned char *pformats; size_t num_formats; if (!use_ecc(s)) return EXT_RETURN_NOT_SENT; /* Add TLS extension ECPointFormats to the ClientHello message */ tls1_get_formatlist(s, &pformats, &num_formats); if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) /* Sub-packet for formats extension */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { const uint16_t *pgroups = NULL; size_t num_groups = 0, i; if (!use_ecc(s)) return EXT_RETURN_NOT_SENT; /* * Add TLS extension supported_groups to the ClientHello message */ /* TODO(TLS1.3): Add support for DHE groups */ tls1_get_supported_groups(s, &pgroups, &num_groups); if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) /* Sub-packet for supported_groups extension */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } /* Copy curve ID if supported */ for (i = 0; i < num_groups; i++) { uint16_t ctmp = pgroups[i]; if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) { if (!WPACKET_put_bytes_u16(pkt, ctmp)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } } } if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #endif EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { size_t ticklen; if (!tls_use_ticket(s)) return EXT_RETURN_NOT_SENT; if (!s->new_session && s->session != NULL && s->session->ext.tick != NULL && s->session->ssl_version != TLS1_3_VERSION) { ticklen = s->session->ext.ticklen; } else if (s->session && s->ext.session_ticket != NULL && s->ext.session_ticket->data != NULL) { ticklen = s->ext.session_ticket->length; s->session->ext.tick = OPENSSL_malloc(ticklen); if (s->session->ext.tick == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } memcpy(s->session->ext.tick, s->ext.session_ticket->data, ticklen); s->session->ext.ticklen = ticklen; } else { ticklen = 0; } if (ticklen == 0 && s->ext.session_ticket != NULL && s->ext.session_ticket->data == NULL) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { size_t salglen; const uint16_t *salg; if (!SSL_CLIENT_USE_SIGALGS(s)) return EXT_RETURN_NOT_SENT; salglen = tls12_get_psigalgs(s, 1, &salg); if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms) /* Sub-packet for sig-algs extension */ || !WPACKET_start_sub_packet_u16(pkt) /* Sub-packet for the actual list */ || !WPACKET_start_sub_packet_u16(pkt) || !tls12_copy_sigalgs(s, pkt, salg, salglen) || !WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_OCSP EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { int i; /* This extension isn't defined for client Certificates */ if (x != NULL) return EXT_RETURN_NOT_SENT; if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) /* Sub-packet for status request extension */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp) /* Sub-packet for the ids */ || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) { unsigned char *idbytes; OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i); int idlen = i2d_OCSP_RESPID(id, NULL); if (idlen <= 0 /* Sub-packet for an individual id */ || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes) || i2d_OCSP_RESPID(id, &idbytes) != idlen) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } } if (!WPACKET_close(pkt) || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } if (s->ext.ocsp.exts) { unsigned char *extbytes; int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL); if (extlen < 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes) || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes) != extlen) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } } if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #endif #ifndef OPENSSL_NO_NEXTPROTONEG EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) return EXT_RETURN_NOT_SENT; /* * The client advertises an empty extension to indicate its support * for Next Protocol Negotiation */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #endif EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { s->s3->alpn_sent = 0; if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_application_layer_protocol_negotiation) /* Sub-packet ALPN extension */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } s->s3->alpn_sent = 1; return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_SRTP EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s); int i, end; if (clnt == NULL) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) /* Sub-packet for SRTP extension */ || !WPACKET_start_sub_packet_u16(pkt) /* Sub-packet for the protection profile list */ || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } end = sk_SRTP_PROTECTION_PROFILE_num(clnt); for (i = 0; i < end; i++) { const SRTP_PROTECTION_PROFILE *prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } } if (!WPACKET_close(pkt) /* Add an empty use_mki value */ || !WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #endif EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_CT EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->ct_validation_callback == NULL) return EXT_RETURN_NOT_SENT; /* Not defined for client Certificates */ if (x != NULL) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } #endif EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { int currv, min_version, max_version, reason; reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); if (reason != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); return EXT_RETURN_FAIL; } /* * Don't include this if we can't negotiate TLSv1.3. We can do a straight * comparison here because we will never be called in DTLS. */ if (max_version < TLS1_3_VERSION) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u8(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } for (currv = max_version; currv >= min_version; currv--) { if (!WPACKET_put_bytes_u16(pkt, currv)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } } if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; } /* * Construct a psk_kex_modes extension. */ EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u8(pkt) || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE) || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE)) || !WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE; if (nodhe) s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; #endif return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_TLS1_3 static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id) { unsigned char *encoded_point = NULL; EVP_PKEY *key_share_key = NULL; size_t encodedlen; if (s->s3->tmp.pkey != NULL) { if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_INTERNAL_ERROR); return 0; } /* * Could happen if we got an HRR that wasn't requesting a new key_share */ key_share_key = s->s3->tmp.pkey; } else { key_share_key = ssl_generate_pkey_group(s, curve_id); if (key_share_key == NULL) { /* SSLfatal() already called */ return 0; } } /* Encode the public key. */ encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key, &encoded_point); if (encodedlen == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB); goto err; } /* Create KeyShareEntry */ if (!WPACKET_put_bytes_u16(pkt, curve_id) || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_INTERNAL_ERROR); goto err; } /* * TODO(TLS1.3): When changing to send more than one key_share we're * going to need to be able to save more than one EVP_PKEY. For now * we reuse the existing tmp.pkey */ s->s3->tmp.pkey = key_share_key; s->s3->group_id = curve_id; OPENSSL_free(encoded_point); return 1; err: if (s->s3->tmp.pkey == NULL) EVP_PKEY_free(key_share_key); OPENSSL_free(encoded_point); return 0; } #endif EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 size_t i, num_groups = 0; const uint16_t *pgroups = NULL; uint16_t curve_id = 0; /* key_share extension */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) /* Extension data sub-packet */ || !WPACKET_start_sub_packet_u16(pkt) /* KeyShare list sub-packet */ || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } tls1_get_supported_groups(s, &pgroups, &num_groups); /* * TODO(TLS1.3): Make the number of key_shares sent configurable. For * now, just send one */ if (s->s3->group_id != 0) { curve_id = s->s3->group_id; } else { for (i = 0; i < num_groups; i++) { if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED)) continue; curve_id = pgroups[i]; break; } } if (curve_id == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, SSL_R_NO_SUITABLE_KEY_SHARE); return EXT_RETURN_FAIL; } if (!add_key_share(s, pkt, curve_id)) { /* SSLfatal() already called */ return EXT_RETURN_FAIL; } if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; #else return EXT_RETURN_NOT_SENT; #endif } EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { EXT_RETURN ret = EXT_RETURN_FAIL; /* Should only be set if we've had an HRR */ if (s->ext.tls13_cookie_len == 0) return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) /* Extension data sub-packet */ || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie, s->ext.tls13_cookie_len) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, ERR_R_INTERNAL_ERROR); goto end; } ret = EXT_RETURN_SENT; end: OPENSSL_free(s->ext.tls13_cookie); s->ext.tls13_cookie = NULL; s->ext.tls13_cookie_len = 0; return ret; } EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_PSK char identity[PSK_MAX_IDENTITY_LEN + 1]; #endif /* OPENSSL_NO_PSK */ const unsigned char *id = NULL; size_t idlen = 0; SSL_SESSION *psksess = NULL; SSL_SESSION *edsess = NULL; const EVP_MD *handmd = NULL; if (s->hello_retry_request == SSL_HRR_PENDING) handmd = ssl_handshake_md(s); if (s->psk_use_session_cb != NULL && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess) || (psksess != NULL && psksess->ssl_version != TLS1_3_VERSION))) { SSL_SESSION_free(psksess); SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, SSL_R_BAD_PSK); return EXT_RETURN_FAIL; } #ifndef OPENSSL_NO_PSK if (psksess == NULL && s->psk_client_callback != NULL) { unsigned char psk[PSK_MAX_PSK_LEN]; size_t psklen = 0; memset(identity, 0, sizeof(identity)); psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, psk, sizeof(psk)); if (psklen > PSK_MAX_PSK_LEN) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } else if (psklen > 0) { const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; const SSL_CIPHER *cipher; idlen = strlen(identity); if (idlen > PSK_MAX_IDENTITY_LEN) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } id = (unsigned char *)identity; /* * We found a PSK using an old style callback. We don't know * the digest so we default to SHA256 as per the TLSv1.3 spec */ cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); if (cipher == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } psksess = SSL_SESSION_new(); if (psksess == NULL || !SSL_SESSION_set1_master_key(psksess, psk, psklen) || !SSL_SESSION_set_cipher(psksess, cipher) || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); OPENSSL_cleanse(psk, psklen); return EXT_RETURN_FAIL; } OPENSSL_cleanse(psk, psklen); } } #endif /* OPENSSL_NO_PSK */ SSL_SESSION_free(s->psksession); s->psksession = psksess; if (psksess != NULL) { OPENSSL_free(s->psksession_id); s->psksession_id = OPENSSL_memdup(id, idlen); if (s->psksession_id == NULL) { + s->psksession_id_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } s->psksession_id_len = idlen; } if (s->early_data_state != SSL_EARLY_DATA_CONNECTING || (s->session->ext.max_early_data == 0 && (psksess == NULL || psksess->ext.max_early_data == 0))) { s->max_early_data = 0; return EXT_RETURN_NOT_SENT; } edsess = s->session->ext.max_early_data != 0 ? s->session : psksess; s->max_early_data = edsess->ext.max_early_data; if (edsess->ext.hostname != NULL) { if (s->ext.hostname == NULL || (s->ext.hostname != NULL && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, SSL_R_INCONSISTENT_EARLY_DATA_SNI); return EXT_RETURN_FAIL; } } if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, SSL_R_INCONSISTENT_EARLY_DATA_ALPN); return EXT_RETURN_FAIL; } /* * Verify that we are offering an ALPN protocol consistent with the early * data. */ if (edsess->ext.alpn_selected != NULL) { PACKET prots, alpnpkt; int found = 0; if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) { if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected, edsess->ext.alpn_selected_len)) { found = 1; break; } } if (!found) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, SSL_R_INCONSISTENT_EARLY_DATA_ALPN); return EXT_RETURN_FAIL; } } if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } /* * We set this to rejected here. Later, if the server acknowledges the * extension, we set it to accepted. */ s->ext.early_data = SSL_EARLY_DATA_REJECTED; s->ext.early_data_ok = 1; return EXT_RETURN_SENT; } #define F5_WORKAROUND_MIN_MSG_LEN 0xff #define F5_WORKAROUND_MAX_MSG_LEN 0x200 /* * PSK pre binder overhead = * 2 bytes for TLSEXT_TYPE_psk * 2 bytes for extension length * 2 bytes for identities list length * 2 bytes for identity length * 4 bytes for obfuscated_ticket_age * 2 bytes for binder list length * 1 byte for binder length * The above excludes the number of bytes for the identity itself and the * subsequent binder bytes */ #define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1) EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { unsigned char *padbytes; size_t hlen; if ((s->options & SSL_OP_TLSEXT_PADDING) == 0) return EXT_RETURN_NOT_SENT; /* * Add padding to workaround bugs in F5 terminators. See RFC7685. * This code calculates the length of all extensions added so far but * excludes the PSK extension (because that MUST be written last). Therefore * this extension MUST always appear second to last. */ if (!WPACKET_get_total_written(pkt, &hlen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } /* * If we're going to send a PSK then that will be written out after this * extension, so we need to calculate how long it is going to be. */ if (s->session->ssl_version == TLS1_3_VERSION && s->session->ext.ticklen != 0 && s->session->cipher != NULL) { const EVP_MD *md = ssl_md(s->session->cipher->algorithm2); if (md != NULL) { /* * Add the fixed PSK overhead, the identity length and the binder * length. */ hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen + EVP_MD_size(md); } } if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) { /* Calculate the amount of padding we need to add */ hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen; /* * Take off the size of extension header itself (2 bytes for type and * 2 bytes for length bytes), but ensure that the extension is at least * 1 byte long so as not to have an empty extension last (WebSphere 7.x, * 8.x are intolerant of that condition) */ if (hlen > 4) hlen -= 4; else hlen = 1; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding) || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } memset(padbytes, 0, hlen); } return EXT_RETURN_SENT; } /* * Construct the pre_shared_key extension */ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 uint32_t now, agesec, agems = 0; size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen; unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL; const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL; int dores = 0; s->ext.tick_identity = 0; /* * Note: At this stage of the code we only support adding a single * resumption PSK. If we add support for multiple PSKs then the length * calculations in the padding extension will need to be adjusted. */ /* * If this is an incompatible or new session then we have nothing to resume * so don't add this extension. */ if (s->session->ssl_version != TLS1_3_VERSION || (s->session->ext.ticklen == 0 && s->psksession == NULL)) return EXT_RETURN_NOT_SENT; if (s->hello_retry_request == SSL_HRR_PENDING) handmd = ssl_handshake_md(s); if (s->session->ext.ticklen != 0) { /* Get the digest associated with the ciphersuite in the session */ if (s->session->cipher == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } mdres = ssl_md(s->session->cipher->algorithm2); if (mdres == NULL) { /* * Don't recognize this cipher so we can't use the session. * Ignore it */ goto dopsksess; } if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) { /* * Selected ciphersuite hash does not match the hash for the session * so we can't use it. */ goto dopsksess; } /* * Technically the C standard just says time() returns a time_t and says * nothing about the encoding of that type. In practice most * implementations follow POSIX which holds it as an integral type in * seconds since epoch. We've already made the assumption that we can do * this in multiple places in the code, so portability shouldn't be an * issue. */ now = (uint32_t)time(NULL); agesec = now - (uint32_t)s->session->time; /* * We calculate the age in seconds but the server may work in ms. Due to * rounding errors we could overestimate the age by up to 1s. It is * better to underestimate it. Otherwise, if the RTT is very short, when * the server calculates the age reported by the client it could be * bigger than the age calculated on the server - which should never * happen. */ if (agesec > 0) agesec--; if (s->session->ext.tick_lifetime_hint < agesec) { /* Ticket is too old. Ignore it. */ goto dopsksess; } /* * Calculate age in ms. We're just doing it to nearest second. Should be * good enough. */ agems = agesec * (uint32_t)1000; if (agesec != 0 && agems / (uint32_t)1000 != agesec) { /* * Overflow. Shouldn't happen unless this is a *really* old session. * If so we just ignore it. */ goto dopsksess; } /* * Obfuscate the age. Overflow here is fine, this addition is supposed * to be mod 2^32. */ agems += s->session->ext.tick_age_add; reshashsize = EVP_MD_size(mdres); s->ext.tick_identity++; dores = 1; } dopsksess: if (!dores && s->psksession == NULL) return EXT_RETURN_NOT_SENT; if (s->psksession != NULL) { mdpsk = ssl_md(s->psksession->cipher->algorithm2); if (mdpsk == NULL) { /* * Don't recognize this cipher so we can't use the session. * If this happens it's an application bug. */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, SSL_R_BAD_PSK); return EXT_RETURN_FAIL; } if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) { /* * Selected ciphersuite hash does not match the hash for the PSK * session. This is an application bug. */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, SSL_R_BAD_PSK); return EXT_RETURN_FAIL; } pskhashsize = EVP_MD_size(mdpsk); } /* Create the extension, but skip over the binder for now */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } if (dores) { if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, s->session->ext.ticklen) || !WPACKET_put_bytes_u32(pkt, agems)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } } if (s->psksession != NULL) { if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id, s->psksession_id_len) || !WPACKET_put_bytes_u32(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } s->ext.tick_identity++; } if (!WPACKET_close(pkt) || !WPACKET_get_total_written(pkt, &binderoffset) || !WPACKET_start_sub_packet_u16(pkt) || (dores && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder)) || (s->psksession != NULL && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder)) || !WPACKET_close(pkt) || !WPACKET_close(pkt) || !WPACKET_get_total_written(pkt, &msglen) /* * We need to fill in all the sub-packet lengths now so we can * calculate the HMAC of the message up to the binders */ || !WPACKET_fill_lengths(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } msgstart = WPACKET_get_curr(pkt) - msglen; if (dores && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL, resbinder, s->session, 1, 0) != 1) { /* SSLfatal() already called */ return EXT_RETURN_FAIL; } if (s->psksession != NULL && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL, pskbinder, s->psksession, 1, 1) != 1) { /* SSLfatal() already called */ return EXT_RETURN_FAIL; } return EXT_RETURN_SENT; #else return EXT_RETURN_NOT_SENT; #endif } EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 if (!s->pha_enabled) return EXT_RETURN_NOT_SENT; /* construct extension - 0 length, no contents */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, ERR_R_INTERNAL_ERROR); return EXT_RETURN_FAIL; } s->post_handshake_auth = SSL_PHA_EXT_SENT; return EXT_RETURN_SENT; #else return EXT_RETURN_NOT_SENT; #endif } /* * Parse the server's renegotiation binding and abort if it's not right */ int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { size_t expected_len = s->s3->previous_client_finished_len + s->s3->previous_server_finished_len; size_t ilen; const unsigned char *data; /* Check for logic errors */ if (!ossl_assert(expected_len == 0 || s->s3->previous_client_finished_len != 0) || !ossl_assert(expected_len == 0 || s->s3->previous_server_finished_len != 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, ERR_R_INTERNAL_ERROR); return 0; } /* Parse the length byte */ if (!PACKET_get_1_len(pkt, &ilen)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, SSL_R_RENEGOTIATION_ENCODING_ERR); return 0; } /* Consistency check */ if (PACKET_remaining(pkt) != ilen) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, SSL_R_RENEGOTIATION_ENCODING_ERR); return 0; } /* Check that the extension matches */ if (ilen != expected_len) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, SSL_R_RENEGOTIATION_MISMATCH); return 0; } if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len) || memcmp(data, s->s3->previous_client_finished, s->s3->previous_client_finished_len) != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, SSL_R_RENEGOTIATION_MISMATCH); return 0; } if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len) || memcmp(data, s->s3->previous_server_finished, s->s3->previous_server_finished_len) != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, SSL_R_RENEGOTIATION_MISMATCH); return 0; } s->s3->send_connection_binding = 1; return 1; } /* Parse the server's max fragment len extension packet */ int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { unsigned int value; if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, SSL_R_BAD_EXTENSION); return 0; } /* |value| should contains a valid max-fragment-length code. */ if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); return 0; } /* Must be the same value as client-configured one who was sent to server */ /*- * RFC 6066: if a client receives a maximum fragment length negotiation * response that differs from the length it requested, ... * It must abort with SSL_AD_ILLEGAL_PARAMETER alert */ if (value != s->ext.max_fragment_len_mode) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); return 0; } /* * Maximum Fragment Length Negotiation succeeded. * The negotiated Maximum Fragment Length is binding now. */ s->session->ext.max_fragment_len_mode = value; return 1; } int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->ext.hostname == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, ERR_R_INTERNAL_ERROR); return 0; } if (PACKET_remaining(pkt) > 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, SSL_R_BAD_EXTENSION); return 0; } if (!s->hit) { if (s->session->ext.hostname != NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, ERR_R_INTERNAL_ERROR); return 0; } s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); if (s->session->ext.hostname == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, ERR_R_INTERNAL_ERROR); return 0; } } return 1; } #ifndef OPENSSL_NO_EC int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { size_t ecpointformats_len; PACKET ecptformatlist; if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_EXTENSION); return 0; } if (!s->hit) { ecpointformats_len = PACKET_remaining(&ecptformatlist); if (ecpointformats_len == 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_LENGTH); return 0; } s->ext.peer_ecpointformats_len = 0; OPENSSL_free(s->ext.peer_ecpointformats); s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len); if (s->ext.peer_ecpointformats == NULL) { + s->ext.peer_ecpointformats_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); return 0; } s->ext.peer_ecpointformats_len = ecpointformats_len; if (!PACKET_copy_bytes(&ecptformatlist, s->ext.peer_ecpointformats, ecpointformats_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); return 0; } } return 1; } #endif int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (s->ext.session_ticket_cb != NULL && !s->ext.session_ticket_cb(s, PACKET_data(pkt), PACKET_remaining(pkt), s->ext.session_ticket_cb_arg)) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); return 0; } if (!tls_use_ticket(s)) { SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); return 0; } if (PACKET_remaining(pkt) > 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); return 0; } s->ext.ticket_expected = 1; return 1; } #ifndef OPENSSL_NO_OCSP int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { /* We ignore this if the server sends a CertificateRequest */ /* TODO(TLS1.3): Add support for this */ return 1; } /* * MUST only be sent if we've requested a status * request message. In TLS <= 1.2 it must also be empty. */ if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); return 0; } if (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); return 0; } if (SSL_IS_TLS13(s)) { /* We only know how to handle this if it's for the first Certificate in * the chain. We ignore any other responses. */ if (chainidx != 0) return 1; /* SSLfatal() already called */ return tls_process_cert_status_body(s, pkt); } /* Set flag to expect CertificateStatus message */ s->ext.status_expected = 1; return 1; } #endif #ifndef OPENSSL_NO_CT int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { /* We ignore this if the server sends it in a CertificateRequest */ /* TODO(TLS1.3): Add support for this */ return 1; } /* * Only take it if we asked for it - i.e if there is no CT validation * callback set, then a custom extension MAY be processing it, so we * need to let control continue to flow to that. */ if (s->ct_validation_callback != NULL) { size_t size = PACKET_remaining(pkt); /* Simply copy it off for later processing */ OPENSSL_free(s->ext.scts); s->ext.scts = NULL; s->ext.scts_len = (uint16_t)size; if (size > 0) { s->ext.scts = OPENSSL_malloc(size); - if (s->ext.scts == NULL - || !PACKET_copy_bytes(pkt, s->ext.scts, size)) { + if (s->ext.scts == NULL) { + s->ext.scts_len = 0; + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, + ERR_R_MALLOC_FAILURE); + return 0; + } + if (!PACKET_copy_bytes(pkt, s->ext.scts, size)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, ERR_R_INTERNAL_ERROR); return 0; } } } else { ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 ? ENDPOINT_CLIENT : ENDPOINT_BOTH; /* * If we didn't ask for it then there must be a custom extension, * otherwise this is unsolicited. */ if (custom_ext_find(&s->cert->custext, role, TLSEXT_TYPE_signed_certificate_timestamp, NULL) == NULL) { SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SCT, SSL_R_BAD_EXTENSION); return 0; } if (!custom_ext_parse(s, context, TLSEXT_TYPE_signed_certificate_timestamp, PACKET_data(pkt), PACKET_remaining(pkt), x, chainidx)) { /* SSLfatal already called */ return 0; } } return 1; } #endif #ifndef OPENSSL_NO_NEXTPROTONEG /* * ssl_next_proto_validate validates a Next Protocol Negotiation block. No * elements of zero length are allowed and the set of elements must exactly * fill the length of the block. Returns 1 on success or 0 on failure. */ static int ssl_next_proto_validate(SSL *s, PACKET *pkt) { PACKET tmp_protocol; while (PACKET_remaining(pkt)) { if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol) || PACKET_remaining(&tmp_protocol) == 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_NEXT_PROTO_VALIDATE, SSL_R_BAD_EXTENSION); return 0; } } return 1; } int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { unsigned char *selected; unsigned char selected_len; PACKET tmppkt; /* Check if we are in a renegotiation. If so ignore this extension */ if (!SSL_IS_FIRST_HANDSHAKE(s)) return 1; /* We must have requested it. */ if (s->ctx->ext.npn_select_cb == NULL) { SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_NPN, SSL_R_BAD_EXTENSION); return 0; } /* The data must be valid */ tmppkt = *pkt; if (!ssl_next_proto_validate(s, &tmppkt)) { /* SSLfatal() already called */ return 0; } if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len, PACKET_data(pkt), PACKET_remaining(pkt), s->ctx->ext.npn_select_cb_arg) != SSL_TLSEXT_ERR_OK) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_NPN, SSL_R_BAD_EXTENSION); return 0; } /* * Could be non-NULL if server has sent multiple NPN extensions in * a single Serverhello */ OPENSSL_free(s->ext.npn); s->ext.npn = OPENSSL_malloc(selected_len); if (s->ext.npn == NULL) { + s->ext.npn_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_NPN, ERR_R_INTERNAL_ERROR); return 0; } memcpy(s->ext.npn, selected, selected_len); s->ext.npn_len = selected_len; s->s3->npn_seen = 1; return 1; } #endif int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { size_t len; /* We must have requested it. */ if (!s->s3->alpn_sent) { SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_ALPN, SSL_R_BAD_EXTENSION); return 0; } /*- * The extension data consists of: * uint16 list_length * uint8 proto_length; * uint8 proto[proto_length]; */ if (!PACKET_get_net_2_len(pkt, &len) || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len) || PACKET_remaining(pkt) != len) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, SSL_R_BAD_EXTENSION); return 0; } OPENSSL_free(s->s3->alpn_selected); s->s3->alpn_selected = OPENSSL_malloc(len); if (s->s3->alpn_selected == NULL) { + s->s3->alpn_selected_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, ERR_R_INTERNAL_ERROR); return 0; } if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, SSL_R_BAD_EXTENSION); return 0; } s->s3->alpn_selected_len = len; if (s->session->ext.alpn_selected == NULL || s->session->ext.alpn_selected_len != len || memcmp(s->session->ext.alpn_selected, s->s3->alpn_selected, len) != 0) { /* ALPN not consistent with the old session so cannot use early_data */ s->ext.early_data_ok = 0; } if (!s->hit) { /* * This is a new session and so alpn_selected should have been * initialised to NULL. We should update it with the selected ALPN. */ if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, ERR_R_INTERNAL_ERROR); return 0; } s->session->ext.alpn_selected = OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); if (s->session->ext.alpn_selected == NULL) { + s->session->ext.alpn_selected_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, ERR_R_INTERNAL_ERROR); return 0; } s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; } return 1; } #ifndef OPENSSL_NO_SRTP int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { unsigned int id, ct, mki; int i; STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; SRTP_PROTECTION_PROFILE *prof; if (!PACKET_get_net_2(pkt, &ct) || ct != 2 || !PACKET_get_net_2(pkt, &id) || !PACKET_get_1(pkt, &mki) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); return 0; } if (mki != 0) { /* Must be no MKI, since we never offer one */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_USE_SRTP, SSL_R_BAD_SRTP_MKI_VALUE); return 0; } /* Throw an error if the server gave us an unsolicited extension */ clnt = SSL_get_srtp_profiles(s); if (clnt == NULL) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, SSL_R_NO_SRTP_PROFILES); return 0; } /* * Check to see if the server gave us something we support (and * presumably offered) */ for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) { prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); if (prof->id == id) { s->srtp_profile = prof; return 1; } } SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); return 0; } #endif int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { /* Ignore if inappropriate ciphersuite */ if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4) s->ext.use_etm = 1; return 1; } int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS; if (!s->hit) s->session->flags |= SSL_SESS_FLAG_EXTMS; return 1; } int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { unsigned int version; if (!PACKET_get_net_2(pkt, &version) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, SSL_R_LENGTH_MISMATCH); return 0; } /* * The only protocol version we support which is valid in this extension in * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else. */ if (version != TLS1_3_VERSION) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, SSL_R_BAD_PROTOCOL_VERSION_NUMBER); return 0; } /* We ignore this extension for HRRs except to sanity check it */ if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) return 1; /* We just set it here. We validate it in ssl_choose_client_version */ s->version = version; return 1; } int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 unsigned int group_id; PACKET encoded_pt; EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL; /* Sanity check */ if (ckey == NULL || s->s3->peer_tmp != NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); return 0; } if (!PACKET_get_net_2(pkt, &group_id)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_LENGTH_MISMATCH); return 0; } if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) { const uint16_t *pgroups = NULL; size_t i, num_groups; if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_LENGTH_MISMATCH); return 0; } /* * It is an error if the HelloRetryRequest wants a key_share that we * already sent in the first ClientHello */ if (group_id == s->s3->group_id) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); return 0; } /* Validate the selected group is one we support */ tls1_get_supported_groups(s, &pgroups, &num_groups); for (i = 0; i < num_groups; i++) { if (group_id == pgroups[i]) break; } if (i >= num_groups || !tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); return 0; } s->s3->group_id = group_id; EVP_PKEY_free(s->s3->tmp.pkey); s->s3->tmp.pkey = NULL; return 1; } if (group_id != s->s3->group_id) { /* * This isn't for the group that we sent in the original * key_share! */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); return 0; } if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt) || PACKET_remaining(&encoded_pt) == 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_LENGTH_MISMATCH); return 0; } skey = EVP_PKEY_new(); if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, ERR_R_MALLOC_FAILURE); return 0; } if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), PACKET_remaining(&encoded_pt))) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_ECPOINT); EVP_PKEY_free(skey); return 0; } if (ssl_derive(s, ckey, skey, 1) == 0) { /* SSLfatal() already called */ EVP_PKEY_free(skey); return 0; } s->s3->peer_tmp = skey; #endif return 1; } int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { PACKET cookie; if (!PACKET_as_length_prefixed_2(pkt, &cookie) || !PACKET_memdup(&cookie, &s->ext.tls13_cookie, &s->ext.tls13_cookie_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_COOKIE, SSL_R_LENGTH_MISMATCH); return 0; } return 1; } int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { unsigned long max_early_data; if (!PACKET_get_net_4(pkt, &max_early_data) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, SSL_R_INVALID_MAX_EARLY_DATA); return 0; } s->session->ext.max_early_data = max_early_data; return 1; } if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, SSL_R_BAD_EXTENSION); return 0; } if (!s->ext.early_data_ok || !s->hit) { /* * If we get here then we didn't send early data, or we didn't resume * using the first identity, or the SNI/ALPN is not consistent so the * server should not be accepting it. */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_EARLY_DATA, SSL_R_BAD_EXTENSION); return 0; } s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; return 1; } int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, size_t chainidx) { #ifndef OPENSSL_NO_TLS1_3 unsigned int identity; if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_PSK, SSL_R_LENGTH_MISMATCH); return 0; } if (identity >= (unsigned int)s->ext.tick_identity) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, SSL_R_BAD_PSK_IDENTITY); return 0; } /* * Session resumption tickets are always sent before PSK tickets. If the * ticket index is 0 then it must be for a session resumption ticket if we * sent two tickets, or if we didn't send a PSK ticket. */ if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) { s->hit = 1; SSL_SESSION_free(s->psksession); s->psksession = NULL; return 1; } if (s->psksession == NULL) { /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_PSK, ERR_R_INTERNAL_ERROR); return 0; } /* * If we used the external PSK for sending early_data then s->early_secret * is already set up, so don't overwrite it. Otherwise we copy the * early_secret across that we generated earlier. */ if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) || s->session->ext.max_early_data > 0 || s->psksession->ext.max_early_data == 0) memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE); SSL_SESSION_free(s->session); s->session = s->psksession; s->psksession = NULL; s->hit = 1; /* Early data is only allowed if we used the first ticket */ if (identity != 0) s->ext.early_data_ok = 0; #endif return 1; } diff --git a/crypto/openssl/ssl/statem/statem_clnt.c b/crypto/openssl/ssl/statem/statem_clnt.c index 64e392cfbfc7..0a61aa82b187 100644 --- a/crypto/openssl/ssl/statem/statem_clnt.c +++ b/crypto/openssl/ssl/statem/statem_clnt.c @@ -1,3842 +1,3847 @@ /* * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include #include #include "../ssl_local.h" #include "statem_local.h" #include #include #include #include #include #include #include #include #include static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt); static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt); static ossl_inline int cert_req_allowed(SSL *s); static int key_exchange_expected(SSL *s); static int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt); /* * Is a CertificateRequest message allowed at the moment or not? * * Return values are: * 1: Yes * 0: No */ static ossl_inline int cert_req_allowed(SSL *s) { /* TLS does not like anon-DH with client cert */ if ((s->version > SSL3_VERSION && (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)) || (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK))) return 0; return 1; } /* * Should we expect the ServerKeyExchange message or not? * * Return values are: * 1: Yes * 0: No */ static int key_exchange_expected(SSL *s) { long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; /* * Can't skip server key exchange if this is an ephemeral * ciphersuite or for SRP */ if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK | SSL_kSRP)) { return 1; } return 0; } /* * ossl_statem_client_read_transition() encapsulates the logic for the allowed * handshake state transitions when a TLS1.3 client is reading messages from the * server. The message type that the server has sent is provided in |mt|. The * current state is in |s->statem.hand_state|. * * Return values are 1 for success (transition allowed) and 0 on error * (transition not allowed) */ static int ossl_statem_client13_read_transition(SSL *s, int mt) { OSSL_STATEM *st = &s->statem; /* * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't * yet negotiated TLSv1.3 at that point so that is handled by * ossl_statem_client_read_transition() */ switch (st->hand_state) { default: break; case TLS_ST_CW_CLNT_HELLO: /* * This must a ClientHello following a HelloRetryRequest, so the only * thing we can get now is a ServerHello. */ if (mt == SSL3_MT_SERVER_HELLO) { st->hand_state = TLS_ST_CR_SRVR_HELLO; return 1; } break; case TLS_ST_CR_SRVR_HELLO: if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) { st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS; return 1; } break; case TLS_ST_CR_ENCRYPTED_EXTENSIONS: if (s->hit) { if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_CR_FINISHED; return 1; } } else { if (mt == SSL3_MT_CERTIFICATE_REQUEST) { st->hand_state = TLS_ST_CR_CERT_REQ; return 1; } if (mt == SSL3_MT_CERTIFICATE) { st->hand_state = TLS_ST_CR_CERT; return 1; } } break; case TLS_ST_CR_CERT_REQ: if (mt == SSL3_MT_CERTIFICATE) { st->hand_state = TLS_ST_CR_CERT; return 1; } break; case TLS_ST_CR_CERT: if (mt == SSL3_MT_CERTIFICATE_VERIFY) { st->hand_state = TLS_ST_CR_CERT_VRFY; return 1; } break; case TLS_ST_CR_CERT_VRFY: if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_CR_FINISHED; return 1; } break; case TLS_ST_OK: if (mt == SSL3_MT_NEWSESSION_TICKET) { st->hand_state = TLS_ST_CR_SESSION_TICKET; return 1; } if (mt == SSL3_MT_KEY_UPDATE) { st->hand_state = TLS_ST_CR_KEY_UPDATE; return 1; } if (mt == SSL3_MT_CERTIFICATE_REQUEST) { #if DTLS_MAX_VERSION != DTLS1_2_VERSION # error TODO(DTLS1.3): Restore digest for PHA before adding message. #endif if (!SSL_IS_DTLS(s) && s->post_handshake_auth == SSL_PHA_EXT_SENT) { s->post_handshake_auth = SSL_PHA_REQUESTED; /* * In TLS, this is called before the message is added to the * digest. In DTLS, this is expected to be called after adding * to the digest. Either move the digest restore, or add the * message here after the swap, or do it after the clientFinished? */ if (!tls13_restore_handshake_digest_for_pha(s)) { /* SSLfatal() already called */ return 0; } st->hand_state = TLS_ST_CR_CERT_REQ; return 1; } } break; } /* No valid transition found */ return 0; } /* * ossl_statem_client_read_transition() encapsulates the logic for the allowed * handshake state transitions when the client is reading messages from the * server. The message type that the server has sent is provided in |mt|. The * current state is in |s->statem.hand_state|. * * Return values are 1 for success (transition allowed) and 0 on error * (transition not allowed) */ int ossl_statem_client_read_transition(SSL *s, int mt) { OSSL_STATEM *st = &s->statem; int ske_expected; /* * Note that after writing the first ClientHello we don't know what version * we are going to negotiate yet, so we don't take this branch until later. */ if (SSL_IS_TLS13(s)) { if (!ossl_statem_client13_read_transition(s, mt)) goto err; return 1; } switch (st->hand_state) { default: break; case TLS_ST_CW_CLNT_HELLO: if (mt == SSL3_MT_SERVER_HELLO) { st->hand_state = TLS_ST_CR_SRVR_HELLO; return 1; } if (SSL_IS_DTLS(s)) { if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; return 1; } } break; case TLS_ST_EARLY_DATA: /* * We've not actually selected TLSv1.3 yet, but we have sent early * data. The only thing allowed now is a ServerHello or a * HelloRetryRequest. */ if (mt == SSL3_MT_SERVER_HELLO) { st->hand_state = TLS_ST_CR_SRVR_HELLO; return 1; } break; case TLS_ST_CR_SRVR_HELLO: if (s->hit) { if (s->ext.ticket_expected) { if (mt == SSL3_MT_NEWSESSION_TICKET) { st->hand_state = TLS_ST_CR_SESSION_TICKET; return 1; } } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_CR_CHANGE; return 1; } } else { if (SSL_IS_DTLS(s) && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; return 1; } else if (s->version >= TLS1_VERSION && s->ext.session_secret_cb != NULL && s->session->ext.tick != NULL && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { /* * Normally, we can tell if the server is resuming the session * from the session ID. EAP-FAST (RFC 4851), however, relies on * the next server message after the ServerHello to determine if * the server is resuming. */ s->hit = 1; st->hand_state = TLS_ST_CR_CHANGE; return 1; } else if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) { if (mt == SSL3_MT_CERTIFICATE) { st->hand_state = TLS_ST_CR_CERT; return 1; } } else { ske_expected = key_exchange_expected(s); /* SKE is optional for some PSK ciphersuites */ if (ske_expected || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK) && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) { if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) { st->hand_state = TLS_ST_CR_KEY_EXCH; return 1; } } else if (mt == SSL3_MT_CERTIFICATE_REQUEST && cert_req_allowed(s)) { st->hand_state = TLS_ST_CR_CERT_REQ; return 1; } else if (mt == SSL3_MT_SERVER_DONE) { st->hand_state = TLS_ST_CR_SRVR_DONE; return 1; } } } break; case TLS_ST_CR_CERT: /* * The CertificateStatus message is optional even if * |ext.status_expected| is set */ if (s->ext.status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) { st->hand_state = TLS_ST_CR_CERT_STATUS; return 1; } /* Fall through */ case TLS_ST_CR_CERT_STATUS: ske_expected = key_exchange_expected(s); /* SKE is optional for some PSK ciphersuites */ if (ske_expected || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK) && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) { if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) { st->hand_state = TLS_ST_CR_KEY_EXCH; return 1; } goto err; } /* Fall through */ case TLS_ST_CR_KEY_EXCH: if (mt == SSL3_MT_CERTIFICATE_REQUEST) { if (cert_req_allowed(s)) { st->hand_state = TLS_ST_CR_CERT_REQ; return 1; } goto err; } /* Fall through */ case TLS_ST_CR_CERT_REQ: if (mt == SSL3_MT_SERVER_DONE) { st->hand_state = TLS_ST_CR_SRVR_DONE; return 1; } break; case TLS_ST_CW_FINISHED: if (s->ext.ticket_expected) { if (mt == SSL3_MT_NEWSESSION_TICKET) { st->hand_state = TLS_ST_CR_SESSION_TICKET; return 1; } } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_CR_CHANGE; return 1; } break; case TLS_ST_CR_SESSION_TICKET: if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_CR_CHANGE; return 1; } break; case TLS_ST_CR_CHANGE: if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_CR_FINISHED; return 1; } break; case TLS_ST_OK: if (mt == SSL3_MT_HELLO_REQUEST) { st->hand_state = TLS_ST_CR_HELLO_REQ; return 1; } break; } err: /* No valid transition found */ if (SSL_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { BIO *rbio; /* * CCS messages don't have a message sequence number so this is probably * because of an out-of-order CCS. We'll just drop it. */ s->init_num = 0; s->rwstate = SSL_READING; rbio = SSL_get_rbio(s); BIO_clear_retry_flags(rbio); BIO_set_retry_read(rbio); return 0; } SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE, SSL_F_OSSL_STATEM_CLIENT_READ_TRANSITION, SSL_R_UNEXPECTED_MESSAGE); return 0; } /* * ossl_statem_client13_write_transition() works out what handshake state to * move to next when the TLSv1.3 client is writing messages to be sent to the * server. */ static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) { OSSL_STATEM *st = &s->statem; /* * Note: There are no cases for TLS_ST_BEFORE because we haven't negotiated * TLSv1.3 yet at that point. They are handled by * ossl_statem_client_write_transition(). */ switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION, ERR_R_INTERNAL_ERROR); return WRITE_TRAN_ERROR; case TLS_ST_CR_CERT_REQ: if (s->post_handshake_auth == SSL_PHA_REQUESTED) { st->hand_state = TLS_ST_CW_CERT; return WRITE_TRAN_CONTINUE; } /* * We should only get here if we received a CertificateRequest after * we already sent close_notify */ if (!ossl_assert((s->shutdown & SSL_SENT_SHUTDOWN) != 0)) { /* Shouldn't happen - same as default case */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_CLIENT13_WRITE_TRANSITION, ERR_R_INTERNAL_ERROR); return WRITE_TRAN_ERROR; } st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; case TLS_ST_CR_FINISHED: if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY || s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING) st->hand_state = TLS_ST_PENDING_EARLY_DATA_END; else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 && s->hello_retry_request == SSL_HRR_NONE) st->hand_state = TLS_ST_CW_CHANGE; else st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT : TLS_ST_CW_FINISHED; return WRITE_TRAN_CONTINUE; case TLS_ST_PENDING_EARLY_DATA_END: if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA; return WRITE_TRAN_CONTINUE; } /* Fall through */ case TLS_ST_CW_END_OF_EARLY_DATA: case TLS_ST_CW_CHANGE: st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT : TLS_ST_CW_FINISHED; return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CERT: /* If a non-empty Certificate we also send CertificateVerify */ st->hand_state = (s->s3->tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY : TLS_ST_CW_FINISHED; return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CERT_VRFY: st->hand_state = TLS_ST_CW_FINISHED; return WRITE_TRAN_CONTINUE; case TLS_ST_CR_KEY_UPDATE: case TLS_ST_CW_KEY_UPDATE: case TLS_ST_CR_SESSION_TICKET: case TLS_ST_CW_FINISHED: st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; case TLS_ST_OK: if (s->key_update != SSL_KEY_UPDATE_NONE) { st->hand_state = TLS_ST_CW_KEY_UPDATE; return WRITE_TRAN_CONTINUE; } /* Try to read from the server instead */ return WRITE_TRAN_FINISHED; } } /* * ossl_statem_client_write_transition() works out what handshake state to * move to next when the client is writing messages to be sent to the server. */ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) { OSSL_STATEM *st = &s->statem; /* * Note that immediately before/after a ClientHello we don't know what * version we are going to negotiate yet, so we don't take this branch until * later */ if (SSL_IS_TLS13(s)) return ossl_statem_client13_write_transition(s); switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_CLIENT_WRITE_TRANSITION, ERR_R_INTERNAL_ERROR); return WRITE_TRAN_ERROR; case TLS_ST_OK: if (!s->renegotiate) { /* * We haven't requested a renegotiation ourselves so we must have * received a message from the server. Better read it. */ return WRITE_TRAN_FINISHED; } /* Renegotiation */ /* fall thru */ case TLS_ST_BEFORE: st->hand_state = TLS_ST_CW_CLNT_HELLO; return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CLNT_HELLO: if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) { /* * We are assuming this is a TLSv1.3 connection, although we haven't * actually selected a version yet. */ if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) st->hand_state = TLS_ST_CW_CHANGE; else st->hand_state = TLS_ST_EARLY_DATA; return WRITE_TRAN_CONTINUE; } /* * No transition at the end of writing because we don't know what * we will be sent */ return WRITE_TRAN_FINISHED; case TLS_ST_CR_SRVR_HELLO: /* * We only get here in TLSv1.3. We just received an HRR, so issue a * CCS unless middlebox compat mode is off, or we already issued one * because we did early data. */ if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) st->hand_state = TLS_ST_CW_CHANGE; else st->hand_state = TLS_ST_CW_CLNT_HELLO; return WRITE_TRAN_CONTINUE; case TLS_ST_EARLY_DATA: return WRITE_TRAN_FINISHED; case DTLS_ST_CR_HELLO_VERIFY_REQUEST: st->hand_state = TLS_ST_CW_CLNT_HELLO; return WRITE_TRAN_CONTINUE; case TLS_ST_CR_SRVR_DONE: if (s->s3->tmp.cert_req) st->hand_state = TLS_ST_CW_CERT; else st->hand_state = TLS_ST_CW_KEY_EXCH; return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CERT: st->hand_state = TLS_ST_CW_KEY_EXCH; return WRITE_TRAN_CONTINUE; case TLS_ST_CW_KEY_EXCH: /* * For TLS, cert_req is set to 2, so a cert chain of nothing is * sent, but no verify packet is sent */ /* * XXX: For now, we do not support client authentication in ECDH * cipher suites with ECDH (rather than ECDSA) certificates. We * need to skip the certificate verify message when client's * ECDH public key is sent inside the client certificate. */ if (s->s3->tmp.cert_req == 1) { st->hand_state = TLS_ST_CW_CERT_VRFY; } else { st->hand_state = TLS_ST_CW_CHANGE; } if (s->s3->flags & TLS1_FLAGS_SKIP_CERT_VERIFY) { st->hand_state = TLS_ST_CW_CHANGE; } return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CERT_VRFY: st->hand_state = TLS_ST_CW_CHANGE; return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CHANGE: if (s->hello_retry_request == SSL_HRR_PENDING) { st->hand_state = TLS_ST_CW_CLNT_HELLO; } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) { st->hand_state = TLS_ST_EARLY_DATA; } else { #if defined(OPENSSL_NO_NEXTPROTONEG) st->hand_state = TLS_ST_CW_FINISHED; #else if (!SSL_IS_DTLS(s) && s->s3->npn_seen) st->hand_state = TLS_ST_CW_NEXT_PROTO; else st->hand_state = TLS_ST_CW_FINISHED; #endif } return WRITE_TRAN_CONTINUE; #if !defined(OPENSSL_NO_NEXTPROTONEG) case TLS_ST_CW_NEXT_PROTO: st->hand_state = TLS_ST_CW_FINISHED; return WRITE_TRAN_CONTINUE; #endif case TLS_ST_CW_FINISHED: if (s->hit) { st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } else { return WRITE_TRAN_FINISHED; } case TLS_ST_CR_FINISHED: if (s->hit) { st->hand_state = TLS_ST_CW_CHANGE; return WRITE_TRAN_CONTINUE; } else { st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } case TLS_ST_CR_HELLO_REQ: /* * If we can renegotiate now then do so, otherwise wait for a more * convenient time. */ if (ssl3_renegotiate_check(s, 1)) { if (!tls_setup_handshake(s)) { /* SSLfatal() already called */ return WRITE_TRAN_ERROR; } st->hand_state = TLS_ST_CW_CLNT_HELLO; return WRITE_TRAN_CONTINUE; } st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } } /* * Perform any pre work that needs to be done prior to sending a message from * the client to the server. */ WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* No pre work to be done */ break; case TLS_ST_CW_CLNT_HELLO: s->shutdown = 0; if (SSL_IS_DTLS(s)) { /* every DTLS ClientHello resets Finished MAC */ if (!ssl3_init_finished_mac(s)) { /* SSLfatal() already called */ return WORK_ERROR; } } break; case TLS_ST_CW_CHANGE: if (SSL_IS_DTLS(s)) { if (s->hit) { /* * We're into the last flight so we don't retransmit these * messages unless we need to. */ st->use_timer = 0; } #ifndef OPENSSL_NO_SCTP if (BIO_dgram_is_sctp(SSL_get_wbio(s))) { /* Calls SSLfatal() as required */ return dtls_wait_for_dry(s); } #endif } break; case TLS_ST_PENDING_EARLY_DATA_END: /* * If we've been called by SSL_do_handshake()/SSL_write(), or we did not * attempt to write early data before calling SSL_read() then we press * on with the handshake. Otherwise we pause here. */ if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING || s->early_data_state == SSL_EARLY_DATA_NONE) return WORK_FINISHED_CONTINUE; /* Fall through */ case TLS_ST_EARLY_DATA: return tls_finish_handshake(s, wst, 0, 1); case TLS_ST_OK: /* Calls SSLfatal() as required */ return tls_finish_handshake(s, wst, 1, 1); } return WORK_FINISHED_CONTINUE; } /* * Perform any work that needs to be done after sending a message from the * client to the server. */ WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; s->init_num = 0; switch (st->hand_state) { default: /* No post work to be done */ break; case TLS_ST_CW_CLNT_HELLO: if (s->early_data_state == SSL_EARLY_DATA_CONNECTING && s->max_early_data > 0) { /* * We haven't selected TLSv1.3 yet so we don't call the change * cipher state function associated with the SSL_METHOD. Instead * we call tls13_change_cipher_state() directly. */ if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0) { if (!tls13_change_cipher_state(s, SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; } } /* else we're in compat mode so we delay flushing until after CCS */ } else if (!statem_flush(s)) { return WORK_MORE_A; } if (SSL_IS_DTLS(s)) { /* Treat the next message as the first packet */ s->first_packet = 1; } break; case TLS_ST_CW_END_OF_EARLY_DATA: /* * We set the enc_write_ctx back to NULL because we may end up writing * in cleartext again if we get a HelloRetryRequest from the server. */ EVP_CIPHER_CTX_free(s->enc_write_ctx); s->enc_write_ctx = NULL; break; case TLS_ST_CW_KEY_EXCH: if (tls_client_key_exchange_post_work(s) == 0) { /* SSLfatal() already called */ return WORK_ERROR; } break; case TLS_ST_CW_CHANGE: if (SSL_IS_TLS13(s) || s->hello_retry_request == SSL_HRR_PENDING) break; if (s->early_data_state == SSL_EARLY_DATA_CONNECTING && s->max_early_data > 0) { /* * We haven't selected TLSv1.3 yet so we don't call the change * cipher state function associated with the SSL_METHOD. Instead * we call tls13_change_cipher_state() directly. */ if (!tls13_change_cipher_state(s, SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) return WORK_ERROR; break; } s->session->cipher = s->s3->tmp.new_cipher; #ifdef OPENSSL_NO_COMP s->session->compress_meth = 0; #else if (s->s3->tmp.new_compression == NULL) s->session->compress_meth = 0; else s->session->compress_meth = s->s3->tmp.new_compression->id; #endif if (!s->method->ssl3_enc->setup_key_block(s)) { /* SSLfatal() already called */ return WORK_ERROR; } if (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; } if (SSL_IS_DTLS(s)) { #ifndef OPENSSL_NO_SCTP if (s->hit) { /* * Change to new shared key of SCTP-Auth, will be ignored if * no SCTP used. */ BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL); } #endif dtls1_reset_seq_numbers(s, SSL3_CC_WRITE); } break; case TLS_ST_CW_FINISHED: #ifndef OPENSSL_NO_SCTP if (wst == WORK_MORE_A && SSL_IS_DTLS(s) && s->hit == 0) { /* * Change to new shared key of SCTP-Auth, will be ignored if * no SCTP used. */ BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL); } #endif if (statem_flush(s) != 1) return WORK_MORE_B; if (SSL_IS_TLS13(s)) { if (!tls13_save_handshake_digest_for_pha(s)) { /* SSLfatal() already called */ return WORK_ERROR; } if (s->post_handshake_auth != SSL_PHA_REQUESTED) { if (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; } } } break; case TLS_ST_CW_KEY_UPDATE: if (statem_flush(s) != 1) return WORK_MORE_A; if (!tls13_update_key(s, 1)) { /* SSLfatal() already called */ return WORK_ERROR; } break; } return WORK_FINISHED_CONTINUE; } /* * Get the message construction function and message type for sending from the * client * * Valid return values are: * 1: Success * 0: Error */ int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt, confunc_f *confunc, int *mt) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_CLIENT_CONSTRUCT_MESSAGE, SSL_R_BAD_HANDSHAKE_STATE); return 0; case TLS_ST_CW_CHANGE: if (SSL_IS_DTLS(s)) *confunc = dtls_construct_change_cipher_spec; else *confunc = tls_construct_change_cipher_spec; *mt = SSL3_MT_CHANGE_CIPHER_SPEC; break; case TLS_ST_CW_CLNT_HELLO: *confunc = tls_construct_client_hello; *mt = SSL3_MT_CLIENT_HELLO; break; case TLS_ST_CW_END_OF_EARLY_DATA: *confunc = tls_construct_end_of_early_data; *mt = SSL3_MT_END_OF_EARLY_DATA; break; case TLS_ST_PENDING_EARLY_DATA_END: *confunc = NULL; *mt = SSL3_MT_DUMMY; break; case TLS_ST_CW_CERT: *confunc = tls_construct_client_certificate; *mt = SSL3_MT_CERTIFICATE; break; case TLS_ST_CW_KEY_EXCH: *confunc = tls_construct_client_key_exchange; *mt = SSL3_MT_CLIENT_KEY_EXCHANGE; break; case TLS_ST_CW_CERT_VRFY: *confunc = tls_construct_cert_verify; *mt = SSL3_MT_CERTIFICATE_VERIFY; break; #if !defined(OPENSSL_NO_NEXTPROTONEG) case TLS_ST_CW_NEXT_PROTO: *confunc = tls_construct_next_proto; *mt = SSL3_MT_NEXT_PROTO; break; #endif case TLS_ST_CW_FINISHED: *confunc = tls_construct_finished; *mt = SSL3_MT_FINISHED; break; case TLS_ST_CW_KEY_UPDATE: *confunc = tls_construct_key_update; *mt = SSL3_MT_KEY_UPDATE; break; } return 1; } /* * Returns the maximum allowed length for the current message that we are * reading. Excludes the message header. */ size_t ossl_statem_client_max_message_size(SSL *s) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ return 0; case TLS_ST_CR_SRVR_HELLO: return SERVER_HELLO_MAX_LENGTH; case DTLS_ST_CR_HELLO_VERIFY_REQUEST: return HELLO_VERIFY_REQUEST_MAX_LENGTH; case TLS_ST_CR_CERT: return s->max_cert_list; case TLS_ST_CR_CERT_VRFY: return SSL3_RT_MAX_PLAIN_LENGTH; case TLS_ST_CR_CERT_STATUS: return SSL3_RT_MAX_PLAIN_LENGTH; case TLS_ST_CR_KEY_EXCH: return SERVER_KEY_EXCH_MAX_LENGTH; case TLS_ST_CR_CERT_REQ: /* * Set to s->max_cert_list for compatibility with previous releases. In * practice these messages can get quite long if servers are configured * to provide a long list of acceptable CAs */ return s->max_cert_list; case TLS_ST_CR_SRVR_DONE: return SERVER_HELLO_DONE_MAX_LENGTH; case TLS_ST_CR_CHANGE: if (s->version == DTLS1_BAD_VER) return 3; return CCS_MAX_LENGTH; case TLS_ST_CR_SESSION_TICKET: return SSL3_RT_MAX_PLAIN_LENGTH; case TLS_ST_CR_FINISHED: return FINISHED_MAX_LENGTH; case TLS_ST_CR_ENCRYPTED_EXTENSIONS: return ENCRYPTED_EXTENSIONS_MAX_LENGTH; case TLS_ST_CR_KEY_UPDATE: return KEY_UPDATE_MAX_LENGTH; } } /* * Process a message that the client has been received from the server. */ MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_CLIENT_PROCESS_MESSAGE, ERR_R_INTERNAL_ERROR); return MSG_PROCESS_ERROR; case TLS_ST_CR_SRVR_HELLO: return tls_process_server_hello(s, pkt); case DTLS_ST_CR_HELLO_VERIFY_REQUEST: return dtls_process_hello_verify(s, pkt); case TLS_ST_CR_CERT: return tls_process_server_certificate(s, pkt); case TLS_ST_CR_CERT_VRFY: return tls_process_cert_verify(s, pkt); case TLS_ST_CR_CERT_STATUS: return tls_process_cert_status(s, pkt); case TLS_ST_CR_KEY_EXCH: return tls_process_key_exchange(s, pkt); case TLS_ST_CR_CERT_REQ: return tls_process_certificate_request(s, pkt); case TLS_ST_CR_SRVR_DONE: return tls_process_server_done(s, pkt); case TLS_ST_CR_CHANGE: return tls_process_change_cipher_spec(s, pkt); case TLS_ST_CR_SESSION_TICKET: return tls_process_new_session_ticket(s, pkt); case TLS_ST_CR_FINISHED: return tls_process_finished(s, pkt); case TLS_ST_CR_HELLO_REQ: return tls_process_hello_req(s, pkt); case TLS_ST_CR_ENCRYPTED_EXTENSIONS: return tls_process_encrypted_extensions(s, pkt); case TLS_ST_CR_KEY_UPDATE: return tls_process_key_update(s, pkt); } } /* * Perform any further processing required following the receipt of a message * from the server */ WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_CLIENT_POST_PROCESS_MESSAGE, ERR_R_INTERNAL_ERROR); return WORK_ERROR; case TLS_ST_CR_CERT_VRFY: case TLS_ST_CR_CERT_REQ: return tls_prepare_client_certificate(s, wst); } } int tls_construct_client_hello(SSL *s, WPACKET *pkt) { unsigned char *p; size_t sess_id_len; int i, protverr; #ifndef OPENSSL_NO_COMP SSL_COMP *comp; #endif SSL_SESSION *sess = s->session; unsigned char *session_id; /* Work out what SSL/TLS/DTLS version to use */ protverr = ssl_set_client_hello_version(s); if (protverr != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, protverr); return 0; } if (sess == NULL || !ssl_version_supported(s, sess->ssl_version, NULL) || !SSL_SESSION_is_resumable(sess)) { if (s->hello_retry_request == SSL_HRR_NONE && !ssl_get_new_session(s, 0)) { /* SSLfatal() already called */ return 0; } } /* else use the pre-loaded session */ p = s->s3->client_random; /* * for DTLS if client_random is initialized, reuse it, we are * required to use same upon reply to HelloVerify */ if (SSL_IS_DTLS(s)) { size_t idx; i = 1; for (idx = 0; idx < sizeof(s->s3->client_random); idx++) { if (p[idx]) { i = 0; break; } } } else { i = (s->hello_retry_request == SSL_HRR_NONE); } if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3->client_random), DOWNGRADE_NONE) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /*- * version indicates the negotiated version: for example from * an SSLv2/v3 compatible client hello). The client_version * field is the maximum version we permit and it is also * used in RSA encrypted premaster secrets. Some servers can * choke if we initially report a higher version then * renegotiate to a lower one in the premaster secret. This * didn't happen with TLS 1.0 as most servers supported it * but it can with TLS 1.1 or later if the server only supports * 1.0. * * Possible scenario with previous logic: * 1. Client hello indicates TLS 1.2 * 2. Server hello says TLS 1.0 * 3. RSA encrypted premaster secret uses 1.2. * 4. Handshake proceeds using TLS 1.0. * 5. Server sends hello request to renegotiate. * 6. Client hello indicates TLS v1.0 as we now * know that is maximum server supports. * 7. Server chokes on RSA encrypted premaster secret * containing version 1.0. * * For interoperability it should be OK to always use the * maximum version we support in client hello and then rely * on the checking of version to ensure the servers isn't * being inconsistent: for example initially negotiating with * TLS 1.0 and renegotiating with TLS 1.2. We do this by using * client_version in client hello and not resetting it to * the negotiated version. * * For TLS 1.3 we always set the ClientHello version to 1.2 and rely on the * supported_versions extension for the real supported versions. */ if (!WPACKET_put_bytes_u16(pkt, s->client_version) || !WPACKET_memcpy(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /* Session ID */ session_id = s->session->session_id; if (s->new_session || s->session->ssl_version == TLS1_3_VERSION) { if (s->version == TLS1_3_VERSION && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) { sess_id_len = sizeof(s->tmp_session_id); s->tmp_session_id_len = sess_id_len; session_id = s->tmp_session_id; if (s->hello_retry_request == SSL_HRR_NONE && RAND_bytes(s->tmp_session_id, sess_id_len) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } } else { sess_id_len = 0; } } else { assert(s->session->session_id_length <= sizeof(s->session->session_id)); sess_id_len = s->session->session_id_length; if (s->version == TLS1_3_VERSION) { s->tmp_session_id_len = sess_id_len; memcpy(s->tmp_session_id, s->session->session_id, sess_id_len); } } if (!WPACKET_start_sub_packet_u8(pkt) || (sess_id_len != 0 && !WPACKET_memcpy(pkt, session_id, sess_id_len)) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /* cookie stuff for DTLS */ if (SSL_IS_DTLS(s)) { if (s->d1->cookie_len > sizeof(s->d1->cookie) || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie, s->d1->cookie_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } } /* Ciphers supported */ if (!WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), pkt)) { /* SSLfatal() already called */ return 0; } if (!WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /* COMPRESSION */ if (!WPACKET_start_sub_packet_u8(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } #ifndef OPENSSL_NO_COMP if (ssl_allow_compression(s) && s->ctx->comp_methods && (SSL_IS_DTLS(s) || s->s3->tmp.max_ver < TLS1_3_VERSION)) { int compnum = sk_SSL_COMP_num(s->ctx->comp_methods); for (i = 0; i < compnum; i++) { comp = sk_SSL_COMP_value(s->ctx->comp_methods, i); if (!WPACKET_put_bytes_u8(pkt, comp->id)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } } } #endif /* Add the NULL method */ if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /* TLS extensions */ if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0)) { /* SSLfatal() already called */ return 0; } return 1; } MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt) { size_t cookie_len; PACKET cookiepkt; if (!PACKET_forward(pkt, 2) || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } cookie_len = PACKET_remaining(&cookiepkt); if (cookie_len > sizeof(s->d1->cookie)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_TOO_LONG); return MSG_PROCESS_ERROR; } if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } s->d1->cookie_len = cookie_len; return MSG_PROCESS_FINISHED_READING; } static int set_client_ciphersuite(SSL *s, const unsigned char *cipherchars) { STACK_OF(SSL_CIPHER) *sk; const SSL_CIPHER *c; int i; c = ssl_get_cipher_by_char(s, cipherchars, 0); if (c == NULL) { /* unknown cipher */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, SSL_R_UNKNOWN_CIPHER_RETURNED); return 0; } /* * If it is a disabled cipher we either didn't send it in client hello, * or it's not allowed for the selected protocol. So we return an error. */ if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK, 1)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, SSL_R_WRONG_CIPHER_RETURNED); return 0; } sk = ssl_get_ciphers_by_id(s); i = sk_SSL_CIPHER_find(sk, c); if (i < 0) { /* we did not say we would use this cipher */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, SSL_R_WRONG_CIPHER_RETURNED); return 0; } if (SSL_IS_TLS13(s) && s->s3->tmp.new_cipher != NULL && s->s3->tmp.new_cipher->id != c->id) { /* ServerHello selected a different ciphersuite to that in the HRR */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, SSL_R_WRONG_CIPHER_RETURNED); return 0; } /* * Depending on the session caching (internal/external), the cipher * and/or cipher_id values may not be set. Make sure that cipher_id is * set and use it for comparison. */ if (s->session->cipher != NULL) s->session->cipher_id = s->session->cipher->id; if (s->hit && (s->session->cipher_id != c->id)) { if (SSL_IS_TLS13(s)) { /* * In TLSv1.3 it is valid for the server to select a different * ciphersuite as long as the hash is the same. */ if (ssl_md(c->algorithm2) != ssl_md(s->session->cipher->algorithm2)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED); return 0; } } else { /* * Prior to TLSv1.3 resuming a session always meant using the same * ciphersuite. */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SET_CLIENT_CIPHERSUITE, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); return 0; } } s->s3->tmp.new_cipher = c; return 1; } MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) { PACKET session_id, extpkt; size_t session_id_len; const unsigned char *cipherchars; int hrr = 0; unsigned int compression; unsigned int sversion; unsigned int context; RAW_EXTENSION *extensions = NULL; #ifndef OPENSSL_NO_COMP SSL_COMP *comp; #endif if (!PACKET_get_net_2(pkt, &sversion)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } /* load the server random */ if (s->version == TLS1_3_VERSION && sversion == TLS1_2_VERSION && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) { s->hello_retry_request = SSL_HRR_PENDING; hrr = 1; if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } } else { if (!PACKET_copy_bytes(pkt, s->s3->server_random, SSL3_RANDOM_SIZE)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } } /* Get the session-id. */ if (!PACKET_get_length_prefixed_1(pkt, &session_id)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } session_id_len = PACKET_remaining(&session_id); if (session_id_len > sizeof(s->session->session_id) || session_id_len > SSL3_SESSION_ID_SIZE) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_SSL3_SESSION_ID_TOO_LONG); goto err; } if (!PACKET_get_bytes(pkt, &cipherchars, TLS_CIPHER_LEN)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } if (!PACKET_get_1(pkt, &compression)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } /* TLS extensions */ if (PACKET_remaining(pkt) == 0 && !hrr) { PACKET_null_init(&extpkt); } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_BAD_LENGTH); goto err; } if (!hrr) { if (!tls_collect_extensions(s, &extpkt, SSL_EXT_TLS1_2_SERVER_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO, &extensions, NULL, 1)) { /* SSLfatal() already called */ goto err; } if (!ssl_choose_client_version(s, sversion, extensions)) { /* SSLfatal() already called */ goto err; } } if (SSL_IS_TLS13(s) || hrr) { if (compression != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_INVALID_COMPRESSION_ALGORITHM); goto err; } if (session_id_len != s->tmp_session_id_len || memcmp(PACKET_data(&session_id), s->tmp_session_id, session_id_len) != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_INVALID_SESSION_ID); goto err; } } if (hrr) { if (!set_client_ciphersuite(s, cipherchars)) { /* SSLfatal() already called */ goto err; } return tls_process_as_hello_retry_request(s, &extpkt); } /* * Now we have chosen the version we need to check again that the extensions * are appropriate for this version. */ context = SSL_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO : SSL_EXT_TLS1_2_SERVER_HELLO; if (!tls_validate_all_contexts(s, context, extensions)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_BAD_EXTENSION); goto err; } s->hit = 0; if (SSL_IS_TLS13(s)) { /* * In TLSv1.3 a ServerHello message signals a key change so the end of * the message must be on a record boundary. */ if (RECORD_LAYER_processed_read_pending(&s->rlayer)) { SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_NOT_ON_RECORD_BOUNDARY); goto err; } /* This will set s->hit if we are resuming */ if (!tls_parse_extension(s, TLSEXT_IDX_psk, SSL_EXT_TLS1_3_SERVER_HELLO, extensions, NULL, 0)) { /* SSLfatal() already called */ goto err; } } else { /* * Check if we can resume the session based on external pre-shared * secret. EAP-FAST (RFC 4851) supports two types of session resumption. * Resumption based on server-side state works with session IDs. * Resumption based on pre-shared Protected Access Credentials (PACs) * works by overriding the SessionTicket extension at the application * layer, and does not send a session ID. (We do not know whether * EAP-FAST servers would honour the session ID.) Therefore, the session * ID alone is not a reliable indicator of session resumption, so we * first check if we can resume, and later peek at the next handshake * message to see if the server wants to resume. */ if (s->version >= TLS1_VERSION && s->ext.session_secret_cb != NULL && s->session->ext.tick) { const SSL_CIPHER *pref_cipher = NULL; /* * s->session->master_key_length is a size_t, but this is an int for * backwards compat reasons */ int master_key_length; master_key_length = sizeof(s->session->master_key); if (s->ext.session_secret_cb(s, s->session->master_key, &master_key_length, NULL, &pref_cipher, s->ext.session_secret_cb_arg) && master_key_length > 0) { s->session->master_key_length = master_key_length; s->session->cipher = pref_cipher ? pref_cipher : ssl_get_cipher_by_char(s, cipherchars, 0); } else { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, ERR_R_INTERNAL_ERROR); goto err; } } if (session_id_len != 0 && session_id_len == s->session->session_id_length && memcmp(PACKET_data(&session_id), s->session->session_id, session_id_len) == 0) s->hit = 1; } if (s->hit) { if (s->sid_ctx_length != s->session->sid_ctx_length || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) { /* actually a client application bug */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); goto err; } } else { /* * If we were trying for session-id reuse but the server * didn't resume, make a new SSL_SESSION. * In the case of EAP-FAST and PAC, we do not send a session ID, * so the PAC-based session secret is always preserved. It'll be * overwritten if the server refuses resumption. */ if (s->session->session_id_length > 0) { tsan_counter(&s->session_ctx->stats.sess_miss); if (!ssl_get_new_session(s, 0)) { /* SSLfatal() already called */ goto err; } } s->session->ssl_version = s->version; /* * In TLSv1.2 and below we save the session id we were sent so we can * resume it later. In TLSv1.3 the session id we were sent is just an * echo of what we originally sent in the ClientHello and should not be * used for resumption. */ if (!SSL_IS_TLS13(s)) { s->session->session_id_length = session_id_len; /* session_id_len could be 0 */ if (session_id_len > 0) memcpy(s->session->session_id, PACKET_data(&session_id), session_id_len); } } /* Session version and negotiated protocol version should match */ if (s->version != s->session->ssl_version) { SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_SSL_SESSION_VERSION_MISMATCH); goto err; } /* * Now that we know the version, update the check to see if it's an allowed * version. */ s->s3->tmp.min_ver = s->version; s->s3->tmp.max_ver = s->version; if (!set_client_ciphersuite(s, cipherchars)) { /* SSLfatal() already called */ goto err; } #ifdef OPENSSL_NO_COMP if (compression != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); goto err; } /* * If compression is disabled we'd better not try to resume a session * using compression. */ if (s->session->compress_meth != 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_INCONSISTENT_COMPRESSION); goto err; } #else if (s->hit && compression != s->session->compress_meth) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED); goto err; } if (compression == 0) comp = NULL; else if (!ssl_allow_compression(s)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_COMPRESSION_DISABLED); goto err; } else { comp = ssl3_comp_find(s->ctx->comp_methods, compression); } if (compression != 0 && comp == NULL) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); goto err; } else { s->s3->tmp.new_compression = comp; } #endif if (!tls_parse_all_extensions(s, context, extensions, NULL, 0, 1)) { /* SSLfatal() already called */ goto err; } #ifndef OPENSSL_NO_SCTP if (SSL_IS_DTLS(s) && s->hit) { unsigned char sctpauthkey[64]; char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; size_t labellen; /* * Add new shared key for SCTP-Auth, will be ignored if * no SCTP used. */ memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, sizeof(DTLS1_SCTP_AUTH_LABEL)); /* Don't include the terminating zero. */ labellen = sizeof(labelbuffer) - 1; if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) labellen += 1; if (SSL_export_keying_material(s, sctpauthkey, sizeof(sctpauthkey), labelbuffer, labellen, NULL, 0, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_HELLO, ERR_R_INTERNAL_ERROR); goto err; } BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, sizeof(sctpauthkey), sctpauthkey); } #endif /* * In TLSv1.3 we have some post-processing to change cipher state, otherwise * we're done with this message */ if (SSL_IS_TLS13(s) && (!s->method->ssl3_enc->setup_key_block(s) || !s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ))) { /* SSLfatal() already called */ goto err; } OPENSSL_free(extensions); return MSG_PROCESS_CONTINUE_READING; err: OPENSSL_free(extensions); return MSG_PROCESS_ERROR; } static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *extpkt) { RAW_EXTENSION *extensions = NULL; /* * If we were sending early_data then the enc_write_ctx is now invalid and * should not be used. */ EVP_CIPHER_CTX_free(s->enc_write_ctx); s->enc_write_ctx = NULL; if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, &extensions, NULL, 1) || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, extensions, NULL, 0, 1)) { /* SSLfatal() already called */ goto err; } OPENSSL_free(extensions); extensions = NULL; if (s->ext.tls13_cookie_len == 0 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) && s->s3->tmp.pkey != NULL #endif ) { /* * We didn't receive a cookie or a new key_share so the next * ClientHello will not change */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_AS_HELLO_RETRY_REQUEST, SSL_R_NO_CHANGE_FOLLOWING_HRR); goto err; } /* * Re-initialise the Transcript Hash. We're going to prepopulate it with * a synthetic message_hash in place of ClientHello1. */ if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) { /* SSLfatal() already called */ goto err; } /* * Add this message to the Transcript Hash. Normally this is done * automatically prior to the message processing stage. However due to the * need to create the synthetic message hash, we defer that step until now * for HRR messages. */ if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + SSL3_HM_HEADER_LENGTH)) { /* SSLfatal() already called */ goto err; } return MSG_PROCESS_FINISHED_READING; err: OPENSSL_free(extensions); return MSG_PROCESS_ERROR; } MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) { int i; MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR; unsigned long cert_list_len, cert_len; X509 *x = NULL; const unsigned char *certstart, *certbytes; STACK_OF(X509) *sk = NULL; EVP_PKEY *pkey = NULL; size_t chainidx, certidx; unsigned int context = 0; const SSL_CERT_LOOKUP *clu; if ((sk = sk_X509_new_null()) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_MALLOC_FAILURE); goto err; } if ((SSL_IS_TLS13(s) && !PACKET_get_1(pkt, &context)) || context != 0 || !PACKET_get_net_3(pkt, &cert_list_len) || PACKET_remaining(pkt) != cert_list_len || PACKET_remaining(pkt) == 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_LENGTH_MISMATCH); goto err; } for (chainidx = 0; PACKET_remaining(pkt); chainidx++) { if (!PACKET_get_net_3(pkt, &cert_len) || !PACKET_get_bytes(pkt, &certbytes, cert_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_CERT_LENGTH_MISMATCH); goto err; } certstart = certbytes; x = d2i_X509(NULL, (const unsigned char **)&certbytes, cert_len); if (x == NULL) { SSLfatal(s, SSL_AD_BAD_CERTIFICATE, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_ASN1_LIB); goto err; } if (certbytes != (certstart + cert_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_CERT_LENGTH_MISMATCH); goto err; } if (SSL_IS_TLS13(s)) { RAW_EXTENSION *rawexts = NULL; PACKET extensions; if (!PACKET_get_length_prefixed_2(pkt, &extensions)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_BAD_LENGTH); goto err; } if (!tls_collect_extensions(s, &extensions, SSL_EXT_TLS1_3_CERTIFICATE, &rawexts, NULL, chainidx == 0) || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE, rawexts, x, chainidx, PACKET_remaining(pkt) == 0)) { OPENSSL_free(rawexts); /* SSLfatal already called */ goto err; } OPENSSL_free(rawexts); } if (!sk_X509_push(sk, x)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_MALLOC_FAILURE); goto err; } x = NULL; } i = ssl_verify_cert_chain(s, sk); /* * The documented interface is that SSL_VERIFY_PEER should be set in order * for client side verification of the server certificate to take place. * However, historically the code has only checked that *any* flag is set * to cause server verification to take place. Use of the other flags makes * no sense in client mode. An attempt to clean up the semantics was * reverted because at least one application *only* set * SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Prior to the clean up this still caused * server verification to take place, after the clean up it silently did * nothing. SSL_CTX_set_verify()/SSL_set_verify() cannot validate the flags * sent to them because they are void functions. Therefore, we now use the * (less clean) historic behaviour of performing validation if any flag is * set. The *documented* interface remains the same. */ if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) { SSLfatal(s, ssl_x509err2alert(s->verify_result), SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_CERTIFICATE_VERIFY_FAILED); goto err; } ERR_clear_error(); /* but we keep s->verify_result */ if (i > 1) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, i); goto err; } s->session->peer_chain = sk; /* * Inconsistency alert: cert_chain does include the peer's certificate, * which we don't include in statem_srvr.c */ x = sk_X509_value(sk, 0); sk = NULL; pkey = X509_get0_pubkey(x); if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) { x = NULL; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); goto err; } if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx)) == NULL) { x = NULL; SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_UNKNOWN_CERTIFICATE_TYPE); goto err; } /* * Check certificate type is consistent with ciphersuite. For TLS 1.3 * skip check since TLS 1.3 ciphersuites can be used with any certificate * type. */ if (!SSL_IS_TLS13(s)) { if ((clu->amask & s->s3->tmp.new_cipher->algorithm_auth) == 0) { x = NULL; SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_WRONG_CERTIFICATE_TYPE); goto err; } } s->session->peer_type = certidx; X509_free(s->session->peer); X509_up_ref(x); s->session->peer = x; s->session->verify_result = s->verify_result; x = NULL; /* Save the current hash state for when we receive the CertificateVerify */ if (SSL_IS_TLS13(s) && !ssl_handshake_hash(s, s->cert_verify_hash, sizeof(s->cert_verify_hash), &s->cert_verify_hash_len)) { /* SSLfatal() already called */; goto err; } ret = MSG_PROCESS_CONTINUE_READING; err: X509_free(x); sk_X509_pop_free(sk, X509_free); return ret; } static int tls_process_ske_psk_preamble(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_PSK PACKET psk_identity_hint; /* PSK ciphersuites are preceded by an identity hint */ if (!PACKET_get_length_prefixed_2(pkt, &psk_identity_hint)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, SSL_R_LENGTH_MISMATCH); return 0; } /* * Store PSK identity hint for later use, hint is used in * tls_construct_client_key_exchange. Assume that the maximum length of * a PSK identity hint can be as long as the maximum length of a PSK * identity. */ if (PACKET_remaining(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, SSL_R_DATA_LENGTH_TOO_LONG); return 0; } if (PACKET_remaining(&psk_identity_hint) == 0) { OPENSSL_free(s->session->psk_identity_hint); s->session->psk_identity_hint = NULL; } else if (!PACKET_strndup(&psk_identity_hint, &s->session->psk_identity_hint)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); return 0; } return 1; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_ske_srp(SSL *s, PACKET *pkt, EVP_PKEY **pkey) { #ifndef OPENSSL_NO_SRP PACKET prime, generator, salt, server_pub; if (!PACKET_get_length_prefixed_2(pkt, &prime) || !PACKET_get_length_prefixed_2(pkt, &generator) || !PACKET_get_length_prefixed_1(pkt, &salt) || !PACKET_get_length_prefixed_2(pkt, &server_pub)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_SRP, SSL_R_LENGTH_MISMATCH); return 0; } /* TODO(size_t): Convert BN_bin2bn() calls */ if ((s->srp_ctx.N = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL)) == NULL || (s->srp_ctx.g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator), NULL)) == NULL || (s->srp_ctx.s = BN_bin2bn(PACKET_data(&salt), (int)PACKET_remaining(&salt), NULL)) == NULL || (s->srp_ctx.B = BN_bin2bn(PACKET_data(&server_pub), (int)PACKET_remaining(&server_pub), NULL)) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_SRP, ERR_R_BN_LIB); return 0; } if (!srp_verify_server_param(s)) { /* SSLfatal() already called */ return 0; } /* We must check if there is a certificate */ if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) *pkey = X509_get0_pubkey(s->session->peer); return 1; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_SRP, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) { #ifndef OPENSSL_NO_DH PACKET prime, generator, pub_key; EVP_PKEY *peer_tmp = NULL; DH *dh = NULL; BIGNUM *p = NULL, *g = NULL, *bnpub_key = NULL; int check_bits = 0; if (!PACKET_get_length_prefixed_2(pkt, &prime) || !PACKET_get_length_prefixed_2(pkt, &generator) || !PACKET_get_length_prefixed_2(pkt, &pub_key)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_LENGTH_MISMATCH); return 0; } peer_tmp = EVP_PKEY_new(); dh = DH_new(); if (peer_tmp == NULL || dh == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_MALLOC_FAILURE); goto err; } /* TODO(size_t): Convert these calls */ p = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL); g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator), NULL); bnpub_key = BN_bin2bn(PACKET_data(&pub_key), (int)PACKET_remaining(&pub_key), NULL); if (p == NULL || g == NULL || bnpub_key == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_BN_LIB); goto err; } /* test non-zero pubkey */ if (BN_is_zero(bnpub_key)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_BAD_DH_VALUE); goto err; } if (!DH_set0_pqg(dh, p, NULL, g)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_BN_LIB); goto err; } p = g = NULL; if (DH_check_params(dh, &check_bits) == 0 || check_bits != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_BAD_DH_VALUE); goto err; } if (!DH_set0_key(dh, bnpub_key, NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_BN_LIB); goto err; } bnpub_key = NULL; if (!ssl_security(s, SSL_SECOP_TMP_DH, DH_security_bits(dh), 0, dh)) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_DH_KEY_TOO_SMALL); goto err; } if (EVP_PKEY_assign_DH(peer_tmp, dh) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_EVP_LIB); goto err; } s->s3->peer_tmp = peer_tmp; /* * FIXME: This makes assumptions about which ciphersuites come with * public keys. We should have a less ad-hoc way of doing this */ if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) *pkey = X509_get0_pubkey(s->session->peer); /* else anonymous DH, so no certificate or pkey. */ return 1; err: BN_free(p); BN_free(g); BN_free(bnpub_key); DH_free(dh); EVP_PKEY_free(peer_tmp); return 0; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) { #ifndef OPENSSL_NO_EC PACKET encoded_pt; unsigned int curve_type, curve_id; /* * Extract elliptic curve parameters and the server's ephemeral ECDH * public key. We only support named (not generic) curves and * ECParameters in this case is just three bytes. */ if (!PACKET_get_1(pkt, &curve_type) || !PACKET_get_net_2(pkt, &curve_id)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_LENGTH_TOO_SHORT); return 0; } /* * Check curve is named curve type and one of our preferences, if not * server has sent an invalid curve. */ if (curve_type != NAMED_CURVE_TYPE || !tls1_check_group_id(s, curve_id, 1)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_WRONG_CURVE); return 0; } if ((s->s3->peer_tmp = ssl_generate_param_group(curve_id)) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); return 0; } if (!PACKET_get_length_prefixed_1(pkt, &encoded_pt)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_LENGTH_MISMATCH); return 0; } if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp, PACKET_data(&encoded_pt), PACKET_remaining(&encoded_pt))) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_BAD_ECPOINT); return 0; } /* * The ECC/TLS specification does not mention the use of DSA to sign * ECParameters in the server key exchange message. We do support RSA * and ECDSA. */ if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA) *pkey = X509_get0_pubkey(s->session->peer); else if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aRSA) *pkey = X509_get0_pubkey(s->session->peer); /* else anonymous ECDH, so no certificate or pkey. */ return 1; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SKE_ECDHE, ERR_R_INTERNAL_ERROR); return 0; #endif } MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) { long alg_k; EVP_PKEY *pkey = NULL; EVP_MD_CTX *md_ctx = NULL; EVP_PKEY_CTX *pctx = NULL; PACKET save_param_start, signature; alg_k = s->s3->tmp.new_cipher->algorithm_mkey; save_param_start = *pkt; #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) EVP_PKEY_free(s->s3->peer_tmp); s->s3->peer_tmp = NULL; #endif if (alg_k & SSL_PSK) { if (!tls_process_ske_psk_preamble(s, pkt)) { /* SSLfatal() already called */ goto err; } } /* Nothing else to do for plain PSK or RSAPSK */ if (alg_k & (SSL_kPSK | SSL_kRSAPSK)) { } else if (alg_k & SSL_kSRP) { if (!tls_process_ske_srp(s, pkt, &pkey)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { if (!tls_process_ske_dhe(s, pkt, &pkey)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { if (!tls_process_ske_ecdhe(s, pkt, &pkey)) { /* SSLfatal() already called */ goto err; } } else if (alg_k) { SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE); goto err; } /* if it was signed, check the signature */ if (pkey != NULL) { PACKET params; int maxsig; const EVP_MD *md = NULL; unsigned char *tbs; size_t tbslen; int rv; /* * |pkt| now points to the beginning of the signature, so the difference * equals the length of the parameters. */ if (!PACKET_get_sub_packet(&save_param_start, ¶ms, PACKET_remaining(&save_param_start) - PACKET_remaining(pkt))) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } if (SSL_USE_SIGALGS(s)) { unsigned int sigalg; if (!PACKET_get_net_2(pkt, &sigalg)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_LENGTH_TOO_SHORT); goto err; } if (tls12_check_peer_sigalg(s, sigalg, pkey) <=0) { /* SSLfatal() already called */ goto err; } } else if (!tls1_set_peer_legacy_sigalg(s, pkey)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } if (!tls1_lookup_md(s->s3->tmp.peer_sigalg, &md)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } #ifdef SSL_DEBUG if (SSL_USE_SIGALGS(s)) fprintf(stderr, "USING TLSv1.2 HASH %s\n", md == NULL ? "n/a" : EVP_MD_name(md)); #endif if (!PACKET_get_length_prefixed_2(pkt, &signature) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH); goto err; } maxsig = EVP_PKEY_size(pkey); if (maxsig < 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } /* * Check signature length */ if (PACKET_remaining(&signature) > (size_t)maxsig) { /* wrong packet length */ SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_WRONG_SIGNATURE_LENGTH); goto err; } md_ctx = EVP_MD_CTX_new(); if (md_ctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); goto err; } if (EVP_DigestVerifyInit(md_ctx, &pctx, md, NULL, pkey) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_EVP_LIB); goto err; } if (SSL_USE_PSS(s)) { if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0 || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, RSA_PSS_SALTLEN_DIGEST) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_EVP_LIB); goto err; } } tbslen = construct_key_exchange_tbs(s, &tbs, PACKET_data(¶ms), PACKET_remaining(¶ms)); if (tbslen == 0) { /* SSLfatal() already called */ goto err; } rv = EVP_DigestVerify(md_ctx, PACKET_data(&signature), PACKET_remaining(&signature), tbs, tbslen); OPENSSL_free(tbs); if (rv <= 0) { SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_BAD_SIGNATURE); goto err; } EVP_MD_CTX_free(md_ctx); md_ctx = NULL; } else { /* aNULL, aSRP or PSK do not need public keys */ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP)) && !(alg_k & SSL_PSK)) { /* Might be wrong key type, check it */ if (ssl3_check_cert_and_algorithm(s)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_BAD_DATA); } /* else this shouldn't happen, SSLfatal() already called */ goto err; } /* still data left over */ if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_EXTRA_DATA_IN_MESSAGE); goto err; } } return MSG_PROCESS_CONTINUE_READING; err: EVP_MD_CTX_free(md_ctx); return MSG_PROCESS_ERROR; } MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt) { size_t i; /* Clear certificate validity flags */ for (i = 0; i < SSL_PKEY_NUM; i++) s->s3->tmp.valid_flags[i] = 0; if (SSL_IS_TLS13(s)) { PACKET reqctx, extensions; RAW_EXTENSION *rawexts = NULL; if ((s->shutdown & SSL_SENT_SHUTDOWN) != 0) { /* * We already sent close_notify. This can only happen in TLSv1.3 * post-handshake messages. We can't reasonably respond to this, so * we just ignore it */ return MSG_PROCESS_FINISHED_READING; } /* Free and zero certificate types: it is not present in TLS 1.3 */ OPENSSL_free(s->s3->tmp.ctype); s->s3->tmp.ctype = NULL; s->s3->tmp.ctype_len = 0; OPENSSL_free(s->pha_context); s->pha_context = NULL; + s->pha_context_len = 0; if (!PACKET_get_length_prefixed_1(pkt, &reqctx) || !PACKET_memdup(&reqctx, &s->pha_context, &s->pha_context_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } if (!PACKET_get_length_prefixed_2(pkt, &extensions)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_BAD_LENGTH); return MSG_PROCESS_ERROR; } if (!tls_collect_extensions(s, &extensions, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, &rawexts, NULL, 1) || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, rawexts, NULL, 0, 1)) { /* SSLfatal() already called */ OPENSSL_free(rawexts); return MSG_PROCESS_ERROR; } OPENSSL_free(rawexts); if (!tls1_process_sigalgs(s)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_BAD_LENGTH); return MSG_PROCESS_ERROR; } } else { PACKET ctypes; /* get the certificate types */ if (!PACKET_get_length_prefixed_1(pkt, &ctypes)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } if (!PACKET_memdup(&ctypes, &s->s3->tmp.ctype, &s->s3->tmp.ctype_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR); return MSG_PROCESS_ERROR; } if (SSL_USE_SIGALGS(s)) { PACKET sigalgs; if (!PACKET_get_length_prefixed_2(pkt, &sigalgs)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } /* * Despite this being for certificates, preserve compatibility * with pre-TLS 1.3 and use the regular sigalgs field. */ if (!tls1_save_sigalgs(s, &sigalgs, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_SIGNATURE_ALGORITHMS_ERROR); return MSG_PROCESS_ERROR; } if (!tls1_process_sigalgs(s)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE); return MSG_PROCESS_ERROR; } } /* get the CA RDNs */ if (!parse_ca_names(s, pkt)) { /* SSLfatal() already called */ return MSG_PROCESS_ERROR; } } if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } /* we should setup a certificate to return.... */ s->s3->tmp.cert_req = 1; /* * In TLSv1.3 we don't prepare the client certificate yet. We wait until * after the CertificateVerify message has been received. This is because * in TLSv1.3 the CertificateRequest arrives before the Certificate message * but in TLSv1.2 it is the other way around. We want to make sure that * SSL_get_peer_certificate() returns something sensible in * client_cert_cb. */ if (SSL_IS_TLS13(s) && s->post_handshake_auth != SSL_PHA_REQUESTED) return MSG_PROCESS_CONTINUE_READING; return MSG_PROCESS_CONTINUE_PROCESSING; } MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) { unsigned int ticklen; unsigned long ticket_lifetime_hint, age_add = 0; unsigned int sess_len; RAW_EXTENSION *exts = NULL; PACKET nonce; PACKET_null_init(&nonce); if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint) || (SSL_IS_TLS13(s) && (!PACKET_get_net_4(pkt, &age_add) || !PACKET_get_length_prefixed_1(pkt, &nonce))) || !PACKET_get_net_2(pkt, &ticklen) || (SSL_IS_TLS13(s) ? (ticklen == 0 || PACKET_remaining(pkt) < ticklen) : PACKET_remaining(pkt) != ticklen)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH); goto err; } /* * Server is allowed to change its mind (in <=TLSv1.2) and send an empty * ticket. We already checked this TLSv1.3 case above, so it should never * be 0 here in that instance */ if (ticklen == 0) return MSG_PROCESS_CONTINUE_READING; /* * Sessions must be immutable once they go into the session cache. Otherwise * we can get multi-thread problems. Therefore we don't "update" sessions, * we replace them with a duplicate. In TLSv1.3 we need to do this every * time a NewSessionTicket arrives because those messages arrive * post-handshake and the session may have already gone into the session * cache. */ if (SSL_IS_TLS13(s) || s->session->session_id_length > 0) { SSL_SESSION *new_sess; /* * We reused an existing session, so we need to replace it with a new * one */ if ((new_sess = ssl_session_dup(s->session, 0)) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE); goto err; } if ((s->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) != 0 && !SSL_IS_TLS13(s)) { /* * In TLSv1.2 and below the arrival of a new tickets signals that * any old ticket we were using is now out of date, so we remove the * old session from the cache. We carry on if this fails */ SSL_CTX_remove_session(s->session_ctx, s->session); } SSL_SESSION_free(s->session); s->session = new_sess; } /* * Technically the cast to long here is not guaranteed by the C standard - * but we use it elsewhere, so this should be ok. */ s->session->time = (long)time(NULL); OPENSSL_free(s->session->ext.tick); s->session->ext.tick = NULL; s->session->ext.ticklen = 0; s->session->ext.tick = OPENSSL_malloc(ticklen); if (s->session->ext.tick == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE); goto err; } if (!PACKET_copy_bytes(pkt, s->session->ext.tick, ticklen)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH); goto err; } s->session->ext.tick_lifetime_hint = ticket_lifetime_hint; s->session->ext.tick_age_add = age_add; s->session->ext.ticklen = ticklen; if (SSL_IS_TLS13(s)) { PACKET extpkt; if (!PACKET_as_length_prefixed_2(pkt, &extpkt) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH); goto err; } if (!tls_collect_extensions(s, &extpkt, SSL_EXT_TLS1_3_NEW_SESSION_TICKET, &exts, NULL, 1) || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_NEW_SESSION_TICKET, exts, NULL, 0, 1)) { /* SSLfatal() already called */ goto err; } } /* * There are two ways to detect a resumed ticket session. One is to set * an appropriate session ID and then the server must return a match in * ServerHello. This allows the normal client session ID matching to work * and we know much earlier that the ticket has been accepted. The * other way is to set zero length session ID when the ticket is * presented and rely on the handshake to determine session resumption. * We choose the former approach because this fits in with assumptions * elsewhere in OpenSSL. The session ID is set to the SHA256 (or SHA1 is * SHA256 is disabled) hash of the ticket. */ /* * TODO(size_t): we use sess_len here because EVP_Digest expects an int * but s->session->session_id_length is a size_t */ if (!EVP_Digest(s->session->ext.tick, ticklen, s->session->session_id, &sess_len, EVP_sha256(), NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_EVP_LIB); goto err; } s->session->session_id_length = sess_len; s->session->not_resumable = 0; /* This is a standalone message in TLSv1.3, so there is no more to read */ if (SSL_IS_TLS13(s)) { const EVP_MD *md = ssl_handshake_md(s); int hashleni = EVP_MD_size(md); size_t hashlen; static const unsigned char nonce_label[] = "resumption"; /* Ensure cast to size_t is safe */ if (!ossl_assert(hashleni >= 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR); goto err; } hashlen = (size_t)hashleni; if (!tls13_hkdf_expand(s, md, s->resumption_master_secret, nonce_label, sizeof(nonce_label) - 1, PACKET_data(&nonce), PACKET_remaining(&nonce), s->session->master_key, hashlen, 1)) { /* SSLfatal() already called */ goto err; } s->session->master_key_length = hashlen; OPENSSL_free(exts); ssl_update_cache(s, SSL_SESS_CACHE_CLIENT); return MSG_PROCESS_FINISHED_READING; } return MSG_PROCESS_CONTINUE_READING; err: OPENSSL_free(exts); return MSG_PROCESS_ERROR; } /* * In TLSv1.3 this is called from the extensions code, otherwise it is used to * parse a separate message. Returns 1 on success or 0 on failure */ int tls_process_cert_status_body(SSL *s, PACKET *pkt) { size_t resplen; unsigned int type; if (!PACKET_get_1(pkt, &type) || type != TLSEXT_STATUSTYPE_ocsp) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, SSL_R_UNSUPPORTED_STATUS_TYPE); return 0; } if (!PACKET_get_net_3_len(pkt, &resplen) || PACKET_remaining(pkt) != resplen) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, SSL_R_LENGTH_MISMATCH); return 0; } s->ext.ocsp.resp = OPENSSL_malloc(resplen); if (s->ext.ocsp.resp == NULL) { + s->ext.ocsp.resp_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, ERR_R_MALLOC_FAILURE); return 0; } + s->ext.ocsp.resp_len = resplen; if (!PACKET_copy_bytes(pkt, s->ext.ocsp.resp, resplen)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CERT_STATUS_BODY, SSL_R_LENGTH_MISMATCH); return 0; } - s->ext.ocsp.resp_len = resplen; return 1; } MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt) { if (!tls_process_cert_status_body(s, pkt)) { /* SSLfatal() already called */ return MSG_PROCESS_ERROR; } return MSG_PROCESS_CONTINUE_READING; } /* * Perform miscellaneous checks and processing after we have received the * server's initial flight. In TLS1.3 this is after the Server Finished message. * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0 * on failure. */ int tls_process_initial_server_flight(SSL *s) { /* * at this point we check that we have the required stuff from * the server */ if (!ssl3_check_cert_and_algorithm(s)) { /* SSLfatal() already called */ return 0; } /* * Call the ocsp status callback if needed. The |ext.ocsp.resp| and * |ext.ocsp.resp_len| values will be set if we actually received a status * message, or NULL and -1 otherwise */ if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing && s->ctx->ext.status_cb != NULL) { int ret = s->ctx->ext.status_cb(s, s->ctx->ext.status_arg); if (ret == 0) { SSLfatal(s, SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE, SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT, SSL_R_INVALID_STATUS_RESPONSE); return 0; } if (ret < 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT, ERR_R_MALLOC_FAILURE); return 0; } } #ifndef OPENSSL_NO_CT if (s->ct_validation_callback != NULL) { /* Note we validate the SCTs whether or not we abort on error */ if (!ssl_validate_ct(s) && (s->verify_mode & SSL_VERIFY_PEER)) { /* SSLfatal() already called */ return 0; } } #endif return 1; } MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt) { if (PACKET_remaining(pkt) > 0) { /* should contain no data */ SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_SERVER_DONE, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } #ifndef OPENSSL_NO_SRP if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) { if (SRP_Calc_A_param(s) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_SERVER_DONE, SSL_R_SRP_A_CALC); return MSG_PROCESS_ERROR; } } #endif if (!tls_process_initial_server_flight(s)) { /* SSLfatal() already called */ return MSG_PROCESS_ERROR; } return MSG_PROCESS_FINISHED_READING; } static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_PSK int ret = 0; /* * The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes to return a * \0-terminated identity. The last byte is for us for simulating * strnlen. */ char identity[PSK_MAX_IDENTITY_LEN + 1]; size_t identitylen = 0; unsigned char psk[PSK_MAX_PSK_LEN]; unsigned char *tmppsk = NULL; char *tmpidentity = NULL; size_t psklen = 0; if (s->psk_client_callback == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, SSL_R_PSK_NO_CLIENT_CB); goto err; } memset(identity, 0, sizeof(identity)); psklen = s->psk_client_callback(s, s->session->psk_identity_hint, identity, sizeof(identity) - 1, psk, sizeof(psk)); if (psklen > PSK_MAX_PSK_LEN) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); goto err; } else if (psklen == 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, SSL_R_PSK_IDENTITY_NOT_FOUND); goto err; } identitylen = strlen(identity); if (identitylen > PSK_MAX_IDENTITY_LEN) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); goto err; } tmppsk = OPENSSL_memdup(psk, psklen); tmpidentity = OPENSSL_strdup(identity); if (tmppsk == NULL || tmpidentity == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_MALLOC_FAILURE); goto err; } OPENSSL_free(s->s3->tmp.psk); s->s3->tmp.psk = tmppsk; s->s3->tmp.psklen = psklen; tmppsk = NULL; OPENSSL_free(s->session->psk_identity); s->session->psk_identity = tmpidentity; tmpidentity = NULL; if (!WPACKET_sub_memcpy_u16(pkt, identity, identitylen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); goto err; } ret = 1; err: OPENSSL_cleanse(psk, psklen); OPENSSL_cleanse(identity, sizeof(identity)); OPENSSL_clear_free(tmppsk, psklen); OPENSSL_clear_free(tmpidentity, identitylen); return ret; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_RSA unsigned char *encdata = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *pctx = NULL; size_t enclen; unsigned char *pms = NULL; size_t pmslen = 0; if (s->session->peer == NULL) { /* * We should always have a server certificate with SSL_kRSA. */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR); return 0; } pkey = X509_get0_pubkey(s->session->peer); if (EVP_PKEY_get0_RSA(pkey) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR); return 0; } pmslen = SSL_MAX_MASTER_KEY_LENGTH; pms = OPENSSL_malloc(pmslen); if (pms == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE); return 0; } pms[0] = s->client_version >> 8; pms[1] = s->client_version & 0xff; /* TODO(size_t): Convert this function */ if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE); goto err; } /* Fix buf for TLS and beyond */ if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR); goto err; } pctx = EVP_PKEY_CTX_new(pkey, NULL); if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0 || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_EVP_LIB); goto err; } if (!WPACKET_allocate_bytes(pkt, enclen, &encdata) || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT); goto err; } EVP_PKEY_CTX_free(pctx); pctx = NULL; /* Fix buf for TLS and beyond */ if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR); goto err; } /* Log the premaster secret, if logging is enabled. */ if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) { /* SSLfatal() already called */ goto err; } s->s3->tmp.pms = pms; s->s3->tmp.pmslen = pmslen; return 1; err: OPENSSL_clear_free(pms, pmslen); EVP_PKEY_CTX_free(pctx); return 0; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_construct_cke_dhe(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_DH DH *dh_clnt = NULL; const BIGNUM *pub_key; EVP_PKEY *ckey = NULL, *skey = NULL; unsigned char *keybytes = NULL; skey = s->s3->peer_tmp; if (skey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR); goto err; } ckey = ssl_generate_pkey(skey); if (ckey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR); goto err; } dh_clnt = EVP_PKEY_get0_DH(ckey); if (dh_clnt == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR); goto err; } if (ssl_derive(s, ckey, skey, 0) == 0) { /* SSLfatal() already called */ goto err; } /* send off the data */ DH_get0_key(dh_clnt, &pub_key, NULL); if (!WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(pub_key), &keybytes)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR); goto err; } BN_bn2bin(pub_key, keybytes); EVP_PKEY_free(ckey); return 1; err: EVP_PKEY_free(ckey); return 0; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_EC unsigned char *encodedPoint = NULL; size_t encoded_pt_len = 0; EVP_PKEY *ckey = NULL, *skey = NULL; int ret = 0; skey = s->s3->peer_tmp; if (skey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR); return 0; } ckey = ssl_generate_pkey(skey); if (ckey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_MALLOC_FAILURE); goto err; } if (ssl_derive(s, ckey, skey, 0) == 0) { /* SSLfatal() already called */ goto err; } /* Generate encoding of client key */ encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(ckey, &encodedPoint); if (encoded_pt_len == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EC_LIB); goto err; } if (!WPACKET_sub_memcpy_u8(pkt, encodedPoint, encoded_pt_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR); goto err; } ret = 1; err: OPENSSL_free(encodedPoint); EVP_PKEY_free(ckey); return ret; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_GOST /* GOST key exchange message creation */ EVP_PKEY_CTX *pkey_ctx = NULL; X509 *peer_cert; size_t msglen; unsigned int md_len; unsigned char shared_ukm[32], tmp[256]; EVP_MD_CTX *ukm_hash = NULL; int dgst_nid = NID_id_GostR3411_94; unsigned char *pms = NULL; size_t pmslen = 0; if ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0) dgst_nid = NID_id_GostR3411_2012_256; /* * Get server certificate PKEY and create ctx from it */ peer_cert = s->session->peer; if (!peer_cert) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_CKE_GOST, SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); return 0; } pkey_ctx = EVP_PKEY_CTX_new(X509_get0_pubkey(peer_cert), NULL); if (pkey_ctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_MALLOC_FAILURE); return 0; } /* * If we have send a certificate, and certificate key * parameters match those of server certificate, use * certificate key for key exchange */ /* Otherwise, generate ephemeral key pair */ pmslen = 32; pms = OPENSSL_malloc(pmslen); if (pms == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_MALLOC_FAILURE); goto err; } if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0 /* Generate session key * TODO(size_t): Convert this function */ || RAND_bytes(pms, (int)pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR); goto err; }; /* * Compute shared IV and store it in algorithm-specific context * data */ ukm_hash = EVP_MD_CTX_new(); if (ukm_hash == NULL || EVP_DigestInit(ukm_hash, EVP_get_digestbynid(dgst_nid)) <= 0 || EVP_DigestUpdate(ukm_hash, s->s3->client_random, SSL3_RANDOM_SIZE) <= 0 || EVP_DigestUpdate(ukm_hash, s->s3->server_random, SSL3_RANDOM_SIZE) <= 0 || EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR); goto err; } EVP_MD_CTX_free(ukm_hash); ukm_hash = NULL; if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) < 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, SSL_R_LIBRARY_BUG); goto err; } /* Make GOST keytransport blob message */ /* * Encapsulate it into sequence */ msglen = 255; if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, pms, pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, SSL_R_LIBRARY_BUG); goto err; } if (!WPACKET_put_bytes_u8(pkt, V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED) || (msglen >= 0x80 && !WPACKET_put_bytes_u8(pkt, 0x81)) || !WPACKET_sub_memcpy_u8(pkt, tmp, msglen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR); goto err; } EVP_PKEY_CTX_free(pkey_ctx); s->s3->tmp.pms = pms; s->s3->tmp.pmslen = pmslen; return 1; err: EVP_PKEY_CTX_free(pkey_ctx); OPENSSL_clear_free(pms, pmslen); EVP_MD_CTX_free(ukm_hash); return 0; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_construct_cke_srp(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_SRP unsigned char *abytes = NULL; if (s->srp_ctx.A == NULL || !WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(s->srp_ctx.A), &abytes)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_SRP, ERR_R_INTERNAL_ERROR); return 0; } BN_bn2bin(s->srp_ctx.A, abytes); OPENSSL_free(s->session->srp_username); s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login); if (s->session->srp_username == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_SRP, ERR_R_MALLOC_FAILURE); return 0; } return 1; #else SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_SRP, ERR_R_INTERNAL_ERROR); return 0; #endif } int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) { unsigned long alg_k; alg_k = s->s3->tmp.new_cipher->algorithm_mkey; /* * All of the construct functions below call SSLfatal() if necessary so * no need to do so here. */ if ((alg_k & SSL_PSK) && !tls_construct_cke_psk_preamble(s, pkt)) goto err; if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) { if (!tls_construct_cke_rsa(s, pkt)) goto err; } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { if (!tls_construct_cke_dhe(s, pkt)) goto err; } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { if (!tls_construct_cke_ecdhe(s, pkt)) goto err; } else if (alg_k & SSL_kGOST) { if (!tls_construct_cke_gost(s, pkt)) goto err; } else if (alg_k & SSL_kSRP) { if (!tls_construct_cke_srp(s, pkt)) goto err; } else if (!(alg_k & SSL_kPSK)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } return 1; err: OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen); s->s3->tmp.pms = NULL; + s->s3->tmp.pmslen = 0; #ifndef OPENSSL_NO_PSK OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen); s->s3->tmp.psk = NULL; + s->s3->tmp.psklen = 0; #endif return 0; } int tls_client_key_exchange_post_work(SSL *s) { unsigned char *pms = NULL; size_t pmslen = 0; pms = s->s3->tmp.pms; pmslen = s->s3->tmp.pmslen; #ifndef OPENSSL_NO_SRP /* Check for SRP */ if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) { if (!srp_generate_client_master_secret(s)) { /* SSLfatal() already called */ goto err; } return 1; } #endif if (pms == NULL && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, ERR_R_MALLOC_FAILURE); goto err; } if (!ssl_generate_master_secret(s, pms, pmslen, 1)) { /* SSLfatal() already called */ /* ssl_generate_master_secret frees the pms even on error */ pms = NULL; pmslen = 0; goto err; } pms = NULL; pmslen = 0; #ifndef OPENSSL_NO_SCTP if (SSL_IS_DTLS(s)) { unsigned char sctpauthkey[64]; char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; size_t labellen; /* * Add new shared key for SCTP-Auth, will be ignored if no SCTP * used. */ memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, sizeof(DTLS1_SCTP_AUTH_LABEL)); /* Don't include the terminating zero. */ labellen = sizeof(labelbuffer) - 1; if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) labellen += 1; if (SSL_export_keying_material(s, sctpauthkey, sizeof(sctpauthkey), labelbuffer, labellen, NULL, 0, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, ERR_R_INTERNAL_ERROR); goto err; } BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, sizeof(sctpauthkey), sctpauthkey); } #endif return 1; err: OPENSSL_clear_free(pms, pmslen); s->s3->tmp.pms = NULL; + s->s3->tmp.pmslen = 0; return 0; } /* * Check a certificate can be used for client authentication. Currently check * cert exists, if we have a suitable digest for TLS 1.2 if static DH client * certificates can be used and optionally checks suitability for Suite B. */ static int ssl3_check_client_certificate(SSL *s) { /* If no suitable signature algorithm can't use certificate */ if (!tls_choose_sigalg(s, 0) || s->s3->tmp.sigalg == NULL) return 0; /* * If strict mode check suitability of chain before using it. This also * adjusts suite B digest if necessary. */ if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT && !tls1_check_chain(s, NULL, NULL, NULL, -2)) return 0; return 1; } WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) { X509 *x509 = NULL; EVP_PKEY *pkey = NULL; int i; if (wst == WORK_MORE_A) { /* Let cert callback update client certificates if required */ if (s->cert->cert_cb) { i = s->cert->cert_cb(s, s->cert->cert_cb_arg); if (i < 0) { s->rwstate = SSL_X509_LOOKUP; return WORK_MORE_A; } if (i == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, SSL_R_CALLBACK_FAILED); return WORK_ERROR; } s->rwstate = SSL_NOTHING; } if (ssl3_check_client_certificate(s)) { if (s->post_handshake_auth == SSL_PHA_REQUESTED) { return WORK_FINISHED_STOP; } return WORK_FINISHED_CONTINUE; } /* Fall through to WORK_MORE_B */ wst = WORK_MORE_B; } /* We need to get a client cert */ if (wst == WORK_MORE_B) { /* * If we get an error, we need to ssl->rwstate=SSL_X509_LOOKUP; * return(-1); We then get retied later */ i = ssl_do_client_cert_cb(s, &x509, &pkey); if (i < 0) { s->rwstate = SSL_X509_LOOKUP; return WORK_MORE_B; } s->rwstate = SSL_NOTHING; if ((i == 1) && (pkey != NULL) && (x509 != NULL)) { if (!SSL_use_certificate(s, x509) || !SSL_use_PrivateKey(s, pkey)) i = 0; } else if (i == 1) { i = 0; SSLerr(SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); } X509_free(x509); EVP_PKEY_free(pkey); if (i && !ssl3_check_client_certificate(s)) i = 0; if (i == 0) { if (s->version == SSL3_VERSION) { s->s3->tmp.cert_req = 0; ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE); return WORK_FINISHED_CONTINUE; } else { s->s3->tmp.cert_req = 2; if (!ssl3_digest_cached_records(s, 0)) { /* SSLfatal() already called */ return WORK_ERROR; } } } if (s->post_handshake_auth == SSL_PHA_REQUESTED) return WORK_FINISHED_STOP; return WORK_FINISHED_CONTINUE; } /* Shouldn't ever get here */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR); return WORK_ERROR; } int tls_construct_client_certificate(SSL *s, WPACKET *pkt) { if (SSL_IS_TLS13(s)) { if (s->pha_context == NULL) { /* no context available, add 0-length context */ if (!WPACKET_put_bytes_u8(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR); return 0; } } else if (!WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR); return 0; } } if (!ssl3_output_cert_chain(s, pkt, (s->s3->tmp.cert_req == 2) ? NULL : s->cert->key)) { /* SSLfatal() already called */ return 0; } if (SSL_IS_TLS13(s) && SSL_IS_FIRST_HANDSHAKE(s) && (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) { /* * This is a fatal error, which leaves enc_write_ctx in an inconsistent * state and thus ssl3_send_alert may crash. */ SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, SSL_R_CANNOT_CHANGE_CIPHER); return 0; } return 1; } int ssl3_check_cert_and_algorithm(SSL *s) { const SSL_CERT_LOOKUP *clu; size_t idx; long alg_k, alg_a; alg_k = s->s3->tmp.new_cipher->algorithm_mkey; alg_a = s->s3->tmp.new_cipher->algorithm_auth; /* we don't have a certificate */ if (!(alg_a & SSL_aCERT)) return 1; /* This is the passed certificate */ clu = ssl_cert_lookup_by_pkey(X509_get0_pubkey(s->session->peer), &idx); /* Check certificate is recognised and suitable for cipher */ if (clu == NULL || (alg_a & clu->amask) == 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_MISSING_SIGNING_CERT); return 0; } #ifndef OPENSSL_NO_EC if (clu->amask & SSL_aECDSA) { if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s)) return 1; SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_BAD_ECC_CERT); return 0; } #endif #ifndef OPENSSL_NO_RSA if (alg_k & (SSL_kRSA | SSL_kRSAPSK) && idx != SSL_PKEY_RSA) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_MISSING_RSA_ENCRYPTING_CERT); return 0; } #endif #ifndef OPENSSL_NO_DH if ((alg_k & SSL_kDHE) && (s->s3->peer_tmp == NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR); return 0; } #endif return 1; } #ifndef OPENSSL_NO_NEXTPROTONEG int tls_construct_next_proto(SSL *s, WPACKET *pkt) { size_t len, padding_len; unsigned char *padding = NULL; len = s->ext.npn_len; padding_len = 32 - ((len + 2) % 32); if (!WPACKET_sub_memcpy_u8(pkt, s->ext.npn, len) || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_NEXT_PROTO, ERR_R_INTERNAL_ERROR); return 0; } memset(padding, 0, padding_len); return 1; } #endif MSG_PROCESS_RETURN tls_process_hello_req(SSL *s, PACKET *pkt) { if (PACKET_remaining(pkt) > 0) { /* should contain no data */ SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_HELLO_REQ, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } if ((s->options & SSL_OP_NO_RENEGOTIATION)) { ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION); return MSG_PROCESS_FINISHED_READING; } /* * This is a historical discrepancy (not in the RFC) maintained for * compatibility reasons. If a TLS client receives a HelloRequest it will * attempt an abbreviated handshake. However if a DTLS client receives a * HelloRequest it will do a full handshake. Either behaviour is reasonable * but doing one for TLS and another for DTLS is odd. */ if (SSL_IS_DTLS(s)) SSL_renegotiate(s); else SSL_renegotiate_abbreviated(s); return MSG_PROCESS_FINISHED_READING; } static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt) { PACKET extensions; RAW_EXTENSION *rawexts = NULL; if (!PACKET_as_length_prefixed_2(pkt, &extensions) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS, SSL_R_LENGTH_MISMATCH); goto err; } if (!tls_collect_extensions(s, &extensions, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, &rawexts, NULL, 1) || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, rawexts, NULL, 0, 1)) { /* SSLfatal() already called */ goto err; } OPENSSL_free(rawexts); return MSG_PROCESS_CONTINUE_READING; err: OPENSSL_free(rawexts); return MSG_PROCESS_ERROR; } int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey) { int i = 0; #ifndef OPENSSL_NO_ENGINE if (s->ctx->client_cert_engine) { i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s, SSL_get_client_CA_list(s), px509, ppkey, NULL, NULL, NULL); if (i != 0) return i; } #endif if (s->ctx->client_cert_cb) i = s->ctx->client_cert_cb(s, px509, ppkey); return i; } int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) { int i; size_t totlen = 0, len, maxlen, maxverok = 0; int empty_reneg_info_scsv = !s->renegotiate; /* Set disabled masks for this session */ if (!ssl_set_client_disabled(s)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, SSL_R_NO_PROTOCOLS_AVAILABLE); return 0; } if (sk == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR); return 0; } #ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH # if OPENSSL_MAX_TLS1_2_CIPHER_LENGTH < 6 # error Max cipher length too short # endif /* * Some servers hang if client hello > 256 bytes as hack workaround * chop number of supported ciphers to keep it well below this if we * use TLS v1.2 */ if (TLS1_get_version(s) >= TLS1_2_VERSION) maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1; else #endif /* Maximum length that can be stored in 2 bytes. Length must be even */ maxlen = 0xfffe; if (empty_reneg_info_scsv) maxlen -= 2; if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) maxlen -= 2; for (i = 0; i < sk_SSL_CIPHER_num(sk) && totlen < maxlen; i++) { const SSL_CIPHER *c; c = sk_SSL_CIPHER_value(sk, i); /* Skip disabled ciphers */ if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) continue; if (!s->method->put_cipher_by_char(c, pkt, &len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR); return 0; } /* Sanity check that the maximum version we offer has ciphers enabled */ if (!maxverok) { if (SSL_IS_DTLS(s)) { if (DTLS_VERSION_GE(c->max_dtls, s->s3->tmp.max_ver) && DTLS_VERSION_LE(c->min_dtls, s->s3->tmp.max_ver)) maxverok = 1; } else { if (c->max_tls >= s->s3->tmp.max_ver && c->min_tls <= s->s3->tmp.max_ver) maxverok = 1; } } totlen += len; } if (totlen == 0 || !maxverok) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, SSL_R_NO_CIPHERS_AVAILABLE); if (!maxverok) ERR_add_error_data(1, "No ciphers enabled for max supported " "SSL/TLS version"); return 0; } if (totlen != 0) { if (empty_reneg_info_scsv) { static SSL_CIPHER scsv = { 0, NULL, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR); return 0; } } if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) { static SSL_CIPHER scsv = { 0, NULL, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR); return 0; } } } return 1; } int tls_construct_end_of_early_data(SSL *s, WPACKET *pkt) { if (s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_END_OF_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING; return 1; } diff --git a/crypto/openssl/ssl/statem/statem_srvr.c b/crypto/openssl/ssl/statem/statem_srvr.c index 14cb27e6db01..fb26c0ba8148 100644 --- a/crypto/openssl/ssl/statem/statem_srvr.c +++ b/crypto/openssl/ssl/statem/statem_srvr.c @@ -1,4285 +1,4296 @@ /* * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include #include "../ssl_local.h" #include "statem_local.h" #include "internal/constant_time.h" #include "internal/cryptlib.h" #include #include #include #include #include #include #include #include #include #include #define TICKET_NONCE_SIZE 8 typedef struct { ASN1_TYPE *kxBlob; ASN1_TYPE *opaqueBlob; } GOST_KX_MESSAGE; DECLARE_ASN1_FUNCTIONS(GOST_KX_MESSAGE) ASN1_SEQUENCE(GOST_KX_MESSAGE) = { ASN1_SIMPLE(GOST_KX_MESSAGE, kxBlob, ASN1_ANY), ASN1_OPT(GOST_KX_MESSAGE, opaqueBlob, ASN1_ANY), } ASN1_SEQUENCE_END(GOST_KX_MESSAGE) IMPLEMENT_ASN1_FUNCTIONS(GOST_KX_MESSAGE) static int tls_construct_encrypted_extensions(SSL *s, WPACKET *pkt); /* * ossl_statem_server13_read_transition() encapsulates the logic for the allowed * handshake state transitions when a TLSv1.3 server is reading messages from * the client. The message type that the client has sent is provided in |mt|. * The current state is in |s->statem.hand_state|. * * Return values are 1 for success (transition allowed) and 0 on error * (transition not allowed) */ static int ossl_statem_server13_read_transition(SSL *s, int mt) { OSSL_STATEM *st = &s->statem; /* * Note: There is no case for TLS_ST_BEFORE because at that stage we have * not negotiated TLSv1.3 yet, so that case is handled by * ossl_statem_server_read_transition() */ switch (st->hand_state) { default: break; case TLS_ST_EARLY_DATA: if (s->hello_retry_request == SSL_HRR_PENDING) { if (mt == SSL3_MT_CLIENT_HELLO) { st->hand_state = TLS_ST_SR_CLNT_HELLO; return 1; } break; } else if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { if (mt == SSL3_MT_END_OF_EARLY_DATA) { st->hand_state = TLS_ST_SR_END_OF_EARLY_DATA; return 1; } break; } /* Fall through */ case TLS_ST_SR_END_OF_EARLY_DATA: case TLS_ST_SW_FINISHED: if (s->s3->tmp.cert_request) { if (mt == SSL3_MT_CERTIFICATE) { st->hand_state = TLS_ST_SR_CERT; return 1; } } else { if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_SR_FINISHED; return 1; } } break; case TLS_ST_SR_CERT: if (s->session->peer == NULL) { if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_SR_FINISHED; return 1; } } else { if (mt == SSL3_MT_CERTIFICATE_VERIFY) { st->hand_state = TLS_ST_SR_CERT_VRFY; return 1; } } break; case TLS_ST_SR_CERT_VRFY: if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_SR_FINISHED; return 1; } break; case TLS_ST_OK: /* * Its never ok to start processing handshake messages in the middle of * early data (i.e. before we've received the end of early data alert) */ if (s->early_data_state == SSL_EARLY_DATA_READING) break; if (mt == SSL3_MT_CERTIFICATE && s->post_handshake_auth == SSL_PHA_REQUESTED) { st->hand_state = TLS_ST_SR_CERT; return 1; } if (mt == SSL3_MT_KEY_UPDATE) { st->hand_state = TLS_ST_SR_KEY_UPDATE; return 1; } break; } /* No valid transition found */ return 0; } /* * ossl_statem_server_read_transition() encapsulates the logic for the allowed * handshake state transitions when the server is reading messages from the * client. The message type that the client has sent is provided in |mt|. The * current state is in |s->statem.hand_state|. * * Return values are 1 for success (transition allowed) and 0 on error * (transition not allowed) */ int ossl_statem_server_read_transition(SSL *s, int mt) { OSSL_STATEM *st = &s->statem; if (SSL_IS_TLS13(s)) { if (!ossl_statem_server13_read_transition(s, mt)) goto err; return 1; } switch (st->hand_state) { default: break; case TLS_ST_BEFORE: case TLS_ST_OK: case DTLS_ST_SW_HELLO_VERIFY_REQUEST: if (mt == SSL3_MT_CLIENT_HELLO) { st->hand_state = TLS_ST_SR_CLNT_HELLO; return 1; } break; case TLS_ST_SW_SRVR_DONE: /* * If we get a CKE message after a ServerDone then either * 1) We didn't request a Certificate * OR * 2) If we did request one then * a) We allow no Certificate to be returned * AND * b) We are running SSL3 (in TLS1.0+ the client must return a 0 * list if we requested a certificate) */ if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) { if (s->s3->tmp.cert_request) { if (s->version == SSL3_VERSION) { if ((s->verify_mode & SSL_VERIFY_PEER) && (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) { /* * This isn't an unexpected message as such - we're just * not going to accept it because we require a client * cert. */ SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); return 0; } st->hand_state = TLS_ST_SR_KEY_EXCH; return 1; } } else { st->hand_state = TLS_ST_SR_KEY_EXCH; return 1; } } else if (s->s3->tmp.cert_request) { if (mt == SSL3_MT_CERTIFICATE) { st->hand_state = TLS_ST_SR_CERT; return 1; } } break; case TLS_ST_SR_CERT: if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) { st->hand_state = TLS_ST_SR_KEY_EXCH; return 1; } break; case TLS_ST_SR_KEY_EXCH: /* * We should only process a CertificateVerify message if we have * received a Certificate from the client. If so then |s->session->peer| * will be non NULL. In some instances a CertificateVerify message is * not required even if the peer has sent a Certificate (e.g. such as in * the case of static DH). In that case |st->no_cert_verify| should be * set. */ if (s->session->peer == NULL || st->no_cert_verify) { if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { /* * For the ECDH ciphersuites when the client sends its ECDH * pub key in a certificate, the CertificateVerify message is * not sent. Also for GOST ciphersuites when the client uses * its key from the certificate for key exchange. */ st->hand_state = TLS_ST_SR_CHANGE; return 1; } } else { if (mt == SSL3_MT_CERTIFICATE_VERIFY) { st->hand_state = TLS_ST_SR_CERT_VRFY; return 1; } } break; case TLS_ST_SR_CERT_VRFY: if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_SR_CHANGE; return 1; } break; case TLS_ST_SR_CHANGE: #ifndef OPENSSL_NO_NEXTPROTONEG if (s->s3->npn_seen) { if (mt == SSL3_MT_NEXT_PROTO) { st->hand_state = TLS_ST_SR_NEXT_PROTO; return 1; } } else { #endif if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_SR_FINISHED; return 1; } #ifndef OPENSSL_NO_NEXTPROTONEG } #endif break; #ifndef OPENSSL_NO_NEXTPROTONEG case TLS_ST_SR_NEXT_PROTO: if (mt == SSL3_MT_FINISHED) { st->hand_state = TLS_ST_SR_FINISHED; return 1; } break; #endif case TLS_ST_SW_FINISHED: if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_SR_CHANGE; return 1; } break; } err: /* No valid transition found */ if (SSL_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { BIO *rbio; /* * CCS messages don't have a message sequence number so this is probably * because of an out-of-order CCS. We'll just drop it. */ s->init_num = 0; s->rwstate = SSL_READING; rbio = SSL_get_rbio(s); BIO_clear_retry_flags(rbio); BIO_set_retry_read(rbio); return 0; } SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE, SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION, SSL_R_UNEXPECTED_MESSAGE); return 0; } /* * Should we send a ServerKeyExchange message? * * Valid return values are: * 1: Yes * 0: No */ static int send_server_key_exchange(SSL *s) { unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; /* * only send a ServerKeyExchange if DH or fortezza but we have a * sign only certificate PSK: may send PSK identity hints For * ECC ciphersuites, we send a serverKeyExchange message only if * the cipher suite is either ECDH-anon or ECDHE. In other cases, * the server certificate contains the server's public key for * key exchange. */ if (alg_k & (SSL_kDHE | SSL_kECDHE) /* * PSK: send ServerKeyExchange if PSK identity hint if * provided */ #ifndef OPENSSL_NO_PSK /* Only send SKE if we have identity hint for plain PSK */ || ((alg_k & (SSL_kPSK | SSL_kRSAPSK)) && s->cert->psk_identity_hint) /* For other PSK always send SKE */ || (alg_k & (SSL_PSK & (SSL_kDHEPSK | SSL_kECDHEPSK))) #endif #ifndef OPENSSL_NO_SRP /* SRP: send ServerKeyExchange */ || (alg_k & SSL_kSRP) #endif ) { return 1; } return 0; } /* * Should we send a CertificateRequest message? * * Valid return values are: * 1: Yes * 0: No */ int send_certificate_request(SSL *s) { if ( /* don't request cert unless asked for it: */ s->verify_mode & SSL_VERIFY_PEER /* * don't request if post-handshake-only unless doing * post-handshake in TLSv1.3: */ && (!SSL_IS_TLS13(s) || !(s->verify_mode & SSL_VERIFY_POST_HANDSHAKE) || s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) /* * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert * a second time: */ && (s->certreqs_sent < 1 || !(s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) /* * never request cert in anonymous ciphersuites (see * section "Certificate request" in SSL 3 drafts and in * RFC 2246): */ && (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) /* * ... except when the application insists on * verification (against the specs, but statem_clnt.c accepts * this for SSL 3) */ || (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) /* don't request certificate for SRP auth */ && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP) /* * With normal PSK Certificates and Certificate Requests * are omitted */ && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aPSK)) { return 1; } return 0; } /* * ossl_statem_server13_write_transition() works out what handshake state to * move to next when a TLSv1.3 server is writing messages to be sent to the * client. */ static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s) { OSSL_STATEM *st = &s->statem; /* * No case for TLS_ST_BEFORE, because at that stage we have not negotiated * TLSv1.3 yet, so that is handled by ossl_statem_server_write_transition() */ switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER13_WRITE_TRANSITION, ERR_R_INTERNAL_ERROR); return WRITE_TRAN_ERROR; case TLS_ST_OK: if (s->key_update != SSL_KEY_UPDATE_NONE) { st->hand_state = TLS_ST_SW_KEY_UPDATE; return WRITE_TRAN_CONTINUE; } if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) { st->hand_state = TLS_ST_SW_CERT_REQ; return WRITE_TRAN_CONTINUE; } /* Try to read from the client instead */ return WRITE_TRAN_FINISHED; case TLS_ST_SR_CLNT_HELLO: st->hand_state = TLS_ST_SW_SRVR_HELLO; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_SRVR_HELLO: if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 && s->hello_retry_request != SSL_HRR_COMPLETE) st->hand_state = TLS_ST_SW_CHANGE; else if (s->hello_retry_request == SSL_HRR_PENDING) st->hand_state = TLS_ST_EARLY_DATA; else st->hand_state = TLS_ST_SW_ENCRYPTED_EXTENSIONS; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CHANGE: if (s->hello_retry_request == SSL_HRR_PENDING) st->hand_state = TLS_ST_EARLY_DATA; else st->hand_state = TLS_ST_SW_ENCRYPTED_EXTENSIONS; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_ENCRYPTED_EXTENSIONS: if (s->hit) st->hand_state = TLS_ST_SW_FINISHED; else if (send_certificate_request(s)) st->hand_state = TLS_ST_SW_CERT_REQ; else st->hand_state = TLS_ST_SW_CERT; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CERT_REQ: if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) { s->post_handshake_auth = SSL_PHA_REQUESTED; st->hand_state = TLS_ST_OK; } else { st->hand_state = TLS_ST_SW_CERT; } return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CERT: st->hand_state = TLS_ST_SW_CERT_VRFY; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CERT_VRFY: st->hand_state = TLS_ST_SW_FINISHED; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_FINISHED: st->hand_state = TLS_ST_EARLY_DATA; return WRITE_TRAN_CONTINUE; case TLS_ST_EARLY_DATA: return WRITE_TRAN_FINISHED; case TLS_ST_SR_FINISHED: /* * Technically we have finished the handshake at this point, but we're * going to remain "in_init" for now and write out any session tickets * immediately. */ if (s->post_handshake_auth == SSL_PHA_REQUESTED) { s->post_handshake_auth = SSL_PHA_EXT_RECEIVED; } else if (!s->ext.ticket_expected) { /* * If we're not going to renew the ticket then we just finish the * handshake at this point. */ st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } if (s->num_tickets > s->sent_tickets) st->hand_state = TLS_ST_SW_SESSION_TICKET; else st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; case TLS_ST_SR_KEY_UPDATE: case TLS_ST_SW_KEY_UPDATE: st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_SESSION_TICKET: /* In a resumption we only ever send a maximum of one new ticket. * Following an initial handshake we send the number of tickets we have * been configured for. */ if (s->hit || s->num_tickets <= s->sent_tickets) { /* We've written enough tickets out. */ st->hand_state = TLS_ST_OK; } return WRITE_TRAN_CONTINUE; } } /* * ossl_statem_server_write_transition() works out what handshake state to move * to next when the server is writing messages to be sent to the client. */ WRITE_TRAN ossl_statem_server_write_transition(SSL *s) { OSSL_STATEM *st = &s->statem; /* * Note that before the ClientHello we don't know what version we are going * to negotiate yet, so we don't take this branch until later */ if (SSL_IS_TLS13(s)) return ossl_statem_server13_write_transition(s); switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER_WRITE_TRANSITION, ERR_R_INTERNAL_ERROR); return WRITE_TRAN_ERROR; case TLS_ST_OK: if (st->request_state == TLS_ST_SW_HELLO_REQ) { /* We must be trying to renegotiate */ st->hand_state = TLS_ST_SW_HELLO_REQ; st->request_state = TLS_ST_BEFORE; return WRITE_TRAN_CONTINUE; } /* Must be an incoming ClientHello */ if (!tls_setup_handshake(s)) { /* SSLfatal() already called */ return WRITE_TRAN_ERROR; } /* Fall through */ case TLS_ST_BEFORE: /* Just go straight to trying to read from the client */ return WRITE_TRAN_FINISHED; case TLS_ST_SW_HELLO_REQ: st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; case TLS_ST_SR_CLNT_HELLO: if (SSL_IS_DTLS(s) && !s->d1->cookie_verified && (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE)) { st->hand_state = DTLS_ST_SW_HELLO_VERIFY_REQUEST; } else if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) { /* We must have rejected the renegotiation */ st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } else { st->hand_state = TLS_ST_SW_SRVR_HELLO; } return WRITE_TRAN_CONTINUE; case DTLS_ST_SW_HELLO_VERIFY_REQUEST: return WRITE_TRAN_FINISHED; case TLS_ST_SW_SRVR_HELLO: if (s->hit) { if (s->ext.ticket_expected) st->hand_state = TLS_ST_SW_SESSION_TICKET; else st->hand_state = TLS_ST_SW_CHANGE; } else { /* Check if it is anon DH or anon ECDH, */ /* normal PSK or SRP */ if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) { st->hand_state = TLS_ST_SW_CERT; } else if (send_server_key_exchange(s)) { st->hand_state = TLS_ST_SW_KEY_EXCH; } else if (send_certificate_request(s)) { st->hand_state = TLS_ST_SW_CERT_REQ; } else { st->hand_state = TLS_ST_SW_SRVR_DONE; } } return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CERT: if (s->ext.status_expected) { st->hand_state = TLS_ST_SW_CERT_STATUS; return WRITE_TRAN_CONTINUE; } /* Fall through */ case TLS_ST_SW_CERT_STATUS: if (send_server_key_exchange(s)) { st->hand_state = TLS_ST_SW_KEY_EXCH; return WRITE_TRAN_CONTINUE; } /* Fall through */ case TLS_ST_SW_KEY_EXCH: if (send_certificate_request(s)) { st->hand_state = TLS_ST_SW_CERT_REQ; return WRITE_TRAN_CONTINUE; } /* Fall through */ case TLS_ST_SW_CERT_REQ: st->hand_state = TLS_ST_SW_SRVR_DONE; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_SRVR_DONE: return WRITE_TRAN_FINISHED; case TLS_ST_SR_FINISHED: if (s->hit) { st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } else if (s->ext.ticket_expected) { st->hand_state = TLS_ST_SW_SESSION_TICKET; } else { st->hand_state = TLS_ST_SW_CHANGE; } return WRITE_TRAN_CONTINUE; case TLS_ST_SW_SESSION_TICKET: st->hand_state = TLS_ST_SW_CHANGE; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CHANGE: st->hand_state = TLS_ST_SW_FINISHED; return WRITE_TRAN_CONTINUE; case TLS_ST_SW_FINISHED: if (s->hit) { return WRITE_TRAN_FINISHED; } st->hand_state = TLS_ST_OK; return WRITE_TRAN_CONTINUE; } } /* * Perform any pre work that needs to be done prior to sending a message from * the server to the client. */ WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* No pre work to be done */ break; case TLS_ST_SW_HELLO_REQ: s->shutdown = 0; if (SSL_IS_DTLS(s)) dtls1_clear_sent_buffer(s); break; case DTLS_ST_SW_HELLO_VERIFY_REQUEST: s->shutdown = 0; if (SSL_IS_DTLS(s)) { dtls1_clear_sent_buffer(s); /* We don't buffer this message so don't use the timer */ st->use_timer = 0; } break; case TLS_ST_SW_SRVR_HELLO: if (SSL_IS_DTLS(s)) { /* * Messages we write from now on should be buffered and * retransmitted if necessary, so we need to use the timer now */ st->use_timer = 1; } break; case TLS_ST_SW_SRVR_DONE: #ifndef OPENSSL_NO_SCTP if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) { /* Calls SSLfatal() as required */ return dtls_wait_for_dry(s); } #endif return WORK_FINISHED_CONTINUE; case TLS_ST_SW_SESSION_TICKET: if (SSL_IS_TLS13(s) && s->sent_tickets == 0) { /* * Actually this is the end of the handshake, but we're going * straight into writing the session ticket out. So we finish off * the handshake, but keep the various buffers active. * * Calls SSLfatal as required. */ return tls_finish_handshake(s, wst, 0, 0); } if (SSL_IS_DTLS(s)) { /* * We're into the last flight. We don't retransmit the last flight * unless we need to, so we don't use the timer */ st->use_timer = 0; } break; case TLS_ST_SW_CHANGE: if (SSL_IS_TLS13(s)) break; /* Writes to s->session are only safe for initial handshakes */ if (s->session->cipher == NULL) { s->session->cipher = s->s3->tmp.new_cipher; } else if (s->session->cipher != s->s3->tmp.new_cipher) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER_PRE_WORK, ERR_R_INTERNAL_ERROR); return WORK_ERROR; } if (!s->method->ssl3_enc->setup_key_block(s)) { /* SSLfatal() already called */ return WORK_ERROR; } if (SSL_IS_DTLS(s)) { /* * We're into the last flight. We don't retransmit the last flight * unless we need to, so we don't use the timer. This might have * already been set to 0 if we sent a NewSessionTicket message, * but we'll set it again here in case we didn't. */ st->use_timer = 0; } return WORK_FINISHED_CONTINUE; case TLS_ST_EARLY_DATA: if (s->early_data_state != SSL_EARLY_DATA_ACCEPTING && (s->s3->flags & TLS1_FLAGS_STATELESS) == 0) return WORK_FINISHED_CONTINUE; /* Fall through */ case TLS_ST_OK: /* Calls SSLfatal() as required */ return tls_finish_handshake(s, wst, 1, 1); } return WORK_FINISHED_CONTINUE; } static ossl_inline int conn_is_closed(void) { switch (get_last_sys_error()) { #if defined(EPIPE) case EPIPE: return 1; #endif #if defined(ECONNRESET) case ECONNRESET: return 1; #endif #if defined(WSAECONNRESET) case WSAECONNRESET: return 1; #endif default: return 0; } } /* * Perform any work that needs to be done after sending a message from the * server to the client. */ WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; s->init_num = 0; switch (st->hand_state) { default: /* No post work to be done */ break; case TLS_ST_SW_HELLO_REQ: if (statem_flush(s) != 1) return WORK_MORE_A; if (!ssl3_init_finished_mac(s)) { /* SSLfatal() already called */ return WORK_ERROR; } break; case DTLS_ST_SW_HELLO_VERIFY_REQUEST: if (statem_flush(s) != 1) return WORK_MORE_A; /* HelloVerifyRequest resets Finished MAC */ if (s->version != DTLS1_BAD_VER && !ssl3_init_finished_mac(s)) { /* SSLfatal() already called */ return WORK_ERROR; } /* * The next message should be another ClientHello which we need to * treat like it was the first packet */ s->first_packet = 1; break; case TLS_ST_SW_SRVR_HELLO: if (SSL_IS_TLS13(s) && s->hello_retry_request == SSL_HRR_PENDING) { if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0 && statem_flush(s) != 1) return WORK_MORE_A; break; } #ifndef OPENSSL_NO_SCTP if (SSL_IS_DTLS(s) && s->hit) { unsigned char sctpauthkey[64]; char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; size_t labellen; /* * Add new shared key for SCTP-Auth, will be ignored if no * SCTP used. */ memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, sizeof(DTLS1_SCTP_AUTH_LABEL)); /* Don't include the terminating zero. */ labellen = sizeof(labelbuffer) - 1; if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) labellen += 1; if (SSL_export_keying_material(s, sctpauthkey, sizeof(sctpauthkey), labelbuffer, labellen, NULL, 0, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER_POST_WORK, ERR_R_INTERNAL_ERROR); return WORK_ERROR; } BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, sizeof(sctpauthkey), sctpauthkey); } #endif if (!SSL_IS_TLS13(s) || ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 && s->hello_retry_request != SSL_HRR_COMPLETE)) break; /* Fall through */ case TLS_ST_SW_CHANGE: if (s->hello_retry_request == SSL_HRR_PENDING) { if (!statem_flush(s)) return WORK_MORE_A; break; } if (SSL_IS_TLS13(s)) { if (!s->method->ssl3_enc->setup_key_block(s) || !s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_SERVER_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; } if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED && !s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE |SSL3_CHANGE_CIPHER_SERVER_READ)) { /* SSLfatal() already called */ return WORK_ERROR; } /* * We don't yet know whether the next record we are going to receive * is an unencrypted alert, an encrypted alert, or an encrypted * handshake message. We temporarily tolerate unencrypted alerts. */ s->statem.enc_read_state = ENC_READ_STATE_ALLOW_PLAIN_ALERTS; break; } #ifndef OPENSSL_NO_SCTP if (SSL_IS_DTLS(s) && !s->hit) { /* * Change to new shared key of SCTP-Auth, will be ignored if * no SCTP used. */ BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL); } #endif if (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CHANGE_CIPHER_SERVER_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; } if (SSL_IS_DTLS(s)) dtls1_reset_seq_numbers(s, SSL3_CC_WRITE); break; case TLS_ST_SW_SRVR_DONE: if (statem_flush(s) != 1) return WORK_MORE_A; break; case TLS_ST_SW_FINISHED: if (statem_flush(s) != 1) return WORK_MORE_A; #ifndef OPENSSL_NO_SCTP if (SSL_IS_DTLS(s) && s->hit) { /* * Change to new shared key of SCTP-Auth, will be ignored if * no SCTP used. */ BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL); } #endif if (SSL_IS_TLS13(s)) { /* TLS 1.3 gets the secret size from the handshake md */ size_t dummy; if (!s->method->ssl3_enc->generate_master_secret(s, s->master_secret, s->handshake_secret, 0, &dummy) || !s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_SERVER_WRITE)) /* SSLfatal() already called */ return WORK_ERROR; } break; case TLS_ST_SW_CERT_REQ: if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) { if (statem_flush(s) != 1) return WORK_MORE_A; } break; case TLS_ST_SW_KEY_UPDATE: if (statem_flush(s) != 1) return WORK_MORE_A; if (!tls13_update_key(s, 1)) { /* SSLfatal() already called */ return WORK_ERROR; } break; case TLS_ST_SW_SESSION_TICKET: clear_sys_error(); if (SSL_IS_TLS13(s) && statem_flush(s) != 1) { if (SSL_get_error(s, 0) == SSL_ERROR_SYSCALL && conn_is_closed()) { /* * We ignore connection closed errors in TLSv1.3 when sending a * NewSessionTicket and behave as if we were successful. This is * so that we are still able to read data sent to us by a client * that closes soon after the end of the handshake without * waiting to read our post-handshake NewSessionTickets. */ s->rwstate = SSL_NOTHING; break; } return WORK_MORE_A; } break; } return WORK_FINISHED_CONTINUE; } /* * Get the message construction function and message type for sending from the * server * * Valid return values are: * 1: Success * 0: Error */ int ossl_statem_server_construct_message(SSL *s, WPACKET *pkt, confunc_f *confunc, int *mt) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER_CONSTRUCT_MESSAGE, SSL_R_BAD_HANDSHAKE_STATE); return 0; case TLS_ST_SW_CHANGE: if (SSL_IS_DTLS(s)) *confunc = dtls_construct_change_cipher_spec; else *confunc = tls_construct_change_cipher_spec; *mt = SSL3_MT_CHANGE_CIPHER_SPEC; break; case DTLS_ST_SW_HELLO_VERIFY_REQUEST: *confunc = dtls_construct_hello_verify_request; *mt = DTLS1_MT_HELLO_VERIFY_REQUEST; break; case TLS_ST_SW_HELLO_REQ: /* No construction function needed */ *confunc = NULL; *mt = SSL3_MT_HELLO_REQUEST; break; case TLS_ST_SW_SRVR_HELLO: *confunc = tls_construct_server_hello; *mt = SSL3_MT_SERVER_HELLO; break; case TLS_ST_SW_CERT: *confunc = tls_construct_server_certificate; *mt = SSL3_MT_CERTIFICATE; break; case TLS_ST_SW_CERT_VRFY: *confunc = tls_construct_cert_verify; *mt = SSL3_MT_CERTIFICATE_VERIFY; break; case TLS_ST_SW_KEY_EXCH: *confunc = tls_construct_server_key_exchange; *mt = SSL3_MT_SERVER_KEY_EXCHANGE; break; case TLS_ST_SW_CERT_REQ: *confunc = tls_construct_certificate_request; *mt = SSL3_MT_CERTIFICATE_REQUEST; break; case TLS_ST_SW_SRVR_DONE: *confunc = tls_construct_server_done; *mt = SSL3_MT_SERVER_DONE; break; case TLS_ST_SW_SESSION_TICKET: *confunc = tls_construct_new_session_ticket; *mt = SSL3_MT_NEWSESSION_TICKET; break; case TLS_ST_SW_CERT_STATUS: *confunc = tls_construct_cert_status; *mt = SSL3_MT_CERTIFICATE_STATUS; break; case TLS_ST_SW_FINISHED: *confunc = tls_construct_finished; *mt = SSL3_MT_FINISHED; break; case TLS_ST_EARLY_DATA: *confunc = NULL; *mt = SSL3_MT_DUMMY; break; case TLS_ST_SW_ENCRYPTED_EXTENSIONS: *confunc = tls_construct_encrypted_extensions; *mt = SSL3_MT_ENCRYPTED_EXTENSIONS; break; case TLS_ST_SW_KEY_UPDATE: *confunc = tls_construct_key_update; *mt = SSL3_MT_KEY_UPDATE; break; } return 1; } /* * Maximum size (excluding the Handshake header) of a ClientHello message, * calculated as follows: * * 2 + # client_version * 32 + # only valid length for random * 1 + # length of session_id * 32 + # maximum size for session_id * 2 + # length of cipher suites * 2^16-2 + # maximum length of cipher suites array * 1 + # length of compression_methods * 2^8-1 + # maximum length of compression methods * 2 + # length of extensions * 2^16-1 # maximum length of extensions */ #define CLIENT_HELLO_MAX_LENGTH 131396 #define CLIENT_KEY_EXCH_MAX_LENGTH 2048 #define NEXT_PROTO_MAX_LENGTH 514 /* * Returns the maximum allowed length for the current message that we are * reading. Excludes the message header. */ size_t ossl_statem_server_max_message_size(SSL *s) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ return 0; case TLS_ST_SR_CLNT_HELLO: return CLIENT_HELLO_MAX_LENGTH; case TLS_ST_SR_END_OF_EARLY_DATA: return END_OF_EARLY_DATA_MAX_LENGTH; case TLS_ST_SR_CERT: return s->max_cert_list; case TLS_ST_SR_KEY_EXCH: return CLIENT_KEY_EXCH_MAX_LENGTH; case TLS_ST_SR_CERT_VRFY: return SSL3_RT_MAX_PLAIN_LENGTH; #ifndef OPENSSL_NO_NEXTPROTONEG case TLS_ST_SR_NEXT_PROTO: return NEXT_PROTO_MAX_LENGTH; #endif case TLS_ST_SR_CHANGE: return CCS_MAX_LENGTH; case TLS_ST_SR_FINISHED: return FINISHED_MAX_LENGTH; case TLS_ST_SR_KEY_UPDATE: return KEY_UPDATE_MAX_LENGTH; } } /* * Process a message that the server has received from the client. */ MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER_PROCESS_MESSAGE, ERR_R_INTERNAL_ERROR); return MSG_PROCESS_ERROR; case TLS_ST_SR_CLNT_HELLO: return tls_process_client_hello(s, pkt); case TLS_ST_SR_END_OF_EARLY_DATA: return tls_process_end_of_early_data(s, pkt); case TLS_ST_SR_CERT: return tls_process_client_certificate(s, pkt); case TLS_ST_SR_KEY_EXCH: return tls_process_client_key_exchange(s, pkt); case TLS_ST_SR_CERT_VRFY: return tls_process_cert_verify(s, pkt); #ifndef OPENSSL_NO_NEXTPROTONEG case TLS_ST_SR_NEXT_PROTO: return tls_process_next_proto(s, pkt); #endif case TLS_ST_SR_CHANGE: return tls_process_change_cipher_spec(s, pkt); case TLS_ST_SR_FINISHED: return tls_process_finished(s, pkt); case TLS_ST_SR_KEY_UPDATE: return tls_process_key_update(s, pkt); } } /* * Perform any further processing required following the receipt of a message * from the client */ WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; switch (st->hand_state) { default: /* Shouldn't happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_OSSL_STATEM_SERVER_POST_PROCESS_MESSAGE, ERR_R_INTERNAL_ERROR); return WORK_ERROR; case TLS_ST_SR_CLNT_HELLO: return tls_post_process_client_hello(s, wst); case TLS_ST_SR_KEY_EXCH: return tls_post_process_client_key_exchange(s, wst); } } #ifndef OPENSSL_NO_SRP /* Returns 1 on success, 0 for retryable error, -1 for fatal error */ static int ssl_check_srp_ext_ClientHello(SSL *s) { int ret; int al = SSL_AD_UNRECOGNIZED_NAME; if ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) && (s->srp_ctx.TLS_ext_srp_username_callback != NULL)) { if (s->srp_ctx.login == NULL) { /* * RFC 5054 says SHOULD reject, we do so if There is no srp * login name */ SSLfatal(s, SSL_AD_UNKNOWN_PSK_IDENTITY, SSL_F_SSL_CHECK_SRP_EXT_CLIENTHELLO, SSL_R_PSK_IDENTITY_NOT_FOUND); return -1; } else { ret = SSL_srp_server_param_with_username(s, &al); if (ret < 0) return 0; if (ret == SSL3_AL_FATAL) { SSLfatal(s, al, SSL_F_SSL_CHECK_SRP_EXT_CLIENTHELLO, al == SSL_AD_UNKNOWN_PSK_IDENTITY ? SSL_R_PSK_IDENTITY_NOT_FOUND : SSL_R_CLIENTHELLO_TLSEXT); return -1; } } } return 1; } #endif int dtls_raw_hello_verify_request(WPACKET *pkt, unsigned char *cookie, size_t cookie_len) { /* Always use DTLS 1.0 version: see RFC 6347 */ if (!WPACKET_put_bytes_u16(pkt, DTLS1_VERSION) || !WPACKET_sub_memcpy_u8(pkt, cookie, cookie_len)) return 0; return 1; } int dtls_construct_hello_verify_request(SSL *s, WPACKET *pkt) { unsigned int cookie_leni; if (s->ctx->app_gen_cookie_cb == NULL || s->ctx->app_gen_cookie_cb(s, s->d1->cookie, &cookie_leni) == 0 || cookie_leni > 255) { SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST, SSL_R_COOKIE_GEN_CALLBACK_FAILURE); return 0; } s->d1->cookie_len = cookie_leni; if (!dtls_raw_hello_verify_request(pkt, s->d1->cookie, s->d1->cookie_len)) { SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST, ERR_R_INTERNAL_ERROR); return 0; } return 1; } #ifndef OPENSSL_NO_EC /*- * ssl_check_for_safari attempts to fingerprint Safari using OS X * SecureTransport using the TLS extension block in |hello|. * Safari, since 10.6, sends exactly these extensions, in this order: * SNI, * elliptic_curves * ec_point_formats * signature_algorithms (for TLSv1.2 only) * * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8, * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them. * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from * 10.8..10.8.3 (which don't work). */ static void ssl_check_for_safari(SSL *s, const CLIENTHELLO_MSG *hello) { static const unsigned char kSafariExtensionsBlock[] = { 0x00, 0x0a, /* elliptic_curves extension */ 0x00, 0x08, /* 8 bytes */ 0x00, 0x06, /* 6 bytes of curve ids */ 0x00, 0x17, /* P-256 */ 0x00, 0x18, /* P-384 */ 0x00, 0x19, /* P-521 */ 0x00, 0x0b, /* ec_point_formats */ 0x00, 0x02, /* 2 bytes */ 0x01, /* 1 point format */ 0x00, /* uncompressed */ /* The following is only present in TLS 1.2 */ 0x00, 0x0d, /* signature_algorithms */ 0x00, 0x0c, /* 12 bytes */ 0x00, 0x0a, /* 10 bytes */ 0x05, 0x01, /* SHA-384/RSA */ 0x04, 0x01, /* SHA-256/RSA */ 0x02, 0x01, /* SHA-1/RSA */ 0x04, 0x03, /* SHA-256/ECDSA */ 0x02, 0x03, /* SHA-1/ECDSA */ }; /* Length of the common prefix (first two extensions). */ static const size_t kSafariCommonExtensionsLength = 18; unsigned int type; PACKET sni, tmppkt; size_t ext_len; tmppkt = hello->extensions; if (!PACKET_forward(&tmppkt, 2) || !PACKET_get_net_2(&tmppkt, &type) || !PACKET_get_length_prefixed_2(&tmppkt, &sni)) { return; } if (type != TLSEXT_TYPE_server_name) return; ext_len = TLS1_get_client_version(s) >= TLS1_2_VERSION ? sizeof(kSafariExtensionsBlock) : kSafariCommonExtensionsLength; s->s3->is_probably_safari = PACKET_equal(&tmppkt, kSafariExtensionsBlock, ext_len); } #endif /* !OPENSSL_NO_EC */ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt) { /* |cookie| will only be initialized for DTLS. */ PACKET session_id, compression, extensions, cookie; static const unsigned char null_compression = 0; CLIENTHELLO_MSG *clienthello = NULL; /* Check if this is actually an unexpected renegotiation ClientHello */ if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) { if (!ossl_assert(!SSL_IS_TLS13(s))) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } if ((s->options & SSL_OP_NO_RENEGOTIATION) != 0 || (!s->s3->send_connection_binding && (s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) == 0)) { ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION); return MSG_PROCESS_FINISHED_READING; } s->renegotiate = 1; s->new_session = 1; } clienthello = OPENSSL_zalloc(sizeof(*clienthello)); if (clienthello == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } /* * First, parse the raw ClientHello data into the CLIENTHELLO_MSG structure. */ clienthello->isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer); PACKET_null_init(&cookie); if (clienthello->isv2) { unsigned int mt; if (!SSL_IS_FIRST_HANDSHAKE(s) || s->hello_retry_request != SSL_HRR_NONE) { SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNEXPECTED_MESSAGE); goto err; } /*- * An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2 * header is sent directly on the wire, not wrapped as a TLS * record. Our record layer just processes the message length and passes * the rest right through. Its format is: * Byte Content * 0-1 msg_length - decoded by the record layer * 2 msg_type - s->init_msg points here * 3-4 version * 5-6 cipher_spec_length * 7-8 session_id_length * 9-10 challenge_length * ... ... */ if (!PACKET_get_1(pkt, &mt) || mt != SSL2_MT_CLIENT_HELLO) { /* * Should never happen. We should have tested this in the record * layer in order to have determined that this is a SSLv2 record * in the first place */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } } if (!PACKET_get_net_2(pkt, &clienthello->legacy_version)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT); goto err; } /* Parse the message and load client random. */ if (clienthello->isv2) { /* * Handle an SSLv2 backwards compatible ClientHello * Note, this is only for SSLv3+ using the backward compatible format. * Real SSLv2 is not supported, and is rejected below. */ unsigned int ciphersuite_len, session_id_len, challenge_len; PACKET challenge; if (!PACKET_get_net_2(pkt, &ciphersuite_len) || !PACKET_get_net_2(pkt, &session_id_len) || !PACKET_get_net_2(pkt, &challenge_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_RECORD_LENGTH_MISMATCH); goto err; } if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } if (!PACKET_get_sub_packet(pkt, &clienthello->ciphersuites, ciphersuite_len) || !PACKET_copy_bytes(pkt, clienthello->session_id, session_id_len) || !PACKET_get_sub_packet(pkt, &challenge, challenge_len) /* No extensions. */ || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_RECORD_LENGTH_MISMATCH); goto err; } clienthello->session_id_len = session_id_len; /* Load the client random and compression list. We use SSL3_RANDOM_SIZE * here rather than sizeof(clienthello->random) because that is the limit * for SSLv3 and it is fixed. It won't change even if * sizeof(clienthello->random) does. */ challenge_len = challenge_len > SSL3_RANDOM_SIZE ? SSL3_RANDOM_SIZE : challenge_len; memset(clienthello->random, 0, SSL3_RANDOM_SIZE); if (!PACKET_copy_bytes(&challenge, clienthello->random + SSL3_RANDOM_SIZE - challenge_len, challenge_len) /* Advertise only null compression. */ || !PACKET_buf_init(&compression, &null_compression, 1)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } PACKET_null_init(&clienthello->extensions); } else { /* Regular ClientHello. */ if (!PACKET_copy_bytes(pkt, clienthello->random, SSL3_RANDOM_SIZE) || !PACKET_get_length_prefixed_1(pkt, &session_id) || !PACKET_copy_all(&session_id, clienthello->session_id, SSL_MAX_SSL_SESSION_ID_LENGTH, &clienthello->session_id_len)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } if (SSL_IS_DTLS(s)) { if (!PACKET_get_length_prefixed_1(pkt, &cookie)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } if (!PACKET_copy_all(&cookie, clienthello->dtls_cookie, DTLS1_COOKIE_LENGTH, &clienthello->dtls_cookie_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } /* * If we require cookies and this ClientHello doesn't contain one, * just return since we do not want to allocate any memory yet. * So check cookie length... */ if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) { if (clienthello->dtls_cookie_len == 0) { OPENSSL_free(clienthello); return MSG_PROCESS_FINISHED_READING; } } } if (!PACKET_get_length_prefixed_2(pkt, &clienthello->ciphersuites)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } if (!PACKET_get_length_prefixed_1(pkt, &compression)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } /* Could be empty. */ if (PACKET_remaining(pkt) == 0) { PACKET_null_init(&clienthello->extensions); } else { if (!PACKET_get_length_prefixed_2(pkt, &clienthello->extensions) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH); goto err; } } } if (!PACKET_copy_all(&compression, clienthello->compressions, MAX_COMPRESSIONS_SIZE, &clienthello->compressions_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } /* Preserve the raw extensions PACKET for later use */ extensions = clienthello->extensions; if (!tls_collect_extensions(s, &extensions, SSL_EXT_CLIENT_HELLO, &clienthello->pre_proc_exts, &clienthello->pre_proc_exts_len, 1)) { /* SSLfatal already been called */ goto err; } s->clienthello = clienthello; return MSG_PROCESS_CONTINUE_PROCESSING; err: if (clienthello != NULL) OPENSSL_free(clienthello->pre_proc_exts); OPENSSL_free(clienthello); return MSG_PROCESS_ERROR; } static int tls_early_post_process_client_hello(SSL *s) { unsigned int j; int i, al = SSL_AD_INTERNAL_ERROR; int protverr; size_t loop; unsigned long id; #ifndef OPENSSL_NO_COMP SSL_COMP *comp = NULL; #endif const SSL_CIPHER *c; STACK_OF(SSL_CIPHER) *ciphers = NULL; STACK_OF(SSL_CIPHER) *scsvs = NULL; CLIENTHELLO_MSG *clienthello = s->clienthello; DOWNGRADE dgrd = DOWNGRADE_NONE; /* Finished parsing the ClientHello, now we can start processing it */ /* Give the ClientHello callback a crack at things */ if (s->ctx->client_hello_cb != NULL) { /* A failure in the ClientHello callback terminates the connection. */ switch (s->ctx->client_hello_cb(s, &al, s->ctx->client_hello_cb_arg)) { case SSL_CLIENT_HELLO_SUCCESS: break; case SSL_CLIENT_HELLO_RETRY: s->rwstate = SSL_CLIENT_HELLO_CB; return -1; case SSL_CLIENT_HELLO_ERROR: default: SSLfatal(s, al, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_CALLBACK_FAILED); goto err; } } /* Set up the client_random */ memcpy(s->s3->client_random, clienthello->random, SSL3_RANDOM_SIZE); /* Choose the version */ if (clienthello->isv2) { if (clienthello->legacy_version == SSL2_VERSION || (clienthello->legacy_version & 0xff00) != (SSL3_VERSION_MAJOR << 8)) { /* * This is real SSLv2 or something completely unknown. We don't * support it. */ SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); goto err; } /* SSLv3/TLS */ s->client_version = clienthello->legacy_version; } /* * Do SSL/TLS version negotiation if applicable. For DTLS we just check * versions are potentially compatible. Version negotiation comes later. */ if (!SSL_IS_DTLS(s)) { protverr = ssl_choose_server_version(s, clienthello, &dgrd); } else if (s->method->version != DTLS_ANY_VERSION && DTLS_VERSION_LT((int)clienthello->legacy_version, s->version)) { protverr = SSL_R_VERSION_TOO_LOW; } else { protverr = 0; } if (protverr) { if (SSL_IS_FIRST_HANDSHAKE(s)) { /* like ssl3_get_record, send alert using remote version number */ s->version = s->client_version = clienthello->legacy_version; } SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, protverr); goto err; } /* TLSv1.3 specifies that a ClientHello must end on a record boundary */ if (SSL_IS_TLS13(s) && RECORD_LAYER_processed_read_pending(&s->rlayer)) { SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_NOT_ON_RECORD_BOUNDARY); goto err; } if (SSL_IS_DTLS(s)) { /* Empty cookie was already handled above by returning early. */ if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) { if (s->ctx->app_verify_cookie_cb != NULL) { if (s->ctx->app_verify_cookie_cb(s, clienthello->dtls_cookie, clienthello->dtls_cookie_len) == 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH); goto err; /* else cookie verification succeeded */ } /* default verification */ } else if (s->d1->cookie_len != clienthello->dtls_cookie_len || memcmp(clienthello->dtls_cookie, s->d1->cookie, s->d1->cookie_len) != 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH); goto err; } s->d1->cookie_verified = 1; } if (s->method->version == DTLS_ANY_VERSION) { protverr = ssl_choose_server_version(s, clienthello, &dgrd); if (protverr != 0) { s->version = s->client_version; SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, protverr); goto err; } } } s->hit = 0; if (!ssl_cache_cipherlist(s, &clienthello->ciphersuites, clienthello->isv2) || !bytes_to_cipher_list(s, &clienthello->ciphersuites, &ciphers, &scsvs, clienthello->isv2, 1)) { /* SSLfatal() already called */ goto err; } s->s3->send_connection_binding = 0; /* Check what signalling cipher-suite values were received. */ if (scsvs != NULL) { for(i = 0; i < sk_SSL_CIPHER_num(scsvs); i++) { c = sk_SSL_CIPHER_value(scsvs, i); if (SSL_CIPHER_get_id(c) == SSL3_CK_SCSV) { if (s->renegotiate) { /* SCSV is fatal if renegotiating */ SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING); goto err; } s->s3->send_connection_binding = 1; } else if (SSL_CIPHER_get_id(c) == SSL3_CK_FALLBACK_SCSV && !ssl_check_version_downgrade(s)) { /* * This SCSV indicates that the client previously tried * a higher version. We should fail if the current version * is an unexpected downgrade, as that indicates that the first * connection may have been tampered with in order to trigger * an insecure downgrade. */ SSLfatal(s, SSL_AD_INAPPROPRIATE_FALLBACK, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_INAPPROPRIATE_FALLBACK); goto err; } } } /* For TLSv1.3 we must select the ciphersuite *before* session resumption */ if (SSL_IS_TLS13(s)) { const SSL_CIPHER *cipher = ssl3_choose_cipher(s, ciphers, SSL_get_ciphers(s)); if (cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER); goto err; } if (s->hello_retry_request == SSL_HRR_PENDING && (s->s3->tmp.new_cipher == NULL || s->s3->tmp.new_cipher->id != cipher->id)) { /* * A previous HRR picked a different ciphersuite to the one we * just selected. Something must have changed. */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_BAD_CIPHER); goto err; } s->s3->tmp.new_cipher = cipher; } /* We need to do this before getting the session */ if (!tls_parse_extension(s, TLSEXT_IDX_extended_master_secret, SSL_EXT_CLIENT_HELLO, clienthello->pre_proc_exts, NULL, 0)) { /* SSLfatal() already called */ goto err; } /* * We don't allow resumption in a backwards compatible ClientHello. * TODO(openssl-team): in TLS1.1+, session_id MUST be empty. * * Versions before 0.9.7 always allow clients to resume sessions in * renegotiation. 0.9.7 and later allow this by default, but optionally * ignore resumption requests with flag * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION (it's a new flag rather * than a change to default behavior so that applications relying on * this for security won't even compile against older library versions). * 1.0.1 and later also have a function SSL_renegotiate_abbreviated() to * request renegotiation but not a new session (s->new_session remains * unset): for servers, this essentially just means that the * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be * ignored. */ if (clienthello->isv2 || (s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) { if (!ssl_get_new_session(s, 1)) { /* SSLfatal() already called */ goto err; } } else { i = ssl_get_prev_session(s, clienthello); if (i == 1) { /* previous session */ s->hit = 1; } else if (i == -1) { /* SSLfatal() already called */ goto err; } else { /* i == 0 */ if (!ssl_get_new_session(s, 1)) { /* SSLfatal() already called */ goto err; } } } if (SSL_IS_TLS13(s)) { memcpy(s->tmp_session_id, s->clienthello->session_id, s->clienthello->session_id_len); s->tmp_session_id_len = s->clienthello->session_id_len; } /* * If it is a hit, check that the cipher is in the list. In TLSv1.3 we check * ciphersuite compatibility with the session as part of resumption. */ if (!SSL_IS_TLS13(s) && s->hit) { j = 0; id = s->session->cipher->id; #ifdef CIPHER_DEBUG fprintf(stderr, "client sent %d ciphers\n", sk_SSL_CIPHER_num(ciphers)); #endif for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) { c = sk_SSL_CIPHER_value(ciphers, i); #ifdef CIPHER_DEBUG fprintf(stderr, "client [%2d of %2d]:%s\n", i, sk_SSL_CIPHER_num(ciphers), SSL_CIPHER_get_name(c)); #endif if (c->id == id) { j = 1; break; } } if (j == 0) { /* * we need to have the cipher in the cipher list if we are asked * to reuse it */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_REQUIRED_CIPHER_MISSING); goto err; } } for (loop = 0; loop < clienthello->compressions_len; loop++) { if (clienthello->compressions[loop] == 0) break; } if (loop >= clienthello->compressions_len) { /* no compress */ SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_NO_COMPRESSION_SPECIFIED); goto err; } #ifndef OPENSSL_NO_EC if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG) ssl_check_for_safari(s, clienthello); #endif /* !OPENSSL_NO_EC */ /* TLS extensions */ if (!tls_parse_all_extensions(s, SSL_EXT_CLIENT_HELLO, clienthello->pre_proc_exts, NULL, 0, 1)) { /* SSLfatal() already called */ goto err; } /* * Check if we want to use external pre-shared secret for this handshake * for not reused session only. We need to generate server_random before * calling tls_session_secret_cb in order to allow SessionTicket * processing to use it in key derivation. */ { unsigned char *pos; pos = s->s3->server_random; if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE, dgrd) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } } if (!s->hit && s->version >= TLS1_VERSION && !SSL_IS_TLS13(s) && !SSL_IS_DTLS(s) && s->ext.session_secret_cb) { const SSL_CIPHER *pref_cipher = NULL; /* * s->session->master_key_length is a size_t, but this is an int for * backwards compat reasons */ int master_key_length; master_key_length = sizeof(s->session->master_key); if (s->ext.session_secret_cb(s, s->session->master_key, &master_key_length, ciphers, &pref_cipher, s->ext.session_secret_cb_arg) && master_key_length > 0) { s->session->master_key_length = master_key_length; s->hit = 1; s->peer_ciphers = ciphers; s->session->verify_result = X509_V_OK; ciphers = NULL; /* check if some cipher was preferred by call back */ if (pref_cipher == NULL) pref_cipher = ssl3_choose_cipher(s, s->peer_ciphers, SSL_get_ciphers(s)); if (pref_cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER); goto err; } s->session->cipher = pref_cipher; sk_SSL_CIPHER_free(s->cipher_list); s->cipher_list = sk_SSL_CIPHER_dup(s->peer_ciphers); sk_SSL_CIPHER_free(s->cipher_list_by_id); s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->peer_ciphers); } } /* * Worst case, we will use the NULL compression, but if we have other * options, we will now look for them. We have complen-1 compression * algorithms from the client, starting at q. */ s->s3->tmp.new_compression = NULL; if (SSL_IS_TLS13(s)) { /* * We already checked above that the NULL compression method appears in * the list. Now we check there aren't any others (which is illegal in * a TLSv1.3 ClientHello. */ if (clienthello->compressions_len != 1) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_INVALID_COMPRESSION_ALGORITHM); goto err; } } #ifndef OPENSSL_NO_COMP /* This only happens if we have a cache hit */ else if (s->session->compress_meth != 0) { int m, comp_id = s->session->compress_meth; unsigned int k; /* Perform sanity checks on resumed compression algorithm */ /* Can't disable compression */ if (!ssl_allow_compression(s)) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_INCONSISTENT_COMPRESSION); goto err; } /* Look for resumed compression method */ for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++) { comp = sk_SSL_COMP_value(s->ctx->comp_methods, m); if (comp_id == comp->id) { s->s3->tmp.new_compression = comp; break; } } if (s->s3->tmp.new_compression == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_INVALID_COMPRESSION_ALGORITHM); goto err; } /* Look for resumed method in compression list */ for (k = 0; k < clienthello->compressions_len; k++) { if (clienthello->compressions[k] == comp_id) break; } if (k >= clienthello->compressions_len) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING); goto err; } } else if (s->hit) { comp = NULL; } else if (ssl_allow_compression(s) && s->ctx->comp_methods) { /* See if we have a match */ int m, nn, v, done = 0; unsigned int o; nn = sk_SSL_COMP_num(s->ctx->comp_methods); for (m = 0; m < nn; m++) { comp = sk_SSL_COMP_value(s->ctx->comp_methods, m); v = comp->id; for (o = 0; o < clienthello->compressions_len; o++) { if (v == clienthello->compressions[o]) { done = 1; break; } } if (done) break; } if (done) s->s3->tmp.new_compression = comp; else comp = NULL; } #else /* * If compression is disabled we'd better not try to resume a session * using compression. */ if (s->session->compress_meth != 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_INCONSISTENT_COMPRESSION); goto err; } #endif /* * Given s->peer_ciphers and SSL_get_ciphers, we must pick a cipher */ if (!s->hit || SSL_IS_TLS13(s)) { sk_SSL_CIPHER_free(s->peer_ciphers); s->peer_ciphers = ciphers; if (ciphers == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); goto err; } ciphers = NULL; } if (!s->hit) { #ifdef OPENSSL_NO_COMP s->session->compress_meth = 0; #else s->session->compress_meth = (comp == NULL) ? 0 : comp->id; #endif if (!tls1_set_server_sigalgs(s)) { /* SSLfatal() already called */ goto err; } } sk_SSL_CIPHER_free(ciphers); sk_SSL_CIPHER_free(scsvs); OPENSSL_free(clienthello->pre_proc_exts); OPENSSL_free(s->clienthello); s->clienthello = NULL; return 1; err: sk_SSL_CIPHER_free(ciphers); sk_SSL_CIPHER_free(scsvs); OPENSSL_free(clienthello->pre_proc_exts); OPENSSL_free(s->clienthello); s->clienthello = NULL; return 0; } /* * Call the status request callback if needed. Upon success, returns 1. * Upon failure, returns 0. */ static int tls_handle_status_request(SSL *s) { s->ext.status_expected = 0; /* * If status request then ask callback what to do. Note: this must be * called after servername callbacks in case the certificate has changed, * and must be called after the cipher has been chosen because this may * influence which certificate is sent */ if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing && s->ctx != NULL && s->ctx->ext.status_cb != NULL) { int ret; /* If no certificate can't return certificate status */ if (s->s3->tmp.cert != NULL) { /* * Set current certificate to one we will use so SSL_get_certificate * et al can pick it up. */ s->cert->key = s->s3->tmp.cert; ret = s->ctx->ext.status_cb(s, s->ctx->ext.status_arg); switch (ret) { /* We don't want to send a status request response */ case SSL_TLSEXT_ERR_NOACK: s->ext.status_expected = 0; break; /* status request response should be sent */ case SSL_TLSEXT_ERR_OK: if (s->ext.ocsp.resp) s->ext.status_expected = 1; break; /* something bad happened */ case SSL_TLSEXT_ERR_ALERT_FATAL: default: SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_HANDLE_STATUS_REQUEST, SSL_R_CLIENTHELLO_TLSEXT); return 0; } } } return 1; } /* * Call the alpn_select callback if needed. Upon success, returns 1. * Upon failure, returns 0. */ int tls_handle_alpn(SSL *s) { const unsigned char *selected = NULL; unsigned char selected_len = 0; if (s->ctx->ext.alpn_select_cb != NULL && s->s3->alpn_proposed != NULL) { int r = s->ctx->ext.alpn_select_cb(s, &selected, &selected_len, s->s3->alpn_proposed, (unsigned int)s->s3->alpn_proposed_len, s->ctx->ext.alpn_select_cb_arg); if (r == SSL_TLSEXT_ERR_OK) { OPENSSL_free(s->s3->alpn_selected); s->s3->alpn_selected = OPENSSL_memdup(selected, selected_len); if (s->s3->alpn_selected == NULL) { + s->s3->alpn_selected_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_HANDLE_ALPN, ERR_R_INTERNAL_ERROR); return 0; } s->s3->alpn_selected_len = selected_len; #ifndef OPENSSL_NO_NEXTPROTONEG /* ALPN takes precedence over NPN. */ s->s3->npn_seen = 0; #endif /* Check ALPN is consistent with session */ if (s->session->ext.alpn_selected == NULL || selected_len != s->session->ext.alpn_selected_len || memcmp(selected, s->session->ext.alpn_selected, selected_len) != 0) { /* Not consistent so can't be used for early_data */ s->ext.early_data_ok = 0; if (!s->hit) { /* * This is a new session and so alpn_selected should have * been initialised to NULL. We should update it with the * selected ALPN. */ if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_HANDLE_ALPN, ERR_R_INTERNAL_ERROR); return 0; } s->session->ext.alpn_selected = OPENSSL_memdup(selected, selected_len); if (s->session->ext.alpn_selected == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_HANDLE_ALPN, ERR_R_INTERNAL_ERROR); return 0; } s->session->ext.alpn_selected_len = selected_len; } } return 1; } else if (r != SSL_TLSEXT_ERR_NOACK) { SSLfatal(s, SSL_AD_NO_APPLICATION_PROTOCOL, SSL_F_TLS_HANDLE_ALPN, SSL_R_NO_APPLICATION_PROTOCOL); return 0; } /* * If r == SSL_TLSEXT_ERR_NOACK then behave as if no callback was * present. */ } /* Check ALPN is consistent with session */ if (s->session->ext.alpn_selected != NULL) { /* Not consistent so can't be used for early_data */ s->ext.early_data_ok = 0; } return 1; } WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) { const SSL_CIPHER *cipher; if (wst == WORK_MORE_A) { int rv = tls_early_post_process_client_hello(s); if (rv == 0) { /* SSLfatal() was already called */ goto err; } if (rv < 0) return WORK_MORE_A; wst = WORK_MORE_B; } if (wst == WORK_MORE_B) { if (!s->hit || SSL_IS_TLS13(s)) { /* Let cert callback update server certificates if required */ if (!s->hit && s->cert->cert_cb != NULL) { int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg); if (rv == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, SSL_R_CERT_CB_ERROR); goto err; } if (rv < 0) { s->rwstate = SSL_X509_LOOKUP; return WORK_MORE_B; } s->rwstate = SSL_NOTHING; } /* In TLSv1.3 we selected the ciphersuite before resumption */ if (!SSL_IS_TLS13(s)) { cipher = ssl3_choose_cipher(s, s->peer_ciphers, SSL_get_ciphers(s)); if (cipher == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER); goto err; } s->s3->tmp.new_cipher = cipher; } if (!s->hit) { if (!tls_choose_sigalg(s, 1)) { /* SSLfatal already called */ goto err; } /* check whether we should disable session resumption */ if (s->not_resumable_session_cb != NULL) s->session->not_resumable = s->not_resumable_session_cb(s, ((s->s3->tmp.new_cipher->algorithm_mkey & (SSL_kDHE | SSL_kECDHE)) != 0)); if (s->session->not_resumable) /* do not send a session ticket */ s->ext.ticket_expected = 0; } } else { /* Session-id reuse */ s->s3->tmp.new_cipher = s->session->cipher; } /*- * we now have the following setup. * client_random * cipher_list - our preferred list of ciphers * ciphers - the clients preferred list of ciphers * compression - basically ignored right now * ssl version is set - sslv3 * s->session - The ssl session has been setup. * s->hit - session reuse flag * s->s3->tmp.new_cipher- the new cipher to use. */ /* * Call status_request callback if needed. Has to be done after the * certificate callbacks etc above. */ if (!tls_handle_status_request(s)) { /* SSLfatal() already called */ goto err; } /* * Call alpn_select callback if needed. Has to be done after SNI and * cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3 * we already did this because cipher negotiation happens earlier, and * we must handle ALPN before we decide whether to accept early_data. */ if (!SSL_IS_TLS13(s) && !tls_handle_alpn(s)) { /* SSLfatal() already called */ goto err; } wst = WORK_MORE_C; } #ifndef OPENSSL_NO_SRP if (wst == WORK_MORE_C) { int ret; if ((ret = ssl_check_srp_ext_ClientHello(s)) == 0) { /* * callback indicates further work to be done */ s->rwstate = SSL_X509_LOOKUP; return WORK_MORE_C; } if (ret < 0) { /* SSLfatal() already called */ goto err; } } #endif return WORK_FINISHED_STOP; err: return WORK_ERROR; } int tls_construct_server_hello(SSL *s, WPACKET *pkt) { int compm; size_t sl, len; int version; unsigned char *session_id; int usetls13 = SSL_IS_TLS13(s) || s->hello_retry_request == SSL_HRR_PENDING; version = usetls13 ? TLS1_2_VERSION : s->version; if (!WPACKET_put_bytes_u16(pkt, version) /* * Random stuff. Filling of the server_random takes place in * tls_process_client_hello() */ || !WPACKET_memcpy(pkt, s->hello_retry_request == SSL_HRR_PENDING ? hrrrandom : s->s3->server_random, SSL3_RANDOM_SIZE)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /*- * There are several cases for the session ID to send * back in the server hello: * - For session reuse from the session cache, * we send back the old session ID. * - If stateless session reuse (using a session ticket) * is successful, we send back the client's "session ID" * (which doesn't actually identify the session). * - If it is a new session, we send back the new * session ID. * - However, if we want the new session to be single-use, * we send back a 0-length session ID. * - In TLSv1.3 we echo back the session id sent to us by the client * regardless * s->hit is non-zero in either case of session reuse, * so the following won't overwrite an ID that we're supposed * to send back. */ if (s->session->not_resumable || (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER) && !s->hit)) s->session->session_id_length = 0; if (usetls13) { sl = s->tmp_session_id_len; session_id = s->tmp_session_id; } else { sl = s->session->session_id_length; session_id = s->session->session_id; } if (sl > sizeof(s->session->session_id)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR); return 0; } /* set up the compression method */ #ifdef OPENSSL_NO_COMP compm = 0; #else if (usetls13 || s->s3->tmp.new_compression == NULL) compm = 0; else compm = s->s3->tmp.new_compression->id; #endif if (!WPACKET_sub_memcpy_u8(pkt, session_id, sl) || !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, pkt, &len) || !WPACKET_put_bytes_u8(pkt, compm)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR); return 0; } if (!tls_construct_extensions(s, pkt, s->hello_retry_request == SSL_HRR_PENDING ? SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST : (SSL_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO : SSL_EXT_TLS1_2_SERVER_HELLO), NULL, 0)) { /* SSLfatal() already called */ return 0; } if (s->hello_retry_request == SSL_HRR_PENDING) { /* Ditch the session. We'll create a new one next time around */ SSL_SESSION_free(s->session); s->session = NULL; s->hit = 0; /* * Re-initialise the Transcript Hash. We're going to prepopulate it with * a synthetic message_hash in place of ClientHello1. */ if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) { /* SSLfatal() already called */ return 0; } } else if (!(s->verify_mode & SSL_VERIFY_PEER) && !ssl3_digest_cached_records(s, 0)) { /* SSLfatal() already called */; return 0; } return 1; } int tls_construct_server_done(SSL *s, WPACKET *pkt) { if (!s->s3->tmp.cert_request) { if (!ssl3_digest_cached_records(s, 0)) { /* SSLfatal() already called */ return 0; } } return 1; } int tls_construct_server_key_exchange(SSL *s, WPACKET *pkt) { #ifndef OPENSSL_NO_DH EVP_PKEY *pkdh = NULL; #endif #ifndef OPENSSL_NO_EC unsigned char *encodedPoint = NULL; size_t encodedlen = 0; int curve_id = 0; #endif const SIGALG_LOOKUP *lu = s->s3->tmp.sigalg; int i; unsigned long type; const BIGNUM *r[4]; EVP_MD_CTX *md_ctx = EVP_MD_CTX_new(); EVP_PKEY_CTX *pctx = NULL; size_t paramlen, paramoffset; if (!WPACKET_get_total_written(pkt, ¶moffset)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } if (md_ctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); goto err; } type = s->s3->tmp.new_cipher->algorithm_mkey; r[0] = r[1] = r[2] = r[3] = NULL; #ifndef OPENSSL_NO_PSK /* Plain PSK or RSAPSK nothing to do */ if (type & (SSL_kPSK | SSL_kRSAPSK)) { } else #endif /* !OPENSSL_NO_PSK */ #ifndef OPENSSL_NO_DH if (type & (SSL_kDHE | SSL_kDHEPSK)) { CERT *cert = s->cert; EVP_PKEY *pkdhp = NULL; DH *dh; if (s->cert->dh_tmp_auto) { DH *dhp = ssl_get_auto_dh(s); pkdh = EVP_PKEY_new(); if (pkdh == NULL || dhp == NULL) { DH_free(dhp); SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } EVP_PKEY_assign_DH(pkdh, dhp); pkdhp = pkdh; } else { pkdhp = cert->dh_tmp; } if ((pkdhp == NULL) && (s->cert->dh_tmp_cb != NULL)) { DH *dhp = s->cert->dh_tmp_cb(s, 0, 1024); pkdh = ssl_dh_to_pkey(dhp); if (pkdh == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } pkdhp = pkdh; } if (pkdhp == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, SSL_R_MISSING_TMP_DH_KEY); goto err; } if (!ssl_security(s, SSL_SECOP_TMP_DH, EVP_PKEY_security_bits(pkdhp), 0, pkdhp)) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, SSL_R_DH_KEY_TOO_SMALL); goto err; } if (s->s3->tmp.pkey != NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } s->s3->tmp.pkey = ssl_generate_pkey(pkdhp); if (s->s3->tmp.pkey == NULL) { /* SSLfatal() already called */ goto err; } dh = EVP_PKEY_get0_DH(s->s3->tmp.pkey); if (dh == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } EVP_PKEY_free(pkdh); pkdh = NULL; DH_get0_pqg(dh, &r[0], NULL, &r[1]); DH_get0_key(dh, &r[2], NULL); } else #endif #ifndef OPENSSL_NO_EC if (type & (SSL_kECDHE | SSL_kECDHEPSK)) { if (s->s3->tmp.pkey != NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } /* Get NID of appropriate shared curve */ curve_id = tls1_shared_group(s, -2); if (curve_id == 0) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); goto err; } s->s3->tmp.pkey = ssl_generate_pkey_group(s, curve_id); /* Generate a new key for this curve */ if (s->s3->tmp.pkey == NULL) { /* SSLfatal() already called */ goto err; } /* Encode the public key. */ encodedlen = EVP_PKEY_get1_tls_encodedpoint(s->s3->tmp.pkey, &encodedPoint); if (encodedlen == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EC_LIB); goto err; } /* * We'll generate the serverKeyExchange message explicitly so we * can set these to NULLs */ r[0] = NULL; r[1] = NULL; r[2] = NULL; r[3] = NULL; } else #endif /* !OPENSSL_NO_EC */ #ifndef OPENSSL_NO_SRP if (type & SSL_kSRP) { if ((s->srp_ctx.N == NULL) || (s->srp_ctx.g == NULL) || (s->srp_ctx.s == NULL) || (s->srp_ctx.B == NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, SSL_R_MISSING_SRP_PARAM); goto err; } r[0] = s->srp_ctx.N; r[1] = s->srp_ctx.g; r[2] = s->srp_ctx.s; r[3] = s->srp_ctx.B; } else #endif { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); goto err; } if (((s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP)) != 0) || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) != 0) { lu = NULL; } else if (lu == NULL) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } #ifndef OPENSSL_NO_PSK if (type & SSL_PSK) { size_t len = (s->cert->psk_identity_hint == NULL) ? 0 : strlen(s->cert->psk_identity_hint); /* * It should not happen that len > PSK_MAX_IDENTITY_LEN - we already * checked this when we set the identity hint - but just in case */ if (len > PSK_MAX_IDENTITY_LEN || !WPACKET_sub_memcpy_u16(pkt, s->cert->psk_identity_hint, len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } } #endif for (i = 0; i < 4 && r[i] != NULL; i++) { unsigned char *binval; int res; #ifndef OPENSSL_NO_SRP if ((i == 2) && (type & SSL_kSRP)) { res = WPACKET_start_sub_packet_u8(pkt); } else #endif res = WPACKET_start_sub_packet_u16(pkt); if (!res) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } #ifndef OPENSSL_NO_DH /*- * for interoperability with some versions of the Microsoft TLS * stack, we need to zero pad the DHE pub key to the same length * as the prime */ if ((i == 2) && (type & (SSL_kDHE | SSL_kDHEPSK))) { size_t len = BN_num_bytes(r[0]) - BN_num_bytes(r[2]); if (len > 0) { if (!WPACKET_allocate_bytes(pkt, len, &binval)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } memset(binval, 0, len); } } #endif if (!WPACKET_allocate_bytes(pkt, BN_num_bytes(r[i]), &binval) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } BN_bn2bin(r[i], binval); } #ifndef OPENSSL_NO_EC if (type & (SSL_kECDHE | SSL_kECDHEPSK)) { /* * We only support named (not generic) curves. In this situation, the * ServerKeyExchange message has: [1 byte CurveType], [2 byte CurveName] * [1 byte length of encoded point], followed by the actual encoded * point itself */ if (!WPACKET_put_bytes_u8(pkt, NAMED_CURVE_TYPE) || !WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_put_bytes_u8(pkt, curve_id) || !WPACKET_sub_memcpy_u8(pkt, encodedPoint, encodedlen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } OPENSSL_free(encodedPoint); encodedPoint = NULL; } #endif /* not anonymous */ if (lu != NULL) { EVP_PKEY *pkey = s->s3->tmp.cert->privatekey; const EVP_MD *md; unsigned char *sigbytes1, *sigbytes2, *tbs; size_t siglen, tbslen; int rv; if (pkey == NULL || !tls1_lookup_md(lu, &md)) { /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } /* Get length of the parameters we have written above */ if (!WPACKET_get_length(pkt, ¶mlen)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } /* send signature algorithm */ if (SSL_USE_SIGALGS(s) && !WPACKET_put_bytes_u16(pkt, lu->sigalg)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } /* * Create the signature. We don't know the actual length of the sig * until after we've created it, so we reserve enough bytes for it * up front, and then properly allocate them in the WPACKET * afterwards. */ siglen = EVP_PKEY_size(pkey); if (!WPACKET_sub_reserve_bytes_u16(pkt, siglen, &sigbytes1) || EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } if (lu->sig == EVP_PKEY_RSA_PSS) { if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0 || EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, RSA_PSS_SALTLEN_DIGEST) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB); goto err; } } tbslen = construct_key_exchange_tbs(s, &tbs, s->init_buf->data + paramoffset, paramlen); if (tbslen == 0) { /* SSLfatal() already called */ goto err; } rv = EVP_DigestSign(md_ctx, sigbytes1, &siglen, tbs, tbslen); OPENSSL_free(tbs); if (rv <= 0 || !WPACKET_sub_allocate_bytes_u16(pkt, siglen, &sigbytes2) || sigbytes1 != sigbytes2) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); goto err; } } EVP_MD_CTX_free(md_ctx); return 1; err: #ifndef OPENSSL_NO_DH EVP_PKEY_free(pkdh); #endif #ifndef OPENSSL_NO_EC OPENSSL_free(encodedPoint); #endif EVP_MD_CTX_free(md_ctx); return 0; } int tls_construct_certificate_request(SSL *s, WPACKET *pkt) { if (SSL_IS_TLS13(s)) { /* Send random context when doing post-handshake auth */ if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) { OPENSSL_free(s->pha_context); s->pha_context_len = 32; - if ((s->pha_context = OPENSSL_malloc(s->pha_context_len)) == NULL - || RAND_bytes(s->pha_context, s->pha_context_len) <= 0 - || !WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) { + if ((s->pha_context = OPENSSL_malloc(s->pha_context_len)) == NULL) { + s->pha_context_len = 0; + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, + ERR_R_INTERNAL_ERROR); + return 0; + } + if (RAND_bytes(s->pha_context, s->pha_context_len) <= 0 + || !WPACKET_sub_memcpy_u8(pkt, s->pha_context, + s->pha_context_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR); return 0; } /* reset the handshake hash back to just after the ClientFinished */ if (!tls13_restore_handshake_digest_for_pha(s)) { /* SSLfatal() already called */ return 0; } } else { if (!WPACKET_put_bytes_u8(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR); return 0; } } if (!tls_construct_extensions(s, pkt, SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, NULL, 0)) { /* SSLfatal() already called */ return 0; } goto done; } /* get the list of acceptable cert types */ if (!WPACKET_start_sub_packet_u8(pkt) || !ssl3_get_req_cert_type(s, pkt) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR); return 0; } if (SSL_USE_SIGALGS(s)) { const uint16_t *psigs; size_t nl = tls12_get_psigalgs(s, 1, &psigs); if (!WPACKET_start_sub_packet_u16(pkt) || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) || !tls12_copy_sigalgs(s, pkt, psigs, nl) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR); return 0; } } if (!construct_ca_names(s, get_ca_names(s), pkt)) { /* SSLfatal() already called */ return 0; } done: s->certreqs_sent++; s->s3->tmp.cert_request = 1; return 1; } static int tls_process_cke_psk_preamble(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_PSK unsigned char psk[PSK_MAX_PSK_LEN]; size_t psklen; PACKET psk_identity; if (!PACKET_get_length_prefixed_2(pkt, &psk_identity)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_LENGTH_MISMATCH); return 0; } if (PACKET_remaining(&psk_identity) > PSK_MAX_IDENTITY_LEN) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_DATA_LENGTH_TOO_LONG); return 0; } if (s->psk_server_callback == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_PSK_NO_SERVER_CB); return 0; } if (!PACKET_strndup(&psk_identity, &s->session->psk_identity)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); return 0; } psklen = s->psk_server_callback(s, s->session->psk_identity, psk, sizeof(psk)); if (psklen > PSK_MAX_PSK_LEN) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); return 0; } else if (psklen == 0) { /* * PSK related to the given identity not found */ SSLfatal(s, SSL_AD_UNKNOWN_PSK_IDENTITY, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, SSL_R_PSK_IDENTITY_NOT_FOUND); return 0; } OPENSSL_free(s->s3->tmp.psk); s->s3->tmp.psk = OPENSSL_memdup(psk, psklen); OPENSSL_cleanse(psk, psklen); if (s->s3->tmp.psk == NULL) { + s->s3->tmp.psklen = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_MALLOC_FAILURE); return 0; } s->s3->tmp.psklen = psklen; return 1; #else /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_cke_rsa(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_RSA unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH]; int decrypt_len; unsigned char decrypt_good, version_good; size_t j, padding_len; PACKET enc_premaster; RSA *rsa = NULL; unsigned char *rsa_decrypt = NULL; int ret = 0; rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA].privatekey); if (rsa == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_MISSING_RSA_CERTIFICATE); return 0; } /* SSLv3 and pre-standard DTLS omit the length bytes. */ if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) { enc_premaster = *pkt; } else { if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_LENGTH_MISMATCH); return 0; } } /* * We want to be sure that the plaintext buffer size makes it safe to * iterate over the entire size of a premaster secret * (SSL_MAX_MASTER_KEY_LENGTH). Reject overly short RSA keys because * their ciphertext cannot accommodate a premaster secret anyway. */ if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, RSA_R_KEY_SIZE_TOO_SMALL); return 0; } rsa_decrypt = OPENSSL_malloc(RSA_size(rsa)); if (rsa_decrypt == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_MALLOC_FAILURE); return 0; } /* * We must not leak whether a decryption failure occurs because of * Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246, * section 7.4.7.1). The code follows that advice of the TLS RFC and * generates a random premaster secret for the case that the decrypt * fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1 */ if (RAND_priv_bytes(rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR); goto err; } /* * Decrypt with no padding. PKCS#1 padding will be removed as part of * the timing-sensitive code below. */ /* TODO(size_t): Convert this function */ decrypt_len = (int)RSA_private_decrypt((int)PACKET_remaining(&enc_premaster), PACKET_data(&enc_premaster), rsa_decrypt, rsa, RSA_NO_PADDING); if (decrypt_len < 0) { SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR); goto err; } /* Check the padding. See RFC 3447, section 7.2.2. */ /* * The smallest padded premaster is 11 bytes of overhead. Small keys * are publicly invalid, so this may return immediately. This ensures * PS is at least 8 bytes. */ if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) { SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_DECRYPTION_FAILED); goto err; } padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH; decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) & constant_time_eq_int_8(rsa_decrypt[1], 2); for (j = 2; j < padding_len - 1; j++) { decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]); } decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]); /* * If the version in the decrypted pre-master secret is correct then * version_good will be 0xff, otherwise it'll be zero. The * Klima-Pokorny-Rosa extension of Bleichenbacher's attack * (http://eprint.iacr.org/2003/052/) exploits the version number * check as a "bad version oracle". Thus version checks are done in * constant time and are treated like any other decryption error. */ version_good = constant_time_eq_8(rsa_decrypt[padding_len], (unsigned)(s->client_version >> 8)); version_good &= constant_time_eq_8(rsa_decrypt[padding_len + 1], (unsigned)(s->client_version & 0xff)); /* * The premaster secret must contain the same version number as the * ClientHello to detect version rollback attacks (strangely, the * protocol does not offer such protection for DH ciphersuites). * However, buggy clients exist that send the negotiated protocol * version instead if the server does not support the requested * protocol version. If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such * clients. */ if (s->options & SSL_OP_TLS_ROLLBACK_BUG) { unsigned char workaround_good; workaround_good = constant_time_eq_8(rsa_decrypt[padding_len], (unsigned)(s->version >> 8)); workaround_good &= constant_time_eq_8(rsa_decrypt[padding_len + 1], (unsigned)(s->version & 0xff)); version_good |= workaround_good; } /* * Both decryption and version must be good for decrypt_good to * remain non-zero (0xff). */ decrypt_good &= version_good; /* * Now copy rand_premaster_secret over from p using * decrypt_good_mask. If decryption failed, then p does not * contain valid plaintext, however, a check above guarantees * it is still sufficiently large to read from. */ for (j = 0; j < sizeof(rand_premaster_secret); j++) { rsa_decrypt[padding_len + j] = constant_time_select_8(decrypt_good, rsa_decrypt[padding_len + j], rand_premaster_secret[j]); } if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len, sizeof(rand_premaster_secret), 0)) { /* SSLfatal() already called */ goto err; } ret = 1; err: OPENSSL_free(rsa_decrypt); return ret; #else /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_cke_dhe(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_DH EVP_PKEY *skey = NULL; DH *cdh; unsigned int i; BIGNUM *pub_key; const unsigned char *data; EVP_PKEY *ckey = NULL; int ret = 0; if (!PACKET_get_net_2(pkt, &i) || PACKET_remaining(pkt) != i) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG); goto err; } skey = s->s3->tmp.pkey; if (skey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_MISSING_TMP_DH_KEY); goto err; } if (PACKET_remaining(pkt) == 0L) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_MISSING_TMP_DH_KEY); goto err; } if (!PACKET_get_bytes(pkt, &data, i)) { /* We already checked we have enough data */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); goto err; } ckey = EVP_PKEY_new(); if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, SSL_R_BN_LIB); goto err; } cdh = EVP_PKEY_get0_DH(ckey); pub_key = BN_bin2bn(data, i, NULL); if (pub_key == NULL || cdh == NULL || !DH_set0_key(cdh, pub_key, NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); BN_free(pub_key); goto err; } if (ssl_derive(s, skey, ckey, 1) == 0) { /* SSLfatal() already called */ goto err; } ret = 1; EVP_PKEY_free(s->s3->tmp.pkey); s->s3->tmp.pkey = NULL; err: EVP_PKEY_free(ckey); return ret; #else /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_cke_ecdhe(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_EC EVP_PKEY *skey = s->s3->tmp.pkey; EVP_PKEY *ckey = NULL; int ret = 0; if (PACKET_remaining(pkt) == 0L) { /* We don't support ECDH client auth */ SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_MISSING_TMP_ECDH_KEY); goto err; } else { unsigned int i; const unsigned char *data; /* * Get client's public key from encoded point in the * ClientKeyExchange message. */ /* Get encoded point length */ if (!PACKET_get_1(pkt, &i) || !PACKET_get_bytes(pkt, &data, i) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_LENGTH_MISMATCH); goto err; } if (skey == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE, SSL_R_MISSING_TMP_ECDH_KEY); goto err; } ckey = EVP_PKEY_new(); if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_EVP_LIB); goto err; } if (EVP_PKEY_set1_tls_encodedpoint(ckey, data, i) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_EC_LIB); goto err; } } if (ssl_derive(s, skey, ckey, 1) == 0) { /* SSLfatal() already called */ goto err; } ret = 1; EVP_PKEY_free(s->s3->tmp.pkey); s->s3->tmp.pkey = NULL; err: EVP_PKEY_free(ckey); return ret; #else /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_cke_srp(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_SRP unsigned int i; const unsigned char *data; if (!PACKET_get_net_2(pkt, &i) || !PACKET_get_bytes(pkt, &data, i)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_SRP, SSL_R_BAD_SRP_A_LENGTH); return 0; } if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_BN_LIB); return 0; } if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0 || BN_is_zero(s->srp_ctx.A)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_CKE_SRP, SSL_R_BAD_SRP_PARAMETERS); return 0; } OPENSSL_free(s->session->srp_username); s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login); if (s->session->srp_username == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_MALLOC_FAILURE); return 0; } if (!srp_generate_server_master_secret(s)) { /* SSLfatal() already called */ return 0; } return 1; #else /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_SRP, ERR_R_INTERNAL_ERROR); return 0; #endif } static int tls_process_cke_gost(SSL *s, PACKET *pkt) { #ifndef OPENSSL_NO_GOST EVP_PKEY_CTX *pkey_ctx; EVP_PKEY *client_pub_pkey = NULL, *pk = NULL; unsigned char premaster_secret[32]; const unsigned char *start; size_t outlen = 32, inlen; unsigned long alg_a; GOST_KX_MESSAGE *pKX = NULL; const unsigned char *ptr; int ret = 0; /* Get our certificate private key */ alg_a = s->s3->tmp.new_cipher->algorithm_auth; if (alg_a & SSL_aGOST12) { /* * New GOST ciphersuites have SSL_aGOST01 bit too */ pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey; if (pk == NULL) { pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey; } if (pk == NULL) { pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey; } } else if (alg_a & SSL_aGOST01) { pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey; } pkey_ctx = EVP_PKEY_CTX_new(pk, NULL); if (pkey_ctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_MALLOC_FAILURE); return 0; } if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR); return 0; } /* * If client certificate is present and is of the same type, maybe * use it for key exchange. Don't mind errors from * EVP_PKEY_derive_set_peer, because it is completely valid to use a * client certificate for authorization only. */ client_pub_pkey = X509_get0_pubkey(s->session->peer); if (client_pub_pkey) { if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0) ERR_clear_error(); } ptr = PACKET_data(pkt); /* Some implementations provide extra data in the opaqueBlob * We have nothing to do with this blob so we just skip it */ pKX = d2i_GOST_KX_MESSAGE(NULL, &ptr, PACKET_remaining(pkt)); if (pKX == NULL || pKX->kxBlob == NULL || ASN1_TYPE_get(pKX->kxBlob) != V_ASN1_SEQUENCE) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED); goto err; } if (!PACKET_forward(pkt, ptr - PACKET_data(pkt))) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED); goto err; } if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED); goto err; } inlen = pKX->kxBlob->value.sequence->length; start = pKX->kxBlob->value.sequence->data; if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen, start, inlen) <= 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, SSL_R_DECRYPTION_FAILED); goto err; } /* Generate master secret */ if (!ssl_generate_master_secret(s, premaster_secret, sizeof(premaster_secret), 0)) { /* SSLfatal() already called */ goto err; } /* Check if pubkey from client certificate was used */ if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0) s->statem.no_cert_verify = 1; ret = 1; err: EVP_PKEY_CTX_free(pkey_ctx); GOST_KX_MESSAGE_free(pKX); return ret; #else /* Should never happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST, ERR_R_INTERNAL_ERROR); return 0; #endif } MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt) { unsigned long alg_k; alg_k = s->s3->tmp.new_cipher->algorithm_mkey; /* For PSK parse and retrieve identity, obtain PSK key */ if ((alg_k & SSL_PSK) && !tls_process_cke_psk_preamble(s, pkt)) { /* SSLfatal() already called */ goto err; } if (alg_k & SSL_kPSK) { /* Identity extracted earlier: should be nothing left */ if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH); goto err; } /* PSK handled by ssl_generate_master_secret */ if (!ssl_generate_master_secret(s, NULL, 0, 0)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) { if (!tls_process_cke_rsa(s, pkt)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) { if (!tls_process_cke_dhe(s, pkt)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) { if (!tls_process_cke_ecdhe(s, pkt)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & SSL_kSRP) { if (!tls_process_cke_srp(s, pkt)) { /* SSLfatal() already called */ goto err; } } else if (alg_k & SSL_kGOST) { if (!tls_process_cke_gost(s, pkt)) { /* SSLfatal() already called */ goto err; } } else { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_UNKNOWN_CIPHER_TYPE); goto err; } return MSG_PROCESS_CONTINUE_PROCESSING; err: #ifndef OPENSSL_NO_PSK OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen); s->s3->tmp.psk = NULL; + s->s3->tmp.psklen = 0; #endif return MSG_PROCESS_ERROR; } WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst) { #ifndef OPENSSL_NO_SCTP if (wst == WORK_MORE_A) { if (SSL_IS_DTLS(s)) { unsigned char sctpauthkey[64]; char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; size_t labellen; /* * Add new shared key for SCTP-Auth, will be ignored if no SCTP * used. */ memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL, sizeof(DTLS1_SCTP_AUTH_LABEL)); /* Don't include the terminating zero. */ labellen = sizeof(labelbuffer) - 1; if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) labellen += 1; if (SSL_export_keying_material(s, sctpauthkey, sizeof(sctpauthkey), labelbuffer, labellen, NULL, 0, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); return WORK_ERROR; } BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, sizeof(sctpauthkey), sctpauthkey); } } #endif if (s->statem.no_cert_verify || !s->session->peer) { /* * No certificate verify or no peer certificate so we no longer need * the handshake_buffer */ if (!ssl3_digest_cached_records(s, 0)) { /* SSLfatal() already called */ return WORK_ERROR; } return WORK_FINISHED_CONTINUE; } else { if (!s->s3->handshake_buffer) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); return WORK_ERROR; } /* * For sigalgs freeze the handshake buffer. If we support * extms we've done this already so this is a no-op */ if (!ssl3_digest_cached_records(s, 1)) { /* SSLfatal() already called */ return WORK_ERROR; } } return WORK_FINISHED_CONTINUE; } MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt) { int i; MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR; X509 *x = NULL; unsigned long l; const unsigned char *certstart, *certbytes; STACK_OF(X509) *sk = NULL; PACKET spkt, context; size_t chainidx; SSL_SESSION *new_sess = NULL; /* * To get this far we must have read encrypted data from the client. We no * longer tolerate unencrypted alerts. This value is ignored if less than * TLSv1.3 */ s->statem.enc_read_state = ENC_READ_STATE_VALID; if ((sk = sk_X509_new_null()) == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE); goto err; } if (SSL_IS_TLS13(s) && (!PACKET_get_length_prefixed_1(pkt, &context) || (s->pha_context == NULL && PACKET_remaining(&context) != 0) || (s->pha_context != NULL && !PACKET_equal(&context, s->pha_context, s->pha_context_len)))) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_INVALID_CONTEXT); goto err; } if (!PACKET_get_length_prefixed_3(pkt, &spkt) || PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_LENGTH_MISMATCH); goto err; } for (chainidx = 0; PACKET_remaining(&spkt) > 0; chainidx++) { if (!PACKET_get_net_3(&spkt, &l) || !PACKET_get_bytes(&spkt, &certbytes, l)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_CERT_LENGTH_MISMATCH); goto err; } certstart = certbytes; x = d2i_X509(NULL, (const unsigned char **)&certbytes, l); if (x == NULL) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_ASN1_LIB); goto err; } if (certbytes != (certstart + l)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_CERT_LENGTH_MISMATCH); goto err; } if (SSL_IS_TLS13(s)) { RAW_EXTENSION *rawexts = NULL; PACKET extensions; if (!PACKET_get_length_prefixed_2(&spkt, &extensions)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_BAD_LENGTH); goto err; } if (!tls_collect_extensions(s, &extensions, SSL_EXT_TLS1_3_CERTIFICATE, &rawexts, NULL, chainidx == 0) || !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE, rawexts, x, chainidx, PACKET_remaining(&spkt) == 0)) { OPENSSL_free(rawexts); goto err; } OPENSSL_free(rawexts); } if (!sk_X509_push(sk, x)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE); goto err; } x = NULL; } if (sk_X509_num(sk) <= 0) { /* TLS does not mind 0 certs returned */ if (s->version == SSL3_VERSION) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_NO_CERTIFICATES_RETURNED); goto err; } /* Fail for TLS only if we required a certificate */ else if ((s->verify_mode & SSL_VERIFY_PEER) && (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) { SSLfatal(s, SSL_AD_CERTIFICATE_REQUIRED, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); goto err; } /* No client certificate so digest cached records */ if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) { /* SSLfatal() already called */ goto err; } } else { EVP_PKEY *pkey; i = ssl_verify_cert_chain(s, sk); if (i <= 0) { SSLfatal(s, ssl_x509err2alert(s->verify_result), SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_CERTIFICATE_VERIFY_FAILED); goto err; } if (i > 1) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, i); goto err; } pkey = X509_get0_pubkey(sk_X509_value(sk, 0)); if (pkey == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_UNKNOWN_CERTIFICATE_TYPE); goto err; } } /* * Sessions must be immutable once they go into the session cache. Otherwise * we can get multi-thread problems. Therefore we don't "update" sessions, * we replace them with a duplicate. Here, we need to do this every time * a new certificate is received via post-handshake authentication, as the * session may have already gone into the session cache. */ if (s->post_handshake_auth == SSL_PHA_REQUESTED) { if ((new_sess = ssl_session_dup(s->session, 0)) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE); goto err; } SSL_SESSION_free(s->session); s->session = new_sess; } X509_free(s->session->peer); s->session->peer = sk_X509_shift(sk); s->session->verify_result = s->verify_result; sk_X509_pop_free(s->session->peer_chain, X509_free); s->session->peer_chain = sk; /* * Freeze the handshake buffer. For cert_verify_hash, sizeof(s->cert_verify_hash), &s->cert_verify_hash_len)) { /* SSLfatal() already called */ goto err; } /* Resend session tickets */ s->sent_tickets = 0; } ret = MSG_PROCESS_CONTINUE_READING; err: X509_free(x); sk_X509_pop_free(sk, X509_free); return ret; } int tls_construct_server_certificate(SSL *s, WPACKET *pkt) { CERT_PKEY *cpk = s->s3->tmp.cert; if (cpk == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR); return 0; } /* * In TLSv1.3 the certificate chain is always preceded by a 0 length context * for the server Certificate message */ if (SSL_IS_TLS13(s) && !WPACKET_put_bytes_u8(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR); return 0; } if (!ssl3_output_cert_chain(s, pkt, cpk)) { /* SSLfatal() already called */ return 0; } return 1; } static int create_ticket_prequel(SSL *s, WPACKET *pkt, uint32_t age_add, unsigned char *tick_nonce) { /* * Ticket lifetime hint: For TLSv1.2 this is advisory only and we leave this * unspecified for resumed session (for simplicity). * In TLSv1.3 we reset the "time" field above, and always specify the * timeout. */ if (!WPACKET_put_bytes_u32(pkt, (s->hit && !SSL_IS_TLS13(s)) ? 0 : s->session->timeout)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CREATE_TICKET_PREQUEL, ERR_R_INTERNAL_ERROR); return 0; } if (SSL_IS_TLS13(s)) { if (!WPACKET_put_bytes_u32(pkt, age_add) || !WPACKET_sub_memcpy_u8(pkt, tick_nonce, TICKET_NONCE_SIZE)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CREATE_TICKET_PREQUEL, ERR_R_INTERNAL_ERROR); return 0; } } /* Start the sub-packet for the actual ticket data */ if (!WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CREATE_TICKET_PREQUEL, ERR_R_INTERNAL_ERROR); return 0; } return 1; } static int construct_stateless_ticket(SSL *s, WPACKET *pkt, uint32_t age_add, unsigned char *tick_nonce) { unsigned char *senc = NULL; EVP_CIPHER_CTX *ctx = NULL; HMAC_CTX *hctx = NULL; unsigned char *p, *encdata1, *encdata2, *macdata1, *macdata2; const unsigned char *const_p; int len, slen_full, slen, lenfinal; SSL_SESSION *sess; unsigned int hlen; SSL_CTX *tctx = s->session_ctx; unsigned char iv[EVP_MAX_IV_LENGTH]; unsigned char key_name[TLSEXT_KEYNAME_LENGTH]; int iv_len, ok = 0; size_t macoffset, macendoffset; /* get session encoding length */ slen_full = i2d_SSL_SESSION(s->session, NULL); /* * Some length values are 16 bits, so forget it if session is too * long */ if (slen_full == 0 || slen_full > 0xFF00) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } senc = OPENSSL_malloc(slen_full); if (senc == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_MALLOC_FAILURE); goto err; } ctx = EVP_CIPHER_CTX_new(); hctx = HMAC_CTX_new(); if (ctx == NULL || hctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_MALLOC_FAILURE); goto err; } p = senc; if (!i2d_SSL_SESSION(s->session, &p)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } /* * create a fresh copy (not shared with other threads) to clean up */ const_p = senc; sess = d2i_SSL_SESSION(NULL, &const_p, slen_full); if (sess == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } slen = i2d_SSL_SESSION(sess, NULL); if (slen == 0 || slen > slen_full) { /* shouldn't ever happen */ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); SSL_SESSION_free(sess); goto err; } p = senc; if (!i2d_SSL_SESSION(sess, &p)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); SSL_SESSION_free(sess); goto err; } SSL_SESSION_free(sess); /* * Initialize HMAC and cipher contexts. If callback present it does * all the work otherwise use generated values from parent ctx. */ if (tctx->ext.ticket_key_cb) { /* if 0 is returned, write an empty ticket */ int ret = tctx->ext.ticket_key_cb(s, key_name, iv, ctx, hctx, 1); if (ret == 0) { /* Put timeout and length */ if (!WPACKET_put_bytes_u32(pkt, 0) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } OPENSSL_free(senc); EVP_CIPHER_CTX_free(ctx); HMAC_CTX_free(hctx); return 1; } if (ret < 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, SSL_R_CALLBACK_FAILED); goto err; } iv_len = EVP_CIPHER_CTX_iv_length(ctx); } else { const EVP_CIPHER *cipher = EVP_aes_256_cbc(); iv_len = EVP_CIPHER_iv_length(cipher); if (RAND_bytes(iv, iv_len) <= 0 || !EVP_EncryptInit_ex(ctx, cipher, NULL, tctx->ext.secure->tick_aes_key, iv) || !HMAC_Init_ex(hctx, tctx->ext.secure->tick_hmac_key, sizeof(tctx->ext.secure->tick_hmac_key), EVP_sha256(), NULL)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } memcpy(key_name, tctx->ext.tick_key_name, sizeof(tctx->ext.tick_key_name)); } if (!create_ticket_prequel(s, pkt, age_add, tick_nonce)) { /* SSLfatal() already called */ goto err; } if (!WPACKET_get_total_written(pkt, &macoffset) /* Output key name */ || !WPACKET_memcpy(pkt, key_name, sizeof(key_name)) /* output IV */ || !WPACKET_memcpy(pkt, iv, iv_len) || !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH, &encdata1) /* Encrypt session data */ || !EVP_EncryptUpdate(ctx, encdata1, &len, senc, slen) || !WPACKET_allocate_bytes(pkt, len, &encdata2) || encdata1 != encdata2 || !EVP_EncryptFinal(ctx, encdata1 + len, &lenfinal) || !WPACKET_allocate_bytes(pkt, lenfinal, &encdata2) || encdata1 + len != encdata2 || len + lenfinal > slen + EVP_MAX_BLOCK_LENGTH || !WPACKET_get_total_written(pkt, &macendoffset) || !HMAC_Update(hctx, (unsigned char *)s->init_buf->data + macoffset, macendoffset - macoffset) || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &macdata1) || !HMAC_Final(hctx, macdata1, &hlen) || hlen > EVP_MAX_MD_SIZE || !WPACKET_allocate_bytes(pkt, hlen, &macdata2) || macdata1 != macdata2) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } /* Close the sub-packet created by create_ticket_prequel() */ if (!WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR); goto err; } ok = 1; err: OPENSSL_free(senc); EVP_CIPHER_CTX_free(ctx); HMAC_CTX_free(hctx); return ok; } static int construct_stateful_ticket(SSL *s, WPACKET *pkt, uint32_t age_add, unsigned char *tick_nonce) { if (!create_ticket_prequel(s, pkt, age_add, tick_nonce)) { /* SSLfatal() already called */ return 0; } if (!WPACKET_memcpy(pkt, s->session->session_id, s->session->session_id_length) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATEFUL_TICKET, ERR_R_INTERNAL_ERROR); return 0; } return 1; } int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt) { SSL_CTX *tctx = s->session_ctx; unsigned char tick_nonce[TICKET_NONCE_SIZE]; union { unsigned char age_add_c[sizeof(uint32_t)]; uint32_t age_add; } age_add_u; age_add_u.age_add = 0; if (SSL_IS_TLS13(s)) { size_t i, hashlen; uint64_t nonce; static const unsigned char nonce_label[] = "resumption"; const EVP_MD *md = ssl_handshake_md(s); int hashleni = EVP_MD_size(md); /* Ensure cast to size_t is safe */ if (!ossl_assert(hashleni >= 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR); goto err; } hashlen = (size_t)hashleni; /* * If we already sent one NewSessionTicket, or we resumed then * s->session may already be in a cache and so we must not modify it. * Instead we need to take a copy of it and modify that. */ if (s->sent_tickets != 0 || s->hit) { SSL_SESSION *new_sess = ssl_session_dup(s->session, 0); if (new_sess == NULL) { /* SSLfatal already called */ goto err; } SSL_SESSION_free(s->session); s->session = new_sess; } if (!ssl_generate_session_id(s, s->session)) { /* SSLfatal() already called */ goto err; } if (RAND_bytes(age_add_u.age_add_c, sizeof(age_add_u)) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR); goto err; } s->session->ext.tick_age_add = age_add_u.age_add; nonce = s->next_ticket_nonce; for (i = TICKET_NONCE_SIZE; i > 0; i--) { tick_nonce[i - 1] = (unsigned char)(nonce & 0xff); nonce >>= 8; } if (!tls13_hkdf_expand(s, md, s->resumption_master_secret, nonce_label, sizeof(nonce_label) - 1, tick_nonce, TICKET_NONCE_SIZE, s->session->master_key, hashlen, 1)) { /* SSLfatal() already called */ goto err; } s->session->master_key_length = hashlen; s->session->time = (long)time(NULL); if (s->s3->alpn_selected != NULL) { OPENSSL_free(s->session->ext.alpn_selected); s->session->ext.alpn_selected = OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); if (s->session->ext.alpn_selected == NULL) { + s->session->ext.alpn_selected_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE); goto err; } s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; } s->session->ext.max_early_data = s->max_early_data; } if (tctx->generate_ticket_cb != NULL && tctx->generate_ticket_cb(s, tctx->ticket_cb_data) == 0) goto err; /* * If we are using anti-replay protection then we behave as if * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there * is no point in using full stateless tickets. */ if (SSL_IS_TLS13(s) && ((s->options & SSL_OP_NO_TICKET) != 0 || (s->max_early_data > 0 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0))) { if (!construct_stateful_ticket(s, pkt, age_add_u.age_add, tick_nonce)) { /* SSLfatal() already called */ goto err; } } else if (!construct_stateless_ticket(s, pkt, age_add_u.age_add, tick_nonce)) { /* SSLfatal() already called */ goto err; } if (SSL_IS_TLS13(s)) { if (!tls_construct_extensions(s, pkt, SSL_EXT_TLS1_3_NEW_SESSION_TICKET, NULL, 0)) { /* SSLfatal() already called */ goto err; } /* * Increment both |sent_tickets| and |next_ticket_nonce|. |sent_tickets| * gets reset to 0 if we send more tickets following a post-handshake * auth, but |next_ticket_nonce| does not. */ s->sent_tickets++; s->next_ticket_nonce++; ssl_update_cache(s, SSL_SESS_CACHE_SERVER); } return 1; err: return 0; } /* * In TLSv1.3 this is called from the extensions code, otherwise it is used to * create a separate message. Returns 1 on success or 0 on failure. */ int tls_construct_cert_status_body(SSL *s, WPACKET *pkt) { if (!WPACKET_put_bytes_u8(pkt, s->ext.status_type) || !WPACKET_sub_memcpy_u24(pkt, s->ext.ocsp.resp, s->ext.ocsp.resp_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_STATUS_BODY, ERR_R_INTERNAL_ERROR); return 0; } return 1; } int tls_construct_cert_status(SSL *s, WPACKET *pkt) { if (!tls_construct_cert_status_body(s, pkt)) { /* SSLfatal() already called */ return 0; } return 1; } #ifndef OPENSSL_NO_NEXTPROTONEG /* * tls_process_next_proto reads a Next Protocol Negotiation handshake message. * It sets the next_proto member in s if found */ MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt) { PACKET next_proto, padding; size_t next_proto_len; /*- * The payload looks like: * uint8 proto_len; * uint8 proto[proto_len]; * uint8 padding_len; * uint8 padding[padding_len]; */ if (!PACKET_get_length_prefixed_1(pkt, &next_proto) || !PACKET_get_length_prefixed_1(pkt, &padding) || PACKET_remaining(pkt) > 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEXT_PROTO, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } if (!PACKET_memdup(&next_proto, &s->ext.npn, &next_proto_len)) { s->ext.npn_len = 0; SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEXT_PROTO, ERR_R_INTERNAL_ERROR); return MSG_PROCESS_ERROR; } s->ext.npn_len = (unsigned char)next_proto_len; return MSG_PROCESS_CONTINUE_READING; } #endif static int tls_construct_encrypted_extensions(SSL *s, WPACKET *pkt) { if (!tls_construct_extensions(s, pkt, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS, NULL, 0)) { /* SSLfatal() already called */ return 0; } return 1; } MSG_PROCESS_RETURN tls_process_end_of_early_data(SSL *s, PACKET *pkt) { if (PACKET_remaining(pkt) != 0) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_END_OF_EARLY_DATA, SSL_R_LENGTH_MISMATCH); return MSG_PROCESS_ERROR; } if (s->early_data_state != SSL_EARLY_DATA_READING && s->early_data_state != SSL_EARLY_DATA_READ_RETRY) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_END_OF_EARLY_DATA, ERR_R_INTERNAL_ERROR); return MSG_PROCESS_ERROR; } /* * EndOfEarlyData signals a key change so the end of the message must be on * a record boundary. */ if (RECORD_LAYER_processed_read_pending(&s->rlayer)) { SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_TLS_PROCESS_END_OF_EARLY_DATA, SSL_R_NOT_ON_RECORD_BOUNDARY); return MSG_PROCESS_ERROR; } s->early_data_state = SSL_EARLY_DATA_FINISHED_READING; if (!s->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_SERVER_READ)) { /* SSLfatal() already called */ return MSG_PROCESS_ERROR; } return MSG_PROCESS_CONTINUE_READING; } diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index dfcb11bb7d5d..68ee29d30168 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -1,313 +1,313 @@ #!/bin/sh - # # SPDX-License-Identifier: BSD-3-Clause # # Copyright (c) 1984, 1986, 1990, 1993 # The Regents of the University of California. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # 3. Neither the name of the University nor the names of its contributors # may be used to endorse or promote products derived from this software # without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # # @(#)newvers.sh 8.1 (Berkeley) 4/20/94 # $FreeBSD$ # Command line options: # # -r Reproducible build. Do not embed directory names, user # names, time stamps or other dynamic information into # the output file. This is intended to allow two builds # done at different times and even by different people on # different hosts to produce identical output. # # -R Reproducible build if the tree represents an unmodified # checkout from a version control system. Metadata is # included if the tree is modified. # Note: usr.sbin/amd/include/newvers.sh assumes all variable assignments of # upper case variables starting in column 1 are on one line w/o continuation. TYPE="FreeBSD" REVISION="12.2" -BRANCH="RELEASE-p4" +BRANCH="RELEASE-p5" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi RELEASE="${REVISION}-${BRANCH}" VERSION="${TYPE} ${RELEASE}" # # findvcs dir # Looks up directory dir at world root and up the filesystem # findvcs() { local savedir savedir=$(pwd) cd ${SYSDIR}/.. while [ $(pwd) != "/" ]; do if [ -e "./$1" ]; then VCSTOP=$(pwd) VCSDIR=${VCSTOP}"/$1" cd ${savedir} return 0 fi cd .. done cd ${savedir} return 1 } if [ -z "${SYSDIR}" ]; then SYSDIR=$(dirname $0)/.. fi RELDATE=$(awk '/__FreeBSD_version.*propagated to newvers/ {print $3}' ${PARAMFILE:-${SYSDIR}/sys/param.h}) if [ -r "${SYSDIR}/../COPYRIGHT" ]; then year=$(sed -Ee '/^Copyright .* The FreeBSD Project/!d;s/^.*1992-([0-9]*) .*$/\1/g' ${SYSDIR}/../COPYRIGHT) else year=$(date +%Y) fi # look for copyright template b=share/examples/etc/bsd-style-copyright for bsd_copyright in ../$b ../../$b ../../../$b /usr/src/$b /usr/$b do if [ -r "$bsd_copyright" ]; then COPYRIGHT=`sed \ -e "s/\[year\]/1992-$year/" \ -e 's/\[your name here\]\.* /The FreeBSD Project./' \ -e 's/\[your name\]\.*/The FreeBSD Project./' \ -e '/\[id for your version control system, if any\]/d' \ $bsd_copyright` break fi done # no copyright found, use a dummy if [ -z "$COPYRIGHT" ]; then COPYRIGHT="/*- * Copyright (c) 1992-$year The FreeBSD Project. * All rights reserved. * */" fi # add newline COPYRIGHT="$COPYRIGHT " # VARS_ONLY means no files should be generated, this is just being # included. [ -n "$VARS_ONLY" ] && return 0 LC_ALL=C; export LC_ALL if [ ! -r version ] then echo 0 > version fi touch version v=`cat version` u=${USER:-root} d=`pwd` h=${HOSTNAME:-`hostname`} if [ -n "$SOURCE_DATE_EPOCH" ]; then if ! t=`date -r $SOURCE_DATE_EPOCH 2>/dev/null`; then echo "Invalid SOURCE_DATE_EPOCH" >&2 exit 1 fi else t=`date` fi i=`${MAKE:-make} -V KERN_IDENT` compiler_v=$($(${MAKE:-make} -V CC) -v 2>&1 | grep -w 'version') for dir in /usr/bin /usr/local/bin; do if [ ! -z "${svnversion}" ] ; then break fi if [ -x "${dir}/svnversion" ] && [ -z ${svnversion} ] ; then # Run svnversion from ${dir} on this script; if return code # is not zero, the checkout might not be compatible with the # svnversion being used. ${dir}/svnversion $(realpath ${0}) >/dev/null 2>&1 if [ $? -eq 0 ]; then svnversion=${dir}/svnversion break fi fi done if [ -z "${svnversion}" ] && [ -x /usr/bin/svnliteversion ] ; then /usr/bin/svnliteversion $(realpath ${0}) >/dev/null 2>&1 if [ $? -eq 0 ]; then svnversion=/usr/bin/svnliteversion else svnversion= fi fi for dir in /usr/bin /usr/local/bin; do if [ -x "${dir}/p4" ] && [ -z ${p4_cmd} ] ; then p4_cmd=${dir}/p4 fi done if findvcs .git; then for dir in /usr/bin /usr/local/bin; do if [ -x "${dir}/git" ] ; then git_cmd="${dir}/git -c help.autocorrect=0 --git-dir=${VCSDIR}" break fi done fi if findvcs .hg; then for dir in /usr/bin /usr/local/bin; do if [ -x "${dir}/hg" ] ; then hg_cmd="${dir}/hg -R ${VCSDIR}" break fi done fi if [ -n "$svnversion" ] ; then svn=`cd ${SYSDIR} && $svnversion 2>/dev/null` case "$svn" in [0-9]*[MSP]|*:*) svn=" r${svn}" modified=true ;; [0-9]*) svn=" r${svn}" ;; *) unset svn ;; esac fi if [ -n "$git_cmd" ] ; then git=`$git_cmd rev-parse --verify --short HEAD 2>/dev/null` svn=`$git_cmd svn find-rev $git 2>/dev/null` if [ -n "$svn" ] ; then svn=" r${svn}" git="=${git}" else svn=`$git_cmd log --grep '^git-svn-id:' | \ grep '^ git-svn-id:' | head -1 | \ sed -n 's/^.*@\([0-9][0-9]*\).*$/\1/p'` if [ -z "$svn" ] ; then svn=`$git_cmd log --format='format:%N' | \ grep '^svn ' | head -1 | \ sed -n 's/^.*revision=\([0-9][0-9]*\).*$/\1/p'` fi if [ -n "$svn" ] ; then svn=" r${svn}" git="+${git}" else git=" ${git}" fi fi git_b=`$git_cmd rev-parse --abbrev-ref HEAD` if [ -n "$git_b" ] ; then git="${git}(${git_b})" fi if $git_cmd --work-tree=${VCSTOP} diff-index \ --name-only HEAD | read dummy; then git="${git}-dirty" modified=true fi fi if [ -n "$p4_cmd" ] ; then p4version=`cd ${SYSDIR} && $p4_cmd changes -m1 "./...#have" 2>&1 | \ awk '{ print $2 }'` case "$p4version" in [0-9]*) p4version=" ${p4version}" p4opened=`cd ${SYSDIR} && $p4_cmd opened ./... 2>&1` case "$p4opened" in File*) ;; //*) p4version="${p4version}+edit" modified=true ;; esac ;; *) unset p4version ;; esac fi if [ -n "$hg_cmd" ] ; then hg=`$hg_cmd id 2>/dev/null` svn=`$hg_cmd svn info 2>/dev/null | \ awk -F': ' '/Revision/ { print $2 }'` if [ -n "$svn" ] ; then svn=" r${svn}" fi if [ -n "$hg" ] ; then hg=" ${hg}" fi fi include_metadata=true while getopts rR opt; do case "$opt" in r) include_metadata= ;; R) if [ -z "${modified}" ]; then include_metadata= fi esac done shift $((OPTIND - 1)) if [ -z "${include_metadata}" ]; then VERINFO="${VERSION}${svn}${git}${hg}${p4version} ${i}" VERSTR="${VERINFO}\\n" else VERINFO="${VERSION} #${v}${svn}${git}${hg}${p4version}: ${t}" VERSTR="${VERINFO}\\n ${u}@${h}:${d}\\n" fi cat << EOF > vers.c $COPYRIGHT #define SCCSSTR "@(#)${VERINFO}" #define VERSTR "${VERSTR}" #define RELSTR "${RELEASE}" char sccs[sizeof(SCCSSTR) > 128 ? sizeof(SCCSSTR) : 128] = SCCSSTR; char version[sizeof(VERSTR) > 256 ? sizeof(VERSTR) : 256] = VERSTR; char compiler_version[] = "${compiler_v}"; char ostype[] = "${TYPE}"; char osrelease[sizeof(RELSTR) > 32 ? sizeof(RELSTR) : 32] = RELSTR; int osreldate = ${RELDATE}; char kern_ident[] = "${i}"; EOF echo $((v + 1)) > version