1/* 2 * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10#include <openssl/ocsp.h> 11#include "../ssl_local.h" 12#include "internal/cryptlib.h" 13#include "statem_local.h" 14 15EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, 16 unsigned int context, X509 *x, 17 size_t chainidx) 18{ 19 /* Add RI if renegotiating */ 20 if (!s->renegotiate) 21 return EXT_RETURN_NOT_SENT; 22 23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) 24 || !WPACKET_start_sub_packet_u16(pkt) 25 || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished, 26 s->s3->previous_client_finished_len) 27 || !WPACKET_close(pkt)) { 28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, 29 ERR_R_INTERNAL_ERROR); 30 return EXT_RETURN_FAIL; 31 } 32 33 return EXT_RETURN_SENT; 34} 35 36EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, 37 unsigned int context, X509 *x, 38 size_t chainidx) 39{ 40 if (s->ext.hostname == NULL) 41 return EXT_RETURN_NOT_SENT; 42 43 /* Add TLS extension servername to the Client Hello message */ 44 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) 45 /* Sub-packet for server_name extension */ 46 || !WPACKET_start_sub_packet_u16(pkt) 47 /* Sub-packet for servername list (always 1 hostname)*/ 48 || !WPACKET_start_sub_packet_u16(pkt) 49 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name) 50 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname, 51 strlen(s->ext.hostname)) 52 || !WPACKET_close(pkt) 53 || !WPACKET_close(pkt)) { 54 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, 55 ERR_R_INTERNAL_ERROR); 56 return EXT_RETURN_FAIL; 57 } 58 59 return EXT_RETURN_SENT; 60} 61 62/* Push a Max Fragment Len extension into ClientHello */ 63EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, 64 unsigned int context, X509 *x, 65 size_t chainidx) 66{ 67 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED) 68 return EXT_RETURN_NOT_SENT; 69 70 /* Add Max Fragment Length extension if client enabled it. */ 71 /*- 72 * 4 bytes for this extension type and extension length 73 * 1 byte for the Max Fragment Length code value. 74 */ 75 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length) 76 /* Sub-packet for Max Fragment Length extension (1 byte) */ 77 || !WPACKET_start_sub_packet_u16(pkt) 78 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode) 79 || !WPACKET_close(pkt)) { 80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 81 SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR); 82 return EXT_RETURN_FAIL; 83 } 84 85 return EXT_RETURN_SENT; 86} 87 88#ifndef OPENSSL_NO_SRP 89EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, 90 X509 *x, size_t chainidx) 91{ 92 /* Add SRP username if there is one */ 93 if (s->srp_ctx.login == NULL) 94 return EXT_RETURN_NOT_SENT; 95 96 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp) 97 /* Sub-packet for SRP extension */ 98 || !WPACKET_start_sub_packet_u16(pkt) 99 || !WPACKET_start_sub_packet_u8(pkt) 100 /* login must not be zero...internal error if so */ 101 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH) 102 || !WPACKET_memcpy(pkt, s->srp_ctx.login, 103 strlen(s->srp_ctx.login)) 104 || !WPACKET_close(pkt) 105 || !WPACKET_close(pkt)) { 106 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP, 107 ERR_R_INTERNAL_ERROR); 108 return EXT_RETURN_FAIL; 109 } 110 111 return EXT_RETURN_SENT; 112} 113#endif 114 115#ifndef OPENSSL_NO_EC 116static int use_ecc(SSL *s) 117{ 118 int i, end, ret = 0; 119 unsigned long alg_k, alg_a; 120 STACK_OF(SSL_CIPHER) *cipher_stack = NULL; 121 122 /* See if we support any ECC ciphersuites */ 123 if (s->version == SSL3_VERSION) 124 return 0; 125 126 cipher_stack = SSL_get1_supported_ciphers(s); 127 end = sk_SSL_CIPHER_num(cipher_stack); 128 for (i = 0; i < end; i++) { 129 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); 130 131 alg_k = c->algorithm_mkey; 132 alg_a = c->algorithm_auth; 133 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) 134 || (alg_a & SSL_aECDSA) 135 || c->min_tls >= TLS1_3_VERSION) { 136 ret = 1; 137 break; 138 } 139 } 140 141 sk_SSL_CIPHER_free(cipher_stack); 142 return ret; 143} 144 145EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, 146 unsigned int context, X509 *x, 147 size_t chainidx) 148{ 149 const unsigned char *pformats; 150 size_t num_formats; 151 152 if (!use_ecc(s)) 153 return EXT_RETURN_NOT_SENT; 154 155 /* Add TLS extension ECPointFormats to the ClientHello message */ 156 tls1_get_formatlist(s, &pformats, &num_formats); 157 158 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) 159 /* Sub-packet for formats extension */ 160 || !WPACKET_start_sub_packet_u16(pkt) 161 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats) 162 || !WPACKET_close(pkt)) { 163 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 164 SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 165 return EXT_RETURN_FAIL; 166 } 167 168 return EXT_RETURN_SENT; 169} 170 171EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, 172 unsigned int context, X509 *x, 173 size_t chainidx) 174{ 175 const uint16_t *pgroups = NULL; 176 size_t num_groups = 0, i; 177 178 if (!use_ecc(s)) 179 return EXT_RETURN_NOT_SENT; 180 181 /* 182 * Add TLS extension supported_groups to the ClientHello message 183 */ 184 /* TODO(TLS1.3): Add support for DHE groups */ 185 tls1_get_supported_groups(s, &pgroups, &num_groups); 186 187 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) 188 /* Sub-packet for supported_groups extension */ 189 || !WPACKET_start_sub_packet_u16(pkt) 190 || !WPACKET_start_sub_packet_u16(pkt)) { 191 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 192 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 193 ERR_R_INTERNAL_ERROR); 194 return EXT_RETURN_FAIL; 195 } 196 /* Copy curve ID if supported */ 197 for (i = 0; i < num_groups; i++) { 198 uint16_t ctmp = pgroups[i]; 199 200 if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) { 201 if (!WPACKET_put_bytes_u16(pkt, ctmp)) { 202 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 203 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 204 ERR_R_INTERNAL_ERROR); 205 return EXT_RETURN_FAIL; 206 } 207 } 208 } 209 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 210 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 211 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS, 212 ERR_R_INTERNAL_ERROR); 213 return EXT_RETURN_FAIL; 214 } 215 216 return EXT_RETURN_SENT; 217} 218#endif 219 220EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, 221 unsigned int context, X509 *x, 222 size_t chainidx) 223{ 224 size_t ticklen; 225 226 if (!tls_use_ticket(s)) 227 return EXT_RETURN_NOT_SENT; 228 229 if (!s->new_session && s->session != NULL 230 && s->session->ext.tick != NULL 231 && s->session->ssl_version != TLS1_3_VERSION) { 232 ticklen = s->session->ext.ticklen; 233 } else if (s->session && s->ext.session_ticket != NULL 234 && s->ext.session_ticket->data != NULL) { 235 ticklen = s->ext.session_ticket->length; 236 s->session->ext.tick = OPENSSL_malloc(ticklen); 237 if (s->session->ext.tick == NULL) { 238 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 239 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, 240 ERR_R_INTERNAL_ERROR); 241 return EXT_RETURN_FAIL; 242 } 243 memcpy(s->session->ext.tick, 244 s->ext.session_ticket->data, ticklen); 245 s->session->ext.ticklen = ticklen; 246 } else { 247 ticklen = 0; 248 } 249 250 if (ticklen == 0 && s->ext.session_ticket != NULL && 251 s->ext.session_ticket->data == NULL) 252 return EXT_RETURN_NOT_SENT; 253 254 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) 255 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) { 256 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 257 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR); 258 return EXT_RETURN_FAIL; 259 } 260 261 return EXT_RETURN_SENT; 262} 263 264EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, 265 unsigned int context, X509 *x, 266 size_t chainidx) 267{ 268 size_t salglen; 269 const uint16_t *salg; 270 271 if (!SSL_CLIENT_USE_SIGALGS(s)) 272 return EXT_RETURN_NOT_SENT; 273 274 salglen = tls12_get_psigalgs(s, 1, &salg); 275 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms) 276 /* Sub-packet for sig-algs extension */ 277 || !WPACKET_start_sub_packet_u16(pkt) 278 /* Sub-packet for the actual list */ 279 || !WPACKET_start_sub_packet_u16(pkt) 280 || !tls12_copy_sigalgs(s, pkt, salg, salglen) 281 || !WPACKET_close(pkt) 282 || !WPACKET_close(pkt)) { 283 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, 284 ERR_R_INTERNAL_ERROR); 285 return EXT_RETURN_FAIL; 286 } 287 288 return EXT_RETURN_SENT; 289} 290 291#ifndef OPENSSL_NO_OCSP 292EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, 293 unsigned int context, X509 *x, 294 size_t chainidx) 295{ 296 int i; 297 298 /* This extension isn't defined for client Certificates */ 299 if (x != NULL) 300 return EXT_RETURN_NOT_SENT; 301 302 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) 303 return EXT_RETURN_NOT_SENT; 304 305 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) 306 /* Sub-packet for status request extension */ 307 || !WPACKET_start_sub_packet_u16(pkt) 308 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp) 309 /* Sub-packet for the ids */ 310 || !WPACKET_start_sub_packet_u16(pkt)) { 311 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 312 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 313 return EXT_RETURN_FAIL; 314 } 315 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) { 316 unsigned char *idbytes; 317 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i); 318 int idlen = i2d_OCSP_RESPID(id, NULL); 319 320 if (idlen <= 0 321 /* Sub-packet for an individual id */ 322 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes) 323 || i2d_OCSP_RESPID(id, &idbytes) != idlen) { 324 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 325 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 326 ERR_R_INTERNAL_ERROR); 327 return EXT_RETURN_FAIL; 328 } 329 } 330 if (!WPACKET_close(pkt) 331 || !WPACKET_start_sub_packet_u16(pkt)) { 332 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 333 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 334 return EXT_RETURN_FAIL; 335 } 336 if (s->ext.ocsp.exts) { 337 unsigned char *extbytes; 338 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL); 339 340 if (extlen < 0) { 341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 342 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 343 ERR_R_INTERNAL_ERROR); 344 return EXT_RETURN_FAIL; 345 } 346 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes) 347 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes) 348 != extlen) { 349 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 350 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, 351 ERR_R_INTERNAL_ERROR); 352 return EXT_RETURN_FAIL; 353 } 354 } 355 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 356 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 357 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); 358 return EXT_RETURN_FAIL; 359 } 360 361 return EXT_RETURN_SENT; 362} 363#endif 364 365#ifndef OPENSSL_NO_NEXTPROTONEG 366EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, 367 X509 *x, size_t chainidx) 368{ 369 if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 370 return EXT_RETURN_NOT_SENT; 371 372 /* 373 * The client advertises an empty extension to indicate its support 374 * for Next Protocol Negotiation 375 */ 376 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg) 377 || !WPACKET_put_bytes_u16(pkt, 0)) { 378 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN, 379 ERR_R_INTERNAL_ERROR); 380 return EXT_RETURN_FAIL; 381 } 382 383 return EXT_RETURN_SENT; 384} 385#endif 386 387EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, 388 X509 *x, size_t chainidx) 389{ 390 s->s3->alpn_sent = 0; 391 392 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s)) 393 return EXT_RETURN_NOT_SENT; 394 395 if (!WPACKET_put_bytes_u16(pkt, 396 TLSEXT_TYPE_application_layer_protocol_negotiation) 397 /* Sub-packet ALPN extension */ 398 || !WPACKET_start_sub_packet_u16(pkt) 399 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len) 400 || !WPACKET_close(pkt)) { 401 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN, 402 ERR_R_INTERNAL_ERROR); 403 return EXT_RETURN_FAIL; 404 } 405 s->s3->alpn_sent = 1; 406 407 return EXT_RETURN_SENT; 408} 409 410 411#ifndef OPENSSL_NO_SRTP 412EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, 413 unsigned int context, X509 *x, 414 size_t chainidx) 415{ 416 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s); 417 int i, end; 418 419 if (clnt == NULL) 420 return EXT_RETURN_NOT_SENT; 421 422 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) 423 /* Sub-packet for SRTP extension */ 424 || !WPACKET_start_sub_packet_u16(pkt) 425 /* Sub-packet for the protection profile list */ 426 || !WPACKET_start_sub_packet_u16(pkt)) { 427 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 428 ERR_R_INTERNAL_ERROR); 429 return EXT_RETURN_FAIL; 430 } 431 432 end = sk_SRTP_PROTECTION_PROFILE_num(clnt); 433 for (i = 0; i < end; i++) { 434 const SRTP_PROTECTION_PROFILE *prof = 435 sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 436 437 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) { 438 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 439 SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR); 440 return EXT_RETURN_FAIL; 441 } 442 } 443 if (!WPACKET_close(pkt) 444 /* Add an empty use_mki value */ 445 || !WPACKET_put_bytes_u8(pkt, 0) 446 || !WPACKET_close(pkt)) { 447 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, 448 ERR_R_INTERNAL_ERROR); 449 return EXT_RETURN_FAIL; 450 } 451 452 return EXT_RETURN_SENT; 453} 454#endif 455 456EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, 457 X509 *x, size_t chainidx) 458{ 459 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 460 return EXT_RETURN_NOT_SENT; 461 462 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) 463 || !WPACKET_put_bytes_u16(pkt, 0)) { 464 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM, 465 ERR_R_INTERNAL_ERROR); 466 return EXT_RETURN_FAIL; 467 } 468 469 return EXT_RETURN_SENT; 470} 471 472#ifndef OPENSSL_NO_CT 473EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, 474 X509 *x, size_t chainidx) 475{ 476 if (s->ct_validation_callback == NULL) 477 return EXT_RETURN_NOT_SENT; 478 479 /* Not defined for client Certificates */ 480 if (x != NULL) 481 return EXT_RETURN_NOT_SENT; 482 483 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp) 484 || !WPACKET_put_bytes_u16(pkt, 0)) { 485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT, 486 ERR_R_INTERNAL_ERROR); 487 return EXT_RETURN_FAIL; 488 } 489 490 return EXT_RETURN_SENT; 491} 492#endif 493 494EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, 495 X509 *x, size_t chainidx) 496{ 497 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) 498 || !WPACKET_put_bytes_u16(pkt, 0)) { 499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS, 500 ERR_R_INTERNAL_ERROR); 501 return EXT_RETURN_FAIL; 502 } 503 504 return EXT_RETURN_SENT; 505} 506 507EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, 508 unsigned int context, X509 *x, 509 size_t chainidx) 510{ 511 int currv, min_version, max_version, reason; 512 513 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL); 514 if (reason != 0) { 515 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 516 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason); 517 return EXT_RETURN_FAIL; 518 } 519 520 /* 521 * Don't include this if we can't negotiate TLSv1.3. We can do a straight 522 * comparison here because we will never be called in DTLS. 523 */ 524 if (max_version < TLS1_3_VERSION) 525 return EXT_RETURN_NOT_SENT; 526 527 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions) 528 || !WPACKET_start_sub_packet_u16(pkt) 529 || !WPACKET_start_sub_packet_u8(pkt)) { 530 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 531 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 532 ERR_R_INTERNAL_ERROR); 533 return EXT_RETURN_FAIL; 534 } 535 536 for (currv = max_version; currv >= min_version; currv--) { 537 if (!WPACKET_put_bytes_u16(pkt, currv)) { 538 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 539 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 540 ERR_R_INTERNAL_ERROR); 541 return EXT_RETURN_FAIL; 542 } 543 } 544 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 545 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 546 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, 547 ERR_R_INTERNAL_ERROR); 548 return EXT_RETURN_FAIL; 549 } 550 551 return EXT_RETURN_SENT; 552} 553 554/* 555 * Construct a psk_kex_modes extension. 556 */ 557EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, 558 unsigned int context, X509 *x, 559 size_t chainidx) 560{ 561#ifndef OPENSSL_NO_TLS1_3 562 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX; 563 564 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes) 565 || !WPACKET_start_sub_packet_u16(pkt) 566 || !WPACKET_start_sub_packet_u8(pkt) 567 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE) 568 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE)) 569 || !WPACKET_close(pkt) 570 || !WPACKET_close(pkt)) { 571 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 572 SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR); 573 return EXT_RETURN_FAIL; 574 } 575 576 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE; 577 if (nodhe) 578 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; 579#endif 580 581 return EXT_RETURN_SENT; 582} 583 584#ifndef OPENSSL_NO_TLS1_3 585static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id) 586{ 587 unsigned char *encoded_point = NULL; 588 EVP_PKEY *key_share_key = NULL; 589 size_t encodedlen; 590 591 if (s->s3->tmp.pkey != NULL) { 592 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) { 593 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 594 ERR_R_INTERNAL_ERROR); 595 return 0; 596 } 597 /* 598 * Could happen if we got an HRR that wasn't requesting a new key_share 599 */ 600 key_share_key = s->s3->tmp.pkey; 601 } else { 602 key_share_key = ssl_generate_pkey_group(s, curve_id); 603 if (key_share_key == NULL) { 604 /* SSLfatal() already called */ 605 return 0; 606 } 607 } 608 609 /* Encode the public key. */ 610 encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key, 611 &encoded_point); 612 if (encodedlen == 0) { 613 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB); 614 goto err; 615 } 616 617 /* Create KeyShareEntry */ 618 if (!WPACKET_put_bytes_u16(pkt, curve_id) 619 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) { 620 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, 621 ERR_R_INTERNAL_ERROR); 622 goto err; 623 } 624 625 /* 626 * TODO(TLS1.3): When changing to send more than one key_share we're 627 * going to need to be able to save more than one EVP_PKEY. For now 628 * we reuse the existing tmp.pkey 629 */ 630 s->s3->tmp.pkey = key_share_key; 631 s->s3->group_id = curve_id; 632 OPENSSL_free(encoded_point); 633 634 return 1; 635 err: 636 if (s->s3->tmp.pkey == NULL) 637 EVP_PKEY_free(key_share_key); 638 OPENSSL_free(encoded_point); 639 return 0; 640} 641#endif 642 643EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, 644 unsigned int context, X509 *x, 645 size_t chainidx) 646{ 647#ifndef OPENSSL_NO_TLS1_3 648 size_t i, num_groups = 0; 649 const uint16_t *pgroups = NULL; 650 uint16_t curve_id = 0; 651 652 /* key_share extension */ 653 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) 654 /* Extension data sub-packet */ 655 || !WPACKET_start_sub_packet_u16(pkt) 656 /* KeyShare list sub-packet */ 657 || !WPACKET_start_sub_packet_u16(pkt)) { 658 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 659 ERR_R_INTERNAL_ERROR); 660 return EXT_RETURN_FAIL; 661 } 662 663 tls1_get_supported_groups(s, &pgroups, &num_groups); 664 665 /* 666 * TODO(TLS1.3): Make the number of key_shares sent configurable. For 667 * now, just send one 668 */ 669 if (s->s3->group_id != 0) { 670 curve_id = s->s3->group_id; 671 } else { 672 for (i = 0; i < num_groups; i++) { 673 674 if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED)) 675 continue; 676 677 curve_id = pgroups[i]; 678 break; 679 } 680 } 681 682 if (curve_id == 0) { 683 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 684 SSL_R_NO_SUITABLE_KEY_SHARE); 685 return EXT_RETURN_FAIL; 686 } 687 688 if (!add_key_share(s, pkt, curve_id)) { 689 /* SSLfatal() already called */ 690 return EXT_RETURN_FAIL; 691 } 692 693 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { 694 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, 695 ERR_R_INTERNAL_ERROR); 696 return EXT_RETURN_FAIL; 697 } 698 return EXT_RETURN_SENT; 699#else 700 return EXT_RETURN_NOT_SENT; 701#endif 702} 703 704EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context, 705 X509 *x, size_t chainidx) 706{ 707 EXT_RETURN ret = EXT_RETURN_FAIL; 708 709 /* Should only be set if we've had an HRR */ 710 if (s->ext.tls13_cookie_len == 0) 711 return EXT_RETURN_NOT_SENT; 712 713 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie) 714 /* Extension data sub-packet */ 715 || !WPACKET_start_sub_packet_u16(pkt) 716 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie, 717 s->ext.tls13_cookie_len) 718 || !WPACKET_close(pkt)) { 719 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE, 720 ERR_R_INTERNAL_ERROR); 721 goto end; 722 } 723 724 ret = EXT_RETURN_SENT; 725 end: 726 OPENSSL_free(s->ext.tls13_cookie); 727 s->ext.tls13_cookie = NULL; 728 s->ext.tls13_cookie_len = 0; 729 730 return ret; 731} 732 733EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt, 734 unsigned int context, X509 *x, 735 size_t chainidx) 736{ 737#ifndef OPENSSL_NO_PSK 738 char identity[PSK_MAX_IDENTITY_LEN + 1]; 739#endif /* OPENSSL_NO_PSK */ 740 const unsigned char *id = NULL; 741 size_t idlen = 0; 742 SSL_SESSION *psksess = NULL; 743 SSL_SESSION *edsess = NULL; 744 const EVP_MD *handmd = NULL; 745 746 if (s->hello_retry_request == SSL_HRR_PENDING) 747 handmd = ssl_handshake_md(s); 748 749 if (s->psk_use_session_cb != NULL 750 && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess) 751 || (psksess != NULL 752 && psksess->ssl_version != TLS1_3_VERSION))) { 753 SSL_SESSION_free(psksess); 754 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 755 SSL_R_BAD_PSK); 756 return EXT_RETURN_FAIL; 757 } 758 759#ifndef OPENSSL_NO_PSK 760 if (psksess == NULL && s->psk_client_callback != NULL) { 761 unsigned char psk[PSK_MAX_PSK_LEN]; 762 size_t psklen = 0; 763 764 memset(identity, 0, sizeof(identity)); 765 psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1, 766 psk, sizeof(psk)); 767 768 if (psklen > PSK_MAX_PSK_LEN) { 769 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 770 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 771 return EXT_RETURN_FAIL; 772 } else if (psklen > 0) { 773 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 }; 774 const SSL_CIPHER *cipher; 775 776 idlen = strlen(identity); 777 if (idlen > PSK_MAX_IDENTITY_LEN) { 778 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 779 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 780 ERR_R_INTERNAL_ERROR); 781 return EXT_RETURN_FAIL; 782 } 783 id = (unsigned char *)identity; 784 785 /* 786 * We found a PSK using an old style callback. We don't know 787 * the digest so we default to SHA256 as per the TLSv1.3 spec 788 */ 789 cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id); 790 if (cipher == NULL) { 791 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 792 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 793 ERR_R_INTERNAL_ERROR); 794 return EXT_RETURN_FAIL; 795 } 796 797 psksess = SSL_SESSION_new(); 798 if (psksess == NULL 799 || !SSL_SESSION_set1_master_key(psksess, psk, psklen) 800 || !SSL_SESSION_set_cipher(psksess, cipher) 801 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) { 802 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 803 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 804 ERR_R_INTERNAL_ERROR); 805 OPENSSL_cleanse(psk, psklen); 806 return EXT_RETURN_FAIL; 807 } 808 OPENSSL_cleanse(psk, psklen); 809 } 810 } 811#endif /* OPENSSL_NO_PSK */ 812 813 SSL_SESSION_free(s->psksession); 814 s->psksession = psksess; 815 if (psksess != NULL) { 816 OPENSSL_free(s->psksession_id); 817 s->psksession_id = OPENSSL_memdup(id, idlen); 818 if (s->psksession_id == NULL) { 819 s->psksession_id_len = 0; 820 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 821 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 822 return EXT_RETURN_FAIL; 823 } 824 s->psksession_id_len = idlen; 825 } 826 827 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING 828 || (s->session->ext.max_early_data == 0 829 && (psksess == NULL || psksess->ext.max_early_data == 0))) { 830 s->max_early_data = 0; 831 return EXT_RETURN_NOT_SENT; 832 } 833 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess; 834 s->max_early_data = edsess->ext.max_early_data; 835 836 if (edsess->ext.hostname != NULL) { 837 if (s->ext.hostname == NULL 838 || (s->ext.hostname != NULL 839 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) { 840 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 841 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 842 SSL_R_INCONSISTENT_EARLY_DATA_SNI); 843 return EXT_RETURN_FAIL; 844 } 845 } 846 847 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) { 848 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 849 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 850 return EXT_RETURN_FAIL; 851 } 852 853 /* 854 * Verify that we are offering an ALPN protocol consistent with the early 855 * data. 856 */ 857 if (edsess->ext.alpn_selected != NULL) { 858 PACKET prots, alpnpkt; 859 int found = 0; 860 861 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) { 862 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 863 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR); 864 return EXT_RETURN_FAIL; 865 } 866 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) { 867 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected, 868 edsess->ext.alpn_selected_len)) { 869 found = 1; 870 break; 871 } 872 } 873 if (!found) { 874 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 875 SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 876 SSL_R_INCONSISTENT_EARLY_DATA_ALPN); 877 return EXT_RETURN_FAIL; 878 } 879 } 880 881 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) 882 || !WPACKET_start_sub_packet_u16(pkt) 883 || !WPACKET_close(pkt)) { 884 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, 885 ERR_R_INTERNAL_ERROR); 886 return EXT_RETURN_FAIL; 887 } 888 889 /* 890 * We set this to rejected here. Later, if the server acknowledges the 891 * extension, we set it to accepted. 892 */ 893 s->ext.early_data = SSL_EARLY_DATA_REJECTED; 894 s->ext.early_data_ok = 1; 895 896 return EXT_RETURN_SENT; 897} 898 899#define F5_WORKAROUND_MIN_MSG_LEN 0xff 900#define F5_WORKAROUND_MAX_MSG_LEN 0x200 901 902/* 903 * PSK pre binder overhead = 904 * 2 bytes for TLSEXT_TYPE_psk 905 * 2 bytes for extension length 906 * 2 bytes for identities list length 907 * 2 bytes for identity length 908 * 4 bytes for obfuscated_ticket_age 909 * 2 bytes for binder list length 910 * 1 byte for binder length 911 * The above excludes the number of bytes for the identity itself and the 912 * subsequent binder bytes 913 */ 914#define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1) 915 916EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt, 917 unsigned int context, X509 *x, 918 size_t chainidx) 919{ 920 unsigned char *padbytes; 921 size_t hlen; 922 923 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0) 924 return EXT_RETURN_NOT_SENT; 925 926 /* 927 * Add padding to workaround bugs in F5 terminators. See RFC7685. 928 * This code calculates the length of all extensions added so far but 929 * excludes the PSK extension (because that MUST be written last). Therefore 930 * this extension MUST always appear second to last. 931 */ 932 if (!WPACKET_get_total_written(pkt, &hlen)) { 933 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 934 ERR_R_INTERNAL_ERROR); 935 return EXT_RETURN_FAIL; 936 } 937 938 /* 939 * If we're going to send a PSK then that will be written out after this 940 * extension, so we need to calculate how long it is going to be. 941 */ 942 if (s->session->ssl_version == TLS1_3_VERSION 943 && s->session->ext.ticklen != 0 944 && s->session->cipher != NULL) { 945 const EVP_MD *md = ssl_md(s->session->cipher->algorithm2); 946 947 if (md != NULL) { 948 /* 949 * Add the fixed PSK overhead, the identity length and the binder 950 * length. 951 */ 952 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen 953 + EVP_MD_size(md); 954 } 955 } 956 957 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) { 958 /* Calculate the amount of padding we need to add */ 959 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen; 960 961 /* 962 * Take off the size of extension header itself (2 bytes for type and 963 * 2 bytes for length bytes), but ensure that the extension is at least 964 * 1 byte long so as not to have an empty extension last (WebSphere 7.x, 965 * 8.x are intolerant of that condition) 966 */ 967 if (hlen > 4) 968 hlen -= 4; 969 else 970 hlen = 1; 971 972 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding) 973 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) { 974 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PADDING, 975 ERR_R_INTERNAL_ERROR); 976 return EXT_RETURN_FAIL; 977 } 978 memset(padbytes, 0, hlen); 979 } 980 981 return EXT_RETURN_SENT; 982} 983 984/* 985 * Construct the pre_shared_key extension 986 */ 987EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, 988 X509 *x, size_t chainidx) 989{ 990#ifndef OPENSSL_NO_TLS1_3 991 uint32_t now, agesec, agems = 0; 992 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen; 993 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL; 994 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL; 995 int dores = 0; 996 997 s->ext.tick_identity = 0; 998 999 /* 1000 * Note: At this stage of the code we only support adding a single 1001 * resumption PSK. If we add support for multiple PSKs then the length 1002 * calculations in the padding extension will need to be adjusted. 1003 */ 1004 1005 /* 1006 * If this is an incompatible or new session then we have nothing to resume 1007 * so don't add this extension. 1008 */ 1009 if (s->session->ssl_version != TLS1_3_VERSION 1010 || (s->session->ext.ticklen == 0 && s->psksession == NULL)) 1011 return EXT_RETURN_NOT_SENT; 1012 1013 if (s->hello_retry_request == SSL_HRR_PENDING) 1014 handmd = ssl_handshake_md(s); 1015 1016 if (s->session->ext.ticklen != 0) { 1017 /* Get the digest associated with the ciphersuite in the session */ 1018 if (s->session->cipher == NULL) { 1019 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1020 ERR_R_INTERNAL_ERROR); 1021 return EXT_RETURN_FAIL; 1022 } 1023 mdres = ssl_md(s->session->cipher->algorithm2); 1024 if (mdres == NULL) { 1025 /* 1026 * Don't recognize this cipher so we can't use the session. 1027 * Ignore it 1028 */ 1029 goto dopsksess; 1030 } 1031 1032 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) { 1033 /* 1034 * Selected ciphersuite hash does not match the hash for the session 1035 * so we can't use it. 1036 */ 1037 goto dopsksess; 1038 } 1039 1040 /* 1041 * Technically the C standard just says time() returns a time_t and says 1042 * nothing about the encoding of that type. In practice most 1043 * implementations follow POSIX which holds it as an integral type in 1044 * seconds since epoch. We've already made the assumption that we can do 1045 * this in multiple places in the code, so portability shouldn't be an 1046 * issue. 1047 */ 1048 now = (uint32_t)time(NULL); 1049 agesec = now - (uint32_t)s->session->time; 1050 /* 1051 * We calculate the age in seconds but the server may work in ms. Due to 1052 * rounding errors we could overestimate the age by up to 1s. It is 1053 * better to underestimate it. Otherwise, if the RTT is very short, when 1054 * the server calculates the age reported by the client it could be 1055 * bigger than the age calculated on the server - which should never 1056 * happen. 1057 */ 1058 if (agesec > 0) 1059 agesec--; 1060 1061 if (s->session->ext.tick_lifetime_hint < agesec) { 1062 /* Ticket is too old. Ignore it. */ 1063 goto dopsksess; 1064 } 1065 1066 /* 1067 * Calculate age in ms. We're just doing it to nearest second. Should be 1068 * good enough. 1069 */ 1070 agems = agesec * (uint32_t)1000; 1071 1072 if (agesec != 0 && agems / (uint32_t)1000 != agesec) { 1073 /* 1074 * Overflow. Shouldn't happen unless this is a *really* old session. 1075 * If so we just ignore it. 1076 */ 1077 goto dopsksess; 1078 } 1079 1080 /* 1081 * Obfuscate the age. Overflow here is fine, this addition is supposed 1082 * to be mod 2^32. 1083 */ 1084 agems += s->session->ext.tick_age_add; 1085 1086 reshashsize = EVP_MD_size(mdres); 1087 s->ext.tick_identity++; 1088 dores = 1; 1089 } 1090 1091 dopsksess: 1092 if (!dores && s->psksession == NULL) 1093 return EXT_RETURN_NOT_SENT; 1094 1095 if (s->psksession != NULL) { 1096 mdpsk = ssl_md(s->psksession->cipher->algorithm2); 1097 if (mdpsk == NULL) { 1098 /* 1099 * Don't recognize this cipher so we can't use the session. 1100 * If this happens it's an application bug. 1101 */ 1102 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1103 SSL_R_BAD_PSK); 1104 return EXT_RETURN_FAIL; 1105 } 1106 1107 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) { 1108 /* 1109 * Selected ciphersuite hash does not match the hash for the PSK 1110 * session. This is an application bug. 1111 */ 1112 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1113 SSL_R_BAD_PSK); 1114 return EXT_RETURN_FAIL; 1115 } 1116 1117 pskhashsize = EVP_MD_size(mdpsk); 1118 } 1119 1120 /* Create the extension, but skip over the binder for now */ 1121 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) 1122 || !WPACKET_start_sub_packet_u16(pkt) 1123 || !WPACKET_start_sub_packet_u16(pkt)) { 1124 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1125 ERR_R_INTERNAL_ERROR); 1126 return EXT_RETURN_FAIL; 1127 } 1128 1129 if (dores) { 1130 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, 1131 s->session->ext.ticklen) 1132 || !WPACKET_put_bytes_u32(pkt, agems)) { 1133 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1134 ERR_R_INTERNAL_ERROR); 1135 return EXT_RETURN_FAIL; 1136 } 1137 } 1138 1139 if (s->psksession != NULL) { 1140 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id, 1141 s->psksession_id_len) 1142 || !WPACKET_put_bytes_u32(pkt, 0)) { 1143 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1144 ERR_R_INTERNAL_ERROR); 1145 return EXT_RETURN_FAIL; 1146 } 1147 s->ext.tick_identity++; 1148 } 1149 1150 if (!WPACKET_close(pkt) 1151 || !WPACKET_get_total_written(pkt, &binderoffset) 1152 || !WPACKET_start_sub_packet_u16(pkt) 1153 || (dores 1154 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder)) 1155 || (s->psksession != NULL 1156 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder)) 1157 || !WPACKET_close(pkt) 1158 || !WPACKET_close(pkt) 1159 || !WPACKET_get_total_written(pkt, &msglen) 1160 /* 1161 * We need to fill in all the sub-packet lengths now so we can 1162 * calculate the HMAC of the message up to the binders 1163 */ 1164 || !WPACKET_fill_lengths(pkt)) { 1165 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_PSK, 1166 ERR_R_INTERNAL_ERROR); 1167 return EXT_RETURN_FAIL; 1168 } 1169 1170 msgstart = WPACKET_get_curr(pkt) - msglen; 1171 1172 if (dores 1173 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL, 1174 resbinder, s->session, 1, 0) != 1) { 1175 /* SSLfatal() already called */ 1176 return EXT_RETURN_FAIL; 1177 } 1178 1179 if (s->psksession != NULL 1180 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL, 1181 pskbinder, s->psksession, 1, 1) != 1) { 1182 /* SSLfatal() already called */ 1183 return EXT_RETURN_FAIL; 1184 } 1185 1186 return EXT_RETURN_SENT; 1187#else 1188 return EXT_RETURN_NOT_SENT; 1189#endif 1190} 1191 1192EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, 1193 unsigned int context, 1194 X509 *x, size_t chainidx) 1195{ 1196#ifndef OPENSSL_NO_TLS1_3 1197 if (!s->pha_enabled) 1198 return EXT_RETURN_NOT_SENT; 1199 1200 /* construct extension - 0 length, no contents */ 1201 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth) 1202 || !WPACKET_start_sub_packet_u16(pkt) 1203 || !WPACKET_close(pkt)) { 1204 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1205 SSL_F_TLS_CONSTRUCT_CTOS_POST_HANDSHAKE_AUTH, 1206 ERR_R_INTERNAL_ERROR); 1207 return EXT_RETURN_FAIL; 1208 } 1209 1210 s->post_handshake_auth = SSL_PHA_EXT_SENT; 1211 1212 return EXT_RETURN_SENT; 1213#else 1214 return EXT_RETURN_NOT_SENT; 1215#endif 1216} 1217 1218 1219/* 1220 * Parse the server's renegotiation binding and abort if it's not right 1221 */ 1222int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context, 1223 X509 *x, size_t chainidx) 1224{ 1225 size_t expected_len = s->s3->previous_client_finished_len 1226 + s->s3->previous_server_finished_len; 1227 size_t ilen; 1228 const unsigned char *data; 1229 1230 /* Check for logic errors */ 1231 if (!ossl_assert(expected_len == 0 1232 || s->s3->previous_client_finished_len != 0) 1233 || !ossl_assert(expected_len == 0 1234 || s->s3->previous_server_finished_len != 0)) { 1235 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1236 ERR_R_INTERNAL_ERROR); 1237 return 0; 1238 } 1239 1240 /* Parse the length byte */ 1241 if (!PACKET_get_1_len(pkt, &ilen)) { 1242 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1243 SSL_R_RENEGOTIATION_ENCODING_ERR); 1244 return 0; 1245 } 1246 1247 /* Consistency check */ 1248 if (PACKET_remaining(pkt) != ilen) { 1249 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1250 SSL_R_RENEGOTIATION_ENCODING_ERR); 1251 return 0; 1252 } 1253 1254 /* Check that the extension matches */ 1255 if (ilen != expected_len) { 1256 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1257 SSL_R_RENEGOTIATION_MISMATCH); 1258 return 0; 1259 } 1260 1261 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len) 1262 || memcmp(data, s->s3->previous_client_finished, 1263 s->s3->previous_client_finished_len) != 0) { 1264 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1265 SSL_R_RENEGOTIATION_MISMATCH); 1266 return 0; 1267 } 1268 1269 if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len) 1270 || memcmp(data, s->s3->previous_server_finished, 1271 s->s3->previous_server_finished_len) != 0) { 1272 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_RENEGOTIATE, 1273 SSL_R_RENEGOTIATION_MISMATCH); 1274 return 0; 1275 } 1276 s->s3->send_connection_binding = 1; 1277 1278 return 1; 1279} 1280 1281/* Parse the server's max fragment len extension packet */ 1282int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context, 1283 X509 *x, size_t chainidx) 1284{ 1285 unsigned int value; 1286 1287 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) { 1288 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1289 SSL_R_BAD_EXTENSION); 1290 return 0; 1291 } 1292 1293 /* |value| should contains a valid max-fragment-length code. */ 1294 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) { 1295 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1296 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1297 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1298 return 0; 1299 } 1300 1301 /* Must be the same value as client-configured one who was sent to server */ 1302 /*- 1303 * RFC 6066: if a client receives a maximum fragment length negotiation 1304 * response that differs from the length it requested, ... 1305 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert 1306 */ 1307 if (value != s->ext.max_fragment_len_mode) { 1308 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1309 SSL_F_TLS_PARSE_STOC_MAXFRAGMENTLEN, 1310 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH); 1311 return 0; 1312 } 1313 1314 /* 1315 * Maximum Fragment Length Negotiation succeeded. 1316 * The negotiated Maximum Fragment Length is binding now. 1317 */ 1318 s->session->ext.max_fragment_len_mode = value; 1319 1320 return 1; 1321} 1322 1323int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context, 1324 X509 *x, size_t chainidx) 1325{ 1326 if (s->ext.hostname == NULL) { 1327 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1328 ERR_R_INTERNAL_ERROR); 1329 return 0; 1330 } 1331 1332 if (PACKET_remaining(pkt) > 0) { 1333 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1334 SSL_R_BAD_EXTENSION); 1335 return 0; 1336 } 1337 1338 if (!s->hit) { 1339 if (s->session->ext.hostname != NULL) { 1340 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1341 ERR_R_INTERNAL_ERROR); 1342 return 0; 1343 } 1344 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname); 1345 if (s->session->ext.hostname == NULL) { 1346 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SERVER_NAME, 1347 ERR_R_INTERNAL_ERROR); 1348 return 0; 1349 } 1350 } 1351 1352 return 1; 1353} 1354 1355#ifndef OPENSSL_NO_EC 1356int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, 1357 X509 *x, size_t chainidx) 1358{ 1359 size_t ecpointformats_len; 1360 PACKET ecptformatlist; 1361 1362 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) { 1363 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, 1364 SSL_R_BAD_EXTENSION); 1365 return 0; 1366 } 1367 if (!s->hit) { 1368 ecpointformats_len = PACKET_remaining(&ecptformatlist); 1369 if (ecpointformats_len == 0) { 1370 SSLfatal(s, SSL_AD_DECODE_ERROR, 1371 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, SSL_R_BAD_LENGTH); 1372 return 0; 1373 } 1374 1375 s->ext.peer_ecpointformats_len = 0; 1376 OPENSSL_free(s->ext.peer_ecpointformats); 1377 s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len); 1378 if (s->ext.peer_ecpointformats == NULL) { 1379 s->ext.peer_ecpointformats_len = 0; 1380 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1381 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1382 return 0; 1383 } 1384 1385 s->ext.peer_ecpointformats_len = ecpointformats_len; 1386 1387 if (!PACKET_copy_bytes(&ecptformatlist, 1388 s->ext.peer_ecpointformats, 1389 ecpointformats_len)) { 1390 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 1391 SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); 1392 return 0; 1393 } 1394 } 1395 1396 return 1; 1397} 1398#endif 1399 1400int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context, 1401 X509 *x, size_t chainidx) 1402{ 1403 if (s->ext.session_ticket_cb != NULL && 1404 !s->ext.session_ticket_cb(s, PACKET_data(pkt), 1405 PACKET_remaining(pkt), 1406 s->ext.session_ticket_cb_arg)) { 1407 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, 1408 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1409 return 0; 1410 } 1411 1412 if (!tls_use_ticket(s)) { 1413 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1414 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1415 return 0; 1416 } 1417 if (PACKET_remaining(pkt) > 0) { 1418 SSLfatal(s, SSL_AD_DECODE_ERROR, 1419 SSL_F_TLS_PARSE_STOC_SESSION_TICKET, SSL_R_BAD_EXTENSION); 1420 return 0; 1421 } 1422 1423 s->ext.ticket_expected = 1; 1424 1425 return 1; 1426} 1427 1428#ifndef OPENSSL_NO_OCSP 1429int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context, 1430 X509 *x, size_t chainidx) 1431{ 1432 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1433 /* We ignore this if the server sends a CertificateRequest */ 1434 /* TODO(TLS1.3): Add support for this */ 1435 return 1; 1436 } 1437 1438 /* 1439 * MUST only be sent if we've requested a status 1440 * request message. In TLS <= 1.2 it must also be empty. 1441 */ 1442 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) { 1443 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, 1444 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1445 return 0; 1446 } 1447 if (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0) { 1448 SSLfatal(s, SSL_AD_DECODE_ERROR, 1449 SSL_F_TLS_PARSE_STOC_STATUS_REQUEST, SSL_R_BAD_EXTENSION); 1450 return 0; 1451 } 1452 1453 if (SSL_IS_TLS13(s)) { 1454 /* We only know how to handle this if it's for the first Certificate in 1455 * the chain. We ignore any other responses. 1456 */ 1457 if (chainidx != 0) 1458 return 1; 1459 1460 /* SSLfatal() already called */ 1461 return tls_process_cert_status_body(s, pkt); 1462 } 1463 1464 /* Set flag to expect CertificateStatus message */ 1465 s->ext.status_expected = 1; 1466 1467 return 1; 1468} 1469#endif 1470 1471 1472#ifndef OPENSSL_NO_CT 1473int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1474 size_t chainidx) 1475{ 1476 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) { 1477 /* We ignore this if the server sends it in a CertificateRequest */ 1478 /* TODO(TLS1.3): Add support for this */ 1479 return 1; 1480 } 1481 1482 /* 1483 * Only take it if we asked for it - i.e if there is no CT validation 1484 * callback set, then a custom extension MAY be processing it, so we 1485 * need to let control continue to flow to that. 1486 */ 1487 if (s->ct_validation_callback != NULL) { 1488 size_t size = PACKET_remaining(pkt); 1489 1490 /* Simply copy it off for later processing */ 1491 OPENSSL_free(s->ext.scts); 1492 s->ext.scts = NULL; 1493 1494 s->ext.scts_len = (uint16_t)size; 1495 if (size > 0) { 1496 s->ext.scts = OPENSSL_malloc(size); 1497 if (s->ext.scts == NULL) { 1498 s->ext.scts_len = 0; 1499 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1500 ERR_R_MALLOC_FAILURE); 1501 return 0; 1502 } 1503 if (!PACKET_copy_bytes(pkt, s->ext.scts, size)) { 1504 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_SCT, 1505 ERR_R_INTERNAL_ERROR); 1506 return 0; 1507 } 1508 } 1509 } else { 1510 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0 1511 ? ENDPOINT_CLIENT : ENDPOINT_BOTH; 1512 1513 /* 1514 * If we didn't ask for it then there must be a custom extension, 1515 * otherwise this is unsolicited. 1516 */ 1517 if (custom_ext_find(&s->cert->custext, role, 1518 TLSEXT_TYPE_signed_certificate_timestamp, 1519 NULL) == NULL) { 1520 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_SCT, 1521 SSL_R_BAD_EXTENSION); 1522 return 0; 1523 } 1524 1525 if (!custom_ext_parse(s, context, 1526 TLSEXT_TYPE_signed_certificate_timestamp, 1527 PACKET_data(pkt), PACKET_remaining(pkt), 1528 x, chainidx)) { 1529 /* SSLfatal already called */ 1530 return 0; 1531 } 1532 } 1533 1534 return 1; 1535} 1536#endif 1537 1538 1539#ifndef OPENSSL_NO_NEXTPROTONEG 1540/* 1541 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1542 * elements of zero length are allowed and the set of elements must exactly 1543 * fill the length of the block. Returns 1 on success or 0 on failure. 1544 */ 1545static int ssl_next_proto_validate(SSL *s, PACKET *pkt) 1546{ 1547 PACKET tmp_protocol; 1548 1549 while (PACKET_remaining(pkt)) { 1550 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol) 1551 || PACKET_remaining(&tmp_protocol) == 0) { 1552 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_NEXT_PROTO_VALIDATE, 1553 SSL_R_BAD_EXTENSION); 1554 return 0; 1555 } 1556 } 1557 1558 return 1; 1559} 1560 1561int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1562 size_t chainidx) 1563{ 1564 unsigned char *selected; 1565 unsigned char selected_len; 1566 PACKET tmppkt; 1567 1568 /* Check if we are in a renegotiation. If so ignore this extension */ 1569 if (!SSL_IS_FIRST_HANDSHAKE(s)) 1570 return 1; 1571 1572 /* We must have requested it. */ 1573 if (s->ctx->ext.npn_select_cb == NULL) { 1574 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_NPN, 1575 SSL_R_BAD_EXTENSION); 1576 return 0; 1577 } 1578 1579 /* The data must be valid */ 1580 tmppkt = *pkt; 1581 if (!ssl_next_proto_validate(s, &tmppkt)) { 1582 /* SSLfatal() already called */ 1583 return 0; 1584 } 1585 if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len, 1586 PACKET_data(pkt), 1587 PACKET_remaining(pkt), 1588 s->ctx->ext.npn_select_cb_arg) != 1589 SSL_TLSEXT_ERR_OK) { 1590 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_STOC_NPN, 1591 SSL_R_BAD_EXTENSION); 1592 return 0; 1593 } 1594 1595 /* 1596 * Could be non-NULL if server has sent multiple NPN extensions in 1597 * a single Serverhello 1598 */ 1599 OPENSSL_free(s->ext.npn); 1600 s->ext.npn = OPENSSL_malloc(selected_len); 1601 if (s->ext.npn == NULL) { 1602 s->ext.npn_len = 0; 1603 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_NPN, 1604 ERR_R_INTERNAL_ERROR); 1605 return 0; 1606 } 1607 1608 memcpy(s->ext.npn, selected, selected_len); 1609 s->ext.npn_len = selected_len; 1610 s->s3->npn_seen = 1; 1611 1612 return 1; 1613} 1614#endif 1615 1616int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1617 size_t chainidx) 1618{ 1619 size_t len; 1620 1621 /* We must have requested it. */ 1622 if (!s->s3->alpn_sent) { 1623 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_F_TLS_PARSE_STOC_ALPN, 1624 SSL_R_BAD_EXTENSION); 1625 return 0; 1626 } 1627 /*- 1628 * The extension data consists of: 1629 * uint16 list_length 1630 * uint8 proto_length; 1631 * uint8 proto[proto_length]; 1632 */ 1633 if (!PACKET_get_net_2_len(pkt, &len) 1634 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len) 1635 || PACKET_remaining(pkt) != len) { 1636 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1637 SSL_R_BAD_EXTENSION); 1638 return 0; 1639 } 1640 OPENSSL_free(s->s3->alpn_selected); 1641 s->s3->alpn_selected = OPENSSL_malloc(len); 1642 if (s->s3->alpn_selected == NULL) { 1643 s->s3->alpn_selected_len = 0; 1644 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1645 ERR_R_INTERNAL_ERROR); 1646 return 0; 1647 } 1648 if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) { 1649 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1650 SSL_R_BAD_EXTENSION); 1651 return 0; 1652 } 1653 s->s3->alpn_selected_len = len; 1654 1655 if (s->session->ext.alpn_selected == NULL 1656 || s->session->ext.alpn_selected_len != len 1657 || memcmp(s->session->ext.alpn_selected, s->s3->alpn_selected, len) 1658 != 0) { 1659 /* ALPN not consistent with the old session so cannot use early_data */ 1660 s->ext.early_data_ok = 0; 1661 } 1662 if (!s->hit) { 1663 /* 1664 * This is a new session and so alpn_selected should have been 1665 * initialised to NULL. We should update it with the selected ALPN. 1666 */ 1667 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) { 1668 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1669 ERR_R_INTERNAL_ERROR); 1670 return 0; 1671 } 1672 s->session->ext.alpn_selected = 1673 OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len); 1674 if (s->session->ext.alpn_selected == NULL) { 1675 s->session->ext.alpn_selected_len = 0; 1676 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_ALPN, 1677 ERR_R_INTERNAL_ERROR); 1678 return 0; 1679 } 1680 s->session->ext.alpn_selected_len = s->s3->alpn_selected_len; 1681 } 1682 1683 return 1; 1684} 1685 1686#ifndef OPENSSL_NO_SRTP 1687int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1688 size_t chainidx) 1689{ 1690 unsigned int id, ct, mki; 1691 int i; 1692 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1693 SRTP_PROTECTION_PROFILE *prof; 1694 1695 if (!PACKET_get_net_2(pkt, &ct) || ct != 2 1696 || !PACKET_get_net_2(pkt, &id) 1697 || !PACKET_get_1(pkt, &mki) 1698 || PACKET_remaining(pkt) != 0) { 1699 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1700 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1701 return 0; 1702 } 1703 1704 if (mki != 0) { 1705 /* Must be no MKI, since we never offer one */ 1706 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1707 SSL_R_BAD_SRTP_MKI_VALUE); 1708 return 0; 1709 } 1710 1711 /* Throw an error if the server gave us an unsolicited extension */ 1712 clnt = SSL_get_srtp_profiles(s); 1713 if (clnt == NULL) { 1714 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1715 SSL_R_NO_SRTP_PROFILES); 1716 return 0; 1717 } 1718 1719 /* 1720 * Check to see if the server gave us something we support (and 1721 * presumably offered) 1722 */ 1723 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) { 1724 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i); 1725 1726 if (prof->id == id) { 1727 s->srtp_profile = prof; 1728 return 1; 1729 } 1730 } 1731 1732 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_USE_SRTP, 1733 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 1734 return 0; 1735} 1736#endif 1737 1738int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1739 size_t chainidx) 1740{ 1741 /* Ignore if inappropriate ciphersuite */ 1742 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC) 1743 && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD 1744 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4) 1745 s->ext.use_etm = 1; 1746 1747 return 1; 1748} 1749 1750int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1751 size_t chainidx) 1752{ 1753 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS; 1754 if (!s->hit) 1755 s->session->flags |= SSL_SESS_FLAG_EXTMS; 1756 1757 return 1; 1758} 1759 1760int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context, 1761 X509 *x, size_t chainidx) 1762{ 1763 unsigned int version; 1764 1765 if (!PACKET_get_net_2(pkt, &version) 1766 || PACKET_remaining(pkt) != 0) { 1767 SSLfatal(s, SSL_AD_DECODE_ERROR, 1768 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1769 SSL_R_LENGTH_MISMATCH); 1770 return 0; 1771 } 1772 1773 /* 1774 * The only protocol version we support which is valid in this extension in 1775 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else. 1776 */ 1777 if (version != TLS1_3_VERSION) { 1778 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1779 SSL_F_TLS_PARSE_STOC_SUPPORTED_VERSIONS, 1780 SSL_R_BAD_PROTOCOL_VERSION_NUMBER); 1781 return 0; 1782 } 1783 1784 /* We ignore this extension for HRRs except to sanity check it */ 1785 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) 1786 return 1; 1787 1788 /* We just set it here. We validate it in ssl_choose_client_version */ 1789 s->version = version; 1790 1791 return 1; 1792} 1793 1794int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1795 size_t chainidx) 1796{ 1797#ifndef OPENSSL_NO_TLS1_3 1798 unsigned int group_id; 1799 PACKET encoded_pt; 1800 EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL; 1801 1802 /* Sanity check */ 1803 if (ckey == NULL || s->s3->peer_tmp != NULL) { 1804 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1805 ERR_R_INTERNAL_ERROR); 1806 return 0; 1807 } 1808 1809 if (!PACKET_get_net_2(pkt, &group_id)) { 1810 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1811 SSL_R_LENGTH_MISMATCH); 1812 return 0; 1813 } 1814 1815 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) { 1816 const uint16_t *pgroups = NULL; 1817 size_t i, num_groups; 1818 1819 if (PACKET_remaining(pkt) != 0) { 1820 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1821 SSL_R_LENGTH_MISMATCH); 1822 return 0; 1823 } 1824 1825 /* 1826 * It is an error if the HelloRetryRequest wants a key_share that we 1827 * already sent in the first ClientHello 1828 */ 1829 if (group_id == s->s3->group_id) { 1830 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1831 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1832 return 0; 1833 } 1834 1835 /* Validate the selected group is one we support */ 1836 tls1_get_supported_groups(s, &pgroups, &num_groups); 1837 for (i = 0; i < num_groups; i++) { 1838 if (group_id == pgroups[i]) 1839 break; 1840 } 1841 if (i >= num_groups 1842 || !tls_curve_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) { 1843 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, 1844 SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE); 1845 return 0; 1846 } 1847 1848 s->s3->group_id = group_id; 1849 EVP_PKEY_free(s->s3->tmp.pkey); 1850 s->s3->tmp.pkey = NULL; 1851 return 1; 1852 } 1853 1854 if (group_id != s->s3->group_id) { 1855 /* 1856 * This isn't for the group that we sent in the original 1857 * key_share! 1858 */ 1859 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1860 SSL_R_BAD_KEY_SHARE); 1861 return 0; 1862 } 1863 1864 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt) 1865 || PACKET_remaining(&encoded_pt) == 0) { 1866 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1867 SSL_R_LENGTH_MISMATCH); 1868 return 0; 1869 } 1870 1871 skey = EVP_PKEY_new(); 1872 if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) { 1873 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1874 ERR_R_MALLOC_FAILURE); 1875 return 0; 1876 } 1877 if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), 1878 PACKET_remaining(&encoded_pt))) { 1879 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_KEY_SHARE, 1880 SSL_R_BAD_ECPOINT); 1881 EVP_PKEY_free(skey); 1882 return 0; 1883 } 1884 1885 if (ssl_derive(s, ckey, skey, 1) == 0) { 1886 /* SSLfatal() already called */ 1887 EVP_PKEY_free(skey); 1888 return 0; 1889 } 1890 s->s3->peer_tmp = skey; 1891#endif 1892 1893 return 1; 1894} 1895 1896int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1897 size_t chainidx) 1898{ 1899 PACKET cookie; 1900 1901 if (!PACKET_as_length_prefixed_2(pkt, &cookie) 1902 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie, 1903 &s->ext.tls13_cookie_len)) { 1904 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_COOKIE, 1905 SSL_R_LENGTH_MISMATCH); 1906 return 0; 1907 } 1908 1909 return 1; 1910} 1911 1912int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context, 1913 X509 *x, size_t chainidx) 1914{ 1915 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { 1916 unsigned long max_early_data; 1917 1918 if (!PACKET_get_net_4(pkt, &max_early_data) 1919 || PACKET_remaining(pkt) != 0) { 1920 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1921 SSL_R_INVALID_MAX_EARLY_DATA); 1922 return 0; 1923 } 1924 1925 s->session->ext.max_early_data = max_early_data; 1926 1927 return 1; 1928 } 1929 1930 if (PACKET_remaining(pkt) != 0) { 1931 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1932 SSL_R_BAD_EXTENSION); 1933 return 0; 1934 } 1935 1936 if (!s->ext.early_data_ok 1937 || !s->hit) { 1938 /* 1939 * If we get here then we didn't send early data, or we didn't resume 1940 * using the first identity, or the SNI/ALPN is not consistent so the 1941 * server should not be accepting it. 1942 */ 1943 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_EARLY_DATA, 1944 SSL_R_BAD_EXTENSION); 1945 return 0; 1946 } 1947 1948 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED; 1949 1950 return 1; 1951} 1952 1953int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, 1954 size_t chainidx) 1955{ 1956#ifndef OPENSSL_NO_TLS1_3 1957 unsigned int identity; 1958 1959 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) { 1960 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1961 SSL_R_LENGTH_MISMATCH); 1962 return 0; 1963 } 1964 1965 if (identity >= (unsigned int)s->ext.tick_identity) { 1966 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, 1967 SSL_R_BAD_PSK_IDENTITY); 1968 return 0; 1969 } 1970 1971 /* 1972 * Session resumption tickets are always sent before PSK tickets. If the 1973 * ticket index is 0 then it must be for a session resumption ticket if we 1974 * sent two tickets, or if we didn't send a PSK ticket. 1975 */ 1976 if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) { 1977 s->hit = 1; 1978 SSL_SESSION_free(s->psksession); 1979 s->psksession = NULL; 1980 return 1; 1981 } 1982 1983 if (s->psksession == NULL) { 1984 /* Should never happen */ 1985 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 1986 ERR_R_INTERNAL_ERROR); 1987 return 0; 1988 } 1989 1990 /* 1991 * If we used the external PSK for sending early_data then s->early_secret 1992 * is already set up, so don't overwrite it. Otherwise we copy the 1993 * early_secret across that we generated earlier. 1994 */ 1995 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY 1996 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) 1997 || s->session->ext.max_early_data > 0 1998 || s->psksession->ext.max_early_data == 0) 1999 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE); 2000 2001 SSL_SESSION_free(s->session); 2002 s->session = s->psksession; 2003 s->psksession = NULL; 2004 s->hit = 1; 2005 /* Early data is only allowed if we used the first ticket */ 2006 if (identity != 0) 2007 s->ext.early_data_ok = 0; 2008#endif 2009 2010 return 1; 2011} 2012