Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 2 | * All rights reserved. |
| 3 | * |
| 4 | * This package is an SSL implementation written |
| 5 | * by Eric Young (eay@cryptsoft.com). |
| 6 | * The implementation was written so as to conform with Netscapes SSL. |
| 7 | * |
| 8 | * This library is free for commercial and non-commercial use as long as |
| 9 | * the following conditions are aheared to. The following conditions |
| 10 | * apply to all code found in this distribution, be it the RC4, RSA, |
| 11 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| 12 | * included with this distribution is covered by the same copyright terms |
| 13 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| 14 | * |
| 15 | * Copyright remains Eric Young's, and as such any Copyright notices in |
| 16 | * the code are not to be removed. |
| 17 | * If this package is used in a product, Eric Young should be given attribution |
| 18 | * as the author of the parts of the library used. |
| 19 | * This can be in the form of a textual message at program startup or |
| 20 | * in documentation (online or textual) provided with the package. |
| 21 | * |
| 22 | * Redistribution and use in source and binary forms, with or without |
| 23 | * modification, are permitted provided that the following conditions |
| 24 | * are met: |
| 25 | * 1. Redistributions of source code must retain the copyright |
| 26 | * notice, this list of conditions and the following disclaimer. |
| 27 | * 2. Redistributions in binary form must reproduce the above copyright |
| 28 | * notice, this list of conditions and the following disclaimer in the |
| 29 | * documentation and/or other materials provided with the distribution. |
| 30 | * 3. All advertising materials mentioning features or use of this software |
| 31 | * must display the following acknowledgement: |
| 32 | * "This product includes cryptographic software written by |
| 33 | * Eric Young (eay@cryptsoft.com)" |
| 34 | * The word 'cryptographic' can be left out if the rouines from the library |
| 35 | * being used are not cryptographic related :-). |
| 36 | * 4. If you include any Windows specific code (or a derivative thereof) from |
| 37 | * the apps directory (application code) you must include an acknowledgement: |
| 38 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| 39 | * |
| 40 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| 41 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 42 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 43 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| 44 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 45 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 46 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 47 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 48 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 49 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 50 | * SUCH DAMAGE. |
| 51 | * |
| 52 | * The licence and distribution terms for any publically available version or |
| 53 | * derivative of this code cannot be changed. i.e. this code cannot simply be |
| 54 | * copied and put under another distribution licence |
| 55 | * [including the GNU Public Licence.] |
| 56 | */ |
| 57 | /* ==================================================================== |
| 58 | * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. |
| 59 | * |
| 60 | * Redistribution and use in source and binary forms, with or without |
| 61 | * modification, are permitted provided that the following conditions |
| 62 | * are met: |
| 63 | * |
| 64 | * 1. Redistributions of source code must retain the above copyright |
| 65 | * notice, this list of conditions and the following disclaimer. |
| 66 | * |
| 67 | * 2. Redistributions in binary form must reproduce the above copyright |
| 68 | * notice, this list of conditions and the following disclaimer in |
| 69 | * the documentation and/or other materials provided with the |
| 70 | * distribution. |
| 71 | * |
| 72 | * 3. All advertising materials mentioning features or use of this |
| 73 | * software must display the following acknowledgment: |
| 74 | * "This product includes software developed by the OpenSSL Project |
| 75 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
| 76 | * |
| 77 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| 78 | * endorse or promote products derived from this software without |
| 79 | * prior written permission. For written permission, please contact |
| 80 | * openssl-core@openssl.org. |
| 81 | * |
| 82 | * 5. Products derived from this software may not be called "OpenSSL" |
| 83 | * nor may "OpenSSL" appear in their names without prior written |
| 84 | * permission of the OpenSSL Project. |
| 85 | * |
| 86 | * 6. Redistributions of any form whatsoever must retain the following |
| 87 | * acknowledgment: |
| 88 | * "This product includes software developed by the OpenSSL Project |
| 89 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
| 90 | * |
| 91 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| 92 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 93 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| 94 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| 95 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 96 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 97 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 98 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 99 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| 100 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| 101 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| 102 | * OF THE POSSIBILITY OF SUCH DAMAGE. |
| 103 | * ==================================================================== |
| 104 | * |
| 105 | * This product includes cryptographic software written by Eric Young |
| 106 | * (eay@cryptsoft.com). This product includes software written by Tim |
| 107 | * Hudson (tjh@cryptsoft.com). */ |
| 108 | /* ==================================================================== |
| 109 | * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. |
| 110 | * ECC cipher suite support in OpenSSL originally developed by |
| 111 | * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. */ |
| 112 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 113 | #include <openssl/ssl.h> |
| 114 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 115 | #include <assert.h> |
| 116 | #include <limits.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 117 | #include <string.h> |
| 118 | |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 119 | #include <tuple> |
| 120 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 121 | #include <openssl/buf.h> |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 122 | #include <openssl/bytestring.h> |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 123 | #include <openssl/err.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 124 | #include <openssl/evp.h> |
| 125 | #include <openssl/mem.h> |
| 126 | #include <openssl/md5.h> |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 127 | #include <openssl/nid.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 128 | #include <openssl/rand.h> |
| 129 | #include <openssl/sha.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 130 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 131 | #include "../crypto/internal.h" |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 132 | #include "internal.h" |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 133 | |
| 134 | |
Robert Sloan | 726e9d1 | 2018-09-11 11:45:04 -0700 | [diff] [blame] | 135 | BSSL_NAMESPACE_BEGIN |
Robert Sloan | b6d070c | 2017-07-24 08:40:01 -0700 | [diff] [blame] | 136 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 137 | static bool add_record_to_flight(SSL *ssl, uint8_t type, |
| 138 | Span<const uint8_t> in) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 139 | // The caller should have flushed |pending_hs_data| first. |
| 140 | assert(!ssl->s3->pending_hs_data); |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 141 | // We'll never add a flight while in the process of writing it out. |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 142 | assert(ssl->s3->pending_flight_offset == 0); |
| 143 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 144 | if (ssl->s3->pending_flight == nullptr) { |
| 145 | ssl->s3->pending_flight.reset(BUF_MEM_new()); |
| 146 | if (ssl->s3->pending_flight == nullptr) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 147 | return false; |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 148 | } |
| 149 | } |
| 150 | |
Robert Sloan | ae1abf9 | 2017-10-05 12:50:08 -0700 | [diff] [blame] | 151 | size_t max_out = in.size() + SSL_max_seal_overhead(ssl); |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 152 | size_t new_cap = ssl->s3->pending_flight->length + max_out; |
Robert Sloan | ae1abf9 | 2017-10-05 12:50:08 -0700 | [diff] [blame] | 153 | if (max_out < in.size() || new_cap < max_out) { |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 154 | OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 155 | return false; |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 156 | } |
| 157 | |
| 158 | size_t len; |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 159 | if (!BUF_MEM_reserve(ssl->s3->pending_flight.get(), new_cap) || |
Robert Sloan | ae1abf9 | 2017-10-05 12:50:08 -0700 | [diff] [blame] | 160 | !tls_seal_record(ssl, |
| 161 | (uint8_t *)ssl->s3->pending_flight->data + |
| 162 | ssl->s3->pending_flight->length, |
| 163 | &len, max_out, type, in.data(), in.size())) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 164 | return false; |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 165 | } |
| 166 | |
| 167 | ssl->s3->pending_flight->length += len; |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 168 | return true; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 169 | } |
| 170 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 171 | bool ssl3_init_message(SSL *ssl, CBB *cbb, CBB *body, uint8_t type) { |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 172 | // Pick a modest size hint to save most of the |realloc| calls. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 173 | if (!CBB_init(cbb, 64) || |
| 174 | !CBB_add_u8(cbb, type) || |
| 175 | !CBB_add_u24_length_prefixed(cbb, body)) { |
| 176 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 177 | CBB_cleanup(cbb); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 178 | return false; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 179 | } |
| 180 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 181 | return true; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 182 | } |
| 183 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 184 | bool ssl3_finish_message(SSL *ssl, CBB *cbb, Array<uint8_t> *out_msg) { |
Robert Sloan | 4562e9d | 2017-10-02 10:26:51 -0700 | [diff] [blame] | 185 | return CBBFinishArray(cbb, out_msg); |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 186 | } |
| 187 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 188 | bool ssl3_add_message(SSL *ssl, Array<uint8_t> msg) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 189 | // Pack handshake data into the minimal number of records. This avoids |
| 190 | // unnecessary encryption overhead, notably in TLS 1.3 where we send several |
| 191 | // encrypted messages in a row. For now, we do not do this for the null |
| 192 | // cipher. The benefit is smaller and there is a risk of breaking buggy |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 193 | // implementations. |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 194 | // |
| 195 | // TODO(davidben): See if we can do this uniformly. |
Robert Sloan | ae1abf9 | 2017-10-05 12:50:08 -0700 | [diff] [blame] | 196 | Span<const uint8_t> rest = msg; |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 197 | if (ssl->quic_method == nullptr && |
| 198 | ssl->s3->aead_write_ctx->is_null_cipher()) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 199 | while (!rest.empty()) { |
| 200 | Span<const uint8_t> chunk = rest.subspan(0, ssl->max_send_fragment); |
| 201 | rest = rest.subspan(chunk.size()); |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 202 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 203 | if (!add_record_to_flight(ssl, SSL3_RT_HANDSHAKE, chunk)) { |
| 204 | return false; |
| 205 | } |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 206 | } |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 207 | } else { |
| 208 | while (!rest.empty()) { |
| 209 | // Flush if |pending_hs_data| is full. |
| 210 | if (ssl->s3->pending_hs_data && |
| 211 | ssl->s3->pending_hs_data->length >= ssl->max_send_fragment && |
| 212 | !tls_flush_pending_hs_data(ssl)) { |
| 213 | return false; |
| 214 | } |
| 215 | |
| 216 | size_t pending_len = |
| 217 | ssl->s3->pending_hs_data ? ssl->s3->pending_hs_data->length : 0; |
| 218 | Span<const uint8_t> chunk = |
| 219 | rest.subspan(0, ssl->max_send_fragment - pending_len); |
| 220 | assert(!chunk.empty()); |
| 221 | rest = rest.subspan(chunk.size()); |
| 222 | |
| 223 | if (!ssl->s3->pending_hs_data) { |
| 224 | ssl->s3->pending_hs_data.reset(BUF_MEM_new()); |
| 225 | } |
| 226 | if (!ssl->s3->pending_hs_data || |
| 227 | !BUF_MEM_append(ssl->s3->pending_hs_data.get(), chunk.data(), |
| 228 | chunk.size())) { |
| 229 | return false; |
| 230 | } |
| 231 | } |
| 232 | } |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 233 | |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 234 | ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HANDSHAKE, msg); |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 235 | // TODO(svaldez): Move this up a layer to fix abstraction for SSLTranscript on |
| 236 | // hs. |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 237 | if (ssl->s3->hs != NULL && |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 238 | !ssl->s3->hs->transcript.Update(msg)) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 239 | return false; |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 240 | } |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 241 | return true; |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 242 | } |
| 243 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 244 | bool tls_flush_pending_hs_data(SSL *ssl) { |
| 245 | if (!ssl->s3->pending_hs_data || ssl->s3->pending_hs_data->length == 0) { |
| 246 | return true; |
| 247 | } |
| 248 | |
| 249 | UniquePtr<BUF_MEM> pending_hs_data = std::move(ssl->s3->pending_hs_data); |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 250 | auto data = |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 251 | MakeConstSpan(reinterpret_cast<const uint8_t *>(pending_hs_data->data), |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 252 | pending_hs_data->length); |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 253 | if (ssl->quic_method) { |
| 254 | if (!ssl->quic_method->add_handshake_data(ssl, ssl->s3->write_level, |
| 255 | data.data(), data.size())) { |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 256 | OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR); |
| 257 | return false; |
| 258 | } |
| 259 | return true; |
| 260 | } |
| 261 | |
| 262 | return add_record_to_flight(ssl, SSL3_RT_HANDSHAKE, data); |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 263 | } |
| 264 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 265 | bool ssl3_add_change_cipher_spec(SSL *ssl) { |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 266 | static const uint8_t kChangeCipherSpec[1] = {SSL3_MT_CCS}; |
| 267 | |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 268 | if (!tls_flush_pending_hs_data(ssl)) { |
| 269 | return false; |
| 270 | } |
| 271 | |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 272 | if (!ssl->quic_method && |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 273 | !add_record_to_flight(ssl, SSL3_RT_CHANGE_CIPHER_SPEC, |
Robert Sloan | ae1abf9 | 2017-10-05 12:50:08 -0700 | [diff] [blame] | 274 | kChangeCipherSpec)) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 275 | return false; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 276 | } |
| 277 | |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 278 | ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_CHANGE_CIPHER_SPEC, |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 279 | kChangeCipherSpec); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 280 | return true; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 281 | } |
| 282 | |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 283 | int ssl3_flush_flight(SSL *ssl) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 284 | if (!tls_flush_pending_hs_data(ssl)) { |
| 285 | return -1; |
| 286 | } |
| 287 | |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 288 | if (ssl->quic_method) { |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 289 | if (ssl->s3->write_shutdown != ssl_shutdown_none) { |
| 290 | OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); |
| 291 | return -1; |
| 292 | } |
| 293 | |
Robert Sloan | 4c22c5f | 2019-03-01 15:53:37 -0800 | [diff] [blame] | 294 | if (!ssl->quic_method->flush_flight(ssl)) { |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 295 | OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR); |
| 296 | return -1; |
| 297 | } |
| 298 | } |
| 299 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 300 | if (ssl->s3->pending_flight == nullptr) { |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 301 | return 1; |
| 302 | } |
| 303 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 304 | if (ssl->s3->write_shutdown != ssl_shutdown_none) { |
| 305 | OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); |
| 306 | return -1; |
| 307 | } |
| 308 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 309 | static_assert(INT_MAX <= 0xffffffff, "int is larger than 32 bits"); |
| 310 | if (ssl->s3->pending_flight->length > INT_MAX) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 311 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 312 | return -1; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 313 | } |
| 314 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 315 | // If there is pending data in the write buffer, it must be flushed out before |
| 316 | // any new data in pending_flight. |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 317 | if (!ssl->s3->write_buffer.empty()) { |
Robert Sloan | e56da3e | 2017-06-26 08:26:42 -0700 | [diff] [blame] | 318 | int ret = ssl_write_buffer_flush(ssl); |
| 319 | if (ret <= 0) { |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 320 | ssl->s3->rwstate = SSL_WRITING; |
Robert Sloan | e56da3e | 2017-06-26 08:26:42 -0700 | [diff] [blame] | 321 | return ret; |
| 322 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 323 | } |
| 324 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 325 | // Write the pending flight. |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 326 | while (ssl->s3->pending_flight_offset < ssl->s3->pending_flight->length) { |
| 327 | int ret = BIO_write( |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 328 | ssl->wbio.get(), |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 329 | ssl->s3->pending_flight->data + ssl->s3->pending_flight_offset, |
| 330 | ssl->s3->pending_flight->length - ssl->s3->pending_flight_offset); |
| 331 | if (ret <= 0) { |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 332 | ssl->s3->rwstate = SSL_WRITING; |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 333 | return ret; |
| 334 | } |
| 335 | |
| 336 | ssl->s3->pending_flight_offset += ret; |
| 337 | } |
| 338 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 339 | if (BIO_flush(ssl->wbio.get()) <= 0) { |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 340 | ssl->s3->rwstate = SSL_WRITING; |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 341 | return -1; |
| 342 | } |
| 343 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 344 | ssl->s3->pending_flight.reset(); |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 345 | ssl->s3->pending_flight_offset = 0; |
David Benjamin | 6e899c7 | 2016-06-09 18:02:18 -0400 | [diff] [blame] | 346 | return 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 347 | } |
| 348 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 349 | static ssl_open_record_t read_v2_client_hello(SSL *ssl, size_t *out_consumed, |
| 350 | Span<const uint8_t> in) { |
| 351 | *out_consumed = 0; |
| 352 | assert(in.size() >= SSL3_RT_HEADER_LENGTH); |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 353 | // Determine the length of the V2ClientHello. |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 354 | size_t msg_length = ((in[0] & 0x7f) << 8) | in[1]; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 355 | if (msg_length > (1024 * 4)) { |
| 356 | OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 357 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 358 | } |
| 359 | if (msg_length < SSL3_RT_HEADER_LENGTH - 2) { |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 360 | // Reject lengths that are too short early. We have already read |
| 361 | // |SSL3_RT_HEADER_LENGTH| bytes, so we should not attempt to process an |
| 362 | // (invalid) V2ClientHello which would be shorter than that. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 363 | OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_LENGTH_MISMATCH); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 364 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 365 | } |
| 366 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 367 | // Ask for the remainder of the V2ClientHello. |
| 368 | if (in.size() < 2 + msg_length) { |
| 369 | *out_consumed = 2 + msg_length; |
| 370 | return ssl_open_record_partial; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 371 | } |
| 372 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 373 | CBS v2_client_hello = CBS(ssl->s3->read_buffer.span().subspan(2, msg_length)); |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 374 | // The V2ClientHello without the length is incorporated into the handshake |
| 375 | // hash. This is only ever called at the start of the handshake, so hs is |
| 376 | // guaranteed to be non-NULL. |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 377 | if (!ssl->s3->hs->transcript.Update(v2_client_hello)) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 378 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 379 | } |
| 380 | |
David Benjamin | 7c0d06c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 381 | ssl_do_msg_callback(ssl, 0 /* read */, 0 /* V2ClientHello */, |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 382 | v2_client_hello); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 383 | |
| 384 | uint8_t msg_type; |
| 385 | uint16_t version, cipher_spec_length, session_id_length, challenge_length; |
| 386 | CBS cipher_specs, session_id, challenge; |
| 387 | if (!CBS_get_u8(&v2_client_hello, &msg_type) || |
| 388 | !CBS_get_u16(&v2_client_hello, &version) || |
| 389 | !CBS_get_u16(&v2_client_hello, &cipher_spec_length) || |
| 390 | !CBS_get_u16(&v2_client_hello, &session_id_length) || |
| 391 | !CBS_get_u16(&v2_client_hello, &challenge_length) || |
| 392 | !CBS_get_bytes(&v2_client_hello, &cipher_specs, cipher_spec_length) || |
| 393 | !CBS_get_bytes(&v2_client_hello, &session_id, session_id_length) || |
| 394 | !CBS_get_bytes(&v2_client_hello, &challenge, challenge_length) || |
| 395 | CBS_len(&v2_client_hello) != 0) { |
| 396 | OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 397 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 398 | } |
| 399 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 400 | // msg_type has already been checked. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 401 | assert(msg_type == SSL2_MT_CLIENT_HELLO); |
| 402 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 403 | // The client_random is the V2ClientHello challenge. Truncate or left-pad with |
| 404 | // zeros as needed. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 405 | size_t rand_len = CBS_len(&challenge); |
| 406 | if (rand_len > SSL3_RANDOM_SIZE) { |
| 407 | rand_len = SSL3_RANDOM_SIZE; |
| 408 | } |
| 409 | uint8_t random[SSL3_RANDOM_SIZE]; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 410 | OPENSSL_memset(random, 0, SSL3_RANDOM_SIZE); |
| 411 | OPENSSL_memcpy(random + (SSL3_RANDOM_SIZE - rand_len), CBS_data(&challenge), |
| 412 | rand_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 413 | |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 414 | // Write out an equivalent TLS ClientHello directly to the handshake buffer. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 415 | size_t max_v3_client_hello = SSL3_HM_HEADER_LENGTH + 2 /* version */ + |
| 416 | SSL3_RANDOM_SIZE + 1 /* session ID length */ + |
| 417 | 2 /* cipher list length */ + |
| 418 | CBS_len(&cipher_specs) / 3 * 2 + |
| 419 | 1 /* compression length */ + 1 /* compression */; |
Robert Sloan | b6d070c | 2017-07-24 08:40:01 -0700 | [diff] [blame] | 420 | ScopedCBB client_hello; |
| 421 | CBB hello_body, cipher_suites; |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 422 | if (!ssl->s3->hs_buf) { |
| 423 | ssl->s3->hs_buf.reset(BUF_MEM_new()); |
| 424 | } |
| 425 | if (!ssl->s3->hs_buf || |
| 426 | !BUF_MEM_reserve(ssl->s3->hs_buf.get(), max_v3_client_hello) || |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 427 | !CBB_init_fixed(client_hello.get(), (uint8_t *)ssl->s3->hs_buf->data, |
| 428 | ssl->s3->hs_buf->max) || |
Robert Sloan | b6d070c | 2017-07-24 08:40:01 -0700 | [diff] [blame] | 429 | !CBB_add_u8(client_hello.get(), SSL3_MT_CLIENT_HELLO) || |
| 430 | !CBB_add_u24_length_prefixed(client_hello.get(), &hello_body) || |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 431 | !CBB_add_u16(&hello_body, version) || |
| 432 | !CBB_add_bytes(&hello_body, random, SSL3_RANDOM_SIZE) || |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 433 | // No session id. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 434 | !CBB_add_u8(&hello_body, 0) || |
| 435 | !CBB_add_u16_length_prefixed(&hello_body, &cipher_suites)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 436 | OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 437 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 438 | } |
| 439 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 440 | // Copy the cipher suites. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 441 | while (CBS_len(&cipher_specs) > 0) { |
| 442 | uint32_t cipher_spec; |
| 443 | if (!CBS_get_u24(&cipher_specs, &cipher_spec)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 444 | OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 445 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 446 | } |
| 447 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 448 | // Skip SSLv2 ciphers. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 449 | if ((cipher_spec & 0xff0000) != 0) { |
| 450 | continue; |
| 451 | } |
| 452 | if (!CBB_add_u16(&cipher_suites, cipher_spec)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 453 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 454 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 455 | } |
| 456 | } |
| 457 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 458 | // Add the null compression scheme and finish. |
Robert Sloan | b6d070c | 2017-07-24 08:40:01 -0700 | [diff] [blame] | 459 | if (!CBB_add_u8(&hello_body, 1) || |
| 460 | !CBB_add_u8(&hello_body, 0) || |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 461 | !CBB_finish(client_hello.get(), NULL, &ssl->s3->hs_buf->length)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 462 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 463 | return ssl_open_record_error; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 464 | } |
| 465 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 466 | *out_consumed = 2 + msg_length; |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 467 | ssl->s3->is_v2_hello = true; |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 468 | return ssl_open_record_success; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 469 | } |
| 470 | |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 471 | static bool parse_message(const SSL *ssl, SSLMessage *out, |
| 472 | size_t *out_bytes_needed) { |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 473 | if (!ssl->s3->hs_buf) { |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 474 | *out_bytes_needed = 4; |
| 475 | return false; |
| 476 | } |
| 477 | |
| 478 | CBS cbs; |
| 479 | uint32_t len; |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 480 | CBS_init(&cbs, reinterpret_cast<const uint8_t *>(ssl->s3->hs_buf->data), |
| 481 | ssl->s3->hs_buf->length); |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 482 | if (!CBS_get_u8(&cbs, &out->type) || |
| 483 | !CBS_get_u24(&cbs, &len)) { |
| 484 | *out_bytes_needed = 4; |
| 485 | return false; |
| 486 | } |
| 487 | |
| 488 | if (!CBS_get_bytes(&cbs, &out->body, len)) { |
| 489 | *out_bytes_needed = 4 + len; |
| 490 | return false; |
| 491 | } |
| 492 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 493 | CBS_init(&out->raw, reinterpret_cast<const uint8_t *>(ssl->s3->hs_buf->data), |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 494 | 4 + len); |
| 495 | out->is_v2_hello = ssl->s3->is_v2_hello; |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 496 | return true; |
| 497 | } |
| 498 | |
Robert Sloan | f63bd1f | 2019-04-16 09:26:20 -0700 | [diff] [blame] | 499 | bool ssl3_get_message(const SSL *ssl, SSLMessage *out) { |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 500 | size_t unused; |
| 501 | if (!parse_message(ssl, out, &unused)) { |
| 502 | return false; |
| 503 | } |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 504 | if (!ssl->s3->has_message) { |
| 505 | if (!out->is_v2_hello) { |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 506 | ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HANDSHAKE, out->raw); |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 507 | } |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 508 | ssl->s3->has_message = true; |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 509 | } |
| 510 | return true; |
| 511 | } |
| 512 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 513 | bool tls_can_accept_handshake_data(const SSL *ssl, uint8_t *out_alert) { |
| 514 | // If there is a complete message, the caller must have consumed it first. |
| 515 | SSLMessage msg; |
| 516 | size_t bytes_needed; |
| 517 | if (parse_message(ssl, &msg, &bytes_needed)) { |
| 518 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 519 | *out_alert = SSL_AD_INTERNAL_ERROR; |
| 520 | return false; |
| 521 | } |
| 522 | |
| 523 | // Enforce the limit so the peer cannot force us to buffer 16MB. |
| 524 | if (bytes_needed > 4 + ssl_max_handshake_message_len(ssl)) { |
| 525 | OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESSIVE_MESSAGE_SIZE); |
| 526 | *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| 527 | return false; |
| 528 | } |
| 529 | |
| 530 | return true; |
| 531 | } |
| 532 | |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 533 | bool tls_has_unprocessed_handshake_data(const SSL *ssl) { |
| 534 | size_t msg_len = 0; |
| 535 | if (ssl->s3->has_message) { |
| 536 | SSLMessage msg; |
| 537 | size_t unused; |
| 538 | if (parse_message(ssl, &msg, &unused)) { |
| 539 | msg_len = CBS_len(&msg.raw); |
| 540 | } |
| 541 | } |
| 542 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 543 | return ssl->s3->hs_buf && ssl->s3->hs_buf->length > msg_len; |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 544 | } |
| 545 | |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 546 | bool tls_append_handshake_data(SSL *ssl, Span<const uint8_t> data) { |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 547 | // Re-create the handshake buffer if needed. |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 548 | if (!ssl->s3->hs_buf) { |
| 549 | ssl->s3->hs_buf.reset(BUF_MEM_new()); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 550 | } |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 551 | return ssl->s3->hs_buf && |
| 552 | BUF_MEM_append(ssl->s3->hs_buf.get(), data.data(), data.size()); |
| 553 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 554 | |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 555 | ssl_open_record_t ssl3_open_handshake(SSL *ssl, size_t *out_consumed, |
| 556 | uint8_t *out_alert, Span<uint8_t> in) { |
| 557 | *out_consumed = 0; |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 558 | // Bypass the record layer for the first message to handle V2ClientHello. |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 559 | if (ssl->server && !ssl->s3->v2_hello_done) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 560 | // Ask for the first 5 bytes, the size of the TLS record header. This is |
| 561 | // sufficient to detect a V2ClientHello and ensures that we never read |
| 562 | // beyond the first record. |
| 563 | if (in.size() < SSL3_RT_HEADER_LENGTH) { |
| 564 | *out_consumed = SSL3_RT_HEADER_LENGTH; |
| 565 | return ssl_open_record_partial; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 566 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 567 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 568 | // Some dedicated error codes for protocol mixups should the application |
| 569 | // wish to interpret them differently. (These do not overlap with |
| 570 | // ClientHello or V2ClientHello.) |
| 571 | const char *str = reinterpret_cast<const char*>(in.data()); |
| 572 | if (strncmp("GET ", str, 4) == 0 || |
| 573 | strncmp("POST ", str, 5) == 0 || |
| 574 | strncmp("HEAD ", str, 5) == 0 || |
| 575 | strncmp("PUT ", str, 4) == 0) { |
| 576 | OPENSSL_PUT_ERROR(SSL, SSL_R_HTTP_REQUEST); |
| 577 | *out_alert = 0; |
| 578 | return ssl_open_record_error; |
| 579 | } |
| 580 | if (strncmp("CONNE", str, 5) == 0) { |
| 581 | OPENSSL_PUT_ERROR(SSL, SSL_R_HTTPS_PROXY_REQUEST); |
| 582 | *out_alert = 0; |
| 583 | return ssl_open_record_error; |
| 584 | } |
| 585 | |
| 586 | // Check for a V2ClientHello. |
| 587 | if ((in[0] & 0x80) != 0 && in[2] == SSL2_MT_CLIENT_HELLO && |
| 588 | in[3] == SSL3_VERSION_MAJOR) { |
| 589 | auto ret = read_v2_client_hello(ssl, out_consumed, in); |
| 590 | if (ret == ssl_open_record_error) { |
| 591 | *out_alert = 0; |
| 592 | } else if (ret == ssl_open_record_success) { |
| 593 | ssl->s3->v2_hello_done = true; |
| 594 | } |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 595 | return ret; |
| 596 | } |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 597 | |
| 598 | ssl->s3->v2_hello_done = true; |
| 599 | } |
| 600 | |
| 601 | uint8_t type; |
| 602 | Span<uint8_t> body; |
| 603 | auto ret = tls_open_record(ssl, &type, &body, out_consumed, out_alert, in); |
| 604 | if (ret != ssl_open_record_success) { |
| 605 | return ret; |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 606 | } |
| 607 | |
| 608 | // WatchGuard's TLS 1.3 interference bug is very distinctive: they drop the |
| 609 | // ServerHello and send the remaining encrypted application data records |
| 610 | // as-is. This manifests as an application data record when we expect |
| 611 | // handshake. Report a dedicated error code for this case. |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 612 | if (!ssl->server && type == SSL3_RT_APPLICATION_DATA && |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 613 | ssl->s3->aead_read_ctx->is_null_cipher()) { |
| 614 | OPENSSL_PUT_ERROR(SSL, SSL_R_APPLICATION_DATA_INSTEAD_OF_HANDSHAKE); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 615 | *out_alert = SSL_AD_UNEXPECTED_MESSAGE; |
| 616 | return ssl_open_record_error; |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 617 | } |
| 618 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 619 | if (type != SSL3_RT_HANDSHAKE) { |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 620 | OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 621 | *out_alert = SSL_AD_UNEXPECTED_MESSAGE; |
| 622 | return ssl_open_record_error; |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 623 | } |
| 624 | |
| 625 | // Append the entire handshake record to the buffer. |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 626 | if (!tls_append_handshake_data(ssl, body)) { |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 627 | *out_alert = SSL_AD_INTERNAL_ERROR; |
| 628 | return ssl_open_record_error; |
Robert Sloan | 921ef2c | 2017-10-17 09:02:20 -0700 | [diff] [blame] | 629 | } |
| 630 | |
Robert Sloan | 3627296 | 2017-10-23 10:28:39 -0700 | [diff] [blame] | 631 | return ssl_open_record_success; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 632 | } |
| 633 | |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 634 | void ssl3_next_message(SSL *ssl) { |
| 635 | SSLMessage msg; |
| 636 | if (!ssl3_get_message(ssl, &msg) || |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 637 | !ssl->s3->hs_buf || |
| 638 | ssl->s3->hs_buf->length < CBS_len(&msg.raw)) { |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 639 | assert(0); |
| 640 | return; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 641 | } |
| 642 | |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 643 | OPENSSL_memmove(ssl->s3->hs_buf->data, |
| 644 | ssl->s3->hs_buf->data + CBS_len(&msg.raw), |
| 645 | ssl->s3->hs_buf->length - CBS_len(&msg.raw)); |
| 646 | ssl->s3->hs_buf->length -= CBS_len(&msg.raw); |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 647 | ssl->s3->is_v2_hello = false; |
| 648 | ssl->s3->has_message = false; |
Robert Sloan | 8437709 | 2017-08-14 09:33:19 -0700 | [diff] [blame] | 649 | |
Robert Sloan | a27a6a4 | 2017-09-05 08:39:28 -0700 | [diff] [blame] | 650 | // Post-handshake messages are rare, so release the buffer after every |
| 651 | // message. During the handshake, |on_handshake_complete| will release it. |
Robert Sloan | 29c1d2c | 2017-10-30 14:10:28 -0700 | [diff] [blame] | 652 | if (!SSL_in_init(ssl) && ssl->s3->hs_buf->length == 0) { |
| 653 | ssl->s3->hs_buf.reset(); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 654 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 655 | } |
| 656 | |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 657 | // CipherScorer produces a "score" for each possible cipher suite offered by |
| 658 | // the client. |
| 659 | class CipherScorer { |
| 660 | public: |
| 661 | CipherScorer(uint16_t group_id) |
| 662 | : aes_is_fine_(EVP_has_aes_hardware()), |
| 663 | security_128_is_fine_(group_id != SSL_CURVE_CECPQ2 && |
| 664 | group_id != SSL_CURVE_CECPQ2b) {} |
| 665 | |
| 666 | typedef std::tuple<bool, bool, bool> Score; |
| 667 | |
| 668 | // MinScore returns a |Score| that will compare less than the score of all |
| 669 | // cipher suites. |
| 670 | Score MinScore() const { |
| 671 | return Score(false, false, false); |
| 672 | } |
| 673 | |
| 674 | Score Evaluate(const SSL_CIPHER *a) const { |
| 675 | return Score( |
| 676 | // Something is always preferable to nothing. |
| 677 | true, |
| 678 | // Either 128-bit is fine, or 256-bit is preferred. |
| 679 | security_128_is_fine_ || a->algorithm_enc != SSL_AES128GCM, |
| 680 | // Either AES is fine, or else ChaCha20 is preferred. |
| 681 | aes_is_fine_ || a->algorithm_enc == SSL_CHACHA20POLY1305); |
| 682 | } |
| 683 | |
| 684 | private: |
| 685 | const bool aes_is_fine_; |
| 686 | const bool security_128_is_fine_; |
| 687 | }; |
| 688 | |
| 689 | const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, uint16_t version, |
| 690 | uint16_t group_id) { |
| 691 | if (CBS_len(&cipher_suites) % 2 != 0) { |
| 692 | return nullptr; |
| 693 | } |
| 694 | |
| 695 | const SSL_CIPHER *best = nullptr; |
| 696 | CipherScorer scorer(group_id); |
| 697 | CipherScorer::Score best_score = scorer.MinScore(); |
| 698 | |
| 699 | while (CBS_len(&cipher_suites) > 0) { |
| 700 | uint16_t cipher_suite; |
| 701 | if (!CBS_get_u16(&cipher_suites, &cipher_suite)) { |
| 702 | return nullptr; |
| 703 | } |
| 704 | |
| 705 | // Limit to TLS 1.3 ciphers we know about. |
| 706 | const SSL_CIPHER *candidate = SSL_get_cipher_by_value(cipher_suite); |
| 707 | if (candidate == nullptr || |
| 708 | SSL_CIPHER_get_min_version(candidate) > version || |
| 709 | SSL_CIPHER_get_max_version(candidate) < version) { |
| 710 | continue; |
| 711 | } |
| 712 | |
| 713 | const CipherScorer::Score candidate_score = scorer.Evaluate(candidate); |
| 714 | // |candidate_score| must be larger to displace the current choice. That way |
| 715 | // the client's order controls between ciphers with an equal score. |
| 716 | if (candidate_score > best_score) { |
| 717 | best = candidate; |
| 718 | best_score = candidate_score; |
| 719 | } |
| 720 | } |
| 721 | |
| 722 | return best; |
| 723 | } |
| 724 | |
Robert Sloan | 726e9d1 | 2018-09-11 11:45:04 -0700 | [diff] [blame] | 725 | BSSL_NAMESPACE_END |