Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 1 | /* Copyright (c) 2018, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
| 15 | #include <openssl/ssl.h> |
| 16 | |
| 17 | #include <openssl/bytestring.h> |
| 18 | |
| 19 | #include "internal.h" |
| 20 | |
| 21 | |
Robert Sloan | 726e9d1 | 2018-09-11 11:45:04 -0700 | [diff] [blame] | 22 | BSSL_NAMESPACE_BEGIN |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 23 | |
| 24 | constexpr int kHandoffVersion = 0; |
| 25 | constexpr int kHandbackVersion = 0; |
| 26 | |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 27 | // serialize_features adds a description of features supported by this binary to |
| 28 | // |out|. Returns true on success and false on error. |
| 29 | static bool serialize_features(CBB *out) { |
| 30 | CBB ciphers; |
| 31 | if (!CBB_add_asn1(out, &ciphers, CBS_ASN1_OCTETSTRING)) { |
| 32 | return false; |
| 33 | } |
| 34 | Span<const SSL_CIPHER> all_ciphers = AllCiphers(); |
| 35 | for (const SSL_CIPHER& cipher : all_ciphers) { |
| 36 | if (!CBB_add_u16(&ciphers, static_cast<uint16_t>(cipher.id))) { |
| 37 | return false; |
| 38 | } |
| 39 | } |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 40 | CBB curves; |
| 41 | if (!CBB_add_asn1(out, &curves, CBS_ASN1_OCTETSTRING)) { |
| 42 | return false; |
| 43 | } |
| 44 | for (const NamedGroup& g : NamedGroups()) { |
| 45 | if (!CBB_add_u16(&curves, g.group_id)) { |
| 46 | return false; |
| 47 | } |
| 48 | } |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 49 | return CBB_flush(out); |
| 50 | } |
| 51 | |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 52 | bool SSL_serialize_handoff(const SSL *ssl, CBB *out) { |
| 53 | const SSL3_STATE *const s3 = ssl->s3; |
| 54 | if (!ssl->server || |
| 55 | s3->hs == nullptr || |
| 56 | s3->rwstate != SSL_HANDOFF) { |
| 57 | return false; |
| 58 | } |
| 59 | |
| 60 | CBB seq; |
| 61 | Span<const uint8_t> transcript = s3->hs->transcript.buffer(); |
| 62 | if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) || |
| 63 | !CBB_add_asn1_uint64(&seq, kHandoffVersion) || |
| 64 | !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) || |
| 65 | !CBB_add_asn1_octet_string(&seq, |
| 66 | reinterpret_cast<uint8_t *>(s3->hs_buf->data), |
| 67 | s3->hs_buf->length) || |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 68 | !serialize_features(&seq) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 69 | !CBB_flush(out)) { |
| 70 | return false; |
| 71 | } |
| 72 | |
| 73 | return true; |
| 74 | } |
| 75 | |
| 76 | bool SSL_decline_handoff(SSL *ssl) { |
| 77 | const SSL3_STATE *const s3 = ssl->s3; |
| 78 | if (!ssl->server || |
| 79 | s3->hs == nullptr || |
| 80 | s3->rwstate != SSL_HANDOFF) { |
| 81 | return false; |
| 82 | } |
| 83 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 84 | s3->hs->config->handoff = false; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 85 | return true; |
| 86 | } |
| 87 | |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 88 | // apply_remote_features reads a list of supported features from |in| and |
| 89 | // (possibly) reconfigures |ssl| to disallow the negotation of features whose |
| 90 | // support has not been indicated. (This prevents the the handshake from |
| 91 | // committing to features that are not supported on the handoff/handback side.) |
| 92 | static bool apply_remote_features(SSL *ssl, CBS *in) { |
| 93 | CBS ciphers; |
| 94 | if (!CBS_get_asn1(in, &ciphers, CBS_ASN1_OCTETSTRING)) { |
| 95 | return false; |
| 96 | } |
| 97 | bssl::UniquePtr<STACK_OF(SSL_CIPHER)> supported(sk_SSL_CIPHER_new_null()); |
| 98 | while (CBS_len(&ciphers)) { |
| 99 | uint16_t id; |
| 100 | if (!CBS_get_u16(&ciphers, &id)) { |
| 101 | return false; |
| 102 | } |
| 103 | const SSL_CIPHER *cipher = SSL_get_cipher_by_value(id); |
| 104 | if (!cipher) { |
| 105 | continue; |
| 106 | } |
| 107 | if (!sk_SSL_CIPHER_push(supported.get(), cipher)) { |
| 108 | return false; |
| 109 | } |
| 110 | } |
| 111 | STACK_OF(SSL_CIPHER) *configured = |
| 112 | ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get() |
| 113 | : ssl->ctx->cipher_list->ciphers.get(); |
| 114 | bssl::UniquePtr<STACK_OF(SSL_CIPHER)> unsupported(sk_SSL_CIPHER_new_null()); |
| 115 | for (const SSL_CIPHER *configured_cipher : configured) { |
| 116 | if (sk_SSL_CIPHER_find(supported.get(), nullptr, configured_cipher)) { |
| 117 | continue; |
| 118 | } |
| 119 | if (!sk_SSL_CIPHER_push(unsupported.get(), configured_cipher)) { |
| 120 | return false; |
| 121 | } |
| 122 | } |
| 123 | if (sk_SSL_CIPHER_num(unsupported.get()) && !ssl->config->cipher_list) { |
| 124 | ssl->config->cipher_list = bssl::MakeUnique<SSLCipherPreferenceList>(); |
| 125 | if (!ssl->config->cipher_list->Init(*ssl->ctx->cipher_list)) { |
| 126 | return false; |
| 127 | } |
| 128 | } |
| 129 | for (const SSL_CIPHER *unsupported_cipher : unsupported.get()) { |
| 130 | ssl->config->cipher_list->Remove(unsupported_cipher); |
| 131 | } |
Robert Sloan | a51059f | 2018-11-12 13:38:50 -0800 | [diff] [blame] | 132 | if (sk_SSL_CIPHER_num(SSL_get_ciphers(ssl)) == 0) { |
| 133 | return false; |
| 134 | } |
| 135 | |
| 136 | CBS curves; |
| 137 | if (!CBS_get_asn1(in, &curves, CBS_ASN1_OCTETSTRING)) { |
| 138 | return false; |
| 139 | } |
| 140 | Array<uint16_t> supported_curves; |
| 141 | if (!supported_curves.Init(CBS_len(&curves) / 2)) { |
| 142 | return false; |
| 143 | } |
| 144 | size_t idx = 0; |
| 145 | while (CBS_len(&curves)) { |
| 146 | uint16_t curve; |
| 147 | if (!CBS_get_u16(&curves, &curve)) { |
| 148 | return false; |
| 149 | } |
| 150 | supported_curves[idx++] = curve; |
| 151 | } |
| 152 | Span<const uint16_t> configured_curves = |
| 153 | tls1_get_grouplist(ssl->s3->hs.get()); |
| 154 | Array<uint16_t> new_configured_curves; |
| 155 | if (!new_configured_curves.Init(configured_curves.size())) { |
| 156 | return false; |
| 157 | } |
| 158 | idx = 0; |
| 159 | for (uint16_t configured_curve : configured_curves) { |
| 160 | bool ok = false; |
| 161 | for (uint16_t supported_curve : supported_curves) { |
| 162 | if (supported_curve == configured_curve) { |
| 163 | ok = true; |
| 164 | break; |
| 165 | } |
| 166 | } |
| 167 | if (ok) { |
| 168 | new_configured_curves[idx++] = configured_curve; |
| 169 | } |
| 170 | } |
| 171 | if (idx == 0) { |
| 172 | return false; |
| 173 | } |
| 174 | new_configured_curves.Shrink(idx); |
| 175 | ssl->config->supported_group_list = std::move(new_configured_curves); |
| 176 | |
| 177 | return true; |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 178 | } |
| 179 | |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 180 | bool SSL_apply_handoff(SSL *ssl, Span<const uint8_t> handoff) { |
| 181 | if (ssl->method->is_dtls) { |
| 182 | return false; |
| 183 | } |
| 184 | |
| 185 | CBS seq, handoff_cbs(handoff); |
| 186 | uint64_t handoff_version; |
| 187 | if (!CBS_get_asn1(&handoff_cbs, &seq, CBS_ASN1_SEQUENCE) || |
| 188 | !CBS_get_asn1_uint64(&seq, &handoff_version) || |
| 189 | handoff_version != kHandoffVersion) { |
| 190 | return false; |
| 191 | } |
| 192 | |
| 193 | CBS transcript, hs_buf; |
| 194 | if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) || |
Robert Sloan | cbf5ea6 | 2018-11-05 11:56:34 -0800 | [diff] [blame] | 195 | !CBS_get_asn1(&seq, &hs_buf, CBS_ASN1_OCTETSTRING) || |
| 196 | !apply_remote_features(ssl, &seq)) { |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 197 | return false; |
| 198 | } |
| 199 | |
| 200 | SSL_set_accept_state(ssl); |
| 201 | |
| 202 | SSL3_STATE *const s3 = ssl->s3; |
| 203 | s3->v2_hello_done = true; |
| 204 | s3->has_message = true; |
| 205 | |
| 206 | s3->hs_buf.reset(BUF_MEM_new()); |
| 207 | if (!s3->hs_buf || |
| 208 | !BUF_MEM_append(s3->hs_buf.get(), CBS_data(&hs_buf), CBS_len(&hs_buf))) { |
| 209 | return false; |
| 210 | } |
| 211 | |
| 212 | if (CBS_len(&transcript) != 0) { |
| 213 | s3->hs->transcript.Update(transcript); |
| 214 | s3->is_v2_hello = true; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 215 | } |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 216 | s3->hs->handback = true; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 217 | |
| 218 | return true; |
| 219 | } |
| 220 | |
| 221 | bool SSL_serialize_handback(const SSL *ssl, CBB *out) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 222 | if (!ssl->server || ssl->method->is_dtls) { |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 223 | return false; |
| 224 | } |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 225 | handback_t type; |
| 226 | switch (ssl->s3->hs->state) { |
| 227 | case state12_read_change_cipher_spec: |
| 228 | type = handback_after_session_resumption; |
| 229 | break; |
| 230 | case state12_read_client_certificate: |
| 231 | type = handback_after_ecdhe; |
| 232 | break; |
| 233 | case state12_finish_server_handshake: |
| 234 | type = handback_after_handshake; |
| 235 | break; |
| 236 | default: |
| 237 | return false; |
| 238 | } |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 239 | |
| 240 | const SSL3_STATE *const s3 = ssl->s3; |
| 241 | size_t hostname_len = 0; |
| 242 | if (s3->hostname) { |
| 243 | hostname_len = strlen(s3->hostname.get()); |
| 244 | } |
| 245 | |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 246 | Span<const uint8_t> transcript; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 247 | if (type == handback_after_ecdhe || |
| 248 | type == handback_after_session_resumption) { |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 249 | transcript = s3->hs->transcript.buffer(); |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 250 | } |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 251 | size_t write_iv_len = 0; |
| 252 | const uint8_t *write_iv = nullptr; |
| 253 | if ((type == handback_after_session_resumption || |
| 254 | type == handback_after_handshake) && |
| 255 | ssl->version == TLS1_VERSION && |
| 256 | SSL_CIPHER_is_block_cipher(s3->aead_write_ctx->cipher()) && |
| 257 | !s3->aead_write_ctx->GetIV(&write_iv, &write_iv_len)) { |
| 258 | return false; |
| 259 | } |
| 260 | size_t read_iv_len = 0; |
| 261 | const uint8_t *read_iv = nullptr; |
| 262 | if (type == handback_after_handshake && |
| 263 | ssl->version == TLS1_VERSION && |
| 264 | SSL_CIPHER_is_block_cipher(s3->aead_read_ctx->cipher()) && |
| 265 | !s3->aead_read_ctx->GetIV(&read_iv, &read_iv_len)) { |
| 266 | return false; |
| 267 | } |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 268 | |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 269 | // TODO(mab): make sure everything is serialized. |
| 270 | CBB seq, key_share; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 271 | const SSL_SESSION *session = |
| 272 | s3->session_reused ? ssl->session.get() : s3->hs->new_session.get(); |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 273 | if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) || |
| 274 | !CBB_add_asn1_uint64(&seq, kHandbackVersion) || |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 275 | !CBB_add_asn1_uint64(&seq, type) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 276 | !CBB_add_asn1_octet_string(&seq, s3->read_sequence, |
| 277 | sizeof(s3->read_sequence)) || |
| 278 | !CBB_add_asn1_octet_string(&seq, s3->write_sequence, |
| 279 | sizeof(s3->write_sequence)) || |
| 280 | !CBB_add_asn1_octet_string(&seq, s3->server_random, |
| 281 | sizeof(s3->server_random)) || |
| 282 | !CBB_add_asn1_octet_string(&seq, s3->client_random, |
| 283 | sizeof(s3->client_random)) || |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 284 | !CBB_add_asn1_octet_string(&seq, read_iv, read_iv_len) || |
| 285 | !CBB_add_asn1_octet_string(&seq, write_iv, write_iv_len) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 286 | !CBB_add_asn1_bool(&seq, s3->session_reused) || |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 287 | !CBB_add_asn1_bool(&seq, s3->channel_id_valid) || |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 288 | !ssl_session_serialize(session, &seq) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 289 | !CBB_add_asn1_octet_string(&seq, s3->next_proto_negotiated.data(), |
| 290 | s3->next_proto_negotiated.size()) || |
| 291 | !CBB_add_asn1_octet_string(&seq, s3->alpn_selected.data(), |
| 292 | s3->alpn_selected.size()) || |
| 293 | !CBB_add_asn1_octet_string( |
| 294 | &seq, reinterpret_cast<uint8_t *>(s3->hostname.get()), |
| 295 | hostname_len) || |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 296 | !CBB_add_asn1_octet_string(&seq, s3->channel_id, |
| 297 | sizeof(s3->channel_id)) || |
Robert Sloan | 15c0b35 | 2018-04-16 08:36:46 -0700 | [diff] [blame] | 298 | !CBB_add_asn1_bool(&seq, ssl->s3->token_binding_negotiated) || |
| 299 | !CBB_add_asn1_uint64(&seq, ssl->s3->negotiated_token_binding_param) || |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 300 | !CBB_add_asn1_bool(&seq, s3->hs->next_proto_neg_seen) || |
| 301 | !CBB_add_asn1_bool(&seq, s3->hs->cert_request) || |
| 302 | !CBB_add_asn1_bool(&seq, s3->hs->extended_master_secret) || |
| 303 | !CBB_add_asn1_bool(&seq, s3->hs->ticket_expected) || |
| 304 | !CBB_add_asn1_uint64(&seq, SSL_CIPHER_get_id(s3->hs->new_cipher)) || |
| 305 | !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) || |
| 306 | !CBB_add_asn1(&seq, &key_share, CBS_ASN1_SEQUENCE)) { |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 307 | return false; |
| 308 | } |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 309 | if (type == handback_after_ecdhe && |
Robert Sloan | 11c28bd | 2018-12-17 12:09:20 -0800 | [diff] [blame] | 310 | !s3->hs->key_shares[0]->Serialize(&key_share)) { |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 311 | return false; |
| 312 | } |
| 313 | return CBB_flush(out); |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 314 | } |
| 315 | |
| 316 | bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) { |
| 317 | if (ssl->do_handshake != nullptr || |
| 318 | ssl->method->is_dtls) { |
| 319 | return false; |
| 320 | } |
| 321 | |
| 322 | SSL3_STATE *const s3 = ssl->s3; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 323 | uint64_t handback_version, negotiated_token_binding_param, cipher, type; |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 324 | |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 325 | CBS seq, read_seq, write_seq, server_rand, client_rand, read_iv, write_iv, |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 326 | next_proto, alpn, hostname, channel_id, transcript, key_share; |
Robert Sloan | 15c0b35 | 2018-04-16 08:36:46 -0700 | [diff] [blame] | 327 | int session_reused, channel_id_valid, cert_request, extended_master_secret, |
| 328 | ticket_expected, token_binding_negotiated, next_proto_neg_seen; |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 329 | SSL_SESSION *session = nullptr; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 330 | |
| 331 | CBS handback_cbs(handback); |
| 332 | if (!CBS_get_asn1(&handback_cbs, &seq, CBS_ASN1_SEQUENCE) || |
| 333 | !CBS_get_asn1_uint64(&seq, &handback_version) || |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 334 | handback_version != kHandbackVersion || |
| 335 | !CBS_get_asn1_uint64(&seq, &type)) { |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 336 | return false; |
| 337 | } |
| 338 | |
Robert Sloan | 15c0b35 | 2018-04-16 08:36:46 -0700 | [diff] [blame] | 339 | if (!CBS_get_asn1(&seq, &read_seq, CBS_ASN1_OCTETSTRING) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 340 | CBS_len(&read_seq) != sizeof(s3->read_sequence) || |
| 341 | !CBS_get_asn1(&seq, &write_seq, CBS_ASN1_OCTETSTRING) || |
| 342 | CBS_len(&write_seq) != sizeof(s3->write_sequence) || |
| 343 | !CBS_get_asn1(&seq, &server_rand, CBS_ASN1_OCTETSTRING) || |
| 344 | CBS_len(&server_rand) != sizeof(s3->server_random) || |
| 345 | !CBS_copy_bytes(&server_rand, s3->server_random, |
| 346 | sizeof(s3->server_random)) || |
| 347 | !CBS_get_asn1(&seq, &client_rand, CBS_ASN1_OCTETSTRING) || |
| 348 | CBS_len(&client_rand) != sizeof(s3->client_random) || |
| 349 | !CBS_copy_bytes(&client_rand, s3->client_random, |
| 350 | sizeof(s3->client_random)) || |
| 351 | !CBS_get_asn1(&seq, &read_iv, CBS_ASN1_OCTETSTRING) || |
| 352 | !CBS_get_asn1(&seq, &write_iv, CBS_ASN1_OCTETSTRING) || |
| 353 | !CBS_get_asn1_bool(&seq, &session_reused) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 354 | !CBS_get_asn1_bool(&seq, &channel_id_valid)) { |
| 355 | return false; |
| 356 | } |
| 357 | |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 358 | s3->hs = ssl_handshake_new(ssl); |
| 359 | if (session_reused) { |
| 360 | ssl->session = |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 361 | SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool); |
| 362 | session = ssl->session.get(); |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 363 | } else { |
| 364 | s3->hs->new_session = |
| 365 | SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool); |
| 366 | session = s3->hs->new_session.get(); |
| 367 | } |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 368 | |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 369 | if (!session || !CBS_get_asn1(&seq, &next_proto, CBS_ASN1_OCTETSTRING) || |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 370 | !CBS_get_asn1(&seq, &alpn, CBS_ASN1_OCTETSTRING) || |
| 371 | !CBS_get_asn1(&seq, &hostname, CBS_ASN1_OCTETSTRING) || |
| 372 | !CBS_get_asn1(&seq, &channel_id, CBS_ASN1_OCTETSTRING) || |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 373 | CBS_len(&channel_id) != sizeof(s3->channel_id) || |
| 374 | !CBS_copy_bytes(&channel_id, s3->channel_id, |
| 375 | sizeof(s3->channel_id)) || |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 376 | !CBS_get_asn1_bool(&seq, &token_binding_negotiated) || |
| 377 | !CBS_get_asn1_uint64(&seq, &negotiated_token_binding_param) || |
| 378 | !CBS_get_asn1_bool(&seq, &next_proto_neg_seen) || |
| 379 | !CBS_get_asn1_bool(&seq, &cert_request) || |
| 380 | !CBS_get_asn1_bool(&seq, &extended_master_secret) || |
| 381 | !CBS_get_asn1_bool(&seq, &ticket_expected) || |
| 382 | !CBS_get_asn1_uint64(&seq, &cipher)) { |
| 383 | return false; |
| 384 | } |
| 385 | if ((s3->hs->new_cipher = |
| 386 | SSL_get_cipher_by_value(static_cast<uint16_t>(cipher))) == nullptr) { |
| 387 | return false; |
| 388 | } |
| 389 | if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) || |
| 390 | !CBS_get_asn1(&seq, &key_share, CBS_ASN1_SEQUENCE)) { |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 391 | return false; |
| 392 | } |
| 393 | |
Robert Sloan | 15c0b35 | 2018-04-16 08:36:46 -0700 | [diff] [blame] | 394 | ssl->version = session->ssl_version; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 395 | s3->have_version = true; |
| 396 | if (!ssl_method_supports_version(ssl->method, ssl->version) || |
| 397 | session->cipher != s3->hs->new_cipher || |
| 398 | ssl_protocol_version(ssl) < SSL_CIPHER_get_min_version(session->cipher) || |
| 399 | SSL_CIPHER_get_max_version(session->cipher) < ssl_protocol_version(ssl)) { |
| 400 | return false; |
| 401 | } |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 402 | ssl->do_handshake = ssl_server_handshake; |
| 403 | ssl->server = true; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 404 | switch (type) { |
| 405 | case handback_after_session_resumption: |
| 406 | ssl->s3->hs->state = state12_read_change_cipher_spec; |
| 407 | if (!session_reused) { |
| 408 | return false; |
| 409 | } |
| 410 | break; |
| 411 | case handback_after_ecdhe: |
| 412 | ssl->s3->hs->state = state12_read_client_certificate; |
| 413 | if (session_reused) { |
| 414 | return false; |
| 415 | } |
| 416 | break; |
| 417 | case handback_after_handshake: |
| 418 | ssl->s3->hs->state = state12_finish_server_handshake; |
| 419 | break; |
| 420 | default: |
| 421 | return false; |
| 422 | } |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 423 | s3->session_reused = session_reused; |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 424 | s3->channel_id_valid = channel_id_valid; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 425 | s3->next_proto_negotiated.CopyFrom(next_proto); |
| 426 | s3->alpn_selected.CopyFrom(alpn); |
| 427 | |
| 428 | const size_t hostname_len = CBS_len(&hostname); |
| 429 | if (hostname_len == 0) { |
| 430 | s3->hostname.reset(); |
| 431 | } else { |
| 432 | char *hostname_str = nullptr; |
| 433 | if (!CBS_strdup(&hostname, &hostname_str)) { |
| 434 | return false; |
| 435 | } |
| 436 | s3->hostname.reset(hostname_str); |
| 437 | } |
| 438 | |
Robert Sloan | 15c0b35 | 2018-04-16 08:36:46 -0700 | [diff] [blame] | 439 | s3->token_binding_negotiated = token_binding_negotiated; |
| 440 | s3->negotiated_token_binding_param = |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 441 | static_cast<uint8_t>(negotiated_token_binding_param); |
| 442 | s3->hs->next_proto_neg_seen = next_proto_neg_seen; |
| 443 | s3->hs->wait = ssl_hs_flush; |
| 444 | s3->hs->extended_master_secret = extended_master_secret; |
| 445 | s3->hs->ticket_expected = ticket_expected; |
| 446 | s3->aead_write_ctx->SetVersionIfNullCipher(ssl->version); |
| 447 | s3->hs->cert_request = cert_request; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 448 | |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 449 | Array<uint8_t> key_block; |
| 450 | if ((type == handback_after_session_resumption || |
| 451 | type == handback_after_handshake) && |
| 452 | (!tls1_configure_aead(ssl, evp_aead_seal, &key_block, session->cipher, |
| 453 | write_iv) || |
| 454 | !CBS_copy_bytes(&write_seq, s3->write_sequence, |
| 455 | sizeof(s3->write_sequence)))) { |
| 456 | return false; |
| 457 | } |
| 458 | if (type == handback_after_handshake && |
| 459 | (!tls1_configure_aead(ssl, evp_aead_open, &key_block, session->cipher, |
| 460 | read_iv) || |
| 461 | !CBS_copy_bytes(&read_seq, s3->read_sequence, |
| 462 | sizeof(s3->read_sequence)))) { |
| 463 | return false; |
| 464 | } |
| 465 | if ((type == handback_after_ecdhe || |
| 466 | type == handback_after_session_resumption) && |
| 467 | (!s3->hs->transcript.Init() || |
| 468 | !s3->hs->transcript.InitHash(ssl_protocol_version(ssl), |
| 469 | s3->hs->new_cipher) || |
| 470 | !s3->hs->transcript.Update(transcript))) { |
| 471 | return false; |
| 472 | } |
| 473 | if (type == handback_after_ecdhe && |
Robert Sloan | 11c28bd | 2018-12-17 12:09:20 -0800 | [diff] [blame] | 474 | (s3->hs->key_shares[0] = SSLKeyShare::Create(&key_share)) == nullptr) { |
Adam Vartanian | bfcf3a7 | 2018-08-10 14:55:24 +0100 | [diff] [blame] | 475 | return false; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 476 | } |
| 477 | |
Robert Sloan | dc2f609 | 2018-04-10 10:22:33 -0700 | [diff] [blame] | 478 | return CBS_len(&seq) == 0; |
Robert Sloan | 8542c08 | 2018-02-05 09:07:34 -0800 | [diff] [blame] | 479 | } |
| 480 | |
Robert Sloan | 726e9d1 | 2018-09-11 11:45:04 -0700 | [diff] [blame] | 481 | BSSL_NAMESPACE_END |