Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 1 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 2 | * All rights reserved. |
| 3 | * |
| 4 | * This package is an SSL implementation written |
| 5 | * by Eric Young (eay@cryptsoft.com). |
| 6 | * The implementation was written so as to conform with Netscapes SSL. |
| 7 | * |
| 8 | * This library is free for commercial and non-commercial use as long as |
| 9 | * the following conditions are aheared to. The following conditions |
| 10 | * apply to all code found in this distribution, be it the RC4, RSA, |
| 11 | * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| 12 | * included with this distribution is covered by the same copyright terms |
| 13 | * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| 14 | * |
| 15 | * Copyright remains Eric Young's, and as such any Copyright notices in |
| 16 | * the code are not to be removed. |
| 17 | * If this package is used in a product, Eric Young should be given attribution |
| 18 | * as the author of the parts of the library used. |
| 19 | * This can be in the form of a textual message at program startup or |
| 20 | * in documentation (online or textual) provided with the package. |
| 21 | * |
| 22 | * Redistribution and use in source and binary forms, with or without |
| 23 | * modification, are permitted provided that the following conditions |
| 24 | * are met: |
| 25 | * 1. Redistributions of source code must retain the copyright |
| 26 | * notice, this list of conditions and the following disclaimer. |
| 27 | * 2. Redistributions in binary form must reproduce the above copyright |
| 28 | * notice, this list of conditions and the following disclaimer in the |
| 29 | * documentation and/or other materials provided with the distribution. |
| 30 | * 3. All advertising materials mentioning features or use of this software |
| 31 | * must display the following acknowledgement: |
| 32 | * "This product includes cryptographic software written by |
| 33 | * Eric Young (eay@cryptsoft.com)" |
| 34 | * The word 'cryptographic' can be left out if the rouines from the library |
| 35 | * being used are not cryptographic related :-). |
| 36 | * 4. If you include any Windows specific code (or a derivative thereof) from |
| 37 | * the apps directory (application code) you must include an acknowledgement: |
| 38 | * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| 39 | * |
| 40 | * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| 41 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 42 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 43 | * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| 44 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 45 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 46 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 47 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 48 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 49 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 50 | * SUCH DAMAGE. |
| 51 | * |
| 52 | * The licence and distribution terms for any publically available version or |
| 53 | * derivative of this code cannot be changed. i.e. this code cannot simply be |
| 54 | * copied and put under another distribution licence |
| 55 | * [including the GNU Public Licence.] */ |
| 56 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 57 | #include <openssl/ssl.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 58 | |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 59 | #include <limits.h> |
| 60 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 61 | #include <openssl/ec.h> |
| 62 | #include <openssl/ec_key.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 63 | #include <openssl/err.h> |
| 64 | #include <openssl/evp.h> |
| 65 | #include <openssl/mem.h> |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 66 | #include <openssl/type_check.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 67 | |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 68 | #include "internal.h" |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 69 | #include "../crypto/internal.h" |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 70 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 71 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 72 | int ssl_is_key_type_supported(int key_type) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 73 | return key_type == EVP_PKEY_RSA || key_type == EVP_PKEY_EC || |
| 74 | key_type == EVP_PKEY_ED25519; |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 75 | } |
| 76 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 77 | static int ssl_set_pkey(CERT *cert, EVP_PKEY *pkey) { |
| 78 | if (!ssl_is_key_type_supported(pkey->type)) { |
| 79 | OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 80 | return 0; |
| 81 | } |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 82 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 83 | if (cert->chain != NULL && |
| 84 | sk_CRYPTO_BUFFER_value(cert->chain, 0) != NULL && |
Robert Sloan | 1c9db53 | 2017-03-13 08:03:59 -0700 | [diff] [blame] | 85 | /* Sanity-check that the private key and the certificate match. */ |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 86 | !ssl_cert_check_private_key(cert, pkey)) { |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 87 | return 0; |
| 88 | } |
| 89 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 90 | EVP_PKEY_free(cert->privatekey); |
| 91 | EVP_PKEY_up_ref(pkey); |
| 92 | cert->privatekey = pkey; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 93 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 94 | return 1; |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 95 | } |
| 96 | |
| 97 | int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) { |
| 98 | EVP_PKEY *pkey; |
| 99 | int ret; |
| 100 | |
| 101 | if (rsa == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 102 | OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 103 | return 0; |
| 104 | } |
| 105 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 106 | pkey = EVP_PKEY_new(); |
| 107 | if (pkey == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 108 | OPENSSL_PUT_ERROR(SSL, ERR_R_EVP_LIB); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 109 | return 0; |
| 110 | } |
| 111 | |
| 112 | RSA_up_ref(rsa); |
| 113 | EVP_PKEY_assign_RSA(pkey, rsa); |
| 114 | |
| 115 | ret = ssl_set_pkey(ssl->cert, pkey); |
| 116 | EVP_PKEY_free(pkey); |
| 117 | |
| 118 | return ret; |
| 119 | } |
| 120 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 121 | int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) { |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 122 | if (pkey == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 123 | OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 124 | return 0; |
| 125 | } |
| 126 | |
Robert Sloan | 4d1ac50 | 2017-02-06 08:36:14 -0800 | [diff] [blame] | 127 | return ssl_set_pkey(ssl->cert, pkey); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 128 | } |
| 129 | |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 130 | int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const uint8_t *der, |
| 131 | size_t der_len) { |
| 132 | if (der_len > LONG_MAX) { |
| 133 | OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 134 | return 0; |
| 135 | } |
| 136 | |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 137 | const uint8_t *p = der; |
| 138 | EVP_PKEY *pkey = d2i_PrivateKey(type, NULL, &p, (long)der_len); |
| 139 | if (pkey == NULL || p != der + der_len) { |
| 140 | OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB); |
| 141 | EVP_PKEY_free(pkey); |
| 142 | return 0; |
| 143 | } |
| 144 | |
| 145 | int ret = SSL_use_PrivateKey(ssl, pkey); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 146 | EVP_PKEY_free(pkey); |
| 147 | return ret; |
| 148 | } |
| 149 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 150 | int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) { |
| 151 | int ret; |
| 152 | EVP_PKEY *pkey; |
| 153 | |
| 154 | if (rsa == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 155 | OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 156 | return 0; |
| 157 | } |
| 158 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 159 | pkey = EVP_PKEY_new(); |
| 160 | if (pkey == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 161 | OPENSSL_PUT_ERROR(SSL, ERR_R_EVP_LIB); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 162 | return 0; |
| 163 | } |
| 164 | |
| 165 | RSA_up_ref(rsa); |
| 166 | EVP_PKEY_assign_RSA(pkey, rsa); |
| 167 | |
| 168 | ret = ssl_set_pkey(ctx->cert, pkey); |
| 169 | EVP_PKEY_free(pkey); |
| 170 | return ret; |
| 171 | } |
| 172 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 173 | int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const uint8_t *der, |
| 174 | size_t der_len) { |
| 175 | RSA *rsa = RSA_private_key_from_bytes(der, der_len); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 176 | if (rsa == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 177 | OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 178 | return 0; |
| 179 | } |
| 180 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 181 | int ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 182 | RSA_free(rsa); |
| 183 | return ret; |
| 184 | } |
| 185 | |
| 186 | int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) { |
| 187 | if (pkey == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 188 | OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 189 | return 0; |
| 190 | } |
| 191 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 192 | return ssl_set_pkey(ctx->cert, pkey); |
| 193 | } |
| 194 | |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 195 | int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const uint8_t *der, |
| 196 | size_t der_len) { |
| 197 | if (der_len > LONG_MAX) { |
| 198 | OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 199 | return 0; |
| 200 | } |
| 201 | |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 202 | const uint8_t *p = der; |
| 203 | EVP_PKEY *pkey = d2i_PrivateKey(type, NULL, &p, (long)der_len); |
| 204 | if (pkey == NULL || p != der + der_len) { |
| 205 | OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB); |
| 206 | EVP_PKEY_free(pkey); |
| 207 | return 0; |
| 208 | } |
| 209 | |
| 210 | int ret = SSL_CTX_use_PrivateKey(ctx, pkey); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 211 | EVP_PKEY_free(pkey); |
| 212 | return ret; |
| 213 | } |
| 214 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 215 | void SSL_set_private_key_method(SSL *ssl, |
| 216 | const SSL_PRIVATE_KEY_METHOD *key_method) { |
| 217 | ssl->cert->key_method = key_method; |
| 218 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 219 | |
David Benjamin | 4969cc9 | 2016-04-22 15:02:23 -0400 | [diff] [blame] | 220 | void SSL_CTX_set_private_key_method(SSL_CTX *ctx, |
| 221 | const SSL_PRIVATE_KEY_METHOD *key_method) { |
| 222 | ctx->cert->key_method = key_method; |
| 223 | } |
| 224 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 225 | static int set_algorithm_prefs(uint16_t **out_prefs, size_t *out_num_prefs, |
| 226 | const uint16_t *prefs, size_t num_prefs) { |
| 227 | OPENSSL_free(*out_prefs); |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 228 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 229 | *out_num_prefs = 0; |
| 230 | *out_prefs = BUF_memdup(prefs, num_prefs * sizeof(prefs[0])); |
| 231 | if (*out_prefs == NULL) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 232 | OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| 233 | return 0; |
| 234 | } |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 235 | *out_num_prefs = num_prefs; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 236 | |
| 237 | return 1; |
| 238 | } |
| 239 | |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 240 | int SSL_CTX_set_signing_algorithm_prefs(SSL_CTX *ctx, const uint16_t *prefs, |
| 241 | size_t num_prefs) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 242 | return set_algorithm_prefs(&ctx->cert->sigalgs, &ctx->cert->num_sigalgs, |
| 243 | prefs, num_prefs); |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 244 | } |
| 245 | |
| 246 | |
| 247 | int SSL_set_signing_algorithm_prefs(SSL *ssl, const uint16_t *prefs, |
| 248 | size_t num_prefs) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 249 | return set_algorithm_prefs(&ssl->cert->sigalgs, &ssl->cert->num_sigalgs, |
| 250 | prefs, num_prefs); |
| 251 | } |
| 252 | |
| 253 | int SSL_CTX_set_verify_algorithm_prefs(SSL_CTX *ctx, const uint16_t *prefs, |
| 254 | size_t num_prefs) { |
| 255 | return set_algorithm_prefs(&ctx->verify_sigalgs, &ctx->num_verify_sigalgs, |
| 256 | prefs, num_prefs); |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 257 | } |
| 258 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 259 | int SSL_set_private_key_digest_prefs(SSL *ssl, const int *digest_nids, |
| 260 | size_t num_digests) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 261 | OPENSSL_free(ssl->cert->sigalgs); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 262 | |
David Benjamin | f31229b | 2017-01-25 14:08:15 -0500 | [diff] [blame] | 263 | OPENSSL_COMPILE_ASSERT(sizeof(int) >= 2 * sizeof(uint16_t), |
| 264 | digest_list_conversion_cannot_overflow); |
| 265 | |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 266 | ssl->cert->num_sigalgs = 0; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 267 | ssl->cert->sigalgs = OPENSSL_malloc(sizeof(uint16_t) * 2 * num_digests); |
| 268 | if (ssl->cert->sigalgs == NULL) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 269 | OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
| 270 | return 0; |
| 271 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 272 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 273 | /* Convert the digest list to a signature algorithms list. |
| 274 | * |
| 275 | * TODO(davidben): Replace this API with one that can express RSA-PSS, etc. */ |
| 276 | for (size_t i = 0; i < num_digests; i++) { |
| 277 | switch (digest_nids[i]) { |
| 278 | case NID_sha1: |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 279 | ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA1; |
| 280 | ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] = SSL_SIGN_ECDSA_SHA1; |
| 281 | ssl->cert->num_sigalgs += 2; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 282 | break; |
| 283 | case NID_sha256: |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 284 | ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA256; |
| 285 | ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] = |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 286 | SSL_SIGN_ECDSA_SECP256R1_SHA256; |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 287 | ssl->cert->num_sigalgs += 2; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 288 | break; |
| 289 | case NID_sha384: |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 290 | ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA384; |
| 291 | ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] = |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 292 | SSL_SIGN_ECDSA_SECP384R1_SHA384; |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 293 | ssl->cert->num_sigalgs += 2; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 294 | break; |
| 295 | case NID_sha512: |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 296 | ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA512; |
| 297 | ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] = |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 298 | SSL_SIGN_ECDSA_SECP521R1_SHA512; |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 299 | ssl->cert->num_sigalgs += 2; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 300 | break; |
| 301 | } |
| 302 | } |
| 303 | |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 304 | return 1; |
| 305 | } |
| 306 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 307 | typedef struct { |
| 308 | uint16_t sigalg; |
| 309 | int pkey_type; |
| 310 | int curve; |
| 311 | const EVP_MD *(*digest_func)(void); |
| 312 | char is_rsa_pss; |
| 313 | } SSL_SIGNATURE_ALGORITHM; |
| 314 | |
| 315 | static const SSL_SIGNATURE_ALGORITHM kSignatureAlgorithms[] = { |
| 316 | {SSL_SIGN_RSA_PKCS1_MD5_SHA1, EVP_PKEY_RSA, NID_undef, &EVP_md5_sha1, 0}, |
| 317 | {SSL_SIGN_RSA_PKCS1_SHA1, EVP_PKEY_RSA, NID_undef, &EVP_sha1, 0}, |
| 318 | {SSL_SIGN_RSA_PKCS1_SHA256, EVP_PKEY_RSA, NID_undef, &EVP_sha256, 0}, |
| 319 | {SSL_SIGN_RSA_PKCS1_SHA384, EVP_PKEY_RSA, NID_undef, &EVP_sha384, 0}, |
| 320 | {SSL_SIGN_RSA_PKCS1_SHA512, EVP_PKEY_RSA, NID_undef, &EVP_sha512, 0}, |
| 321 | |
| 322 | {SSL_SIGN_RSA_PSS_SHA256, EVP_PKEY_RSA, NID_undef, &EVP_sha256, 1}, |
| 323 | {SSL_SIGN_RSA_PSS_SHA384, EVP_PKEY_RSA, NID_undef, &EVP_sha384, 1}, |
| 324 | {SSL_SIGN_RSA_PSS_SHA512, EVP_PKEY_RSA, NID_undef, &EVP_sha512, 1}, |
| 325 | |
| 326 | {SSL_SIGN_ECDSA_SHA1, EVP_PKEY_EC, NID_undef, &EVP_sha1, 0}, |
| 327 | {SSL_SIGN_ECDSA_SECP256R1_SHA256, EVP_PKEY_EC, NID_X9_62_prime256v1, |
| 328 | &EVP_sha256, 0}, |
| 329 | {SSL_SIGN_ECDSA_SECP384R1_SHA384, EVP_PKEY_EC, NID_secp384r1, &EVP_sha384, |
| 330 | 0}, |
| 331 | {SSL_SIGN_ECDSA_SECP521R1_SHA512, EVP_PKEY_EC, NID_secp521r1, &EVP_sha512, |
| 332 | 0}, |
| 333 | |
| 334 | {SSL_SIGN_ED25519, EVP_PKEY_ED25519, NID_undef, NULL, 0}, |
| 335 | }; |
| 336 | |
| 337 | static const SSL_SIGNATURE_ALGORITHM *get_signature_algorithm(uint16_t sigalg) { |
| 338 | for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kSignatureAlgorithms); i++) { |
| 339 | if (kSignatureAlgorithms[i].sigalg == sigalg) { |
| 340 | return &kSignatureAlgorithms[i]; |
| 341 | } |
| 342 | } |
| 343 | return NULL; |
| 344 | } |
| 345 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 346 | int ssl_has_private_key(const SSL *ssl) { |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 347 | return ssl->cert->privatekey != NULL || ssl->cert->key_method != NULL; |
| 348 | } |
| 349 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 350 | static int pkey_supports_algorithm(const SSL *ssl, EVP_PKEY *pkey, |
| 351 | uint16_t sigalg) { |
| 352 | const SSL_SIGNATURE_ALGORITHM *alg = get_signature_algorithm(sigalg); |
| 353 | if (alg == NULL || |
| 354 | EVP_PKEY_id(pkey) != alg->pkey_type) { |
| 355 | return 0; |
| 356 | } |
| 357 | |
| 358 | if (ssl3_protocol_version(ssl) >= TLS1_3_VERSION) { |
| 359 | /* RSA keys may only be used with RSA-PSS. */ |
| 360 | if (alg->pkey_type == EVP_PKEY_RSA && !alg->is_rsa_pss) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 361 | return 0; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 362 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 363 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 364 | /* EC keys have a curve requirement. */ |
| 365 | if (alg->pkey_type == EVP_PKEY_EC && |
| 366 | (alg->curve == NID_undef || |
| 367 | EC_GROUP_get_curve_name( |
| 368 | EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(pkey))) != alg->curve)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 369 | return 0; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 370 | } |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 371 | } |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 372 | |
| 373 | return 1; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 374 | } |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 375 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 376 | static int setup_ctx(SSL *ssl, EVP_PKEY_CTX *ctx, uint16_t sigalg) { |
| 377 | if (!pkey_supports_algorithm(ssl, EVP_PKEY_CTX_get0_pkey(ctx), sigalg)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 378 | OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE); |
| 379 | return 0; |
| 380 | } |
| 381 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 382 | const SSL_SIGNATURE_ALGORITHM *alg = get_signature_algorithm(sigalg); |
| 383 | if (alg->digest_func != NULL && |
| 384 | !EVP_PKEY_CTX_set_signature_md(ctx, alg->digest_func())) { |
| 385 | return 0; |
| 386 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 387 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 388 | if (alg->is_rsa_pss) { |
| 389 | if (!EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PSS_PADDING) || |
| 390 | !EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, -1 /* salt len = hash len */)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 391 | return 0; |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 392 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 393 | } |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 394 | |
| 395 | return 1; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 396 | } |
| 397 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 398 | static int legacy_sign_digest_supported(const SSL_SIGNATURE_ALGORITHM *alg) { |
| 399 | return (alg->pkey_type == EVP_PKEY_EC || alg->pkey_type == EVP_PKEY_RSA) && |
| 400 | !alg->is_rsa_pss; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 401 | } |
| 402 | |
| 403 | enum ssl_private_key_result_t ssl_private_key_sign( |
| 404 | SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out, |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 405 | uint16_t sigalg, const uint8_t *in, size_t in_len) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 406 | if (ssl->cert->key_method != NULL) { |
| 407 | if (ssl->cert->key_method->sign != NULL) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 408 | return ssl->cert->key_method->sign(ssl, out, out_len, max_out, sigalg, in, |
| 409 | in_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 410 | } |
| 411 | |
| 412 | /* TODO(davidben): Remove support for |sign_digest|-only |
| 413 | * |SSL_PRIVATE_KEY_METHOD|s. */ |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 414 | const SSL_SIGNATURE_ALGORITHM *alg = get_signature_algorithm(sigalg); |
| 415 | if (alg == NULL || |
| 416 | !legacy_sign_digest_supported(alg)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 417 | OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL_FOR_CUSTOM_KEY); |
| 418 | return ssl_private_key_failure; |
| 419 | } |
| 420 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 421 | const EVP_MD *md = alg->digest_func(); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 422 | uint8_t hash[EVP_MAX_MD_SIZE]; |
| 423 | unsigned hash_len; |
| 424 | if (!EVP_Digest(in, in_len, hash, &hash_len, md, NULL)) { |
| 425 | return ssl_private_key_failure; |
| 426 | } |
| 427 | |
| 428 | return ssl->cert->key_method->sign_digest(ssl, out, out_len, max_out, md, |
| 429 | hash, hash_len); |
| 430 | } |
| 431 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 432 | *out_len = max_out; |
| 433 | EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(ssl->cert->privatekey, NULL); |
| 434 | int ret = ctx != NULL && |
| 435 | EVP_PKEY_sign_init(ctx) && |
| 436 | setup_ctx(ssl, ctx, sigalg) && |
| 437 | EVP_PKEY_sign_message(ctx, out, out_len, in, in_len); |
| 438 | EVP_PKEY_CTX_free(ctx); |
| 439 | return ret ? ssl_private_key_success : ssl_private_key_failure; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 440 | } |
| 441 | |
| 442 | int ssl_public_key_verify(SSL *ssl, const uint8_t *signature, |
| 443 | size_t signature_len, uint16_t signature_algorithm, |
| 444 | EVP_PKEY *pkey, const uint8_t *in, size_t in_len) { |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 445 | EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey, NULL); |
| 446 | int ret = ctx != NULL && |
| 447 | EVP_PKEY_verify_init(ctx) && |
| 448 | setup_ctx(ssl, ctx, signature_algorithm) && |
| 449 | EVP_PKEY_verify_message(ctx, signature, signature_len, in, in_len); |
| 450 | EVP_PKEY_CTX_free(ctx); |
| 451 | return ret; |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 452 | } |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 453 | |
| 454 | enum ssl_private_key_result_t ssl_private_key_decrypt( |
| 455 | SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out, |
| 456 | const uint8_t *in, size_t in_len) { |
| 457 | if (ssl->cert->key_method != NULL) { |
| 458 | return ssl->cert->key_method->decrypt(ssl, out, out_len, max_out, in, |
| 459 | in_len); |
| 460 | } |
| 461 | |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 462 | RSA *rsa = EVP_PKEY_get0_RSA(ssl->cert->privatekey); |
| 463 | if (rsa == NULL) { |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 464 | /* Decrypt operations are only supported for RSA keys. */ |
| 465 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 466 | return ssl_private_key_failure; |
| 467 | } |
| 468 | |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 469 | /* Decrypt with no padding. PKCS#1 padding will be removed as part |
| 470 | * of the timing-sensitive code by the caller. */ |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 471 | if (!RSA_decrypt(rsa, out_len, out, max_out, in, in_len, RSA_NO_PADDING)) { |
| 472 | return ssl_private_key_failure; |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 473 | } |
Adam Langley | 4139edb | 2016-01-13 15:00:54 -0800 | [diff] [blame] | 474 | return ssl_private_key_success; |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 475 | } |
| 476 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 477 | enum ssl_private_key_result_t ssl_private_key_complete(SSL *ssl, uint8_t *out, |
| 478 | size_t *out_len, |
| 479 | size_t max_out) { |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 480 | /* Only custom keys may be asynchronous. */ |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 481 | return ssl->cert->key_method->complete(ssl, out, out_len, max_out); |
| 482 | } |
| 483 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 484 | int ssl_private_key_supports_signature_algorithm(SSL_HANDSHAKE *hs, |
| 485 | uint16_t sigalg) { |
| 486 | SSL *const ssl = hs->ssl; |
| 487 | if (!pkey_supports_algorithm(ssl, hs->local_pubkey, sigalg)) { |
| 488 | return 0; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 489 | } |
| 490 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 491 | /* Ensure the RSA key is large enough for the hash. RSASSA-PSS requires that |
| 492 | * emLen be at least hLen + sLen + 2. Both hLen and sLen are the size of the |
| 493 | * hash in TLS. Reasonable RSA key sizes are large enough for the largest |
| 494 | * defined RSASSA-PSS algorithm, but 1024-bit RSA is slightly too small for |
| 495 | * SHA-512. 1024-bit RSA is sometimes used for test credentials, so check the |
| 496 | * size so that we can fall back to another algorithm in that case. */ |
| 497 | const SSL_SIGNATURE_ALGORITHM *alg = get_signature_algorithm(sigalg); |
| 498 | if (alg->is_rsa_pss && |
| 499 | (size_t)EVP_PKEY_size(hs->local_pubkey) < |
| 500 | 2 * EVP_MD_size(alg->digest_func()) + 2) { |
| 501 | return 0; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 502 | } |
| 503 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 504 | /* Newer algorithms require message-based private keys. |
| 505 | * TODO(davidben): Remove this check when sign_digest is gone. */ |
| 506 | if (ssl->cert->key_method != NULL && |
| 507 | ssl->cert->key_method->sign == NULL && |
| 508 | !legacy_sign_digest_supported(alg)) { |
| 509 | return 0; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 510 | } |
| 511 | |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 512 | return 1; |
Kenny Root | e99801b | 2015-11-06 15:31:15 -0800 | [diff] [blame] | 513 | } |