[331] | 1 | /*
|
---|
| 2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | /* ====================================================================
|
---|
| 11 | * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
---|
| 12 | * ECC cipher suite support in OpenSSL originally developed by
|
---|
| 13 | * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
|
---|
| 14 | */
|
---|
| 15 |
|
---|
| 16 | #include <limits.h>
|
---|
| 17 | #include <string.h>
|
---|
| 18 | #include <stdio.h>
|
---|
| 19 | #include "../ssl_locl.h"
|
---|
| 20 | #include "statem_locl.h"
|
---|
| 21 | #include <openssl/buffer.h>
|
---|
| 22 | #include <openssl/objects.h>
|
---|
| 23 | #include <openssl/evp.h>
|
---|
| 24 | #include <openssl/x509.h>
|
---|
| 25 |
|
---|
| 26 | /*
|
---|
| 27 | * send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
|
---|
| 28 | * SSL3_RT_CHANGE_CIPHER_SPEC)
|
---|
| 29 | */
|
---|
| 30 | int ssl3_do_write(SSL *s, int type)
|
---|
| 31 | {
|
---|
| 32 | int ret;
|
---|
| 33 |
|
---|
| 34 | ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
|
---|
| 35 | s->init_num);
|
---|
| 36 | if (ret < 0)
|
---|
| 37 | return (-1);
|
---|
| 38 | if (type == SSL3_RT_HANDSHAKE)
|
---|
| 39 | /*
|
---|
| 40 | * should not be done for 'Hello Request's, but in that case we'll
|
---|
| 41 | * ignore the result anyway
|
---|
| 42 | */
|
---|
| 43 | if (!ssl3_finish_mac(s,
|
---|
| 44 | (unsigned char *)&s->init_buf->data[s->init_off],
|
---|
| 45 | ret))
|
---|
| 46 | return -1;
|
---|
| 47 |
|
---|
| 48 | if (ret == s->init_num) {
|
---|
| 49 | if (s->msg_callback)
|
---|
| 50 | s->msg_callback(1, s->version, type, s->init_buf->data,
|
---|
| 51 | (size_t)(s->init_off + s->init_num), s,
|
---|
| 52 | s->msg_callback_arg);
|
---|
| 53 | return (1);
|
---|
| 54 | }
|
---|
| 55 | s->init_off += ret;
|
---|
| 56 | s->init_num -= ret;
|
---|
| 57 | return (0);
|
---|
| 58 | }
|
---|
| 59 |
|
---|
| 60 | int tls_construct_finished(SSL *s, const char *sender, int slen)
|
---|
| 61 | {
|
---|
| 62 | unsigned char *p;
|
---|
| 63 | int i;
|
---|
| 64 | unsigned long l;
|
---|
| 65 |
|
---|
| 66 | p = ssl_handshake_start(s);
|
---|
| 67 |
|
---|
| 68 | i = s->method->ssl3_enc->final_finish_mac(s,
|
---|
| 69 | sender, slen,
|
---|
| 70 | s->s3->tmp.finish_md);
|
---|
| 71 | if (i <= 0)
|
---|
| 72 | return 0;
|
---|
| 73 | s->s3->tmp.finish_md_len = i;
|
---|
| 74 | memcpy(p, s->s3->tmp.finish_md, i);
|
---|
| 75 | l = i;
|
---|
| 76 |
|
---|
| 77 | /*
|
---|
| 78 | * Copy the finished so we can use it for renegotiation checks
|
---|
| 79 | */
|
---|
| 80 | if (!s->server) {
|
---|
| 81 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
| 82 | memcpy(s->s3->previous_client_finished, s->s3->tmp.finish_md, i);
|
---|
| 83 | s->s3->previous_client_finished_len = i;
|
---|
| 84 | } else {
|
---|
| 85 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
| 86 | memcpy(s->s3->previous_server_finished, s->s3->tmp.finish_md, i);
|
---|
| 87 | s->s3->previous_server_finished_len = i;
|
---|
| 88 | }
|
---|
| 89 |
|
---|
| 90 | if (!ssl_set_handshake_header(s, SSL3_MT_FINISHED, l)) {
|
---|
| 91 | SSLerr(SSL_F_TLS_CONSTRUCT_FINISHED, ERR_R_INTERNAL_ERROR);
|
---|
| 92 | return 0;
|
---|
| 93 | }
|
---|
| 94 |
|
---|
| 95 | return 1;
|
---|
| 96 | }
|
---|
| 97 |
|
---|
| 98 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
---|
| 99 | /*
|
---|
| 100 | * ssl3_take_mac calculates the Finished MAC for the handshakes messages seen
|
---|
| 101 | * to far.
|
---|
| 102 | */
|
---|
| 103 | static void ssl3_take_mac(SSL *s)
|
---|
| 104 | {
|
---|
| 105 | const char *sender;
|
---|
| 106 | int slen;
|
---|
| 107 | /*
|
---|
| 108 | * If no new cipher setup return immediately: other functions will set
|
---|
| 109 | * the appropriate error.
|
---|
| 110 | */
|
---|
| 111 | if (s->s3->tmp.new_cipher == NULL)
|
---|
| 112 | return;
|
---|
| 113 | if (!s->server) {
|
---|
| 114 | sender = s->method->ssl3_enc->server_finished_label;
|
---|
| 115 | slen = s->method->ssl3_enc->server_finished_label_len;
|
---|
| 116 | } else {
|
---|
| 117 | sender = s->method->ssl3_enc->client_finished_label;
|
---|
| 118 | slen = s->method->ssl3_enc->client_finished_label_len;
|
---|
| 119 | }
|
---|
| 120 |
|
---|
| 121 | s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
|
---|
| 122 | sender,
|
---|
| 123 | slen,
|
---|
| 124 | s->s3->tmp.peer_finish_md);
|
---|
| 125 | }
|
---|
| 126 | #endif
|
---|
| 127 |
|
---|
| 128 | MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL *s, PACKET *pkt)
|
---|
| 129 | {
|
---|
| 130 | int al;
|
---|
| 131 | long remain;
|
---|
| 132 |
|
---|
| 133 | remain = PACKET_remaining(pkt);
|
---|
| 134 | /*
|
---|
| 135 | * 'Change Cipher Spec' is just a single byte, which should already have
|
---|
| 136 | * been consumed by ssl_get_message() so there should be no bytes left,
|
---|
| 137 | * unless we're using DTLS1_BAD_VER, which has an extra 2 bytes
|
---|
| 138 | */
|
---|
| 139 | if (SSL_IS_DTLS(s)) {
|
---|
| 140 | if ((s->version == DTLS1_BAD_VER
|
---|
| 141 | && remain != DTLS1_CCS_HEADER_LENGTH + 1)
|
---|
| 142 | || (s->version != DTLS1_BAD_VER
|
---|
| 143 | && remain != DTLS1_CCS_HEADER_LENGTH - 1)) {
|
---|
| 144 | al = SSL_AD_ILLEGAL_PARAMETER;
|
---|
| 145 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
|
---|
| 146 | SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
---|
| 147 | goto f_err;
|
---|
| 148 | }
|
---|
| 149 | } else {
|
---|
| 150 | if (remain != 0) {
|
---|
| 151 | al = SSL_AD_ILLEGAL_PARAMETER;
|
---|
| 152 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
|
---|
| 153 | SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
---|
| 154 | goto f_err;
|
---|
| 155 | }
|
---|
| 156 | }
|
---|
| 157 |
|
---|
| 158 | /* Check we have a cipher to change to */
|
---|
| 159 | if (s->s3->tmp.new_cipher == NULL) {
|
---|
| 160 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
| 161 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC, SSL_R_CCS_RECEIVED_EARLY);
|
---|
| 162 | goto f_err;
|
---|
| 163 | }
|
---|
| 164 |
|
---|
| 165 | s->s3->change_cipher_spec = 1;
|
---|
| 166 | if (!ssl3_do_change_cipher_spec(s)) {
|
---|
| 167 | al = SSL_AD_INTERNAL_ERROR;
|
---|
| 168 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
|
---|
| 169 | goto f_err;
|
---|
| 170 | }
|
---|
| 171 |
|
---|
| 172 | if (SSL_IS_DTLS(s)) {
|
---|
| 173 | dtls1_reset_seq_numbers(s, SSL3_CC_READ);
|
---|
| 174 |
|
---|
| 175 | if (s->version == DTLS1_BAD_VER)
|
---|
| 176 | s->d1->handshake_read_seq++;
|
---|
| 177 |
|
---|
| 178 | #ifndef OPENSSL_NO_SCTP
|
---|
| 179 | /*
|
---|
| 180 | * Remember that a CCS has been received, so that an old key of
|
---|
| 181 | * SCTP-Auth can be deleted when a CCS is sent. Will be ignored if no
|
---|
| 182 | * SCTP is used
|
---|
| 183 | */
|
---|
| 184 | BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD, 1, NULL);
|
---|
| 185 | #endif
|
---|
| 186 | }
|
---|
| 187 |
|
---|
| 188 | return MSG_PROCESS_CONTINUE_READING;
|
---|
| 189 | f_err:
|
---|
| 190 | ssl3_send_alert(s, SSL3_AL_FATAL, al);
|
---|
| 191 | ossl_statem_set_error(s);
|
---|
| 192 | return MSG_PROCESS_ERROR;
|
---|
| 193 | }
|
---|
| 194 |
|
---|
| 195 | MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt)
|
---|
| 196 | {
|
---|
| 197 | int al, i;
|
---|
| 198 |
|
---|
| 199 | /* If this occurs, we have missed a message */
|
---|
| 200 | if (!s->s3->change_cipher_spec) {
|
---|
| 201 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
| 202 | SSLerr(SSL_F_TLS_PROCESS_FINISHED, SSL_R_GOT_A_FIN_BEFORE_A_CCS);
|
---|
| 203 | goto f_err;
|
---|
| 204 | }
|
---|
| 205 | s->s3->change_cipher_spec = 0;
|
---|
| 206 |
|
---|
| 207 | i = s->s3->tmp.peer_finish_md_len;
|
---|
| 208 |
|
---|
| 209 | if ((unsigned long)i != PACKET_remaining(pkt)) {
|
---|
| 210 | al = SSL_AD_DECODE_ERROR;
|
---|
| 211 | SSLerr(SSL_F_TLS_PROCESS_FINISHED, SSL_R_BAD_DIGEST_LENGTH);
|
---|
| 212 | goto f_err;
|
---|
| 213 | }
|
---|
| 214 |
|
---|
| 215 | if (CRYPTO_memcmp(PACKET_data(pkt), s->s3->tmp.peer_finish_md, i) != 0) {
|
---|
| 216 | al = SSL_AD_DECRYPT_ERROR;
|
---|
| 217 | SSLerr(SSL_F_TLS_PROCESS_FINISHED, SSL_R_DIGEST_CHECK_FAILED);
|
---|
| 218 | goto f_err;
|
---|
| 219 | }
|
---|
| 220 |
|
---|
| 221 | /*
|
---|
| 222 | * Copy the finished so we can use it for renegotiation checks
|
---|
| 223 | */
|
---|
| 224 | if (s->server) {
|
---|
| 225 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
| 226 | memcpy(s->s3->previous_client_finished, s->s3->tmp.peer_finish_md, i);
|
---|
| 227 | s->s3->previous_client_finished_len = i;
|
---|
| 228 | } else {
|
---|
| 229 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
| 230 | memcpy(s->s3->previous_server_finished, s->s3->tmp.peer_finish_md, i);
|
---|
| 231 | s->s3->previous_server_finished_len = i;
|
---|
| 232 | }
|
---|
| 233 |
|
---|
| 234 | return MSG_PROCESS_FINISHED_READING;
|
---|
| 235 | f_err:
|
---|
| 236 | ssl3_send_alert(s, SSL3_AL_FATAL, al);
|
---|
| 237 | ossl_statem_set_error(s);
|
---|
| 238 | return MSG_PROCESS_ERROR;
|
---|
| 239 | }
|
---|
| 240 |
|
---|
| 241 | int tls_construct_change_cipher_spec(SSL *s)
|
---|
| 242 | {
|
---|
| 243 | unsigned char *p;
|
---|
| 244 |
|
---|
| 245 | p = (unsigned char *)s->init_buf->data;
|
---|
| 246 | *p = SSL3_MT_CCS;
|
---|
| 247 | s->init_num = 1;
|
---|
| 248 | s->init_off = 0;
|
---|
| 249 |
|
---|
| 250 | return 1;
|
---|
| 251 | }
|
---|
| 252 |
|
---|
| 253 | unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
|
---|
| 254 | {
|
---|
| 255 | unsigned char *p;
|
---|
| 256 | unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
|
---|
| 257 |
|
---|
| 258 | if (!ssl_add_cert_chain(s, cpk, &l))
|
---|
| 259 | return 0;
|
---|
| 260 |
|
---|
| 261 | l -= 3 + SSL_HM_HEADER_LENGTH(s);
|
---|
| 262 | p = ssl_handshake_start(s);
|
---|
| 263 | l2n3(l, p);
|
---|
| 264 | l += 3;
|
---|
| 265 |
|
---|
| 266 | if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE, l)) {
|
---|
| 267 | SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_INTERNAL_ERROR);
|
---|
| 268 | return 0;
|
---|
| 269 | }
|
---|
| 270 | return l + SSL_HM_HEADER_LENGTH(s);
|
---|
| 271 | }
|
---|
| 272 |
|
---|
| 273 | WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst)
|
---|
| 274 | {
|
---|
| 275 | void (*cb) (const SSL *ssl, int type, int val) = NULL;
|
---|
| 276 |
|
---|
| 277 | #ifndef OPENSSL_NO_SCTP
|
---|
| 278 | if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
|
---|
| 279 | WORK_STATE ret;
|
---|
| 280 | ret = dtls_wait_for_dry(s);
|
---|
| 281 | if (ret != WORK_FINISHED_CONTINUE)
|
---|
| 282 | return ret;
|
---|
| 283 | }
|
---|
| 284 | #endif
|
---|
| 285 |
|
---|
| 286 | /* clean a few things up */
|
---|
| 287 | ssl3_cleanup_key_block(s);
|
---|
| 288 |
|
---|
| 289 | if (!SSL_IS_DTLS(s)) {
|
---|
| 290 | /*
|
---|
| 291 | * We don't do this in DTLS because we may still need the init_buf
|
---|
| 292 | * in case there are any unexpected retransmits
|
---|
| 293 | */
|
---|
| 294 | BUF_MEM_free(s->init_buf);
|
---|
| 295 | s->init_buf = NULL;
|
---|
| 296 | }
|
---|
| 297 |
|
---|
| 298 | ssl_free_wbio_buffer(s);
|
---|
| 299 |
|
---|
| 300 | s->init_num = 0;
|
---|
| 301 |
|
---|
| 302 | if (!s->server || s->renegotiate == 2) {
|
---|
| 303 | /* skipped if we just sent a HelloRequest */
|
---|
| 304 | s->renegotiate = 0;
|
---|
| 305 | s->new_session = 0;
|
---|
| 306 |
|
---|
| 307 | if (s->server) {
|
---|
| 308 | ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
|
---|
| 309 |
|
---|
| 310 | s->ctx->stats.sess_accept_good++;
|
---|
| 311 | s->handshake_func = ossl_statem_accept;
|
---|
| 312 | } else {
|
---|
| 313 | ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
|
---|
| 314 | if (s->hit)
|
---|
| 315 | s->ctx->stats.sess_hit++;
|
---|
| 316 |
|
---|
| 317 | s->handshake_func = ossl_statem_connect;
|
---|
| 318 | s->ctx->stats.sess_connect_good++;
|
---|
| 319 | }
|
---|
| 320 |
|
---|
| 321 | if (s->info_callback != NULL)
|
---|
| 322 | cb = s->info_callback;
|
---|
| 323 | else if (s->ctx->info_callback != NULL)
|
---|
| 324 | cb = s->ctx->info_callback;
|
---|
| 325 |
|
---|
| 326 | if (cb != NULL)
|
---|
| 327 | cb(s, SSL_CB_HANDSHAKE_DONE, 1);
|
---|
| 328 |
|
---|
| 329 | if (SSL_IS_DTLS(s)) {
|
---|
| 330 | /* done with handshaking */
|
---|
| 331 | s->d1->handshake_read_seq = 0;
|
---|
| 332 | s->d1->handshake_write_seq = 0;
|
---|
| 333 | s->d1->next_handshake_write_seq = 0;
|
---|
| 334 | dtls1_clear_received_buffer(s);
|
---|
| 335 | }
|
---|
| 336 | }
|
---|
| 337 |
|
---|
| 338 | return WORK_FINISHED_STOP;
|
---|
| 339 | }
|
---|
| 340 |
|
---|
| 341 | int tls_get_message_header(SSL *s, int *mt)
|
---|
| 342 | {
|
---|
| 343 | /* s->init_num < SSL3_HM_HEADER_LENGTH */
|
---|
| 344 | int skip_message, i, recvd_type, al;
|
---|
| 345 | unsigned char *p;
|
---|
| 346 | unsigned long l;
|
---|
| 347 |
|
---|
| 348 | p = (unsigned char *)s->init_buf->data;
|
---|
| 349 |
|
---|
| 350 | do {
|
---|
| 351 | while (s->init_num < SSL3_HM_HEADER_LENGTH) {
|
---|
| 352 | i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &recvd_type,
|
---|
| 353 | &p[s->init_num],
|
---|
| 354 | SSL3_HM_HEADER_LENGTH - s->init_num,
|
---|
| 355 | 0);
|
---|
| 356 | if (i <= 0) {
|
---|
| 357 | s->rwstate = SSL_READING;
|
---|
| 358 | return 0;
|
---|
| 359 | }
|
---|
| 360 | if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
|
---|
| 361 | /*
|
---|
| 362 | * A ChangeCipherSpec must be a single byte and may not occur
|
---|
| 363 | * in the middle of a handshake message.
|
---|
| 364 | */
|
---|
| 365 | if (s->init_num != 0 || i != 1 || p[0] != SSL3_MT_CCS) {
|
---|
| 366 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
| 367 | SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER,
|
---|
| 368 | SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
---|
| 369 | goto f_err;
|
---|
| 370 | }
|
---|
| 371 | s->s3->tmp.message_type = *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
|
---|
| 372 | s->init_num = i - 1;
|
---|
| 373 | s->init_msg = s->init_buf->data;
|
---|
| 374 | s->s3->tmp.message_size = i;
|
---|
| 375 | return 1;
|
---|
| 376 | } else if (recvd_type != SSL3_RT_HANDSHAKE) {
|
---|
| 377 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
| 378 | SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, SSL_R_CCS_RECEIVED_EARLY);
|
---|
| 379 | goto f_err;
|
---|
| 380 | }
|
---|
| 381 | s->init_num += i;
|
---|
| 382 | }
|
---|
| 383 |
|
---|
| 384 | skip_message = 0;
|
---|
| 385 | if (!s->server)
|
---|
| 386 | if (p[0] == SSL3_MT_HELLO_REQUEST)
|
---|
| 387 | /*
|
---|
| 388 | * The server may always send 'Hello Request' messages --
|
---|
| 389 | * we are doing a handshake anyway now, so ignore them if
|
---|
| 390 | * their format is correct. Does not count for 'Finished'
|
---|
| 391 | * MAC.
|
---|
| 392 | */
|
---|
| 393 | if (p[1] == 0 && p[2] == 0 && p[3] == 0) {
|
---|
| 394 | s->init_num = 0;
|
---|
| 395 | skip_message = 1;
|
---|
| 396 |
|
---|
| 397 | if (s->msg_callback)
|
---|
| 398 | s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
|
---|
| 399 | p, SSL3_HM_HEADER_LENGTH, s,
|
---|
| 400 | s->msg_callback_arg);
|
---|
| 401 | }
|
---|
| 402 | } while (skip_message);
|
---|
| 403 | /* s->init_num == SSL3_HM_HEADER_LENGTH */
|
---|
| 404 |
|
---|
| 405 | *mt = *p;
|
---|
| 406 | s->s3->tmp.message_type = *(p++);
|
---|
| 407 |
|
---|
| 408 | if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
|
---|
| 409 | /*
|
---|
| 410 | * Only happens with SSLv3+ in an SSLv2 backward compatible
|
---|
| 411 | * ClientHello
|
---|
| 412 | *
|
---|
| 413 | * Total message size is the remaining record bytes to read
|
---|
| 414 | * plus the SSL3_HM_HEADER_LENGTH bytes that we already read
|
---|
| 415 | */
|
---|
| 416 | l = RECORD_LAYER_get_rrec_length(&s->rlayer)
|
---|
| 417 | + SSL3_HM_HEADER_LENGTH;
|
---|
| 418 | s->s3->tmp.message_size = l;
|
---|
| 419 |
|
---|
| 420 | s->init_msg = s->init_buf->data;
|
---|
| 421 | s->init_num = SSL3_HM_HEADER_LENGTH;
|
---|
| 422 | } else {
|
---|
| 423 | n2l3(p, l);
|
---|
| 424 | /* BUF_MEM_grow takes an 'int' parameter */
|
---|
| 425 | if (l > (INT_MAX - SSL3_HM_HEADER_LENGTH)) {
|
---|
| 426 | al = SSL_AD_ILLEGAL_PARAMETER;
|
---|
| 427 | SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, SSL_R_EXCESSIVE_MESSAGE_SIZE);
|
---|
| 428 | goto f_err;
|
---|
| 429 | }
|
---|
| 430 | s->s3->tmp.message_size = l;
|
---|
| 431 |
|
---|
| 432 | s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;
|
---|
| 433 | s->init_num = 0;
|
---|
| 434 | }
|
---|
| 435 |
|
---|
| 436 | return 1;
|
---|
| 437 | f_err:
|
---|
| 438 | ssl3_send_alert(s, SSL3_AL_FATAL, al);
|
---|
| 439 | return 0;
|
---|
| 440 | }
|
---|
| 441 |
|
---|
| 442 | int tls_get_message_body(SSL *s, unsigned long *len)
|
---|
| 443 | {
|
---|
| 444 | long n;
|
---|
| 445 | unsigned char *p;
|
---|
| 446 | int i;
|
---|
| 447 |
|
---|
| 448 | if (s->s3->tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {
|
---|
| 449 | /* We've already read everything in */
|
---|
| 450 | *len = (unsigned long)s->init_num;
|
---|
| 451 | return 1;
|
---|
| 452 | }
|
---|
| 453 |
|
---|
| 454 | p = s->init_msg;
|
---|
| 455 | n = s->s3->tmp.message_size - s->init_num;
|
---|
| 456 | while (n > 0) {
|
---|
| 457 | i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,
|
---|
| 458 | &p[s->init_num], n, 0);
|
---|
| 459 | if (i <= 0) {
|
---|
| 460 | s->rwstate = SSL_READING;
|
---|
| 461 | *len = 0;
|
---|
| 462 | return 0;
|
---|
| 463 | }
|
---|
| 464 | s->init_num += i;
|
---|
| 465 | n -= i;
|
---|
| 466 | }
|
---|
| 467 |
|
---|
| 468 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
---|
| 469 | /*
|
---|
| 470 | * If receiving Finished, record MAC of prior handshake messages for
|
---|
| 471 | * Finished verification.
|
---|
| 472 | */
|
---|
| 473 | if (*s->init_buf->data == SSL3_MT_FINISHED)
|
---|
| 474 | ssl3_take_mac(s);
|
---|
| 475 | #endif
|
---|
| 476 |
|
---|
| 477 | /* Feed this message into MAC computation. */
|
---|
| 478 | if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
|
---|
| 479 | if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
|
---|
| 480 | s->init_num)) {
|
---|
| 481 | SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_EVP_LIB);
|
---|
| 482 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
|
---|
| 483 | *len = 0;
|
---|
| 484 | return 0;
|
---|
| 485 | }
|
---|
| 486 | if (s->msg_callback)
|
---|
| 487 | s->msg_callback(0, SSL2_VERSION, 0, s->init_buf->data,
|
---|
| 488 | (size_t)s->init_num, s, s->msg_callback_arg);
|
---|
| 489 | } else {
|
---|
| 490 | if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
|
---|
| 491 | s->init_num + SSL3_HM_HEADER_LENGTH)) {
|
---|
| 492 | SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_EVP_LIB);
|
---|
| 493 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
|
---|
| 494 | *len = 0;
|
---|
| 495 | return 0;
|
---|
| 496 | }
|
---|
| 497 | if (s->msg_callback)
|
---|
| 498 | s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,
|
---|
| 499 | (size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,
|
---|
| 500 | s->msg_callback_arg);
|
---|
| 501 | }
|
---|
| 502 |
|
---|
| 503 | /*
|
---|
| 504 | * init_num should never be negative...should probably be declared
|
---|
| 505 | * unsigned
|
---|
| 506 | */
|
---|
| 507 | if (s->init_num < 0) {
|
---|
| 508 | SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_INTERNAL_ERROR);
|
---|
| 509 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
|
---|
| 510 | *len = 0;
|
---|
| 511 | return 0;
|
---|
| 512 | }
|
---|
| 513 | *len = (unsigned long)s->init_num;
|
---|
| 514 | return 1;
|
---|
| 515 | }
|
---|
| 516 |
|
---|
| 517 | int ssl_cert_type(const X509 *x, const EVP_PKEY *pk)
|
---|
| 518 | {
|
---|
| 519 | if (pk == NULL && (pk = X509_get0_pubkey(x)) == NULL)
|
---|
| 520 | return -1;
|
---|
| 521 |
|
---|
| 522 | switch (EVP_PKEY_id(pk)) {
|
---|
| 523 | default:
|
---|
| 524 | return -1;
|
---|
| 525 | case EVP_PKEY_RSA:
|
---|
| 526 | return SSL_PKEY_RSA_ENC;
|
---|
| 527 | case EVP_PKEY_DSA:
|
---|
| 528 | return SSL_PKEY_DSA_SIGN;
|
---|
| 529 | #ifndef OPENSSL_NO_EC
|
---|
| 530 | case EVP_PKEY_EC:
|
---|
| 531 | return SSL_PKEY_ECC;
|
---|
| 532 | #endif
|
---|
| 533 | #ifndef OPENSSL_NO_GOST
|
---|
| 534 | case NID_id_GostR3410_2001:
|
---|
| 535 | return SSL_PKEY_GOST01;
|
---|
| 536 | case NID_id_GostR3410_2012_256:
|
---|
| 537 | return SSL_PKEY_GOST12_256;
|
---|
| 538 | case NID_id_GostR3410_2012_512:
|
---|
| 539 | return SSL_PKEY_GOST12_512;
|
---|
| 540 | #endif
|
---|
| 541 | }
|
---|
| 542 | }
|
---|
| 543 |
|
---|
| 544 | int ssl_verify_alarm_type(long type)
|
---|
| 545 | {
|
---|
| 546 | int al;
|
---|
| 547 |
|
---|
| 548 | switch (type) {
|
---|
| 549 | case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
---|
| 550 | case X509_V_ERR_UNABLE_TO_GET_CRL:
|
---|
| 551 | case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
|
---|
| 552 | al = SSL_AD_UNKNOWN_CA;
|
---|
| 553 | break;
|
---|
| 554 | case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
|
---|
| 555 | case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
|
---|
| 556 | case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
|
---|
| 557 | case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
|
---|
| 558 | case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
|
---|
| 559 | case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
|
---|
| 560 | case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
|
---|
| 561 | case X509_V_ERR_CERT_NOT_YET_VALID:
|
---|
| 562 | case X509_V_ERR_CRL_NOT_YET_VALID:
|
---|
| 563 | case X509_V_ERR_CERT_UNTRUSTED:
|
---|
| 564 | case X509_V_ERR_CERT_REJECTED:
|
---|
| 565 | case X509_V_ERR_HOSTNAME_MISMATCH:
|
---|
| 566 | case X509_V_ERR_EMAIL_MISMATCH:
|
---|
| 567 | case X509_V_ERR_IP_ADDRESS_MISMATCH:
|
---|
| 568 | case X509_V_ERR_DANE_NO_MATCH:
|
---|
| 569 | case X509_V_ERR_EE_KEY_TOO_SMALL:
|
---|
| 570 | case X509_V_ERR_CA_KEY_TOO_SMALL:
|
---|
| 571 | case X509_V_ERR_CA_MD_TOO_WEAK:
|
---|
| 572 | al = SSL_AD_BAD_CERTIFICATE;
|
---|
| 573 | break;
|
---|
| 574 | case X509_V_ERR_CERT_SIGNATURE_FAILURE:
|
---|
| 575 | case X509_V_ERR_CRL_SIGNATURE_FAILURE:
|
---|
| 576 | al = SSL_AD_DECRYPT_ERROR;
|
---|
| 577 | break;
|
---|
| 578 | case X509_V_ERR_CERT_HAS_EXPIRED:
|
---|
| 579 | case X509_V_ERR_CRL_HAS_EXPIRED:
|
---|
| 580 | al = SSL_AD_CERTIFICATE_EXPIRED;
|
---|
| 581 | break;
|
---|
| 582 | case X509_V_ERR_CERT_REVOKED:
|
---|
| 583 | al = SSL_AD_CERTIFICATE_REVOKED;
|
---|
| 584 | break;
|
---|
| 585 | case X509_V_ERR_UNSPECIFIED:
|
---|
| 586 | case X509_V_ERR_OUT_OF_MEM:
|
---|
| 587 | case X509_V_ERR_INVALID_CALL:
|
---|
| 588 | case X509_V_ERR_STORE_LOOKUP:
|
---|
| 589 | al = SSL_AD_INTERNAL_ERROR;
|
---|
| 590 | break;
|
---|
| 591 | case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
|
---|
| 592 | case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
|
---|
| 593 | case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
|
---|
| 594 | case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
|
---|
| 595 | case X509_V_ERR_CERT_CHAIN_TOO_LONG:
|
---|
| 596 | case X509_V_ERR_PATH_LENGTH_EXCEEDED:
|
---|
| 597 | case X509_V_ERR_INVALID_CA:
|
---|
| 598 | al = SSL_AD_UNKNOWN_CA;
|
---|
| 599 | break;
|
---|
| 600 | case X509_V_ERR_APPLICATION_VERIFICATION:
|
---|
| 601 | al = SSL_AD_HANDSHAKE_FAILURE;
|
---|
| 602 | break;
|
---|
| 603 | case X509_V_ERR_INVALID_PURPOSE:
|
---|
| 604 | al = SSL_AD_UNSUPPORTED_CERTIFICATE;
|
---|
| 605 | break;
|
---|
| 606 | default:
|
---|
| 607 | al = SSL_AD_CERTIFICATE_UNKNOWN;
|
---|
| 608 | break;
|
---|
| 609 | }
|
---|
| 610 | return (al);
|
---|
| 611 | }
|
---|
| 612 |
|
---|
| 613 | int ssl_allow_compression(SSL *s)
|
---|
| 614 | {
|
---|
| 615 | if (s->options & SSL_OP_NO_COMPRESSION)
|
---|
| 616 | return 0;
|
---|
| 617 | return ssl_security(s, SSL_SECOP_COMPRESSION, 0, 0, NULL);
|
---|
| 618 | }
|
---|
| 619 |
|
---|
| 620 | static int version_cmp(const SSL *s, int a, int b)
|
---|
| 621 | {
|
---|
| 622 | int dtls = SSL_IS_DTLS(s);
|
---|
| 623 |
|
---|
| 624 | if (a == b)
|
---|
| 625 | return 0;
|
---|
| 626 | if (!dtls)
|
---|
| 627 | return a < b ? -1 : 1;
|
---|
| 628 | return DTLS_VERSION_LT(a, b) ? -1 : 1;
|
---|
| 629 | }
|
---|
| 630 |
|
---|
| 631 | typedef struct {
|
---|
| 632 | int version;
|
---|
| 633 | const SSL_METHOD *(*cmeth) (void);
|
---|
| 634 | const SSL_METHOD *(*smeth) (void);
|
---|
| 635 | } version_info;
|
---|
| 636 |
|
---|
| 637 | #if TLS_MAX_VERSION != TLS1_2_VERSION
|
---|
| 638 | # error Code needs update for TLS_method() support beyond TLS1_2_VERSION.
|
---|
| 639 | #endif
|
---|
| 640 |
|
---|
| 641 | static const version_info tls_version_table[] = {
|
---|
| 642 | #ifndef OPENSSL_NO_TLS1_2
|
---|
| 643 | {TLS1_2_VERSION, tlsv1_2_client_method, tlsv1_2_server_method},
|
---|
| 644 | #else
|
---|
| 645 | {TLS1_2_VERSION, NULL, NULL},
|
---|
| 646 | #endif
|
---|
| 647 | #ifndef OPENSSL_NO_TLS1_1
|
---|
| 648 | {TLS1_1_VERSION, tlsv1_1_client_method, tlsv1_1_server_method},
|
---|
| 649 | #else
|
---|
| 650 | {TLS1_1_VERSION, NULL, NULL},
|
---|
| 651 | #endif
|
---|
| 652 | #ifndef OPENSSL_NO_TLS1
|
---|
| 653 | {TLS1_VERSION, tlsv1_client_method, tlsv1_server_method},
|
---|
| 654 | #else
|
---|
| 655 | {TLS1_VERSION, NULL, NULL},
|
---|
| 656 | #endif
|
---|
| 657 | #ifndef OPENSSL_NO_SSL3
|
---|
| 658 | {SSL3_VERSION, sslv3_client_method, sslv3_server_method},
|
---|
| 659 | #else
|
---|
| 660 | {SSL3_VERSION, NULL, NULL},
|
---|
| 661 | #endif
|
---|
| 662 | {0, NULL, NULL},
|
---|
| 663 | };
|
---|
| 664 |
|
---|
| 665 | #if DTLS_MAX_VERSION != DTLS1_2_VERSION
|
---|
| 666 | # error Code needs update for DTLS_method() support beyond DTLS1_2_VERSION.
|
---|
| 667 | #endif
|
---|
| 668 |
|
---|
| 669 | static const version_info dtls_version_table[] = {
|
---|
| 670 | #ifndef OPENSSL_NO_DTLS1_2
|
---|
| 671 | {DTLS1_2_VERSION, dtlsv1_2_client_method, dtlsv1_2_server_method},
|
---|
| 672 | #else
|
---|
| 673 | {DTLS1_2_VERSION, NULL, NULL},
|
---|
| 674 | #endif
|
---|
| 675 | #ifndef OPENSSL_NO_DTLS1
|
---|
| 676 | {DTLS1_VERSION, dtlsv1_client_method, dtlsv1_server_method},
|
---|
| 677 | {DTLS1_BAD_VER, dtls_bad_ver_client_method, NULL},
|
---|
| 678 | #else
|
---|
| 679 | {DTLS1_VERSION, NULL, NULL},
|
---|
| 680 | {DTLS1_BAD_VER, NULL, NULL},
|
---|
| 681 | #endif
|
---|
| 682 | {0, NULL, NULL},
|
---|
| 683 | };
|
---|
| 684 |
|
---|
| 685 | /*
|
---|
| 686 | * ssl_method_error - Check whether an SSL_METHOD is enabled.
|
---|
| 687 | *
|
---|
| 688 | * @s: The SSL handle for the candidate method
|
---|
| 689 | * @method: the intended method.
|
---|
| 690 | *
|
---|
| 691 | * Returns 0 on success, or an SSL error reason on failure.
|
---|
| 692 | */
|
---|
| 693 | static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
|
---|
| 694 | {
|
---|
| 695 | int version = method->version;
|
---|
| 696 |
|
---|
| 697 | if ((s->min_proto_version != 0 &&
|
---|
| 698 | version_cmp(s, version, s->min_proto_version) < 0) ||
|
---|
| 699 | ssl_security(s, SSL_SECOP_VERSION, 0, version, NULL) == 0)
|
---|
| 700 | return SSL_R_VERSION_TOO_LOW;
|
---|
| 701 |
|
---|
| 702 | if (s->max_proto_version != 0 &&
|
---|
| 703 | version_cmp(s, version, s->max_proto_version) > 0)
|
---|
| 704 | return SSL_R_VERSION_TOO_HIGH;
|
---|
| 705 |
|
---|
| 706 | if ((s->options & method->mask) != 0)
|
---|
| 707 | return SSL_R_UNSUPPORTED_PROTOCOL;
|
---|
| 708 | if ((method->flags & SSL_METHOD_NO_SUITEB) != 0 && tls1_suiteb(s))
|
---|
| 709 | return SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE;
|
---|
| 710 | else if ((method->flags & SSL_METHOD_NO_FIPS) != 0 && FIPS_mode())
|
---|
| 711 | return SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE;
|
---|
| 712 |
|
---|
| 713 | return 0;
|
---|
| 714 | }
|
---|
| 715 |
|
---|
| 716 | /*
|
---|
| 717 | * ssl_version_supported - Check that the specified `version` is supported by
|
---|
| 718 | * `SSL *` instance
|
---|
| 719 | *
|
---|
| 720 | * @s: The SSL handle for the candidate method
|
---|
| 721 | * @version: Protocol version to test against
|
---|
| 722 | *
|
---|
| 723 | * Returns 1 when supported, otherwise 0
|
---|
| 724 | */
|
---|
| 725 | int ssl_version_supported(const SSL *s, int version)
|
---|
| 726 | {
|
---|
| 727 | const version_info *vent;
|
---|
| 728 | const version_info *table;
|
---|
| 729 |
|
---|
| 730 | switch (s->method->version) {
|
---|
| 731 | default:
|
---|
| 732 | /* Version should match method version for non-ANY method */
|
---|
| 733 | return version_cmp(s, version, s->version) == 0;
|
---|
| 734 | case TLS_ANY_VERSION:
|
---|
| 735 | table = tls_version_table;
|
---|
| 736 | break;
|
---|
| 737 | case DTLS_ANY_VERSION:
|
---|
| 738 | table = dtls_version_table;
|
---|
| 739 | break;
|
---|
| 740 | }
|
---|
| 741 |
|
---|
| 742 | for (vent = table;
|
---|
| 743 | vent->version != 0 && version_cmp(s, version, vent->version) <= 0;
|
---|
| 744 | ++vent) {
|
---|
| 745 | if (vent->cmeth != NULL &&
|
---|
| 746 | version_cmp(s, version, vent->version) == 0 &&
|
---|
| 747 | ssl_method_error(s, vent->cmeth()) == 0) {
|
---|
| 748 | return 1;
|
---|
| 749 | }
|
---|
| 750 | }
|
---|
| 751 | return 0;
|
---|
| 752 | }
|
---|
| 753 |
|
---|
| 754 | /*
|
---|
| 755 | * ssl_check_version_downgrade - In response to RFC7507 SCSV version
|
---|
| 756 | * fallback indication from a client check whether we're using the highest
|
---|
| 757 | * supported protocol version.
|
---|
| 758 | *
|
---|
| 759 | * @s server SSL handle.
|
---|
| 760 | *
|
---|
| 761 | * Returns 1 when using the highest enabled version, 0 otherwise.
|
---|
| 762 | */
|
---|
| 763 | int ssl_check_version_downgrade(SSL *s)
|
---|
| 764 | {
|
---|
| 765 | const version_info *vent;
|
---|
| 766 | const version_info *table;
|
---|
| 767 |
|
---|
| 768 | /*
|
---|
| 769 | * Check that the current protocol is the highest enabled version
|
---|
| 770 | * (according to s->ctx->method, as version negotiation may have changed
|
---|
| 771 | * s->method).
|
---|
| 772 | */
|
---|
| 773 | if (s->version == s->ctx->method->version)
|
---|
| 774 | return 1;
|
---|
| 775 |
|
---|
| 776 | /*
|
---|
| 777 | * Apparently we're using a version-flexible SSL_METHOD (not at its
|
---|
| 778 | * highest protocol version).
|
---|
| 779 | */
|
---|
| 780 | if (s->ctx->method->version == TLS_method()->version)
|
---|
| 781 | table = tls_version_table;
|
---|
| 782 | else if (s->ctx->method->version == DTLS_method()->version)
|
---|
| 783 | table = dtls_version_table;
|
---|
| 784 | else {
|
---|
| 785 | /* Unexpected state; fail closed. */
|
---|
| 786 | return 0;
|
---|
| 787 | }
|
---|
| 788 |
|
---|
| 789 | for (vent = table; vent->version != 0; ++vent) {
|
---|
| 790 | if (vent->smeth != NULL && ssl_method_error(s, vent->smeth()) == 0)
|
---|
| 791 | return s->version == vent->version;
|
---|
| 792 | }
|
---|
| 793 | return 0;
|
---|
| 794 | }
|
---|
| 795 |
|
---|
| 796 | /*
|
---|
| 797 | * ssl_set_version_bound - set an upper or lower bound on the supported (D)TLS
|
---|
| 798 | * protocols, provided the initial (D)TLS method is version-flexible. This
|
---|
| 799 | * function sanity-checks the proposed value and makes sure the method is
|
---|
| 800 | * version-flexible, then sets the limit if all is well.
|
---|
| 801 | *
|
---|
| 802 | * @method_version: The version of the current SSL_METHOD.
|
---|
| 803 | * @version: the intended limit.
|
---|
| 804 | * @bound: pointer to limit to be updated.
|
---|
| 805 | *
|
---|
| 806 | * Returns 1 on success, 0 on failure.
|
---|
| 807 | */
|
---|
| 808 | int ssl_set_version_bound(int method_version, int version, int *bound)
|
---|
| 809 | {
|
---|
| 810 | if (version == 0) {
|
---|
| 811 | *bound = version;
|
---|
| 812 | return 1;
|
---|
| 813 | }
|
---|
| 814 |
|
---|
| 815 | /*-
|
---|
| 816 | * Restrict TLS methods to TLS protocol versions.
|
---|
| 817 | * Restrict DTLS methods to DTLS protocol versions.
|
---|
| 818 | * Note, DTLS version numbers are decreasing, use comparison macros.
|
---|
| 819 | *
|
---|
| 820 | * Note that for both lower-bounds we use explicit versions, not
|
---|
| 821 | * (D)TLS_MIN_VERSION. This is because we don't want to break user
|
---|
| 822 | * configurations. If the MIN (supported) version ever rises, the user's
|
---|
| 823 | * "floor" remains valid even if no longer available. We don't expect the
|
---|
| 824 | * MAX ceiling to ever get lower, so making that variable makes sense.
|
---|
| 825 | */
|
---|
| 826 | switch (method_version) {
|
---|
| 827 | default:
|
---|
| 828 | /*
|
---|
| 829 | * XXX For fixed version methods, should we always fail and not set any
|
---|
| 830 | * bounds, always succeed and not set any bounds, or set the bounds and
|
---|
| 831 | * arrange to fail later if they are not met? At present fixed-version
|
---|
| 832 | * methods are not subject to controls that disable individual protocol
|
---|
| 833 | * versions.
|
---|
| 834 | */
|
---|
| 835 | return 0;
|
---|
| 836 |
|
---|
| 837 | case TLS_ANY_VERSION:
|
---|
| 838 | if (version < SSL3_VERSION || version > TLS_MAX_VERSION)
|
---|
| 839 | return 0;
|
---|
| 840 | break;
|
---|
| 841 |
|
---|
| 842 | case DTLS_ANY_VERSION:
|
---|
| 843 | if (DTLS_VERSION_GT(version, DTLS_MAX_VERSION) ||
|
---|
| 844 | DTLS_VERSION_LT(version, DTLS1_BAD_VER))
|
---|
| 845 | return 0;
|
---|
| 846 | break;
|
---|
| 847 | }
|
---|
| 848 |
|
---|
| 849 | *bound = version;
|
---|
| 850 | return 1;
|
---|
| 851 | }
|
---|
| 852 |
|
---|
| 853 | /*
|
---|
| 854 | * ssl_choose_server_version - Choose server (D)TLS version. Called when the
|
---|
| 855 | * client HELLO is received to select the final server protocol version and
|
---|
| 856 | * the version specific method.
|
---|
| 857 | *
|
---|
| 858 | * @s: server SSL handle.
|
---|
| 859 | *
|
---|
| 860 | * Returns 0 on success or an SSL error reason number on failure.
|
---|
| 861 | */
|
---|
| 862 | int ssl_choose_server_version(SSL *s)
|
---|
| 863 | {
|
---|
| 864 | /*-
|
---|
| 865 | * With version-flexible methods we have an initial state with:
|
---|
| 866 | *
|
---|
| 867 | * s->method->version == (D)TLS_ANY_VERSION,
|
---|
| 868 | * s->version == (D)TLS_MAX_VERSION.
|
---|
| 869 | *
|
---|
| 870 | * So we detect version-flexible methods via the method version, not the
|
---|
| 871 | * handle version.
|
---|
| 872 | */
|
---|
| 873 | int server_version = s->method->version;
|
---|
| 874 | int client_version = s->client_version;
|
---|
| 875 | const version_info *vent;
|
---|
| 876 | const version_info *table;
|
---|
| 877 | int disabled = 0;
|
---|
| 878 |
|
---|
| 879 | switch (server_version) {
|
---|
| 880 | default:
|
---|
| 881 | if (version_cmp(s, client_version, s->version) < 0)
|
---|
| 882 | return SSL_R_WRONG_SSL_VERSION;
|
---|
| 883 | /*
|
---|
| 884 | * If this SSL handle is not from a version flexible method we don't
|
---|
| 885 | * (and never did) check min/max FIPS or Suite B constraints. Hope
|
---|
| 886 | * that's OK. It is up to the caller to not choose fixed protocol
|
---|
| 887 | * versions they don't want. If not, then easy to fix, just return
|
---|
| 888 | * ssl_method_error(s, s->method)
|
---|
| 889 | */
|
---|
| 890 | return 0;
|
---|
| 891 | case TLS_ANY_VERSION:
|
---|
| 892 | table = tls_version_table;
|
---|
| 893 | break;
|
---|
| 894 | case DTLS_ANY_VERSION:
|
---|
| 895 | table = dtls_version_table;
|
---|
| 896 | break;
|
---|
| 897 | }
|
---|
| 898 |
|
---|
| 899 | for (vent = table; vent->version != 0; ++vent) {
|
---|
| 900 | const SSL_METHOD *method;
|
---|
| 901 |
|
---|
| 902 | if (vent->smeth == NULL ||
|
---|
| 903 | version_cmp(s, client_version, vent->version) < 0)
|
---|
| 904 | continue;
|
---|
| 905 | method = vent->smeth();
|
---|
| 906 | if (ssl_method_error(s, method) == 0) {
|
---|
| 907 | s->version = vent->version;
|
---|
| 908 | s->method = method;
|
---|
| 909 | return 0;
|
---|
| 910 | }
|
---|
| 911 | disabled = 1;
|
---|
| 912 | }
|
---|
| 913 | return disabled ? SSL_R_UNSUPPORTED_PROTOCOL : SSL_R_VERSION_TOO_LOW;
|
---|
| 914 | }
|
---|
| 915 |
|
---|
| 916 | /*
|
---|
| 917 | * ssl_choose_client_version - Choose client (D)TLS version. Called when the
|
---|
| 918 | * server HELLO is received to select the final client protocol version and
|
---|
| 919 | * the version specific method.
|
---|
| 920 | *
|
---|
| 921 | * @s: client SSL handle.
|
---|
| 922 | * @version: The proposed version from the server's HELLO.
|
---|
| 923 | *
|
---|
| 924 | * Returns 0 on success or an SSL error reason number on failure.
|
---|
| 925 | */
|
---|
| 926 | int ssl_choose_client_version(SSL *s, int version)
|
---|
| 927 | {
|
---|
| 928 | const version_info *vent;
|
---|
| 929 | const version_info *table;
|
---|
| 930 |
|
---|
| 931 | switch (s->method->version) {
|
---|
| 932 | default:
|
---|
| 933 | if (version != s->version)
|
---|
| 934 | return SSL_R_WRONG_SSL_VERSION;
|
---|
| 935 | /*
|
---|
| 936 | * If this SSL handle is not from a version flexible method we don't
|
---|
| 937 | * (and never did) check min/max, FIPS or Suite B constraints. Hope
|
---|
| 938 | * that's OK. It is up to the caller to not choose fixed protocol
|
---|
| 939 | * versions they don't want. If not, then easy to fix, just return
|
---|
| 940 | * ssl_method_error(s, s->method)
|
---|
| 941 | */
|
---|
| 942 | return 0;
|
---|
| 943 | case TLS_ANY_VERSION:
|
---|
| 944 | table = tls_version_table;
|
---|
| 945 | break;
|
---|
| 946 | case DTLS_ANY_VERSION:
|
---|
| 947 | table = dtls_version_table;
|
---|
| 948 | break;
|
---|
| 949 | }
|
---|
| 950 |
|
---|
| 951 | for (vent = table; vent->version != 0; ++vent) {
|
---|
| 952 | const SSL_METHOD *method;
|
---|
| 953 | int err;
|
---|
| 954 |
|
---|
| 955 | if (version != vent->version)
|
---|
| 956 | continue;
|
---|
| 957 | if (vent->cmeth == NULL)
|
---|
| 958 | break;
|
---|
| 959 | method = vent->cmeth();
|
---|
| 960 | err = ssl_method_error(s, method);
|
---|
| 961 | if (err != 0)
|
---|
| 962 | return err;
|
---|
| 963 | s->method = method;
|
---|
| 964 | s->version = version;
|
---|
| 965 | return 0;
|
---|
| 966 | }
|
---|
| 967 |
|
---|
| 968 | return SSL_R_UNSUPPORTED_PROTOCOL;
|
---|
| 969 | }
|
---|
| 970 |
|
---|
| 971 | /*
|
---|
| 972 | * ssl_get_client_min_max_version - get minimum and maximum client version
|
---|
| 973 | * @s: The SSL connection
|
---|
| 974 | * @min_version: The minimum supported version
|
---|
| 975 | * @max_version: The maximum supported version
|
---|
| 976 | *
|
---|
| 977 | * Work out what version we should be using for the initial ClientHello if the
|
---|
| 978 | * version is initially (D)TLS_ANY_VERSION. We apply any explicit SSL_OP_NO_xxx
|
---|
| 979 | * options, the MinProtocol and MaxProtocol configuration commands, any Suite B
|
---|
| 980 | * or FIPS_mode() constraints and any floor imposed by the security level here,
|
---|
| 981 | * so we don't advertise the wrong protocol version to only reject the outcome later.
|
---|
| 982 | *
|
---|
| 983 | * Computing the right floor matters. If, e.g., TLS 1.0 and 1.2 are enabled,
|
---|
| 984 | * TLS 1.1 is disabled, but the security level, Suite-B and/or MinProtocol
|
---|
| 985 | * only allow TLS 1.2, we want to advertise TLS1.2, *not* TLS1.
|
---|
| 986 | *
|
---|
| 987 | * Returns 0 on success or an SSL error reason number on failure. On failure
|
---|
| 988 | * min_version and max_version will also be set to 0.
|
---|
| 989 | */
|
---|
| 990 | int ssl_get_client_min_max_version(const SSL *s, int *min_version,
|
---|
| 991 | int *max_version)
|
---|
| 992 | {
|
---|
| 993 | int version;
|
---|
| 994 | int hole;
|
---|
| 995 | const SSL_METHOD *single = NULL;
|
---|
| 996 | const SSL_METHOD *method;
|
---|
| 997 | const version_info *table;
|
---|
| 998 | const version_info *vent;
|
---|
| 999 |
|
---|
| 1000 | switch (s->method->version) {
|
---|
| 1001 | default:
|
---|
| 1002 | /*
|
---|
| 1003 | * If this SSL handle is not from a version flexible method we don't
|
---|
| 1004 | * (and never did) check min/max FIPS or Suite B constraints. Hope
|
---|
| 1005 | * that's OK. It is up to the caller to not choose fixed protocol
|
---|
| 1006 | * versions they don't want. If not, then easy to fix, just return
|
---|
| 1007 | * ssl_method_error(s, s->method)
|
---|
| 1008 | */
|
---|
| 1009 | *min_version = *max_version = s->version;
|
---|
| 1010 | return 0;
|
---|
| 1011 | case TLS_ANY_VERSION:
|
---|
| 1012 | table = tls_version_table;
|
---|
| 1013 | break;
|
---|
| 1014 | case DTLS_ANY_VERSION:
|
---|
| 1015 | table = dtls_version_table;
|
---|
| 1016 | break;
|
---|
| 1017 | }
|
---|
| 1018 |
|
---|
| 1019 | /*
|
---|
| 1020 | * SSL_OP_NO_X disables all protocols above X *if* there are some protocols
|
---|
| 1021 | * below X enabled. This is required in order to maintain the "version
|
---|
| 1022 | * capability" vector contiguous. Any versions with a NULL client method
|
---|
| 1023 | * (protocol version client is disabled at compile-time) is also a "hole".
|
---|
| 1024 | *
|
---|
| 1025 | * Our initial state is hole == 1, version == 0. That is, versions above
|
---|
| 1026 | * the first version in the method table are disabled (a "hole" above
|
---|
| 1027 | * the valid protocol entries) and we don't have a selected version yet.
|
---|
| 1028 | *
|
---|
| 1029 | * Whenever "hole == 1", and we hit an enabled method, its version becomes
|
---|
| 1030 | * the selected version, and the method becomes a candidate "single"
|
---|
| 1031 | * method. We're no longer in a hole, so "hole" becomes 0.
|
---|
| 1032 | *
|
---|
| 1033 | * If "hole == 0" and we hit an enabled method, then "single" is cleared,
|
---|
| 1034 | * as we support a contiguous range of at least two methods. If we hit
|
---|
| 1035 | * a disabled method, then hole becomes true again, but nothing else
|
---|
| 1036 | * changes yet, because all the remaining methods may be disabled too.
|
---|
| 1037 | * If we again hit an enabled method after the new hole, it becomes
|
---|
| 1038 | * selected, as we start from scratch.
|
---|
| 1039 | */
|
---|
| 1040 | *min_version = version = 0;
|
---|
| 1041 | hole = 1;
|
---|
| 1042 | for (vent = table; vent->version != 0; ++vent) {
|
---|
| 1043 | /*
|
---|
| 1044 | * A table entry with a NULL client method is still a hole in the
|
---|
| 1045 | * "version capability" vector.
|
---|
| 1046 | */
|
---|
| 1047 | if (vent->cmeth == NULL) {
|
---|
| 1048 | hole = 1;
|
---|
| 1049 | continue;
|
---|
| 1050 | }
|
---|
| 1051 | method = vent->cmeth();
|
---|
| 1052 | if (ssl_method_error(s, method) != 0) {
|
---|
| 1053 | hole = 1;
|
---|
| 1054 | } else if (!hole) {
|
---|
| 1055 | single = NULL;
|
---|
| 1056 | *min_version = method->version;
|
---|
| 1057 | } else {
|
---|
| 1058 | version = (single = method)->version;
|
---|
| 1059 | *min_version = version;
|
---|
| 1060 | hole = 0;
|
---|
| 1061 | }
|
---|
| 1062 | }
|
---|
| 1063 |
|
---|
| 1064 | *max_version = version;
|
---|
| 1065 |
|
---|
| 1066 | /* Fail if everything is disabled */
|
---|
| 1067 | if (version == 0)
|
---|
| 1068 | return SSL_R_NO_PROTOCOLS_AVAILABLE;
|
---|
| 1069 |
|
---|
| 1070 | return 0;
|
---|
| 1071 | }
|
---|
| 1072 |
|
---|
| 1073 | /*
|
---|
| 1074 | * ssl_set_client_hello_version - Work out what version we should be using for
|
---|
| 1075 | * the initial ClientHello.
|
---|
| 1076 | *
|
---|
| 1077 | * @s: client SSL handle.
|
---|
| 1078 | *
|
---|
| 1079 | * Returns 0 on success or an SSL error reason number on failure.
|
---|
| 1080 | */
|
---|
| 1081 | int ssl_set_client_hello_version(SSL *s)
|
---|
| 1082 | {
|
---|
| 1083 | int ver_min, ver_max, ret;
|
---|
| 1084 |
|
---|
| 1085 | ret = ssl_get_client_min_max_version(s, &ver_min, &ver_max);
|
---|
| 1086 |
|
---|
| 1087 | if (ret != 0)
|
---|
| 1088 | return ret;
|
---|
| 1089 |
|
---|
| 1090 | s->client_version = s->version = ver_max;
|
---|
| 1091 | return 0;
|
---|
| 1092 | }
|
---|