1 | /*
|
---|
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
3 | *
|
---|
4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
5 | * this file except in compliance with the License. You can obtain a copy
|
---|
6 | * in the file LICENSE in the source distribution or at
|
---|
7 | * https://www.openssl.org/source/license.html
|
---|
8 | */
|
---|
9 |
|
---|
10 | /* ====================================================================
|
---|
11 | * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
---|
12 | * ECC cipher suite support in OpenSSL originally developed by
|
---|
13 | * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
|
---|
14 | */
|
---|
15 |
|
---|
16 | #include <limits.h>
|
---|
17 | #include <string.h>
|
---|
18 | #include <stdio.h>
|
---|
19 | #include "../ssl_locl.h"
|
---|
20 | #include "statem_locl.h"
|
---|
21 | #include <openssl/buffer.h>
|
---|
22 | #include <openssl/objects.h>
|
---|
23 | #include <openssl/evp.h>
|
---|
24 | #include <openssl/x509.h>
|
---|
25 |
|
---|
26 | /*
|
---|
27 | * send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
|
---|
28 | * SSL3_RT_CHANGE_CIPHER_SPEC)
|
---|
29 | */
|
---|
30 | int ssl3_do_write(SSL *s, int type)
|
---|
31 | {
|
---|
32 | int ret;
|
---|
33 |
|
---|
34 | ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
|
---|
35 | s->init_num);
|
---|
36 | if (ret < 0)
|
---|
37 | return (-1);
|
---|
38 | if (type == SSL3_RT_HANDSHAKE)
|
---|
39 | /*
|
---|
40 | * should not be done for 'Hello Request's, but in that case we'll
|
---|
41 | * ignore the result anyway
|
---|
42 | */
|
---|
43 | if (!ssl3_finish_mac(s,
|
---|
44 | (unsigned char *)&s->init_buf->data[s->init_off],
|
---|
45 | ret))
|
---|
46 | return -1;
|
---|
47 |
|
---|
48 | if (ret == s->init_num) {
|
---|
49 | if (s->msg_callback)
|
---|
50 | s->msg_callback(1, s->version, type, s->init_buf->data,
|
---|
51 | (size_t)(s->init_off + s->init_num), s,
|
---|
52 | s->msg_callback_arg);
|
---|
53 | return (1);
|
---|
54 | }
|
---|
55 | s->init_off += ret;
|
---|
56 | s->init_num -= ret;
|
---|
57 | return (0);
|
---|
58 | }
|
---|
59 |
|
---|
60 | int tls_construct_finished(SSL *s, const char *sender, int slen)
|
---|
61 | {
|
---|
62 | unsigned char *p;
|
---|
63 | int i;
|
---|
64 | unsigned long l;
|
---|
65 |
|
---|
66 | p = ssl_handshake_start(s);
|
---|
67 |
|
---|
68 | i = s->method->ssl3_enc->final_finish_mac(s,
|
---|
69 | sender, slen,
|
---|
70 | s->s3->tmp.finish_md);
|
---|
71 | if (i <= 0)
|
---|
72 | return 0;
|
---|
73 | s->s3->tmp.finish_md_len = i;
|
---|
74 | memcpy(p, s->s3->tmp.finish_md, i);
|
---|
75 | l = i;
|
---|
76 |
|
---|
77 | /*
|
---|
78 | * Copy the finished so we can use it for renegotiation checks
|
---|
79 | */
|
---|
80 | if (!s->server) {
|
---|
81 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
82 | memcpy(s->s3->previous_client_finished, s->s3->tmp.finish_md, i);
|
---|
83 | s->s3->previous_client_finished_len = i;
|
---|
84 | } else {
|
---|
85 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
86 | memcpy(s->s3->previous_server_finished, s->s3->tmp.finish_md, i);
|
---|
87 | s->s3->previous_server_finished_len = i;
|
---|
88 | }
|
---|
89 |
|
---|
90 | if (!ssl_set_handshake_header(s, SSL3_MT_FINISHED, l)) {
|
---|
91 | SSLerr(SSL_F_TLS_CONSTRUCT_FINISHED, ERR_R_INTERNAL_ERROR);
|
---|
92 | return 0;
|
---|
93 | }
|
---|
94 |
|
---|
95 | return 1;
|
---|
96 | }
|
---|
97 |
|
---|
98 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
---|
99 | /*
|
---|
100 | * ssl3_take_mac calculates the Finished MAC for the handshakes messages seen
|
---|
101 | * to far.
|
---|
102 | */
|
---|
103 | static void ssl3_take_mac(SSL *s)
|
---|
104 | {
|
---|
105 | const char *sender;
|
---|
106 | int slen;
|
---|
107 | /*
|
---|
108 | * If no new cipher setup return immediately: other functions will set
|
---|
109 | * the appropriate error.
|
---|
110 | */
|
---|
111 | if (s->s3->tmp.new_cipher == NULL)
|
---|
112 | return;
|
---|
113 | if (!s->server) {
|
---|
114 | sender = s->method->ssl3_enc->server_finished_label;
|
---|
115 | slen = s->method->ssl3_enc->server_finished_label_len;
|
---|
116 | } else {
|
---|
117 | sender = s->method->ssl3_enc->client_finished_label;
|
---|
118 | slen = s->method->ssl3_enc->client_finished_label_len;
|
---|
119 | }
|
---|
120 |
|
---|
121 | s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
|
---|
122 | sender,
|
---|
123 | slen,
|
---|
124 | s->s3->tmp.peer_finish_md);
|
---|
125 | }
|
---|
126 | #endif
|
---|
127 |
|
---|
128 | MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL *s, PACKET *pkt)
|
---|
129 | {
|
---|
130 | int al;
|
---|
131 | long remain;
|
---|
132 |
|
---|
133 | remain = PACKET_remaining(pkt);
|
---|
134 | /*
|
---|
135 | * 'Change Cipher Spec' is just a single byte, which should already have
|
---|
136 | * been consumed by ssl_get_message() so there should be no bytes left,
|
---|
137 | * unless we're using DTLS1_BAD_VER, which has an extra 2 bytes
|
---|
138 | */
|
---|
139 | if (SSL_IS_DTLS(s)) {
|
---|
140 | if ((s->version == DTLS1_BAD_VER
|
---|
141 | && remain != DTLS1_CCS_HEADER_LENGTH + 1)
|
---|
142 | || (s->version != DTLS1_BAD_VER
|
---|
143 | && remain != DTLS1_CCS_HEADER_LENGTH - 1)) {
|
---|
144 | al = SSL_AD_ILLEGAL_PARAMETER;
|
---|
145 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
|
---|
146 | SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
---|
147 | goto f_err;
|
---|
148 | }
|
---|
149 | } else {
|
---|
150 | if (remain != 0) {
|
---|
151 | al = SSL_AD_ILLEGAL_PARAMETER;
|
---|
152 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC,
|
---|
153 | SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
---|
154 | goto f_err;
|
---|
155 | }
|
---|
156 | }
|
---|
157 |
|
---|
158 | /* Check we have a cipher to change to */
|
---|
159 | if (s->s3->tmp.new_cipher == NULL) {
|
---|
160 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
161 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC, SSL_R_CCS_RECEIVED_EARLY);
|
---|
162 | goto f_err;
|
---|
163 | }
|
---|
164 |
|
---|
165 | s->s3->change_cipher_spec = 1;
|
---|
166 | if (!ssl3_do_change_cipher_spec(s)) {
|
---|
167 | al = SSL_AD_INTERNAL_ERROR;
|
---|
168 | SSLerr(SSL_F_TLS_PROCESS_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
|
---|
169 | goto f_err;
|
---|
170 | }
|
---|
171 |
|
---|
172 | if (SSL_IS_DTLS(s)) {
|
---|
173 | dtls1_reset_seq_numbers(s, SSL3_CC_READ);
|
---|
174 |
|
---|
175 | if (s->version == DTLS1_BAD_VER)
|
---|
176 | s->d1->handshake_read_seq++;
|
---|
177 |
|
---|
178 | #ifndef OPENSSL_NO_SCTP
|
---|
179 | /*
|
---|
180 | * Remember that a CCS has been received, so that an old key of
|
---|
181 | * SCTP-Auth can be deleted when a CCS is sent. Will be ignored if no
|
---|
182 | * SCTP is used
|
---|
183 | */
|
---|
184 | BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD, 1, NULL);
|
---|
185 | #endif
|
---|
186 | }
|
---|
187 |
|
---|
188 | return MSG_PROCESS_CONTINUE_READING;
|
---|
189 | f_err:
|
---|
190 | ssl3_send_alert(s, SSL3_AL_FATAL, al);
|
---|
191 | ossl_statem_set_error(s);
|
---|
192 | return MSG_PROCESS_ERROR;
|
---|
193 | }
|
---|
194 |
|
---|
195 | MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt)
|
---|
196 | {
|
---|
197 | int al, i;
|
---|
198 |
|
---|
199 | /* If this occurs, we have missed a message */
|
---|
200 | if (!s->s3->change_cipher_spec) {
|
---|
201 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
202 | SSLerr(SSL_F_TLS_PROCESS_FINISHED, SSL_R_GOT_A_FIN_BEFORE_A_CCS);
|
---|
203 | goto f_err;
|
---|
204 | }
|
---|
205 | s->s3->change_cipher_spec = 0;
|
---|
206 |
|
---|
207 | i = s->s3->tmp.peer_finish_md_len;
|
---|
208 |
|
---|
209 | if ((unsigned long)i != PACKET_remaining(pkt)) {
|
---|
210 | al = SSL_AD_DECODE_ERROR;
|
---|
211 | SSLerr(SSL_F_TLS_PROCESS_FINISHED, SSL_R_BAD_DIGEST_LENGTH);
|
---|
212 | goto f_err;
|
---|
213 | }
|
---|
214 |
|
---|
215 | if (CRYPTO_memcmp(PACKET_data(pkt), s->s3->tmp.peer_finish_md, i) != 0) {
|
---|
216 | al = SSL_AD_DECRYPT_ERROR;
|
---|
217 | SSLerr(SSL_F_TLS_PROCESS_FINISHED, SSL_R_DIGEST_CHECK_FAILED);
|
---|
218 | goto f_err;
|
---|
219 | }
|
---|
220 |
|
---|
221 | /*
|
---|
222 | * Copy the finished so we can use it for renegotiation checks
|
---|
223 | */
|
---|
224 | if (s->server) {
|
---|
225 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
226 | memcpy(s->s3->previous_client_finished, s->s3->tmp.peer_finish_md, i);
|
---|
227 | s->s3->previous_client_finished_len = i;
|
---|
228 | } else {
|
---|
229 | OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
|
---|
230 | memcpy(s->s3->previous_server_finished, s->s3->tmp.peer_finish_md, i);
|
---|
231 | s->s3->previous_server_finished_len = i;
|
---|
232 | }
|
---|
233 |
|
---|
234 | return MSG_PROCESS_FINISHED_READING;
|
---|
235 | f_err:
|
---|
236 | ssl3_send_alert(s, SSL3_AL_FATAL, al);
|
---|
237 | ossl_statem_set_error(s);
|
---|
238 | return MSG_PROCESS_ERROR;
|
---|
239 | }
|
---|
240 |
|
---|
241 | int tls_construct_change_cipher_spec(SSL *s)
|
---|
242 | {
|
---|
243 | unsigned char *p;
|
---|
244 |
|
---|
245 | p = (unsigned char *)s->init_buf->data;
|
---|
246 | *p = SSL3_MT_CCS;
|
---|
247 | s->init_num = 1;
|
---|
248 | s->init_off = 0;
|
---|
249 |
|
---|
250 | return 1;
|
---|
251 | }
|
---|
252 |
|
---|
253 | unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
|
---|
254 | {
|
---|
255 | unsigned char *p;
|
---|
256 | unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
|
---|
257 |
|
---|
258 | if (!ssl_add_cert_chain(s, cpk, &l))
|
---|
259 | return 0;
|
---|
260 |
|
---|
261 | l -= 3 + SSL_HM_HEADER_LENGTH(s);
|
---|
262 | p = ssl_handshake_start(s);
|
---|
263 | l2n3(l, p);
|
---|
264 | l += 3;
|
---|
265 |
|
---|
266 | if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE, l)) {
|
---|
267 | SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_INTERNAL_ERROR);
|
---|
268 | return 0;
|
---|
269 | }
|
---|
270 | return l + SSL_HM_HEADER_LENGTH(s);
|
---|
271 | }
|
---|
272 |
|
---|
273 | WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst)
|
---|
274 | {
|
---|
275 | void (*cb) (const SSL *ssl, int type, int val) = NULL;
|
---|
276 |
|
---|
277 | #ifndef OPENSSL_NO_SCTP
|
---|
278 | if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
|
---|
279 | WORK_STATE ret;
|
---|
280 | ret = dtls_wait_for_dry(s);
|
---|
281 | if (ret != WORK_FINISHED_CONTINUE)
|
---|
282 | return ret;
|
---|
283 | }
|
---|
284 | #endif
|
---|
285 |
|
---|
286 | /* clean a few things up */
|
---|
287 | ssl3_cleanup_key_block(s);
|
---|
288 |
|
---|
289 | if (!SSL_IS_DTLS(s)) {
|
---|
290 | /*
|
---|
291 | * We don't do this in DTLS because we may still need the init_buf
|
---|
292 | * in case there are any unexpected retransmits
|
---|
293 | */
|
---|
294 | BUF_MEM_free(s->init_buf);
|
---|
295 | s->init_buf = NULL;
|
---|
296 | }
|
---|
297 |
|
---|
298 | ssl_free_wbio_buffer(s);
|
---|
299 |
|
---|
300 | s->init_num = 0;
|
---|
301 |
|
---|
302 | if (!s->server || s->renegotiate == 2) {
|
---|
303 | /* skipped if we just sent a HelloRequest */
|
---|
304 | s->renegotiate = 0;
|
---|
305 | s->new_session = 0;
|
---|
306 |
|
---|
307 | if (s->server) {
|
---|
308 | ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
|
---|
309 |
|
---|
310 | s->ctx->stats.sess_accept_good++;
|
---|
311 | s->handshake_func = ossl_statem_accept;
|
---|
312 | } else {
|
---|
313 | ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
|
---|
314 | if (s->hit)
|
---|
315 | s->ctx->stats.sess_hit++;
|
---|
316 |
|
---|
317 | s->handshake_func = ossl_statem_connect;
|
---|
318 | s->ctx->stats.sess_connect_good++;
|
---|
319 | }
|
---|
320 |
|
---|
321 | if (s->info_callback != NULL)
|
---|
322 | cb = s->info_callback;
|
---|
323 | else if (s->ctx->info_callback != NULL)
|
---|
324 | cb = s->ctx->info_callback;
|
---|
325 |
|
---|
326 | if (cb != NULL)
|
---|
327 | cb(s, SSL_CB_HANDSHAKE_DONE, 1);
|
---|
328 |
|
---|
329 | if (SSL_IS_DTLS(s)) {
|
---|
330 | /* done with handshaking */
|
---|
331 | s->d1->handshake_read_seq = 0;
|
---|
332 | s->d1->handshake_write_seq = 0;
|
---|
333 | s->d1->next_handshake_write_seq = 0;
|
---|
334 | dtls1_clear_received_buffer(s);
|
---|
335 | }
|
---|
336 | }
|
---|
337 |
|
---|
338 | return WORK_FINISHED_STOP;
|
---|
339 | }
|
---|
340 |
|
---|
341 | int tls_get_message_header(SSL *s, int *mt)
|
---|
342 | {
|
---|
343 | /* s->init_num < SSL3_HM_HEADER_LENGTH */
|
---|
344 | int skip_message, i, recvd_type, al;
|
---|
345 | unsigned char *p;
|
---|
346 | unsigned long l;
|
---|
347 |
|
---|
348 | p = (unsigned char *)s->init_buf->data;
|
---|
349 |
|
---|
350 | do {
|
---|
351 | while (s->init_num < SSL3_HM_HEADER_LENGTH) {
|
---|
352 | i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &recvd_type,
|
---|
353 | &p[s->init_num],
|
---|
354 | SSL3_HM_HEADER_LENGTH - s->init_num,
|
---|
355 | 0);
|
---|
356 | if (i <= 0) {
|
---|
357 | s->rwstate = SSL_READING;
|
---|
358 | return 0;
|
---|
359 | }
|
---|
360 | if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
|
---|
361 | /*
|
---|
362 | * A ChangeCipherSpec must be a single byte and may not occur
|
---|
363 | * in the middle of a handshake message.
|
---|
364 | */
|
---|
365 | if (s->init_num != 0 || i != 1 || p[0] != SSL3_MT_CCS) {
|
---|
366 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
367 | SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER,
|
---|
368 | SSL_R_BAD_CHANGE_CIPHER_SPEC);
|
---|
369 | goto f_err;
|
---|
370 | }
|
---|
371 | s->s3->tmp.message_type = *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
|
---|
372 | s->init_num = i - 1;
|
---|
373 | s->init_msg = s->init_buf->data;
|
---|
374 | s->s3->tmp.message_size = i;
|
---|
375 | return 1;
|
---|
376 | } else if (recvd_type != SSL3_RT_HANDSHAKE) {
|
---|
377 | al = SSL_AD_UNEXPECTED_MESSAGE;
|
---|
378 | SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, SSL_R_CCS_RECEIVED_EARLY);
|
---|
379 | goto f_err;
|
---|
380 | }
|
---|
381 | s->init_num += i;
|
---|
382 | }
|
---|
383 |
|
---|
384 | skip_message = 0;
|
---|
385 | if (!s->server)
|
---|
386 | if (p[0] == SSL3_MT_HELLO_REQUEST)
|
---|
387 | /*
|
---|
388 | * The server may always send 'Hello Request' messages --
|
---|
389 | * we are doing a handshake anyway now, so ignore them if
|
---|
390 | * their format is correct. Does not count for 'Finished'
|
---|
391 | * MAC.
|
---|
392 | */
|
---|
393 | if (p[1] == 0 && p[2] == 0 && p[3] == 0) {
|
---|
394 | s->init_num = 0;
|
---|
395 | skip_message = 1;
|
---|
396 |
|
---|
397 | if (s->msg_callback)
|
---|
398 | s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
|
---|
399 | p, SSL3_HM_HEADER_LENGTH, s,
|
---|
400 | s->msg_callback_arg);
|
---|
401 | }
|
---|
402 | } while (skip_message);
|
---|
403 | /* s->init_num == SSL3_HM_HEADER_LENGTH */
|
---|
404 |
|
---|
405 | *mt = *p;
|
---|
406 | s->s3->tmp.message_type = *(p++);
|
---|
407 |
|
---|
408 | if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
|
---|
409 | /*
|
---|
410 | * Only happens with SSLv3+ in an SSLv2 backward compatible
|
---|
411 | * ClientHello
|
---|
412 | *
|
---|
413 | * Total message size is the remaining record bytes to read
|
---|
414 | * plus the SSL3_HM_HEADER_LENGTH bytes that we already read
|
---|
415 | */
|
---|
416 | l = RECORD_LAYER_get_rrec_length(&s->rlayer)
|
---|
417 | + SSL3_HM_HEADER_LENGTH;
|
---|
418 | s->s3->tmp.message_size = l;
|
---|
419 |
|
---|
420 | s->init_msg = s->init_buf->data;
|
---|
421 | s->init_num = SSL3_HM_HEADER_LENGTH;
|
---|
422 | } else {
|
---|
423 | n2l3(p, l);
|
---|
424 | /* BUF_MEM_grow takes an 'int' parameter */
|
---|
425 | if (l > (INT_MAX - SSL3_HM_HEADER_LENGTH)) {
|
---|
426 | al = SSL_AD_ILLEGAL_PARAMETER;
|
---|
427 | SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, SSL_R_EXCESSIVE_MESSAGE_SIZE);
|
---|
428 | goto f_err;
|
---|
429 | }
|
---|
430 | s->s3->tmp.message_size = l;
|
---|
431 |
|
---|
432 | s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;
|
---|
433 | s->init_num = 0;
|
---|
434 | }
|
---|
435 |
|
---|
436 | return 1;
|
---|
437 | f_err:
|
---|
438 | ssl3_send_alert(s, SSL3_AL_FATAL, al);
|
---|
439 | return 0;
|
---|
440 | }
|
---|
441 |
|
---|
442 | int tls_get_message_body(SSL *s, unsigned long *len)
|
---|
443 | {
|
---|
444 | long n;
|
---|
445 | unsigned char *p;
|
---|
446 | int i;
|
---|
447 |
|
---|
448 | if (s->s3->tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {
|
---|
449 | /* We've already read everything in */
|
---|
450 | *len = (unsigned long)s->init_num;
|
---|
451 | return 1;
|
---|
452 | }
|
---|
453 |
|
---|
454 | p = s->init_msg;
|
---|
455 | n = s->s3->tmp.message_size - s->init_num;
|
---|
456 | while (n > 0) {
|
---|
457 | i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,
|
---|
458 | &p[s->init_num], n, 0);
|
---|
459 | if (i <= 0) {
|
---|
460 | s->rwstate = SSL_READING;
|
---|
461 | *len = 0;
|
---|
462 | return 0;
|
---|
463 | }
|
---|
464 | s->init_num += i;
|
---|
465 | n -= i;
|
---|
466 | }
|
---|
467 |
|
---|
468 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
---|
469 | /*
|
---|
470 | * If receiving Finished, record MAC of prior handshake messages for
|
---|
471 | * Finished verification.
|
---|
472 | */
|
---|
473 | if (*s->init_buf->data == SSL3_MT_FINISHED)
|
---|
474 | ssl3_take_mac(s);
|
---|
475 | #endif
|
---|
476 |
|
---|
477 | /* Feed this message into MAC computation. */
|
---|
478 | if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
|
---|
479 | if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
|
---|
480 | s->init_num)) {
|
---|
481 | SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_EVP_LIB);
|
---|
482 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
|
---|
483 | *len = 0;
|
---|
484 | return 0;
|
---|
485 | }
|
---|
486 | if (s->msg_callback)
|
---|
487 | s->msg_callback(0, SSL2_VERSION, 0, s->init_buf->data,
|
---|
488 | (size_t)s->init_num, s, s->msg_callback_arg);
|
---|
489 | } else {
|
---|
490 | if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
|
---|
491 | s->init_num + SSL3_HM_HEADER_LENGTH)) {
|
---|
492 | SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_EVP_LIB);
|
---|
493 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
|
---|
494 | *len = 0;
|
---|
495 | return 0;
|
---|
496 | }
|
---|
497 | if (s->msg_callback)
|
---|
498 | s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,
|
---|
499 | (size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,
|
---|
500 | s->msg_callback_arg);
|
---|
501 | }
|
---|
502 |
|
---|
503 | /*
|
---|
504 | * init_num should never be negative...should probably be declared
|
---|
505 | * unsigned
|
---|
506 | */
|
---|
507 | if (s->init_num < 0) {
|
---|
508 | SSLerr(SSL_F_TLS_GET_MESSAGE_BODY, ERR_R_INTERNAL_ERROR);
|
---|
509 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
|
---|
510 | *len = 0;
|
---|
511 | return 0;
|
---|
512 | }
|
---|
513 | *len = (unsigned long)s->init_num;
|
---|
514 | return 1;
|
---|
515 | }
|
---|
516 |
|
---|
517 | int ssl_cert_type(const X509 *x, const EVP_PKEY *pk)
|
---|
518 | {
|
---|
519 | if (pk == NULL && (pk = X509_get0_pubkey(x)) == NULL)
|
---|
520 | return -1;
|
---|
521 |
|
---|
522 | switch (EVP_PKEY_id(pk)) {
|
---|
523 | default:
|
---|
524 | return -1;
|
---|
525 | case EVP_PKEY_RSA:
|
---|
526 | return SSL_PKEY_RSA_ENC;
|
---|
527 | case EVP_PKEY_DSA:
|
---|
528 | return SSL_PKEY_DSA_SIGN;
|
---|
529 | #ifndef OPENSSL_NO_EC
|
---|
530 | case EVP_PKEY_EC:
|
---|
531 | return SSL_PKEY_ECC;
|
---|
532 | #endif
|
---|
533 | #ifndef OPENSSL_NO_GOST
|
---|
534 | case NID_id_GostR3410_2001:
|
---|
535 | return SSL_PKEY_GOST01;
|
---|
536 | case NID_id_GostR3410_2012_256:
|
---|
537 | return SSL_PKEY_GOST12_256;
|
---|
538 | case NID_id_GostR3410_2012_512:
|
---|
539 | return SSL_PKEY_GOST12_512;
|
---|
540 | #endif
|
---|
541 | }
|
---|
542 | }
|
---|
543 |
|
---|
544 | int ssl_verify_alarm_type(long type)
|
---|
545 | {
|
---|
546 | int al;
|
---|
547 |
|
---|
548 | switch (type) {
|
---|
549 | case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
|
---|
550 | case X509_V_ERR_UNABLE_TO_GET_CRL:
|
---|
551 | case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
|
---|
552 | al = SSL_AD_UNKNOWN_CA;
|
---|
553 | break;
|
---|
554 | case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
|
---|
555 | case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
|
---|
556 | case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
|
---|
557 | case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
|
---|
558 | case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
|
---|
559 | case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
|
---|
560 | case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
|
---|
561 | case X509_V_ERR_CERT_NOT_YET_VALID:
|
---|
562 | case X509_V_ERR_CRL_NOT_YET_VALID:
|
---|
563 | case X509_V_ERR_CERT_UNTRUSTED:
|
---|
564 | case X509_V_ERR_CERT_REJECTED:
|
---|
565 | case X509_V_ERR_HOSTNAME_MISMATCH:
|
---|
566 | case X509_V_ERR_EMAIL_MISMATCH:
|
---|
567 | case X509_V_ERR_IP_ADDRESS_MISMATCH:
|
---|
568 | case X509_V_ERR_DANE_NO_MATCH:
|
---|
569 | case X509_V_ERR_EE_KEY_TOO_SMALL:
|
---|
570 | case X509_V_ERR_CA_KEY_TOO_SMALL:
|
---|
571 | case X509_V_ERR_CA_MD_TOO_WEAK:
|
---|
572 | al = SSL_AD_BAD_CERTIFICATE;
|
---|
573 | break;
|
---|
574 | case X509_V_ERR_CERT_SIGNATURE_FAILURE:
|
---|
575 | case X509_V_ERR_CRL_SIGNATURE_FAILURE:
|
---|
576 | al = SSL_AD_DECRYPT_ERROR;
|
---|
577 | break;
|
---|
578 | case X509_V_ERR_CERT_HAS_EXPIRED:
|
---|
579 | case X509_V_ERR_CRL_HAS_EXPIRED:
|
---|
580 | al = SSL_AD_CERTIFICATE_EXPIRED;
|
---|
581 | break;
|
---|
582 | case X509_V_ERR_CERT_REVOKED:
|
---|
583 | al = SSL_AD_CERTIFICATE_REVOKED;
|
---|
584 | break;
|
---|
585 | case X509_V_ERR_UNSPECIFIED:
|
---|
586 | case X509_V_ERR_OUT_OF_MEM:
|
---|
587 | case X509_V_ERR_INVALID_CALL:
|
---|
588 | case X509_V_ERR_STORE_LOOKUP:
|
---|
589 | al = SSL_AD_INTERNAL_ERROR;
|
---|
590 | break;
|
---|
591 | case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
|
---|
592 | case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
|
---|
593 | case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
|
---|
594 | case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
|
---|
595 | case X509_V_ERR_CERT_CHAIN_TOO_LONG:
|
---|
596 | case X509_V_ERR_PATH_LENGTH_EXCEEDED:
|
---|
597 | case X509_V_ERR_INVALID_CA:
|
---|
598 | al = SSL_AD_UNKNOWN_CA;
|
---|
599 | break;
|
---|
600 | case X509_V_ERR_APPLICATION_VERIFICATION:
|
---|
601 | al = SSL_AD_HANDSHAKE_FAILURE;
|
---|
602 | break;
|
---|
603 | case X509_V_ERR_INVALID_PURPOSE:
|
---|
604 | al = SSL_AD_UNSUPPORTED_CERTIFICATE;
|
---|
605 | break;
|
---|
606 | default:
|
---|
607 | al = SSL_AD_CERTIFICATE_UNKNOWN;
|
---|
608 | break;
|
---|
609 | }
|
---|
610 | return (al);
|
---|
611 | }
|
---|
612 |
|
---|
613 | int ssl_allow_compression(SSL *s)
|
---|
614 | {
|
---|
615 | if (s->options & SSL_OP_NO_COMPRESSION)
|
---|
616 | return 0;
|
---|
617 | return ssl_security(s, SSL_SECOP_COMPRESSION, 0, 0, NULL);
|
---|
618 | }
|
---|
619 |
|
---|
620 | static int version_cmp(const SSL *s, int a, int b)
|
---|
621 | {
|
---|
622 | int dtls = SSL_IS_DTLS(s);
|
---|
623 |
|
---|
624 | if (a == b)
|
---|
625 | return 0;
|
---|
626 | if (!dtls)
|
---|
627 | return a < b ? -1 : 1;
|
---|
628 | return DTLS_VERSION_LT(a, b) ? -1 : 1;
|
---|
629 | }
|
---|
630 |
|
---|
631 | typedef struct {
|
---|
632 | int version;
|
---|
633 | const SSL_METHOD *(*cmeth) (void);
|
---|
634 | const SSL_METHOD *(*smeth) (void);
|
---|
635 | } version_info;
|
---|
636 |
|
---|
637 | #if TLS_MAX_VERSION != TLS1_2_VERSION
|
---|
638 | # error Code needs update for TLS_method() support beyond TLS1_2_VERSION.
|
---|
639 | #endif
|
---|
640 |
|
---|
641 | static const version_info tls_version_table[] = {
|
---|
642 | #ifndef OPENSSL_NO_TLS1_2
|
---|
643 | {TLS1_2_VERSION, tlsv1_2_client_method, tlsv1_2_server_method},
|
---|
644 | #else
|
---|
645 | {TLS1_2_VERSION, NULL, NULL},
|
---|
646 | #endif
|
---|
647 | #ifndef OPENSSL_NO_TLS1_1
|
---|
648 | {TLS1_1_VERSION, tlsv1_1_client_method, tlsv1_1_server_method},
|
---|
649 | #else
|
---|
650 | {TLS1_1_VERSION, NULL, NULL},
|
---|
651 | #endif
|
---|
652 | #ifndef OPENSSL_NO_TLS1
|
---|
653 | {TLS1_VERSION, tlsv1_client_method, tlsv1_server_method},
|
---|
654 | #else
|
---|
655 | {TLS1_VERSION, NULL, NULL},
|
---|
656 | #endif
|
---|
657 | #ifndef OPENSSL_NO_SSL3
|
---|
658 | {SSL3_VERSION, sslv3_client_method, sslv3_server_method},
|
---|
659 | #else
|
---|
660 | {SSL3_VERSION, NULL, NULL},
|
---|
661 | #endif
|
---|
662 | {0, NULL, NULL},
|
---|
663 | };
|
---|
664 |
|
---|
665 | #if DTLS_MAX_VERSION != DTLS1_2_VERSION
|
---|
666 | # error Code needs update for DTLS_method() support beyond DTLS1_2_VERSION.
|
---|
667 | #endif
|
---|
668 |
|
---|
669 | static const version_info dtls_version_table[] = {
|
---|
670 | #ifndef OPENSSL_NO_DTLS1_2
|
---|
671 | {DTLS1_2_VERSION, dtlsv1_2_client_method, dtlsv1_2_server_method},
|
---|
672 | #else
|
---|
673 | {DTLS1_2_VERSION, NULL, NULL},
|
---|
674 | #endif
|
---|
675 | #ifndef OPENSSL_NO_DTLS1
|
---|
676 | {DTLS1_VERSION, dtlsv1_client_method, dtlsv1_server_method},
|
---|
677 | {DTLS1_BAD_VER, dtls_bad_ver_client_method, NULL},
|
---|
678 | #else
|
---|
679 | {DTLS1_VERSION, NULL, NULL},
|
---|
680 | {DTLS1_BAD_VER, NULL, NULL},
|
---|
681 | #endif
|
---|
682 | {0, NULL, NULL},
|
---|
683 | };
|
---|
684 |
|
---|
685 | /*
|
---|
686 | * ssl_method_error - Check whether an SSL_METHOD is enabled.
|
---|
687 | *
|
---|
688 | * @s: The SSL handle for the candidate method
|
---|
689 | * @method: the intended method.
|
---|
690 | *
|
---|
691 | * Returns 0 on success, or an SSL error reason on failure.
|
---|
692 | */
|
---|
693 | static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
|
---|
694 | {
|
---|
695 | int version = method->version;
|
---|
696 |
|
---|
697 | if ((s->min_proto_version != 0 &&
|
---|
698 | version_cmp(s, version, s->min_proto_version) < 0) ||
|
---|
699 | ssl_security(s, SSL_SECOP_VERSION, 0, version, NULL) == 0)
|
---|
700 | return SSL_R_VERSION_TOO_LOW;
|
---|
701 |
|
---|
702 | if (s->max_proto_version != 0 &&
|
---|
703 | version_cmp(s, version, s->max_proto_version) > 0)
|
---|
704 | return SSL_R_VERSION_TOO_HIGH;
|
---|
705 |
|
---|
706 | if ((s->options & method->mask) != 0)
|
---|
707 | return SSL_R_UNSUPPORTED_PROTOCOL;
|
---|
708 | if ((method->flags & SSL_METHOD_NO_SUITEB) != 0 && tls1_suiteb(s))
|
---|
709 | return SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE;
|
---|
710 | else if ((method->flags & SSL_METHOD_NO_FIPS) != 0 && FIPS_mode())
|
---|
711 | return SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE;
|
---|
712 |
|
---|
713 | return 0;
|
---|
714 | }
|
---|
715 |
|
---|
716 | /*
|
---|
717 | * ssl_version_supported - Check that the specified `version` is supported by
|
---|
718 | * `SSL *` instance
|
---|
719 | *
|
---|
720 | * @s: The SSL handle for the candidate method
|
---|
721 | * @version: Protocol version to test against
|
---|
722 | *
|
---|
723 | * Returns 1 when supported, otherwise 0
|
---|
724 | */
|
---|
725 | int ssl_version_supported(const SSL *s, int version)
|
---|
726 | {
|
---|
727 | const version_info *vent;
|
---|
728 | const version_info *table;
|
---|
729 |
|
---|
730 | switch (s->method->version) {
|
---|
731 | default:
|
---|
732 | /* Version should match method version for non-ANY method */
|
---|
733 | return version_cmp(s, version, s->version) == 0;
|
---|
734 | case TLS_ANY_VERSION:
|
---|
735 | table = tls_version_table;
|
---|
736 | break;
|
---|
737 | case DTLS_ANY_VERSION:
|
---|
738 | table = dtls_version_table;
|
---|
739 | break;
|
---|
740 | }
|
---|
741 |
|
---|
742 | for (vent = table;
|
---|
743 | vent->version != 0 && version_cmp(s, version, vent->version) <= 0;
|
---|
744 | ++vent) {
|
---|
745 | if (vent->cmeth != NULL &&
|
---|
746 | version_cmp(s, version, vent->version) == 0 &&
|
---|
747 | ssl_method_error(s, vent->cmeth()) == 0) {
|
---|
748 | return 1;
|
---|
749 | }
|
---|
750 | }
|
---|
751 | return 0;
|
---|
752 | }
|
---|
753 |
|
---|
754 | /*
|
---|
755 | * ssl_check_version_downgrade - In response to RFC7507 SCSV version
|
---|
756 | * fallback indication from a client check whether we're using the highest
|
---|
757 | * supported protocol version.
|
---|
758 | *
|
---|
759 | * @s server SSL handle.
|
---|
760 | *
|
---|
761 | * Returns 1 when using the highest enabled version, 0 otherwise.
|
---|
762 | */
|
---|
763 | int ssl_check_version_downgrade(SSL *s)
|
---|
764 | {
|
---|
765 | const version_info *vent;
|
---|
766 | const version_info *table;
|
---|
767 |
|
---|
768 | /*
|
---|
769 | * Check that the current protocol is the highest enabled version
|
---|
770 | * (according to s->ctx->method, as version negotiation may have changed
|
---|
771 | * s->method).
|
---|
772 | */
|
---|
773 | if (s->version == s->ctx->method->version)
|
---|
774 | return 1;
|
---|
775 |
|
---|
776 | /*
|
---|
777 | * Apparently we're using a version-flexible SSL_METHOD (not at its
|
---|
778 | * highest protocol version).
|
---|
779 | */
|
---|
780 | if (s->ctx->method->version == TLS_method()->version)
|
---|
781 | table = tls_version_table;
|
---|
782 | else if (s->ctx->method->version == DTLS_method()->version)
|
---|
783 | table = dtls_version_table;
|
---|
784 | else {
|
---|
785 | /* Unexpected state; fail closed. */
|
---|
786 | return 0;
|
---|
787 | }
|
---|
788 |
|
---|
789 | for (vent = table; vent->version != 0; ++vent) {
|
---|
790 | if (vent->smeth != NULL && ssl_method_error(s, vent->smeth()) == 0)
|
---|
791 | return s->version == vent->version;
|
---|
792 | }
|
---|
793 | return 0;
|
---|
794 | }
|
---|
795 |
|
---|
796 | /*
|
---|
797 | * ssl_set_version_bound - set an upper or lower bound on the supported (D)TLS
|
---|
798 | * protocols, provided the initial (D)TLS method is version-flexible. This
|
---|
799 | * function sanity-checks the proposed value and makes sure the method is
|
---|
800 | * version-flexible, then sets the limit if all is well.
|
---|
801 | *
|
---|
802 | * @method_version: The version of the current SSL_METHOD.
|
---|
803 | * @version: the intended limit.
|
---|
804 | * @bound: pointer to limit to be updated.
|
---|
805 | *
|
---|
806 | * Returns 1 on success, 0 on failure.
|
---|
807 | */
|
---|
808 | int ssl_set_version_bound(int method_version, int version, int *bound)
|
---|
809 | {
|
---|
810 | if (version == 0) {
|
---|
811 | *bound = version;
|
---|
812 | return 1;
|
---|
813 | }
|
---|
814 |
|
---|
815 | /*-
|
---|
816 | * Restrict TLS methods to TLS protocol versions.
|
---|
817 | * Restrict DTLS methods to DTLS protocol versions.
|
---|
818 | * Note, DTLS version numbers are decreasing, use comparison macros.
|
---|
819 | *
|
---|
820 | * Note that for both lower-bounds we use explicit versions, not
|
---|
821 | * (D)TLS_MIN_VERSION. This is because we don't want to break user
|
---|
822 | * configurations. If the MIN (supported) version ever rises, the user's
|
---|
823 | * "floor" remains valid even if no longer available. We don't expect the
|
---|
824 | * MAX ceiling to ever get lower, so making that variable makes sense.
|
---|
825 | */
|
---|
826 | switch (method_version) {
|
---|
827 | default:
|
---|
828 | /*
|
---|
829 | * XXX For fixed version methods, should we always fail and not set any
|
---|
830 | * bounds, always succeed and not set any bounds, or set the bounds and
|
---|
831 | * arrange to fail later if they are not met? At present fixed-version
|
---|
832 | * methods are not subject to controls that disable individual protocol
|
---|
833 | * versions.
|
---|
834 | */
|
---|
835 | return 0;
|
---|
836 |
|
---|
837 | case TLS_ANY_VERSION:
|
---|
838 | if (version < SSL3_VERSION || version > TLS_MAX_VERSION)
|
---|
839 | return 0;
|
---|
840 | break;
|
---|
841 |
|
---|
842 | case DTLS_ANY_VERSION:
|
---|
843 | if (DTLS_VERSION_GT(version, DTLS_MAX_VERSION) ||
|
---|
844 | DTLS_VERSION_LT(version, DTLS1_BAD_VER))
|
---|
845 | return 0;
|
---|
846 | break;
|
---|
847 | }
|
---|
848 |
|
---|
849 | *bound = version;
|
---|
850 | return 1;
|
---|
851 | }
|
---|
852 |
|
---|
853 | /*
|
---|
854 | * ssl_choose_server_version - Choose server (D)TLS version. Called when the
|
---|
855 | * client HELLO is received to select the final server protocol version and
|
---|
856 | * the version specific method.
|
---|
857 | *
|
---|
858 | * @s: server SSL handle.
|
---|
859 | *
|
---|
860 | * Returns 0 on success or an SSL error reason number on failure.
|
---|
861 | */
|
---|
862 | int ssl_choose_server_version(SSL *s)
|
---|
863 | {
|
---|
864 | /*-
|
---|
865 | * With version-flexible methods we have an initial state with:
|
---|
866 | *
|
---|
867 | * s->method->version == (D)TLS_ANY_VERSION,
|
---|
868 | * s->version == (D)TLS_MAX_VERSION.
|
---|
869 | *
|
---|
870 | * So we detect version-flexible methods via the method version, not the
|
---|
871 | * handle version.
|
---|
872 | */
|
---|
873 | int server_version = s->method->version;
|
---|
874 | int client_version = s->client_version;
|
---|
875 | const version_info *vent;
|
---|
876 | const version_info *table;
|
---|
877 | int disabled = 0;
|
---|
878 |
|
---|
879 | switch (server_version) {
|
---|
880 | default:
|
---|
881 | if (version_cmp(s, client_version, s->version) < 0)
|
---|
882 | return SSL_R_WRONG_SSL_VERSION;
|
---|
883 | /*
|
---|
884 | * If this SSL handle is not from a version flexible method we don't
|
---|
885 | * (and never did) check min/max FIPS or Suite B constraints. Hope
|
---|
886 | * that's OK. It is up to the caller to not choose fixed protocol
|
---|
887 | * versions they don't want. If not, then easy to fix, just return
|
---|
888 | * ssl_method_error(s, s->method)
|
---|
889 | */
|
---|
890 | return 0;
|
---|
891 | case TLS_ANY_VERSION:
|
---|
892 | table = tls_version_table;
|
---|
893 | break;
|
---|
894 | case DTLS_ANY_VERSION:
|
---|
895 | table = dtls_version_table;
|
---|
896 | break;
|
---|
897 | }
|
---|
898 |
|
---|
899 | for (vent = table; vent->version != 0; ++vent) {
|
---|
900 | const SSL_METHOD *method;
|
---|
901 |
|
---|
902 | if (vent->smeth == NULL ||
|
---|
903 | version_cmp(s, client_version, vent->version) < 0)
|
---|
904 | continue;
|
---|
905 | method = vent->smeth();
|
---|
906 | if (ssl_method_error(s, method) == 0) {
|
---|
907 | s->version = vent->version;
|
---|
908 | s->method = method;
|
---|
909 | return 0;
|
---|
910 | }
|
---|
911 | disabled = 1;
|
---|
912 | }
|
---|
913 | return disabled ? SSL_R_UNSUPPORTED_PROTOCOL : SSL_R_VERSION_TOO_LOW;
|
---|
914 | }
|
---|
915 |
|
---|
916 | /*
|
---|
917 | * ssl_choose_client_version - Choose client (D)TLS version. Called when the
|
---|
918 | * server HELLO is received to select the final client protocol version and
|
---|
919 | * the version specific method.
|
---|
920 | *
|
---|
921 | * @s: client SSL handle.
|
---|
922 | * @version: The proposed version from the server's HELLO.
|
---|
923 | *
|
---|
924 | * Returns 0 on success or an SSL error reason number on failure.
|
---|
925 | */
|
---|
926 | int ssl_choose_client_version(SSL *s, int version)
|
---|
927 | {
|
---|
928 | const version_info *vent;
|
---|
929 | const version_info *table;
|
---|
930 |
|
---|
931 | switch (s->method->version) {
|
---|
932 | default:
|
---|
933 | if (version != s->version)
|
---|
934 | return SSL_R_WRONG_SSL_VERSION;
|
---|
935 | /*
|
---|
936 | * If this SSL handle is not from a version flexible method we don't
|
---|
937 | * (and never did) check min/max, FIPS or Suite B constraints. Hope
|
---|
938 | * that's OK. It is up to the caller to not choose fixed protocol
|
---|
939 | * versions they don't want. If not, then easy to fix, just return
|
---|
940 | * ssl_method_error(s, s->method)
|
---|
941 | */
|
---|
942 | return 0;
|
---|
943 | case TLS_ANY_VERSION:
|
---|
944 | table = tls_version_table;
|
---|
945 | break;
|
---|
946 | case DTLS_ANY_VERSION:
|
---|
947 | table = dtls_version_table;
|
---|
948 | break;
|
---|
949 | }
|
---|
950 |
|
---|
951 | for (vent = table; vent->version != 0; ++vent) {
|
---|
952 | const SSL_METHOD *method;
|
---|
953 | int err;
|
---|
954 |
|
---|
955 | if (version != vent->version)
|
---|
956 | continue;
|
---|
957 | if (vent->cmeth == NULL)
|
---|
958 | break;
|
---|
959 | method = vent->cmeth();
|
---|
960 | err = ssl_method_error(s, method);
|
---|
961 | if (err != 0)
|
---|
962 | return err;
|
---|
963 | s->method = method;
|
---|
964 | s->version = version;
|
---|
965 | return 0;
|
---|
966 | }
|
---|
967 |
|
---|
968 | return SSL_R_UNSUPPORTED_PROTOCOL;
|
---|
969 | }
|
---|
970 |
|
---|
971 | /*
|
---|
972 | * ssl_get_client_min_max_version - get minimum and maximum client version
|
---|
973 | * @s: The SSL connection
|
---|
974 | * @min_version: The minimum supported version
|
---|
975 | * @max_version: The maximum supported version
|
---|
976 | *
|
---|
977 | * Work out what version we should be using for the initial ClientHello if the
|
---|
978 | * version is initially (D)TLS_ANY_VERSION. We apply any explicit SSL_OP_NO_xxx
|
---|
979 | * options, the MinProtocol and MaxProtocol configuration commands, any Suite B
|
---|
980 | * or FIPS_mode() constraints and any floor imposed by the security level here,
|
---|
981 | * so we don't advertise the wrong protocol version to only reject the outcome later.
|
---|
982 | *
|
---|
983 | * Computing the right floor matters. If, e.g., TLS 1.0 and 1.2 are enabled,
|
---|
984 | * TLS 1.1 is disabled, but the security level, Suite-B and/or MinProtocol
|
---|
985 | * only allow TLS 1.2, we want to advertise TLS1.2, *not* TLS1.
|
---|
986 | *
|
---|
987 | * Returns 0 on success or an SSL error reason number on failure. On failure
|
---|
988 | * min_version and max_version will also be set to 0.
|
---|
989 | */
|
---|
990 | int ssl_get_client_min_max_version(const SSL *s, int *min_version,
|
---|
991 | int *max_version)
|
---|
992 | {
|
---|
993 | int version;
|
---|
994 | int hole;
|
---|
995 | const SSL_METHOD *single = NULL;
|
---|
996 | const SSL_METHOD *method;
|
---|
997 | const version_info *table;
|
---|
998 | const version_info *vent;
|
---|
999 |
|
---|
1000 | switch (s->method->version) {
|
---|
1001 | default:
|
---|
1002 | /*
|
---|
1003 | * If this SSL handle is not from a version flexible method we don't
|
---|
1004 | * (and never did) check min/max FIPS or Suite B constraints. Hope
|
---|
1005 | * that's OK. It is up to the caller to not choose fixed protocol
|
---|
1006 | * versions they don't want. If not, then easy to fix, just return
|
---|
1007 | * ssl_method_error(s, s->method)
|
---|
1008 | */
|
---|
1009 | *min_version = *max_version = s->version;
|
---|
1010 | return 0;
|
---|
1011 | case TLS_ANY_VERSION:
|
---|
1012 | table = tls_version_table;
|
---|
1013 | break;
|
---|
1014 | case DTLS_ANY_VERSION:
|
---|
1015 | table = dtls_version_table;
|
---|
1016 | break;
|
---|
1017 | }
|
---|
1018 |
|
---|
1019 | /*
|
---|
1020 | * SSL_OP_NO_X disables all protocols above X *if* there are some protocols
|
---|
1021 | * below X enabled. This is required in order to maintain the "version
|
---|
1022 | * capability" vector contiguous. Any versions with a NULL client method
|
---|
1023 | * (protocol version client is disabled at compile-time) is also a "hole".
|
---|
1024 | *
|
---|
1025 | * Our initial state is hole == 1, version == 0. That is, versions above
|
---|
1026 | * the first version in the method table are disabled (a "hole" above
|
---|
1027 | * the valid protocol entries) and we don't have a selected version yet.
|
---|
1028 | *
|
---|
1029 | * Whenever "hole == 1", and we hit an enabled method, its version becomes
|
---|
1030 | * the selected version, and the method becomes a candidate "single"
|
---|
1031 | * method. We're no longer in a hole, so "hole" becomes 0.
|
---|
1032 | *
|
---|
1033 | * If "hole == 0" and we hit an enabled method, then "single" is cleared,
|
---|
1034 | * as we support a contiguous range of at least two methods. If we hit
|
---|
1035 | * a disabled method, then hole becomes true again, but nothing else
|
---|
1036 | * changes yet, because all the remaining methods may be disabled too.
|
---|
1037 | * If we again hit an enabled method after the new hole, it becomes
|
---|
1038 | * selected, as we start from scratch.
|
---|
1039 | */
|
---|
1040 | *min_version = version = 0;
|
---|
1041 | hole = 1;
|
---|
1042 | for (vent = table; vent->version != 0; ++vent) {
|
---|
1043 | /*
|
---|
1044 | * A table entry with a NULL client method is still a hole in the
|
---|
1045 | * "version capability" vector.
|
---|
1046 | */
|
---|
1047 | if (vent->cmeth == NULL) {
|
---|
1048 | hole = 1;
|
---|
1049 | continue;
|
---|
1050 | }
|
---|
1051 | method = vent->cmeth();
|
---|
1052 | if (ssl_method_error(s, method) != 0) {
|
---|
1053 | hole = 1;
|
---|
1054 | } else if (!hole) {
|
---|
1055 | single = NULL;
|
---|
1056 | *min_version = method->version;
|
---|
1057 | } else {
|
---|
1058 | version = (single = method)->version;
|
---|
1059 | *min_version = version;
|
---|
1060 | hole = 0;
|
---|
1061 | }
|
---|
1062 | }
|
---|
1063 |
|
---|
1064 | *max_version = version;
|
---|
1065 |
|
---|
1066 | /* Fail if everything is disabled */
|
---|
1067 | if (version == 0)
|
---|
1068 | return SSL_R_NO_PROTOCOLS_AVAILABLE;
|
---|
1069 |
|
---|
1070 | return 0;
|
---|
1071 | }
|
---|
1072 |
|
---|
1073 | /*
|
---|
1074 | * ssl_set_client_hello_version - Work out what version we should be using for
|
---|
1075 | * the initial ClientHello.
|
---|
1076 | *
|
---|
1077 | * @s: client SSL handle.
|
---|
1078 | *
|
---|
1079 | * Returns 0 on success or an SSL error reason number on failure.
|
---|
1080 | */
|
---|
1081 | int ssl_set_client_hello_version(SSL *s)
|
---|
1082 | {
|
---|
1083 | int ver_min, ver_max, ret;
|
---|
1084 |
|
---|
1085 | ret = ssl_get_client_min_max_version(s, &ver_min, &ver_max);
|
---|
1086 |
|
---|
1087 | if (ret != 0)
|
---|
1088 | return ret;
|
---|
1089 |
|
---|
1090 | s->client_version = s->version = ver_max;
|
---|
1091 | return 0;
|
---|
1092 | }
|
---|