File: | src/lib/libssl/ssl_tlsext.c |
Warning: | line 798, column 7 Branch condition evaluates to a garbage value |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: ssl_tlsext.c,v 1.108 2022/01/11 18:28:41 jsing Exp $ */ | |||
2 | /* | |||
3 | * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org> | |||
4 | * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> | |||
5 | * Copyright (c) 2018-2019 Bob Beck <beck@openbsd.org> | |||
6 | * | |||
7 | * Permission to use, copy, modify, and distribute this software for any | |||
8 | * purpose with or without fee is hereby granted, provided that the above | |||
9 | * copyright notice and this permission notice appear in all copies. | |||
10 | * | |||
11 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | |||
12 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | |||
13 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | |||
14 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | |||
15 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |||
16 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |||
17 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | |||
18 | */ | |||
19 | ||||
20 | #include <sys/socket.h> | |||
21 | ||||
22 | #include <arpa/inet.h> | |||
23 | #include <netinet/in.h> | |||
24 | ||||
25 | #include <ctype.h> | |||
26 | ||||
27 | #include <openssl/ocsp.h> | |||
28 | #include <openssl/opensslconf.h> | |||
29 | ||||
30 | #include "bytestring.h" | |||
31 | #include "ssl_locl.h" | |||
32 | #include "ssl_sigalgs.h" | |||
33 | #include "ssl_tlsext.h" | |||
34 | ||||
35 | /* | |||
36 | * Supported Application-Layer Protocol Negotiation - RFC 7301 | |||
37 | */ | |||
38 | ||||
39 | int | |||
40 | tlsext_alpn_client_needs(SSL *s, uint16_t msg_type) | |||
41 | { | |||
42 | /* ALPN protos have been specified and this is the initial handshake */ | |||
43 | return s->internal->alpn_client_proto_list != NULL((void*)0) && | |||
44 | S3I(s)(s->s3->internal)->hs.finished_len == 0; | |||
45 | } | |||
46 | ||||
47 | int | |||
48 | tlsext_alpn_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
49 | { | |||
50 | CBB protolist; | |||
51 | ||||
52 | if (!CBB_add_u16_length_prefixed(cbb, &protolist)) | |||
53 | return 0; | |||
54 | ||||
55 | if (!CBB_add_bytes(&protolist, s->internal->alpn_client_proto_list, | |||
56 | s->internal->alpn_client_proto_list_len)) | |||
57 | return 0; | |||
58 | ||||
59 | if (!CBB_flush(cbb)) | |||
60 | return 0; | |||
61 | ||||
62 | return 1; | |||
63 | } | |||
64 | ||||
65 | int | |||
66 | tlsext_alpn_server_parse(SSL *s, uint16_t msg_types, CBS *cbs, int *alert) | |||
67 | { | |||
68 | CBS proto_name_list, alpn; | |||
69 | const unsigned char *selected; | |||
70 | unsigned char selected_len; | |||
71 | int r; | |||
72 | ||||
73 | if (!CBS_get_u16_length_prefixed(cbs, &alpn)) | |||
74 | goto err; | |||
75 | if (CBS_len(&alpn) < 2) | |||
76 | goto err; | |||
77 | if (CBS_len(cbs) != 0) | |||
78 | goto err; | |||
79 | ||||
80 | CBS_dup(&alpn, &proto_name_list); | |||
81 | while (CBS_len(&proto_name_list) > 0) { | |||
82 | CBS proto_name; | |||
83 | ||||
84 | if (!CBS_get_u8_length_prefixed(&proto_name_list, &proto_name)) | |||
85 | goto err; | |||
86 | if (CBS_len(&proto_name) == 0) | |||
87 | goto err; | |||
88 | } | |||
89 | ||||
90 | if (s->ctx->internal->alpn_select_cb == NULL((void*)0)) | |||
91 | return 1; | |||
92 | ||||
93 | /* | |||
94 | * XXX - A few things should be considered here: | |||
95 | * 1. Ensure that the same protocol is selected on session resumption. | |||
96 | * 2. Should the callback be called even if no ALPN extension was sent? | |||
97 | * 3. TLSv1.2 and earlier: ensure that SNI has already been processed. | |||
98 | */ | |||
99 | r = s->ctx->internal->alpn_select_cb(s, &selected, &selected_len, | |||
100 | CBS_data(&alpn), CBS_len(&alpn), | |||
101 | s->ctx->internal->alpn_select_cb_arg); | |||
102 | ||||
103 | if (r == SSL_TLSEXT_ERR_OK0) { | |||
104 | free(S3I(s)(s->s3->internal)->alpn_selected); | |||
105 | if ((S3I(s)(s->s3->internal)->alpn_selected = malloc(selected_len)) == NULL((void*)0)) { | |||
106 | S3I(s)(s->s3->internal)->alpn_selected_len = 0; | |||
107 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
108 | return 0; | |||
109 | } | |||
110 | memcpy(S3I(s)(s->s3->internal)->alpn_selected, selected, selected_len); | |||
111 | S3I(s)(s->s3->internal)->alpn_selected_len = selected_len; | |||
112 | ||||
113 | return 1; | |||
114 | } | |||
115 | ||||
116 | /* On SSL_TLSEXT_ERR_NOACK behave as if no callback was present. */ | |||
117 | if (r == SSL_TLSEXT_ERR_NOACK3) | |||
118 | return 1; | |||
119 | ||||
120 | *alert = SSL_AD_NO_APPLICATION_PROTOCOL120; | |||
121 | SSLerror(s, SSL_R_NO_APPLICATION_PROTOCOL)SSL_error_internal(s, 235, "/usr/src/lib/libssl/ssl_tlsext.c" , 121); | |||
122 | ||||
123 | return 0; | |||
124 | ||||
125 | err: | |||
126 | *alert = SSL_AD_DECODE_ERROR50; | |||
127 | return 0; | |||
128 | } | |||
129 | ||||
130 | int | |||
131 | tlsext_alpn_server_needs(SSL *s, uint16_t msg_type) | |||
132 | { | |||
133 | return S3I(s)(s->s3->internal)->alpn_selected != NULL((void*)0); | |||
134 | } | |||
135 | ||||
136 | int | |||
137 | tlsext_alpn_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
138 | { | |||
139 | CBB list, selected; | |||
140 | ||||
141 | if (!CBB_add_u16_length_prefixed(cbb, &list)) | |||
142 | return 0; | |||
143 | ||||
144 | if (!CBB_add_u8_length_prefixed(&list, &selected)) | |||
145 | return 0; | |||
146 | ||||
147 | if (!CBB_add_bytes(&selected, S3I(s)(s->s3->internal)->alpn_selected, | |||
148 | S3I(s)(s->s3->internal)->alpn_selected_len)) | |||
149 | return 0; | |||
150 | ||||
151 | if (!CBB_flush(cbb)) | |||
152 | return 0; | |||
153 | ||||
154 | return 1; | |||
155 | } | |||
156 | ||||
157 | int | |||
158 | tlsext_alpn_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
159 | { | |||
160 | CBS list, proto; | |||
161 | ||||
162 | if (s->internal->alpn_client_proto_list == NULL((void*)0)) { | |||
163 | *alert = SSL_AD_UNSUPPORTED_EXTENSION110; | |||
164 | return 0; | |||
165 | } | |||
166 | ||||
167 | if (!CBS_get_u16_length_prefixed(cbs, &list)) | |||
168 | goto err; | |||
169 | if (CBS_len(cbs) != 0) | |||
170 | goto err; | |||
171 | ||||
172 | if (!CBS_get_u8_length_prefixed(&list, &proto)) | |||
173 | goto err; | |||
174 | ||||
175 | if (CBS_len(&list) != 0) | |||
176 | goto err; | |||
177 | if (CBS_len(&proto) == 0) | |||
178 | goto err; | |||
179 | ||||
180 | if (!CBS_stow(&proto, &(S3I(s)(s->s3->internal)->alpn_selected), | |||
181 | &(S3I(s)(s->s3->internal)->alpn_selected_len))) | |||
182 | goto err; | |||
183 | ||||
184 | return 1; | |||
185 | ||||
186 | err: | |||
187 | *alert = SSL_AD_DECODE_ERROR50; | |||
188 | return 0; | |||
189 | } | |||
190 | ||||
191 | /* | |||
192 | * Supported Groups - RFC 7919 section 2 | |||
193 | */ | |||
194 | int | |||
195 | tlsext_supportedgroups_client_needs(SSL *s, uint16_t msg_type) | |||
196 | { | |||
197 | return ssl_has_ecc_ciphers(s) || | |||
198 | (S3I(s)(s->s3->internal)->hs.our_max_tls_version >= TLS1_3_VERSION0x0304); | |||
199 | } | |||
200 | ||||
201 | int | |||
202 | tlsext_supportedgroups_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
203 | { | |||
204 | const uint16_t *groups; | |||
205 | size_t groups_len; | |||
206 | CBB grouplist; | |||
207 | int i; | |||
208 | ||||
209 | tls1_get_group_list(s, 0, &groups, &groups_len); | |||
210 | if (groups_len == 0) { | |||
211 | SSLerror(s, ERR_R_INTERNAL_ERROR)SSL_error_internal(s, (4|64), "/usr/src/lib/libssl/ssl_tlsext.c" , 211); | |||
212 | return 0; | |||
213 | } | |||
214 | ||||
215 | if (!CBB_add_u16_length_prefixed(cbb, &grouplist)) | |||
216 | return 0; | |||
217 | ||||
218 | for (i = 0; i < groups_len; i++) { | |||
219 | if (!CBB_add_u16(&grouplist, groups[i])) | |||
220 | return 0; | |||
221 | } | |||
222 | ||||
223 | if (!CBB_flush(cbb)) | |||
224 | return 0; | |||
225 | ||||
226 | return 1; | |||
227 | } | |||
228 | ||||
229 | int | |||
230 | tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, | |||
231 | int *alert) | |||
232 | { | |||
233 | CBS grouplist; | |||
234 | size_t groups_len; | |||
235 | ||||
236 | if (!CBS_get_u16_length_prefixed(cbs, &grouplist)) | |||
237 | goto err; | |||
238 | if (CBS_len(cbs) != 0) | |||
239 | goto err; | |||
240 | ||||
241 | groups_len = CBS_len(&grouplist); | |||
242 | if (groups_len == 0 || groups_len % 2 != 0) | |||
243 | goto err; | |||
244 | groups_len /= 2; | |||
245 | ||||
246 | if (!s->internal->hit) { | |||
247 | uint16_t *groups; | |||
248 | int i; | |||
249 | ||||
250 | if (S3I(s)(s->s3->internal)->hs.tls13.hrr) { | |||
251 | if (s->session->tlsext_supportedgroups == NULL((void*)0)) { | |||
252 | *alert = SSL_AD_HANDSHAKE_FAILURE40; | |||
253 | return 0; | |||
254 | } | |||
255 | /* | |||
256 | * In the case of TLSv1.3 the client cannot change | |||
257 | * the supported groups. | |||
258 | */ | |||
259 | if (groups_len != s->session->tlsext_supportedgroups_length) { | |||
260 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
261 | return 0; | |||
262 | } | |||
263 | for (i = 0; i < groups_len; i++) { | |||
264 | uint16_t group; | |||
265 | ||||
266 | if (!CBS_get_u16(&grouplist, &group)) | |||
267 | goto err; | |||
268 | if (s->session->tlsext_supportedgroups[i] != group) { | |||
269 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
270 | return 0; | |||
271 | } | |||
272 | } | |||
273 | ||||
274 | return 1; | |||
275 | } | |||
276 | ||||
277 | if (s->session->tlsext_supportedgroups != NULL((void*)0)) | |||
278 | goto err; | |||
279 | ||||
280 | if ((groups = reallocarray(NULL((void*)0), groups_len, | |||
281 | sizeof(uint16_t))) == NULL((void*)0)) { | |||
282 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
283 | return 0; | |||
284 | } | |||
285 | ||||
286 | for (i = 0; i < groups_len; i++) { | |||
287 | if (!CBS_get_u16(&grouplist, &groups[i])) { | |||
288 | free(groups); | |||
289 | goto err; | |||
290 | } | |||
291 | } | |||
292 | ||||
293 | if (CBS_len(&grouplist) != 0) { | |||
294 | free(groups); | |||
295 | goto err; | |||
296 | } | |||
297 | ||||
298 | s->session->tlsext_supportedgroups = groups; | |||
299 | s->session->tlsext_supportedgroups_length = groups_len; | |||
300 | } | |||
301 | ||||
302 | return 1; | |||
303 | ||||
304 | err: | |||
305 | *alert = SSL_AD_DECODE_ERROR50; | |||
306 | return 0; | |||
307 | } | |||
308 | ||||
309 | /* This extension is never used by the server. */ | |||
310 | int | |||
311 | tlsext_supportedgroups_server_needs(SSL *s, uint16_t msg_type) | |||
312 | { | |||
313 | return 0; | |||
314 | } | |||
315 | ||||
316 | int | |||
317 | tlsext_supportedgroups_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
318 | { | |||
319 | return 0; | |||
320 | } | |||
321 | ||||
322 | int | |||
323 | tlsext_supportedgroups_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, | |||
324 | int *alert) | |||
325 | { | |||
326 | /* | |||
327 | * Servers should not send this extension per the RFC. | |||
328 | * | |||
329 | * However, certain F5 BIG-IP systems incorrectly send it. This bug is | |||
330 | * from at least 2014 but as of 2017, there are still large sites with | |||
331 | * this unpatched in production. As a result, we need to currently skip | |||
332 | * over the extension and ignore its content: | |||
333 | * | |||
334 | * https://support.f5.com/csp/article/K37345003 | |||
335 | */ | |||
336 | if (!CBS_skip(cbs, CBS_len(cbs))) { | |||
337 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
338 | return 0; | |||
339 | } | |||
340 | ||||
341 | return 1; | |||
342 | } | |||
343 | ||||
344 | /* | |||
345 | * Supported Point Formats Extension - RFC 4492 section 5.1.2 | |||
346 | */ | |||
347 | static int | |||
348 | tlsext_ecpf_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
349 | { | |||
350 | CBB ecpf; | |||
351 | size_t formats_len; | |||
352 | const uint8_t *formats; | |||
353 | ||||
354 | tls1_get_formatlist(s, 0, &formats, &formats_len); | |||
355 | ||||
356 | if (formats_len == 0) { | |||
357 | SSLerror(s, ERR_R_INTERNAL_ERROR)SSL_error_internal(s, (4|64), "/usr/src/lib/libssl/ssl_tlsext.c" , 357); | |||
358 | return 0; | |||
359 | } | |||
360 | ||||
361 | if (!CBB_add_u8_length_prefixed(cbb, &ecpf)) | |||
362 | return 0; | |||
363 | if (!CBB_add_bytes(&ecpf, formats, formats_len)) | |||
364 | return 0; | |||
365 | if (!CBB_flush(cbb)) | |||
366 | return 0; | |||
367 | ||||
368 | return 1; | |||
369 | } | |||
370 | ||||
371 | static int | |||
372 | tlsext_ecpf_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
373 | { | |||
374 | CBS ecpf; | |||
375 | ||||
376 | if (!CBS_get_u8_length_prefixed(cbs, &ecpf)) | |||
377 | return 0; | |||
378 | if (CBS_len(&ecpf) == 0) | |||
379 | return 0; | |||
380 | if (CBS_len(cbs) != 0) | |||
381 | return 0; | |||
382 | ||||
383 | /* Must contain uncompressed (0) - RFC 8422, section 5.1.2. */ | |||
384 | if (!CBS_contains_zero_byte(&ecpf)) { | |||
385 | SSLerror(s, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST)SSL_error_internal(s, 157, "/usr/src/lib/libssl/ssl_tlsext.c" , 385); | |||
386 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
387 | return 0; | |||
388 | } | |||
389 | ||||
390 | if (!s->internal->hit) { | |||
391 | if (!CBS_stow(&ecpf, &(s->session->tlsext_ecpointformatlist), | |||
392 | &(s->session->tlsext_ecpointformatlist_length))) { | |||
393 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
394 | return 0; | |||
395 | } | |||
396 | } | |||
397 | ||||
398 | return 1; | |||
399 | } | |||
400 | ||||
401 | int | |||
402 | tlsext_ecpf_client_needs(SSL *s, uint16_t msg_type) | |||
403 | { | |||
404 | return ssl_has_ecc_ciphers(s); | |||
405 | } | |||
406 | ||||
407 | int | |||
408 | tlsext_ecpf_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
409 | { | |||
410 | return tlsext_ecpf_build(s, msg_type, cbb); | |||
411 | } | |||
412 | ||||
413 | int | |||
414 | tlsext_ecpf_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
415 | { | |||
416 | return tlsext_ecpf_parse(s, msg_type, cbs, alert); | |||
417 | } | |||
418 | ||||
419 | int | |||
420 | tlsext_ecpf_server_needs(SSL *s, uint16_t msg_type) | |||
421 | { | |||
422 | return ssl_using_ecc_cipher(s); | |||
423 | } | |||
424 | ||||
425 | int | |||
426 | tlsext_ecpf_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
427 | { | |||
428 | return tlsext_ecpf_build(s, msg_type, cbb); | |||
429 | } | |||
430 | ||||
431 | int | |||
432 | tlsext_ecpf_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
433 | { | |||
434 | return tlsext_ecpf_parse(s, msg_type, cbs, alert); | |||
435 | } | |||
436 | ||||
437 | /* | |||
438 | * Renegotiation Indication - RFC 5746. | |||
439 | */ | |||
440 | int | |||
441 | tlsext_ri_client_needs(SSL *s, uint16_t msg_type) | |||
442 | { | |||
443 | return (s->internal->renegotiate); | |||
444 | } | |||
445 | ||||
446 | int | |||
447 | tlsext_ri_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
448 | { | |||
449 | CBB reneg; | |||
450 | ||||
451 | if (!CBB_add_u8_length_prefixed(cbb, &reneg)) | |||
452 | return 0; | |||
453 | if (!CBB_add_bytes(&reneg, S3I(s)(s->s3->internal)->previous_client_finished, | |||
454 | S3I(s)(s->s3->internal)->previous_client_finished_len)) | |||
455 | return 0; | |||
456 | if (!CBB_flush(cbb)) | |||
457 | return 0; | |||
458 | ||||
459 | return 1; | |||
460 | } | |||
461 | ||||
462 | int | |||
463 | tlsext_ri_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
464 | { | |||
465 | CBS reneg; | |||
466 | ||||
467 | if (!CBS_get_u8_length_prefixed(cbs, &reneg)) | |||
468 | goto err; | |||
469 | if (CBS_len(cbs) != 0) | |||
470 | goto err; | |||
471 | ||||
472 | if (!CBS_mem_equal(&reneg, S3I(s)(s->s3->internal)->previous_client_finished, | |||
473 | S3I(s)(s->s3->internal)->previous_client_finished_len)) { | |||
474 | SSLerror(s, SSL_R_RENEGOTIATION_MISMATCH)SSL_error_internal(s, 337, "/usr/src/lib/libssl/ssl_tlsext.c" , 474); | |||
475 | *alert = SSL_AD_HANDSHAKE_FAILURE40; | |||
476 | return 0; | |||
477 | } | |||
478 | ||||
479 | S3I(s)(s->s3->internal)->renegotiate_seen = 1; | |||
480 | S3I(s)(s->s3->internal)->send_connection_binding = 1; | |||
481 | ||||
482 | return 1; | |||
483 | ||||
484 | err: | |||
485 | SSLerror(s, SSL_R_RENEGOTIATION_ENCODING_ERR)SSL_error_internal(s, 336, "/usr/src/lib/libssl/ssl_tlsext.c" , 485); | |||
486 | *alert = SSL_AD_DECODE_ERROR50; | |||
487 | return 0; | |||
488 | } | |||
489 | ||||
490 | int | |||
491 | tlsext_ri_server_needs(SSL *s, uint16_t msg_type) | |||
492 | { | |||
493 | return (S3I(s)(s->s3->internal)->hs.negotiated_tls_version < TLS1_3_VERSION0x0304 && | |||
494 | S3I(s)(s->s3->internal)->send_connection_binding); | |||
495 | } | |||
496 | ||||
497 | int | |||
498 | tlsext_ri_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
499 | { | |||
500 | CBB reneg; | |||
501 | ||||
502 | if (!CBB_add_u8_length_prefixed(cbb, &reneg)) | |||
503 | return 0; | |||
504 | if (!CBB_add_bytes(&reneg, S3I(s)(s->s3->internal)->previous_client_finished, | |||
505 | S3I(s)(s->s3->internal)->previous_client_finished_len)) | |||
506 | return 0; | |||
507 | if (!CBB_add_bytes(&reneg, S3I(s)(s->s3->internal)->previous_server_finished, | |||
508 | S3I(s)(s->s3->internal)->previous_server_finished_len)) | |||
509 | return 0; | |||
510 | if (!CBB_flush(cbb)) | |||
511 | return 0; | |||
512 | ||||
513 | return 1; | |||
514 | } | |||
515 | ||||
516 | int | |||
517 | tlsext_ri_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
518 | { | |||
519 | CBS reneg, prev_client, prev_server; | |||
520 | ||||
521 | /* | |||
522 | * Ensure that the previous client and server values are both not | |||
523 | * present, or that they are both present. | |||
524 | */ | |||
525 | if ((S3I(s)(s->s3->internal)->previous_client_finished_len == 0 && | |||
526 | S3I(s)(s->s3->internal)->previous_server_finished_len != 0) || | |||
527 | (S3I(s)(s->s3->internal)->previous_client_finished_len != 0 && | |||
528 | S3I(s)(s->s3->internal)->previous_server_finished_len == 0)) { | |||
529 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
530 | return 0; | |||
531 | } | |||
532 | ||||
533 | if (!CBS_get_u8_length_prefixed(cbs, &reneg)) | |||
534 | goto err; | |||
535 | if (!CBS_get_bytes(&reneg, &prev_client, | |||
536 | S3I(s)(s->s3->internal)->previous_client_finished_len)) | |||
537 | goto err; | |||
538 | if (!CBS_get_bytes(&reneg, &prev_server, | |||
539 | S3I(s)(s->s3->internal)->previous_server_finished_len)) | |||
540 | goto err; | |||
541 | if (CBS_len(&reneg) != 0) | |||
542 | goto err; | |||
543 | if (CBS_len(cbs) != 0) | |||
544 | goto err; | |||
545 | ||||
546 | if (!CBS_mem_equal(&prev_client, S3I(s)(s->s3->internal)->previous_client_finished, | |||
547 | S3I(s)(s->s3->internal)->previous_client_finished_len)) { | |||
548 | SSLerror(s, SSL_R_RENEGOTIATION_MISMATCH)SSL_error_internal(s, 337, "/usr/src/lib/libssl/ssl_tlsext.c" , 548); | |||
549 | *alert = SSL_AD_HANDSHAKE_FAILURE40; | |||
550 | return 0; | |||
551 | } | |||
552 | if (!CBS_mem_equal(&prev_server, S3I(s)(s->s3->internal)->previous_server_finished, | |||
553 | S3I(s)(s->s3->internal)->previous_server_finished_len)) { | |||
554 | SSLerror(s, SSL_R_RENEGOTIATION_MISMATCH)SSL_error_internal(s, 337, "/usr/src/lib/libssl/ssl_tlsext.c" , 554); | |||
555 | *alert = SSL_AD_HANDSHAKE_FAILURE40; | |||
556 | return 0; | |||
557 | } | |||
558 | ||||
559 | S3I(s)(s->s3->internal)->renegotiate_seen = 1; | |||
560 | S3I(s)(s->s3->internal)->send_connection_binding = 1; | |||
561 | ||||
562 | return 1; | |||
563 | ||||
564 | err: | |||
565 | SSLerror(s, SSL_R_RENEGOTIATION_ENCODING_ERR)SSL_error_internal(s, 336, "/usr/src/lib/libssl/ssl_tlsext.c" , 565); | |||
566 | *alert = SSL_AD_DECODE_ERROR50; | |||
567 | return 0; | |||
568 | } | |||
569 | ||||
570 | /* | |||
571 | * Signature Algorithms - RFC 5246 section 7.4.1.4.1. | |||
572 | */ | |||
573 | int | |||
574 | tlsext_sigalgs_client_needs(SSL *s, uint16_t msg_type) | |||
575 | { | |||
576 | return (S3I(s)(s->s3->internal)->hs.our_max_tls_version >= TLS1_2_VERSION0x0303); | |||
577 | } | |||
578 | ||||
579 | int | |||
580 | tlsext_sigalgs_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
581 | { | |||
582 | uint16_t tls_version = S3I(s)(s->s3->internal)->hs.negotiated_tls_version; | |||
583 | CBB sigalgs; | |||
584 | ||||
585 | if (msg_type == SSL_TLSEXT_MSG_CH0x0001) | |||
586 | tls_version = S3I(s)(s->s3->internal)->hs.our_min_tls_version; | |||
587 | ||||
588 | if (!CBB_add_u16_length_prefixed(cbb, &sigalgs)) | |||
589 | return 0; | |||
590 | if (!ssl_sigalgs_build(tls_version, &sigalgs)) | |||
591 | return 0; | |||
592 | if (!CBB_flush(cbb)) | |||
593 | return 0; | |||
594 | ||||
595 | return 1; | |||
596 | } | |||
597 | ||||
598 | int | |||
599 | tlsext_sigalgs_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
600 | { | |||
601 | CBS sigalgs; | |||
602 | ||||
603 | if (!CBS_get_u16_length_prefixed(cbs, &sigalgs)) | |||
604 | return 0; | |||
605 | if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) | |||
606 | return 0; | |||
607 | if (!CBS_stow(&sigalgs, &S3I(s)(s->s3->internal)->hs.sigalgs, &S3I(s)(s->s3->internal)->hs.sigalgs_len)) | |||
608 | return 0; | |||
609 | ||||
610 | return 1; | |||
611 | } | |||
612 | ||||
613 | int | |||
614 | tlsext_sigalgs_server_needs(SSL *s, uint16_t msg_type) | |||
615 | { | |||
616 | return (S3I(s)(s->s3->internal)->hs.negotiated_tls_version >= TLS1_3_VERSION0x0304); | |||
617 | } | |||
618 | ||||
619 | int | |||
620 | tlsext_sigalgs_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
621 | { | |||
622 | CBB sigalgs; | |||
623 | ||||
624 | if (!CBB_add_u16_length_prefixed(cbb, &sigalgs)) | |||
625 | return 0; | |||
626 | if (!ssl_sigalgs_build(S3I(s)(s->s3->internal)->hs.negotiated_tls_version, &sigalgs)) | |||
627 | return 0; | |||
628 | if (!CBB_flush(cbb)) | |||
629 | return 0; | |||
630 | ||||
631 | return 1; | |||
632 | } | |||
633 | ||||
634 | int | |||
635 | tlsext_sigalgs_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
636 | { | |||
637 | CBS sigalgs; | |||
638 | ||||
639 | if (ssl_effective_tls_version(s) < TLS1_3_VERSION0x0304) | |||
640 | return 0; | |||
641 | ||||
642 | if (!CBS_get_u16_length_prefixed(cbs, &sigalgs)) | |||
643 | return 0; | |||
644 | if (CBS_len(&sigalgs) % 2 != 0 || CBS_len(&sigalgs) > 64) | |||
645 | return 0; | |||
646 | if (!CBS_stow(&sigalgs, &S3I(s)(s->s3->internal)->hs.sigalgs, &S3I(s)(s->s3->internal)->hs.sigalgs_len)) | |||
647 | return 0; | |||
648 | ||||
649 | return 1; | |||
650 | } | |||
651 | ||||
652 | /* | |||
653 | * Server Name Indication - RFC 6066, section 3. | |||
654 | */ | |||
655 | int | |||
656 | tlsext_sni_client_needs(SSL *s, uint16_t msg_type) | |||
657 | { | |||
658 | return (s->tlsext_hostname != NULL((void*)0)); | |||
659 | } | |||
660 | ||||
661 | int | |||
662 | tlsext_sni_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
663 | { | |||
664 | CBB server_name_list, host_name; | |||
665 | ||||
666 | if (!CBB_add_u16_length_prefixed(cbb, &server_name_list)) | |||
667 | return 0; | |||
668 | if (!CBB_add_u8(&server_name_list, TLSEXT_NAMETYPE_host_name0)) | |||
669 | return 0; | |||
670 | if (!CBB_add_u16_length_prefixed(&server_name_list, &host_name)) | |||
671 | return 0; | |||
672 | if (!CBB_add_bytes(&host_name, (const uint8_t *)s->tlsext_hostname, | |||
673 | strlen(s->tlsext_hostname))) | |||
674 | return 0; | |||
675 | if (!CBB_flush(cbb)) | |||
676 | return 0; | |||
677 | ||||
678 | return 1; | |||
679 | } | |||
680 | ||||
681 | static int | |||
682 | tlsext_sni_is_ip_literal(CBS *cbs, int *is_ip) | |||
683 | { | |||
684 | union { | |||
685 | struct in_addr ip4; | |||
686 | struct in6_addr ip6; | |||
687 | } addrbuf; | |||
688 | char *hostname = NULL((void*)0); | |||
689 | ||||
690 | *is_ip = 0; | |||
691 | ||||
692 | if (!CBS_strdup(cbs, &hostname)) | |||
693 | return 0; | |||
694 | ||||
695 | if (inet_pton(AF_INET2, hostname, &addrbuf) == 1 || | |||
696 | inet_pton(AF_INET624, hostname, &addrbuf) == 1) | |||
697 | *is_ip = 1; | |||
698 | ||||
699 | free(hostname); | |||
700 | ||||
701 | return 1; | |||
702 | } | |||
703 | ||||
704 | /* | |||
705 | * Validate that the CBS contains only a hostname consisting of RFC 5890 | |||
706 | * compliant A-labels (see RFC 6066 section 3). Not a complete check | |||
707 | * since we don't parse punycode to verify its validity but limits to | |||
708 | * correct structure and character set. | |||
709 | */ | |||
710 | int | |||
711 | tlsext_sni_is_valid_hostname(CBS *cbs, int *is_ip) | |||
712 | { | |||
713 | uint8_t prev, c = 0; | |||
714 | int component = 0; | |||
715 | CBS hostname; | |||
716 | ||||
717 | CBS_dup(cbs, &hostname); | |||
718 | ||||
719 | if (CBS_len(&hostname) > TLSEXT_MAXLEN_host_name255) | |||
720 | return 0; | |||
721 | ||||
722 | /* An IP literal is invalid as a host name (RFC 6066 section 3). */ | |||
723 | if (!tlsext_sni_is_ip_literal(&hostname, is_ip)) | |||
724 | return 0; | |||
725 | if (*is_ip) | |||
726 | return 0; | |||
727 | ||||
728 | while (CBS_len(&hostname) > 0) { | |||
729 | prev = c; | |||
730 | if (!CBS_get_u8(&hostname, &c)) | |||
731 | return 0; | |||
732 | /* Everything has to be ASCII, with no NUL byte. */ | |||
733 | if (!isascii(c) || c == '\0') | |||
734 | return 0; | |||
735 | /* It must be alphanumeric, a '-', or a '.' */ | |||
736 | if (!isalnum(c) && c != '-' && c != '.') | |||
737 | return 0; | |||
738 | /* '-' and '.' must not start a component or be at the end. */ | |||
739 | if (component == 0 || CBS_len(&hostname) == 0) { | |||
740 | if (c == '-' || c == '.') | |||
741 | return 0; | |||
742 | } | |||
743 | if (c == '.') { | |||
744 | /* Components can not end with a dash. */ | |||
745 | if (prev == '-') | |||
746 | return 0; | |||
747 | /* Start new component */ | |||
748 | component = 0; | |||
749 | continue; | |||
750 | } | |||
751 | /* Components must be 63 chars or less. */ | |||
752 | if (++component > 63) | |||
753 | return 0; | |||
754 | } | |||
755 | ||||
756 | return 1; | |||
757 | } | |||
758 | ||||
759 | int | |||
760 | tlsext_sni_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
761 | { | |||
762 | CBS server_name_list, host_name; | |||
763 | uint8_t name_type; | |||
764 | int is_ip; | |||
| ||||
765 | ||||
766 | if (!CBS_get_u16_length_prefixed(cbs, &server_name_list)) | |||
767 | goto err; | |||
768 | ||||
769 | if (!CBS_get_u8(&server_name_list, &name_type)) | |||
770 | goto err; | |||
771 | ||||
772 | /* | |||
773 | * RFC 6066 section 3, only one type (host_name) is specified. | |||
774 | * We do not tolerate unknown types, neither does BoringSSL. | |||
775 | * other implementations appear more tolerant. | |||
776 | */ | |||
777 | if (name_type != TLSEXT_NAMETYPE_host_name0) { | |||
778 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
779 | goto err; | |||
780 | } | |||
781 | ||||
782 | /* | |||
783 | * RFC 6066 section 3 specifies a host name must be at least 1 byte | |||
784 | * so 0 length is a decode error. | |||
785 | */ | |||
786 | if (!CBS_get_u16_length_prefixed(&server_name_list, &host_name)) | |||
787 | goto err; | |||
788 | if (CBS_len(&host_name) < 1) | |||
789 | goto err; | |||
790 | ||||
791 | if (!tlsext_sni_is_valid_hostname(&host_name, &is_ip)) { | |||
792 | /* | |||
793 | * Various pieces of software have been known to set the SNI | |||
794 | * host name to an IP address, even though that violates the | |||
795 | * RFC. If this is the case, pretend the SNI extension does | |||
796 | * not exist. | |||
797 | */ | |||
798 | if (is_ip) | |||
| ||||
799 | goto done; | |||
800 | ||||
801 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
802 | goto err; | |||
803 | } | |||
804 | ||||
805 | if (s->internal->hit || S3I(s)(s->s3->internal)->hs.tls13.hrr) { | |||
806 | if (s->session->tlsext_hostname == NULL((void*)0)) { | |||
807 | *alert = SSL_AD_UNRECOGNIZED_NAME112; | |||
808 | goto err; | |||
809 | } | |||
810 | if (!CBS_mem_equal(&host_name, s->session->tlsext_hostname, | |||
811 | strlen(s->session->tlsext_hostname))) { | |||
812 | *alert = SSL_AD_UNRECOGNIZED_NAME112; | |||
813 | goto err; | |||
814 | } | |||
815 | } else { | |||
816 | if (s->session->tlsext_hostname != NULL((void*)0)) | |||
817 | goto err; | |||
818 | if (!CBS_strdup(&host_name, &s->session->tlsext_hostname)) { | |||
819 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
820 | goto err; | |||
821 | } | |||
822 | } | |||
823 | ||||
824 | done: | |||
825 | /* | |||
826 | * RFC 6066 section 3 forbids multiple host names with the same type, | |||
827 | * therefore we allow only one entry. | |||
828 | */ | |||
829 | if (CBS_len(&server_name_list) != 0) { | |||
830 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
831 | goto err; | |||
832 | } | |||
833 | if (CBS_len(cbs) != 0) | |||
834 | goto err; | |||
835 | ||||
836 | return 1; | |||
837 | ||||
838 | err: | |||
839 | return 0; | |||
840 | } | |||
841 | ||||
842 | int | |||
843 | tlsext_sni_server_needs(SSL *s, uint16_t msg_type) | |||
844 | { | |||
845 | if (s->internal->hit) | |||
846 | return 0; | |||
847 | ||||
848 | return (s->session->tlsext_hostname != NULL((void*)0)); | |||
849 | } | |||
850 | ||||
851 | int | |||
852 | tlsext_sni_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
853 | { | |||
854 | return 1; | |||
855 | } | |||
856 | ||||
857 | int | |||
858 | tlsext_sni_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
859 | { | |||
860 | if (s->tlsext_hostname == NULL((void*)0) || CBS_len(cbs) != 0) { | |||
861 | *alert = SSL_AD_UNRECOGNIZED_NAME112; | |||
862 | return 0; | |||
863 | } | |||
864 | ||||
865 | if (s->internal->hit) { | |||
866 | if (s->session->tlsext_hostname == NULL((void*)0)) { | |||
867 | *alert = SSL_AD_UNRECOGNIZED_NAME112; | |||
868 | return 0; | |||
869 | } | |||
870 | if (strcmp(s->tlsext_hostname, | |||
871 | s->session->tlsext_hostname) != 0) { | |||
872 | *alert = SSL_AD_UNRECOGNIZED_NAME112; | |||
873 | return 0; | |||
874 | } | |||
875 | } else { | |||
876 | if (s->session->tlsext_hostname != NULL((void*)0)) { | |||
877 | *alert = SSL_AD_DECODE_ERROR50; | |||
878 | return 0; | |||
879 | } | |||
880 | if ((s->session->tlsext_hostname = | |||
881 | strdup(s->tlsext_hostname)) == NULL((void*)0)) { | |||
882 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
883 | return 0; | |||
884 | } | |||
885 | } | |||
886 | ||||
887 | return 1; | |||
888 | } | |||
889 | ||||
890 | ||||
891 | /* | |||
892 | * Certificate Status Request - RFC 6066 section 8. | |||
893 | */ | |||
894 | ||||
895 | int | |||
896 | tlsext_ocsp_client_needs(SSL *s, uint16_t msg_type) | |||
897 | { | |||
898 | if (msg_type != SSL_TLSEXT_MSG_CH0x0001) | |||
899 | return 0; | |||
900 | ||||
901 | return (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp1); | |||
902 | } | |||
903 | ||||
904 | int | |||
905 | tlsext_ocsp_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
906 | { | |||
907 | CBB respid_list, respid, exts; | |||
908 | unsigned char *ext_data; | |||
909 | size_t ext_len; | |||
910 | int i; | |||
911 | ||||
912 | if (!CBB_add_u8(cbb, TLSEXT_STATUSTYPE_ocsp1)) | |||
913 | return 0; | |||
914 | if (!CBB_add_u16_length_prefixed(cbb, &respid_list)) | |||
915 | return 0; | |||
916 | for (i = 0; i < sk_OCSP_RESPID_num(s->internal->tlsext_ocsp_ids)sk_num(((_STACK*) (1 ? (s->internal->tlsext_ocsp_ids) : (struct stack_st_OCSP_RESPID*)0))); i++) { | |||
917 | unsigned char *respid_data; | |||
918 | OCSP_RESPID *id; | |||
919 | size_t id_len; | |||
920 | ||||
921 | if ((id = sk_OCSP_RESPID_value(s->internal->tlsext_ocsp_ids,((OCSP_RESPID *)sk_value(((_STACK*) (1 ? (s->internal-> tlsext_ocsp_ids) : (struct stack_st_OCSP_RESPID*)0)), (i))) | |||
922 | i)((OCSP_RESPID *)sk_value(((_STACK*) (1 ? (s->internal-> tlsext_ocsp_ids) : (struct stack_st_OCSP_RESPID*)0)), (i)))) == NULL((void*)0)) | |||
923 | return 0; | |||
924 | if ((id_len = i2d_OCSP_RESPID(id, NULL((void*)0))) == -1) | |||
925 | return 0; | |||
926 | if (!CBB_add_u16_length_prefixed(&respid_list, &respid)) | |||
927 | return 0; | |||
928 | if (!CBB_add_space(&respid, &respid_data, id_len)) | |||
929 | return 0; | |||
930 | if ((i2d_OCSP_RESPID(id, &respid_data)) != id_len) | |||
931 | return 0; | |||
932 | } | |||
933 | if (!CBB_add_u16_length_prefixed(cbb, &exts)) | |||
934 | return 0; | |||
935 | if ((ext_len = i2d_X509_EXTENSIONS(s->internal->tlsext_ocsp_exts, | |||
936 | NULL((void*)0))) == -1) | |||
937 | return 0; | |||
938 | if (!CBB_add_space(&exts, &ext_data, ext_len)) | |||
939 | return 0; | |||
940 | if ((i2d_X509_EXTENSIONS(s->internal->tlsext_ocsp_exts, &ext_data) != | |||
941 | ext_len)) | |||
942 | return 0; | |||
943 | if (!CBB_flush(cbb)) | |||
944 | return 0; | |||
945 | return 1; | |||
946 | } | |||
947 | ||||
948 | int | |||
949 | tlsext_ocsp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
950 | { | |||
951 | int alert_desc = SSL_AD_DECODE_ERROR50; | |||
952 | CBS respid_list, respid, exts; | |||
953 | const unsigned char *p; | |||
954 | uint8_t status_type; | |||
955 | int ret = 0; | |||
956 | ||||
957 | if (msg_type != SSL_TLSEXT_MSG_CH0x0001) | |||
958 | goto err; | |||
959 | ||||
960 | if (!CBS_get_u8(cbs, &status_type)) | |||
961 | goto err; | |||
962 | if (status_type != TLSEXT_STATUSTYPE_ocsp1) { | |||
963 | /* ignore unknown status types */ | |||
964 | s->tlsext_status_type = -1; | |||
965 | ||||
966 | if (!CBS_skip(cbs, CBS_len(cbs))) { | |||
967 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
968 | return 0; | |||
969 | } | |||
970 | return 1; | |||
971 | } | |||
972 | s->tlsext_status_type = status_type; | |||
973 | if (!CBS_get_u16_length_prefixed(cbs, &respid_list)) | |||
974 | goto err; | |||
975 | ||||
976 | /* XXX */ | |||
977 | sk_OCSP_RESPID_pop_free(s->internal->tlsext_ocsp_ids, OCSP_RESPID_free)sk_pop_free(((_STACK*) (1 ? (s->internal->tlsext_ocsp_ids ) : (struct stack_st_OCSP_RESPID*)0)), ((void (*)(void *)) (( 1 ? (OCSP_RESPID_free) : (void (*)(OCSP_RESPID *))0)))); | |||
978 | s->internal->tlsext_ocsp_ids = NULL((void*)0); | |||
979 | if (CBS_len(&respid_list) > 0) { | |||
980 | s->internal->tlsext_ocsp_ids = sk_OCSP_RESPID_new_null()((struct stack_st_OCSP_RESPID *)sk_new_null()); | |||
981 | if (s->internal->tlsext_ocsp_ids == NULL((void*)0)) { | |||
982 | alert_desc = SSL_AD_INTERNAL_ERROR80; | |||
983 | goto err; | |||
984 | } | |||
985 | } | |||
986 | ||||
987 | while (CBS_len(&respid_list) > 0) { | |||
988 | OCSP_RESPID *id; | |||
989 | ||||
990 | if (!CBS_get_u16_length_prefixed(&respid_list, &respid)) | |||
991 | goto err; | |||
992 | p = CBS_data(&respid); | |||
993 | if ((id = d2i_OCSP_RESPID(NULL((void*)0), &p, CBS_len(&respid))) == NULL((void*)0)) | |||
994 | goto err; | |||
995 | if (!sk_OCSP_RESPID_push(s->internal->tlsext_ocsp_ids, id)sk_push(((_STACK*) (1 ? (s->internal->tlsext_ocsp_ids) : (struct stack_st_OCSP_RESPID*)0)), ((void*) (1 ? (id) : (OCSP_RESPID *)0)))) { | |||
996 | alert_desc = SSL_AD_INTERNAL_ERROR80; | |||
997 | OCSP_RESPID_free(id); | |||
998 | goto err; | |||
999 | } | |||
1000 | } | |||
1001 | ||||
1002 | /* Read in request_extensions */ | |||
1003 | if (!CBS_get_u16_length_prefixed(cbs, &exts)) | |||
1004 | goto err; | |||
1005 | if (CBS_len(&exts) > 0) { | |||
1006 | sk_X509_EXTENSION_pop_free(s->internal->tlsext_ocsp_exts,sk_pop_free(((_STACK*) (1 ? (s->internal->tlsext_ocsp_exts ) : (struct stack_st_X509_EXTENSION*)0)), ((void (*)(void *)) ((1 ? (X509_EXTENSION_free) : (void (*)(X509_EXTENSION *))0) ))) | |||
1007 | X509_EXTENSION_free)sk_pop_free(((_STACK*) (1 ? (s->internal->tlsext_ocsp_exts ) : (struct stack_st_X509_EXTENSION*)0)), ((void (*)(void *)) ((1 ? (X509_EXTENSION_free) : (void (*)(X509_EXTENSION *))0) ))); | |||
1008 | p = CBS_data(&exts); | |||
1009 | if ((s->internal->tlsext_ocsp_exts = d2i_X509_EXTENSIONS(NULL((void*)0), | |||
1010 | &p, CBS_len(&exts))) == NULL((void*)0)) | |||
1011 | goto err; | |||
1012 | } | |||
1013 | ||||
1014 | /* should be nothing left */ | |||
1015 | if (CBS_len(cbs) > 0) | |||
1016 | goto err; | |||
1017 | ||||
1018 | ret = 1; | |||
1019 | err: | |||
1020 | if (ret == 0) | |||
1021 | *alert = alert_desc; | |||
1022 | return ret; | |||
1023 | } | |||
1024 | ||||
1025 | int | |||
1026 | tlsext_ocsp_server_needs(SSL *s, uint16_t msg_type) | |||
1027 | { | |||
1028 | if (S3I(s)(s->s3->internal)->hs.negotiated_tls_version >= TLS1_3_VERSION0x0304 && | |||
1029 | s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp1 && | |||
1030 | s->ctx->internal->tlsext_status_cb != NULL((void*)0)) { | |||
1031 | s->internal->tlsext_status_expected = 0; | |||
1032 | if (s->ctx->internal->tlsext_status_cb(s, | |||
1033 | s->ctx->internal->tlsext_status_arg) == SSL_TLSEXT_ERR_OK0 && | |||
1034 | s->internal->tlsext_ocsp_resp_len > 0) | |||
1035 | s->internal->tlsext_status_expected = 1; | |||
1036 | } | |||
1037 | return s->internal->tlsext_status_expected; | |||
1038 | } | |||
1039 | ||||
1040 | int | |||
1041 | tlsext_ocsp_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1042 | { | |||
1043 | CBB ocsp_response; | |||
1044 | ||||
1045 | if (S3I(s)(s->s3->internal)->hs.negotiated_tls_version >= TLS1_3_VERSION0x0304) { | |||
1046 | if (!CBB_add_u8(cbb, TLSEXT_STATUSTYPE_ocsp1)) | |||
1047 | return 0; | |||
1048 | if (!CBB_add_u24_length_prefixed(cbb, &ocsp_response)) | |||
1049 | return 0; | |||
1050 | if (!CBB_add_bytes(&ocsp_response, | |||
1051 | s->internal->tlsext_ocsp_resp, | |||
1052 | s->internal->tlsext_ocsp_resp_len)) | |||
1053 | return 0; | |||
1054 | if (!CBB_flush(cbb)) | |||
1055 | return 0; | |||
1056 | } | |||
1057 | return 1; | |||
1058 | } | |||
1059 | ||||
1060 | int | |||
1061 | tlsext_ocsp_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1062 | { | |||
1063 | uint8_t status_type; | |||
1064 | CBS response; | |||
1065 | ||||
1066 | if (ssl_effective_tls_version(s) >= TLS1_3_VERSION0x0304) { | |||
1067 | if (msg_type == SSL_TLSEXT_MSG_CR0x0010) { | |||
1068 | /* | |||
1069 | * RFC 8446, 4.4.2.1 - the server may request an OCSP | |||
1070 | * response with an empty status_request. | |||
1071 | */ | |||
1072 | if (CBS_len(cbs) == 0) | |||
1073 | return 1; | |||
1074 | ||||
1075 | SSLerror(s, SSL_R_LENGTH_MISMATCH)SSL_error_internal(s, 159, "/usr/src/lib/libssl/ssl_tlsext.c" , 1075); | |||
1076 | return 0; | |||
1077 | } | |||
1078 | if (!CBS_get_u8(cbs, &status_type)) { | |||
1079 | SSLerror(s, SSL_R_LENGTH_MISMATCH)SSL_error_internal(s, 159, "/usr/src/lib/libssl/ssl_tlsext.c" , 1079); | |||
1080 | return 0; | |||
1081 | } | |||
1082 | if (status_type != TLSEXT_STATUSTYPE_ocsp1) { | |||
1083 | SSLerror(s, SSL_R_UNSUPPORTED_STATUS_TYPE)SSL_error_internal(s, 329, "/usr/src/lib/libssl/ssl_tlsext.c" , 1083); | |||
1084 | return 0; | |||
1085 | } | |||
1086 | if (!CBS_get_u24_length_prefixed(cbs, &response)) { | |||
1087 | SSLerror(s, SSL_R_LENGTH_MISMATCH)SSL_error_internal(s, 159, "/usr/src/lib/libssl/ssl_tlsext.c" , 1087); | |||
1088 | return 0; | |||
1089 | } | |||
1090 | if (CBS_len(&response) > 65536) { | |||
1091 | SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG)SSL_error_internal(s, 146, "/usr/src/lib/libssl/ssl_tlsext.c" , 1091); | |||
1092 | return 0; | |||
1093 | } | |||
1094 | if (!CBS_stow(&response, &s->internal->tlsext_ocsp_resp, | |||
1095 | &s->internal->tlsext_ocsp_resp_len)) { | |||
1096 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1097 | return 0; | |||
1098 | } | |||
1099 | } else { | |||
1100 | if (s->tlsext_status_type == -1) { | |||
1101 | *alert = SSL_AD_UNSUPPORTED_EXTENSION110; | |||
1102 | return 0; | |||
1103 | } | |||
1104 | /* Set flag to expect CertificateStatus message */ | |||
1105 | s->internal->tlsext_status_expected = 1; | |||
1106 | } | |||
1107 | return 1; | |||
1108 | } | |||
1109 | ||||
1110 | /* | |||
1111 | * SessionTicket extension - RFC 5077 section 3.2 | |||
1112 | */ | |||
1113 | int | |||
1114 | tlsext_sessionticket_client_needs(SSL *s, uint16_t msg_type) | |||
1115 | { | |||
1116 | /* | |||
1117 | * Send session ticket extension when enabled and not overridden. | |||
1118 | * | |||
1119 | * When renegotiating, send an empty session ticket to indicate support. | |||
1120 | */ | |||
1121 | if ((SSL_get_options(s)SSL_ctrl((s),32,0,((void*)0)) & SSL_OP_NO_TICKET0x00004000L) != 0) | |||
1122 | return 0; | |||
1123 | ||||
1124 | if (s->internal->new_session) | |||
1125 | return 1; | |||
1126 | ||||
1127 | if (s->internal->tlsext_session_ticket != NULL((void*)0) && | |||
1128 | s->internal->tlsext_session_ticket->data == NULL((void*)0)) | |||
1129 | return 0; | |||
1130 | ||||
1131 | return 1; | |||
1132 | } | |||
1133 | ||||
1134 | int | |||
1135 | tlsext_sessionticket_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1136 | { | |||
1137 | /* | |||
1138 | * Signal that we support session tickets by sending an empty | |||
1139 | * extension when renegotiating or no session found. | |||
1140 | */ | |||
1141 | if (s->internal->new_session || s->session == NULL((void*)0)) | |||
1142 | return 1; | |||
1143 | ||||
1144 | if (s->session->tlsext_tick != NULL((void*)0)) { | |||
1145 | /* Attempt to resume with an existing session ticket */ | |||
1146 | if (!CBB_add_bytes(cbb, s->session->tlsext_tick, | |||
1147 | s->session->tlsext_ticklen)) | |||
1148 | return 0; | |||
1149 | ||||
1150 | } else if (s->internal->tlsext_session_ticket != NULL((void*)0)) { | |||
1151 | /* | |||
1152 | * Attempt to resume with a custom provided session ticket set | |||
1153 | * by SSL_set_session_ticket_ext(). | |||
1154 | */ | |||
1155 | if (s->internal->tlsext_session_ticket->length > 0) { | |||
1156 | size_t ticklen = s->internal->tlsext_session_ticket->length; | |||
1157 | ||||
1158 | if ((s->session->tlsext_tick = malloc(ticklen)) == NULL((void*)0)) | |||
1159 | return 0; | |||
1160 | memcpy(s->session->tlsext_tick, | |||
1161 | s->internal->tlsext_session_ticket->data, | |||
1162 | ticklen); | |||
1163 | s->session->tlsext_ticklen = ticklen; | |||
1164 | ||||
1165 | if (!CBB_add_bytes(cbb, s->session->tlsext_tick, | |||
1166 | s->session->tlsext_ticklen)) | |||
1167 | return 0; | |||
1168 | } | |||
1169 | } | |||
1170 | ||||
1171 | if (!CBB_flush(cbb)) | |||
1172 | return 0; | |||
1173 | ||||
1174 | return 1; | |||
1175 | } | |||
1176 | ||||
1177 | int | |||
1178 | tlsext_sessionticket_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, | |||
1179 | int *alert) | |||
1180 | { | |||
1181 | if (s->internal->tls_session_ticket_ext_cb) { | |||
1182 | if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs), | |||
1183 | (int)CBS_len(cbs), | |||
1184 | s->internal->tls_session_ticket_ext_cb_arg)) { | |||
1185 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1186 | return 0; | |||
1187 | } | |||
1188 | } | |||
1189 | ||||
1190 | /* We need to signal that this was processed fully */ | |||
1191 | if (!CBS_skip(cbs, CBS_len(cbs))) { | |||
1192 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1193 | return 0; | |||
1194 | } | |||
1195 | ||||
1196 | return 1; | |||
1197 | } | |||
1198 | ||||
1199 | int | |||
1200 | tlsext_sessionticket_server_needs(SSL *s, uint16_t msg_type) | |||
1201 | { | |||
1202 | return (s->internal->tlsext_ticket_expected && | |||
1203 | !(SSL_get_options(s)SSL_ctrl((s),32,0,((void*)0)) & SSL_OP_NO_TICKET0x00004000L)); | |||
1204 | } | |||
1205 | ||||
1206 | int | |||
1207 | tlsext_sessionticket_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1208 | { | |||
1209 | /* Empty ticket */ | |||
1210 | return 1; | |||
1211 | } | |||
1212 | ||||
1213 | int | |||
1214 | tlsext_sessionticket_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, | |||
1215 | int *alert) | |||
1216 | { | |||
1217 | if (s->internal->tls_session_ticket_ext_cb) { | |||
1218 | if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs), | |||
1219 | (int)CBS_len(cbs), | |||
1220 | s->internal->tls_session_ticket_ext_cb_arg)) { | |||
1221 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1222 | return 0; | |||
1223 | } | |||
1224 | } | |||
1225 | ||||
1226 | if ((SSL_get_options(s)SSL_ctrl((s),32,0,((void*)0)) & SSL_OP_NO_TICKET0x00004000L) != 0 || CBS_len(cbs) > 0) { | |||
1227 | *alert = SSL_AD_UNSUPPORTED_EXTENSION110; | |||
1228 | return 0; | |||
1229 | } | |||
1230 | ||||
1231 | s->internal->tlsext_ticket_expected = 1; | |||
1232 | ||||
1233 | return 1; | |||
1234 | } | |||
1235 | ||||
1236 | /* | |||
1237 | * DTLS extension for SRTP key establishment - RFC 5764 | |||
1238 | */ | |||
1239 | ||||
1240 | #ifndef OPENSSL_NO_SRTP | |||
1241 | ||||
1242 | int | |||
1243 | tlsext_srtp_client_needs(SSL *s, uint16_t msg_type) | |||
1244 | { | |||
1245 | return SSL_is_dtls(s) && SSL_get_srtp_profiles(s) != NULL((void*)0); | |||
1246 | } | |||
1247 | ||||
1248 | int | |||
1249 | tlsext_srtp_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1250 | { | |||
1251 | CBB profiles, mki; | |||
1252 | int ct, i; | |||
1253 | STACK_OF(SRTP_PROTECTION_PROFILE)struct stack_st_SRTP_PROTECTION_PROFILE *clnt = NULL((void*)0); | |||
1254 | const SRTP_PROTECTION_PROFILE *prof; | |||
1255 | ||||
1256 | if ((clnt = SSL_get_srtp_profiles(s)) == NULL((void*)0)) { | |||
1257 | SSLerror(s, SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST)SSL_error_internal(s, 354, "/usr/src/lib/libssl/ssl_tlsext.c" , 1257); | |||
1258 | return 0; | |||
1259 | } | |||
1260 | ||||
1261 | if ((ct = sk_SRTP_PROTECTION_PROFILE_num(clnt)sk_num(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE *)0)))) < 1) { | |||
1262 | SSLerror(s, SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST)SSL_error_internal(s, 354, "/usr/src/lib/libssl/ssl_tlsext.c" , 1262); | |||
1263 | return 0; | |||
1264 | } | |||
1265 | ||||
1266 | if (!CBB_add_u16_length_prefixed(cbb, &profiles)) | |||
1267 | return 0; | |||
1268 | ||||
1269 | for (i = 0; i < ct; i++) { | |||
1270 | if ((prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i)((SRTP_PROTECTION_PROFILE *)sk_value(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE*)0)), (i)))) == NULL((void*)0)) | |||
1271 | return 0; | |||
1272 | if (!CBB_add_u16(&profiles, prof->id)) | |||
1273 | return 0; | |||
1274 | } | |||
1275 | ||||
1276 | if (!CBB_add_u8_length_prefixed(cbb, &mki)) | |||
1277 | return 0; | |||
1278 | ||||
1279 | if (!CBB_flush(cbb)) | |||
1280 | return 0; | |||
1281 | ||||
1282 | return 1; | |||
1283 | } | |||
1284 | ||||
1285 | int | |||
1286 | tlsext_srtp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1287 | { | |||
1288 | const SRTP_PROTECTION_PROFILE *cprof, *sprof; | |||
1289 | STACK_OF(SRTP_PROTECTION_PROFILE)struct stack_st_SRTP_PROTECTION_PROFILE *clnt = NULL((void*)0), *srvr; | |||
1290 | int i, j; | |||
1291 | int ret; | |||
1292 | uint16_t id; | |||
1293 | CBS profiles, mki; | |||
1294 | ||||
1295 | ret = 0; | |||
1296 | ||||
1297 | if (!CBS_get_u16_length_prefixed(cbs, &profiles)) | |||
1298 | goto err; | |||
1299 | if (CBS_len(&profiles) == 0 || CBS_len(&profiles) % 2 != 0) | |||
1300 | goto err; | |||
1301 | ||||
1302 | if ((clnt = sk_SRTP_PROTECTION_PROFILE_new_null()((struct stack_st_SRTP_PROTECTION_PROFILE *)sk_new_null())) == NULL((void*)0)) | |||
1303 | goto err; | |||
1304 | ||||
1305 | while (CBS_len(&profiles) > 0) { | |||
1306 | if (!CBS_get_u16(&profiles, &id)) | |||
1307 | goto err; | |||
1308 | ||||
1309 | if (!srtp_find_profile_by_num(id, &cprof)) { | |||
1310 | if (!sk_SRTP_PROTECTION_PROFILE_push(clnt, cprof)sk_push(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE *)0)), ((void*) (1 ? (cprof) : (SRTP_PROTECTION_PROFILE*)0)))) | |||
1311 | goto err; | |||
1312 | } | |||
1313 | } | |||
1314 | ||||
1315 | if (!CBS_get_u8_length_prefixed(cbs, &mki) || CBS_len(&mki) != 0) { | |||
1316 | SSLerror(s, SSL_R_BAD_SRTP_MKI_VALUE)SSL_error_internal(s, 352, "/usr/src/lib/libssl/ssl_tlsext.c" , 1316); | |||
1317 | *alert = SSL_AD_DECODE_ERROR50; | |||
1318 | goto done; | |||
1319 | } | |||
1320 | if (CBS_len(cbs) != 0) | |||
1321 | goto err; | |||
1322 | ||||
1323 | /* | |||
1324 | * Per RFC 5764 section 4.1.1 | |||
1325 | * | |||
1326 | * Find the server preferred profile using the client's list. | |||
1327 | * | |||
1328 | * The server MUST send a profile if it sends the use_srtp | |||
1329 | * extension. If one is not found, it should fall back to the | |||
1330 | * negotiated DTLS cipher suite or return a DTLS alert. | |||
1331 | */ | |||
1332 | if ((srvr = SSL_get_srtp_profiles(s)) == NULL((void*)0)) | |||
1333 | goto err; | |||
1334 | for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(srvr)sk_num(((_STACK*) (1 ? (srvr) : (struct stack_st_SRTP_PROTECTION_PROFILE *)0))); i++) { | |||
1335 | if ((sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i)((SRTP_PROTECTION_PROFILE *)sk_value(((_STACK*) (1 ? (srvr) : (struct stack_st_SRTP_PROTECTION_PROFILE*)0)), (i)))) | |||
1336 | == NULL((void*)0)) | |||
1337 | goto err; | |||
1338 | ||||
1339 | for (j = 0; j < sk_SRTP_PROTECTION_PROFILE_num(clnt)sk_num(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE *)0))); j++) { | |||
1340 | if ((cprof = sk_SRTP_PROTECTION_PROFILE_value(clnt, j)((SRTP_PROTECTION_PROFILE *)sk_value(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE*)0)), (j)))) | |||
1341 | == NULL((void*)0)) | |||
1342 | goto err; | |||
1343 | ||||
1344 | if (cprof->id == sprof->id) { | |||
1345 | s->internal->srtp_profile = sprof; | |||
1346 | ret = 1; | |||
1347 | goto done; | |||
1348 | } | |||
1349 | } | |||
1350 | } | |||
1351 | ||||
1352 | /* If we didn't find anything, fall back to the negotiated */ | |||
1353 | ret = 1; | |||
1354 | goto done; | |||
1355 | ||||
1356 | err: | |||
1357 | SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST)SSL_error_internal(s, 353, "/usr/src/lib/libssl/ssl_tlsext.c" , 1357); | |||
1358 | *alert = SSL_AD_DECODE_ERROR50; | |||
1359 | ||||
1360 | done: | |||
1361 | sk_SRTP_PROTECTION_PROFILE_free(clnt)sk_free(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE *)0))); | |||
1362 | return ret; | |||
1363 | } | |||
1364 | ||||
1365 | int | |||
1366 | tlsext_srtp_server_needs(SSL *s, uint16_t msg_type) | |||
1367 | { | |||
1368 | return SSL_is_dtls(s) && SSL_get_selected_srtp_profile(s) != NULL((void*)0); | |||
1369 | } | |||
1370 | ||||
1371 | int | |||
1372 | tlsext_srtp_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1373 | { | |||
1374 | SRTP_PROTECTION_PROFILE *profile; | |||
1375 | CBB srtp, mki; | |||
1376 | ||||
1377 | if (!CBB_add_u16_length_prefixed(cbb, &srtp)) | |||
1378 | return 0; | |||
1379 | ||||
1380 | if ((profile = SSL_get_selected_srtp_profile(s)) == NULL((void*)0)) | |||
1381 | return 0; | |||
1382 | ||||
1383 | if (!CBB_add_u16(&srtp, profile->id)) | |||
1384 | return 0; | |||
1385 | ||||
1386 | if (!CBB_add_u8_length_prefixed(cbb, &mki)) | |||
1387 | return 0; | |||
1388 | ||||
1389 | if (!CBB_flush(cbb)) | |||
1390 | return 0; | |||
1391 | ||||
1392 | return 1; | |||
1393 | } | |||
1394 | ||||
1395 | int | |||
1396 | tlsext_srtp_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1397 | { | |||
1398 | STACK_OF(SRTP_PROTECTION_PROFILE)struct stack_st_SRTP_PROTECTION_PROFILE *clnt; | |||
1399 | const SRTP_PROTECTION_PROFILE *prof; | |||
1400 | int i; | |||
1401 | uint16_t id; | |||
1402 | CBS profile_ids, mki; | |||
1403 | ||||
1404 | if (!CBS_get_u16_length_prefixed(cbs, &profile_ids)) { | |||
1405 | SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST)SSL_error_internal(s, 353, "/usr/src/lib/libssl/ssl_tlsext.c" , 1405); | |||
1406 | goto err; | |||
1407 | } | |||
1408 | ||||
1409 | if (!CBS_get_u16(&profile_ids, &id) || CBS_len(&profile_ids) != 0) { | |||
1410 | SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST)SSL_error_internal(s, 353, "/usr/src/lib/libssl/ssl_tlsext.c" , 1410); | |||
1411 | goto err; | |||
1412 | } | |||
1413 | ||||
1414 | if (!CBS_get_u8_length_prefixed(cbs, &mki) || CBS_len(&mki) != 0) { | |||
1415 | SSLerror(s, SSL_R_BAD_SRTP_MKI_VALUE)SSL_error_internal(s, 352, "/usr/src/lib/libssl/ssl_tlsext.c" , 1415); | |||
1416 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
1417 | return 0; | |||
1418 | } | |||
1419 | ||||
1420 | if ((clnt = SSL_get_srtp_profiles(s)) == NULL((void*)0)) { | |||
1421 | SSLerror(s, SSL_R_NO_SRTP_PROFILES)SSL_error_internal(s, 359, "/usr/src/lib/libssl/ssl_tlsext.c" , 1421); | |||
1422 | goto err; | |||
1423 | } | |||
1424 | ||||
1425 | for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt)sk_num(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE *)0))); i++) { | |||
1426 | if ((prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i)((SRTP_PROTECTION_PROFILE *)sk_value(((_STACK*) (1 ? (clnt) : (struct stack_st_SRTP_PROTECTION_PROFILE*)0)), (i)))) | |||
1427 | == NULL((void*)0)) { | |||
1428 | SSLerror(s, SSL_R_NO_SRTP_PROFILES)SSL_error_internal(s, 359, "/usr/src/lib/libssl/ssl_tlsext.c" , 1428); | |||
1429 | goto err; | |||
1430 | } | |||
1431 | ||||
1432 | if (prof->id == id) { | |||
1433 | s->internal->srtp_profile = prof; | |||
1434 | return 1; | |||
1435 | } | |||
1436 | } | |||
1437 | ||||
1438 | SSLerror(s, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST)SSL_error_internal(s, 353, "/usr/src/lib/libssl/ssl_tlsext.c" , 1438); | |||
1439 | err: | |||
1440 | *alert = SSL_AD_DECODE_ERROR50; | |||
1441 | return 0; | |||
1442 | } | |||
1443 | ||||
1444 | #endif /* OPENSSL_NO_SRTP */ | |||
1445 | ||||
1446 | /* | |||
1447 | * TLSv1.3 Key Share - RFC 8446 section 4.2.8. | |||
1448 | */ | |||
1449 | int | |||
1450 | tlsext_keyshare_client_needs(SSL *s, uint16_t msg_type) | |||
1451 | { | |||
1452 | return (S3I(s)(s->s3->internal)->hs.our_max_tls_version >= TLS1_3_VERSION0x0304); | |||
1453 | } | |||
1454 | ||||
1455 | int | |||
1456 | tlsext_keyshare_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1457 | { | |||
1458 | CBB client_shares, key_exchange; | |||
1459 | ||||
1460 | if (!CBB_add_u16_length_prefixed(cbb, &client_shares)) | |||
1461 | return 0; | |||
1462 | ||||
1463 | if (!CBB_add_u16(&client_shares, | |||
1464 | tls_key_share_group(S3I(s)(s->s3->internal)->hs.key_share))) | |||
1465 | return 0; | |||
1466 | if (!CBB_add_u16_length_prefixed(&client_shares, &key_exchange)) | |||
1467 | return 0; | |||
1468 | if (!tls_key_share_public(S3I(s)(s->s3->internal)->hs.key_share, &key_exchange)) | |||
1469 | return 0; | |||
1470 | ||||
1471 | if (!CBB_flush(cbb)) | |||
1472 | return 0; | |||
1473 | ||||
1474 | return 1; | |||
1475 | } | |||
1476 | ||||
1477 | int | |||
1478 | tlsext_keyshare_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1479 | { | |||
1480 | CBS client_shares, key_exchange; | |||
1481 | int decode_error; | |||
1482 | uint16_t group; | |||
1483 | ||||
1484 | if (!CBS_get_u16_length_prefixed(cbs, &client_shares)) | |||
1485 | return 0; | |||
1486 | ||||
1487 | while (CBS_len(&client_shares) > 0) { | |||
1488 | ||||
1489 | /* Unpack client share. */ | |||
1490 | if (!CBS_get_u16(&client_shares, &group)) | |||
1491 | return 0; | |||
1492 | if (!CBS_get_u16_length_prefixed(&client_shares, &key_exchange)) | |||
1493 | return 0; | |||
1494 | ||||
1495 | /* | |||
1496 | * XXX - check key exchange against supported groups from client. | |||
1497 | * XXX - check that groups only appear once. | |||
1498 | */ | |||
1499 | ||||
1500 | /* | |||
1501 | * Ignore this client share if we're using earlier than TLSv1.3 | |||
1502 | * or we've already selected a key share. | |||
1503 | */ | |||
1504 | if (S3I(s)(s->s3->internal)->hs.our_max_tls_version < TLS1_3_VERSION0x0304) | |||
1505 | continue; | |||
1506 | if (S3I(s)(s->s3->internal)->hs.key_share != NULL((void*)0)) | |||
1507 | continue; | |||
1508 | ||||
1509 | /* XXX - consider implementing server preference. */ | |||
1510 | if (!tls1_check_curve(s, group)) | |||
1511 | continue; | |||
1512 | ||||
1513 | /* Decode and store the selected key share. */ | |||
1514 | if ((S3I(s)(s->s3->internal)->hs.key_share = tls_key_share_new(group)) == NULL((void*)0)) { | |||
1515 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1516 | return 0; | |||
1517 | } | |||
1518 | if (!tls_key_share_peer_public(S3I(s)(s->s3->internal)->hs.key_share, | |||
1519 | &key_exchange, &decode_error, NULL((void*)0))) { | |||
1520 | if (!decode_error) | |||
1521 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1522 | return 0; | |||
1523 | } | |||
1524 | } | |||
1525 | ||||
1526 | return 1; | |||
1527 | } | |||
1528 | ||||
1529 | int | |||
1530 | tlsext_keyshare_server_needs(SSL *s, uint16_t msg_type) | |||
1531 | { | |||
1532 | return (S3I(s)(s->s3->internal)->hs.negotiated_tls_version >= TLS1_3_VERSION0x0304 && | |||
1533 | tlsext_extension_seen(s, TLSEXT_TYPE_key_share51)); | |||
1534 | } | |||
1535 | ||||
1536 | int | |||
1537 | tlsext_keyshare_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1538 | { | |||
1539 | CBB key_exchange; | |||
1540 | ||||
1541 | /* In the case of a HRR, we only send the server selected group. */ | |||
1542 | if (S3I(s)(s->s3->internal)->hs.tls13.hrr) { | |||
1543 | if (S3I(s)(s->s3->internal)->hs.tls13.server_group == 0) | |||
1544 | return 0; | |||
1545 | return CBB_add_u16(cbb, S3I(s)(s->s3->internal)->hs.tls13.server_group); | |||
1546 | } | |||
1547 | ||||
1548 | if (S3I(s)(s->s3->internal)->hs.key_share == NULL((void*)0)) | |||
1549 | return 0; | |||
1550 | ||||
1551 | if (!CBB_add_u16(cbb, tls_key_share_group(S3I(s)(s->s3->internal)->hs.key_share))) | |||
1552 | return 0; | |||
1553 | if (!CBB_add_u16_length_prefixed(cbb, &key_exchange)) | |||
1554 | return 0; | |||
1555 | if (!tls_key_share_public(S3I(s)(s->s3->internal)->hs.key_share, &key_exchange)) | |||
1556 | return 0; | |||
1557 | ||||
1558 | if (!CBB_flush(cbb)) | |||
1559 | return 0; | |||
1560 | ||||
1561 | return 1; | |||
1562 | } | |||
1563 | ||||
1564 | int | |||
1565 | tlsext_keyshare_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1566 | { | |||
1567 | CBS key_exchange; | |||
1568 | int decode_error; | |||
1569 | uint16_t group; | |||
1570 | ||||
1571 | /* Unpack server share. */ | |||
1572 | if (!CBS_get_u16(cbs, &group)) | |||
1573 | return 0; | |||
1574 | ||||
1575 | if (CBS_len(cbs) == 0) { | |||
1576 | /* HRR does not include an actual key share, only the group. */ | |||
1577 | if (msg_type != SSL_TLSEXT_MSG_HRR0x0040) | |||
1578 | return 0; | |||
1579 | ||||
1580 | S3I(s)(s->s3->internal)->hs.tls13.server_group = group; | |||
1581 | return 1; | |||
1582 | } | |||
1583 | ||||
1584 | if (!CBS_get_u16_length_prefixed(cbs, &key_exchange)) | |||
1585 | return 0; | |||
1586 | ||||
1587 | if (S3I(s)(s->s3->internal)->hs.key_share == NULL((void*)0)) { | |||
1588 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1589 | return 0; | |||
1590 | } | |||
1591 | if (tls_key_share_group(S3I(s)(s->s3->internal)->hs.key_share) != group) { | |||
1592 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1593 | return 0; | |||
1594 | } | |||
1595 | if (!tls_key_share_peer_public(S3I(s)(s->s3->internal)->hs.key_share, | |||
1596 | &key_exchange, &decode_error, NULL((void*)0))) { | |||
1597 | if (!decode_error) | |||
1598 | *alert = SSL_AD_INTERNAL_ERROR80; | |||
1599 | return 0; | |||
1600 | } | |||
1601 | ||||
1602 | return 1; | |||
1603 | } | |||
1604 | ||||
1605 | /* | |||
1606 | * Supported Versions - RFC 8446 section 4.2.1. | |||
1607 | */ | |||
1608 | int | |||
1609 | tlsext_versions_client_needs(SSL *s, uint16_t msg_type) | |||
1610 | { | |||
1611 | return (S3I(s)(s->s3->internal)->hs.our_max_tls_version >= TLS1_3_VERSION0x0304); | |||
1612 | } | |||
1613 | ||||
1614 | int | |||
1615 | tlsext_versions_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1616 | { | |||
1617 | uint16_t max, min; | |||
1618 | uint16_t version; | |||
1619 | CBB versions; | |||
1620 | ||||
1621 | max = S3I(s)(s->s3->internal)->hs.our_max_tls_version; | |||
1622 | min = S3I(s)(s->s3->internal)->hs.our_min_tls_version; | |||
1623 | ||||
1624 | if (!CBB_add_u8_length_prefixed(cbb, &versions)) | |||
1625 | return 0; | |||
1626 | ||||
1627 | /* XXX - fix, but contiguous for now... */ | |||
1628 | for (version = max; version >= min; version--) { | |||
1629 | if (!CBB_add_u16(&versions, version)) | |||
1630 | return 0; | |||
1631 | } | |||
1632 | ||||
1633 | if (!CBB_flush(cbb)) | |||
1634 | return 0; | |||
1635 | ||||
1636 | return 1; | |||
1637 | } | |||
1638 | ||||
1639 | int | |||
1640 | tlsext_versions_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1641 | { | |||
1642 | CBS versions; | |||
1643 | uint16_t version; | |||
1644 | uint16_t max, min; | |||
1645 | uint16_t matched_version = 0; | |||
1646 | ||||
1647 | max = S3I(s)(s->s3->internal)->hs.our_max_tls_version; | |||
1648 | min = S3I(s)(s->s3->internal)->hs.our_min_tls_version; | |||
1649 | ||||
1650 | if (!CBS_get_u8_length_prefixed(cbs, &versions)) | |||
1651 | goto err; | |||
1652 | ||||
1653 | while (CBS_len(&versions) > 0) { | |||
1654 | if (!CBS_get_u16(&versions, &version)) | |||
1655 | goto err; | |||
1656 | /* | |||
1657 | * XXX What is below implements client preference, and | |||
1658 | * ignores any server preference entirely. | |||
1659 | */ | |||
1660 | if (matched_version == 0 && version >= min && version <= max) | |||
1661 | matched_version = version; | |||
1662 | } | |||
1663 | ||||
1664 | if (matched_version > 0) { | |||
1665 | /* XXX - this should be stored for later processing. */ | |||
1666 | s->version = matched_version; | |||
1667 | return 1; | |||
1668 | } | |||
1669 | ||||
1670 | *alert = SSL_AD_PROTOCOL_VERSION70; | |||
1671 | return 0; | |||
1672 | ||||
1673 | err: | |||
1674 | *alert = SSL_AD_DECODE_ERROR50; | |||
1675 | return 0; | |||
1676 | } | |||
1677 | ||||
1678 | int | |||
1679 | tlsext_versions_server_needs(SSL *s, uint16_t msg_type) | |||
1680 | { | |||
1681 | return (S3I(s)(s->s3->internal)->hs.negotiated_tls_version >= TLS1_3_VERSION0x0304); | |||
1682 | } | |||
1683 | ||||
1684 | int | |||
1685 | tlsext_versions_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1686 | { | |||
1687 | return CBB_add_u16(cbb, TLS1_3_VERSION0x0304); | |||
1688 | } | |||
1689 | ||||
1690 | int | |||
1691 | tlsext_versions_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1692 | { | |||
1693 | uint16_t selected_version; | |||
1694 | ||||
1695 | if (!CBS_get_u16(cbs, &selected_version)) { | |||
1696 | *alert = SSL_AD_DECODE_ERROR50; | |||
1697 | return 0; | |||
1698 | } | |||
1699 | ||||
1700 | /* XXX - need to fix for DTLS 1.3 */ | |||
1701 | if (selected_version < TLS1_3_VERSION0x0304) { | |||
1702 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
1703 | return 0; | |||
1704 | } | |||
1705 | ||||
1706 | /* XXX test between min and max once initialization code goes in */ | |||
1707 | S3I(s)(s->s3->internal)->hs.tls13.server_version = selected_version; | |||
1708 | ||||
1709 | return 1; | |||
1710 | } | |||
1711 | ||||
1712 | ||||
1713 | /* | |||
1714 | * Cookie - RFC 8446 section 4.2.2. | |||
1715 | */ | |||
1716 | ||||
1717 | int | |||
1718 | tlsext_cookie_client_needs(SSL *s, uint16_t msg_type) | |||
1719 | { | |||
1720 | return (S3I(s)(s->s3->internal)->hs.our_max_tls_version >= TLS1_3_VERSION0x0304 && | |||
1721 | S3I(s)(s->s3->internal)->hs.tls13.cookie_len > 0 && S3I(s)(s->s3->internal)->hs.tls13.cookie != NULL((void*)0)); | |||
1722 | } | |||
1723 | ||||
1724 | int | |||
1725 | tlsext_cookie_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1726 | { | |||
1727 | CBB cookie; | |||
1728 | ||||
1729 | if (!CBB_add_u16_length_prefixed(cbb, &cookie)) | |||
1730 | return 0; | |||
1731 | ||||
1732 | if (!CBB_add_bytes(&cookie, S3I(s)(s->s3->internal)->hs.tls13.cookie, | |||
1733 | S3I(s)(s->s3->internal)->hs.tls13.cookie_len)) | |||
1734 | return 0; | |||
1735 | ||||
1736 | if (!CBB_flush(cbb)) | |||
1737 | return 0; | |||
1738 | ||||
1739 | return 1; | |||
1740 | } | |||
1741 | ||||
1742 | int | |||
1743 | tlsext_cookie_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1744 | { | |||
1745 | CBS cookie; | |||
1746 | ||||
1747 | if (!CBS_get_u16_length_prefixed(cbs, &cookie)) | |||
1748 | goto err; | |||
1749 | ||||
1750 | if (CBS_len(&cookie) != S3I(s)(s->s3->internal)->hs.tls13.cookie_len) | |||
1751 | goto err; | |||
1752 | ||||
1753 | /* | |||
1754 | * Check provided cookie value against what server previously | |||
1755 | * sent - client *MUST* send the same cookie with new CR after | |||
1756 | * a cookie is sent by the server with an HRR. | |||
1757 | */ | |||
1758 | if (!CBS_mem_equal(&cookie, S3I(s)(s->s3->internal)->hs.tls13.cookie, | |||
1759 | S3I(s)(s->s3->internal)->hs.tls13.cookie_len)) { | |||
1760 | /* XXX special cookie mismatch alert? */ | |||
1761 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
1762 | return 0; | |||
1763 | } | |||
1764 | ||||
1765 | return 1; | |||
1766 | ||||
1767 | err: | |||
1768 | *alert = SSL_AD_DECODE_ERROR50; | |||
1769 | return 0; | |||
1770 | } | |||
1771 | ||||
1772 | int | |||
1773 | tlsext_cookie_server_needs(SSL *s, uint16_t msg_type) | |||
1774 | { | |||
1775 | /* | |||
1776 | * Server needs to set cookie value in tls13 handshake | |||
1777 | * in order to send one, should only be sent with HRR. | |||
1778 | */ | |||
1779 | return (S3I(s)(s->s3->internal)->hs.our_max_tls_version >= TLS1_3_VERSION0x0304 && | |||
1780 | S3I(s)(s->s3->internal)->hs.tls13.cookie_len > 0 && S3I(s)(s->s3->internal)->hs.tls13.cookie != NULL((void*)0)); | |||
1781 | } | |||
1782 | ||||
1783 | int | |||
1784 | tlsext_cookie_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
1785 | { | |||
1786 | CBB cookie; | |||
1787 | ||||
1788 | /* XXX deduplicate with client code */ | |||
1789 | ||||
1790 | if (!CBB_add_u16_length_prefixed(cbb, &cookie)) | |||
1791 | return 0; | |||
1792 | ||||
1793 | if (!CBB_add_bytes(&cookie, S3I(s)(s->s3->internal)->hs.tls13.cookie, | |||
1794 | S3I(s)(s->s3->internal)->hs.tls13.cookie_len)) | |||
1795 | return 0; | |||
1796 | ||||
1797 | if (!CBB_flush(cbb)) | |||
1798 | return 0; | |||
1799 | ||||
1800 | return 1; | |||
1801 | } | |||
1802 | ||||
1803 | int | |||
1804 | tlsext_cookie_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
1805 | { | |||
1806 | CBS cookie; | |||
1807 | ||||
1808 | /* | |||
1809 | * XXX This currently assumes we will not get a second | |||
1810 | * HRR from a server with a cookie to process after accepting | |||
1811 | * one from the server in the same handshake | |||
1812 | */ | |||
1813 | if (S3I(s)(s->s3->internal)->hs.tls13.cookie != NULL((void*)0) || | |||
1814 | S3I(s)(s->s3->internal)->hs.tls13.cookie_len != 0) { | |||
1815 | *alert = SSL_AD_ILLEGAL_PARAMETER47; | |||
1816 | return 0; | |||
1817 | } | |||
1818 | ||||
1819 | if (!CBS_get_u16_length_prefixed(cbs, &cookie)) | |||
1820 | goto err; | |||
1821 | ||||
1822 | if (!CBS_stow(&cookie, &S3I(s)(s->s3->internal)->hs.tls13.cookie, | |||
1823 | &S3I(s)(s->s3->internal)->hs.tls13.cookie_len)) | |||
1824 | goto err; | |||
1825 | ||||
1826 | return 1; | |||
1827 | ||||
1828 | err: | |||
1829 | *alert = SSL_AD_DECODE_ERROR50; | |||
1830 | return 0; | |||
1831 | } | |||
1832 | ||||
1833 | struct tls_extension_funcs { | |||
1834 | int (*needs)(SSL *s, uint16_t msg_type); | |||
1835 | int (*build)(SSL *s, uint16_t msg_type, CBB *cbb); | |||
1836 | int (*parse)(SSL *s, uint16_t msg_type, CBS *cbs, int *alert); | |||
1837 | }; | |||
1838 | ||||
1839 | struct tls_extension { | |||
1840 | uint16_t type; | |||
1841 | uint16_t messages; | |||
1842 | struct tls_extension_funcs client; | |||
1843 | struct tls_extension_funcs server; | |||
1844 | }; | |||
1845 | ||||
1846 | static const struct tls_extension tls_extensions[] = { | |||
1847 | { | |||
1848 | .type = TLSEXT_TYPE_supported_versions43, | |||
1849 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002 | | |||
1850 | SSL_TLSEXT_MSG_HRR0x0040, | |||
1851 | .client = { | |||
1852 | .needs = tlsext_versions_client_needs, | |||
1853 | .build = tlsext_versions_client_build, | |||
1854 | .parse = tlsext_versions_client_parse, | |||
1855 | }, | |||
1856 | .server = { | |||
1857 | .needs = tlsext_versions_server_needs, | |||
1858 | .build = tlsext_versions_server_build, | |||
1859 | .parse = tlsext_versions_server_parse, | |||
1860 | }, | |||
1861 | }, | |||
1862 | { | |||
1863 | .type = TLSEXT_TYPE_key_share51, | |||
1864 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002 | | |||
1865 | SSL_TLSEXT_MSG_HRR0x0040, | |||
1866 | .client = { | |||
1867 | .needs = tlsext_keyshare_client_needs, | |||
1868 | .build = tlsext_keyshare_client_build, | |||
1869 | .parse = tlsext_keyshare_client_parse, | |||
1870 | }, | |||
1871 | .server = { | |||
1872 | .needs = tlsext_keyshare_server_needs, | |||
1873 | .build = tlsext_keyshare_server_build, | |||
1874 | .parse = tlsext_keyshare_server_parse, | |||
1875 | }, | |||
1876 | }, | |||
1877 | { | |||
1878 | .type = TLSEXT_TYPE_server_name0, | |||
1879 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_EE0x0004, | |||
1880 | .client = { | |||
1881 | .needs = tlsext_sni_client_needs, | |||
1882 | .build = tlsext_sni_client_build, | |||
1883 | .parse = tlsext_sni_client_parse, | |||
1884 | }, | |||
1885 | .server = { | |||
1886 | .needs = tlsext_sni_server_needs, | |||
1887 | .build = tlsext_sni_server_build, | |||
1888 | .parse = tlsext_sni_server_parse, | |||
1889 | }, | |||
1890 | }, | |||
1891 | { | |||
1892 | .type = TLSEXT_TYPE_renegotiate0xff01, | |||
1893 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002, | |||
1894 | .client = { | |||
1895 | .needs = tlsext_ri_client_needs, | |||
1896 | .build = tlsext_ri_client_build, | |||
1897 | .parse = tlsext_ri_client_parse, | |||
1898 | }, | |||
1899 | .server = { | |||
1900 | .needs = tlsext_ri_server_needs, | |||
1901 | .build = tlsext_ri_server_build, | |||
1902 | .parse = tlsext_ri_server_parse, | |||
1903 | }, | |||
1904 | }, | |||
1905 | { | |||
1906 | .type = TLSEXT_TYPE_status_request5, | |||
1907 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_CR0x0010 | | |||
1908 | SSL_TLSEXT_MSG_CT0x0008, | |||
1909 | .client = { | |||
1910 | .needs = tlsext_ocsp_client_needs, | |||
1911 | .build = tlsext_ocsp_client_build, | |||
1912 | .parse = tlsext_ocsp_client_parse, | |||
1913 | }, | |||
1914 | .server = { | |||
1915 | .needs = tlsext_ocsp_server_needs, | |||
1916 | .build = tlsext_ocsp_server_build, | |||
1917 | .parse = tlsext_ocsp_server_parse, | |||
1918 | }, | |||
1919 | }, | |||
1920 | { | |||
1921 | .type = TLSEXT_TYPE_ec_point_formats11, | |||
1922 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002, | |||
1923 | .client = { | |||
1924 | .needs = tlsext_ecpf_client_needs, | |||
1925 | .build = tlsext_ecpf_client_build, | |||
1926 | .parse = tlsext_ecpf_client_parse, | |||
1927 | }, | |||
1928 | .server = { | |||
1929 | .needs = tlsext_ecpf_server_needs, | |||
1930 | .build = tlsext_ecpf_server_build, | |||
1931 | .parse = tlsext_ecpf_server_parse, | |||
1932 | }, | |||
1933 | }, | |||
1934 | { | |||
1935 | .type = TLSEXT_TYPE_supported_groups10, | |||
1936 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_EE0x0004, | |||
1937 | .client = { | |||
1938 | .needs = tlsext_supportedgroups_client_needs, | |||
1939 | .build = tlsext_supportedgroups_client_build, | |||
1940 | .parse = tlsext_supportedgroups_client_parse, | |||
1941 | }, | |||
1942 | .server = { | |||
1943 | .needs = tlsext_supportedgroups_server_needs, | |||
1944 | .build = tlsext_supportedgroups_server_build, | |||
1945 | .parse = tlsext_supportedgroups_server_parse, | |||
1946 | }, | |||
1947 | }, | |||
1948 | { | |||
1949 | .type = TLSEXT_TYPE_session_ticket35, | |||
1950 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002, | |||
1951 | .client = { | |||
1952 | .needs = tlsext_sessionticket_client_needs, | |||
1953 | .build = tlsext_sessionticket_client_build, | |||
1954 | .parse = tlsext_sessionticket_client_parse, | |||
1955 | }, | |||
1956 | .server = { | |||
1957 | .needs = tlsext_sessionticket_server_needs, | |||
1958 | .build = tlsext_sessionticket_server_build, | |||
1959 | .parse = tlsext_sessionticket_server_parse, | |||
1960 | }, | |||
1961 | }, | |||
1962 | { | |||
1963 | .type = TLSEXT_TYPE_signature_algorithms13, | |||
1964 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_CR0x0010, | |||
1965 | .client = { | |||
1966 | .needs = tlsext_sigalgs_client_needs, | |||
1967 | .build = tlsext_sigalgs_client_build, | |||
1968 | .parse = tlsext_sigalgs_client_parse, | |||
1969 | }, | |||
1970 | .server = { | |||
1971 | .needs = tlsext_sigalgs_server_needs, | |||
1972 | .build = tlsext_sigalgs_server_build, | |||
1973 | .parse = tlsext_sigalgs_server_parse, | |||
1974 | }, | |||
1975 | }, | |||
1976 | { | |||
1977 | .type = TLSEXT_TYPE_application_layer_protocol_negotiation16, | |||
1978 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_EE0x0004, | |||
1979 | .client = { | |||
1980 | .needs = tlsext_alpn_client_needs, | |||
1981 | .build = tlsext_alpn_client_build, | |||
1982 | .parse = tlsext_alpn_client_parse, | |||
1983 | }, | |||
1984 | .server = { | |||
1985 | .needs = tlsext_alpn_server_needs, | |||
1986 | .build = tlsext_alpn_server_build, | |||
1987 | .parse = tlsext_alpn_server_parse, | |||
1988 | }, | |||
1989 | }, | |||
1990 | { | |||
1991 | .type = TLSEXT_TYPE_cookie44, | |||
1992 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_HRR0x0040, | |||
1993 | .client = { | |||
1994 | .needs = tlsext_cookie_client_needs, | |||
1995 | .build = tlsext_cookie_client_build, | |||
1996 | .parse = tlsext_cookie_client_parse, | |||
1997 | }, | |||
1998 | .server = { | |||
1999 | .needs = tlsext_cookie_server_needs, | |||
2000 | .build = tlsext_cookie_server_build, | |||
2001 | .parse = tlsext_cookie_server_parse, | |||
2002 | }, | |||
2003 | }, | |||
2004 | #ifndef OPENSSL_NO_SRTP | |||
2005 | { | |||
2006 | .type = TLSEXT_TYPE_use_srtp14, | |||
2007 | .messages = SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002 /* XXX */ | | |||
2008 | SSL_TLSEXT_MSG_EE0x0004, | |||
2009 | .client = { | |||
2010 | .needs = tlsext_srtp_client_needs, | |||
2011 | .build = tlsext_srtp_client_build, | |||
2012 | .parse = tlsext_srtp_client_parse, | |||
2013 | }, | |||
2014 | .server = { | |||
2015 | .needs = tlsext_srtp_server_needs, | |||
2016 | .build = tlsext_srtp_server_build, | |||
2017 | .parse = tlsext_srtp_server_parse, | |||
2018 | }, | |||
2019 | } | |||
2020 | #endif /* OPENSSL_NO_SRTP */ | |||
2021 | }; | |||
2022 | ||||
2023 | #define N_TLS_EXTENSIONS(sizeof(tls_extensions) / sizeof(*tls_extensions)) (sizeof(tls_extensions) / sizeof(*tls_extensions)) | |||
2024 | ||||
2025 | /* Ensure that extensions fit in a uint32_t bitmask. */ | |||
2026 | CTASSERT(N_TLS_EXTENSIONS <= (sizeof(uint32_t) * 8))extern char _ctassert[((sizeof(tls_extensions) / sizeof(*tls_extensions )) <= (sizeof(uint32_t) * 8)) ? 1 : -1 ] __attribute__((__unused__ )); | |||
2027 | ||||
2028 | const struct tls_extension * | |||
2029 | tls_extension_find(uint16_t type, size_t *tls_extensions_idx) | |||
2030 | { | |||
2031 | size_t i; | |||
2032 | ||||
2033 | for (i = 0; i < N_TLS_EXTENSIONS(sizeof(tls_extensions) / sizeof(*tls_extensions)); i++) { | |||
2034 | if (tls_extensions[i].type == type) { | |||
2035 | *tls_extensions_idx = i; | |||
2036 | return &tls_extensions[i]; | |||
2037 | } | |||
2038 | } | |||
2039 | ||||
2040 | return NULL((void*)0); | |||
2041 | } | |||
2042 | ||||
2043 | int | |||
2044 | tlsext_extension_seen(SSL *s, uint16_t type) | |||
2045 | { | |||
2046 | size_t idx; | |||
2047 | ||||
2048 | if (tls_extension_find(type, &idx) == NULL((void*)0)) | |||
2049 | return 0; | |||
2050 | return ((S3I(s)(s->s3->internal)->hs.extensions_seen & (1 << idx)) != 0); | |||
2051 | } | |||
2052 | ||||
2053 | static const struct tls_extension_funcs * | |||
2054 | tlsext_funcs(const struct tls_extension *tlsext, int is_server) | |||
2055 | { | |||
2056 | if (is_server) | |||
2057 | return &tlsext->server; | |||
2058 | ||||
2059 | return &tlsext->client; | |||
2060 | } | |||
2061 | ||||
2062 | static int | |||
2063 | tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb) | |||
2064 | { | |||
2065 | const struct tls_extension_funcs *ext; | |||
2066 | const struct tls_extension *tlsext; | |||
2067 | CBB extensions, extension_data; | |||
2068 | int extensions_present = 0; | |||
2069 | uint16_t tls_version; | |||
2070 | size_t i; | |||
2071 | ||||
2072 | tls_version = ssl_effective_tls_version(s); | |||
2073 | ||||
2074 | if (!CBB_add_u16_length_prefixed(cbb, &extensions)) | |||
2075 | return 0; | |||
2076 | ||||
2077 | for (i = 0; i < N_TLS_EXTENSIONS(sizeof(tls_extensions) / sizeof(*tls_extensions)); i++) { | |||
2078 | tlsext = &tls_extensions[i]; | |||
2079 | ext = tlsext_funcs(tlsext, is_server); | |||
2080 | ||||
2081 | /* RFC 8446 Section 4.2 */ | |||
2082 | if (tls_version >= TLS1_3_VERSION0x0304 && | |||
2083 | !(tlsext->messages & msg_type)) | |||
2084 | continue; | |||
2085 | ||||
2086 | if (!ext->needs(s, msg_type)) | |||
2087 | continue; | |||
2088 | ||||
2089 | if (!CBB_add_u16(&extensions, tlsext->type)) | |||
2090 | return 0; | |||
2091 | if (!CBB_add_u16_length_prefixed(&extensions, &extension_data)) | |||
2092 | return 0; | |||
2093 | ||||
2094 | if (!ext->build(s, msg_type, &extension_data)) | |||
2095 | return 0; | |||
2096 | ||||
2097 | extensions_present = 1; | |||
2098 | } | |||
2099 | ||||
2100 | if (!extensions_present && | |||
2101 | (msg_type & (SSL_TLSEXT_MSG_CH0x0001 | SSL_TLSEXT_MSG_SH0x0002)) != 0) | |||
2102 | CBB_discard_child(cbb); | |||
2103 | ||||
2104 | if (!CBB_flush(cbb)) | |||
2105 | return 0; | |||
2106 | ||||
2107 | return 1; | |||
2108 | } | |||
2109 | ||||
2110 | int | |||
2111 | tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs) | |||
2112 | { | |||
2113 | /* | |||
2114 | * RFC 8446 4.1.2. For subsequent CH, early data will be removed, | |||
2115 | * cookie may be added, padding may be removed. | |||
2116 | */ | |||
2117 | struct tls13_ctx *ctx = s->internal->tls13; | |||
2118 | ||||
2119 | if (type == TLSEXT_TYPE_early_data42 || type == TLSEXT_TYPE_cookie44 || | |||
2120 | type == TLSEXT_TYPE_padding21) | |||
2121 | return 1; | |||
2122 | if (!tls13_clienthello_hash_update_bytes(ctx, (void *)&type, | |||
2123 | sizeof(type))) | |||
2124 | return 0; | |||
2125 | /* | |||
2126 | * key_share data may be changed, and pre_shared_key data may | |||
2127 | * be changed | |||
2128 | */ | |||
2129 | if (type == TLSEXT_TYPE_pre_shared_key41 || type == TLSEXT_TYPE_key_share51) | |||
2130 | return 1; | |||
2131 | if (!tls13_clienthello_hash_update(ctx, cbs)) | |||
2132 | return 0; | |||
2133 | ||||
2134 | return 1; | |||
2135 | } | |||
2136 | ||||
2137 | static int | |||
2138 | tlsext_parse(SSL *s, int is_server, uint16_t msg_type, CBS *cbs, int *alert) | |||
2139 | { | |||
2140 | const struct tls_extension_funcs *ext; | |||
2141 | const struct tls_extension *tlsext; | |||
2142 | CBS extensions, extension_data; | |||
2143 | uint16_t type; | |||
2144 | size_t idx; | |||
2145 | uint16_t tls_version; | |||
2146 | int alert_desc; | |||
2147 | ||||
2148 | tls_version = ssl_effective_tls_version(s); | |||
2149 | ||||
2150 | S3I(s)(s->s3->internal)->hs.extensions_seen = 0; | |||
2151 | ||||
2152 | /* An empty extensions block is valid. */ | |||
2153 | if (CBS_len(cbs) == 0) | |||
2154 | return 1; | |||
2155 | ||||
2156 | alert_desc = SSL_AD_DECODE_ERROR50; | |||
2157 | ||||
2158 | if (!CBS_get_u16_length_prefixed(cbs, &extensions)) | |||
2159 | goto err; | |||
2160 | ||||
2161 | while (CBS_len(&extensions) > 0) { | |||
2162 | if (!CBS_get_u16(&extensions, &type)) | |||
2163 | goto err; | |||
2164 | if (!CBS_get_u16_length_prefixed(&extensions, &extension_data)) | |||
2165 | goto err; | |||
2166 | ||||
2167 | if (s->internal->tlsext_debug_cb != NULL((void*)0)) | |||
2168 | s->internal->tlsext_debug_cb(s, !is_server, type, | |||
2169 | (unsigned char *)CBS_data(&extension_data), | |||
2170 | CBS_len(&extension_data), | |||
2171 | s->internal->tlsext_debug_arg); | |||
2172 | ||||
2173 | /* Unknown extensions are ignored. */ | |||
2174 | if ((tlsext = tls_extension_find(type, &idx)) == NULL((void*)0)) | |||
2175 | continue; | |||
2176 | ||||
2177 | if (tls_version >= TLS1_3_VERSION0x0304 && is_server && | |||
2178 | msg_type == SSL_TLSEXT_MSG_CH0x0001) { | |||
2179 | if (!tlsext_clienthello_hash_extension(s, type, | |||
2180 | &extension_data)) | |||
2181 | goto err; | |||
2182 | } | |||
2183 | ||||
2184 | /* RFC 8446 Section 4.2 */ | |||
2185 | if (tls_version >= TLS1_3_VERSION0x0304 && | |||
2186 | !(tlsext->messages & msg_type)) { | |||
2187 | alert_desc = SSL_AD_ILLEGAL_PARAMETER47; | |||
2188 | goto err; | |||
2189 | } | |||
2190 | ||||
2191 | /* Check for duplicate known extensions. */ | |||
2192 | if ((S3I(s)(s->s3->internal)->hs.extensions_seen & (1 << idx)) != 0) | |||
2193 | goto err; | |||
2194 | S3I(s)(s->s3->internal)->hs.extensions_seen |= (1 << idx); | |||
2195 | ||||
2196 | ext = tlsext_funcs(tlsext, is_server); | |||
2197 | if (!ext->parse(s, msg_type, &extension_data, &alert_desc)) | |||
2198 | goto err; | |||
2199 | ||||
2200 | if (CBS_len(&extension_data) != 0) | |||
2201 | goto err; | |||
2202 | } | |||
2203 | ||||
2204 | return 1; | |||
2205 | ||||
2206 | err: | |||
2207 | *alert = alert_desc; | |||
2208 | ||||
2209 | return 0; | |||
2210 | } | |||
2211 | ||||
2212 | static void | |||
2213 | tlsext_server_reset_state(SSL *s) | |||
2214 | { | |||
2215 | s->tlsext_status_type = -1; | |||
2216 | S3I(s)(s->s3->internal)->renegotiate_seen = 0; | |||
2217 | free(S3I(s)(s->s3->internal)->alpn_selected); | |||
2218 | S3I(s)(s->s3->internal)->alpn_selected = NULL((void*)0); | |||
2219 | S3I(s)(s->s3->internal)->alpn_selected_len = 0; | |||
2220 | s->internal->srtp_profile = NULL((void*)0); | |||
2221 | } | |||
2222 | ||||
2223 | int | |||
2224 | tlsext_server_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
2225 | { | |||
2226 | return tlsext_build(s, 1, msg_type, cbb); | |||
2227 | } | |||
2228 | ||||
2229 | int | |||
2230 | tlsext_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
2231 | { | |||
2232 | /* XXX - this should be done by the caller... */ | |||
2233 | if (msg_type == SSL_TLSEXT_MSG_CH0x0001) | |||
2234 | tlsext_server_reset_state(s); | |||
2235 | ||||
2236 | return tlsext_parse(s, 1, msg_type, cbs, alert); | |||
2237 | } | |||
2238 | ||||
2239 | static void | |||
2240 | tlsext_client_reset_state(SSL *s) | |||
2241 | { | |||
2242 | S3I(s)(s->s3->internal)->renegotiate_seen = 0; | |||
2243 | free(S3I(s)(s->s3->internal)->alpn_selected); | |||
2244 | S3I(s)(s->s3->internal)->alpn_selected = NULL((void*)0); | |||
2245 | S3I(s)(s->s3->internal)->alpn_selected_len = 0; | |||
2246 | } | |||
2247 | ||||
2248 | int | |||
2249 | tlsext_client_build(SSL *s, uint16_t msg_type, CBB *cbb) | |||
2250 | { | |||
2251 | return tlsext_build(s, 0, msg_type, cbb); | |||
2252 | } | |||
2253 | ||||
2254 | int | |||
2255 | tlsext_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert) | |||
2256 | { | |||
2257 | /* XXX - this should be done by the caller... */ | |||
2258 | if (msg_type == SSL_TLSEXT_MSG_SH0x0002) | |||
2259 | tlsext_client_reset_state(s); | |||
2260 | ||||
2261 | return tlsext_parse(s, 0, msg_type, cbs, alert); | |||
2262 | } |