diff options
Diffstat (limited to 'ssl/statem/statem_clnt.c')
| -rw-r--r-- | ssl/statem/statem_clnt.c | 993 |
1 files changed, 702 insertions, 291 deletions
diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index 3cd1ee2d3dfe..3990a2b0c219 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -1,5 +1,5 @@ /* - * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved. * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved * Copyright 2005 Nokia. All rights reserved. * @@ -27,15 +27,24 @@ #include <openssl/core_names.h> #include <openssl/param_build.h> #include "internal/cryptlib.h" +#include "internal/comp.h" +#include "internal/ssl_unwrap.h" -static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt); -static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt); +static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s, + PACKET *pkt); +static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s, + PACKET *pkt); -static ossl_inline int cert_req_allowed(SSL *s); -static int key_exchange_expected(SSL *s); -static int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, +static ossl_inline int cert_req_allowed(SSL_CONNECTION *s); +static int key_exchange_expected(SSL_CONNECTION *s); +static int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt); +static ossl_inline int received_server_cert(SSL_CONNECTION *sc) +{ + return sc->session->peer_rpk != NULL || sc->session->peer != NULL; +} + /* * Is a CertificateRequest message allowed at the moment or not? * @@ -43,7 +52,7 @@ static int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, * 1: Yes * 0: No */ -static ossl_inline int cert_req_allowed(SSL *s) +static ossl_inline int cert_req_allowed(SSL_CONNECTION *s) { /* TLS does not like anon-DH with client cert */ if ((s->version > SSL3_VERSION @@ -61,7 +70,7 @@ static ossl_inline int cert_req_allowed(SSL *s) * 1: Yes * 0: No */ -static int key_exchange_expected(SSL *s) +static int key_exchange_expected(SSL_CONNECTION *s) { long alg_k = s->s3.tmp.new_cipher->algorithm_mkey; @@ -86,7 +95,7 @@ static int key_exchange_expected(SSL *s) * Return values are 1 for success (transition allowed) and 0 on error * (transition not allowed) */ -static int ossl_statem_client13_read_transition(SSL *s, int mt) +static int ossl_statem_client13_read_transition(SSL_CONNECTION *s, int mt) { OSSL_STATEM *st = &s->statem; @@ -133,6 +142,13 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) st->hand_state = TLS_ST_CR_CERT; return 1; } +#ifndef OPENSSL_NO_COMP_ALG + if (mt == SSL3_MT_COMPRESSED_CERTIFICATE + && s->ext.compress_certificate_sent) { + st->hand_state = TLS_ST_CR_COMP_CERT; + return 1; + } +#endif } break; @@ -141,9 +157,17 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) st->hand_state = TLS_ST_CR_CERT; return 1; } +#ifndef OPENSSL_NO_COMP_ALG + if (mt == SSL3_MT_COMPRESSED_CERTIFICATE + && s->ext.compress_certificate_sent) { + st->hand_state = TLS_ST_CR_COMP_CERT; + return 1; + } +#endif break; case TLS_ST_CR_CERT: + case TLS_ST_CR_COMP_CERT: if (mt == SSL3_MT_CERTIFICATE_VERIFY) { st->hand_state = TLS_ST_CR_CERT_VRFY; return 1; @@ -162,7 +186,7 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) st->hand_state = TLS_ST_CR_SESSION_TICKET; return 1; } - if (mt == SSL3_MT_KEY_UPDATE) { + if (mt == SSL3_MT_KEY_UPDATE && !SSL_IS_QUIC_HANDSHAKE(s)) { st->hand_state = TLS_ST_CR_KEY_UPDATE; return 1; } @@ -171,7 +195,8 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) /* Restore digest for PHA before adding message.*/ # error Internal DTLS version error #endif - if (!SSL_IS_DTLS(s) && s->post_handshake_auth == SSL_PHA_EXT_SENT) { + if (!SSL_CONNECTION_IS_DTLS(s) + && s->post_handshake_auth == SSL_PHA_EXT_SENT) { s->post_handshake_auth = SSL_PHA_REQUESTED; /* * In TLS, this is called before the message is added to the @@ -203,7 +228,7 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) * Return values are 1 for success (transition allowed) and 0 on error * (transition not allowed) */ -int ossl_statem_client_read_transition(SSL *s, int mt) +int ossl_statem_client_read_transition(SSL_CONNECTION *s, int mt) { OSSL_STATEM *st = &s->statem; int ske_expected; @@ -212,7 +237,7 @@ int ossl_statem_client_read_transition(SSL *s, int mt) * Note that after writing the first ClientHello we don't know what version * we are going to negotiate yet, so we don't take this branch until later. */ - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { if (!ossl_statem_client13_read_transition(s, mt)) goto err; return 1; @@ -228,7 +253,7 @@ int ossl_statem_client_read_transition(SSL *s, int mt) return 1; } - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; return 1; @@ -260,7 +285,8 @@ int ossl_statem_client_read_transition(SSL *s, int mt) return 1; } } else { - if (SSL_IS_DTLS(s) && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { + if (SSL_CONNECTION_IS_DTLS(s) + && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) { st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST; return 1; } else if (s->version >= TLS1_VERSION @@ -305,6 +331,7 @@ int ossl_statem_client_read_transition(SSL *s, int mt) break; case TLS_ST_CR_CERT: + case TLS_ST_CR_COMP_CERT: /* * The CertificateStatus message is optional even if * |ext.status_expected| is set @@ -381,7 +408,7 @@ int ossl_statem_client_read_transition(SSL *s, int mt) err: /* No valid transition found */ - if (SSL_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { + if (SSL_CONNECTION_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) { BIO *rbio; /* @@ -390,7 +417,7 @@ int ossl_statem_client_read_transition(SSL *s, int mt) */ s->init_num = 0; s->rwstate = SSL_READING; - rbio = SSL_get_rbio(s); + rbio = SSL_get_rbio(SSL_CONNECTION_GET_SSL(s)); BIO_clear_retry_flags(rbio); BIO_set_retry_read(rbio); return 0; @@ -399,12 +426,19 @@ int ossl_statem_client_read_transition(SSL *s, int mt) return 0; } +static int do_compressed_cert(SSL_CONNECTION *sc) +{ + /* If we negotiated RPK, we won't try to compress it */ + return sc->ext.client_cert_type == TLSEXT_cert_type_x509 + && sc->ext.compress_certificate_from_peer[0] != TLSEXT_comp_cert_none; +} + /* * ossl_statem_client13_write_transition() works out what handshake state to * move to next when the TLSv1.3 client is writing messages to be sent to the * server. */ -static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) +static WRITE_TRAN ossl_statem_client13_write_transition(SSL_CONNECTION *s) { OSSL_STATEM *st = &s->statem; @@ -421,7 +455,10 @@ static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) case TLS_ST_CR_CERT_REQ: if (s->post_handshake_auth == SSL_PHA_REQUESTED) { - st->hand_state = TLS_ST_CW_CERT; + if (do_compressed_cert(s)) + st->hand_state = TLS_ST_CW_COMP_CERT; + else + st->hand_state = TLS_ST_CW_CERT; return WRITE_TRAN_CONTINUE; } /* @@ -443,13 +480,18 @@ static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) else if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0 && s->hello_retry_request == SSL_HRR_NONE) st->hand_state = TLS_ST_CW_CHANGE; + else if (s->s3.tmp.cert_req == 0) + st->hand_state = TLS_ST_CW_FINISHED; + else if (do_compressed_cert(s)) + st->hand_state = TLS_ST_CW_COMP_CERT; else - st->hand_state = (s->s3.tmp.cert_req != 0) ? TLS_ST_CW_CERT - : TLS_ST_CW_FINISHED; + st->hand_state = TLS_ST_CW_CERT; + + s->ts_msg_read = ossl_time_now(); return WRITE_TRAN_CONTINUE; case TLS_ST_PENDING_EARLY_DATA_END: - if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { + if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED && !SSL_NO_EOED(s)) { st->hand_state = TLS_ST_CW_END_OF_EARLY_DATA; return WRITE_TRAN_CONTINUE; } @@ -457,10 +499,15 @@ static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) case TLS_ST_CW_END_OF_EARLY_DATA: case TLS_ST_CW_CHANGE: - st->hand_state = (s->s3.tmp.cert_req != 0) ? TLS_ST_CW_CERT - : TLS_ST_CW_FINISHED; + if (s->s3.tmp.cert_req == 0) + st->hand_state = TLS_ST_CW_FINISHED; + else if (do_compressed_cert(s)) + st->hand_state = TLS_ST_CW_COMP_CERT; + else + st->hand_state = TLS_ST_CW_CERT; return WRITE_TRAN_CONTINUE; + case TLS_ST_CW_COMP_CERT: case TLS_ST_CW_CERT: /* If a non-empty Certificate we also send CertificateVerify */ st->hand_state = (s->s3.tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY @@ -493,7 +540,7 @@ static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s) * ossl_statem_client_write_transition() works out what handshake state to * move to next when the client is writing messages to be sent to the server. */ -WRITE_TRAN ossl_statem_client_write_transition(SSL *s) +WRITE_TRAN ossl_statem_client_write_transition(SSL_CONNECTION *s) { OSSL_STATEM *st = &s->statem; @@ -502,7 +549,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) * version we are going to negotiate yet, so we don't take this branch until * later */ - if (SSL_IS_TLS13(s)) + if (SSL_CONNECTION_IS_TLS13(s)) return ossl_statem_client13_write_transition(s); switch (st->hand_state) { @@ -526,7 +573,8 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) return WRITE_TRAN_CONTINUE; case TLS_ST_CW_CLNT_HELLO: - if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) { + if (s->early_data_state == SSL_EARLY_DATA_CONNECTING + && !SSL_IS_QUIC_HANDSHAKE(s)) { /* * We are assuming this is a TLSv1.3 connection, although we haven't * actually selected a version yet. @@ -541,6 +589,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) * No transition at the end of writing because we don't know what * we will be sent */ + s->ts_msg_write = ossl_time_now(); return WRITE_TRAN_FINISHED; case TLS_ST_CR_SRVR_HELLO: @@ -557,6 +606,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) return WRITE_TRAN_CONTINUE; case TLS_ST_EARLY_DATA: + s->ts_msg_write = ossl_time_now(); return WRITE_TRAN_FINISHED; case DTLS_ST_CR_HELLO_VERIFY_REQUEST: @@ -564,6 +614,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) return WRITE_TRAN_CONTINUE; case TLS_ST_CR_SRVR_DONE: + s->ts_msg_read = ossl_time_now(); if (s->s3.tmp.cert_req) st->hand_state = TLS_ST_CW_CERT; else @@ -608,7 +659,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) #if defined(OPENSSL_NO_NEXTPROTONEG) st->hand_state = TLS_ST_CW_FINISHED; #else - if (!SSL_IS_DTLS(s) && s->s3.npn_seen) + if (!SSL_CONNECTION_IS_DTLS(s) && s->s3.npn_seen) st->hand_state = TLS_ST_CW_NEXT_PROTO; else st->hand_state = TLS_ST_CW_FINISHED; @@ -644,7 +695,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) * If we can renegotiate now then do so, otherwise wait for a more * convenient time. */ - if (ssl3_renegotiate_check(s, 1)) { + if (ssl3_renegotiate_check(SSL_CONNECTION_GET_SSL(s), 1)) { if (!tls_setup_handshake(s)) { /* SSLfatal() already called */ return WRITE_TRAN_ERROR; @@ -661,7 +712,7 @@ WRITE_TRAN ossl_statem_client_write_transition(SSL *s) * Perform any pre work that needs to be done prior to sending a message from * the client to the server. */ -WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst) +WORK_STATE ossl_statem_client_pre_work(SSL_CONNECTION *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; @@ -672,17 +723,34 @@ WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst) case TLS_ST_CW_CLNT_HELLO: s->shutdown = 0; - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { /* every DTLS ClientHello resets Finished MAC */ if (!ssl3_init_finished_mac(s)) { /* SSLfatal() already called */ return WORK_ERROR; } + } else if (s->ext.early_data == SSL_EARLY_DATA_REJECTED) { + /* + * This must be a second ClientHello after an HRR following an + * earlier rejected attempt to send early data. Since we were + * previously encrypting the early data we now need to reset the + * write record layer in order to write in plaintext again. + */ + if (!ssl_set_new_record_layer(s, + TLS_ANY_VERSION, + OSSL_RECORD_DIRECTION_WRITE, + OSSL_RECORD_PROTECTION_LEVEL_NONE, + NULL, 0, NULL, 0, NULL, 0, NULL, 0, + NULL, 0, NID_undef, NULL, NULL, + NULL)) { + /* SSLfatal already called */ + return WORK_ERROR; + } } break; case TLS_ST_CW_CHANGE: - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { if (s->hit) { /* * We're into the last flight so we don't retransmit these @@ -691,7 +759,7 @@ WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst) st->use_timer = 0; } #ifndef OPENSSL_NO_SCTP - if (BIO_dgram_is_sctp(SSL_get_wbio(s))) { + if (BIO_dgram_is_sctp(SSL_get_wbio(SSL_CONNECTION_GET_SSL(s)))) { /* Calls SSLfatal() as required */ return dtls_wait_for_dry(s); } @@ -725,9 +793,10 @@ WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst) * Perform any work that needs to be done after sending a message from the * client to the server. */ -WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) +WORK_STATE ossl_statem_client_post_work(SSL_CONNECTION *s, WORK_STATE wst) { OSSL_STATEM *st = &s->statem; + SSL *ssl = SSL_CONNECTION_GET_SSL(s); s->init_num = 0; @@ -756,21 +825,12 @@ WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) return WORK_MORE_A; } - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { /* Treat the next message as the first packet */ s->first_packet = 1; } break; - case TLS_ST_CW_END_OF_EARLY_DATA: - /* - * We set the enc_write_ctx back to NULL because we may end up writing - * in cleartext again if we get a HelloRetryRequest from the server. - */ - EVP_CIPHER_CTX_free(s->enc_write_ctx); - s->enc_write_ctx = NULL; - break; - case TLS_ST_CW_KEY_EXCH: if (tls_client_key_exchange_post_work(s) == 0) { /* SSLfatal() already called */ @@ -779,7 +839,8 @@ WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) break; case TLS_ST_CW_CHANGE: - if (SSL_IS_TLS13(s) || s->hello_retry_request == SSL_HRR_PENDING) + if (SSL_CONNECTION_IS_TLS13(s) + || s->hello_retry_request == SSL_HRR_PENDING) break; if (s->early_data_state == SSL_EARLY_DATA_CONNECTING && s->max_early_data > 0) { @@ -802,54 +863,50 @@ WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) else s->session->compress_meth = s->s3.tmp.new_compression->id; #endif - if (!s->method->ssl3_enc->setup_key_block(s)) { + if (!ssl->method->ssl3_enc->setup_key_block(s)) { /* SSLfatal() already called */ return WORK_ERROR; } - if (!s->method->ssl3_enc->change_cipher_state(s, + if (!ssl->method->ssl3_enc->change_cipher_state(s, SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; } - if (SSL_IS_DTLS(s)) { #ifndef OPENSSL_NO_SCTP - if (s->hit) { - /* - * Change to new shared key of SCTP-Auth, will be ignored if - * no SCTP used. - */ - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, - 0, NULL); - } -#endif - - dtls1_reset_seq_numbers(s, SSL3_CC_WRITE); + if (SSL_CONNECTION_IS_DTLS(s) && s->hit) { + /* + * Change to new shared key of SCTP-Auth, will be ignored if + * no SCTP used. + */ + BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, + 0, NULL); } +#endif break; case TLS_ST_CW_FINISHED: #ifndef OPENSSL_NO_SCTP - if (wst == WORK_MORE_A && SSL_IS_DTLS(s) && s->hit == 0) { + if (wst == WORK_MORE_A && SSL_CONNECTION_IS_DTLS(s) && s->hit == 0) { /* * Change to new shared key of SCTP-Auth, will be ignored if * no SCTP used. */ - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, + BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL); } #endif if (statem_flush(s) != 1) return WORK_MORE_B; - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { if (!tls13_save_handshake_digest_for_pha(s)) { /* SSLfatal() already called */ return WORK_ERROR; } if (s->post_handshake_auth != SSL_PHA_REQUESTED) { - if (!s->method->ssl3_enc->change_cipher_state(s, + if (!ssl->method->ssl3_enc->change_cipher_state(s, SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { /* SSLfatal() already called */ return WORK_ERROR; @@ -879,7 +936,7 @@ WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst) * 1: Success * 0: Error */ -int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt, +int ossl_statem_client_construct_message(SSL_CONNECTION *s, confunc_f *confunc, int *mt) { OSSL_STATEM *st = &s->statem; @@ -891,7 +948,7 @@ int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt, return 0; case TLS_ST_CW_CHANGE: - if (SSL_IS_DTLS(s)) + if (SSL_CONNECTION_IS_DTLS(s)) *confunc = dtls_construct_change_cipher_spec; else *confunc = tls_construct_change_cipher_spec; @@ -918,6 +975,13 @@ int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt, *mt = SSL3_MT_CERTIFICATE; break; +#ifndef OPENSSL_NO_COMP_ALG + case TLS_ST_CW_COMP_CERT: + *confunc = tls_construct_client_compressed_certificate; + *mt = SSL3_MT_COMPRESSED_CERTIFICATE; + break; +#endif + case TLS_ST_CW_KEY_EXCH: *confunc = tls_construct_client_key_exchange; *mt = SSL3_MT_CLIENT_KEY_EXCHANGE; @@ -952,7 +1016,7 @@ int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt, * Returns the maximum allowed length for the current message that we are * reading. Excludes the message header. */ -size_t ossl_statem_client_max_message_size(SSL *s) +size_t ossl_statem_client_max_message_size(SSL_CONNECTION *s) { OSSL_STATEM *st = &s->statem; @@ -967,11 +1031,12 @@ size_t ossl_statem_client_max_message_size(SSL *s) case DTLS_ST_CR_HELLO_VERIFY_REQUEST: return HELLO_VERIFY_REQUEST_MAX_LENGTH; + case TLS_ST_CR_COMP_CERT: case TLS_ST_CR_CERT: return s->max_cert_list; case TLS_ST_CR_CERT_VRFY: - return SSL3_RT_MAX_PLAIN_LENGTH; + return CERTIFICATE_VERIFY_MAX_LENGTH; case TLS_ST_CR_CERT_STATUS: return SSL3_RT_MAX_PLAIN_LENGTH; @@ -996,8 +1061,8 @@ size_t ossl_statem_client_max_message_size(SSL *s) return CCS_MAX_LENGTH; case TLS_ST_CR_SESSION_TICKET: - return (SSL_IS_TLS13(s)) ? SESSION_TICKET_MAX_LENGTH_TLS13 - : SESSION_TICKET_MAX_LENGTH_TLS12; + return (SSL_CONNECTION_IS_TLS13(s)) ? SESSION_TICKET_MAX_LENGTH_TLS13 + : SESSION_TICKET_MAX_LENGTH_TLS12; case TLS_ST_CR_FINISHED: return FINISHED_MAX_LENGTH; @@ -1013,7 +1078,8 @@ size_t ossl_statem_client_max_message_size(SSL *s) /* * Process a message that the client has received from the server. */ -MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL_CONNECTION *s, + PACKET *pkt) { OSSL_STATEM *st = &s->statem; @@ -1032,6 +1098,11 @@ MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt) case TLS_ST_CR_CERT: return tls_process_server_certificate(s, pkt); +#ifndef OPENSSL_NO_COMP_ALG + case TLS_ST_CR_COMP_CERT: + return tls_process_server_compressed_certificate(s, pkt); +#endif + case TLS_ST_CR_CERT_VRFY: return tls_process_cert_verify(s, pkt); @@ -1071,7 +1142,8 @@ MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt) * Perform any further processing required following the receipt of a message * from the server */ -WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst) +WORK_STATE ossl_statem_client_post_process_message(SSL_CONNECTION *s, + WORK_STATE wst) { OSSL_STATEM *st = &s->statem; @@ -1082,6 +1154,7 @@ WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst) return WORK_ERROR; case TLS_ST_CR_CERT: + case TLS_ST_CR_COMP_CERT: return tls_post_process_server_certificate(s, wst); case TLS_ST_CR_CERT_VRFY: @@ -1090,7 +1163,7 @@ WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst) } } -int tls_construct_client_hello(SSL *s, WPACKET *pkt) +CON_FUNC_RETURN tls_construct_client_hello(SSL_CONNECTION *s, WPACKET *pkt) { unsigned char *p; size_t sess_id_len; @@ -1100,12 +1173,13 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) #endif SSL_SESSION *sess = s->session; unsigned char *session_id; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); /* Work out what SSL/TLS/DTLS version to use */ protverr = ssl_set_client_hello_version(s); if (protverr != 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, protverr); - return 0; + return CON_FUNC_ERROR; } if (sess == NULL @@ -1114,7 +1188,7 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) if (s->hello_retry_request == SSL_HRR_NONE && !ssl_get_new_session(s, 0)) { /* SSLfatal() already called */ - return 0; + return CON_FUNC_ERROR; } } /* else use the pre-loaded session */ @@ -1125,7 +1199,7 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) * for DTLS if client_random is initialized, reuse it, we are * required to use same upon reply to HelloVerify */ - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { size_t idx; i = 1; for (idx = 0; idx < sizeof(s->s3.client_random); idx++) { @@ -1141,7 +1215,7 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3.client_random), DOWNGRADE_NONE) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } /*- @@ -1180,7 +1254,7 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) if (!WPACKET_put_bytes_u16(pkt, s->client_version) || !WPACKET_memcpy(pkt, s->s3.client_random, SSL3_RANDOM_SIZE)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } /* Session ID */ @@ -1192,10 +1266,10 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) s->tmp_session_id_len = sess_id_len; session_id = s->tmp_session_id; if (s->hello_retry_request == SSL_HRR_NONE - && RAND_bytes_ex(s->ctx->libctx, s->tmp_session_id, + && RAND_bytes_ex(sctx->libctx, s->tmp_session_id, sess_id_len, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } } else { sess_id_len = 0; @@ -1213,49 +1287,51 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) sess_id_len)) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } /* cookie stuff for DTLS */ - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { if (s->d1->cookie_len > sizeof(s->d1->cookie) || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie, s->d1->cookie_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } } /* Ciphers supported */ if (!WPACKET_start_sub_packet_u16(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } - if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), pkt)) { + if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(SSL_CONNECTION_GET_SSL(s)), + pkt)) { /* SSLfatal() already called */ - return 0; + return CON_FUNC_ERROR; } if (!WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } /* COMPRESSION */ if (!WPACKET_start_sub_packet_u8(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } #ifndef OPENSSL_NO_COMP if (ssl_allow_compression(s) - && s->ctx->comp_methods - && (SSL_IS_DTLS(s) || s->s3.tmp.max_ver < TLS1_3_VERSION)) { - int compnum = sk_SSL_COMP_num(s->ctx->comp_methods); + && sctx->comp_methods + && (SSL_CONNECTION_IS_DTLS(s) + || s->s3.tmp.max_ver < TLS1_3_VERSION)) { + int compnum = sk_SSL_COMP_num(sctx->comp_methods); for (i = 0; i < compnum; i++) { - comp = sk_SSL_COMP_value(s->ctx->comp_methods, i); + comp = sk_SSL_COMP_value(sctx->comp_methods, i); if (!WPACKET_put_bytes_u8(pkt, comp->id)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } } } @@ -1263,19 +1339,19 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt) /* Add the NULL method */ if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } /* TLS extensions */ if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0)) { /* SSLfatal() already called */ - return 0; + return CON_FUNC_ERROR; } - return 1; + return CON_FUNC_SUCCESS; } -MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN dtls_process_hello_verify(SSL_CONNECTION *s, PACKET *pkt) { size_t cookie_len; PACKET cookiepkt; @@ -1301,11 +1377,13 @@ MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt) return MSG_PROCESS_FINISHED_READING; } -static int set_client_ciphersuite(SSL *s, const unsigned char *cipherchars) +static int set_client_ciphersuite(SSL_CONNECTION *s, + const unsigned char *cipherchars) { STACK_OF(SSL_CIPHER) *sk; const SSL_CIPHER *c; int i; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); c = ssl_get_cipher_by_char(s, cipherchars, 0); if (c == NULL) { @@ -1330,7 +1408,7 @@ static int set_client_ciphersuite(SSL *s, const unsigned char *cipherchars) return 0; } - if (SSL_IS_TLS13(s) && s->s3.tmp.new_cipher != NULL + if (SSL_CONNECTION_IS_TLS13(s) && s->s3.tmp.new_cipher != NULL && s->s3.tmp.new_cipher->id != c->id) { /* ServerHello selected a different ciphersuite to that in the HRR */ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CIPHER_RETURNED); @@ -1345,15 +1423,19 @@ static int set_client_ciphersuite(SSL *s, const unsigned char *cipherchars) if (s->session->cipher != NULL) s->session->cipher_id = s->session->cipher->id; if (s->hit && (s->session->cipher_id != c->id)) { - if (SSL_IS_TLS13(s)) { - const EVP_MD *md = ssl_md(s->ctx, c->algorithm2); + if (SSL_CONNECTION_IS_TLS13(s)) { + const EVP_MD *md = ssl_md(sctx, c->algorithm2); + if (!ossl_assert(s->session->cipher != NULL)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + return 0; + } /* * In TLSv1.3 it is valid for the server to select a different * ciphersuite as long as the hash is the same. */ if (md == NULL - || md != ssl_md(s->ctx, s->session->cipher->algorithm2)) { + || md != ssl_md(sctx, s->session->cipher->algorithm2)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED); return 0; @@ -1373,7 +1455,7 @@ static int set_client_ciphersuite(SSL *s, const unsigned char *cipherchars) return 1; } -MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_server_hello(SSL_CONNECTION *s, PACKET *pkt) { PACKET session_id, extpkt; size_t session_id_len; @@ -1383,6 +1465,8 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) unsigned int sversion; unsigned int context; RAW_EXTENSION *extensions = NULL; + SSL *ssl = SSL_CONNECTION_GET_SSL(s); + SSL *ussl = SSL_CONNECTION_GET_USER_SSL(s); #ifndef OPENSSL_NO_COMP SSL_COMP *comp; #endif @@ -1402,6 +1486,11 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) goto err; } s->hello_retry_request = SSL_HRR_PENDING; + /* Tell the record layer that we know we're going to get TLSv1.3 */ + if (!ssl_set_record_protocol_version(s, s->version)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + goto err; + } hrr = 1; if (!PACKET_forward(pkt, SSL3_RANDOM_SIZE)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); @@ -1460,7 +1549,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) } } - if (SSL_IS_TLS13(s) || hrr) { + if (SSL_CONNECTION_IS_TLS13(s) || hrr) { if (compression != 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_INVALID_COMPRESSION_ALGORITHM); @@ -1488,8 +1577,8 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) * Now we have chosen the version we need to check again that the extensions * are appropriate for this version. */ - context = SSL_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO - : SSL_EXT_TLS1_2_SERVER_HELLO; + context = SSL_CONNECTION_IS_TLS13(s) ? SSL_EXT_TLS1_3_SERVER_HELLO + : SSL_EXT_TLS1_2_SERVER_HELLO; if (!tls_validate_all_contexts(s, context, extensions)) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION); goto err; @@ -1497,7 +1586,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) s->hit = 0; - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { /* * In TLSv1.3 a ServerHello message signals a key change so the end of * the message must be on a record boundary. @@ -1536,8 +1625,9 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) * backwards compat reasons */ int master_key_length; + master_key_length = sizeof(s->session->master_key); - if (s->ext.session_secret_cb(s, s->session->master_key, + if (s->ext.session_secret_cb(ussl, s->session->master_key, &master_key_length, NULL, &pref_cipher, s->ext.session_secret_cb_arg) @@ -1589,7 +1679,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) * echo of what we originally sent in the ClientHello and should not be * used for resumption. */ - if (!SSL_IS_TLS13(s)) { + if (!SSL_CONNECTION_IS_TLS13(s)) { s->session->session_id_length = session_id_len; /* session_id_len could be 0 */ if (session_id_len > 0) @@ -1642,7 +1732,8 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COMPRESSION_DISABLED); goto err; } else { - comp = ssl3_comp_find(s->ctx->comp_methods, compression); + comp = ssl3_comp_find(SSL_CONNECTION_GET_CTX(s)->comp_methods, + compression); } if (compression != 0 && comp == NULL) { @@ -1660,7 +1751,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) } #ifndef OPENSSL_NO_SCTP - if (SSL_IS_DTLS(s) && s->hit) { + if (SSL_CONNECTION_IS_DTLS(s) && s->hit) { unsigned char sctpauthkey[64]; char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; size_t labellen; @@ -1677,7 +1768,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) labellen += 1; - if (SSL_export_keying_material(s, sctpauthkey, + if (SSL_export_keying_material(ssl, sctpauthkey, sizeof(sctpauthkey), labelbuffer, labellen, NULL, 0, 0) <= 0) { @@ -1685,7 +1776,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) goto err; } - BIO_ctrl(SSL_get_wbio(s), + BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, sizeof(sctpauthkey), sctpauthkey); } @@ -1695,12 +1786,29 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) * In TLSv1.3 we have some post-processing to change cipher state, otherwise * we're done with this message */ - if (SSL_IS_TLS13(s) - && (!s->method->ssl3_enc->setup_key_block(s) - || !s->method->ssl3_enc->change_cipher_state(s, - SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ))) { - /* SSLfatal() already called */ - goto err; + if (SSL_CONNECTION_IS_TLS13(s)) { + if (!ssl->method->ssl3_enc->setup_key_block(s) + || !ssl->method->ssl3_enc->change_cipher_state(s, + SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ)) { + /* SSLfatal() already called */ + goto err; + } + /* + * If we're not doing early-data and we're not going to send a dummy CCS + * (i.e. no middlebox compat mode) then we can change the write keys + * immediately. Otherwise we have to defer this until after all possible + * early data is written. We could just always defer until the last + * moment except QUIC needs it done at the same time as the read keys + * are changed. Since QUIC doesn't do TLS early data or need middlebox + * compat this doesn't cause a problem. + */ + if (s->early_data_state == SSL_EARLY_DATA_NONE + && (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0 + && !ssl->method->ssl3_enc->change_cipher_state(s, + SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE)) { + /* SSLfatal() already called */ + goto err; + } } OPENSSL_free(extensions); @@ -1710,17 +1818,27 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt) return MSG_PROCESS_ERROR; } -static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, +static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s, PACKET *extpkt) { RAW_EXTENSION *extensions = NULL; /* - * If we were sending early_data then the enc_write_ctx is now invalid and - * should not be used. + * If we were sending early_data then any alerts should not be sent using + * the old wrlmethod. */ - EVP_CIPHER_CTX_free(s->enc_write_ctx); - s->enc_write_ctx = NULL; + if (s->early_data_state == SSL_EARLY_DATA_FINISHED_WRITING + && !ssl_set_new_record_layer(s, + TLS_ANY_VERSION, + OSSL_RECORD_DIRECTION_WRITE, + OSSL_RECORD_PROTECTION_LEVEL_NONE, + NULL, 0, NULL, 0, NULL, 0, NULL, 0, + NULL, 0, NID_undef, NULL, NULL, NULL)) { + /* SSLfatal already called */ + goto err; + } + /* We are definitely going to be using TLSv1.3 */ + s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, TLS1_3_VERSION); if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST, &extensions, NULL, 1) @@ -1769,21 +1887,117 @@ static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, return MSG_PROCESS_ERROR; } +MSG_PROCESS_RETURN tls_process_server_rpk(SSL_CONNECTION *sc, PACKET *pkt) +{ + EVP_PKEY *peer_rpk = NULL; + + if (!tls_process_rpk(sc, pkt, &peer_rpk)) { + /* SSLfatal() already called */ + return MSG_PROCESS_ERROR; + } + + if (peer_rpk == NULL) { + SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_CERTIFICATE); + return MSG_PROCESS_ERROR; + } + + EVP_PKEY_free(sc->session->peer_rpk); + sc->session->peer_rpk = peer_rpk; + + return MSG_PROCESS_CONTINUE_PROCESSING; +} + +static WORK_STATE tls_post_process_server_rpk(SSL_CONNECTION *sc, + WORK_STATE wst) +{ + size_t certidx; + const SSL_CERT_LOOKUP *clu; + int v_ok; + + if (sc->session->peer_rpk == NULL) { + SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, + SSL_R_INVALID_RAW_PUBLIC_KEY); + return WORK_ERROR; + } + + if (sc->rwstate == SSL_RETRY_VERIFY) + sc->rwstate = SSL_NOTHING; + + ERR_set_mark(); + v_ok = ssl_verify_rpk(sc, sc->session->peer_rpk); + if (v_ok <= 0 && sc->verify_mode != SSL_VERIFY_NONE) { + ERR_clear_last_mark(); + SSLfatal(sc, ssl_x509err2alert(sc->verify_result), + SSL_R_CERTIFICATE_VERIFY_FAILED); + return WORK_ERROR; + } + ERR_pop_to_mark(); /* but we keep s->verify_result */ + if (v_ok > 0 && sc->rwstate == SSL_RETRY_VERIFY) { + return WORK_MORE_A; + } + + if ((clu = ssl_cert_lookup_by_pkey(sc->session->peer_rpk, &certidx, + SSL_CONNECTION_GET_CTX(sc))) == NULL) { + SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE); + return WORK_ERROR; + } + + /* + * Check certificate type is consistent with ciphersuite. For TLS 1.3 + * skip check since TLS 1.3 ciphersuites can be used with any certificate + * type. + */ + if (!SSL_CONNECTION_IS_TLS13(sc)) { + if ((clu->amask & sc->s3.tmp.new_cipher->algorithm_auth) == 0) { + SSLfatal(sc, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_RPK_TYPE); + return WORK_ERROR; + } + } + + /* Ensure there is no peer/peer_chain */ + X509_free(sc->session->peer); + sc->session->peer = NULL; + sk_X509_pop_free(sc->session->peer_chain, X509_free); + sc->session->peer_chain = NULL; + sc->session->verify_result = sc->verify_result; + + /* Save the current hash state for when we receive the CertificateVerify */ + if (SSL_CONNECTION_IS_TLS13(sc) + && !ssl_handshake_hash(sc, sc->cert_verify_hash, + sizeof(sc->cert_verify_hash), + &sc->cert_verify_hash_len)) { + /* SSLfatal() already called */ + return WORK_ERROR; + } + + return WORK_FINISHED_CONTINUE; +} + /* prepare server cert verification by setting s->session->peer_chain from pkt */ -MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_server_certificate(SSL_CONNECTION *s, + PACKET *pkt) { unsigned long cert_list_len, cert_len; X509 *x = NULL; const unsigned char *certstart, *certbytes; size_t chainidx; unsigned int context = 0; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); + + if (s->ext.server_cert_type == TLSEXT_cert_type_rpk) + return tls_process_server_rpk(s, pkt); + if (s->ext.server_cert_type != TLSEXT_cert_type_x509) { + SSLfatal(s, SSL_AD_UNSUPPORTED_CERTIFICATE, + SSL_R_UNKNOWN_CERTIFICATE_TYPE); + goto err; + } if ((s->session->peer_chain = sk_X509_new_null()) == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; } - if ((SSL_IS_TLS13(s) && !PACKET_get_1(pkt, &context)) + if ((SSL_CONNECTION_IS_TLS13(s) && !PACKET_get_1(pkt, &context)) || context != 0 || !PACKET_get_net_3(pkt, &cert_list_len) || PACKET_remaining(pkt) != cert_list_len @@ -1799,10 +2013,9 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) } certstart = certbytes; - x = X509_new_ex(s->ctx->libctx, s->ctx->propq); + x = X509_new_ex(sctx->libctx, sctx->propq); if (x == NULL) { - SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_MALLOC_FAILURE); - ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_ASN1_LIB); goto err; } if (d2i_X509(&x, (const unsigned char **)&certbytes, @@ -1816,7 +2029,7 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) goto err; } - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { RAW_EXTENSION *rawexts = NULL; PACKET extensions; @@ -1838,7 +2051,7 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) } if (!sk_X509_push(s->session->peer_chain, x)) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; } x = NULL; @@ -1847,7 +2060,7 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) err: X509_free(x); - sk_X509_pop_free(s->session->peer_chain, X509_free); + OSSL_STACK_OF_X509_free(s->session->peer_chain); s->session->peer_chain = NULL; return MSG_PROCESS_ERROR; } @@ -1857,7 +2070,8 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt) * On success set s->session->peer and s->session->verify_result. * Else the peer certificate verification callback may request retry. */ -WORK_STATE tls_post_process_server_certificate(SSL *s, WORK_STATE wst) +WORK_STATE tls_post_process_server_certificate(SSL_CONNECTION *s, + WORK_STATE wst) { X509 *x; EVP_PKEY *pkey = NULL; @@ -1865,12 +2079,12 @@ WORK_STATE tls_post_process_server_certificate(SSL *s, WORK_STATE wst) size_t certidx; int i; + if (s->ext.server_cert_type == TLSEXT_cert_type_rpk) + return tls_post_process_server_rpk(s, wst); + if (s->rwstate == SSL_RETRY_VERIFY) s->rwstate = SSL_NOTHING; - i = ssl_verify_cert_chain(s, s->session->peer_chain); - if (i > 0 && s->rwstate == SSL_RETRY_VERIFY) { - return WORK_MORE_A; - } + /* * The documented interface is that SSL_VERIFY_PEER should be set in order * for client side verification of the server certificate to take place. @@ -1885,12 +2099,17 @@ WORK_STATE tls_post_process_server_certificate(SSL *s, WORK_STATE wst) * (less clean) historic behaviour of performing validation if any flag is * set. The *documented* interface remains the same. */ - if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) { + ERR_set_mark(); + i = ssl_verify_cert_chain(s, s->session->peer_chain); + if (i <= 0 && s->verify_mode != SSL_VERIFY_NONE) { + ERR_clear_last_mark(); SSLfatal(s, ssl_x509err2alert(s->verify_result), SSL_R_CERTIFICATE_VERIFY_FAILED); return WORK_ERROR; } - ERR_clear_error(); /* but we keep s->verify_result */ + ERR_pop_to_mark(); /* but we keep s->verify_result */ + if (i > 0 && s->rwstate == SSL_RETRY_VERIFY) + return WORK_MORE_A; /* * Inconsistency alert: cert_chain does include the peer's certificate, @@ -1906,7 +2125,8 @@ WORK_STATE tls_post_process_server_certificate(SSL *s, WORK_STATE wst) return WORK_ERROR; } - if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx)) == NULL) { + if ((clu = ssl_cert_lookup_by_pkey(pkey, &certidx, + SSL_CONNECTION_GET_CTX(s))) == NULL) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_UNKNOWN_CERTIFICATE_TYPE); return WORK_ERROR; } @@ -1915,20 +2135,27 @@ WORK_STATE tls_post_process_server_certificate(SSL *s, WORK_STATE wst) * skip check since TLS 1.3 ciphersuites can be used with any certificate * type. */ - if (!SSL_IS_TLS13(s)) { + if (!SSL_CONNECTION_IS_TLS13(s)) { if ((clu->amask & s->s3.tmp.new_cipher->algorithm_auth) == 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_WRONG_CERTIFICATE_TYPE); return WORK_ERROR; } } + if (!X509_up_ref(x)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + return WORK_ERROR; + } + X509_free(s->session->peer); - X509_up_ref(x); s->session->peer = x; s->session->verify_result = s->verify_result; + /* Ensure there is no RPK */ + EVP_PKEY_free(s->session->peer_rpk); + s->session->peer_rpk = NULL; /* Save the current hash state for when we receive the CertificateVerify */ - if (SSL_IS_TLS13(s) + if (SSL_CONNECTION_IS_TLS13(s) && !ssl_handshake_hash(s, s->cert_verify_hash, sizeof(s->cert_verify_hash), &s->cert_verify_hash_len)) { @@ -1938,7 +2165,22 @@ WORK_STATE tls_post_process_server_certificate(SSL *s, WORK_STATE wst) return WORK_FINISHED_CONTINUE; } -static int tls_process_ske_psk_preamble(SSL *s, PACKET *pkt) +#ifndef OPENSSL_NO_COMP_ALG +MSG_PROCESS_RETURN tls_process_server_compressed_certificate(SSL_CONNECTION *sc, PACKET *pkt) +{ + MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR; + PACKET tmppkt; + BUF_MEM *buf = BUF_MEM_new(); + + if (tls13_process_compressed_certificate(sc, pkt, &tmppkt, buf) != MSG_PROCESS_ERROR) + ret = tls_process_server_certificate(sc, &tmppkt); + + BUF_MEM_free(buf); + return ret; +} +#endif + +static int tls_process_ske_psk_preamble(SSL_CONNECTION *s, PACKET *pkt) { #ifndef OPENSSL_NO_PSK PACKET psk_identity_hint; @@ -1977,7 +2219,7 @@ static int tls_process_ske_psk_preamble(SSL *s, PACKET *pkt) #endif } -static int tls_process_ske_srp(SSL *s, PACKET *pkt, EVP_PKEY **pkey) +static int tls_process_ske_srp(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey) { #ifndef OPENSSL_NO_SRP PACKET prime, generator, salt, server_pub; @@ -2013,7 +2255,7 @@ static int tls_process_ske_srp(SSL *s, PACKET *pkt, EVP_PKEY **pkey) /* We must check if there is a certificate */ if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) - *pkey = X509_get0_pubkey(s->session->peer); + *pkey = tls_get_peer_pkey(s); return 1; #else @@ -2022,7 +2264,7 @@ static int tls_process_ske_srp(SSL *s, PACKET *pkt, EVP_PKEY **pkey) #endif } -static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) +static int tls_process_ske_dhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey) { PACKET prime, generator, pub_key; EVP_PKEY *peer_tmp = NULL; @@ -2030,6 +2272,7 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) EVP_PKEY_CTX *pctx = NULL; OSSL_PARAM *params = NULL; OSSL_PARAM_BLD *tmpl = NULL; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); int ret = 0; if (!PACKET_get_length_prefixed_2(pkt, &prime) @@ -2060,7 +2303,7 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) goto err; } - pctx = EVP_PKEY_CTX_new_from_name(s->ctx->libctx, "DH", s->ctx->propq); + pctx = EVP_PKEY_CTX_new_from_name(sctx->libctx, "DH", sctx->propq); if (pctx == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; @@ -2072,7 +2315,7 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) } EVP_PKEY_CTX_free(pctx); - pctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, peer_tmp, s->ctx->propq); + pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, peer_tmp, sctx->propq); if (pctx == NULL /* * EVP_PKEY_param_check() will verify that the DH params are using @@ -2101,7 +2344,7 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) * public keys. We should have a less ad-hoc way of doing this */ if (s->s3.tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS)) - *pkey = X509_get0_pubkey(s->session->peer); + *pkey = tls_get_peer_pkey(s); /* else anonymous DH, so no certificate or pkey. */ ret = 1; @@ -2118,7 +2361,7 @@ static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) return ret; } -static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) +static int tls_process_ske_ecdhe(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **pkey) { PACKET encoded_pt; unsigned int curve_type, curve_id; @@ -2166,9 +2409,9 @@ static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) * and ECDSA. */ if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) - *pkey = X509_get0_pubkey(s->session->peer); + *pkey = tls_get_peer_pkey(s); else if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aRSA) - *pkey = X509_get0_pubkey(s->session->peer); + *pkey = tls_get_peer_pkey(s); /* else anonymous ECDH, so no certificate or pkey. */ /* Cache the agreed upon group in the SSL_SESSION */ @@ -2176,13 +2419,14 @@ static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey) return 1; } -MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_key_exchange(SSL_CONNECTION *s, PACKET *pkt) { long alg_k; EVP_PKEY *pkey = NULL; EVP_MD_CTX *md_ctx = NULL; EVP_PKEY_CTX *pctx = NULL; PACKET save_param_start, signature; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); alg_k = s->s3.tmp.new_cipher->algorithm_mkey; @@ -2256,7 +2500,7 @@ MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) goto err; } - if (!tls1_lookup_md(s->ctx, s->s3.tmp.peer_sigalg, &md)) { + if (!tls1_lookup_md(sctx, s->s3.tmp.peer_sigalg, &md)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_DIGEST_ALGORITHM); goto err; @@ -2273,13 +2517,13 @@ MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) md_ctx = EVP_MD_CTX_new(); if (md_ctx == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); goto err; } if (EVP_DigestVerifyInit_ex(md_ctx, &pctx, md == NULL ? NULL : EVP_MD_get0_name(md), - s->ctx->libctx, s->ctx->propq, pkey, + sctx->libctx, sctx->propq, pkey, NULL) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); goto err; @@ -2332,15 +2576,20 @@ MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt) return MSG_PROCESS_ERROR; } -MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_certificate_request(SSL_CONNECTION *s, + PACKET *pkt) { - size_t i; - /* Clear certificate validity flags */ - for (i = 0; i < SSL_PKEY_NUM; i++) - s->s3.tmp.valid_flags[i] = 0; + if (s->s3.tmp.valid_flags != NULL) + memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t)); + else + s->s3.tmp.valid_flags = OPENSSL_zalloc(s->ssl_pkey_num * sizeof(uint32_t)); + + /* Give up for good if allocation didn't work */ + if (s->s3.tmp.valid_flags == NULL) + return 0; - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { PACKET reqctx, extensions; RAW_EXTENSION *rawexts = NULL; @@ -2417,7 +2666,7 @@ MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt) return MSG_PROCESS_ERROR; } if (!tls1_process_sigalgs(s)) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); return MSG_PROCESS_ERROR; } } @@ -2445,13 +2694,15 @@ MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt) * SSL_get1_peer_certificate() returns something sensible in * client_cert_cb. */ - if (SSL_IS_TLS13(s) && s->post_handshake_auth != SSL_PHA_REQUESTED) + if (SSL_CONNECTION_IS_TLS13(s) + && s->post_handshake_auth != SSL_PHA_REQUESTED) return MSG_PROCESS_CONTINUE_READING; return MSG_PROCESS_CONTINUE_PROCESSING; } -MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s, + PACKET *pkt) { unsigned int ticklen; unsigned long ticket_lifetime_hint, age_add = 0; @@ -2459,16 +2710,18 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) RAW_EXTENSION *exts = NULL; PACKET nonce; EVP_MD *sha256 = NULL; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); PACKET_null_init(&nonce); if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint) - || (SSL_IS_TLS13(s) + || (SSL_CONNECTION_IS_TLS13(s) && (!PACKET_get_net_4(pkt, &age_add) || !PACKET_get_length_prefixed_1(pkt, &nonce))) || !PACKET_get_net_2(pkt, &ticklen) - || (SSL_IS_TLS13(s) ? (ticklen == 0 || PACKET_remaining(pkt) < ticklen) - : PACKET_remaining(pkt) != ticklen)) { + || (SSL_CONNECTION_IS_TLS13(s) ? (ticklen == 0 + || PACKET_remaining(pkt) < ticklen) + : PACKET_remaining(pkt) != ticklen)) { SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); goto err; } @@ -2489,7 +2742,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) * post-handshake and the session may have already gone into the session * cache. */ - if (SSL_IS_TLS13(s) || s->session->session_id_length > 0) { + if (SSL_CONNECTION_IS_TLS13(s) || s->session->session_id_length > 0) { SSL_SESSION *new_sess; /* @@ -2497,12 +2750,12 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) * one */ if ((new_sess = ssl_session_dup(s->session, 0)) == 0) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); goto err; } if ((s->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) != 0 - && !SSL_IS_TLS13(s)) { + && !SSL_CONNECTION_IS_TLS13(s)) { /* * In TLSv1.2 and below the arrival of a new tickets signals that * any old ticket we were using is now out of date, so we remove the @@ -2515,7 +2768,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) s->session = new_sess; } - s->session->time = time(NULL); + s->session->time = ossl_time_now(); ssl_session_calculate_timeout(s->session); OPENSSL_free(s->session->ext.tick); @@ -2524,7 +2777,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) s->session->ext.tick = OPENSSL_malloc(ticklen); if (s->session->ext.tick == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; } if (!PACKET_copy_bytes(pkt, s->session->ext.tick, ticklen)) { @@ -2536,7 +2789,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) s->session->ext.tick_age_add = age_add; s->session->ext.ticklen = ticklen; - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { PACKET extpkt; if (!PACKET_as_length_prefixed_2(pkt, &extpkt) @@ -2567,7 +2820,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) * elsewhere in OpenSSL. The session ID is set to the SHA256 hash of the * ticket. */ - sha256 = EVP_MD_fetch(s->ctx->libctx, "SHA2-256", s->ctx->propq); + sha256 = EVP_MD_fetch(sctx->libctx, "SHA2-256", sctx->propq); if (sha256 == NULL) { /* Error is already recorded */ SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); @@ -2589,14 +2842,14 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) s->session->not_resumable = 0; /* This is a standalone message in TLSv1.3, so there is no more to read */ - if (SSL_IS_TLS13(s)) { + if (SSL_CONNECTION_IS_TLS13(s)) { const EVP_MD *md = ssl_handshake_md(s); int hashleni = EVP_MD_get_size(md); size_t hashlen; static const unsigned char nonce_label[] = "resumption"; /* Ensure cast to size_t is safe */ - if (!ossl_assert(hashleni >= 0)) { + if (!ossl_assert(hashleni > 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; } @@ -2630,7 +2883,7 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt) * In TLSv1.3 this is called from the extensions code, otherwise it is used to * parse a separate message. Returns 1 on success or 0 on failure */ -int tls_process_cert_status_body(SSL *s, PACKET *pkt) +int tls_process_cert_status_body(SSL_CONNECTION *s, PACKET *pkt) { size_t resplen; unsigned int type; @@ -2648,7 +2901,7 @@ int tls_process_cert_status_body(SSL *s, PACKET *pkt) s->ext.ocsp.resp = OPENSSL_malloc(resplen); if (s->ext.ocsp.resp == NULL) { s->ext.ocsp.resp_len = 0; - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); return 0; } s->ext.ocsp.resp_len = resplen; @@ -2661,7 +2914,7 @@ int tls_process_cert_status_body(SSL *s, PACKET *pkt) } -MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_cert_status(SSL_CONNECTION *s, PACKET *pkt) { if (!tls_process_cert_status_body(s, pkt)) { /* SSLfatal() already called */ @@ -2677,8 +2930,10 @@ MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt) * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0 * on failure. */ -int tls_process_initial_server_flight(SSL *s) +int tls_process_initial_server_flight(SSL_CONNECTION *s) { + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); + /* * at this point we check that we have the required stuff from * the server @@ -2694,8 +2949,9 @@ int tls_process_initial_server_flight(SSL *s) * message, or NULL and -1 otherwise */ if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing - && s->ctx->ext.status_cb != NULL) { - int ret = s->ctx->ext.status_cb(s, s->ctx->ext.status_arg); + && sctx->ext.status_cb != NULL) { + int ret = sctx->ext.status_cb(SSL_CONNECTION_GET_USER_SSL(s), + sctx->ext.status_arg); if (ret == 0) { SSLfatal(s, SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE, @@ -2721,7 +2977,7 @@ int tls_process_initial_server_flight(SSL *s) return 1; } -MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_server_done(SSL_CONNECTION *s, PACKET *pkt) { if (PACKET_remaining(pkt) > 0) { /* should contain no data */ @@ -2745,7 +3001,7 @@ MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt) return MSG_PROCESS_FINISHED_READING; } -static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt) +static int tls_construct_cke_psk_preamble(SSL_CONNECTION *s, WPACKET *pkt) { #ifndef OPENSSL_NO_PSK int ret = 0; @@ -2768,7 +3024,8 @@ static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt) memset(identity, 0, sizeof(identity)); - psklen = s->psk_client_callback(s, s->session->psk_identity_hint, + psklen = s->psk_client_callback(SSL_CONNECTION_GET_USER_SSL(s), + s->session->psk_identity_hint, identity, sizeof(identity) - 1, psk, sizeof(psk)); @@ -2790,7 +3047,7 @@ static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt) tmppsk = OPENSSL_memdup(psk, psklen); tmpidentity = OPENSSL_strdup(identity); if (tmppsk == NULL || tmpidentity == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; } @@ -2822,7 +3079,7 @@ static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt) #endif } -static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) +static int tls_construct_cke_rsa(SSL_CONNECTION *s, WPACKET *pkt) { unsigned char *encdata = NULL; EVP_PKEY *pkey = NULL; @@ -2830,8 +3087,9 @@ static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) size_t enclen; unsigned char *pms = NULL; size_t pmslen = 0; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); - if (s->session->peer == NULL) { + if (!received_server_cert(s)) { /* * We should always have a server certificate with SSL_kRSA. */ @@ -2839,7 +3097,11 @@ static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) return 0; } - pkey = X509_get0_pubkey(s->session->peer); + if ((pkey = tls_get_peer_pkey(s)) == NULL) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + return 0; + } + if (!EVP_PKEY_is_a(pkey, "RSA")) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; @@ -2848,14 +3110,14 @@ static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) pmslen = SSL_MAX_MASTER_KEY_LENGTH; pms = OPENSSL_malloc(pmslen); if (pms == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); return 0; } pms[0] = s->client_version >> 8; pms[1] = s->client_version & 0xff; - if (RAND_bytes_ex(s->ctx->libctx, pms + 2, pmslen - 2, 0) <= 0) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + if (RAND_bytes_ex(sctx->libctx, pms + 2, pmslen - 2, 0) <= 0) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_RAND_LIB); goto err; } @@ -2865,7 +3127,7 @@ static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) goto err; } - pctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, pkey, s->ctx->propq); + pctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, pkey, sctx->propq); if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0 || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); @@ -2902,7 +3164,7 @@ static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt) return 0; } -static int tls_construct_cke_dhe(SSL *s, WPACKET *pkt) +static int tls_construct_cke_dhe(SSL_CONNECTION *s, WPACKET *pkt) { EVP_PKEY *ckey = NULL, *skey = NULL; unsigned char *keybytes = NULL; @@ -2965,7 +3227,7 @@ static int tls_construct_cke_dhe(SSL *s, WPACKET *pkt) return ret; } -static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) +static int tls_construct_cke_ecdhe(SSL_CONNECTION *s, WPACKET *pkt) { unsigned char *encodedPoint = NULL; size_t encoded_pt_len = 0; @@ -2980,7 +3242,7 @@ static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) ckey = ssl_generate_pkey(s, skey); if (ckey == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); goto err; } @@ -3009,12 +3271,12 @@ static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt) return ret; } -static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) +static int tls_construct_cke_gost(SSL_CONNECTION *s, WPACKET *pkt) { #ifndef OPENSSL_NO_GOST /* GOST key exchange message creation */ EVP_PKEY_CTX *pkey_ctx = NULL; - X509 *peer_cert; + EVP_PKEY *pkey = NULL; size_t msglen; unsigned int md_len; unsigned char shared_ukm[32], tmp[256]; @@ -3022,6 +3284,7 @@ static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) int dgst_nid = NID_id_GostR3411_94; unsigned char *pms = NULL; size_t pmslen = 0; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); if ((s->s3.tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0) dgst_nid = NID_id_GostR3411_2012_256; @@ -3029,18 +3292,17 @@ static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) /* * Get server certificate PKEY and create ctx from it */ - peer_cert = s->session->peer; - if (peer_cert == NULL) { + if ((pkey = tls_get_peer_pkey(s)) == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); return 0; } - pkey_ctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, - X509_get0_pubkey(peer_cert), - s->ctx->propq); + pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, + pkey, + sctx->propq); if (pkey_ctx == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); return 0; } /* @@ -3053,14 +3315,14 @@ static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) pmslen = 32; pms = OPENSSL_malloc(pmslen); if (pms == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; } if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0 /* Generate session key */ - || RAND_bytes_ex(s->ctx->libctx, pms, pmslen, 0) <= 0) { + || RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; }; @@ -3120,7 +3382,7 @@ static int tls_construct_cke_gost(SSL *s, WPACKET *pkt) } #ifndef OPENSSL_NO_GOST -int ossl_gost18_cke_cipher_nid(const SSL *s) +int ossl_gost18_cke_cipher_nid(const SSL_CONNECTION *s) { if ((s->s3.tmp.new_cipher->algorithm_enc & SSL_MAGMA) != 0) return NID_magma_ctr; @@ -3130,11 +3392,13 @@ int ossl_gost18_cke_cipher_nid(const SSL *s) return NID_undef; } -int ossl_gost_ukm(const SSL *s, unsigned char *dgst_buf) +int ossl_gost_ukm(const SSL_CONNECTION *s, unsigned char *dgst_buf) { - EVP_MD_CTX * hash = NULL; + EVP_MD_CTX *hash = NULL; unsigned int md_len; - const EVP_MD *md = ssl_evp_md_fetch(s->ctx->libctx, NID_id_GostR3411_2012_256, s->ctx->propq); + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); + const EVP_MD *md = ssl_evp_md_fetch(sctx->libctx, NID_id_GostR3411_2012_256, + sctx->propq); if (md == NULL) return 0; @@ -3155,18 +3419,19 @@ int ossl_gost_ukm(const SSL *s, unsigned char *dgst_buf) } #endif -static int tls_construct_cke_gost18(SSL *s, WPACKET *pkt) +static int tls_construct_cke_gost18(SSL_CONNECTION *s, WPACKET *pkt) { #ifndef OPENSSL_NO_GOST /* GOST 2018 key exchange message creation */ unsigned char rnd_dgst[32]; unsigned char *encdata = NULL; EVP_PKEY_CTX *pkey_ctx = NULL; - X509 *peer_cert; + EVP_PKEY *pkey; unsigned char *pms = NULL; size_t pmslen = 0; size_t msglen; int cipher_nid = ossl_gost18_cke_cipher_nid(s); + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); if (cipher_nid == NID_undef) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); @@ -3182,32 +3447,31 @@ static int tls_construct_cke_gost18(SSL *s, WPACKET *pkt) pmslen = 32; pms = OPENSSL_malloc(pmslen); if (pms == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); goto err; } - if (RAND_bytes_ex(s->ctx->libctx, pms, pmslen, 0) <= 0) { + if (RAND_bytes_ex(sctx->libctx, pms, pmslen, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; } /* Get server certificate PKEY and create ctx from it */ - peer_cert = s->session->peer; - if (peer_cert == NULL) { + if ((pkey = tls_get_peer_pkey(s)) == NULL) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); goto err; } - pkey_ctx = EVP_PKEY_CTX_new_from_pkey(s->ctx->libctx, - X509_get0_pubkey(peer_cert), - s->ctx->propq); + pkey_ctx = EVP_PKEY_CTX_new_from_pkey(sctx->libctx, + pkey, + sctx->propq); if (pkey_ctx == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB); goto err; } - if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0 ) { + if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; }; @@ -3252,7 +3516,7 @@ static int tls_construct_cke_gost18(SSL *s, WPACKET *pkt) #endif } -static int tls_construct_cke_srp(SSL *s, WPACKET *pkt) +static int tls_construct_cke_srp(SSL_CONNECTION *s, WPACKET *pkt) { #ifndef OPENSSL_NO_SRP unsigned char *abytes = NULL; @@ -3268,7 +3532,7 @@ static int tls_construct_cke_srp(SSL *s, WPACKET *pkt) OPENSSL_free(s->session->srp_username); s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login); if (s->session->srp_username == NULL) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); return 0; } @@ -3279,7 +3543,8 @@ static int tls_construct_cke_srp(SSL *s, WPACKET *pkt) #endif } -int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) +CON_FUNC_RETURN tls_construct_client_key_exchange(SSL_CONNECTION *s, + WPACKET *pkt) { unsigned long alg_k; @@ -3316,7 +3581,7 @@ int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) goto err; } - return 1; + return CON_FUNC_SUCCESS; err: OPENSSL_clear_free(s->s3.tmp.pms, s->s3.tmp.pmslen); s->s3.tmp.pms = NULL; @@ -3326,10 +3591,10 @@ int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt) s->s3.tmp.psk = NULL; s->s3.tmp.psklen = 0; #endif - return 0; + return CON_FUNC_ERROR; } -int tls_client_key_exchange_post_work(SSL *s) +int tls_client_key_exchange_post_work(SSL_CONNECTION *s) { unsigned char *pms = NULL; size_t pmslen = 0; @@ -3349,7 +3614,7 @@ int tls_client_key_exchange_post_work(SSL *s) #endif if (pms == NULL && !(s->s3.tmp.new_cipher->algorithm_mkey & SSL_kPSK)) { - SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_PASSED_INVALID_ARGUMENT); goto err; } if (!ssl_generate_master_secret(s, pms, pmslen, 1)) { @@ -3363,10 +3628,11 @@ int tls_client_key_exchange_post_work(SSL *s) pmslen = 0; #ifndef OPENSSL_NO_SCTP - if (SSL_IS_DTLS(s)) { + if (SSL_CONNECTION_IS_DTLS(s)) { unsigned char sctpauthkey[64]; char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)]; size_t labellen; + SSL *ssl = SSL_CONNECTION_GET_SSL(s); /* * Add new shared key for SCTP-Auth, will be ignored if no SCTP @@ -3380,14 +3646,14 @@ int tls_client_key_exchange_post_work(SSL *s) if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG) labellen += 1; - if (SSL_export_keying_material(s, sctpauthkey, + if (SSL_export_keying_material(ssl, sctpauthkey, sizeof(sctpauthkey), labelbuffer, labellen, NULL, 0, 0) <= 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); goto err; } - BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, + BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY, sizeof(sctpauthkey), sctpauthkey); } #endif @@ -3405,7 +3671,7 @@ int tls_client_key_exchange_post_work(SSL *s) * cert exists, if we have a suitable digest for TLS 1.2 if static DH client * certificates can be used and optionally checks suitability for Suite B. */ -static int ssl3_check_client_certificate(SSL *s) +static int ssl3_check_client_certificate(SSL_CONNECTION *s) { /* If no suitable signature algorithm can't use certificate */ if (!tls_choose_sigalg(s, 0) || s->s3.tmp.sigalg == NULL) @@ -3420,16 +3686,17 @@ static int ssl3_check_client_certificate(SSL *s) return 1; } -WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) +WORK_STATE tls_prepare_client_certificate(SSL_CONNECTION *s, WORK_STATE wst) { X509 *x509 = NULL; EVP_PKEY *pkey = NULL; int i; + SSL *ssl = SSL_CONNECTION_GET_SSL(s); if (wst == WORK_MORE_A) { /* Let cert callback update client certificates if required */ if (s->cert->cert_cb) { - i = s->cert->cert_cb(s, s->cert->cert_cb_arg); + i = s->cert->cert_cb(ssl, s->cert->cert_cb_arg); if (i < 0) { s->rwstate = SSL_X509_LOOKUP; return WORK_MORE_A; @@ -3464,7 +3731,8 @@ WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) } s->rwstate = SSL_NOTHING; if ((i == 1) && (pkey != NULL) && (x509 != NULL)) { - if (!SSL_use_certificate(s, x509) || !SSL_use_PrivateKey(s, pkey)) + if (!SSL_use_certificate(ssl, x509) + || !SSL_use_PrivateKey(ssl, pkey)) i = 0; } else if (i == 1) { i = 0; @@ -3482,6 +3750,7 @@ WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) return WORK_FINISHED_CONTINUE; } else { s->s3.tmp.cert_req = 2; + s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none; if (!ssl3_digest_cached_records(s, 0)) { /* SSLfatal() already called */ return WORK_ERROR; @@ -3489,6 +3758,10 @@ WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) } } + if (!SSL_CONNECTION_IS_TLS13(s) + || (s->options & SSL_OP_NO_TX_CERTIFICATE_COMPRESSION) != 0) + s->ext.compress_certificate_from_peer[0] = TLSEXT_comp_cert_none; + if (s->post_handshake_auth == SSL_PHA_REQUESTED) return WORK_FINISHED_STOP; return WORK_FINISHED_CONTINUE; @@ -3499,47 +3772,173 @@ WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst) return WORK_ERROR; } -int tls_construct_client_certificate(SSL *s, WPACKET *pkt) +CON_FUNC_RETURN tls_construct_client_certificate(SSL_CONNECTION *s, + WPACKET *pkt) { - if (SSL_IS_TLS13(s)) { + CERT_PKEY *cpk = NULL; + SSL *ssl = SSL_CONNECTION_GET_SSL(s); + + if (SSL_CONNECTION_IS_TLS13(s)) { if (s->pha_context == NULL) { /* no context available, add 0-length context */ if (!WPACKET_put_bytes_u8(pkt, 0)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } } else if (!WPACKET_sub_memcpy_u8(pkt, s->pha_context, s->pha_context_len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } } - if (!ssl3_output_cert_chain(s, pkt, - (s->s3.tmp.cert_req == 2) ? NULL - : s->cert->key)) { - /* SSLfatal() already called */ - return 0; + if (s->s3.tmp.cert_req != 2) + cpk = s->cert->key; + switch (s->ext.client_cert_type) { + case TLSEXT_cert_type_rpk: + if (!tls_output_rpk(s, pkt, cpk)) { + /* SSLfatal() already called */ + return CON_FUNC_ERROR; + } + break; + case TLSEXT_cert_type_x509: + if (!ssl3_output_cert_chain(s, pkt, cpk, 0)) { + /* SSLfatal() already called */ + return CON_FUNC_ERROR; + } + break; + default: + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + return CON_FUNC_ERROR; } - if (SSL_IS_TLS13(s) + /* + * If we attempted to write early data or we're in middlebox compat mode + * then we deferred changing the handshake write keys to the last possible + * moment. We need to do it now. + */ + if (SSL_CONNECTION_IS_TLS13(s) && SSL_IS_FIRST_HANDSHAKE(s) - && (!s->method->ssl3_enc->change_cipher_state(s, + && (s->early_data_state != SSL_EARLY_DATA_NONE + || (s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) + && (!ssl->method->ssl3_enc->change_cipher_state(s, SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) { /* * This is a fatal error, which leaves enc_write_ctx in an inconsistent * state and thus ssl3_send_alert may crash. */ SSLfatal(s, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER); - return 0; + return CON_FUNC_ERROR; } - return 1; + return CON_FUNC_SUCCESS; +} + +#ifndef OPENSSL_NO_COMP_ALG +CON_FUNC_RETURN tls_construct_client_compressed_certificate(SSL_CONNECTION *sc, + WPACKET *pkt) +{ + SSL *ssl = SSL_CONNECTION_GET_SSL(sc); + WPACKET tmppkt; + BUF_MEM *buf = NULL; + size_t length; + size_t max_length; + COMP_METHOD *method; + COMP_CTX *comp = NULL; + int comp_len; + int ret = 0; + int alg = sc->ext.compress_certificate_from_peer[0]; + + /* Note that sc->s3.tmp.cert_req == 2 is checked in write transition */ + + if ((buf = BUF_MEM_new()) == NULL || !WPACKET_init(&tmppkt, buf)) + goto err; + + /* Use the |tmppkt| for the to-be-compressed data */ + if (sc->pha_context == NULL) { + /* no context available, add 0-length context */ + if (!WPACKET_put_bytes_u8(&tmppkt, 0)) + goto err; + } else if (!WPACKET_sub_memcpy_u8(&tmppkt, sc->pha_context, sc->pha_context_len)) + goto err; + + if (!ssl3_output_cert_chain(sc, &tmppkt, sc->cert->key, 0)) { + /* SSLfatal() already called */ + goto out; + } + + /* continue with the real |pkt| */ + if (!WPACKET_put_bytes_u16(pkt, alg) + || !WPACKET_get_total_written(&tmppkt, &length) + || !WPACKET_put_bytes_u24(pkt, length)) + goto err; + + switch (alg) { + case TLSEXT_comp_cert_zlib: + method = COMP_zlib_oneshot(); + break; + case TLSEXT_comp_cert_brotli: + method = COMP_brotli_oneshot(); + break; + case TLSEXT_comp_cert_zstd: + method = COMP_zstd_oneshot(); + break; + default: + goto err; + } + max_length = ossl_calculate_comp_expansion(alg, length); + + if ((comp = COMP_CTX_new(method)) == NULL + || !WPACKET_start_sub_packet_u24(pkt) + || !WPACKET_reserve_bytes(pkt, max_length, NULL)) + goto err; + + comp_len = COMP_compress_block(comp, WPACKET_get_curr(pkt), max_length, + (unsigned char *)buf->data, length); + if (comp_len <= 0) + goto err; + + if (!WPACKET_allocate_bytes(pkt, comp_len, NULL) + || !WPACKET_close(pkt)) + goto err; + + /* + * If we attempted to write early data or we're in middlebox compat mode + * then we deferred changing the handshake write keys to the last possible + * moment. We need to do it now. + */ + if (SSL_IS_FIRST_HANDSHAKE(sc) + && (sc->early_data_state != SSL_EARLY_DATA_NONE + || (sc->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0) + && (!ssl->method->ssl3_enc->change_cipher_state(sc, + SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE))) { + /* + * This is a fatal error, which leaves sc->enc_write_ctx in an + * inconsistent state and thus ssl3_send_alert may crash. + */ + SSLfatal(sc, SSL_AD_NO_ALERT, SSL_R_CANNOT_CHANGE_CIPHER); + goto out; + } + ret = 1; + goto out; + + err: + SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); + out: + if (buf != NULL) { + /* If |buf| is NULL, then |tmppkt| could not have been initialized */ + WPACKET_cleanup(&tmppkt); + } + BUF_MEM_free(buf); + COMP_CTX_free(comp); + return ret; } +#endif -int ssl3_check_cert_and_algorithm(SSL *s) +int ssl3_check_cert_and_algorithm(SSL_CONNECTION *s) { const SSL_CERT_LOOKUP *clu; size_t idx; long alg_k, alg_a; + EVP_PKEY *pkey; alg_k = s->s3.tmp.new_cipher->algorithm_mkey; alg_a = s->s3.tmp.new_cipher->algorithm_auth; @@ -3549,7 +3948,8 @@ int ssl3_check_cert_and_algorithm(SSL *s) return 1; /* This is the passed certificate */ - clu = ssl_cert_lookup_by_pkey(X509_get0_pubkey(s->session->peer), &idx); + pkey = tls_get_peer_pkey(s); + clu = ssl_cert_lookup_by_pkey(pkey, &idx, SSL_CONNECTION_GET_CTX(s)); /* Check certificate is recognised and suitable for cipher */ if (clu == NULL || (alg_a & clu->amask) == 0) { @@ -3557,13 +3957,6 @@ int ssl3_check_cert_and_algorithm(SSL *s) return 0; } - if (clu->amask & SSL_aECDSA) { - if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s)) - return 1; - SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_ECC_CERT); - return 0; - } - if (alg_k & (SSL_kRSA | SSL_kRSAPSK) && idx != SSL_PKEY_RSA) { SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_MISSING_RSA_ENCRYPTING_CERT); @@ -3575,11 +3968,22 @@ int ssl3_check_cert_and_algorithm(SSL *s) return 0; } + /* Early out to skip the checks below */ + if (s->session->peer_rpk != NULL) + return 1; + + if (clu->amask & SSL_aECDSA) { + if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s)) + return 1; + SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_ECC_CERT); + return 0; + } + return 1; } #ifndef OPENSSL_NO_NEXTPROTONEG -int tls_construct_next_proto(SSL *s, WPACKET *pkt) +CON_FUNC_RETURN tls_construct_next_proto(SSL_CONNECTION *s, WPACKET *pkt) { size_t len, padding_len; unsigned char *padding = NULL; @@ -3590,17 +3994,19 @@ int tls_construct_next_proto(SSL *s, WPACKET *pkt) if (!WPACKET_sub_memcpy_u8(pkt, s->ext.npn, len) || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); - return 0; + return CON_FUNC_ERROR; } memset(padding, 0, padding_len); - return 1; + return CON_FUNC_SUCCESS; } #endif -MSG_PROCESS_RETURN tls_process_hello_req(SSL *s, PACKET *pkt) +MSG_PROCESS_RETURN tls_process_hello_req(SSL_CONNECTION *s, PACKET *pkt) { + SSL *ssl = SSL_CONNECTION_GET_SSL(s); + if (PACKET_remaining(pkt) > 0) { /* should contain no data */ SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH); @@ -3619,15 +4025,16 @@ MSG_PROCESS_RETURN tls_process_hello_req(SSL *s, PACKET *pkt) * HelloRequest it will do a full handshake. Either behaviour is reasonable * but doing one for TLS and another for DTLS is odd. */ - if (SSL_IS_DTLS(s)) - SSL_renegotiate(s); + if (SSL_CONNECTION_IS_DTLS(s)) + SSL_renegotiate(ssl); else - SSL_renegotiate_abbreviated(s); + SSL_renegotiate_abbreviated(ssl); return MSG_PROCESS_FINISHED_READING; } -static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt) +static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL_CONNECTION *s, + PACKET *pkt) { PACKET extensions; RAW_EXTENSION *rawexts = NULL; @@ -3655,26 +4062,33 @@ static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt) return MSG_PROCESS_ERROR; } -int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey) +int ssl_do_client_cert_cb(SSL_CONNECTION *s, X509 **px509, EVP_PKEY **ppkey) { int i = 0; + SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); + #ifndef OPENSSL_NO_ENGINE - if (s->ctx->client_cert_engine) { + if (sctx->client_cert_engine) { i = tls_engine_load_ssl_client_cert(s, px509, ppkey); if (i != 0) return i; } #endif - if (s->ctx->client_cert_cb) - i = s->ctx->client_cert_cb(s, px509, ppkey); + if (sctx->client_cert_cb) + i = sctx->client_cert_cb(SSL_CONNECTION_GET_USER_SSL(s), px509, ppkey); return i; } -int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) +int ssl_cipher_list_to_bytes(SSL_CONNECTION *s, STACK_OF(SSL_CIPHER) *sk, + WPACKET *pkt) { int i; size_t totlen = 0, len, maxlen, maxverok = 0; - int empty_reneg_info_scsv = !s->renegotiate; + int empty_reneg_info_scsv = !s->renegotiate + && !SSL_CONNECTION_IS_DTLS(s) + && ssl_security(s, SSL_SECOP_VERSION, 0, TLS1_VERSION, NULL) + && s->min_proto_version <= TLS1_VERSION; + SSL *ssl = SSL_CONNECTION_GET_SSL(s); /* Set disabled masks for this session */ if (!ssl_set_client_disabled(s)) { @@ -3696,7 +4110,7 @@ int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) * chop number of supported ciphers to keep it well below this if we * use TLS v1.2 */ - if (TLS1_get_version(s) >= TLS1_2_VERSION) + if (TLS1_get_version(ssl) >= TLS1_2_VERSION) maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1; else #endif @@ -3716,22 +4130,19 @@ int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) continue; - if (!s->method->put_cipher_by_char(c, pkt, &len)) { + if (!ssl->method->put_cipher_by_char(c, pkt, &len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; } /* Sanity check that the maximum version we offer has ciphers enabled */ if (!maxverok) { - if (SSL_IS_DTLS(s)) { - if (DTLS_VERSION_GE(c->max_dtls, s->s3.tmp.max_ver) - && DTLS_VERSION_LE(c->min_dtls, s->s3.tmp.max_ver)) - maxverok = 1; - } else { - if (c->max_tls >= s->s3.tmp.max_ver - && c->min_tls <= s->s3.tmp.max_ver) - maxverok = 1; - } + int minproto = SSL_CONNECTION_IS_DTLS(s) ? c->min_dtls : c->min_tls; + int maxproto = SSL_CONNECTION_IS_DTLS(s) ? c->max_dtls : c->max_tls; + + if (ssl_version_cmp(s, maxproto, s->s3.tmp.max_ver) >= 0 + && ssl_version_cmp(s, minproto, s->s3.tmp.max_ver) <= 0) + maxverok = 1; } totlen += len; @@ -3750,19 +4161,19 @@ int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) if (totlen != 0) { if (empty_reneg_info_scsv) { - static SSL_CIPHER scsv = { + static const SSL_CIPHER scsv = { 0, NULL, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; - if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) { + if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; } } if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) { - static SSL_CIPHER scsv = { + static const SSL_CIPHER scsv = { 0, NULL, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; - if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) { + if (!ssl->method->put_cipher_by_char(&scsv, pkt, &len)) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; } @@ -3772,14 +4183,14 @@ int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt) return 1; } -int tls_construct_end_of_early_data(SSL *s, WPACKET *pkt) +CON_FUNC_RETURN tls_construct_end_of_early_data(SSL_CONNECTION *s, WPACKET *pkt) { if (s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); - return 0; + return CON_FUNC_ERROR; } s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING; - return 1; + return CON_FUNC_SUCCESS; } |