2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 /* ====================================================================
11 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
13 * Portions of the attached software ("Contribution") are developed by
14 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
16 * The Contribution is licensed pursuant to the OpenSSL open source
17 * license provided above.
19 * ECC cipher suite support in OpenSSL originally written by
20 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
23 /* ====================================================================
24 * Copyright 2005 Nokia. All rights reserved.
26 * The portions of the attached software ("Contribution") is developed by
27 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
30 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
31 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
32 * support (see RFC 4279) to OpenSSL.
34 * No patent licenses or other rights except those expressly stated in
35 * the OpenSSL open source license shall be deemed granted or received
36 * expressly, by implication, estoppel, or otherwise.
38 * No assurances are provided by Nokia that the Contribution does not
39 * infringe the patent or other intellectual property rights of any third
40 * party or that the license provides you with all the necessary rights
41 * to make use of the Contribution.
43 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
44 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
45 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
46 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
52 #include "../ssl_locl.h"
53 #include "statem_locl.h"
54 #include "internal/constant_time_locl.h"
55 #include <openssl/buffer.h>
56 #include <openssl/rand.h>
57 #include <openssl/objects.h>
58 #include <openssl/evp.h>
59 #include <openssl/hmac.h>
60 #include <openssl/x509.h>
61 #include <openssl/dh.h>
62 #include <openssl/bn.h>
63 #include <openssl/md5.h>
65 static STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,
66 PACKET *cipher_suites,
67 STACK_OF(SSL_CIPHER) **skp,
68 int sslv2format, int *al);
71 * server_read_transition() encapsulates the logic for the allowed handshake
72 * state transitions when the server is reading messages from the client. The
73 * message type that the client has sent is provided in |mt|. The current state
74 * is in |s->statem.hand_state|.
76 * Valid return values are:
77 * 1: Success (transition allowed)
78 * 0: Error (transition not allowed)
80 int ossl_statem_server_read_transition(SSL *s, int mt)
82 OSSL_STATEM *st = &s->statem;
84 switch(st->hand_state) {
86 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
87 if (mt == SSL3_MT_CLIENT_HELLO) {
88 st->hand_state = TLS_ST_SR_CLNT_HELLO;
93 case TLS_ST_SW_SRVR_DONE:
95 * If we get a CKE message after a ServerDone then either
96 * 1) We didn't request a Certificate
98 * 2) If we did request one then
99 * a) We allow no Certificate to be returned
101 * b) We are running SSL3 (in TLS1.0+ the client must return a 0
102 * list if we requested a certificate)
104 if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE
105 && (!s->s3->tmp.cert_request
106 || (!((s->verify_mode & SSL_VERIFY_PEER) &&
107 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
108 && (s->version == SSL3_VERSION)))) {
109 st->hand_state = TLS_ST_SR_KEY_EXCH;
111 } else if (s->s3->tmp.cert_request) {
112 if (mt == SSL3_MT_CERTIFICATE) {
113 st->hand_state = TLS_ST_SR_CERT;
120 if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) {
121 st->hand_state = TLS_ST_SR_KEY_EXCH;
126 case TLS_ST_SR_KEY_EXCH:
128 * We should only process a CertificateVerify message if we have
129 * received a Certificate from the client. If so then |s->session->peer|
130 * will be non NULL. In some instances a CertificateVerify message is
131 * not required even if the peer has sent a Certificate (e.g. such as in
132 * the case of static DH). In that case |st->no_cert_verify| should be
135 if (s->session->peer == NULL || st->no_cert_verify) {
136 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
138 * For the ECDH ciphersuites when the client sends its ECDH
139 * pub key in a certificate, the CertificateVerify message is
140 * not sent. Also for GOST ciphersuites when the client uses
141 * its key from the certificate for key exchange.
143 st->hand_state = TLS_ST_SR_CHANGE;
147 if (mt == SSL3_MT_CERTIFICATE_VERIFY) {
148 st->hand_state = TLS_ST_SR_CERT_VRFY;
154 case TLS_ST_SR_CERT_VRFY:
155 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
156 st->hand_state = TLS_ST_SR_CHANGE;
161 case TLS_ST_SR_CHANGE:
162 #ifndef OPENSSL_NO_NEXTPROTONEG
163 if (s->s3->next_proto_neg_seen) {
164 if (mt == SSL3_MT_NEXT_PROTO) {
165 st->hand_state = TLS_ST_SR_NEXT_PROTO;
170 if (mt == SSL3_MT_FINISHED) {
171 st->hand_state = TLS_ST_SR_FINISHED;
174 #ifndef OPENSSL_NO_NEXTPROTONEG
179 #ifndef OPENSSL_NO_NEXTPROTONEG
180 case TLS_ST_SR_NEXT_PROTO:
181 if (mt == SSL3_MT_FINISHED) {
182 st->hand_state = TLS_ST_SR_FINISHED;
188 case TLS_ST_SW_FINISHED:
189 if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
190 st->hand_state = TLS_ST_SR_CHANGE;
199 /* No valid transition found */
204 * Should we send a ServerKeyExchange message?
206 * Valid return values are:
210 static int send_server_key_exchange(SSL *s)
212 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
215 * only send a ServerKeyExchange if DH or fortezza but we have a
216 * sign only certificate PSK: may send PSK identity hints For
217 * ECC ciphersuites, we send a serverKeyExchange message only if
218 * the cipher suite is either ECDH-anon or ECDHE. In other cases,
219 * the server certificate contains the server's public key for
222 if (alg_k & (SSL_kDHE|SSL_kECDHE)
224 * PSK: send ServerKeyExchange if PSK identity hint if
227 #ifndef OPENSSL_NO_PSK
228 /* Only send SKE if we have identity hint for plain PSK */
229 || ((alg_k & (SSL_kPSK | SSL_kRSAPSK))
230 && s->cert->psk_identity_hint)
231 /* For other PSK always send SKE */
232 || (alg_k & (SSL_PSK & (SSL_kDHEPSK | SSL_kECDHEPSK)))
234 #ifndef OPENSSL_NO_SRP
235 /* SRP: send ServerKeyExchange */
236 || (alg_k & SSL_kSRP)
246 * Should we send a CertificateRequest message?
248 * Valid return values are:
252 static int send_certificate_request(SSL *s)
255 /* don't request cert unless asked for it: */
256 s->verify_mode & SSL_VERIFY_PEER
258 * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert
259 * during re-negotiation:
261 && ((s->session->peer == NULL) ||
262 !(s->verify_mode & SSL_VERIFY_CLIENT_ONCE))
264 * never request cert in anonymous ciphersuites (see
265 * section "Certificate request" in SSL 3 drafts and in
268 && (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
270 * ... except when the application insists on
271 * verification (against the specs, but statem_clnt.c accepts
274 || (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
275 /* don't request certificate for SRP auth */
276 && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP)
278 * With normal PSK Certificates and Certificate Requests
281 && !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aPSK)) {
289 * server_write_transition() works out what handshake state to move to next
290 * when the server is writing messages to be sent to the client.
292 WRITE_TRAN ossl_statem_server_write_transition(SSL *s)
294 OSSL_STATEM *st = &s->statem;
296 switch(st->hand_state) {
298 /* Just go straight to trying to read from the client */;
299 return WRITE_TRAN_FINISHED;
302 /* We must be trying to renegotiate */
303 st->hand_state = TLS_ST_SW_HELLO_REQ;
304 return WRITE_TRAN_CONTINUE;
306 case TLS_ST_SW_HELLO_REQ:
307 st->hand_state = TLS_ST_OK;
308 ossl_statem_set_in_init(s, 0);
309 return WRITE_TRAN_CONTINUE;
311 case TLS_ST_SR_CLNT_HELLO:
312 if (SSL_IS_DTLS(s) && !s->d1->cookie_verified
313 && (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE))
314 st->hand_state = DTLS_ST_SW_HELLO_VERIFY_REQUEST;
316 st->hand_state = TLS_ST_SW_SRVR_HELLO;
317 return WRITE_TRAN_CONTINUE;
319 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
320 return WRITE_TRAN_FINISHED;
322 case TLS_ST_SW_SRVR_HELLO:
324 if (s->tlsext_ticket_expected)
325 st->hand_state = TLS_ST_SW_SESSION_TICKET;
327 st->hand_state = TLS_ST_SW_CHANGE;
329 /* Check if it is anon DH or anon ECDH, */
330 /* normal PSK or SRP */
331 if (!(s->s3->tmp.new_cipher->algorithm_auth &
332 (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {
333 st->hand_state = TLS_ST_SW_CERT;
334 } else if (send_server_key_exchange(s)) {
335 st->hand_state = TLS_ST_SW_KEY_EXCH;
336 } else if (send_certificate_request(s)) {
337 st->hand_state = TLS_ST_SW_CERT_REQ;
339 st->hand_state = TLS_ST_SW_SRVR_DONE;
342 return WRITE_TRAN_CONTINUE;
345 if (s->tlsext_status_expected) {
346 st->hand_state = TLS_ST_SW_CERT_STATUS;
347 return WRITE_TRAN_CONTINUE;
351 case TLS_ST_SW_CERT_STATUS:
352 if (send_server_key_exchange(s)) {
353 st->hand_state = TLS_ST_SW_KEY_EXCH;
354 return WRITE_TRAN_CONTINUE;
358 case TLS_ST_SW_KEY_EXCH:
359 if (send_certificate_request(s)) {
360 st->hand_state = TLS_ST_SW_CERT_REQ;
361 return WRITE_TRAN_CONTINUE;
365 case TLS_ST_SW_CERT_REQ:
366 st->hand_state = TLS_ST_SW_SRVR_DONE;
367 return WRITE_TRAN_CONTINUE;
369 case TLS_ST_SW_SRVR_DONE:
370 return WRITE_TRAN_FINISHED;
372 case TLS_ST_SR_FINISHED:
374 st->hand_state = TLS_ST_OK;
375 ossl_statem_set_in_init(s, 0);
376 return WRITE_TRAN_CONTINUE;
377 } else if (s->tlsext_ticket_expected) {
378 st->hand_state = TLS_ST_SW_SESSION_TICKET;
380 st->hand_state = TLS_ST_SW_CHANGE;
382 return WRITE_TRAN_CONTINUE;
384 case TLS_ST_SW_SESSION_TICKET:
385 st->hand_state = TLS_ST_SW_CHANGE;
386 return WRITE_TRAN_CONTINUE;
388 case TLS_ST_SW_CHANGE:
389 st->hand_state = TLS_ST_SW_FINISHED;
390 return WRITE_TRAN_CONTINUE;
392 case TLS_ST_SW_FINISHED:
394 return WRITE_TRAN_FINISHED;
396 st->hand_state = TLS_ST_OK;
397 ossl_statem_set_in_init(s, 0);
398 return WRITE_TRAN_CONTINUE;
401 /* Shouldn't happen */
402 return WRITE_TRAN_ERROR;
407 * Perform any pre work that needs to be done prior to sending a message from
408 * the server to the client.
410 WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst)
412 OSSL_STATEM *st = &s->statem;
414 switch(st->hand_state) {
415 case TLS_ST_SW_HELLO_REQ:
418 dtls1_clear_record_buffer(s);
421 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
423 if (SSL_IS_DTLS(s)) {
424 dtls1_clear_record_buffer(s);
425 /* We don't buffer this message so don't use the timer */
430 case TLS_ST_SW_SRVR_HELLO:
431 if (SSL_IS_DTLS(s)) {
433 * Messages we write from now on should be bufferred and
434 * retransmitted if necessary, so we need to use the timer now
440 case TLS_ST_SW_SRVR_DONE:
441 #ifndef OPENSSL_NO_SCTP
442 if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s)))
443 return dtls_wait_for_dry(s);
445 return WORK_FINISHED_CONTINUE;
447 case TLS_ST_SW_SESSION_TICKET:
448 if (SSL_IS_DTLS(s)) {
450 * We're into the last flight. We don't retransmit the last flight
451 * unless we need to, so we don't use the timer
457 case TLS_ST_SW_CHANGE:
458 s->session->cipher = s->s3->tmp.new_cipher;
459 if (!s->method->ssl3_enc->setup_key_block(s)) {
460 ossl_statem_set_error(s);
463 if (SSL_IS_DTLS(s)) {
465 * We're into the last flight. We don't retransmit the last flight
466 * unless we need to, so we don't use the timer. This might have
467 * already been set to 0 if we sent a NewSessionTicket message,
468 * but we'll set it again here in case we didn't.
472 return WORK_FINISHED_CONTINUE;
475 return tls_finish_handshake(s, wst);
478 /* No pre work to be done */
482 return WORK_FINISHED_CONTINUE;
486 * Perform any work that needs to be done after sending a message from the
487 * server to the client.
489 WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst)
491 OSSL_STATEM *st = &s->statem;
495 switch(st->hand_state) {
496 case TLS_ST_SW_HELLO_REQ:
497 if (statem_flush(s) != 1)
499 if (!ssl3_init_finished_mac(s)) {
500 ossl_statem_set_error(s);
505 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
506 if (statem_flush(s) != 1)
508 /* HelloVerifyRequest resets Finished MAC */
509 if (s->version != DTLS1_BAD_VER && !ssl3_init_finished_mac(s)) {
510 ossl_statem_set_error(s);
514 * The next message should be another ClientHello which we need to
515 * treat like it was the first packet
520 case TLS_ST_SW_SRVR_HELLO:
521 #ifndef OPENSSL_NO_SCTP
522 if (SSL_IS_DTLS(s) && s->hit) {
523 unsigned char sctpauthkey[64];
524 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
527 * Add new shared key for SCTP-Auth, will be ignored if no
530 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
531 sizeof(DTLS1_SCTP_AUTH_LABEL));
533 if (SSL_export_keying_material(s, sctpauthkey,
534 sizeof(sctpauthkey), labelbuffer,
535 sizeof(labelbuffer), NULL, 0, 0) <= 0) {
536 ossl_statem_set_error(s);
540 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
541 sizeof(sctpauthkey), sctpauthkey);
546 case TLS_ST_SW_CHANGE:
547 #ifndef OPENSSL_NO_SCTP
548 if (SSL_IS_DTLS(s) && !s->hit) {
550 * Change to new shared key of SCTP-Auth, will be ignored if
553 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
557 if (!s->method->ssl3_enc->change_cipher_state(s,
558 SSL3_CHANGE_CIPHER_SERVER_WRITE)) {
559 ossl_statem_set_error(s);
564 dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
567 case TLS_ST_SW_SRVR_DONE:
568 if (statem_flush(s) != 1)
572 case TLS_ST_SW_FINISHED:
573 if (statem_flush(s) != 1)
575 #ifndef OPENSSL_NO_SCTP
576 if (SSL_IS_DTLS(s) && s->hit) {
578 * Change to new shared key of SCTP-Auth, will be ignored if
581 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
588 /* No post work to be done */
592 return WORK_FINISHED_CONTINUE;
596 * Construct a message to be sent from the server to the client.
598 * Valid return values are:
602 int ossl_statem_server_construct_message(SSL *s)
604 OSSL_STATEM *st = &s->statem;
606 switch(st->hand_state) {
607 case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
608 return dtls_construct_hello_verify_request(s);
610 case TLS_ST_SW_HELLO_REQ:
611 return tls_construct_hello_request(s);
613 case TLS_ST_SW_SRVR_HELLO:
614 return tls_construct_server_hello(s);
617 return tls_construct_server_certificate(s);
619 case TLS_ST_SW_KEY_EXCH:
620 return tls_construct_server_key_exchange(s);
622 case TLS_ST_SW_CERT_REQ:
623 return tls_construct_certificate_request(s);
625 case TLS_ST_SW_SRVR_DONE:
626 return tls_construct_server_done(s);
628 case TLS_ST_SW_SESSION_TICKET:
629 return tls_construct_new_session_ticket(s);
631 case TLS_ST_SW_CERT_STATUS:
632 return tls_construct_cert_status(s);
634 case TLS_ST_SW_CHANGE:
636 return dtls_construct_change_cipher_spec(s);
638 return tls_construct_change_cipher_spec(s);
640 case TLS_ST_SW_FINISHED:
641 return tls_construct_finished(s,
643 ssl3_enc->server_finished_label,
645 ssl3_enc->server_finished_label_len);
648 /* Shouldn't happen */
656 * Maximum size (excluding the Handshake header) of a ClientHello message,
657 * calculated as follows:
659 * 2 + # client_version
660 * 32 + # only valid length for random
661 * 1 + # length of session_id
662 * 32 + # maximum size for session_id
663 * 2 + # length of cipher suites
664 * 2^16-2 + # maximum length of cipher suites array
665 * 1 + # length of compression_methods
666 * 2^8-1 + # maximum length of compression methods
667 * 2 + # length of extensions
668 * 2^16-1 # maximum length of extensions
670 #define CLIENT_HELLO_MAX_LENGTH 131396
672 #define CLIENT_KEY_EXCH_MAX_LENGTH 2048
673 #define NEXT_PROTO_MAX_LENGTH 514
676 * Returns the maximum allowed length for the current message that we are
677 * reading. Excludes the message header.
679 unsigned long ossl_statem_server_max_message_size(SSL *s)
681 OSSL_STATEM *st = &s->statem;
683 switch(st->hand_state) {
684 case TLS_ST_SR_CLNT_HELLO:
685 return CLIENT_HELLO_MAX_LENGTH;
688 return s->max_cert_list;
690 case TLS_ST_SR_KEY_EXCH:
691 return CLIENT_KEY_EXCH_MAX_LENGTH;
693 case TLS_ST_SR_CERT_VRFY:
694 return SSL3_RT_MAX_PLAIN_LENGTH;
696 #ifndef OPENSSL_NO_NEXTPROTONEG
697 case TLS_ST_SR_NEXT_PROTO:
698 return NEXT_PROTO_MAX_LENGTH;
701 case TLS_ST_SR_CHANGE:
702 return CCS_MAX_LENGTH;
704 case TLS_ST_SR_FINISHED:
705 return FINISHED_MAX_LENGTH;
708 /* Shouldn't happen */
716 * Process a message that the server has received from the client.
718 MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt)
720 OSSL_STATEM *st = &s->statem;
722 switch(st->hand_state) {
723 case TLS_ST_SR_CLNT_HELLO:
724 return tls_process_client_hello(s, pkt);
727 return tls_process_client_certificate(s, pkt);
729 case TLS_ST_SR_KEY_EXCH:
730 return tls_process_client_key_exchange(s, pkt);
732 case TLS_ST_SR_CERT_VRFY:
733 return tls_process_cert_verify(s, pkt);
735 #ifndef OPENSSL_NO_NEXTPROTONEG
736 case TLS_ST_SR_NEXT_PROTO:
737 return tls_process_next_proto(s, pkt);
740 case TLS_ST_SR_CHANGE:
741 return tls_process_change_cipher_spec(s, pkt);
743 case TLS_ST_SR_FINISHED:
744 return tls_process_finished(s, pkt);
747 /* Shouldn't happen */
751 return MSG_PROCESS_ERROR;
755 * Perform any further processing required following the receipt of a message
758 WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst)
760 OSSL_STATEM *st = &s->statem;
762 switch(st->hand_state) {
763 case TLS_ST_SR_CLNT_HELLO:
764 return tls_post_process_client_hello(s, wst);
766 case TLS_ST_SR_KEY_EXCH:
767 return tls_post_process_client_key_exchange(s, wst);
769 case TLS_ST_SR_CERT_VRFY:
770 #ifndef OPENSSL_NO_SCTP
771 if ( /* Is this SCTP? */
772 BIO_dgram_is_sctp(SSL_get_wbio(s))
773 /* Are we renegotiating? */
775 && BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
776 s->s3->in_read_app_data = 2;
777 s->rwstate = SSL_READING;
778 BIO_clear_retry_flags(SSL_get_rbio(s));
779 BIO_set_retry_read(SSL_get_rbio(s));
780 ossl_statem_set_sctp_read_sock(s, 1);
783 ossl_statem_set_sctp_read_sock(s, 0);
786 return WORK_FINISHED_CONTINUE;
792 /* Shouldn't happen */
796 #ifndef OPENSSL_NO_SRP
797 static int ssl_check_srp_ext_ClientHello(SSL *s, int *al)
799 int ret = SSL_ERROR_NONE;
801 *al = SSL_AD_UNRECOGNIZED_NAME;
803 if ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) &&
804 (s->srp_ctx.TLS_ext_srp_username_callback != NULL)) {
805 if (s->srp_ctx.login == NULL) {
807 * RFC 5054 says SHOULD reject, we do so if There is no srp
811 *al = SSL_AD_UNKNOWN_PSK_IDENTITY;
813 ret = SSL_srp_server_param_with_username(s, al);
820 int tls_construct_hello_request(SSL *s)
822 if (!ssl_set_handshake_header(s, SSL3_MT_HELLO_REQUEST, 0)) {
823 SSLerr(SSL_F_TLS_CONSTRUCT_HELLO_REQUEST, ERR_R_INTERNAL_ERROR);
824 ossl_statem_set_error(s);
831 unsigned int dtls_raw_hello_verify_request(unsigned char *buf,
832 unsigned char *cookie,
833 unsigned char cookie_len)
835 unsigned int msg_len;
839 /* Always use DTLS 1.0 version: see RFC 6347 */
840 *(p++) = DTLS1_VERSION >> 8;
841 *(p++) = DTLS1_VERSION & 0xFF;
843 *(p++) = (unsigned char)cookie_len;
844 memcpy(p, cookie, cookie_len);
851 int dtls_construct_hello_verify_request(SSL *s)
856 buf = (unsigned char *)s->init_buf->data;
858 if (s->ctx->app_gen_cookie_cb == NULL ||
859 s->ctx->app_gen_cookie_cb(s, s->d1->cookie,
860 &(s->d1->cookie_len)) == 0 ||
861 s->d1->cookie_len > 255) {
862 SSLerr(SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST,
863 SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
864 ossl_statem_set_error(s);
868 len = dtls_raw_hello_verify_request(&buf[DTLS1_HM_HEADER_LENGTH],
869 s->d1->cookie, s->d1->cookie_len);
871 dtls1_set_message_header(s, DTLS1_MT_HELLO_VERIFY_REQUEST, len, 0,
873 len += DTLS1_HM_HEADER_LENGTH;
875 /* number of bytes to write */
882 MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
884 int i, al = SSL_AD_INTERNAL_ERROR;
885 unsigned int j, complen = 0;
888 #ifndef OPENSSL_NO_COMP
889 SSL_COMP *comp = NULL;
891 STACK_OF(SSL_CIPHER) *ciphers = NULL;
893 /* |cookie| will only be initialized for DTLS. */
894 PACKET session_id, cipher_suites, compression, extensions, cookie;
896 static const unsigned char null_compression = 0;
898 is_v2_record = RECORD_LAYER_is_sslv2_record(&s->rlayer);
900 PACKET_null_init(&cookie);
901 /* First lets get s->client_version set correctly */
903 unsigned int version;
906 * An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2
907 * header is sent directly on the wire, not wrapped as a TLS
908 * record. Our record layer just processes the message length and passes
909 * the rest right through. Its format is:
911 * 0-1 msg_length - decoded by the record layer
912 * 2 msg_type - s->init_msg points here
914 * 5-6 cipher_spec_length
915 * 7-8 session_id_length
916 * 9-10 challenge_length
920 if (!PACKET_get_1(pkt, &mt)
921 || mt != SSL2_MT_CLIENT_HELLO) {
923 * Should never happen. We should have tested this in the record
924 * layer in order to have determined that this is a SSLv2 record
927 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
931 if (!PACKET_get_net_2(pkt, &version)) {
932 /* No protocol version supplied! */
933 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
936 if (version == 0x0002) {
937 /* This is real SSLv2. We don't support it. */
938 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
940 } else if ((version & 0xff00) == (SSL3_VERSION_MAJOR << 8)) {
942 s->client_version = version;
944 /* No idea what protocol this is */
945 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
950 * use version from inside client hello, not from record header (may
951 * differ: see RFC 2246, Appendix E, second paragraph)
953 if(!PACKET_get_net_2(pkt, (unsigned int *)&s->client_version)) {
954 al = SSL_AD_DECODE_ERROR;
955 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);
961 * Do SSL/TLS version negotiation if applicable. For DTLS we just check
962 * versions are potentially compatible. Version negotiation comes later.
964 if (!SSL_IS_DTLS(s)) {
965 protverr = ssl_choose_server_version(s);
966 } else if (s->method->version != DTLS_ANY_VERSION &&
967 DTLS_VERSION_LT(s->client_version, s->version)) {
968 protverr = SSL_R_VERSION_TOO_LOW;
974 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
975 if ((!s->enc_write_ctx && !s->write_hash)) {
977 * similar to ssl3_get_record, send alert using remote version
980 s->version = s->client_version;
982 al = SSL_AD_PROTOCOL_VERSION;
986 /* Parse the message and load client random. */
989 * Handle an SSLv2 backwards compatible ClientHello
990 * Note, this is only for SSLv3+ using the backward compatible format.
991 * Real SSLv2 is not supported, and is rejected above.
993 unsigned int cipher_len, session_id_len, challenge_len;
996 if (!PACKET_get_net_2(pkt, &cipher_len)
997 || !PACKET_get_net_2(pkt, &session_id_len)
998 || !PACKET_get_net_2(pkt, &challenge_len)) {
999 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1000 SSL_R_RECORD_LENGTH_MISMATCH);
1001 al = SSL_AD_DECODE_ERROR;
1005 if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {
1006 al = SSL_AD_DECODE_ERROR;
1007 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1011 if (!PACKET_get_sub_packet(pkt, &cipher_suites, cipher_len)
1012 || !PACKET_get_sub_packet(pkt, &session_id, session_id_len)
1013 || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
1014 /* No extensions. */
1015 || PACKET_remaining(pkt) != 0) {
1016 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1017 SSL_R_RECORD_LENGTH_MISMATCH);
1018 al = SSL_AD_DECODE_ERROR;
1022 /* Load the client random and compression list. */
1023 challenge_len = challenge_len > SSL3_RANDOM_SIZE ? SSL3_RANDOM_SIZE :
1025 memset(s->s3->client_random, 0, SSL3_RANDOM_SIZE);
1026 if (!PACKET_copy_bytes(&challenge,
1027 s->s3->client_random + SSL3_RANDOM_SIZE -
1028 challenge_len, challenge_len)
1029 /* Advertise only null compression. */
1030 || !PACKET_buf_init(&compression, &null_compression, 1)) {
1031 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1032 al = SSL_AD_INTERNAL_ERROR;
1036 PACKET_null_init(&extensions);
1038 /* Regular ClientHello. */
1039 if (!PACKET_copy_bytes(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)
1040 || !PACKET_get_length_prefixed_1(pkt, &session_id)) {
1041 al = SSL_AD_DECODE_ERROR;
1042 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1046 if (PACKET_remaining(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) {
1047 al = SSL_AD_DECODE_ERROR;
1048 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1052 if (SSL_IS_DTLS(s)) {
1053 if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {
1054 al = SSL_AD_DECODE_ERROR;
1055 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1059 * If we require cookies and this ClientHello doesn't contain one,
1060 * just return since we do not want to allocate any memory yet.
1061 * So check cookie length...
1063 if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
1064 if (PACKET_remaining(&cookie) == 0)
1069 if (!PACKET_get_length_prefixed_2(pkt, &cipher_suites)
1070 || !PACKET_get_length_prefixed_1(pkt, &compression)) {
1071 al = SSL_AD_DECODE_ERROR;
1072 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1075 /* Could be empty. */
1079 if (SSL_IS_DTLS(s)) {
1080 /* Empty cookie was already handled above by returning early. */
1081 if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
1082 if (s->ctx->app_verify_cookie_cb != NULL) {
1083 if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&cookie),
1084 PACKET_remaining(&cookie)) == 0) {
1085 al = SSL_AD_HANDSHAKE_FAILURE;
1086 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1087 SSL_R_COOKIE_MISMATCH);
1089 /* else cookie verification succeeded */
1091 /* default verification */
1092 } else if (!PACKET_equal(&cookie, s->d1->cookie,
1093 s->d1->cookie_len)) {
1094 al = SSL_AD_HANDSHAKE_FAILURE;
1095 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
1098 s->d1->cookie_verified = 1;
1100 if (s->method->version == DTLS_ANY_VERSION) {
1101 protverr = ssl_choose_server_version(s);
1102 if (protverr != 0) {
1103 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
1104 s->version = s->client_version;
1105 al = SSL_AD_PROTOCOL_VERSION;
1114 * We don't allow resumption in a backwards compatible ClientHello.
1115 * TODO(openssl-team): in TLS1.1+, session_id MUST be empty.
1117 * Versions before 0.9.7 always allow clients to resume sessions in
1118 * renegotiation. 0.9.7 and later allow this by default, but optionally
1119 * ignore resumption requests with flag
1120 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION (it's a new flag rather
1121 * than a change to default behavior so that applications relying on
1122 * this for security won't even compile against older library versions).
1123 * 1.0.1 and later also have a function SSL_renegotiate_abbreviated() to
1124 * request renegotiation but not a new session (s->new_session remains
1125 * unset): for servers, this essentially just means that the
1126 * SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be
1131 (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) {
1132 if (!ssl_get_new_session(s, 1))
1135 i = ssl_get_prev_session(s, &extensions, &session_id);
1137 * Only resume if the session's version matches the negotiated
1139 * RFC 5246 does not provide much useful advice on resumption
1140 * with a different protocol version. It doesn't forbid it but
1141 * the sanity of such behaviour would be questionable.
1142 * In practice, clients do not accept a version mismatch and
1143 * will abort the handshake with an error.
1145 if (i == 1 && s->version == s->session->ssl_version) {
1146 /* previous session */
1148 } else if (i == -1) {
1152 if (!ssl_get_new_session(s, 1))
1157 if (ssl_bytes_to_cipher_list(s, &cipher_suites, &(ciphers),
1158 is_v2_record, &al) == NULL) {
1162 /* If it is a hit, check that the cipher is in the list */
1165 id = s->session->cipher->id;
1168 fprintf(stderr, "client sent %d ciphers\n",
1169 sk_SSL_CIPHER_num(ciphers));
1171 for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
1172 c = sk_SSL_CIPHER_value(ciphers, i);
1174 fprintf(stderr, "client [%2d of %2d]:%s\n",
1175 i, sk_SSL_CIPHER_num(ciphers), SSL_CIPHER_get_name(c));
1184 * we need to have the cipher in the cipher list if we are asked
1187 al = SSL_AD_ILLEGAL_PARAMETER;
1188 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1189 SSL_R_REQUIRED_CIPHER_MISSING);
1194 complen = PACKET_remaining(&compression);
1195 for (j = 0; j < complen; j++) {
1196 if (PACKET_data(&compression)[j] == 0)
1202 al = SSL_AD_DECODE_ERROR;
1203 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_COMPRESSION_SPECIFIED);
1207 /* TLS extensions */
1208 if (s->version >= SSL3_VERSION) {
1209 if (!ssl_parse_clienthello_tlsext(s, &extensions)) {
1210 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_PARSE_TLSEXT);
1216 * Check if we want to use external pre-shared secret for this handshake
1217 * for not reused session only. We need to generate server_random before
1218 * calling tls_session_secret_cb in order to allow SessionTicket
1219 * processing to use it in key derivation.
1223 pos = s->s3->server_random;
1224 if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE) <= 0) {
1229 if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) {
1230 const SSL_CIPHER *pref_cipher = NULL;
1232 s->session->master_key_length = sizeof(s->session->master_key);
1233 if (s->tls_session_secret_cb(s, s->session->master_key,
1234 &s->session->master_key_length, ciphers,
1236 s->tls_session_secret_cb_arg)) {
1238 s->session->ciphers = ciphers;
1239 s->session->verify_result = X509_V_OK;
1243 /* check if some cipher was preferred by call back */
1245 pref_cipher ? pref_cipher : ssl3_choose_cipher(s,
1250 if (pref_cipher == NULL) {
1251 al = SSL_AD_HANDSHAKE_FAILURE;
1252 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER);
1256 s->session->cipher = pref_cipher;
1257 sk_SSL_CIPHER_free(s->cipher_list);
1258 s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers);
1259 sk_SSL_CIPHER_free(s->cipher_list_by_id);
1260 s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers);
1265 * Worst case, we will use the NULL compression, but if we have other
1266 * options, we will now look for them. We have complen-1 compression
1267 * algorithms from the client, starting at q.
1269 s->s3->tmp.new_compression = NULL;
1270 #ifndef OPENSSL_NO_COMP
1271 /* This only happens if we have a cache hit */
1272 if (s->session->compress_meth != 0) {
1273 int m, comp_id = s->session->compress_meth;
1275 /* Perform sanity checks on resumed compression algorithm */
1276 /* Can't disable compression */
1277 if (!ssl_allow_compression(s)) {
1278 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1279 SSL_R_INCONSISTENT_COMPRESSION);
1282 /* Look for resumed compression method */
1283 for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++) {
1284 comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
1285 if (comp_id == comp->id) {
1286 s->s3->tmp.new_compression = comp;
1290 if (s->s3->tmp.new_compression == NULL) {
1291 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1292 SSL_R_INVALID_COMPRESSION_ALGORITHM);
1295 /* Look for resumed method in compression list */
1296 for (k = 0; k < complen; k++) {
1297 if (PACKET_data(&compression)[k] == comp_id)
1301 al = SSL_AD_ILLEGAL_PARAMETER;
1302 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
1303 SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING);
1308 else if (ssl_allow_compression(s) && s->ctx->comp_methods) {
1309 /* See if we have a match */
1310 int m, nn, v, done = 0;
1313 nn = sk_SSL_COMP_num(s->ctx->comp_methods);
1314 for (m = 0; m < nn; m++) {
1315 comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
1317 for (o = 0; o < complen; o++) {
1318 if (v == PACKET_data(&compression)[o]) {
1327 s->s3->tmp.new_compression = comp;
1333 * If compression is disabled we'd better not try to resume a session
1334 * using compression.
1336 if (s->session->compress_meth != 0) {
1337 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_INCONSISTENT_COMPRESSION);
1343 * Given s->session->ciphers and SSL_get_ciphers, we must pick a cipher
1347 #ifdef OPENSSL_NO_COMP
1348 s->session->compress_meth = 0;
1350 s->session->compress_meth = (comp == NULL) ? 0 : comp->id;
1352 sk_SSL_CIPHER_free(s->session->ciphers);
1353 s->session->ciphers = ciphers;
1354 if (ciphers == NULL) {
1355 al = SSL_AD_INTERNAL_ERROR;
1356 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1360 if (!tls1_set_server_sigalgs(s)) {
1361 SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
1366 sk_SSL_CIPHER_free(ciphers);
1367 return MSG_PROCESS_CONTINUE_PROCESSING;
1369 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1371 ossl_statem_set_error(s);
1373 sk_SSL_CIPHER_free(ciphers);
1374 return MSG_PROCESS_ERROR;
1378 WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst)
1380 int al = SSL_AD_HANDSHAKE_FAILURE;
1381 const SSL_CIPHER *cipher;
1383 if (wst == WORK_MORE_A) {
1385 /* Let cert callback update server certificates if required */
1386 if (s->cert->cert_cb) {
1387 int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg);
1389 al = SSL_AD_INTERNAL_ERROR;
1390 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, SSL_R_CERT_CB_ERROR);
1394 s->rwstate = SSL_X509_LOOKUP;
1397 s->rwstate = SSL_NOTHING;
1399 cipher = ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s));
1401 if (cipher == NULL) {
1402 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER);
1405 s->s3->tmp.new_cipher = cipher;
1406 /* check whether we should disable session resumption */
1407 if (s->not_resumable_session_cb != NULL)
1408 s->session->not_resumable = s->not_resumable_session_cb(s,
1409 ((cipher->algorithm_mkey & (SSL_kDHE | SSL_kECDHE)) != 0));
1410 if (s->session->not_resumable)
1411 /* do not send a session ticket */
1412 s->tlsext_ticket_expected = 0;
1414 /* Session-id reuse */
1415 s->s3->tmp.new_cipher = s->session->cipher;
1418 if (!(s->verify_mode & SSL_VERIFY_PEER)) {
1419 if (!ssl3_digest_cached_records(s, 0)) {
1420 al = SSL_AD_INTERNAL_ERROR;
1426 * we now have the following setup.
1428 * cipher_list - our prefered list of ciphers
1429 * ciphers - the clients prefered list of ciphers
1430 * compression - basically ignored right now
1431 * ssl version is set - sslv3
1432 * s->session - The ssl session has been setup.
1433 * s->hit - session reuse flag
1434 * s->s3->tmp.new_cipher- the new cipher to use.
1437 /* Handles TLS extensions that we couldn't check earlier */
1438 if (s->version >= SSL3_VERSION) {
1439 if (ssl_check_clienthello_tlsext_late(s) <= 0) {
1440 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
1441 SSL_R_CLIENTHELLO_TLSEXT);
1448 #ifndef OPENSSL_NO_SRP
1449 if (wst == WORK_MORE_B) {
1451 if ((ret = ssl_check_srp_ext_ClientHello(s, &al)) < 0) {
1453 * callback indicates further work to be done
1455 s->rwstate = SSL_X509_LOOKUP;
1458 if (ret != SSL_ERROR_NONE) {
1460 * This is not really an error but the only means to for
1461 * a client to detect whether srp is supported.
1463 if (al != TLS1_AD_UNKNOWN_PSK_IDENTITY)
1464 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
1465 SSL_R_CLIENTHELLO_TLSEXT);
1472 return WORK_FINISHED_STOP;
1474 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1475 ossl_statem_set_error(s);
1479 int tls_construct_server_hello(SSL *s)
1482 unsigned char *p, *d;
1487 buf = (unsigned char *)s->init_buf->data;
1489 /* Do the message type and length last */
1490 d = p = ssl_handshake_start(s);
1492 *(p++) = s->version >> 8;
1493 *(p++) = s->version & 0xff;
1496 * Random stuff. Filling of the server_random takes place in
1497 * tls_process_client_hello()
1499 memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE);
1500 p += SSL3_RANDOM_SIZE;
1503 * There are several cases for the session ID to send
1504 * back in the server hello:
1505 * - For session reuse from the session cache,
1506 * we send back the old session ID.
1507 * - If stateless session reuse (using a session ticket)
1508 * is successful, we send back the client's "session ID"
1509 * (which doesn't actually identify the session).
1510 * - If it is a new session, we send back the new
1512 * - However, if we want the new session to be single-use,
1513 * we send back a 0-length session ID.
1514 * s->hit is non-zero in either case of session reuse,
1515 * so the following won't overwrite an ID that we're supposed
1518 if (s->session->not_resumable ||
1519 (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
1521 s->session->session_id_length = 0;
1523 sl = s->session->session_id_length;
1524 if (sl > (int)sizeof(s->session->session_id)) {
1525 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
1526 ossl_statem_set_error(s);
1530 memcpy(p, s->session->session_id, sl);
1533 /* put the cipher */
1534 i = ssl3_put_cipher_by_char(s->s3->tmp.new_cipher, p);
1537 /* put the compression method */
1538 #ifdef OPENSSL_NO_COMP
1541 if (s->s3->tmp.new_compression == NULL)
1544 *(p++) = s->s3->tmp.new_compression->id;
1547 if (ssl_prepare_serverhello_tlsext(s) <= 0) {
1548 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, SSL_R_SERVERHELLO_TLSEXT);
1549 ossl_statem_set_error(s);
1553 ssl_add_serverhello_tlsext(s, p, buf + SSL3_RT_MAX_PLAIN_LENGTH,
1555 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1556 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
1557 ossl_statem_set_error(s);
1563 if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_HELLO, l)) {
1564 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
1565 ossl_statem_set_error(s);
1572 int tls_construct_server_done(SSL *s)
1574 if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_DONE, 0)) {
1575 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_DONE, ERR_R_INTERNAL_ERROR);
1576 ossl_statem_set_error(s);
1580 if (!s->s3->tmp.cert_request) {
1581 if (!ssl3_digest_cached_records(s, 0)) {
1582 ossl_statem_set_error(s);
1589 int tls_construct_server_key_exchange(SSL *s)
1591 #ifndef OPENSSL_NO_DH
1592 EVP_PKEY *pkdh = NULL;
1594 #ifndef OPENSSL_NO_EC
1595 unsigned char *encodedPoint = NULL;
1600 const EVP_MD *md = NULL;
1601 unsigned char *p, *d;
1608 EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
1610 if (md_ctx == NULL) {
1611 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
1612 al = SSL_AD_INTERNAL_ERROR;
1616 type = s->s3->tmp.new_cipher->algorithm_mkey;
1620 r[0] = r[1] = r[2] = r[3] = NULL;
1622 #ifndef OPENSSL_NO_PSK
1623 if (type & SSL_PSK) {
1625 * reserve size for record length and PSK identity hint
1628 if (s->cert->psk_identity_hint)
1629 n += strlen(s->cert->psk_identity_hint);
1631 /* Plain PSK or RSAPSK nothing to do */
1632 if (type & (SSL_kPSK | SSL_kRSAPSK)) {
1634 #endif /* !OPENSSL_NO_PSK */
1635 #ifndef OPENSSL_NO_DH
1636 if (type & (SSL_kDHE | SSL_kDHEPSK)) {
1637 CERT *cert = s->cert;
1639 EVP_PKEY *pkdhp = NULL;
1642 if (s->cert->dh_tmp_auto) {
1643 DH *dhp = ssl_get_auto_dh(s);
1644 pkdh = EVP_PKEY_new();
1645 if (pkdh == NULL || dhp == NULL) {
1647 al = SSL_AD_INTERNAL_ERROR;
1648 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1649 ERR_R_INTERNAL_ERROR);
1652 EVP_PKEY_assign_DH(pkdh, dhp);
1655 pkdhp = cert->dh_tmp;
1657 if ((pkdhp == NULL) && (s->cert->dh_tmp_cb != NULL)) {
1658 DH *dhp = s->cert->dh_tmp_cb(s, 0, 1024);
1659 pkdh = ssl_dh_to_pkey(dhp);
1661 al = SSL_AD_INTERNAL_ERROR;
1662 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1663 ERR_R_INTERNAL_ERROR);
1668 if (pkdhp == NULL) {
1669 al = SSL_AD_HANDSHAKE_FAILURE;
1670 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1671 SSL_R_MISSING_TMP_DH_KEY);
1674 if (!ssl_security(s, SSL_SECOP_TMP_DH,
1675 EVP_PKEY_security_bits(pkdhp), 0, pkdhp)) {
1676 al = SSL_AD_HANDSHAKE_FAILURE;
1677 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1678 SSL_R_DH_KEY_TOO_SMALL);
1681 if (s->s3->tmp.pkey != NULL) {
1682 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1683 ERR_R_INTERNAL_ERROR);
1687 s->s3->tmp.pkey = ssl_generate_pkey(pkdhp, NID_undef);
1689 if (s->s3->tmp.pkey == NULL) {
1690 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB);
1694 dh = EVP_PKEY_get0_DH(s->s3->tmp.pkey);
1696 EVP_PKEY_free(pkdh);
1699 DH_get0_pqg(dh, &r[0], NULL, &r[1]);
1700 DH_get0_key(dh, &r[2], NULL);
1703 #ifndef OPENSSL_NO_EC
1704 if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {
1707 if (s->s3->tmp.pkey != NULL) {
1708 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1709 ERR_R_INTERNAL_ERROR);
1713 /* Get NID of appropriate shared curve */
1714 nid = tls1_shared_curve(s, -2);
1715 curve_id = tls1_ec_nid2curve_id(nid);
1716 if (curve_id == 0) {
1717 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1718 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
1721 s->s3->tmp.pkey = ssl_generate_pkey(NULL, nid);
1722 /* Generate a new key for this curve */
1723 if (s->s3->tmp.pkey == NULL) {
1724 al = SSL_AD_INTERNAL_ERROR;
1725 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EVP_LIB);
1729 /* Encode the public key. */
1730 encodedlen = EC_KEY_key2buf(EVP_PKEY_get0_EC_KEY(s->s3->tmp.pkey),
1731 POINT_CONVERSION_UNCOMPRESSED,
1732 &encodedPoint, NULL);
1734 if (encodedlen == 0) {
1735 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EC_LIB);
1740 * We only support named (not generic) curves in ECDH ephemeral key
1741 * exchanges. In this situation, we need four additional bytes to
1742 * encode the entire ServerECDHParams structure.
1744 n += 4 + encodedlen;
1747 * We'll generate the serverKeyExchange message explicitly so we
1748 * can set these to NULLs
1755 #endif /* !OPENSSL_NO_EC */
1756 #ifndef OPENSSL_NO_SRP
1757 if (type & SSL_kSRP) {
1758 if ((s->srp_ctx.N == NULL) ||
1759 (s->srp_ctx.g == NULL) ||
1760 (s->srp_ctx.s == NULL) || (s->srp_ctx.B == NULL)) {
1761 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1762 SSL_R_MISSING_SRP_PARAM);
1765 r[0] = s->srp_ctx.N;
1766 r[1] = s->srp_ctx.g;
1767 r[2] = s->srp_ctx.s;
1768 r[3] = s->srp_ctx.B;
1772 al = SSL_AD_HANDSHAKE_FAILURE;
1773 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1774 SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
1777 for (i = 0; i < 4 && r[i] != NULL; i++) {
1778 nr[i] = BN_num_bytes(r[i]);
1779 #ifndef OPENSSL_NO_SRP
1780 if ((i == 2) && (type & SSL_kSRP))
1787 if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP))
1788 && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) {
1789 if ((pkey = ssl_get_sign_pkey(s, s->s3->tmp.new_cipher, &md))
1791 al = SSL_AD_DECODE_ERROR;
1794 kn = EVP_PKEY_size(pkey);
1795 /* Allow space for signature algorithm */
1796 if (SSL_USE_SIGALGS(s))
1798 /* Allow space for signature length */
1805 if (!BUF_MEM_grow_clean(buf, n + SSL_HM_HEADER_LENGTH(s) + kn)) {
1806 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_BUF);
1809 d = p = ssl_handshake_start(s);
1811 #ifndef OPENSSL_NO_PSK
1812 if (type & SSL_PSK) {
1813 /* copy PSK identity hint */
1814 if (s->cert->psk_identity_hint) {
1815 s2n(strlen(s->cert->psk_identity_hint), p);
1816 strncpy((char *)p, s->cert->psk_identity_hint,
1817 strlen(s->cert->psk_identity_hint));
1818 p += strlen(s->cert->psk_identity_hint);
1825 for (i = 0; i < 4 && r[i] != NULL; i++) {
1826 #ifndef OPENSSL_NO_SRP
1827 if ((i == 2) && (type & SSL_kSRP)) {
1837 #ifndef OPENSSL_NO_EC
1838 if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {
1840 * XXX: For now, we only support named (not generic) curves. In
1841 * this situation, the serverKeyExchange message has: [1 byte
1842 * CurveType], [2 byte CurveName] [1 byte length of encoded
1843 * point], followed by the actual encoded point itself
1845 *p = NAMED_CURVE_TYPE;
1853 memcpy(p, encodedPoint, encodedlen);
1854 OPENSSL_free(encodedPoint);
1855 encodedPoint = NULL;
1863 * n is the length of the params, they start at &(d[4]) and p
1864 * points to the space at the end.
1867 /* send signature algorithm */
1868 if (SSL_USE_SIGALGS(s)) {
1869 if (!tls12_get_sigandhash(p, pkey, md)) {
1870 /* Should never happen */
1871 al = SSL_AD_INTERNAL_ERROR;
1872 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1873 ERR_R_INTERNAL_ERROR);
1879 fprintf(stderr, "Using hash %s\n", EVP_MD_name(md));
1881 if (EVP_SignInit_ex(md_ctx, md, NULL) <= 0
1882 || EVP_SignUpdate(md_ctx, &(s->s3->client_random[0]),
1883 SSL3_RANDOM_SIZE) <= 0
1884 || EVP_SignUpdate(md_ctx, &(s->s3->server_random[0]),
1885 SSL3_RANDOM_SIZE) <= 0
1886 || EVP_SignUpdate(md_ctx, d, n) <= 0
1887 || EVP_SignFinal(md_ctx, &(p[2]),
1888 (unsigned int *)&i, pkey) <= 0) {
1889 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_EVP);
1890 al = SSL_AD_INTERNAL_ERROR;
1895 if (SSL_USE_SIGALGS(s))
1898 /* Is this error check actually needed? */
1899 al = SSL_AD_HANDSHAKE_FAILURE;
1900 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
1901 SSL_R_UNKNOWN_PKEY_TYPE);
1906 if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_KEY_EXCHANGE, n)) {
1907 al = SSL_AD_HANDSHAKE_FAILURE;
1908 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
1912 EVP_MD_CTX_free(md_ctx);
1915 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1917 #ifndef OPENSSL_NO_DH
1918 EVP_PKEY_free(pkdh);
1920 #ifndef OPENSSL_NO_EC
1921 OPENSSL_free(encodedPoint);
1923 EVP_MD_CTX_free(md_ctx);
1924 ossl_statem_set_error(s);
1928 int tls_construct_certificate_request(SSL *s)
1930 unsigned char *p, *d;
1931 int i, j, nl, off, n;
1932 STACK_OF(X509_NAME) *sk = NULL;
1938 d = p = ssl_handshake_start(s);
1940 /* get the list of acceptable cert types */
1942 n = ssl3_get_req_cert_type(s, p);
1947 if (SSL_USE_SIGALGS(s)) {
1948 const unsigned char *psigs;
1949 unsigned char *etmp = p;
1950 nl = tls12_get_psigalgs(s, &psigs);
1951 /* Skip over length for now */
1953 nl = tls12_copy_sigalgs(s, p, psigs, nl);
1954 /* Now fill in length */
1964 sk = SSL_get_client_CA_list(s);
1967 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
1968 name = sk_X509_NAME_value(sk, i);
1969 j = i2d_X509_NAME(name, NULL);
1970 if (!BUF_MEM_grow_clean
1971 (buf, SSL_HM_HEADER_LENGTH(s) + n + j + 2)) {
1972 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
1976 p = ssl_handshake_start(s) + n;
1978 i2d_X509_NAME(name, &p);
1983 /* else no CA names */
1984 p = ssl_handshake_start(s) + off;
1987 if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_REQUEST, n)) {
1988 SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);
1992 s->s3->tmp.cert_request = 1;
1996 ossl_statem_set_error(s);
2000 MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt)
2003 unsigned long alg_k;
2004 #ifndef OPENSSL_NO_RSA
2007 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
2008 EVP_PKEY *ckey = NULL;
2010 PACKET enc_premaster;
2011 unsigned char *rsa_decrypt = NULL;
2013 alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2015 #ifndef OPENSSL_NO_PSK
2016 /* For PSK parse and retrieve identity, obtain PSK key */
2017 if (alg_k & SSL_PSK) {
2018 unsigned char psk[PSK_MAX_PSK_LEN];
2020 PACKET psk_identity;
2022 if (!PACKET_get_length_prefixed_2(pkt, &psk_identity)) {
2023 al = SSL_AD_DECODE_ERROR;
2024 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH);
2027 if (PACKET_remaining(&psk_identity) > PSK_MAX_IDENTITY_LEN) {
2028 al = SSL_AD_DECODE_ERROR;
2029 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2030 SSL_R_DATA_LENGTH_TOO_LONG);
2033 if (s->psk_server_callback == NULL) {
2034 al = SSL_AD_INTERNAL_ERROR;
2035 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2036 SSL_R_PSK_NO_SERVER_CB);
2040 if (!PACKET_strndup(&psk_identity, &s->session->psk_identity)) {
2041 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2042 al = SSL_AD_INTERNAL_ERROR;
2046 psklen = s->psk_server_callback(s, s->session->psk_identity,
2049 if (psklen > PSK_MAX_PSK_LEN) {
2050 al = SSL_AD_INTERNAL_ERROR;
2051 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2053 } else if (psklen == 0) {
2055 * PSK related to the given identity not found
2057 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2058 SSL_R_PSK_IDENTITY_NOT_FOUND);
2059 al = SSL_AD_UNKNOWN_PSK_IDENTITY;
2063 OPENSSL_free(s->s3->tmp.psk);
2064 s->s3->tmp.psk = OPENSSL_memdup(psk, psklen);
2065 OPENSSL_cleanse(psk, psklen);
2067 if (s->s3->tmp.psk == NULL) {
2068 al = SSL_AD_INTERNAL_ERROR;
2069 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
2073 s->s3->tmp.psklen = psklen;
2075 if (alg_k & SSL_kPSK) {
2076 /* Identity extracted earlier: should be nothing left */
2077 if (PACKET_remaining(pkt) != 0) {
2078 al = SSL_AD_HANDSHAKE_FAILURE;
2079 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH);
2082 /* PSK handled by ssl_generate_master_secret */
2083 if (!ssl_generate_master_secret(s, NULL, 0, 0)) {
2084 al = SSL_AD_INTERNAL_ERROR;
2085 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2090 #ifndef OPENSSL_NO_RSA
2091 if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) {
2092 unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];
2094 unsigned char decrypt_good, version_good;
2095 size_t j, padding_len;
2097 /* FIX THIS UP EAY EAY EAY EAY */
2098 rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey);
2100 al = SSL_AD_HANDSHAKE_FAILURE;
2101 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2102 SSL_R_MISSING_RSA_CERTIFICATE);
2106 /* SSLv3 and pre-standard DTLS omit the length bytes. */
2107 if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {
2108 enc_premaster = *pkt;
2110 if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)
2111 || PACKET_remaining(pkt) != 0) {
2112 al = SSL_AD_DECODE_ERROR;
2113 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2114 SSL_R_LENGTH_MISMATCH);
2120 * We want to be sure that the plaintext buffer size makes it safe to
2121 * iterate over the entire size of a premaster secret
2122 * (SSL_MAX_MASTER_KEY_LENGTH). Reject overly short RSA keys because
2123 * their ciphertext cannot accommodate a premaster secret anyway.
2125 if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {
2126 al = SSL_AD_INTERNAL_ERROR;
2127 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2128 RSA_R_KEY_SIZE_TOO_SMALL);
2132 rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
2133 if (rsa_decrypt == NULL) {
2134 al = SSL_AD_INTERNAL_ERROR;
2135 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
2140 * We must not leak whether a decryption failure occurs because of
2141 * Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246,
2142 * section 7.4.7.1). The code follows that advice of the TLS RFC and
2143 * generates a random premaster secret for the case that the decrypt
2144 * fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1
2147 if (RAND_bytes(rand_premaster_secret,
2148 sizeof(rand_premaster_secret)) <= 0) {
2153 * Decrypt with no padding. PKCS#1 padding will be removed as part of
2154 * the timing-sensitive code below.
2156 decrypt_len = RSA_private_decrypt(PACKET_remaining(&enc_premaster),
2157 PACKET_data(&enc_premaster),
2158 rsa_decrypt, rsa, RSA_NO_PADDING);
2159 if (decrypt_len < 0) {
2163 /* Check the padding. See RFC 3447, section 7.2.2. */
2166 * The smallest padded premaster is 11 bytes of overhead. Small keys
2167 * are publicly invalid, so this may return immediately. This ensures
2168 * PS is at least 8 bytes.
2170 if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {
2171 al = SSL_AD_DECRYPT_ERROR;
2172 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_DECRYPTION_FAILED);
2176 padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;
2177 decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &
2178 constant_time_eq_int_8(rsa_decrypt[1], 2);
2179 for (j = 2; j < padding_len - 1; j++) {
2180 decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
2182 decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);
2185 * If the version in the decrypted pre-master secret is correct then
2186 * version_good will be 0xff, otherwise it'll be zero. The
2187 * Klima-Pokorny-Rosa extension of Bleichenbacher's attack
2188 * (http://eprint.iacr.org/2003/052/) exploits the version number
2189 * check as a "bad version oracle". Thus version checks are done in
2190 * constant time and are treated like any other decryption error.
2193 constant_time_eq_8(rsa_decrypt[padding_len],
2194 (unsigned)(s->client_version >> 8));
2196 constant_time_eq_8(rsa_decrypt[padding_len + 1],
2197 (unsigned)(s->client_version & 0xff));
2200 * The premaster secret must contain the same version number as the
2201 * ClientHello to detect version rollback attacks (strangely, the
2202 * protocol does not offer such protection for DH ciphersuites).
2203 * However, buggy clients exist that send the negotiated protocol
2204 * version instead if the server does not support the requested
2205 * protocol version. If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such
2208 if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {
2209 unsigned char workaround_good;
2210 workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],
2211 (unsigned)(s->version >> 8));
2213 constant_time_eq_8(rsa_decrypt[padding_len + 1],
2214 (unsigned)(s->version & 0xff));
2215 version_good |= workaround_good;
2219 * Both decryption and version must be good for decrypt_good to
2220 * remain non-zero (0xff).
2222 decrypt_good &= version_good;
2225 * Now copy rand_premaster_secret over from p using
2226 * decrypt_good_mask. If decryption failed, then p does not
2227 * contain valid plaintext, however, a check above guarantees
2228 * it is still sufficiently large to read from.
2230 for (j = 0; j < sizeof(rand_premaster_secret); j++) {
2231 rsa_decrypt[padding_len + j] =
2232 constant_time_select_8(decrypt_good,
2233 rsa_decrypt[padding_len + j],
2234 rand_premaster_secret[j]);
2237 if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,
2238 sizeof(rand_premaster_secret), 0)) {
2239 al = SSL_AD_INTERNAL_ERROR;
2240 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2243 OPENSSL_free(rsa_decrypt);
2247 #ifndef OPENSSL_NO_DH
2248 if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
2249 EVP_PKEY *skey = NULL;
2253 const unsigned char *data;
2255 if (!PACKET_get_net_2(pkt, &i)) {
2256 if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
2257 al = SSL_AD_HANDSHAKE_FAILURE;
2258 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2259 SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
2264 if (PACKET_remaining(pkt) != i) {
2265 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2266 SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
2269 skey = s->s3->tmp.pkey;
2271 al = SSL_AD_HANDSHAKE_FAILURE;
2272 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2273 SSL_R_MISSING_TMP_DH_KEY);
2277 if (PACKET_remaining(pkt) == 0L) {
2278 al = SSL_AD_HANDSHAKE_FAILURE;
2279 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2280 SSL_R_MISSING_TMP_DH_KEY);
2283 if (!PACKET_get_bytes(pkt, &data, i)) {
2284 /* We already checked we have enough data */
2285 al = SSL_AD_INTERNAL_ERROR;
2286 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2287 ERR_R_INTERNAL_ERROR);
2290 ckey = EVP_PKEY_new();
2291 if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) == 0) {
2292 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_BN_LIB);
2295 cdh = EVP_PKEY_get0_DH(ckey);
2296 pub_key = BN_bin2bn(data, i, NULL);
2298 if (pub_key == NULL || !DH_set0_key(cdh, pub_key, NULL)) {
2299 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2300 if (pub_key != NULL)
2305 if (ssl_derive(s, skey, ckey) == 0) {
2306 al = SSL_AD_INTERNAL_ERROR;
2307 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2311 EVP_PKEY_free(ckey);
2313 EVP_PKEY_free(s->s3->tmp.pkey);
2314 s->s3->tmp.pkey = NULL;
2319 #ifndef OPENSSL_NO_EC
2320 if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
2321 EVP_PKEY *skey = s->s3->tmp.pkey;
2323 if (PACKET_remaining(pkt) == 0L) {
2324 /* We don't support ECDH client auth */
2325 al = SSL_AD_HANDSHAKE_FAILURE;
2326 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2327 SSL_R_MISSING_TMP_ECDH_KEY);
2331 const unsigned char *data;
2334 * Get client's public key from encoded point in the
2335 * ClientKeyExchange message.
2338 /* Get encoded point length */
2339 if (!PACKET_get_1(pkt, &i)) {
2340 al = SSL_AD_DECODE_ERROR;
2341 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2342 SSL_R_LENGTH_MISMATCH);
2345 if (!PACKET_get_bytes(pkt, &data, i)
2346 || PACKET_remaining(pkt) != 0) {
2347 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
2350 ckey = EVP_PKEY_new();
2351 if (ckey == NULL || EVP_PKEY_copy_parameters(ckey, skey) <= 0) {
2352 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_EVP_LIB);
2355 if (EC_KEY_oct2key(EVP_PKEY_get0_EC_KEY(ckey), data, i,
2357 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
2362 if (ssl_derive(s, skey, ckey) == 0) {
2363 al = SSL_AD_INTERNAL_ERROR;
2364 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2368 EVP_PKEY_free(ckey);
2370 EVP_PKEY_free(s->s3->tmp.pkey);
2371 s->s3->tmp.pkey = NULL;
2373 return MSG_PROCESS_CONTINUE_PROCESSING;
2376 #ifndef OPENSSL_NO_SRP
2377 if (alg_k & SSL_kSRP) {
2379 const unsigned char *data;
2381 if (!PACKET_get_net_2(pkt, &i)
2382 || !PACKET_get_bytes(pkt, &data, i)) {
2383 al = SSL_AD_DECODE_ERROR;
2384 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_BAD_SRP_A_LENGTH);
2387 if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) {
2388 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_BN_LIB);
2391 if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0
2392 || BN_is_zero(s->srp_ctx.A)) {
2393 al = SSL_AD_ILLEGAL_PARAMETER;
2394 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2395 SSL_R_BAD_SRP_PARAMETERS);
2398 OPENSSL_free(s->session->srp_username);
2399 s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);
2400 if (s->session->srp_username == NULL) {
2401 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
2405 if (!srp_generate_server_master_secret(s)) {
2406 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2410 #endif /* OPENSSL_NO_SRP */
2411 #ifndef OPENSSL_NO_GOST
2412 if (alg_k & SSL_kGOST) {
2413 EVP_PKEY_CTX *pkey_ctx;
2414 EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
2415 unsigned char premaster_secret[32];
2416 const unsigned char *start;
2417 size_t outlen = 32, inlen;
2418 unsigned long alg_a;
2422 const unsigned char *data;
2424 /* Get our certificate private key */
2425 alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2426 if (alg_a & SSL_aGOST12) {
2428 * New GOST ciphersuites have SSL_aGOST01 bit too
2430 pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey;
2432 pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey;
2435 pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
2437 } else if (alg_a & SSL_aGOST01) {
2438 pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
2441 pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
2442 if (pkey_ctx == NULL) {
2443 al = SSL_AD_INTERNAL_ERROR;
2444 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
2447 if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) {
2448 al = SSL_AD_INTERNAL_ERROR;
2449 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2453 * If client certificate is present and is of the same type, maybe
2454 * use it for key exchange. Don't mind errors from
2455 * EVP_PKEY_derive_set_peer, because it is completely valid to use a
2456 * client certificate for authorization only.
2458 client_pub_pkey = X509_get0_pubkey(s->session->peer);
2459 if (client_pub_pkey) {
2460 if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)
2463 /* Decrypt session key */
2464 sess_key_len = PACKET_remaining(pkt);
2465 if (!PACKET_get_bytes(pkt, &data, sess_key_len)) {
2466 al = SSL_AD_INTERNAL_ERROR;
2467 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2470 if (ASN1_get_object ((const unsigned char **)&data, &Tlen, &Ttag,
2471 &Tclass, sess_key_len) != V_ASN1_CONSTRUCTED
2472 || Ttag != V_ASN1_SEQUENCE
2473 || Tclass != V_ASN1_UNIVERSAL) {
2474 al = SSL_AD_DECODE_ERROR;
2475 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2476 SSL_R_DECRYPTION_FAILED);
2481 if (EVP_PKEY_decrypt
2482 (pkey_ctx, premaster_secret, &outlen, start, inlen) <= 0) {
2483 al = SSL_AD_DECODE_ERROR;
2484 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
2485 SSL_R_DECRYPTION_FAILED);
2488 /* Generate master secret */
2489 if (!ssl_generate_master_secret(s, premaster_secret,
2490 sizeof(premaster_secret), 0)) {
2491 al = SSL_AD_INTERNAL_ERROR;
2492 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2495 /* Check if pubkey from client certificate was used */
2496 if (EVP_PKEY_CTX_ctrl
2497 (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)
2498 s->statem.no_cert_verify = 1;
2500 EVP_PKEY_CTX_free(pkey_ctx);
2501 return MSG_PROCESS_CONTINUE_PROCESSING;
2503 EVP_PKEY_CTX_free(pkey_ctx);
2508 al = SSL_AD_HANDSHAKE_FAILURE;
2509 SSLerr(SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE, SSL_R_UNKNOWN_CIPHER_TYPE);
2513 return MSG_PROCESS_CONTINUE_PROCESSING;
2515 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2516 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_SRP)
2519 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
2520 EVP_PKEY_free(ckey);
2522 OPENSSL_free(rsa_decrypt);
2523 #ifndef OPENSSL_NO_PSK
2524 OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen);
2525 s->s3->tmp.psk = NULL;
2527 ossl_statem_set_error(s);
2528 return MSG_PROCESS_ERROR;
2531 WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst)
2533 #ifndef OPENSSL_NO_SCTP
2534 if (wst == WORK_MORE_A) {
2535 if (SSL_IS_DTLS(s)) {
2536 unsigned char sctpauthkey[64];
2537 char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
2539 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
2542 memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
2543 sizeof(DTLS1_SCTP_AUTH_LABEL));
2545 if (SSL_export_keying_material(s, sctpauthkey,
2546 sizeof(sctpauthkey), labelbuffer,
2547 sizeof(labelbuffer), NULL, 0, 0) <= 0) {
2548 ossl_statem_set_error(s);
2552 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
2553 sizeof(sctpauthkey), sctpauthkey);
2558 if ((wst == WORK_MORE_B)
2560 && BIO_dgram_is_sctp(SSL_get_wbio(s))
2561 /* Are we renegotiating? */
2563 /* Are we going to skip the CertificateVerify? */
2564 && (s->session->peer == NULL || s->statem.no_cert_verify)
2565 && BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
2566 s->s3->in_read_app_data = 2;
2567 s->rwstate = SSL_READING;
2568 BIO_clear_retry_flags(SSL_get_rbio(s));
2569 BIO_set_retry_read(SSL_get_rbio(s));
2570 ossl_statem_set_sctp_read_sock(s, 1);
2573 ossl_statem_set_sctp_read_sock(s, 0);
2577 if (s->statem.no_cert_verify) {
2578 /* No certificate verify so we no longer need the handshake_buffer */
2579 BIO_free(s->s3->handshake_buffer);
2580 s->s3->handshake_buffer = NULL;
2581 return WORK_FINISHED_CONTINUE;
2583 if (!s->session->peer) {
2584 /* No peer certificate so we no longer need the handshake_buffer */
2585 BIO_free(s->s3->handshake_buffer);
2586 return WORK_FINISHED_CONTINUE;
2588 if (!s->s3->handshake_buffer) {
2589 SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE,
2590 ERR_R_INTERNAL_ERROR);
2591 ossl_statem_set_error(s);
2595 * For sigalgs freeze the handshake buffer. If we support
2596 * extms we've done this already so this is a no-op
2598 if (!ssl3_digest_cached_records(s, 1)) {
2599 ossl_statem_set_error(s);
2604 return WORK_FINISHED_CONTINUE;
2607 MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt)
2609 EVP_PKEY *pkey = NULL;
2610 const unsigned char *sig, *data;
2611 #ifndef OPENSSL_NO_GOST
2612 unsigned char *gost_data = NULL;
2614 int al, ret = MSG_PROCESS_ERROR;
2618 const EVP_MD *md = NULL;
2622 EVP_MD_CTX *mctx = EVP_MD_CTX_new();
2625 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
2626 al = SSL_AD_INTERNAL_ERROR;
2630 peer = s->session->peer;
2631 pkey = X509_get0_pubkey(peer);
2632 type = X509_certificate_type(peer, pkey);
2634 if (!(type & EVP_PKT_SIGN)) {
2635 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY,
2636 SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
2637 al = SSL_AD_ILLEGAL_PARAMETER;
2641 /* Check for broken implementations of GOST ciphersuites */
2643 * If key is GOST and n is exactly 64, it is bare signature without
2644 * length field (CryptoPro implementations at least till CSP 4.0)
2646 #ifndef OPENSSL_NO_GOST
2647 if (PACKET_remaining(pkt) == 64
2648 && EVP_PKEY_id(pkey) == NID_id_GostR3410_2001) {
2653 if (SSL_USE_SIGALGS(s)) {
2656 if (!PACKET_get_bytes(pkt, &sig, 2)) {
2657 al = SSL_AD_DECODE_ERROR;
2660 rv = tls12_check_peer_sigalg(&md, s, sig, pkey);
2662 al = SSL_AD_INTERNAL_ERROR;
2664 } else if (rv == 0) {
2665 al = SSL_AD_DECODE_ERROR;
2669 fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
2672 /* Use default digest for this key type */
2673 int idx = ssl_cert_type(NULL, pkey);
2675 md = s->s3->tmp.md[idx];
2677 al = SSL_AD_INTERNAL_ERROR;
2682 if (!PACKET_get_net_2(pkt, &len)) {
2683 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);
2684 al = SSL_AD_DECODE_ERROR;
2688 j = EVP_PKEY_size(pkey);
2689 if (((int)len > j) || ((int)PACKET_remaining(pkt) > j)
2690 || (PACKET_remaining(pkt) == 0)) {
2691 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_WRONG_SIGNATURE_SIZE);
2692 al = SSL_AD_DECODE_ERROR;
2695 if (!PACKET_get_bytes(pkt, &data, len)) {
2696 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_LENGTH_MISMATCH);
2697 al = SSL_AD_DECODE_ERROR;
2701 hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
2702 if (hdatalen <= 0) {
2703 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_INTERNAL_ERROR);
2704 al = SSL_AD_INTERNAL_ERROR;
2708 fprintf(stderr, "Using client verify alg %s\n", EVP_MD_name(md));
2710 if (!EVP_VerifyInit_ex(mctx, md, NULL)
2711 || !EVP_VerifyUpdate(mctx, hdata, hdatalen)) {
2712 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB);
2713 al = SSL_AD_INTERNAL_ERROR;
2717 #ifndef OPENSSL_NO_GOST
2719 int pktype = EVP_PKEY_id(pkey);
2720 if (pktype == NID_id_GostR3410_2001
2721 || pktype == NID_id_GostR3410_2012_256
2722 || pktype == NID_id_GostR3410_2012_512) {
2723 if ((gost_data = OPENSSL_malloc(len)) == NULL) {
2724 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_MALLOC_FAILURE);
2725 al = SSL_AD_INTERNAL_ERROR;
2728 BUF_reverse(gost_data, data, len);
2734 if (s->version == SSL3_VERSION
2735 && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
2736 s->session->master_key_length,
2737 s->session->master_key)) {
2738 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, ERR_R_EVP_LIB);
2739 al = SSL_AD_INTERNAL_ERROR;
2743 if (EVP_VerifyFinal(mctx, data, len, pkey) <= 0) {
2744 al = SSL_AD_DECRYPT_ERROR;
2745 SSLerr(SSL_F_TLS_PROCESS_CERT_VERIFY, SSL_R_BAD_SIGNATURE);
2749 ret = MSG_PROCESS_CONTINUE_PROCESSING;
2752 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2753 ossl_statem_set_error(s);
2755 BIO_free(s->s3->handshake_buffer);
2756 s->s3->handshake_buffer = NULL;
2757 EVP_MD_CTX_free(mctx);
2758 #ifndef OPENSSL_NO_GOST
2759 OPENSSL_free(gost_data);
2764 MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt)
2766 int i, al = SSL_AD_INTERNAL_ERROR, ret = MSG_PROCESS_ERROR;
2768 unsigned long l, llen;
2769 const unsigned char *certstart, *certbytes;
2770 STACK_OF(X509) *sk = NULL;
2773 if ((sk = sk_X509_new_null()) == NULL) {
2774 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
2778 if (!PACKET_get_net_3(pkt, &llen)
2779 || !PACKET_get_sub_packet(pkt, &spkt, llen)
2780 || PACKET_remaining(pkt) != 0) {
2781 al = SSL_AD_DECODE_ERROR;
2782 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, SSL_R_LENGTH_MISMATCH);
2786 while (PACKET_remaining(&spkt) > 0) {
2787 if (!PACKET_get_net_3(&spkt, &l)
2788 || !PACKET_get_bytes(&spkt, &certbytes, l)) {
2789 al = SSL_AD_DECODE_ERROR;
2790 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
2791 SSL_R_CERT_LENGTH_MISMATCH);
2795 certstart = certbytes;
2796 x = d2i_X509(NULL, (const unsigned char **)&certbytes, l);
2798 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_ASN1_LIB);
2801 if (certbytes != (certstart + l)) {
2802 al = SSL_AD_DECODE_ERROR;
2803 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
2804 SSL_R_CERT_LENGTH_MISMATCH);
2807 if (!sk_X509_push(sk, x)) {
2808 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
2814 if (sk_X509_num(sk) <= 0) {
2815 /* TLS does not mind 0 certs returned */
2816 if (s->version == SSL3_VERSION) {
2817 al = SSL_AD_HANDSHAKE_FAILURE;
2818 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
2819 SSL_R_NO_CERTIFICATES_RETURNED);
2822 /* Fail for TLS only if we required a certificate */
2823 else if ((s->verify_mode & SSL_VERIFY_PEER) &&
2824 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
2825 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
2826 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
2827 al = SSL_AD_HANDSHAKE_FAILURE;
2830 /* No client certificate so digest cached records */
2831 if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) {
2836 i = ssl_verify_cert_chain(s, sk);
2838 al = ssl_verify_alarm_type(s->verify_result);
2839 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
2840 SSL_R_CERTIFICATE_VERIFY_FAILED);
2844 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, i);
2845 al = SSL_AD_HANDSHAKE_FAILURE;
2848 pkey = X509_get0_pubkey(sk_X509_value(sk, 0));
2850 al = SSL3_AD_HANDSHAKE_FAILURE;
2851 SSLerr(SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
2852 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
2857 X509_free(s->session->peer);
2858 s->session->peer = sk_X509_shift(sk);
2859 s->session->verify_result = s->verify_result;
2861 sk_X509_pop_free(s->session->peer_chain, X509_free);
2862 s->session->peer_chain = sk;
2864 * Inconsistency alert: cert_chain does *not* include the peer's own
2865 * certificate, while we do include it in statem_clnt.c
2868 ret = MSG_PROCESS_CONTINUE_READING;
2872 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2873 ossl_statem_set_error(s);
2876 sk_X509_pop_free(sk, X509_free);
2880 int tls_construct_server_certificate(SSL *s)
2884 cpk = ssl_get_server_send_pkey(s);
2886 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
2887 ossl_statem_set_error(s);
2891 if (!ssl3_output_cert_chain(s, cpk)) {
2892 SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
2893 ossl_statem_set_error(s);
2900 int tls_construct_new_session_ticket(SSL *s)
2902 unsigned char *senc = NULL;
2903 EVP_CIPHER_CTX *ctx;
2904 HMAC_CTX *hctx = NULL;
2905 unsigned char *p, *macstart;
2906 const unsigned char *const_p;
2907 int len, slen_full, slen;
2910 SSL_CTX *tctx = s->initial_ctx;
2911 unsigned char iv[EVP_MAX_IV_LENGTH];
2912 unsigned char key_name[TLSEXT_KEYNAME_LENGTH];
2915 /* get session encoding length */
2916 slen_full = i2d_SSL_SESSION(s->session, NULL);
2918 * Some length values are 16 bits, so forget it if session is too
2921 if (slen_full == 0 || slen_full > 0xFF00) {
2922 ossl_statem_set_error(s);
2925 senc = OPENSSL_malloc(slen_full);
2927 ossl_statem_set_error(s);
2931 ctx = EVP_CIPHER_CTX_new();
2932 hctx = HMAC_CTX_new();
2935 if (!i2d_SSL_SESSION(s->session, &p))
2939 * create a fresh copy (not shared with other threads) to clean up
2942 sess = d2i_SSL_SESSION(NULL, &const_p, slen_full);
2945 sess->session_id_length = 0; /* ID is irrelevant for the ticket */
2947 slen = i2d_SSL_SESSION(sess, NULL);
2948 if (slen == 0 || slen > slen_full) { /* shouldn't ever happen */
2949 SSL_SESSION_free(sess);
2953 if (!i2d_SSL_SESSION(sess, &p)) {
2954 SSL_SESSION_free(sess);
2957 SSL_SESSION_free(sess);
2960 * Grow buffer if need be: the length calculation is as
2961 * follows handshake_header_length +
2962 * 4 (ticket lifetime hint) + 2 (ticket length) +
2963 * sizeof(keyname) + max_iv_len (iv length) +
2964 * max_enc_block_size (max encrypted session * length) +
2965 * max_md_size (HMAC) + session_length.
2967 if (!BUF_MEM_grow(s->init_buf,
2968 SSL_HM_HEADER_LENGTH(s) + 6 + sizeof(key_name) +
2969 EVP_MAX_IV_LENGTH + EVP_MAX_BLOCK_LENGTH +
2970 EVP_MAX_MD_SIZE + slen))
2973 p = ssl_handshake_start(s);
2975 * Initialize HMAC and cipher contexts. If callback present it does
2976 * all the work otherwise use generated values from parent ctx.
2978 if (tctx->tlsext_ticket_key_cb) {
2979 /* if 0 is returned, write an empty ticket */
2980 int ret = tctx->tlsext_ticket_key_cb(s, key_name, iv, ctx,
2984 l2n(0, p); /* timeout */
2985 s2n(0, p); /* length */
2986 if (!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, p - ssl_handshake_start(s)))
2989 EVP_CIPHER_CTX_free(ctx);
2990 HMAC_CTX_free(hctx);
2995 iv_len = EVP_CIPHER_CTX_iv_length(ctx);
2997 const EVP_CIPHER *cipher = EVP_aes_256_cbc();
2999 iv_len = EVP_CIPHER_iv_length(cipher);
3000 if (RAND_bytes(iv, iv_len) <= 0)
3002 if (!EVP_EncryptInit_ex(ctx, cipher, NULL,
3003 tctx->tlsext_tick_aes_key, iv))
3005 if (!HMAC_Init_ex(hctx, tctx->tlsext_tick_hmac_key,
3006 sizeof(tctx->tlsext_tick_hmac_key),
3007 EVP_sha256(), NULL))
3009 memcpy(key_name, tctx->tlsext_tick_key_name,
3010 sizeof(tctx->tlsext_tick_key_name));
3014 * Ticket lifetime hint (advisory only): We leave this unspecified
3015 * for resumed session (for simplicity), and guess that tickets for
3016 * new sessions will live as long as their sessions.
3018 l2n(s->hit ? 0 : s->session->timeout, p);
3020 /* Skip ticket length for now */
3022 /* Output key name */
3024 memcpy(p, key_name, sizeof(key_name));
3025 p += sizeof(key_name);
3027 memcpy(p, iv, iv_len);
3029 /* Encrypt session data */
3030 if (!EVP_EncryptUpdate(ctx, p, &len, senc, slen))
3033 if (!EVP_EncryptFinal(ctx, p, &len))
3037 if (!HMAC_Update(hctx, macstart, p - macstart))
3039 if (!HMAC_Final(hctx, p, &hlen))
3042 EVP_CIPHER_CTX_free(ctx);
3043 HMAC_CTX_free(hctx);
3048 /* Now write out lengths: p points to end of data written */
3050 len = p - ssl_handshake_start(s);
3051 /* Skip ticket lifetime hint */
3052 p = ssl_handshake_start(s) + 4;
3054 if (!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, len))
3061 EVP_CIPHER_CTX_free(ctx);
3062 HMAC_CTX_free(hctx);
3063 ossl_statem_set_error(s);
3067 int tls_construct_cert_status(SSL *s)
3071 * Grow buffer if need be: the length calculation is as
3072 * follows 1 (message type) + 3 (message length) +
3073 * 1 (ocsp response type) + 3 (ocsp response length)
3076 if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen)) {
3077 ossl_statem_set_error(s);
3081 p = (unsigned char *)s->init_buf->data;
3084 *(p++) = SSL3_MT_CERTIFICATE_STATUS;
3085 /* message length */
3086 l2n3(s->tlsext_ocsp_resplen + 4, p);
3088 *(p++) = s->tlsext_status_type;
3089 /* length of OCSP response */
3090 l2n3(s->tlsext_ocsp_resplen, p);
3091 /* actual response */
3092 memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
3093 /* number of bytes to write */
3094 s->init_num = 8 + s->tlsext_ocsp_resplen;
3100 #ifndef OPENSSL_NO_NEXTPROTONEG
3102 * tls_process_next_proto reads a Next Protocol Negotiation handshake message.
3103 * It sets the next_proto member in s if found
3105 MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt)
3107 PACKET next_proto, padding;
3108 size_t next_proto_len;
3111 * The payload looks like:
3113 * uint8 proto[proto_len];
3114 * uint8 padding_len;
3115 * uint8 padding[padding_len];
3117 if (!PACKET_get_length_prefixed_1(pkt, &next_proto)
3118 || !PACKET_get_length_prefixed_1(pkt, &padding)
3119 || PACKET_remaining(pkt) > 0) {
3120 SSLerr(SSL_F_TLS_PROCESS_NEXT_PROTO, SSL_R_LENGTH_MISMATCH);
3124 if (!PACKET_memdup(&next_proto, &s->next_proto_negotiated,
3126 s->next_proto_negotiated_len = 0;
3130 s->next_proto_negotiated_len = (unsigned char)next_proto_len;
3132 return MSG_PROCESS_CONTINUE_READING;
3134 ossl_statem_set_error(s);
3135 return MSG_PROCESS_ERROR;
3139 #define SSLV2_CIPHER_LEN 3
3141 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,
3142 PACKET *cipher_suites,
3143 STACK_OF(SSL_CIPHER) **skp,
3144 int sslv2format, int *al
3147 const SSL_CIPHER *c;
3148 STACK_OF(SSL_CIPHER) *sk;
3150 /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */
3151 unsigned char cipher[SSLV2_CIPHER_LEN];
3153 s->s3->send_connection_binding = 0;
3155 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
3157 if (PACKET_remaining(cipher_suites) == 0) {
3158 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);
3159 *al = SSL_AD_ILLEGAL_PARAMETER;
3163 if (PACKET_remaining(cipher_suites) % n != 0) {
3164 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,
3165 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
3166 *al = SSL_AD_DECODE_ERROR;
3170 if ((skp == NULL) || (*skp == NULL)) {
3171 sk = sk_SSL_CIPHER_new_null(); /* change perhaps later */
3173 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
3174 *al = SSL_AD_INTERNAL_ERROR;
3179 sk_SSL_CIPHER_zero(sk);
3182 if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw,
3183 &s->s3->tmp.ciphers_rawlen)) {
3184 *al = SSL_AD_INTERNAL_ERROR;
3188 while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
3190 * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
3191 * first byte set to zero, while true SSLv2 ciphers have a non-zero
3192 * first byte. We don't support any true SSLv2 ciphers, so skip them.
3194 if (sslv2format && cipher[0] != '\0')
3197 /* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */
3198 if ((cipher[n - 2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
3199 (cipher[n - 1] == (SSL3_CK_SCSV & 0xff))) {
3200 /* SCSV fatal if renegotiating */
3201 if (s->renegotiate) {
3202 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,
3203 SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
3204 *al = SSL_AD_HANDSHAKE_FAILURE;
3207 s->s3->send_connection_binding = 1;
3211 /* Check for TLS_FALLBACK_SCSV */
3212 if ((cipher[n - 2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) &&
3213 (cipher[n - 1] == (SSL3_CK_FALLBACK_SCSV & 0xff))) {
3215 * The SCSV indicates that the client previously tried a higher
3216 * version. Fail if the current version is an unexpected
3219 if (!ssl_check_version_downgrade(s)) {
3220 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,
3221 SSL_R_INAPPROPRIATE_FALLBACK);
3222 *al = SSL_AD_INAPPROPRIATE_FALLBACK;
3228 /* For SSLv2-compat, ignore leading 0-byte. */
3229 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher);
3231 if (!sk_SSL_CIPHER_push(sk, c)) {
3232 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
3233 *al = SSL_AD_INTERNAL_ERROR;
3238 if (PACKET_remaining(cipher_suites) > 0) {
3239 *al = SSL_AD_INTERNAL_ERROR;
3240 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_INTERNAL_ERROR);
3248 if ((skp == NULL) || (*skp == NULL))
3249 sk_SSL_CIPHER_free(sk);