X-Git-Url: https://git.openssl.org/?a=blobdiff_plain;f=ssl%2Fssl_locl.h;h=9913548c8884e7b3ac75e5a0dbd6e721174b5621;hb=6594189fa16e845df5565ca4c180220783a752d4;hp=40bcdd26f24f3132cce288b7d2133b0a7c514059;hpb=90134d9806f0191bc0eb0cde2750f0cd68667a6d;p=openssl.git diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 40bcdd26f2..9913548c88 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -73,8 +73,6 @@ # define OPENSSL_EXTERN OPENSSL_EXPORT # endif -# undef PKCS1_CHECK - # define c2l(c,l) (l = ((unsigned long)(*((c)++))) , \ l|=(((unsigned long)(*((c)++)))<< 8), \ l|=(((unsigned long)(*((c)++)))<<16), \ @@ -175,19 +173,6 @@ # define DTLS_VERSION_LT(v1, v2) (dtls_ver_ordinal(v1) > dtls_ver_ordinal(v2)) # define DTLS_VERSION_LE(v1, v2) (dtls_ver_ordinal(v1) >= dtls_ver_ordinal(v2)) -/* LOCAL STUFF */ - -# define SSL_DECRYPT 0 -# define SSL_ENCRYPT 1 - -# define TWO_BYTE_BIT 0x80 -# define SEC_ESC_BIT 0x40 -# define TWO_BYTE_MASK 0x7fff -# define THREE_BYTE_MASK 0x3fff - -# define INC32(a) ((a)=((a)+1)&0xffffffffL) -# define DEC32(a) ((a)=((a)-1)&0xffffffffL) -# define MAX_MAC_SIZE 20 /* up from 16 for SSLv3 */ /* * Define the Bitmasks for SSL_CIPHER.algorithms. @@ -364,6 +349,10 @@ && (s)->method->version >= TLS1_3_VERSION \ && (s)->method->version != TLS_ANY_VERSION) +# define SSL_TREAT_AS_TLS13(s) \ + (SSL_IS_TLS13(s) || (s)->early_data_state == SSL_EARLY_DATA_WRITING \ + || (s)->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) + # define SSL_IS_FIRST_HANDSHAKE(S) ((s)->s3->tmp.finish_md_len == 0) /* See if we need explicit IV */ @@ -590,6 +579,11 @@ struct ssl_session_st { unsigned long tick_lifetime_hint; uint32_t tick_age_add; int tick_identity; + /* Max number of bytes that can be sent as early data */ + uint32_t max_early_data; + /* The ALPN protocol selected for this session */ + unsigned char *alpn_selected; + size_t alpn_selected_len; } ext; # ifndef OPENSSL_NO_SRP char *srp_username; @@ -622,6 +616,41 @@ typedef struct srp_ctx_st { # endif +typedef enum { + SSL_EARLY_DATA_NONE = 0, + SSL_EARLY_DATA_CONNECT_RETRY, + SSL_EARLY_DATA_CONNECTING, + SSL_EARLY_DATA_WRITE_RETRY, + SSL_EARLY_DATA_WRITING, + SSL_EARLY_DATA_UNAUTH_WRITING, + SSL_EARLY_DATA_FINISHED_WRITING, + SSL_EARLY_DATA_ACCEPT_RETRY, + SSL_EARLY_DATA_ACCEPTING, + SSL_EARLY_DATA_READ_RETRY, + SSL_EARLY_DATA_READING, + SSL_EARLY_DATA_FINISHED_READING +} SSL_EARLY_DATA_STATE; + +/* + * We check that the amount of unreadable early data doesn't exceed + * max_early_data. max_early_data is given in plaintext bytes. However if it is + * unreadable then we only know the number of ciphertext bytes. We also don't + * know how much the overhead should be because it depends on the ciphersuite. + * We make a small allowance. We assume 5 records of actual data plus the end + * of early data alert record. Each record has a tag and a content type byte. + * The longest tag length we know of is EVP_GCM_TLS_TAG_LEN. We don't count the + * content of the alert record either which is 2 bytes. + */ +# define EARLY_DATA_CIPHERTEXT_OVERHEAD ((6 * (EVP_GCM_TLS_TAG_LEN + 1)) + 2) + +/* + * The allowance we have between the client's calculated ticket age and our own. + * We allow for 10 seconds (units are in ms). If a ticket is presented and the + * client's age calculation is different by more than this than our own then we + * do not allow that ticket for early_data. + */ +# define TICKET_AGE_ALLOWANCE (10 * 1000) + #define MAX_COMPRESSIONS_SIZE 255 struct ssl_comp_st { @@ -830,6 +859,10 @@ struct ssl_ctx_st { ENGINE *client_cert_engine; # endif + /* Early callback. Mostly for extensions, but not entirely. */ + SSL_early_cb_fn early_cb; + void *early_cb_arg; + /* TLS extensions. */ struct { /* TLS extensions servername callback */ @@ -933,6 +966,9 @@ struct ssl_ctx_st { * Wireshark. The callback should log `line` followed by a newline. */ SSL_CTX_keylog_cb_func keylog_callback; + + /* The maximum number of bytes that can be sent as early data */ + uint32_t max_early_data; }; struct ssl_st { @@ -982,6 +1018,7 @@ struct ssl_st { int shutdown; /* where we are */ OSSL_STATEM statem; + SSL_EARLY_DATA_STATE early_data_state; BUF_MEM *init_buf; /* buffer used during init */ void *init_msg; /* pointer to handshake message body, set by * ssl3_get_message() */ @@ -1015,6 +1052,7 @@ struct ssl_st { unsigned char client_finished_secret[EVP_MAX_MD_SIZE]; unsigned char server_finished_secret[EVP_MAX_MD_SIZE]; unsigned char server_finished_hash[EVP_MAX_MD_SIZE]; + unsigned char handshake_traffic_hash[EVP_MAX_MD_SIZE]; unsigned char client_app_traffic_secret[EVP_MAX_MD_SIZE]; unsigned char server_app_traffic_secret[EVP_MAX_MD_SIZE]; EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */ @@ -1169,8 +1207,20 @@ struct ssl_st { /* Set to one if we have negotiated ETM */ int use_etm; + + /* Are we expecting to receive early data? */ + int early_data; + /* Is the session suitable for early data? */ + int early_data_ok; + + /* May be sent by a server in HRR. Must be echoed back in ClientHello */ + unsigned char *tls13_cookie; + size_t tls13_cookie_len; } ext; + /* Parsed form of the ClientHello, kept around across early_cb calls. */ + CLIENTHELLO_MSG *clienthello; + /*- * no further mod of servername * 0 : call the servername extension callback. @@ -1226,6 +1276,15 @@ struct ssl_st { ASYNC_WAIT_CTX *waitctx; size_t asyncrw; + /* The maximum number of plaintext bytes that can be sent as early data */ + uint32_t max_early_data; + /* + * The number of bytes of early data received so far. If we accepted early + * data then this is a count of the plaintext bytes. If we rejected it then + * this is a count of the ciphertext bytes. + */ + uint32_t early_data_count; + CRYPTO_RWLOCK *lock; }; @@ -1309,8 +1368,9 @@ typedef struct ssl3_state_st { # endif /* used for certificate requests */ int cert_req; - int ctype_num; - char ctype[SSL3_CT_NUMBER]; + /* Certificate types in certificate request message. */ + uint8_t *ctype; + size_t ctype_len; STACK_OF(X509_NAME) *ca_names; size_t key_block_length; unsigned char *key_block; @@ -1599,13 +1659,9 @@ typedef struct cert_st { /* Flags related to certificates */ uint32_t cert_flags; CERT_PKEY pkeys[SSL_PKEY_NUM]; - /* - * Certificate types (received or sent) in certificate request message. - * On receive this is only set if number of certificate types exceeds - * SSL3_CT_NUMBER. - */ - unsigned char *ctypes; - size_t ctype_num; + /* Custom certificate types sent in certificate request message. */ + uint8_t *ctype; + size_t ctype_len; /* * supported signature algorithms. When set on a client this is sent in * the client hello as the supported signature algorithms extension. For @@ -1749,7 +1805,9 @@ typedef enum tlsext_index_en { TLSEXT_IDX_supported_versions, TLSEXT_IDX_psk_kex_modes, TLSEXT_IDX_key_share, + TLSEXT_IDX_cookie, TLSEXT_IDX_cryptopro_bug, + TLSEXT_IDX_early_data, TLSEXT_IDX_padding, TLSEXT_IDX_psk } TLSEXT_INDEX; @@ -1972,6 +2030,8 @@ static ossl_inline int ssl_has_cert(const SSL *s, int idx) # ifndef OPENSSL_UNIT_TEST +__owur int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes); +__owur int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written); void ssl_clear_cipher_ctx(SSL *s); int ssl_clear_bad_session(SSL *s); __owur CERT *ssl_cert_new(void); @@ -2179,10 +2239,12 @@ __owur int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *label, size_t labellen, const unsigned char *hash, unsigned char *out, size_t outlen); -__owur int tls13_derive_key(SSL *s, const unsigned char *secret, - unsigned char *key, size_t keylen); -__owur int tls13_derive_iv(SSL *s, const unsigned char *secret, - unsigned char *iv, size_t ivlen); +__owur int tls13_derive_key(SSL *s, const EVP_MD *md, + const unsigned char *secret, unsigned char *key, + size_t keylen); +__owur int tls13_derive_iv(SSL *s, const EVP_MD *md, + const unsigned char *secret, unsigned char *iv, + size_t ivlen); __owur int tls13_derive_finishedkey(SSL *s, const EVP_MD *md, const unsigned char *secret, unsigned char *fin, size_t finlen); @@ -2204,7 +2266,6 @@ __owur int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, __owur int tls1_alert_code(int code); __owur int tls13_alert_code(int code); __owur int ssl3_alert_code(int code); -__owur int ssl_ok(SSL *s); # ifndef OPENSSL_NO_EC __owur int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s); @@ -2336,6 +2397,7 @@ __owur int ssl_log_secret(SSL *ssl, const char *label, const uint8_t *secret, size_t secret_len); #define MASTER_SECRET_LABEL "CLIENT_RANDOM" +#define CLIENT_EARLY_LABEL "CLIENT_EARLY_TRAFFIC_SECRET" #define CLIENT_HANDSHAKE_LABEL "CLIENT_HANDSHAKE_TRAFFIC_SECRET" #define SERVER_HANDSHAKE_LABEL "SERVER_HANDSHAKE_TRAFFIC_SECRET" #define CLIENT_APPLICATION_LABEL "CLIENT_TRAFFIC_SECRET_0" @@ -2353,10 +2415,6 @@ __owur int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, const unsigned char *mac_secret, size_t mac_secret_length, char is_sslv3); -__owur int tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx, - EVP_MD_CTX *mac_ctx, const unsigned char *data, - size_t data_len, size_t orig_len); - __owur int srp_generate_server_master_secret(SSL *s); __owur int srp_generate_client_master_secret(SSL *s); __owur int srp_verify_server_param(SSL *s, int *al); @@ -2377,7 +2435,7 @@ void custom_exts_free(custom_ext_methods *exts); void ssl_comp_free_compression_methods_int(void); -# else +# else /* OPENSSL_UNIT_TEST */ # define ssl_init_wbio_buffer SSL_test_functions()->p_ssl_init_wbio_buffer # define ssl3_setup_buffers SSL_test_functions()->p_ssl3_setup_buffers