{
int i, al = SSL_AD_INTERNAL_ERROR;
unsigned int j;
- size_t loop, complen = 0;
+ size_t loop;
unsigned long id;
const SSL_CIPHER *c;
#ifndef OPENSSL_NO_COMP
STACK_OF(SSL_CIPHER) *ciphers = NULL;
int protverr;
/* |cookie| will only be initialized for DTLS. */
- PACKET session_id, cipher_suites, compression, extensions, cookie;
- int is_v2_record;
+ PACKET session_id, compression, extensions, cookie;
static const unsigned char null_compression = 0;
+ CLIENTHELLO_MSG clienthello;
- is_v2_record = RECORD_LAYER_is_sslv2_record(&s->rlayer);
-
+ /*
+ * First, parse the raw ClientHello data into the CLIENTHELLO_MSG structure.
+ */
+ memset(&clienthello, 0, sizeof(clienthello));
+ clienthello.isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer);
PACKET_null_init(&cookie);
- /* First lets get s->client_version set correctly */
- if (is_v2_record) {
- unsigned int version;
+
+ if (clienthello.isv2) {
unsigned int mt;
+
/*-
* An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2
* header is sent directly on the wire, not wrapped as a TLS
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
goto err;
}
-
- if (!PACKET_get_net_2(pkt, &version)) {
- /* No protocol version supplied! */
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
- goto err;
- }
- if (version == 0x0002) {
- /* This is real SSLv2. We don't support it. */
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
- goto err;
- } else if ((version & 0xff00) == (SSL3_VERSION_MAJOR << 8)) {
- /* SSLv3/TLS */
- s->client_version = version;
- } else {
- /* No idea what protocol this is */
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
- goto err;
- }
- } else {
- /*
- * use version from inside client hello, not from record header (may
- * differ: see RFC 2246, Appendix E, second paragraph)
- */
- if (!PACKET_get_net_2(pkt, (unsigned int *)&s->client_version)) {
- al = SSL_AD_DECODE_ERROR;
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);
- goto f_err;
- }
- }
-
- /*
- * Do SSL/TLS version negotiation if applicable. For DTLS we just check
- * versions are potentially compatible. Version negotiation comes later.
- */
- if (!SSL_IS_DTLS(s)) {
- protverr = ssl_choose_server_version(s);
- } else if (s->method->version != DTLS_ANY_VERSION &&
- DTLS_VERSION_LT(s->client_version, s->version)) {
- protverr = SSL_R_VERSION_TOO_LOW;
- } else {
- protverr = 0;
}
- if (protverr) {
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
- if ((!s->enc_write_ctx && !s->write_hash)) {
- /*
- * similar to ssl3_get_record, send alert using remote version
- * number
- */
- s->version = s->client_version;
- }
- al = SSL_AD_PROTOCOL_VERSION;
- goto f_err;
+ if (!PACKET_get_net_2(pkt, &clienthello.legacy_version)) {
+ al = SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);
+ goto err;
}
/* Parse the message and load client random. */
- if (is_v2_record) {
+ if (clienthello.isv2) {
/*
* Handle an SSLv2 backwards compatible ClientHello
* Note, this is only for SSLv3+ using the backward compatible format.
- * Real SSLv2 is not supported, and is rejected above.
+ * Real SSLv2 is not supported, and is rejected below.
*/
- unsigned int cipher_len, session_id_len, challenge_len;
+ unsigned int ciphersuite_len, session_id_len, challenge_len;
PACKET challenge;
- if (!PACKET_get_net_2(pkt, &cipher_len)
+ if (!PACKET_get_net_2(pkt, &ciphersuite_len)
|| !PACKET_get_net_2(pkt, &session_id_len)
|| !PACKET_get_net_2(pkt, &challenge_len)) {
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
goto f_err;
}
- if (!PACKET_get_sub_packet(pkt, &cipher_suites, cipher_len)
- || !PACKET_get_sub_packet(pkt, &session_id, session_id_len)
+ if (!PACKET_get_sub_packet(pkt, &clienthello.ciphersuites,
+ ciphersuite_len)
+ || !PACKET_copy_bytes(pkt, clienthello.session_id, session_id_len)
|| !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
/* No extensions. */
|| PACKET_remaining(pkt) != 0) {
al = SSL_AD_DECODE_ERROR;
goto f_err;
}
+ clienthello.session_id_len = session_id_len;
- /* Load the client random and compression list. */
- challenge_len = challenge_len > SSL3_RANDOM_SIZE ? SSL3_RANDOM_SIZE :
- challenge_len;
- memset(s->s3->client_random, 0, SSL3_RANDOM_SIZE);
+ /* Load the client random and compression list. We use SSL3_RANDOM_SIZE
+ * here rather than sizeof(clienthello.random) because that is the limit
+ * for SSLv3 and it is fixed. It won't change even if
+ * sizeof(clienthello.random) does.
+ */
+ challenge_len = challenge_len > SSL3_RANDOM_SIZE
+ ? SSL3_RANDOM_SIZE : challenge_len;
+ memset(clienthello.random, 0, SSL3_RANDOM_SIZE);
if (!PACKET_copy_bytes(&challenge,
- s->s3->client_random + SSL3_RANDOM_SIZE -
+ clienthello.random + SSL3_RANDOM_SIZE -
challenge_len, challenge_len)
/* Advertise only null compression. */
|| !PACKET_buf_init(&compression, &null_compression, 1)) {
goto f_err;
}
- PACKET_null_init(&extensions);
+ PACKET_null_init(&clienthello.extensions);
} else {
/* Regular ClientHello. */
- if (!PACKET_copy_bytes(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)
- || !PACKET_get_length_prefixed_1(pkt, &session_id)) {
- al = SSL_AD_DECODE_ERROR;
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
- goto f_err;
- }
-
- if (PACKET_remaining(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) {
+ if (!PACKET_copy_bytes(pkt, clienthello.random, SSL3_RANDOM_SIZE)
+ || !PACKET_get_length_prefixed_1(pkt, &session_id)
+ || !PACKET_copy_all(&session_id, clienthello.session_id,
+ SSL_MAX_SSL_SESSION_ID_LENGTH,
+ &clienthello.session_id_len)) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
goto f_err;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
goto f_err;
}
+ if (!PACKET_copy_all(&cookie, clienthello.dtls_cookie,
+ DTLS1_COOKIE_LENGTH,
+ &clienthello.dtls_cookie_len)) {
+ al = SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
+ goto f_err;
+ }
/*
* If we require cookies and this ClientHello doesn't contain one,
* just return since we do not want to allocate any memory yet.
* So check cookie length...
*/
if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
- if (PACKET_remaining(&cookie) == 0)
+ if (clienthello.dtls_cookie_len == 0)
return 1;
}
}
- if (!PACKET_get_length_prefixed_2(pkt, &cipher_suites)
- || !PACKET_get_length_prefixed_1(pkt, &compression)) {
+ if (!PACKET_get_length_prefixed_2(pkt, &clienthello.ciphersuites)) {
+ al = SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
+ goto f_err;
+ }
+
+ if (!PACKET_get_length_prefixed_1(pkt, &compression)) {
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
goto f_err;
}
+
/* Could be empty. */
- extensions = *pkt;
+ if (PACKET_remaining(pkt) == 0) {
+ PACKET_null_init(&clienthello.extensions);
+ } else {
+ if (!PACKET_get_length_prefixed_2(pkt, &clienthello.extensions)) {
+ al = SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
+ goto f_err;
+ }
+ }
+ }
+
+ if (!PACKET_copy_all(&compression, clienthello.compressions,
+ MAX_COMPRESSIONS_SIZE,
+ &clienthello.compressions_len)) {
+ al = SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
+ goto f_err;
+ }
+
+ /* Preserve the raw extensions PACKET for later use */
+ extensions = clienthello.extensions;
+ if (!tls_collect_extensions(&extensions, &clienthello.pre_proc_exts,
+ &clienthello.num_extensions, &al)) {
+ /* SSLerr already been called */
+ goto f_err;
+ }
+
+ /* Finished parsing the ClientHello, now we can start processing it */
+
+ /* Set up the client_random */
+ memcpy(s->s3->client_random, clienthello.random, SSL3_RANDOM_SIZE);
+
+ /* Choose the version */
+
+ if (clienthello.isv2) {
+ if (clienthello.legacy_version == SSL2_VERSION
+ || (clienthello.legacy_version & 0xff00)
+ != (SSL3_VERSION_MAJOR << 8)) {
+ /*
+ * This is real SSLv2 or something complete unknown. We don't
+ * support it.
+ */
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
+ goto err;
+ }
+ /* SSLv3/TLS */
+ s->client_version = clienthello.legacy_version;
+ }
+ /*
+ * Do SSL/TLS version negotiation if applicable. For DTLS we just check
+ * versions are potentially compatible. Version negotiation comes later.
+ */
+ if (!SSL_IS_DTLS(s)) {
+ protverr = ssl_choose_server_version(s, &clienthello);
+ } else if (s->method->version != DTLS_ANY_VERSION &&
+ DTLS_VERSION_LT((int)clienthello.legacy_version, s->version)) {
+ protverr = SSL_R_VERSION_TOO_LOW;
+ } else {
+ protverr = 0;
+ }
+
+ if (protverr) {
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
+ if ((!s->enc_write_ctx && !s->write_hash)) {
+ /* like ssl3_get_record, send alert using remote version number */
+ s->version = s->client_version = clienthello.legacy_version;
+ }
+ al = SSL_AD_PROTOCOL_VERSION;
+ goto f_err;
}
if (SSL_IS_DTLS(s)) {
/* Empty cookie was already handled above by returning early. */
if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
if (s->ctx->app_verify_cookie_cb != NULL) {
- if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&cookie),
- (unsigned int)PACKET_remaining(&cookie)) == 0) {
+ if (s->ctx->app_verify_cookie_cb(s, clienthello.dtls_cookie,
+ clienthello.dtls_cookie_len) == 0) {
al = SSL_AD_HANDSHAKE_FAILURE;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
SSL_R_COOKIE_MISMATCH);
/* else cookie verification succeeded */
}
/* default verification */
- } else if (!PACKET_equal(&cookie, s->d1->cookie, s->d1->cookie_len)) {
+ } else if (s->d1->cookie_len != clienthello.dtls_cookie_len
+ || memcmp(clienthello.dtls_cookie, s->d1->cookie,
+ s->d1->cookie_len) != 0) {
al = SSL_AD_HANDSHAKE_FAILURE;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
goto f_err;
s->d1->cookie_verified = 1;
}
if (s->method->version == DTLS_ANY_VERSION) {
- protverr = ssl_choose_server_version(s);
+ protverr = ssl_choose_server_version(s, &clienthello);
if (protverr != 0) {
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, protverr);
s->version = s->client_version;
s->hit = 0;
+ /* We need to do this before getting the session */
+ if (!tls_check_client_ems_support(s, &clienthello)) {
+ /* Only fails if the extension is malformed */
+ al = SSL_AD_DECODE_ERROR;
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
+ goto f_err;
+ }
+
/*
* We don't allow resumption in a backwards compatible ClientHello.
* TODO(openssl-team): in TLS1.1+, session_id MUST be empty.
* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be
* ignored.
*/
- if (is_v2_record ||
+ if (clienthello.isv2 ||
(s->new_session &&
(s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) {
if (!ssl_get_new_session(s, 1))
goto err;
} else {
- i = ssl_get_prev_session(s, &extensions, &session_id);
+ i = ssl_get_prev_session(s, &clienthello);
/*
* Only resume if the session's version matches the negotiated
* version.
}
}
- if (ssl_bytes_to_cipher_list(s, &cipher_suites, &(ciphers),
- is_v2_record, &al) == NULL) {
+ if (ssl_bytes_to_cipher_list(s, &clienthello.ciphersuites, &ciphers,
+ clienthello.isv2, &al) == NULL) {
goto f_err;
}
}
}
- complen = PACKET_remaining(&compression);
- for (loop = 0; loop < complen; loop++) {
- if (PACKET_data(&compression)[loop] == 0)
+ for (loop = 0; loop < clienthello.compressions_len; loop++) {
+ if (clienthello.compressions[loop] == 0)
break;
}
- if (loop >= complen) {
+ if (loop >= clienthello.compressions_len) {
/* no compress */
al = SSL_AD_DECODE_ERROR;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_NO_COMPRESSION_SPECIFIED);
}
/* TLS extensions */
- if (s->version >= SSL3_VERSION) {
- if (!ssl_parse_clienthello_tlsext(s, &extensions)) {
- SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_PARSE_TLSEXT);
- goto err;
- }
+ if (!ssl_parse_clienthello_tlsext(s, &clienthello)) {
+ SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_PARSE_TLSEXT);
+ goto err;
}
/*
goto f_err;
}
/* Look for resumed method in compression list */
- for (k = 0; k < complen; k++) {
- if (PACKET_data(&compression)[k] == comp_id)
+ for (k = 0; k < clienthello.compressions_len; k++) {
+ if (clienthello.compressions[k] == comp_id)
break;
}
- if (k >= complen) {
+ if (k >= clienthello.compressions_len) {
al = SSL_AD_ILLEGAL_PARAMETER;
SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,
SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING);
for (m = 0; m < nn; m++) {
comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
v = comp->id;
- for (o = 0; o < complen; o++) {
- if (v == PACKET_data(&compression)[o]) {
+ for (o = 0; o < clienthello.compressions_len; o++) {
+ if (v == clienthello.compressions[o]) {
done = 1;
break;
}
}
sk_SSL_CIPHER_free(ciphers);
+ OPENSSL_free(clienthello.pre_proc_exts);
return MSG_PROCESS_CONTINUE_PROCESSING;
f_err:
ssl3_send_alert(s, SSL3_AL_FATAL, al);
ossl_statem_set_error(s);
sk_SSL_CIPHER_free(ciphers);
- return MSG_PROCESS_ERROR;
+ OPENSSL_free(clienthello.pre_proc_exts);
+ return MSG_PROCESS_ERROR;
}
WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst)
projects / openssl.git / blobdiff