#endif /* OPENSSL_NO_EC */
/* Default sigalg schemes */
-static const unsigned int tls12_sigalgs[] = {
+static const uint16_t tls12_sigalgs[] = {
#ifndef OPENSSL_NO_EC
TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
TLSEXT_SIGALG_ecdsa_secp384r1_sha384,
};
#ifndef OPENSSL_NO_EC
-static const unsigned int suiteb_sigalgs[] = {
+static const uint16_t suiteb_sigalgs[] = {
TLSEXT_SIGALG_ecdsa_secp256r1_sha256,
TLSEXT_SIGALG_ecdsa_secp384r1_sha384
};
#endif
typedef struct sigalg_lookup_st {
- unsigned int sigalg;
+ uint16_t sigalg;
int hash;
int sig;
} SIGALG_LOOKUP;
{TLSEXT_SIGALG_ecdsa_secp521r1_sha512, NID_sha512, EVP_PKEY_EC},
{TLSEXT_SIGALG_ecdsa_sha1, NID_sha1, EVP_PKEY_EC},
#endif
- /*
- * PSS must appear before PKCS1 so that we prefer that when signing where
- * possible
- */
- {TLSEXT_SIGALG_rsa_pss_sha256, NID_sha256, EVP_PKEY_RSA},
- {TLSEXT_SIGALG_rsa_pss_sha384, NID_sha384, EVP_PKEY_RSA},
- {TLSEXT_SIGALG_rsa_pss_sha512, NID_sha512, EVP_PKEY_RSA},
+ {TLSEXT_SIGALG_rsa_pss_sha256, NID_sha256, EVP_PKEY_RSA_PSS},
+ {TLSEXT_SIGALG_rsa_pss_sha384, NID_sha384, EVP_PKEY_RSA_PSS},
+ {TLSEXT_SIGALG_rsa_pss_sha512, NID_sha512, EVP_PKEY_RSA_PSS},
{TLSEXT_SIGALG_rsa_pkcs1_sha256, NID_sha256, EVP_PKEY_RSA},
{TLSEXT_SIGALG_rsa_pkcs1_sha384, NID_sha384, EVP_PKEY_RSA},
{TLSEXT_SIGALG_rsa_pkcs1_sha512, NID_sha512, EVP_PKEY_RSA},
#endif
};
-static int tls_sigalg_get_hash(unsigned int sigalg)
+static int tls_sigalg_get_hash(uint16_t sigalg)
{
size_t i;
const SIGALG_LOOKUP *curr;
return 0;
}
-static int tls_sigalg_get_sig(unsigned int sigalg)
+static int tls_sigalg_get_sig(uint16_t sigalg)
{
size_t i;
const SIGALG_LOOKUP *curr;
return 0;
}
-size_t tls12_get_psigalgs(SSL *s, int sent, const unsigned int **psigs)
+
+size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs)
{
/*
* If Suite B mode use Suite B sigalgs only, ignore any other
/*
* Check signature algorithm is consistent with sent supported signature
- * algorithms and if so return relevant digest.
+ * algorithms and if so set relevant digest and signature scheme in
+ * s.
*/
-int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s, unsigned int sig,
- EVP_PKEY *pkey)
+int tls12_check_peer_sigalg(SSL *s, unsigned int sig, EVP_PKEY *pkey)
{
- const unsigned int *sent_sigs;
+ const uint16_t *sent_sigs;
+ const EVP_MD *md = NULL;
char sigalgstr[2];
size_t sent_sigslen, i;
int pkeyid = EVP_PKEY_id(pkey);
+ int peer_sigtype;
/* Should never happen */
if (pkeyid == -1)
return -1;
/* Check key type is consistent with signature */
- if (pkeyid != tls_sigalg_get_sig(sig)) {
+ peer_sigtype = tls_sigalg_get_sig(sig);
+ /* RSA keys can be used for RSA-PSS */
+ if (pkeyid != peer_sigtype
+ && (peer_sigtype != EVP_PKEY_RSA_PSS || pkeyid != EVP_PKEY_RSA)) {
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
- *pmd = tls12_get_hash(tls_sigalg_get_hash(sig));
- if (*pmd == NULL) {
+ md = tls12_get_hash(tls_sigalg_get_hash(sig));
+ if (md == NULL) {
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_UNKNOWN_DIGEST);
return 0;
}
sigalgstr[0] = (sig >> 8) & 0xff;
sigalgstr[1] = sig & 0xff;
if (!ssl_security(s, SSL_SECOP_SIGALG_CHECK,
- EVP_MD_size(*pmd) * 4, EVP_MD_type(*pmd),
+ EVP_MD_size(md) * 4, EVP_MD_type(md),
(void *)sigalgstr)) {
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
/*
* Store the digest used so applications can retrieve it if they wish.
*/
- s->s3->tmp.peer_md = *pmd;
+ s->s3->tmp.peer_md = md;
+ s->s3->tmp.peer_sigtype = peer_sigtype;
+ return 1;
+}
+
+int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid)
+{
+ if (s->s3->tmp.peer_sigtype == NID_undef)
+ return 0;
+ *pnid = s->s3->tmp.peer_sigtype;
return 1;
}
retv = tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size,
hello->session_id, hello->session_id_len, ret);
switch (retv) {
- case TICKET_NO_DECRYPT: /* ticket couldn't be decrypted */
+ case TICKET_NO_DECRYPT:
s->ext.ticket_expected = 1;
return TICKET_NO_DECRYPT;
- case TICKET_SUCCESS: /* ticket was decrypted */
+ case TICKET_SUCCESS:
return TICKET_SUCCESS;
- case TICKET_SUCCESS_RENEW: /* ticket decrypted but need to renew */
+ case TICKET_SUCCESS_RENEW:
s->ext.ticket_expected = 1;
return TICKET_SUCCESS;
- default: /* fatal error */
+ default:
return TICKET_FATAL_ERR_OTHER;
}
}
* sesslen: the length of the session ID.
* psess: (output) on return, if a ticket was decrypted, then this is set to
* point to the resulting session.
- *
- * Returns:
- * TICKET_FATAL_ERR_MALLOC: fatal error, malloc failure.
- * TICKET_FATAL_ERR_OTHER: fatal error, either from parsing or decrypting the
- * ticket.
- * TICKET_NO_DECRYPT: the ticket couldn't be decrypted.
- * TICKET_SUCCESS: a ticket was successfully decrypted and *psess was
- * set.
- * TICKET_SUCCESS_RENEW: same as 3, but the ticket needs to be renewed
*/
TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
size_t eticklen, const unsigned char *sess_id,
int tls12_get_sigandhash(SSL *s, WPACKET *pkt, const EVP_PKEY *pk,
const EVP_MD *md, int *ispss)
{
- int md_id, sig_id, tmpispss = 0;
+ int md_id, sig_id;
size_t i;
const SIGALG_LOOKUP *curr;
sig_id = EVP_PKEY_id(pk);
if (md_id == NID_undef)
return 0;
+ /* For TLS 1.3 only allow RSA-PSS */
+ if (SSL_IS_TLS13(s) && sig_id == EVP_PKEY_RSA)
+ sig_id = EVP_PKEY_RSA_PSS;
for (i = 0, curr = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl);
i++, curr++) {
- if (curr->hash == md_id && curr->sig == sig_id) {
- if (sig_id == EVP_PKEY_RSA) {
- tmpispss = SIGID_IS_PSS(curr->sigalg);
- if (!SSL_IS_TLS13(s) && tmpispss) {
- size_t j;
-
- /*
- * Check peer actually sent a PSS sig id - it could have
- * been a PKCS1 sig id instead.
- */
- for (j = 0; j < s->cert->shared_sigalgslen; j++)
- if (s->cert->shared_sigalgs[j].rsigalg == curr->sigalg)
- break;
-
- if (j == s->cert->shared_sigalgslen)
- continue;
- }
- }
+ /* If key type is RSA also match PSS signature type */
+ if (curr->hash == md_id && (curr->sig == sig_id
+ || (sig_id == EVP_PKEY_RSA && curr->sig == EVP_PKEY_RSA_PSS))) {
if (!WPACKET_put_bytes_u16(pkt, curr->sigalg))
return 0;
- *ispss = tmpispss;
+ *ispss = curr->sig == EVP_PKEY_RSA_PSS;
return 1;
}
}
#ifndef OPENSSL_NO_RSA
case EVP_PKEY_RSA:
return SSL_PKEY_RSA_SIGN;
+ /*
+ * For now return RSA key for PSS. When we support PSS only keys
+ * this will need to be updated.
+ */
+ case EVP_PKEY_RSA_PSS:
+ return SSL_PKEY_RSA_SIGN;
#endif
#ifndef OPENSSL_NO_DSA
case EVP_PKEY_DSA:
/* Convert TLS 1.2 signature algorithm extension values into NIDs */
static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
- int *psignhash_nid, unsigned int data)
+ int *psignhash_nid, uint16_t data)
{
int sign_nid = NID_undef, hash_nid = NID_undef;
if (!phash_nid && !psign_nid && !psignhash_nid)
void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op)
{
- const unsigned int *sigalgs;
+ const uint16_t *sigalgs;
size_t i, sigalgslen;
int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
/*
for (i = 0; i < sigalgslen; i ++, sigalgs++) {
switch (tls_sigalg_get_sig(*sigalgs)) {
#ifndef OPENSSL_NO_RSA
+ /* Any RSA-PSS signature algorithms also mean we allow RSA */
+ case EVP_PKEY_RSA_PSS:
case EVP_PKEY_RSA:
if (!have_rsa && tls12_sigalg_allowed(s, op, *sigalgs))
have_rsa = 1;
}
int tls12_copy_sigalgs(SSL *s, WPACKET *pkt,
- const unsigned int *psig, size_t psiglen)
+ const uint16_t *psig, size_t psiglen)
{
size_t i;
/* Given preference and allowed sigalgs set shared sigalgs */
static size_t tls12_shared_sigalgs(SSL *s, TLS_SIGALGS *shsig,
- const unsigned int *pref, size_t preflen,
- const unsigned int *allow, size_t allowlen)
+ const uint16_t *pref, size_t preflen,
+ const uint16_t *allow, size_t allowlen)
{
- const unsigned int *ptmp, *atmp;
+ const uint16_t *ptmp, *atmp;
size_t i, j, nmatch = 0;
for (i = 0, ptmp = pref; i < preflen; i++, ptmp++) {
/* Skip disabled hashes or signature algorithms */
/* Set shared signature algorithms for SSL structures */
static int tls1_set_shared_sigalgs(SSL *s)
{
- const unsigned int *pref, *allow, *conf;
+ const uint16_t *pref, *allow, *conf;
size_t preflen, allowlen, conflen;
size_t nmatch;
TLS_SIGALGS *salgs = NULL;
int tls1_save_sigalgs(SSL *s, PACKET *pkt)
{
CERT *c = s->cert;
+ unsigned int stmp;
size_t size, i;
/* Extension ignored for inappropriate versions */
if (s->s3->tmp.peer_sigalgs == NULL)
return 0;
s->s3->tmp.peer_sigalgslen = size;
- for (i = 0; i < size && PACKET_get_net_2(pkt, &s->s3->tmp.peer_sigalgs[i]);
- i++)
- continue;
+ for (i = 0; i < size && PACKET_get_net_2(pkt, &stmp); i++)
+ s->s3->tmp.peer_sigalgs[i] = stmp;
if (i != size)
return 0;
for (i = 0, sigptr = c->shared_sigalgs;
i < c->shared_sigalgslen; i++, sigptr++) {
/* Ignore PKCS1 based sig algs in TLSv1.3 */
- if (SSL_IS_TLS13(s)
- && (sigptr->rsigalg == TLSEXT_SIGALG_rsa_pkcs1_sha1
- || sigptr->rsigalg == TLSEXT_SIGALG_rsa_pkcs1_sha256
- || sigptr->rsigalg == TLSEXT_SIGALG_rsa_pkcs1_sha384
- || sigptr->rsigalg == TLSEXT_SIGALG_rsa_pkcs1_sha512))
+ if (SSL_IS_TLS13(s) && sigptr->sign_nid == EVP_PKEY_RSA)
continue;
idx = tls12_get_pkey_idx(sigptr->sign_nid);
if (idx > 0 && pmd[idx] == NULL) {
int *psign, int *phash, int *psignhash,
unsigned char *rsig, unsigned char *rhash)
{
- unsigned int *psig = s->s3->tmp.peer_sigalgs;
+ uint16_t *psig = s->s3->tmp.peer_sigalgs;
size_t numsigalgs = s->s3->tmp.peer_sigalgslen;
if (psig == NULL || numsigalgs > INT_MAX)
return 0;
{
if (strcmp(str, "RSA") == 0) {
*psig = EVP_PKEY_RSA;
+ } else if (strcmp(str, "RSA-PSS") == 0 || strcmp(str, "PSS") == 0) {
+ *psig = EVP_PKEY_RSA_PSS;
} else if (strcmp(str, "DSA") == 0) {
*psig = EVP_PKEY_DSA;
} else if (strcmp(str, "ECDSA") == 0) {
return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
}
-/* TODO(TLS1.3): Needs updating to allow setting of TLS1.3 sig algs */
int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
{
- unsigned int *sigalgs, *sptr;
+ uint16_t *sigalgs, *sptr;
size_t i;
if (salglen & 1)
sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
if (sigalgs == NULL)
return 0;
- /*
- * TODO(TLS1.3): Somehow we need to be able to set RSA-PSS as well as
- * RSA-PKCS1. For now we only allow setting of RSA-PKCS1
- */
for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
size_t j;
const SIGALG_LOOKUP *curr;
for (j = 0, curr = sigalg_lookup_tbl; j < OSSL_NELEM(sigalg_lookup_tbl);
j++, curr++) {
- /* Skip setting PSS so we get PKCS1 by default */
- if (SIGID_IS_PSS(curr->sigalg))
- continue;
if (curr->hash == md_id && curr->sig == sig_id) {
*sptr++ = curr->sigalg;
break;
*/
if (default_nid > 0 && c->conf_sigalgs) {
size_t j;
- const unsigned int *p = c->conf_sigalgs;
+ const uint16_t *p = c->conf_sigalgs;
for (j = 0; j < c->conf_sigalgslen; j++, p++) {
if (tls_sigalg_get_hash(*p) == NID_sha1
&& tls_sigalg_get_sig(*p) == rsign)
projects / openssl.git / blobdiff