*/
unsigned long dup_list = 0;
+ if (ngroups == 0) {
+ SSLerr(SSL_F_TLS1_SET_GROUPS, SSL_R_BAD_LENGTH);
+ return 0;
+ }
if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) {
SSLerr(SSL_F_TLS1_SET_GROUPS, ERR_R_MALLOC_FAILURE);
return 0;
TLSEXT_SIGALG_dsa_sha256,
TLSEXT_SIGALG_dsa_sha384,
- TLSEXT_SIGALG_dsa_sha512
+ TLSEXT_SIGALG_dsa_sha512,
+#endif
+#ifndef OPENSSL_NO_GOST
+ TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256,
+ TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512,
+ TLSEXT_SIGALG_gostr34102001_gostr3411,
#endif
};
break;
}
}
+
+ /*
+ * Some GOST ciphersuites allow more than one signature algorithms
+ * */
+ if (idx == SSL_PKEY_GOST01 && s->s3->tmp.new_cipher->algorithm_auth != SSL_aGOST01) {
+ int real_idx;
+
+ for (real_idx = SSL_PKEY_GOST12_512; real_idx >= SSL_PKEY_GOST01;
+ real_idx--) {
+ if (s->cert->pkeys[real_idx].privatekey != NULL) {
+ idx = real_idx;
+ break;
+ }
+ }
+ }
} else {
idx = s->cert->key - s->cert->pkeys;
}
const uint16_t *sent_sigs;
const EVP_MD *md = NULL;
char sigalgstr[2];
- size_t sent_sigslen, i;
+ size_t sent_sigslen, i, cidx;
int pkeyid = EVP_PKEY_id(pkey);
const SIGALG_LOOKUP *lu;
SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
+ /* Check the sigalg is consistent with the key OID */
+ if (!ssl_cert_lookup_by_nid(EVP_PKEY_id(pkey), &cidx)
+ || lu->sig_idx != (int)cidx) {
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS12_CHECK_PEER_SIGALG,
+ SSL_R_WRONG_SIGNATURE_TYPE);
+ return 0;
+ }
+
#ifndef OPENSSL_NO_EC
if (pkeyid == EVP_PKEY_EC) {
s->s3->tmp.mask_k = 0;
ssl_set_sig_mask(&s->s3->tmp.mask_a, s, SSL_SECOP_SIGALG_MASK);
if (ssl_get_min_max_version(s, &s->s3->tmp.min_ver,
- &s->s3->tmp.max_ver) != 0)
+ &s->s3->tmp.max_ver, NULL) != 0)
return 0;
#ifndef OPENSSL_NO_PSK
/* with PSK there must be client callback set */
* hello: The parsed ClientHello data
* ret: (output) on return, if a ticket was decrypted, then this is set to
* point to the resulting session.
- *
- * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
- * ciphersuite, in which case we have no use for session tickets and one will
- * never be decrypted, nor will s->ext.ticket_expected be set to 1.
- *
- * Side effects:
- * Sets s->ext.ticket_expected to 1 if the server will have to issue
- * a new session ticket to the client because the client indicated support
- * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
- * a session ticket or we couldn't use the one it gave us, or if
- * s->ctx->ext.ticket_key_cb asked to renew the client's ticket.
- * Otherwise, s->ext.ticket_expected is set to 0.
*/
-SSL_TICKET_RETURN tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
+SSL_TICKET_STATUS tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
SSL_SESSION **ret)
{
size_t size;
return SSL_TICKET_NONE;
size = PACKET_remaining(&ticketext->data);
- if (size == 0) {
- /*
- * The client will accept a ticket but doesn't currently have
- * one.
- */
- s->ext.ticket_expected = 1;
- return SSL_TICKET_EMPTY;
- }
- if (s->ext.session_secret_cb) {
- /*
- * Indicate that the ticket couldn't be decrypted rather than
- * generating the session from ticket now, trigger
- * abbreviated handshake based on external mechanism to
- * calculate the master secret later.
- */
- return SSL_TICKET_NO_DECRYPT;
- }
return tls_decrypt_ticket(s, PACKET_data(&ticketext->data), size,
hello->session_id, hello->session_id_len, ret);
/*-
* tls_decrypt_ticket attempts to decrypt a session ticket.
*
+ * If s->tls_session_secret_cb is set and we're not doing TLSv1.3 then we are
+ * expecting a pre-shared key ciphersuite, in which case we have no use for
+ * session tickets and one will never be decrypted, nor will
+ * s->ext.ticket_expected be set to 1.
+ *
+ * Side effects:
+ * Sets s->ext.ticket_expected to 1 if the server will have to issue
+ * a new session ticket to the client because the client indicated support
+ * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
+ * a session ticket or we couldn't use the one it gave us, or if
+ * s->ctx->ext.ticket_key_cb asked to renew the client's ticket.
+ * Otherwise, s->ext.ticket_expected is set to 0.
+ *
* etick: points to the body of the session ticket extension.
* eticklen: the length of the session tickets extension.
* sess_id: points at the session ID.
* psess: (output) on return, if a ticket was decrypted, then this is set to
* point to the resulting session.
*/
-SSL_TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick,
+SSL_TICKET_STATUS tls_decrypt_ticket(SSL *s, const unsigned char *etick,
size_t eticklen, const unsigned char *sess_id,
size_t sesslen, SSL_SESSION **psess)
{
- SSL_SESSION *sess;
+ SSL_SESSION *sess = NULL;
unsigned char *sdec;
const unsigned char *p;
int slen, renew_ticket = 0, declen;
- SSL_TICKET_RETURN ret = SSL_TICKET_FATAL_ERR_OTHER;
+ SSL_TICKET_STATUS ret = SSL_TICKET_FATAL_ERR_OTHER;
size_t mlen;
unsigned char tick_hmac[EVP_MAX_MD_SIZE];
HMAC_CTX *hctx = NULL;
EVP_CIPHER_CTX *ctx = NULL;
SSL_CTX *tctx = s->session_ctx;
+ if (eticklen == 0) {
+ /*
+ * The client will accept a ticket but doesn't currently have
+ * one (TLSv1.2 and below), or treated as a fatal error in TLSv1.3
+ */
+ ret = SSL_TICKET_EMPTY;
+ goto end;
+ }
+ if (!SSL_IS_TLS13(s) && s->ext.session_secret_cb) {
+ /*
+ * Indicate that the ticket couldn't be decrypted rather than
+ * generating the session from ticket now, trigger
+ * abbreviated handshake based on external mechanism to
+ * calculate the master secret later.
+ */
+ ret = SSL_TICKET_NO_DECRYPT;
+ goto end;
+ }
+
/* Need at least keyname + iv */
if (eticklen < TLSEXT_KEYNAME_LENGTH + EVP_MAX_IV_LENGTH) {
ret = SSL_TICKET_NO_DECRYPT;
/* Some additional consistency checks */
if (slen != 0) {
SSL_SESSION_free(sess);
+ sess = NULL;
ret = SSL_TICKET_NO_DECRYPT;
goto end;
}
memcpy(sess->session_id, sess_id, sesslen);
sess->session_id_length = sesslen;
}
- *psess = sess;
if (renew_ticket)
ret = SSL_TICKET_SUCCESS_RENEW;
else
HMAC_CTX_free(hctx);
/*
- * If set, the decrypt_ticket_cb() is always called regardless of the
- * return value determined above. The callback is responsible for checking
- * |ret| before it performs any action
+ * If set, the decrypt_ticket_cb() is called unless a fatal error was
+ * detected above. The callback is responsible for checking |ret| before it
+ * performs any action
*/
- if (s->session_ctx->decrypt_ticket_cb != NULL) {
+ if (s->session_ctx->decrypt_ticket_cb != NULL
+ && (ret == SSL_TICKET_EMPTY
+ || ret == SSL_TICKET_NO_DECRYPT
+ || ret == SSL_TICKET_SUCCESS
+ || ret == SSL_TICKET_SUCCESS_RENEW)) {
size_t keyname_len = eticklen;
+ int retcb;
if (keyname_len > TLSEXT_KEYNAME_LENGTH)
keyname_len = TLSEXT_KEYNAME_LENGTH;
- ret = s->session_ctx->decrypt_ticket_cb(s, *psess, etick, keyname_len,
- ret,
- s->session_ctx->ticket_cb_data);
+ retcb = s->session_ctx->decrypt_ticket_cb(s, sess, etick, keyname_len,
+ ret,
+ s->session_ctx->ticket_cb_data);
+ switch (retcb) {
+ case SSL_TICKET_RETURN_ABORT:
+ ret = SSL_TICKET_FATAL_ERR_OTHER;
+ break;
+
+ case SSL_TICKET_RETURN_IGNORE:
+ ret = SSL_TICKET_NONE;
+ SSL_SESSION_free(sess);
+ sess = NULL;
+ break;
+
+ case SSL_TICKET_RETURN_IGNORE_RENEW:
+ if (ret != SSL_TICKET_EMPTY && ret != SSL_TICKET_NO_DECRYPT)
+ ret = SSL_TICKET_NO_DECRYPT;
+ /* else the value of |ret| will already do the right thing */
+ SSL_SESSION_free(sess);
+ sess = NULL;
+ break;
+
+ case SSL_TICKET_RETURN_USE:
+ case SSL_TICKET_RETURN_USE_RENEW:
+ if (ret != SSL_TICKET_SUCCESS
+ && ret != SSL_TICKET_SUCCESS_RENEW)
+ ret = SSL_TICKET_FATAL_ERR_OTHER;
+ else if (retcb == SSL_TICKET_RETURN_USE)
+ ret = SSL_TICKET_SUCCESS;
+ else
+ ret = SSL_TICKET_SUCCESS_RENEW;
+ break;
+
+ default:
+ ret = SSL_TICKET_FATAL_ERR_OTHER;
+ }
}
- switch (ret) {
- case SSL_TICKET_NO_DECRYPT:
- case SSL_TICKET_SUCCESS_RENEW:
- case SSL_TICKET_EMPTY:
- s->ext.ticket_expected = 1;
- /* Fall through */
- case SSL_TICKET_SUCCESS:
- case SSL_TICKET_NONE:
- return ret;
+ if (s->ext.session_secret_cb == NULL || SSL_IS_TLS13(s)) {
+ switch (ret) {
+ case SSL_TICKET_NO_DECRYPT:
+ case SSL_TICKET_SUCCESS_RENEW:
+ case SSL_TICKET_EMPTY:
+ s->ext.ticket_expected = 1;
+ }
}
- return SSL_TICKET_FATAL_ERR_OTHER;
+ *psess = sess;
+
+ return ret;
}
/* Check to see if a signature algorithm is allowed */
|| lu->hash_idx == SSL_MD_MD5_IDX
|| lu->hash_idx == SSL_MD_SHA224_IDX))
return 0;
+
/* See if public key algorithm allowed */
if (ssl_cert_is_disabled(lu->sig_idx))
return 0;
+
+ if (lu->sig == NID_id_GostR3410_2012_256
+ || lu->sig == NID_id_GostR3410_2012_512
+ || lu->sig == NID_id_GostR3410_2001) {
+ /* We never allow GOST sig algs on the server with TLSv1.3 */
+ if (s->server && SSL_IS_TLS13(s))
+ return 0;
+ if (!s->server
+ && s->method->version == TLS_ANY_VERSION
+ && s->s3->tmp.max_ver >= TLS1_3_VERSION) {
+ int i, num;
+ STACK_OF(SSL_CIPHER) *sk;
+
+ /*
+ * We're a client that could negotiate TLSv1.3. We only allow GOST
+ * sig algs if we could negotiate TLSv1.2 or below and we have GOST
+ * ciphersuites enabled.
+ */
+
+ if (s->s3->tmp.min_ver >= TLS1_3_VERSION)
+ return 0;
+
+ sk = SSL_get_ciphers(s);
+ num = sk != NULL ? sk_SSL_CIPHER_num(sk) : 0;
+ for (i = 0; i < num; i++) {
+ const SSL_CIPHER *c;
+
+ c = sk_SSL_CIPHER_value(sk, i);
+ /* Skip disabled ciphers */
+ if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0))
+ continue;
+
+ if ((c->algorithm_mkey & SSL_kGOST) != 0)
+ break;
+ }
+ if (i == num)
+ return 0;
+ }
+ }
+
if (lu->hash == NID_undef)
return 1;
/* Security bits: half digest bits */
if (dhp == NULL)
return NULL;
g = BN_new();
- if (g != NULL)
- BN_set_word(g, 2);
+ if (g == NULL || !BN_set_word(g, 2)) {
+ DH_free(dhp);
+ BN_free(g);
+ return NULL;
+ }
if (dh_secbits >= 192)
p = BN_get_rfc3526_prime_8192(NULL);
else
p = BN_get_rfc3526_prime_3072(NULL);
- if (p == NULL || g == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
+ if (p == NULL || !DH_set0_pqg(dhp, p, NULL, g)) {
DH_free(dhp);
BN_free(p);
BN_free(g);
const SSL_CERT_LOOKUP *clu = ssl_cert_lookup_by_idx(sig_idx);
/* If not recognised or not supported by cipher mask it is not suitable */
- if (clu == NULL || !(clu->amask & s->s3->tmp.new_cipher->algorithm_auth))
+ if (clu == NULL
+ || (clu->amask & s->s3->tmp.new_cipher->algorithm_auth) == 0
+ || (clu->nid == EVP_PKEY_RSA_PSS
+ && (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kRSA) != 0))
return -1;
return s->s3->tmp.valid_flags[sig_idx] & CERT_PKEY_VALID ? sig_idx : -1;
static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
{
const SIGALG_LOOKUP *lu;
- int mdnid, pknid;
+ int mdnid, pknid, supported;
size_t i;
/* TLS 1.2 callers can override lu->sig_idx, but not TLS 1.3 callers. */
lu = tls1_lookup_sigalg(s->s3->tmp.peer_cert_sigalgs[i]);
if (lu == NULL
|| !X509_get_signature_info(s->cert->pkeys[idx].x509, &mdnid,
- &pknid, NULL, NULL))
+ &pknid, NULL, NULL)
+ /*
+ * TODO this does not differentiate between the
+ * rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
+ * have a chain here that lets us look at the key OID in the
+ * signing certificate.
+ */
+ || mdnid != lu->hash
+ || pknid != lu->sig)
continue;
- /*
- * TODO this does not differentiate between the
- * rsa_pss_pss_* and rsa_pss_rsae_* schemes since we do not
- * have a chain here that lets us look at the key OID in the
- * signing certificate.
- */
- if (mdnid == lu->hash && pknid == lu->sig)
- return 1;
+
+ ERR_set_mark();
+ supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
+ mdnid);
+ if (supported == 0)
+ continue;
+ else if (supported < 0)
+ {
+ /* If it didn't report a mandatory NID, for whatever reasons,
+ * just clear the error and allow all hashes to be used. */
+ ERR_pop_to_mark();
+ }
+ return 1;
}
return 0;
}
+ supported = EVP_PKEY_supports_digest_nid(s->cert->pkeys[idx].privatekey,
+ sig->hash);
+ if (supported == 0)
+ return 0;
+ else if (supported < 0)
+ ERR_clear_error();
+
return 1;
}
if (i == s->cert->shared_sigalgslen) {
if (!fatalerrs)
return 1;
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CHOOSE_SIGALG,
- ERR_R_INTERNAL_ERROR);
+ SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
+ SSL_F_TLS_CHOOSE_SIGALG,
+ SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
return 0;
}
} else {
projects / openssl.git / blobdiff