X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=ssl%2Ft1_lib.c;h=6363348d54b4e7fedbfea0ae2e74fb1dbe4df13d;hp=3aa01db7e57e20c0f503c989acaa60639f2afe53;hb=f7aa318552c4ef62d902c480b59bd7c4513c0009;hpb=062178678f5374b09f00d70796f6e692e8775aca diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 3aa01db7e5..6363348d54 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -114,12 +114,13 @@ #include #include #include +#include +#include #include -#ifndef OPENSSL_NO_DH -# include -# include -#endif +#include +#include #include "ssl_locl.h" +#include static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen, const unsigned char *sess_id, int sesslen, @@ -230,10 +231,9 @@ typedef struct { /* * Table of curve information. - * NB: do not delete entries or reorder this array. It is used as a lookup + * Do not delete entries or reorder this array! It is used as a lookup * table: the index of each entry is one less than the TLS curve id. */ - static const tls_curve_info nid_list[] = { {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */ {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */ @@ -276,46 +276,31 @@ static const unsigned char ecformats_default[] = { /* The default curves */ static const unsigned char eccurves_default[] = { 0, 29, /* X25519 (29) */ - /* Prefer P-256 which has the fastest and most secure implementations. */ 0, 23, /* secp256r1 (23) */ - /* Other >= 256-bit prime curves. */ 0, 25, /* secp521r1 (25) */ - 0, 28, /* brainpool512r1 (28) */ - 0, 27, /* brainpoolP384r1 (27) */ 0, 24, /* secp384r1 (24) */ - 0, 26, /* brainpoolP256r1 (26) */ - 0, 22, /* secp256k1 (22) */ - /* >= 256-bit binary curves. */ - 0, 14, /* sect571r1 (14) */ - 0, 13, /* sect571k1 (13) */ - 0, 11, /* sect409k1 (11) */ - 0, 12, /* sect409r1 (12) */ - 0, 9, /* sect283k1 (9) */ - 0, 10, /* sect283r1 (10) */ }; static const unsigned char eccurves_all[] = { 0, 29, /* X25519 (29) */ - /* Prefer P-256 which has the fastest and most secure implementations. */ 0, 23, /* secp256r1 (23) */ - /* Other >= 256-bit prime curves. */ 0, 25, /* secp521r1 (25) */ - 0, 28, /* brainpool512r1 (28) */ - 0, 27, /* brainpoolP384r1 (27) */ 0, 24, /* secp384r1 (24) */ 0, 26, /* brainpoolP256r1 (26) */ + 0, 27, /* brainpoolP384r1 (27) */ + 0, 28, /* brainpool512r1 (28) */ + + /* + * Remaining curves disabled by default but still permitted if set + * via an explicit callback or parameters. + */ 0, 22, /* secp256k1 (22) */ - /* >= 256-bit binary curves. */ 0, 14, /* sect571r1 (14) */ 0, 13, /* sect571k1 (13) */ 0, 11, /* sect409k1 (11) */ 0, 12, /* sect409r1 (12) */ 0, 9, /* sect283k1 (9) */ 0, 10, /* sect283r1 (10) */ - /* - * Remaining curves disabled by default but still permitted if set - * via an explicit callback or parameters. - */ 0, 20, /* secp224k1 (20) */ 0, 21, /* secp224r1 (21) */ 0, 18, /* secp192k1 (18) */ @@ -784,7 +769,7 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md) # ifndef OPENSSL_NO_EC /* - * tls1_check_ec_tmp_key - Check EC temporary key compatiblity + * tls1_check_ec_tmp_key - Check EC temporary key compatibility * @s: SSL connection * @cid: Cipher ID we're considering using * @@ -995,24 +980,21 @@ int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s, } /* - * Get a mask of disabled algorithms: an algorithm is disabled if it isn't - * supported or doesn't appear in supported signature algorithms. Unlike - * ssl_cipher_get_disabled this applies to a specific session and not global - * settings. + * Set a mask of disabled algorithms: an algorithm is disabled if it isn't + * supported, doesn't appear in supported signature algorithms, isn't supported + * by the enabled protocol versions or by the security level. + * + * This function should only be used for checking which ciphers are supported + * by the client. + * + * Call ssl_cipher_disabled() to check that it's enabled or not. */ void ssl_set_client_disabled(SSL *s) { s->s3->tmp.mask_a = 0; s->s3->tmp.mask_k = 0; - /* Don't allow TLS 1.2 only ciphers if we don't suppport them */ - if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s)) - s->s3->tmp.mask_ssl = SSL_TLSV1_2; - else - s->s3->tmp.mask_ssl = 0; - /* Disable TLS 1.0 ciphers if using SSL v3 */ - if (s->client_version == SSL3_VERSION) - s->s3->tmp.mask_ssl |= SSL_TLSV1; ssl_set_sig_mask(&s->s3->tmp.mask_a, s, SSL_SECOP_SIGALG_MASK); + ssl_get_client_min_max_version(s, &s->s3->tmp.min_ver, &s->s3->tmp.max_ver); # ifndef OPENSSL_NO_PSK /* with PSK there must be client callback set */ if (!s->psk_client_callback) { @@ -1028,12 +1010,28 @@ void ssl_set_client_disabled(SSL *s) #endif } +/* + * ssl_cipher_disabled - check that a cipher is disabled or not + * @s: SSL connection that you want to use the cipher on + * @c: cipher to check + * @op: Security check that you want to do + * + * Returns 1 when it's disabled, 0 when enabled. + */ int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op) { - if (c->algorithm_ssl & s->s3->tmp.mask_ssl - || c->algorithm_mkey & s->s3->tmp.mask_k + if (c->algorithm_mkey & s->s3->tmp.mask_k || c->algorithm_auth & s->s3->tmp.mask_a) return 1; + if (s->s3->tmp.max_ver == 0) + return 1; + if (!SSL_IS_DTLS(s) && ((c->min_tls > s->s3->tmp.max_ver) + || (c->max_tls < s->s3->tmp.min_ver))) + return 1; + if (SSL_IS_DTLS(s) && (DTLS_VERSION_GT(c->min_dtls, s->s3->tmp.max_ver) + || DTLS_VERSION_LT(c->max_dtls, s->s3->tmp.min_ver))) + return 1; + return !ssl_security(s, op, c->strength_bits, 0, (void *)c); } @@ -1183,7 +1181,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, /*- * check for enough space. - * 4 for the servername type and entension length + * 4 for the servername type and extension length * 2 for servernamelist length * 1 for the hostname type * 2 for hostname length @@ -1221,7 +1219,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, /*- * check for enough space. - * 4 for the srp type type and entension length + * 4 for the srp type type and extension length * 1 for the srp user identity * + srp user identity length */ @@ -1333,7 +1331,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, } skip_ext: - if (SSL_USE_SIGALGS(s)) { + if (SSL_CLIENT_USE_SIGALGS(s)) { size_t salglen; const unsigned char *salg; unsigned char *etmp; @@ -1351,6 +1349,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, ret += salglen; } +#ifndef OPENSSL_NO_OCSP if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) { int i; long extlen, idlen, itmp; @@ -1394,6 +1393,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, if (extlen > 0) i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret); } +#endif #ifndef OPENSSL_NO_HEARTBEATS if (SSL_IS_DTLS(s)) { /* Add Heartbeat extension */ @@ -1416,7 +1416,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, #ifndef OPENSSL_NO_NEXTPROTONEG if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) { /* - * The client advertises an emtpy extension to indicate its support + * The client advertises an empty extension to indicate its support * for Next Protocol Negotiation */ if (limit - ret - 4 < 0) @@ -1426,6 +1426,11 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, } #endif + /* + * finish_md_len is non-zero during a renegotiation, so + * this avoids sending ALPN during the renegotiation + * (see longer comment below) + */ if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len) { if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len) return NULL; @@ -1434,6 +1439,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, s2n(s->alpn_client_proto_list_len, ret); memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len); ret += s->alpn_client_proto_list_len; + s->s3->alpn_sent = 1; } #ifndef OPENSSL_NO_SRTP if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) { @@ -1465,6 +1471,12 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, #ifdef TLSEXT_TYPE_encrypt_then_mac s2n(TLSEXT_TYPE_encrypt_then_mac, ret); s2n(0, ret); +#endif +#ifndef OPENSSL_NO_CT + if (s->ct_validation_callback != NULL) { + s2n(TLSEXT_TYPE_signed_certificate_timestamp, ret); + s2n(0, ret); + } #endif s2n(TLSEXT_TYPE_extended_master_secret, ret); s2n(0, ret); @@ -1708,9 +1720,9 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, s2n(0, ret); } - if (s->s3->alpn_selected) { + if (s->s3->alpn_selected != NULL) { const unsigned char *selected = s->s3->alpn_selected; - unsigned len = s->s3->alpn_selected_len; + unsigned int len = s->s3->alpn_selected_len; if ((long)(limit - ret - 4 - 2 - 1 - len) < 0) return NULL; @@ -1732,16 +1744,13 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, } /* - * Process the ALPN extension in a ClientHello. + * Save the ALPN extension in a ClientHello. * pkt: the contents of the ALPN extension, not including type and length. * al: a pointer to the alert value to send in the event of a failure. * returns: 1 on success, 0 on error. */ static int tls1_alpn_handle_client_hello(SSL *s, PACKET *pkt, int *al) { - const unsigned char *selected; - unsigned char selected_len; - int r; PACKET protocol_list, save_protocol_list, protocol; *al = SSL_AD_DECODE_ERROR; @@ -1760,25 +1769,51 @@ static int tls1_alpn_handle_client_hello(SSL *s, PACKET *pkt, int *al) } } while (PACKET_remaining(&protocol_list) != 0); - if (s->ctx->alpn_select_cb == NULL) - return 1; + if (!PACKET_memdup(&save_protocol_list, + &s->s3->alpn_proposed, + &s->s3->alpn_proposed_len)) { + *al = TLS1_AD_INTERNAL_ERROR; + return 0; + } - r = s->ctx->alpn_select_cb(s, &selected, &selected_len, - PACKET_data(&save_protocol_list), - PACKET_remaining(&save_protocol_list), - s->ctx->alpn_select_cb_arg); - if (r == SSL_TLSEXT_ERR_OK) { - OPENSSL_free(s->s3->alpn_selected); - s->s3->alpn_selected = OPENSSL_malloc(selected_len); - if (s->s3->alpn_selected == NULL) { - *al = SSL_AD_INTERNAL_ERROR; + return 1; +} + +/* + * Process the ALPN extension in a ClientHello. + * ret: a pointer to the TLSEXT return value: SSL_TLSEXT_ERR_* + * al: a pointer to the alert value to send in the event of a failure. + * returns 1 on success, 0 + */ +static int tls1_alpn_handle_client_hello_late(SSL *s, int *ret, int *al) +{ + const unsigned char *selected = NULL; + unsigned char selected_len = 0; + + if (s->ctx->alpn_select_cb != NULL && s->s3->alpn_proposed != NULL) { + int r = s->ctx->alpn_select_cb(s, &selected, &selected_len, + s->s3->alpn_proposed, + s->s3->alpn_proposed_len, + s->ctx->alpn_select_cb_arg); + + if (r == SSL_TLSEXT_ERR_OK) { + OPENSSL_free(s->s3->alpn_selected); + s->s3->alpn_selected = OPENSSL_memdup(selected, selected_len); + if (s->s3->alpn_selected == NULL) { + *al = SSL_AD_INTERNAL_ERROR; + *ret = SSL_TLSEXT_ERR_ALERT_FATAL; + return 0; + } + s->s3->alpn_selected_len = selected_len; +#ifndef OPENSSL_NO_NEXTPROTONEG + /* ALPN takes precedence over NPN. */ + s->s3->next_proto_neg_seen = 0; +#endif + } else { + *al = SSL_AD_NO_APPLICATION_PROTOCOL; + *ret = SSL_TLSEXT_ERR_ALERT_FATAL; return 0; } - memcpy(s->s3->alpn_selected, selected, selected_len); - s->s3->alpn_selected_len = selected_len; - } else { - *al = SSL_AD_NO_APPLICATION_PROTOCOL; - return 0; } return 1; @@ -1875,6 +1910,10 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al) OPENSSL_free(s->s3->alpn_selected); s->s3->alpn_selected = NULL; + s->s3->alpn_selected_len = 0; + OPENSSL_free(s->s3->alpn_proposed); + s->s3->alpn_proposed = NULL; + s->s3->alpn_proposed_len = 0; #ifndef OPENSSL_NO_HEARTBEATS s->tlsext_heartbeat &= ~(SSL_DTLSEXT_HB_ENABLED | SSL_DTLSEXT_HB_DONT_SEND_REQUESTS); @@ -1967,7 +2006,7 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al) /* * Although the server_name extension was intended to be * extensible to new name types, RFC 4366 defined the - * syntax inextensibly and OpenSSL 1.0.x parses it as + * syntax inextensibility and OpenSSL 1.0.x parses it as * such. * RFC 6066 corrected the mistake but adding new name types * is nevertheless no longer feasible, so act as if no other @@ -2093,14 +2132,14 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al) } } } else if (type == TLSEXT_TYPE_status_request) { - const unsigned char *ext_data; - if (!PACKET_get_1(&extension, (unsigned int *)&s->tlsext_status_type)) { return 0; } +#ifndef OPENSSL_NO_OCSP if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) { + const unsigned char *ext_data; PACKET responder_id_list, exts; if (!PACKET_get_length_prefixed_2(&extension, &responder_id_list)) return 0; @@ -2157,10 +2196,12 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al) return 0; } } - /* - * We don't know what to do with any other type * so ignore it. - */ - } else { + } else +#endif + { + /* + * We don't know what to do with any other type so ignore it. + */ s->tlsext_status_type = -1; } } @@ -2189,15 +2230,14 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al) #endif #ifndef OPENSSL_NO_NEXTPROTONEG else if (type == TLSEXT_TYPE_next_proto_neg && - s->s3->tmp.finish_md_len == 0 && - s->s3->alpn_selected == NULL) { + s->s3->tmp.finish_md_len == 0) { /*- * We shouldn't accept this extension on a * renegotiation. * * s->new_session will be set on renegotiation, but we * probably shouldn't rely that it couldn't be set on - * the initial renegotation too in certain cases (when + * the initial renegotiation too in certain cases (when * there's some other reason to disallow resuming an * earlier session -- the current code won't be doing * anything like that, but this might change). @@ -2216,10 +2256,6 @@ static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al) s->s3->tmp.finish_md_len == 0) { if (!tls1_alpn_handle_client_hello(s, &extension, al)) return 0; -#ifndef OPENSSL_NO_NEXTPROTONEG - /* ALPN takes precedence over NPN. */ - s->s3->next_proto_neg_seen = 0; -#endif } /* session ticket processed earlier */ @@ -2430,6 +2466,30 @@ static int ssl_scan_serverhello_tlsext(SSL *s, PACKET *pkt, int *al) /* Set flag to expect CertificateStatus message */ s->tlsext_status_expected = 1; } +#ifndef OPENSSL_NO_CT + /* + * Only take it if we asked for it - i.e if there is no CT validation + * callback set, then a custom extension MAY be processing it, so we + * need to let control continue to flow to that. + */ + else if (type == TLSEXT_TYPE_signed_certificate_timestamp && + s->ct_validation_callback != NULL) { + /* Simply copy it off for later processing */ + if (s->tlsext_scts != NULL) { + OPENSSL_free(s->tlsext_scts); + s->tlsext_scts = NULL; + } + s->tlsext_scts_len = size; + if (size > 0) { + s->tlsext_scts = OPENSSL_malloc(size); + if (s->tlsext_scts == NULL) { + *al = TLS1_AD_INTERNAL_ERROR; + return 0; + } + memcpy(s->tlsext_scts, data, size); + } + } +#endif #ifndef OPENSSL_NO_NEXTPROTONEG else if (type == TLSEXT_TYPE_next_proto_neg && s->s3->tmp.finish_md_len == 0) { @@ -2467,7 +2527,7 @@ static int ssl_scan_serverhello_tlsext(SSL *s, PACKET *pkt, int *al) else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation) { unsigned len; /* We must have requested it. */ - if (s->alpn_client_proto_list == NULL) { + if (!s->s3->alpn_sent) { *al = TLS1_AD_UNSUPPORTED_EXTENSION; return 0; } @@ -2600,7 +2660,7 @@ static int ssl_scan_serverhello_tlsext(SSL *s, PACKET *pkt, int *al) int ssl_prepare_clienthello_tlsext(SSL *s) { - + s->s3->alpn_sent = 0; return 1; } @@ -2679,7 +2739,8 @@ int tls1_set_server_sigalgs(SSL *s) { int al; size_t i; - /* Clear any shared sigtnature algorithms */ + + /* Clear any shared signature algorithms */ OPENSSL_free(s->cert->shared_sigalgs); s->cert->shared_sigalgs = NULL; s->cert->shared_sigalgslen = 0; @@ -2759,6 +2820,10 @@ int ssl_check_clienthello_tlsext_late(SSL *s) } else s->tlsext_status_expected = 0; + if (!tls1_alpn_handle_client_hello_late(s, &ret, &al)) { + goto err; + } + err: switch (ret) { case SSL_TLSEXT_ERR_ALERT_FATAL: @@ -3013,7 +3078,7 @@ end: * tls_decrypt_ticket attempts to decrypt a session ticket. * * etick: points to the body of the session ticket extension. - * eticklen: the length of the session tickets extenion. + * eticklen: the length of the session tickets extension. * sess_id: points at the session ID. * sesslen: the length of the session ID. * psess: (output) on return, if a ticket was decrypted, then this is set to @@ -3103,6 +3168,7 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, if (sdec == NULL || EVP_DecryptUpdate(ctx, sdec, &slen, p, eticklen) <= 0) { EVP_CIPHER_CTX_free(ctx); + OPENSSL_free(sdec); return -1; } if (EVP_DecryptFinal(ctx, sdec + slen, &mlen) <= 0) { @@ -4028,17 +4094,20 @@ DH *ssl_get_auto_dh(SSL *s) if (dh_secbits >= 128) { DH *dhp = DH_new(); + BIGNUM *p, *g; if (dhp == NULL) return NULL; - dhp->g = BN_new(); - if (dhp->g != NULL) - BN_set_word(dhp->g, 2); + g = BN_new(); + if (g != NULL) + BN_set_word(g, 2); if (dh_secbits >= 192) - dhp->p = get_rfc3526_prime_8192(NULL); + p = BN_get_rfc3526_prime_8192(NULL); else - dhp->p = get_rfc3526_prime_3072(NULL); - if (dhp->p == NULL || dhp->g == NULL) { + p = BN_get_rfc3526_prime_3072(NULL); + if (p == NULL || g == NULL || !DH_set0_pqg(dhp, p, NULL, g)) { DH_free(dhp); + BN_free(p); + BN_free(g); return NULL; } return dhp;