| /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| * All rights reserved. |
| * |
| * This package is an SSL implementation written |
| * by Eric Young (eay@cryptsoft.com). |
| * The implementation was written so as to conform with Netscapes SSL. |
| * |
| * This library is free for commercial and non-commercial use as long as |
| * the following conditions are aheared to. The following conditions |
| * apply to all code found in this distribution, be it the RC4, RSA, |
| * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| * included with this distribution is covered by the same copyright terms |
| * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| * |
| * Copyright remains Eric Young's, and as such any Copyright notices in |
| * the code are not to be removed. |
| * If this package is used in a product, Eric Young should be given attribution |
| * as the author of the parts of the library used. |
| * This can be in the form of a textual message at program startup or |
| * in documentation (online or textual) provided with the package. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * 1. Redistributions of source code must retain the copyright |
| * notice, this list of conditions and the following disclaimer. |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in the |
| * documentation and/or other materials provided with the distribution. |
| * 3. All advertising materials mentioning features or use of this software |
| * must display the following acknowledgement: |
| * "This product includes cryptographic software written by |
| * Eric Young (eay@cryptsoft.com)" |
| * The word 'cryptographic' can be left out if the rouines from the library |
| * being used are not cryptographic related :-). |
| * 4. If you include any Windows specific code (or a derivative thereof) from |
| * the apps directory (application code) you must include an acknowledgement: |
| * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| * |
| * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| * SUCH DAMAGE. |
| * |
| * The licence and distribution terms for any publically available version or |
| * derivative of this code cannot be changed. i.e. this code cannot simply be |
| * copied and put under another distribution licence |
| * [including the GNU Public Licence.] |
| */ |
| /* ==================================================================== |
| * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * |
| * 1. Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in |
| * the documentation and/or other materials provided with the |
| * distribution. |
| * |
| * 3. All advertising materials mentioning features or use of this |
| * software must display the following acknowledgment: |
| * "This product includes software developed by the OpenSSL Project |
| * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
| * |
| * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| * endorse or promote products derived from this software without |
| * prior written permission. For written permission, please contact |
| * openssl-core@openssl.org. |
| * |
| * 5. Products derived from this software may not be called "OpenSSL" |
| * nor may "OpenSSL" appear in their names without prior written |
| * permission of the OpenSSL Project. |
| * |
| * 6. Redistributions of any form whatsoever must retain the following |
| * acknowledgment: |
| * "This product includes software developed by the OpenSSL Project |
| * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| * OF THE POSSIBILITY OF SUCH DAMAGE. |
| * ==================================================================== |
| * |
| * This product includes cryptographic software written by Eric Young |
| * (eay@cryptsoft.com). This product includes software written by Tim |
| * Hudson (tjh@cryptsoft.com). */ |
| |
| #include <openssl/ssl.h> |
| |
| #include <assert.h> |
| #include <limits.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include <algorithm> |
| #include <utility> |
| |
| #include <openssl/aead.h> |
| #include <openssl/bytestring.h> |
| #include <openssl/chacha.h> |
| #include <openssl/curve25519.h> |
| #include <openssl/digest.h> |
| #include <openssl/err.h> |
| #include <openssl/evp.h> |
| #include <openssl/hmac.h> |
| #include <openssl/mem.h> |
| #include <openssl/nid.h> |
| #include <openssl/rand.h> |
| |
| #include "../crypto/hpke/internal.h" |
| #include "../crypto/internal.h" |
| #include "internal.h" |
| |
| |
| BSSL_NAMESPACE_BEGIN |
| |
| static bool ssl_check_clienthello_tlsext(SSL_HANDSHAKE *hs); |
| static bool ssl_check_serverhello_tlsext(SSL_HANDSHAKE *hs); |
| |
| static int compare_uint16_t(const void *p1, const void *p2) { |
| uint16_t u1 = *((const uint16_t *)p1); |
| uint16_t u2 = *((const uint16_t *)p2); |
| if (u1 < u2) { |
| return -1; |
| } else if (u1 > u2) { |
| return 1; |
| } else { |
| return 0; |
| } |
| } |
| |
| // Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be |
| // more than one extension of the same type in a ClientHello or ServerHello. |
| // This function does an initial scan over the extensions block to filter those |
| // out. |
| static bool tls1_check_duplicate_extensions(const CBS *cbs) { |
| // First pass: count the extensions. |
| size_t num_extensions = 0; |
| CBS extensions = *cbs; |
| while (CBS_len(&extensions) > 0) { |
| uint16_t type; |
| CBS extension; |
| |
| if (!CBS_get_u16(&extensions, &type) || |
| !CBS_get_u16_length_prefixed(&extensions, &extension)) { |
| return false; |
| } |
| |
| num_extensions++; |
| } |
| |
| if (num_extensions == 0) { |
| return true; |
| } |
| |
| Array<uint16_t> extension_types; |
| if (!extension_types.Init(num_extensions)) { |
| return false; |
| } |
| |
| // Second pass: gather the extension types. |
| extensions = *cbs; |
| for (size_t i = 0; i < extension_types.size(); i++) { |
| CBS extension; |
| |
| if (!CBS_get_u16(&extensions, &extension_types[i]) || |
| !CBS_get_u16_length_prefixed(&extensions, &extension)) { |
| // This should not happen. |
| return false; |
| } |
| } |
| assert(CBS_len(&extensions) == 0); |
| |
| // Sort the extensions and make sure there are no duplicates. |
| qsort(extension_types.data(), extension_types.size(), sizeof(uint16_t), |
| compare_uint16_t); |
| for (size_t i = 1; i < num_extensions; i++) { |
| if (extension_types[i - 1] == extension_types[i]) { |
| return false; |
| } |
| } |
| |
| return true; |
| } |
| |
| static bool is_post_quantum_group(uint16_t id) { |
| return id == SSL_CURVE_CECPQ2; |
| } |
| |
| bool ssl_client_hello_init(const SSL *ssl, SSL_CLIENT_HELLO *out, |
| const SSLMessage &msg) { |
| OPENSSL_memset(out, 0, sizeof(*out)); |
| out->ssl = const_cast<SSL *>(ssl); |
| out->client_hello = CBS_data(&msg.body); |
| out->client_hello_len = CBS_len(&msg.body); |
| |
| CBS client_hello, random, session_id; |
| CBS_init(&client_hello, out->client_hello, out->client_hello_len); |
| if (!CBS_get_u16(&client_hello, &out->version) || |
| !CBS_get_bytes(&client_hello, &random, SSL3_RANDOM_SIZE) || |
| !CBS_get_u8_length_prefixed(&client_hello, &session_id) || |
| CBS_len(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) { |
| return false; |
| } |
| |
| out->random = CBS_data(&random); |
| out->random_len = CBS_len(&random); |
| out->session_id = CBS_data(&session_id); |
| out->session_id_len = CBS_len(&session_id); |
| |
| // Skip past DTLS cookie |
| if (SSL_is_dtls(out->ssl)) { |
| CBS cookie; |
| if (!CBS_get_u8_length_prefixed(&client_hello, &cookie) || |
| CBS_len(&cookie) > DTLS1_COOKIE_LENGTH) { |
| return false; |
| } |
| } |
| |
| CBS cipher_suites, compression_methods; |
| if (!CBS_get_u16_length_prefixed(&client_hello, &cipher_suites) || |
| CBS_len(&cipher_suites) < 2 || (CBS_len(&cipher_suites) & 1) != 0 || |
| !CBS_get_u8_length_prefixed(&client_hello, &compression_methods) || |
| CBS_len(&compression_methods) < 1) { |
| return false; |
| } |
| |
| out->cipher_suites = CBS_data(&cipher_suites); |
| out->cipher_suites_len = CBS_len(&cipher_suites); |
| out->compression_methods = CBS_data(&compression_methods); |
| out->compression_methods_len = CBS_len(&compression_methods); |
| |
| // If the ClientHello ends here then it's valid, but doesn't have any |
| // extensions. |
| if (CBS_len(&client_hello) == 0) { |
| out->extensions = NULL; |
| out->extensions_len = 0; |
| return true; |
| } |
| |
| // Extract extensions and check it is valid. |
| CBS extensions; |
| if (!CBS_get_u16_length_prefixed(&client_hello, &extensions) || |
| !tls1_check_duplicate_extensions(&extensions) || |
| CBS_len(&client_hello) != 0) { |
| return false; |
| } |
| |
| out->extensions = CBS_data(&extensions); |
| out->extensions_len = CBS_len(&extensions); |
| |
| return true; |
| } |
| |
| bool ssl_client_hello_get_extension(const SSL_CLIENT_HELLO *client_hello, |
| CBS *out, uint16_t extension_type) { |
| CBS extensions; |
| CBS_init(&extensions, client_hello->extensions, client_hello->extensions_len); |
| while (CBS_len(&extensions) != 0) { |
| // Decode the next extension. |
| uint16_t type; |
| CBS extension; |
| if (!CBS_get_u16(&extensions, &type) || |
| !CBS_get_u16_length_prefixed(&extensions, &extension)) { |
| return false; |
| } |
| |
| if (type == extension_type) { |
| *out = extension; |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| static const uint16_t kDefaultGroups[] = { |
| SSL_CURVE_X25519, |
| SSL_CURVE_SECP256R1, |
| SSL_CURVE_SECP384R1, |
| }; |
| |
| Span<const uint16_t> tls1_get_grouplist(const SSL_HANDSHAKE *hs) { |
| if (!hs->config->supported_group_list.empty()) { |
| return hs->config->supported_group_list; |
| } |
| return Span<const uint16_t>(kDefaultGroups); |
| } |
| |
| bool tls1_get_shared_group(SSL_HANDSHAKE *hs, uint16_t *out_group_id) { |
| SSL *const ssl = hs->ssl; |
| assert(ssl->server); |
| |
| // Clients are not required to send a supported_groups extension. In this |
| // case, the server is free to pick any group it likes. See RFC 4492, |
| // section 4, paragraph 3. |
| // |
| // However, in the interests of compatibility, we will skip ECDH if the |
| // client didn't send an extension because we can't be sure that they'll |
| // support our favoured group. Thus we do not special-case an emtpy |
| // |peer_supported_group_list|. |
| |
| Span<const uint16_t> groups = tls1_get_grouplist(hs); |
| Span<const uint16_t> pref, supp; |
| if (ssl->options & SSL_OP_CIPHER_SERVER_PREFERENCE) { |
| pref = groups; |
| supp = hs->peer_supported_group_list; |
| } else { |
| pref = hs->peer_supported_group_list; |
| supp = groups; |
| } |
| |
| for (uint16_t pref_group : pref) { |
| for (uint16_t supp_group : supp) { |
| if (pref_group == supp_group && |
| // CECPQ2(b) doesn't fit in the u8-length-prefixed ECPoint field in |
| // TLS 1.2 and below. |
| (ssl_protocol_version(ssl) >= TLS1_3_VERSION || |
| !is_post_quantum_group(pref_group))) { |
| *out_group_id = pref_group; |
| return true; |
| } |
| } |
| } |
| |
| return false; |
| } |
| |
| bool tls1_set_curves(Array<uint16_t> *out_group_ids, Span<const int> curves) { |
| Array<uint16_t> group_ids; |
| if (!group_ids.Init(curves.size())) { |
| return false; |
| } |
| |
| for (size_t i = 0; i < curves.size(); i++) { |
| if (!ssl_nid_to_group_id(&group_ids[i], curves[i])) { |
| return false; |
| } |
| } |
| |
| *out_group_ids = std::move(group_ids); |
| return true; |
| } |
| |
| bool tls1_set_curves_list(Array<uint16_t> *out_group_ids, const char *curves) { |
| // Count the number of curves in the list. |
| size_t count = 0; |
| const char *ptr = curves, *col; |
| do { |
| col = strchr(ptr, ':'); |
| count++; |
| if (col) { |
| ptr = col + 1; |
| } |
| } while (col); |
| |
| Array<uint16_t> group_ids; |
| if (!group_ids.Init(count)) { |
| return false; |
| } |
| |
| size_t i = 0; |
| ptr = curves; |
| do { |
| col = strchr(ptr, ':'); |
| if (!ssl_name_to_group_id(&group_ids[i++], ptr, |
| col ? (size_t)(col - ptr) : strlen(ptr))) { |
| return false; |
| } |
| if (col) { |
| ptr = col + 1; |
| } |
| } while (col); |
| |
| assert(i == count); |
| *out_group_ids = std::move(group_ids); |
| return true; |
| } |
| |
| bool tls1_check_group_id(const SSL_HANDSHAKE *hs, uint16_t group_id) { |
| if (is_post_quantum_group(group_id) && |
| ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) { |
| // CECPQ2(b) requires TLS 1.3. |
| return false; |
| } |
| |
| for (uint16_t supported : tls1_get_grouplist(hs)) { |
| if (supported == group_id) { |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| // kVerifySignatureAlgorithms is the default list of accepted signature |
| // algorithms for verifying. |
| static const uint16_t kVerifySignatureAlgorithms[] = { |
| // List our preferred algorithms first. |
| SSL_SIGN_ECDSA_SECP256R1_SHA256, |
| SSL_SIGN_RSA_PSS_RSAE_SHA256, |
| SSL_SIGN_RSA_PKCS1_SHA256, |
| |
| // Larger hashes are acceptable. |
| SSL_SIGN_ECDSA_SECP384R1_SHA384, |
| SSL_SIGN_RSA_PSS_RSAE_SHA384, |
| SSL_SIGN_RSA_PKCS1_SHA384, |
| |
| SSL_SIGN_RSA_PSS_RSAE_SHA512, |
| SSL_SIGN_RSA_PKCS1_SHA512, |
| |
| // For now, SHA-1 is still accepted but least preferable. |
| SSL_SIGN_RSA_PKCS1_SHA1, |
| }; |
| |
| // kSignSignatureAlgorithms is the default list of supported signature |
| // algorithms for signing. |
| static const uint16_t kSignSignatureAlgorithms[] = { |
| // List our preferred algorithms first. |
| SSL_SIGN_ED25519, |
| SSL_SIGN_ECDSA_SECP256R1_SHA256, |
| SSL_SIGN_RSA_PSS_RSAE_SHA256, |
| SSL_SIGN_RSA_PKCS1_SHA256, |
| |
| // If needed, sign larger hashes. |
| // |
| // TODO(davidben): Determine which of these may be pruned. |
| SSL_SIGN_ECDSA_SECP384R1_SHA384, |
| SSL_SIGN_RSA_PSS_RSAE_SHA384, |
| SSL_SIGN_RSA_PKCS1_SHA384, |
| |
| SSL_SIGN_ECDSA_SECP521R1_SHA512, |
| SSL_SIGN_RSA_PSS_RSAE_SHA512, |
| SSL_SIGN_RSA_PKCS1_SHA512, |
| |
| // If the peer supports nothing else, sign with SHA-1. |
| SSL_SIGN_ECDSA_SHA1, |
| SSL_SIGN_RSA_PKCS1_SHA1, |
| }; |
| |
| static Span<const uint16_t> tls12_get_verify_sigalgs(const SSL_HANDSHAKE *hs) { |
| if (hs->config->verify_sigalgs.empty()) { |
| return Span<const uint16_t>(kVerifySignatureAlgorithms); |
| } |
| return hs->config->verify_sigalgs; |
| } |
| |
| bool tls12_add_verify_sigalgs(const SSL_HANDSHAKE *hs, CBB *out) { |
| for (uint16_t sigalg : tls12_get_verify_sigalgs(hs)) { |
| if (!CBB_add_u16(out, sigalg)) { |
| return false; |
| } |
| } |
| return true; |
| } |
| |
| bool tls12_check_peer_sigalg(const SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| uint16_t sigalg) { |
| for (uint16_t verify_sigalg : tls12_get_verify_sigalgs(hs)) { |
| if (verify_sigalg == sigalg) { |
| return true; |
| } |
| } |
| |
| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // tls_extension represents a TLS extension that is handled internally. The |
| // |init| function is called for each handshake, before any other functions of |
| // the extension. Then the add and parse callbacks are called as needed. |
| // |
| // The parse callbacks receive a |CBS| that contains the contents of the |
| // extension (i.e. not including the type and length bytes). If an extension is |
| // not received then the parse callbacks will be called with a NULL CBS so that |
| // they can do any processing needed to handle the absence of an extension. |
| // |
| // The add callbacks receive a |CBB| to which the extension can be appended but |
| // the function is responsible for appending the type and length bytes too. |
| // |
| // All callbacks return true for success and false for error. If a parse |
| // function returns zero then a fatal alert with value |*out_alert| will be |
| // sent. If |*out_alert| isn't set, then a |decode_error| alert will be sent. |
| struct tls_extension { |
| uint16_t value; |
| void (*init)(SSL_HANDSHAKE *hs); |
| |
| bool (*add_clienthello)(SSL_HANDSHAKE *hs, CBB *out); |
| bool (*parse_serverhello)(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents); |
| |
| bool (*parse_clienthello)(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents); |
| bool (*add_serverhello)(SSL_HANDSHAKE *hs, CBB *out); |
| }; |
| |
| static bool forbid_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents != NULL) { |
| // Servers MUST NOT send this extension. |
| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ignore_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| // This extension from the client is handled elsewhere. |
| return true; |
| } |
| |
| static bool dont_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| return true; |
| } |
| |
| // Server name indication (SNI). |
| // |
| // https://tools.ietf.org/html/rfc6066#section-3. |
| |
| static bool ext_sni_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->hostname == nullptr) { |
| return true; |
| } |
| |
| CBB contents, server_name_list, name; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &server_name_list) || |
| !CBB_add_u8(&server_name_list, TLSEXT_NAMETYPE_host_name) || |
| !CBB_add_u16_length_prefixed(&server_name_list, &name) || |
| !CBB_add_bytes(&name, (const uint8_t *)ssl->hostname.get(), |
| strlen(ssl->hostname.get())) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sni_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| // The server may acknowledge SNI with an empty extension. We check the syntax |
| // but otherwise ignore this signal. |
| return contents == NULL || CBS_len(contents) == 0; |
| } |
| |
| static bool ext_sni_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| // SNI has already been parsed earlier in the handshake. See |extract_sni|. |
| return true; |
| } |
| |
| static bool ext_sni_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (hs->ssl->s3->session_reused || |
| !hs->should_ack_sni) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Encrypted Client Hello (ECH) |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-esni-09 |
| |
| // random_size returns a random value between |min| and |max|, inclusive. |
| static size_t random_size(size_t min, size_t max) { |
| assert(min < max); |
| size_t value; |
| RAND_bytes(reinterpret_cast<uint8_t *>(&value), sizeof(value)); |
| return value % (max - min + 1) + min; |
| } |
| |
| static bool ext_ech_add_clienthello_grease(SSL_HANDSHAKE *hs, CBB *out) { |
| // If we are responding to the server's HelloRetryRequest, we repeat the bytes |
| // of the first ECH GREASE extension. |
| if (hs->ssl->s3->used_hello_retry_request) { |
| CBB ech_body; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_encrypted_client_hello) || |
| !CBB_add_u16_length_prefixed(out, &ech_body) || |
| !CBB_add_bytes(&ech_body, hs->ech_grease.data(), |
| hs->ech_grease.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| return true; |
| } |
| |
| constexpr uint16_t kdf_id = EVP_HPKE_HKDF_SHA256; |
| const uint16_t aead_id = EVP_has_aes_hardware() |
| ? EVP_HPKE_AEAD_AES_GCM_128 |
| : EVP_HPKE_AEAD_CHACHA20POLY1305; |
| const EVP_AEAD *aead = EVP_HPKE_get_aead(aead_id); |
| assert(aead != nullptr); |
| |
| uint8_t ech_config_id[8]; |
| RAND_bytes(ech_config_id, sizeof(ech_config_id)); |
| |
| uint8_t ech_enc[X25519_PUBLIC_VALUE_LEN]; |
| uint8_t private_key_unused[X25519_PRIVATE_KEY_LEN]; |
| X25519_keypair(ech_enc, private_key_unused); |
| |
| // To determine a plausible length for the payload, we first estimate the size |
| // of a typical EncodedClientHelloInner, with an expected use of |
| // outer_extensions. To limit the size, we only consider initial ClientHellos |
| // that do not offer resumption. |
| // |
| // Field/Extension Size |
| // --------------------------------------------------------------------- |
| // version 2 |
| // random 32 |
| // legacy_session_id 1 |
| // - Has a U8 length prefix, but body is |
| // always empty string in inner CH. |
| // cipher_suites 2 (length prefix) |
| // - Only includes TLS 1.3 ciphers (3). 6 |
| // - Maybe also include a GREASE suite. 2 |
| // legacy_compression_methods 2 (length prefix) |
| // - Always has "null" compression method. 1 |
| // extensions: 2 (length prefix) |
| // - encrypted_client_hello (empty). 4 (id + length prefix) |
| // - supported_versions. 4 (id + length prefix) |
| // - U8 length prefix 1 |
| // - U16 protocol version (TLS 1.3) 2 |
| // - outer_extensions. 4 (id + length prefix) |
| // - U8 length prefix 1 |
| // - N extension IDs (2 bytes each): |
| // - key_share 2 |
| // - sigalgs 2 |
| // - sct 2 |
| // - alpn 2 |
| // - supported_groups. 2 |
| // - status_request. 2 |
| // - psk_key_exchange_modes. 2 |
| // - compress_certificate. 2 |
| // |
| // The server_name extension has an overhead of 9 bytes, plus up to an |
| // estimated 100 bytes of hostname. Rounding up to a multiple of 32 yields a |
| // range of 96 to 192. Note that this estimate does not fully capture |
| // optional extensions like GREASE, but the rounding gives some leeway. |
| |
| uint8_t payload[EVP_AEAD_MAX_OVERHEAD + 192]; |
| const size_t payload_len = |
| EVP_AEAD_max_overhead(aead) + 32 * random_size(96 / 32, 192 / 32); |
| assert(payload_len <= sizeof(payload)); |
| RAND_bytes(payload, payload_len); |
| |
| // Inside the TLS extension contents, write a serialized ClientEncryptedCH. |
| CBB ech_body, config_id_cbb, enc_cbb, payload_cbb; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_encrypted_client_hello) || |
| !CBB_add_u16_length_prefixed(out, &ech_body) || |
| !CBB_add_u16(&ech_body, kdf_id) || // |
| !CBB_add_u16(&ech_body, aead_id) || |
| !CBB_add_u8_length_prefixed(&ech_body, &config_id_cbb) || |
| !CBB_add_bytes(&config_id_cbb, ech_config_id, sizeof(ech_config_id)) || |
| !CBB_add_u16_length_prefixed(&ech_body, &enc_cbb) || |
| !CBB_add_bytes(&enc_cbb, ech_enc, OPENSSL_ARRAY_SIZE(ech_enc)) || |
| !CBB_add_u16_length_prefixed(&ech_body, &payload_cbb) || |
| !CBB_add_bytes(&payload_cbb, payload, payload_len) || // |
| !CBB_flush(&ech_body)) { |
| return false; |
| } |
| // Save the bytes of the newly-generated extension in case the server sends |
| // a HelloRetryRequest. |
| if (!hs->ech_grease.CopyFrom( |
| MakeConstSpan(CBB_data(&ech_body), CBB_len(&ech_body)))) { |
| return false; |
| } |
| return CBB_flush(out); |
| } |
| |
| static bool ext_ech_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (hs->max_version < TLS1_3_VERSION) { |
| return true; |
| } |
| if (hs->config->ech_grease_enabled) { |
| return ext_ech_add_clienthello_grease(hs, out); |
| } |
| // Nothing to do, since we don't yet implement the non-GREASE parts of ECH. |
| return true; |
| } |
| |
| static bool ext_ech_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // If the client only sent GREASE, we must check the extension syntactically. |
| CBS ech_configs; |
| if (!CBS_get_u16_length_prefixed(contents, &ech_configs) || |
| CBS_len(&ech_configs) == 0 || // |
| CBS_len(contents) > 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| while (CBS_len(&ech_configs) > 0) { |
| // Do a top-level parse of the ECHConfig, stopping before ECHConfigContents. |
| uint16_t version; |
| CBS ech_config_contents; |
| if (!CBS_get_u16(&ech_configs, &version) || |
| !CBS_get_u16_length_prefixed(&ech_configs, &ech_config_contents)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| } |
| return true; |
| } |
| |
| static bool ext_ech_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents != nullptr) { |
| hs->ech_present = true; |
| return true; |
| } |
| return true; |
| } |
| |
| static bool ext_ech_is_inner_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| return true; |
| } |
| |
| static bool ext_ech_is_inner_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == nullptr) { |
| return true; |
| } |
| if (CBS_len(contents) > 0) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| hs->ech_is_inner_present = true; |
| return true; |
| } |
| |
| |
| // Renegotiation indication. |
| // |
| // https://tools.ietf.org/html/rfc5746 |
| |
| static bool ext_ri_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // Renegotiation indication is not necessary in TLS 1.3. |
| if (hs->min_version >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| assert(ssl->s3->initial_handshake_complete == |
| (ssl->s3->previous_client_finished_len != 0)); |
| |
| CBB contents, prev_finished; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &prev_finished) || |
| !CBB_add_bytes(&prev_finished, ssl->s3->previous_client_finished, |
| ssl->s3->previous_client_finished_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ri_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents != NULL && ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // Servers may not switch between omitting the extension and supporting it. |
| // See RFC 5746, sections 3.5 and 4.2. |
| if (ssl->s3->initial_handshake_complete && |
| (contents != NULL) != ssl->s3->send_connection_binding) { |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| return false; |
| } |
| |
| if (contents == NULL) { |
| // Strictly speaking, if we want to avoid an attack we should *always* see |
| // RI even on initial ServerHello because the client doesn't see any |
| // renegotiation during an attack. However this would mean we could not |
| // connect to any server which doesn't support RI. |
| // |
| // OpenSSL has |SSL_OP_LEGACY_SERVER_CONNECT| to control this, but in |
| // practical terms every client sets it so it's just assumed here. |
| return true; |
| } |
| |
| const size_t expected_len = ssl->s3->previous_client_finished_len + |
| ssl->s3->previous_server_finished_len; |
| |
| // Check for logic errors |
| assert(!expected_len || ssl->s3->previous_client_finished_len); |
| assert(!expected_len || ssl->s3->previous_server_finished_len); |
| assert(ssl->s3->initial_handshake_complete == |
| (ssl->s3->previous_client_finished_len != 0)); |
| assert(ssl->s3->initial_handshake_complete == |
| (ssl->s3->previous_server_finished_len != 0)); |
| |
| // Parse out the extension contents. |
| CBS renegotiated_connection; |
| if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // Check that the extension matches. |
| if (CBS_len(&renegotiated_connection) != expected_len) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| |
| const uint8_t *d = CBS_data(&renegotiated_connection); |
| bool ok = CRYPTO_memcmp(d, ssl->s3->previous_client_finished, |
| ssl->s3->previous_client_finished_len) == 0; |
| #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) |
| ok = true; |
| #endif |
| if (!ok) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| d += ssl->s3->previous_client_finished_len; |
| |
| ok = CRYPTO_memcmp(d, ssl->s3->previous_server_finished, |
| ssl->s3->previous_server_finished_len) == 0; |
| #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) |
| ok = true; |
| #endif |
| if (!ok) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| ssl->s3->send_connection_binding = true; |
| |
| return true; |
| } |
| |
| static bool ext_ri_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| // Renegotiation isn't supported as a server so this function should never be |
| // called after the initial handshake. |
| assert(!ssl->s3->initial_handshake_complete); |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS renegotiated_connection; |
| if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR); |
| return false; |
| } |
| |
| // Check that the extension matches. We do not support renegotiation as a |
| // server, so this must be empty. |
| if (CBS_len(&renegotiated_connection) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| |
| ssl->s3->send_connection_binding = true; |
| |
| return true; |
| } |
| |
| static bool ext_ri_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // Renegotiation isn't supported as a server so this function should never be |
| // called after the initial handshake. |
| assert(!ssl->s3->initial_handshake_complete); |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) || |
| !CBB_add_u16(out, 1 /* length */) || |
| !CBB_add_u8(out, 0 /* empty renegotiation info */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Extended Master Secret. |
| // |
| // https://tools.ietf.org/html/rfc7627 |
| |
| static bool ext_ems_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| // Extended master secret is not necessary in TLS 1.3. |
| if (hs->min_version >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ems_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| |
| if (contents != NULL) { |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || |
| CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->extended_master_secret = true; |
| } |
| |
| // Whether EMS is negotiated may not change on renegotiation. |
| if (ssl->s3->established_session != nullptr && |
| hs->extended_master_secret != |
| !!ssl->s3->established_session->extended_master_secret) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_EMS_MISMATCH); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ems_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->extended_master_secret = true; |
| return true; |
| } |
| |
| static bool ext_ems_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->extended_master_secret) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Session tickets. |
| // |
| // https://tools.ietf.org/html/rfc5077 |
| |
| static bool ext_ticket_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // TLS 1.3 uses a different ticket extension. |
| if (hs->min_version >= TLS1_3_VERSION || |
| SSL_get_options(ssl) & SSL_OP_NO_TICKET) { |
| return true; |
| } |
| |
| Span<const uint8_t> ticket; |
| |
| // Renegotiation does not participate in session resumption. However, still |
| // advertise the extension to avoid potentially breaking servers which carry |
| // over the state from the previous handshake, such as OpenSSL servers |
| // without upstream's 3c3f0259238594d77264a78944d409f2127642c4. |
| if (!ssl->s3->initial_handshake_complete && |
| ssl->session != nullptr && |
| !ssl->session->ticket.empty() && |
| // Don't send TLS 1.3 session tickets in the ticket extension. |
| ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) { |
| ticket = ssl->session->ticket; |
| } |
| |
| CBB ticket_cbb; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) || |
| !CBB_add_u16_length_prefixed(out, &ticket_cbb) || |
| !CBB_add_bytes(&ticket_cbb, ticket.data(), ticket.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ticket_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| // If |SSL_OP_NO_TICKET| is set then no extension will have been sent and |
| // this function should never be called, even if the server tries to send the |
| // extension. |
| assert((SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0); |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->ticket_expected = true; |
| return true; |
| } |
| |
| static bool ext_ticket_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->ticket_expected) { |
| return true; |
| } |
| |
| // If |SSL_OP_NO_TICKET| is set, |ticket_expected| should never be true. |
| assert((SSL_get_options(hs->ssl) & SSL_OP_NO_TICKET) == 0); |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Signature Algorithms. |
| // |
| // https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 |
| |
| static bool ext_sigalgs_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (hs->max_version < TLS1_2_VERSION) { |
| return true; |
| } |
| |
| CBB contents, sigalgs_cbb; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_signature_algorithms) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &sigalgs_cbb) || |
| !tls12_add_verify_sigalgs(hs, &sigalgs_cbb) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sigalgs_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| hs->peer_sigalgs.Reset(); |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS supported_signature_algorithms; |
| if (!CBS_get_u16_length_prefixed(contents, &supported_signature_algorithms) || |
| CBS_len(contents) != 0 || |
| !tls1_parse_peer_sigalgs(hs, &supported_signature_algorithms)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // OCSP Stapling. |
| // |
| // https://tools.ietf.org/html/rfc6066#section-8 |
| |
| static bool ext_ocsp_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->config->ocsp_stapling_enabled) { |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_status_request) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8(&contents, TLSEXT_STATUSTYPE_ocsp) || |
| !CBB_add_u16(&contents, 0 /* empty responder ID list */) || |
| !CBB_add_u16(&contents, 0 /* empty request extensions */) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ocsp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // TLS 1.3 OCSP responses are included in the Certificate extensions. |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| // OCSP stapling is forbidden on non-certificate ciphers. |
| if (CBS_len(contents) != 0 || |
| !ssl_cipher_uses_certificate_auth(hs->new_cipher)) { |
| return false; |
| } |
| |
| // Note this does not check for resumption in TLS 1.2. Sending |
| // status_request here does not make sense, but OpenSSL does so and the |
| // specification does not say anything. Tolerate it but ignore it. |
| |
| hs->certificate_status_expected = true; |
| return true; |
| } |
| |
| static bool ext_ocsp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| uint8_t status_type; |
| if (!CBS_get_u8(contents, &status_type)) { |
| return false; |
| } |
| |
| // We cannot decide whether OCSP stapling will occur yet because the correct |
| // SSL_CTX might not have been selected. |
| hs->ocsp_stapling_requested = status_type == TLSEXT_STATUSTYPE_ocsp; |
| |
| return true; |
| } |
| |
| static bool ext_ocsp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || |
| !hs->ocsp_stapling_requested || hs->config->cert->ocsp_response == NULL || |
| ssl->s3->session_reused || |
| !ssl_cipher_uses_certificate_auth(hs->new_cipher)) { |
| return true; |
| } |
| |
| hs->certificate_status_expected = true; |
| |
| return CBB_add_u16(out, TLSEXT_TYPE_status_request) && |
| CBB_add_u16(out, 0 /* length */); |
| } |
| |
| |
| // Next protocol negotiation. |
| // |
| // https://htmlpreview.github.io/?https://github.com/agl/technotes/blob/master/nextprotoneg.html |
| |
| static bool ext_npn_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->s3->initial_handshake_complete || |
| ssl->ctx->next_proto_select_cb == NULL || |
| SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_npn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| // If any of these are false then we should never have sent the NPN |
| // extension in the ClientHello and thus this function should never have been |
| // called. |
| assert(!ssl->s3->initial_handshake_complete); |
| assert(!SSL_is_dtls(ssl)); |
| assert(ssl->ctx->next_proto_select_cb != NULL); |
| |
| if (!ssl->s3->alpn_selected.empty()) { |
| // NPN and ALPN may not be negotiated in the same connection. |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN); |
| return false; |
| } |
| |
| const uint8_t *const orig_contents = CBS_data(contents); |
| const size_t orig_len = CBS_len(contents); |
| |
| while (CBS_len(contents) != 0) { |
| CBS proto; |
| if (!CBS_get_u8_length_prefixed(contents, &proto) || |
| CBS_len(&proto) == 0) { |
| return false; |
| } |
| } |
| |
| uint8_t *selected; |
| uint8_t selected_len; |
| if (ssl->ctx->next_proto_select_cb( |
| ssl, &selected, &selected_len, orig_contents, orig_len, |
| ssl->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK || |
| !ssl->s3->next_proto_negotiated.CopyFrom( |
| MakeConstSpan(selected, selected_len))) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| |
| hs->next_proto_neg_seen = true; |
| return true; |
| } |
| |
| static bool ext_npn_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (contents != NULL && CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| if (contents == NULL || |
| ssl->s3->initial_handshake_complete || |
| ssl->ctx->next_protos_advertised_cb == NULL || |
| SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| hs->next_proto_neg_seen = true; |
| return true; |
| } |
| |
| static bool ext_npn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // |next_proto_neg_seen| might have been cleared when an ALPN extension was |
| // parsed. |
| if (!hs->next_proto_neg_seen) { |
| return true; |
| } |
| |
| const uint8_t *npa; |
| unsigned npa_len; |
| |
| if (ssl->ctx->next_protos_advertised_cb( |
| ssl, &npa, &npa_len, ssl->ctx->next_protos_advertised_cb_arg) != |
| SSL_TLSEXT_ERR_OK) { |
| hs->next_proto_neg_seen = false; |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_bytes(&contents, npa, npa_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Signed certificate timestamps. |
| // |
| // https://tools.ietf.org/html/rfc6962#section-3.3.1 |
| |
| static bool ext_sct_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->config->signed_cert_timestamps_enabled) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_certificate_timestamp) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sct_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // TLS 1.3 SCTs are included in the Certificate extensions. |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // If this is false then we should never have sent the SCT extension in the |
| // ClientHello and thus this function should never have been called. |
| assert(hs->config->signed_cert_timestamps_enabled); |
| |
| if (!ssl_is_sct_list_valid(contents)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // Session resumption uses the original session information. The extension |
| // should not be sent on resumption, but RFC 6962 did not make it a |
| // requirement, so tolerate this. |
| // |
| // TODO(davidben): Enforce this anyway. |
| if (!ssl->s3->session_reused) { |
| hs->new_session->signed_cert_timestamp_list.reset( |
| CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool)); |
| if (hs->new_session->signed_cert_timestamp_list == nullptr) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sct_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->scts_requested = true; |
| return true; |
| } |
| |
| static bool ext_sct_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // The extension shouldn't be sent when resuming sessions. |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || ssl->s3->session_reused || |
| hs->config->cert->signed_cert_timestamp_list == NULL) { |
| return true; |
| } |
| |
| CBB contents; |
| return CBB_add_u16(out, TLSEXT_TYPE_certificate_timestamp) && |
| CBB_add_u16_length_prefixed(out, &contents) && |
| CBB_add_bytes( |
| &contents, |
| CRYPTO_BUFFER_data( |
| hs->config->cert->signed_cert_timestamp_list.get()), |
| CRYPTO_BUFFER_len( |
| hs->config->cert->signed_cert_timestamp_list.get())) && |
| CBB_flush(out); |
| } |
| |
| |
| // Application-level Protocol Negotiation. |
| // |
| // https://tools.ietf.org/html/rfc7301 |
| |
| static bool ext_alpn_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->config->alpn_client_proto_list.empty() && ssl->quic_method) { |
| // ALPN MUST be used with QUIC. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_ALPN); |
| return false; |
| } |
| |
| if (hs->config->alpn_client_proto_list.empty() || |
| ssl->s3->initial_handshake_complete) { |
| return true; |
| } |
| |
| CBB contents, proto_list; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_application_layer_protocol_negotiation) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &proto_list) || |
| !CBB_add_bytes(&proto_list, hs->config->alpn_client_proto_list.data(), |
| hs->config->alpn_client_proto_list.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_alpn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| if (ssl->quic_method) { |
| // ALPN is required when QUIC is used. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_ALPN); |
| *out_alert = SSL_AD_NO_APPLICATION_PROTOCOL; |
| return false; |
| } |
| return true; |
| } |
| |
| assert(!ssl->s3->initial_handshake_complete); |
| assert(!hs->config->alpn_client_proto_list.empty()); |
| |
| if (hs->next_proto_neg_seen) { |
| // NPN and ALPN may not be negotiated in the same connection. |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN); |
| return false; |
| } |
| |
| // The extension data consists of a ProtocolNameList which must have |
| // exactly one ProtocolName. Each of these is length-prefixed. |
| CBS protocol_name_list, protocol_name; |
| if (!CBS_get_u16_length_prefixed(contents, &protocol_name_list) || |
| CBS_len(contents) != 0 || |
| !CBS_get_u8_length_prefixed(&protocol_name_list, &protocol_name) || |
| // Empty protocol names are forbidden. |
| CBS_len(&protocol_name) == 0 || |
| CBS_len(&protocol_name_list) != 0) { |
| return false; |
| } |
| |
| if (!ssl_is_alpn_protocol_allowed(hs, protocol_name)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| if (!ssl->s3->alpn_selected.CopyFrom(protocol_name)) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool ssl_is_alpn_protocol_allowed(const SSL_HANDSHAKE *hs, |
| Span<const uint8_t> protocol) { |
| if (hs->config->alpn_client_proto_list.empty()) { |
| return false; |
| } |
| |
| if (hs->ssl->ctx->allow_unknown_alpn_protos) { |
| return true; |
| } |
| |
| // Check that the protocol name is one of the ones we advertised. |
| CBS client_protocol_name_list = |
| MakeConstSpan(hs->config->alpn_client_proto_list), |
| client_protocol_name; |
| while (CBS_len(&client_protocol_name_list) > 0) { |
| if (!CBS_get_u8_length_prefixed(&client_protocol_name_list, |
| &client_protocol_name)) { |
| return false; |
| } |
| |
| if (client_protocol_name == protocol) { |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| bool ssl_negotiate_alpn(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| const SSL_CLIENT_HELLO *client_hello) { |
| SSL *const ssl = hs->ssl; |
| CBS contents; |
| if (ssl->ctx->alpn_select_cb == NULL || |
| !ssl_client_hello_get_extension( |
| client_hello, &contents, |
| TLSEXT_TYPE_application_layer_protocol_negotiation)) { |
| if (ssl->quic_method) { |
| // ALPN is required when QUIC is used. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_ALPN); |
| *out_alert = SSL_AD_NO_APPLICATION_PROTOCOL; |
| return false; |
| } |
| // Ignore ALPN if not configured or no extension was supplied. |
| return true; |
| } |
| |
| // ALPN takes precedence over NPN. |
| hs->next_proto_neg_seen = false; |
| |
| CBS protocol_name_list; |
| if (!CBS_get_u16_length_prefixed(&contents, &protocol_name_list) || |
| CBS_len(&contents) != 0 || |
| CBS_len(&protocol_name_list) < 2) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // Validate the protocol list. |
| CBS protocol_name_list_copy = protocol_name_list; |
| while (CBS_len(&protocol_name_list_copy) > 0) { |
| CBS protocol_name; |
| if (!CBS_get_u8_length_prefixed(&protocol_name_list_copy, &protocol_name) || |
| // Empty protocol names are forbidden. |
| CBS_len(&protocol_name) == 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| } |
| |
| const uint8_t *selected; |
| uint8_t selected_len; |
| if (ssl->ctx->alpn_select_cb( |
| ssl, &selected, &selected_len, CBS_data(&protocol_name_list), |
| CBS_len(&protocol_name_list), |
| ssl->ctx->alpn_select_cb_arg) == SSL_TLSEXT_ERR_OK) { |
| if (selected_len == 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL); |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| if (!ssl->s3->alpn_selected.CopyFrom( |
| MakeConstSpan(selected, selected_len))) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| } else if (ssl->quic_method) { |
| // ALPN is required when QUIC is used. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_ALPN); |
| *out_alert = SSL_AD_NO_APPLICATION_PROTOCOL; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_alpn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->s3->alpn_selected.empty()) { |
| return true; |
| } |
| |
| CBB contents, proto_list, proto; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_application_layer_protocol_negotiation) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &proto_list) || |
| !CBB_add_u8_length_prefixed(&proto_list, &proto) || |
| !CBB_add_bytes(&proto, ssl->s3->alpn_selected.data(), |
| ssl->s3->alpn_selected.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Channel ID. |
| // |
| // https://tools.ietf.org/html/draft-balfanz-tls-channelid-01 |
| |
| static void ext_channel_id_init(SSL_HANDSHAKE *hs) { |
| hs->ssl->s3->channel_id_valid = false; |
| } |
| |
| static bool ext_channel_id_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!hs->config->channel_id_enabled || SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_channel_id_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| assert(!SSL_is_dtls(ssl)); |
| assert(hs->config->channel_id_enabled); |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| ssl->s3->channel_id_valid = true; |
| return true; |
| } |
| |
| static bool ext_channel_id_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL || !hs->config->channel_id_enabled || SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| ssl->s3->channel_id_valid = true; |
| return true; |
| } |
| |
| static bool ext_channel_id_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->s3->channel_id_valid) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Secure Real-time Transport Protocol (SRTP) extension. |
| // |
| // https://tools.ietf.org/html/rfc5764 |
| |
| |
| static void ext_srtp_init(SSL_HANDSHAKE *hs) { |
| hs->ssl->s3->srtp_profile = NULL; |
| } |
| |
| static bool ext_srtp_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = SSL_get_srtp_profiles(ssl); |
| if (profiles == NULL || |
| sk_SRTP_PROTECTION_PROFILE_num(profiles) == 0) { |
| return true; |
| } |
| |
| CBB contents, profile_ids; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_srtp) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &profile_ids)) { |
| return false; |
| } |
| |
| for (const SRTP_PROTECTION_PROFILE *profile : profiles) { |
| if (!CBB_add_u16(&profile_ids, profile->id)) { |
| return false; |
| } |
| } |
| |
| if (!CBB_add_u8(&contents, 0 /* empty use_mki value */) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_srtp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // The extension consists of a u16-prefixed profile ID list containing a |
| // single uint16_t profile ID, then followed by a u8-prefixed srtp_mki field. |
| // |
| // See https://tools.ietf.org/html/rfc5764#section-4.1.1 |
| CBS profile_ids, srtp_mki; |
| uint16_t profile_id; |
| if (!CBS_get_u16_length_prefixed(contents, &profile_ids) || |
| !CBS_get_u16(&profile_ids, &profile_id) || |
| CBS_len(&profile_ids) != 0 || |
| !CBS_get_u8_length_prefixed(contents, &srtp_mki) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); |
| return false; |
| } |
| |
| if (CBS_len(&srtp_mki) != 0) { |
| // Must be no MKI, since we never offer one. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_MKI_VALUE); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = SSL_get_srtp_profiles(ssl); |
| |
| // Check to see if the server gave us something we support (and presumably |
| // offered). |
| for (const SRTP_PROTECTION_PROFILE *profile : profiles) { |
| if (profile->id == profile_id) { |
| ssl->s3->srtp_profile = profile; |
| return true; |
| } |
| } |
| |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| static bool ext_srtp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS profile_ids, srtp_mki; |
| if (!CBS_get_u16_length_prefixed(contents, &profile_ids) || |
| CBS_len(&profile_ids) < 2 || |
| !CBS_get_u8_length_prefixed(contents, &srtp_mki) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); |
| return false; |
| } |
| // Discard the MKI value for now. |
| |
| const STACK_OF(SRTP_PROTECTION_PROFILE) *server_profiles = |
| SSL_get_srtp_profiles(ssl); |
| |
| // Pick the server's most preferred profile. |
| for (const SRTP_PROTECTION_PROFILE *server_profile : server_profiles) { |
| CBS profile_ids_tmp; |
| CBS_init(&profile_ids_tmp, CBS_data(&profile_ids), CBS_len(&profile_ids)); |
| |
| while (CBS_len(&profile_ids_tmp) > 0) { |
| uint16_t profile_id; |
| if (!CBS_get_u16(&profile_ids_tmp, &profile_id)) { |
| return false; |
| } |
| |
| if (server_profile->id == profile_id) { |
| ssl->s3->srtp_profile = server_profile; |
| return true; |
| } |
| } |
| } |
| |
| return true; |
| } |
| |
| static bool ext_srtp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->s3->srtp_profile == NULL) { |
| return true; |
| } |
| |
| CBB contents, profile_ids; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_srtp) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &profile_ids) || |
| !CBB_add_u16(&profile_ids, ssl->s3->srtp_profile->id) || |
| !CBB_add_u8(&contents, 0 /* empty MKI */) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // EC point formats. |
| // |
| // https://tools.ietf.org/html/rfc4492#section-5.1.2 |
| |
| static bool ext_ec_point_add_extension(SSL_HANDSHAKE *hs, CBB *out) { |
| CBB contents, formats; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_ec_point_formats) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &formats) || |
| !CBB_add_u8(&formats, TLSEXT_ECPOINTFORMAT_uncompressed) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ec_point_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| // The point format extension is unnecessary in TLS 1.3. |
| if (hs->min_version >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| return ext_ec_point_add_extension(hs, out); |
| } |
| |
| static bool ext_ec_point_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| CBS ec_point_format_list; |
| if (!CBS_get_u8_length_prefixed(contents, &ec_point_format_list) || |
| CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| // Per RFC 4492, section 5.1.2, implementations MUST support the uncompressed |
| // point format. |
| if (OPENSSL_memchr(CBS_data(&ec_point_format_list), |
| TLSEXT_ECPOINTFORMAT_uncompressed, |
| CBS_len(&ec_point_format_list)) == NULL) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ec_point_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| return ext_ec_point_parse_serverhello(hs, out_alert, contents); |
| } |
| |
| static bool ext_ec_point_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| const uint32_t alg_k = hs->new_cipher->algorithm_mkey; |
| const uint32_t alg_a = hs->new_cipher->algorithm_auth; |
| const bool using_ecc = (alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA); |
| |
| if (!using_ecc) { |
| return true; |
| } |
| |
| return ext_ec_point_add_extension(hs, out); |
| } |
| |
| |
| // Pre Shared Key |
| // |
| // https://tools.ietf.org/html/rfc8446#section-4.2.11 |
| |
| static size_t ext_pre_shared_key_clienthello_length(SSL_HANDSHAKE *hs) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version < TLS1_3_VERSION || ssl->session == nullptr || |
| ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) { |
| return 0; |
| } |
| |
| size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get())); |
| return 15 + ssl->session->ticket.size() + binder_len; |
| } |
| |
| static bool ext_pre_shared_key_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| hs->needs_psk_binder = false; |
| if (hs->max_version < TLS1_3_VERSION || ssl->session == nullptr || |
| ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| // Per RFC 8446 section 4.1.4, skip offering the session if the selected |
| // cipher in HelloRetryRequest does not match. This avoids performing the |
| // transcript hash transformation for multiple hashes. |
| if (ssl->s3 && ssl->s3->used_hello_retry_request && |
| ssl->session->cipher->algorithm_prf != hs->new_cipher->algorithm_prf) { |
| return true; |
| } |
| |
| struct OPENSSL_timeval now; |
| ssl_get_current_time(ssl, &now); |
| uint32_t ticket_age = 1000 * (now.tv_sec - ssl->session->time); |
| uint32_t obfuscated_ticket_age = ticket_age + ssl->session->ticket_age_add; |
| |
| // Fill in a placeholder zero binder of the appropriate length. It will be |
| // computed and filled in later after length prefixes are computed. |
| uint8_t zero_binder[EVP_MAX_MD_SIZE] = {0}; |
| size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get())); |
| |
| CBB contents, identity, ticket, binders, binder; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &identity) || |
| !CBB_add_u16_length_prefixed(&identity, &ticket) || |
| !CBB_add_bytes(&ticket, ssl->session->ticket.data(), |
| ssl->session->ticket.size()) || |
| !CBB_add_u32(&identity, obfuscated_ticket_age) || |
| !CBB_add_u16_length_prefixed(&contents, &binders) || |
| !CBB_add_u8_length_prefixed(&binders, &binder) || |
| !CBB_add_bytes(&binder, zero_binder, binder_len)) { |
| return false; |
| } |
| |
| hs->needs_psk_binder = true; |
| return CBB_flush(out); |
| } |
| |
| bool ssl_ext_pre_shared_key_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| uint16_t psk_id; |
| if (!CBS_get_u16(contents, &psk_id) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // We only advertise one PSK identity, so the only legal index is zero. |
| if (psk_id != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND); |
| *out_alert = SSL_AD_UNKNOWN_PSK_IDENTITY; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool ssl_ext_pre_shared_key_parse_clienthello( |
| SSL_HANDSHAKE *hs, CBS *out_ticket, CBS *out_binders, |
| uint32_t *out_obfuscated_ticket_age, uint8_t *out_alert, |
| const SSL_CLIENT_HELLO *client_hello, CBS *contents) { |
| // Verify that the pre_shared_key extension is the last extension in |
| // ClientHello. |
| if (CBS_data(contents) + CBS_len(contents) != |
| client_hello->extensions + client_hello->extensions_len) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PRE_SHARED_KEY_MUST_BE_LAST); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // We only process the first PSK identity since we don't support pure PSK. |
| CBS identities, binders; |
| if (!CBS_get_u16_length_prefixed(contents, &identities) || |
| !CBS_get_u16_length_prefixed(&identities, out_ticket) || |
| !CBS_get_u32(&identities, out_obfuscated_ticket_age) || |
| !CBS_get_u16_length_prefixed(contents, &binders) || |
| CBS_len(&binders) == 0 || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| *out_binders = binders; |
| |
| // Check the syntax of the remaining identities, but do not process them. |
| size_t num_identities = 1; |
| while (CBS_len(&identities) != 0) { |
| CBS unused_ticket; |
| uint32_t unused_obfuscated_ticket_age; |
| if (!CBS_get_u16_length_prefixed(&identities, &unused_ticket) || |
| !CBS_get_u32(&identities, &unused_obfuscated_ticket_age)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| num_identities++; |
| } |
| |
| // Check the syntax of the binders. The value will be checked later if |
| // resuming. |
| size_t num_binders = 0; |
| while (CBS_len(&binders) != 0) { |
| CBS binder; |
| if (!CBS_get_u8_length_prefixed(&binders, &binder)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| num_binders++; |
| } |
| |
| if (num_identities != num_binders) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_BINDER_COUNT_MISMATCH); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool ssl_ext_pre_shared_key_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->ssl->s3->session_reused) { |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| // We only consider the first identity for resumption |
| !CBB_add_u16(&contents, 0) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Pre-Shared Key Exchange Modes |
| // |
| // https://tools.ietf.org/html/rfc8446#section-4.2.9 |
| |
| static bool ext_psk_key_exchange_modes_add_clienthello(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| if (hs->max_version < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| CBB contents, ke_modes; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_psk_key_exchange_modes) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &ke_modes) || |
| !CBB_add_u8(&ke_modes, SSL_PSK_DHE_KE)) { |
| return false; |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| static bool ext_psk_key_exchange_modes_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS ke_modes; |
| if (!CBS_get_u8_length_prefixed(contents, &ke_modes) || |
| CBS_len(&ke_modes) == 0 || |
| CBS_len(contents) != 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // We only support tickets with PSK_DHE_KE. |
| hs->accept_psk_mode = OPENSSL_memchr(CBS_data(&ke_modes), SSL_PSK_DHE_KE, |
| CBS_len(&ke_modes)) != NULL; |
| |
| return true; |
| } |
| |
| |
| // Early Data Indication |
| // |
| // https://tools.ietf.org/html/rfc8446#section-4.2.10 |
| |
| // ssl_get_local_application_settings looks up the configured ALPS value for |
| // |protocol|. If found, it sets |*out_settings| to the value and returns true. |
| // Otherwise, it returns false. |
| static bool ssl_get_local_application_settings( |
| const SSL_HANDSHAKE *hs, Span<const uint8_t> *out_settings, |
| Span<const uint8_t> protocol) { |
| for (const ALPSConfig &config : hs->config->alps_configs) { |
| if (protocol == config.protocol) { |
| *out_settings = config.settings; |
| return true; |
| } |
| } |
| return false; |
| } |
| |
| static bool ext_early_data_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // The second ClientHello never offers early data, and we must have already |
| // filled in |early_data_reason| by this point. |
| if (ssl->s3->used_hello_retry_request) { |
| assert(ssl->s3->early_data_reason != ssl_early_data_unknown); |
| return true; |
| } |
| |
| if (!ssl->enable_early_data) { |
| ssl->s3->early_data_reason = ssl_early_data_disabled; |
| return true; |
| } |
| |
| if (hs->max_version < TLS1_3_VERSION) { |
| // We discard inapplicable sessions, so this is redundant with the session |
| // checks below, but we check give a more useful reason. |
| ssl->s3->early_data_reason = ssl_early_data_protocol_version; |
| return true; |
| } |
| |
| if (ssl->session == nullptr) { |
| ssl->s3->early_data_reason = ssl_early_data_no_session_offered; |
| return true; |
| } |
| |
| if (ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION || |
| ssl->session->ticket_max_early_data == 0) { |
| ssl->s3->early_data_reason = ssl_early_data_unsupported_for_session; |
| return true; |
| } |
| |
| if (!ssl->session->early_alpn.empty()) { |
| if (!ssl_is_alpn_protocol_allowed(hs, ssl->session->early_alpn)) { |
| // Avoid reporting a confusing value in |SSL_get0_alpn_selected|. |
| ssl->s3->early_data_reason = ssl_early_data_alpn_mismatch; |
| return true; |
| } |
| |
| // If the previous connection negotiated ALPS, only offer 0-RTT when the |
| // local are settings are consistent with what we'd offer for this |
| // connection. |
| if (ssl->session->has_application_settings) { |
| Span<const uint8_t> settings; |
| if (!ssl_get_local_application_settings(hs, &settings, |
| ssl->session->early_alpn) || |
| settings != ssl->session->local_application_settings) { |
| ssl->s3->early_data_reason = ssl_early_data_alps_mismatch; |
| return true; |
| } |
| } |
| } |
| |
| // |early_data_reason| will be filled in later when the server responds. |
| hs->early_data_offered = true; |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_early_data) || |
| !CBB_add_u16(out, 0) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_early_data_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| if (hs->early_data_offered && !ssl->s3->used_hello_retry_request) { |
| ssl->s3->early_data_reason = ssl->s3->session_reused |
| ? ssl_early_data_peer_declined |
| : ssl_early_data_session_not_resumed; |
| } else { |
| // We already filled in |early_data_reason| when declining to offer 0-RTT |
| // or handling the implicit HelloRetryRequest reject. |
| assert(ssl->s3->early_data_reason != ssl_early_data_unknown); |
| } |
| return true; |
| } |
| |
| // If we received an HRR, the second ClientHello never offers early data, so |
| // the extensions logic will automatically reject early data extensions as |
| // unsolicited. This covered by the ServerAcceptsEarlyDataOnHRR test. |
| assert(!ssl->s3->used_hello_retry_request); |
| |
| if (CBS_len(contents) != 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| if (!ssl->s3->session_reused) { |
| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); |
| return false; |
| } |
| |
| ssl->s3->early_data_reason = ssl_early_data_accepted; |
| ssl->s3->early_data_accepted = true; |
| return true; |
| } |
| |
| static bool ext_early_data_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL || |
| ssl_protocol_version(ssl) < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| hs->early_data_offered = true; |
| return true; |
| } |
| |
| static bool ext_early_data_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->ssl->s3->early_data_accepted) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_early_data) || |
| !CBB_add_u16(out, 0) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Key Share |
| // |
| // https://tools.ietf.org/html/rfc8446#section-4.2.8 |
| |
| static bool ext_key_share_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| CBB contents, kse_bytes; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_key_share) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &kse_bytes)) { |
| return false; |
| } |
| |
| uint16_t group_id = hs->retry_group; |
| uint16_t second_group_id = 0; |
| if (ssl->s3 && ssl->s3->used_hello_retry_request) { |
| // We received a HelloRetryRequest without a new curve, so there is no new |
| // share to append. Leave |hs->key_share| as-is. |
| if (group_id == 0 && |
| !CBB_add_bytes(&kse_bytes, hs->key_share_bytes.data(), |
| hs->key_share_bytes.size())) { |
| return false; |
| } |
| hs->key_share_bytes.Reset(); |
| if (group_id == 0) { |
| return CBB_flush(out); |
| } |
| } else { |
| // Add a fake group. See draft-davidben-tls-grease-01. |
| if (ssl->ctx->grease_enabled && |
| (!CBB_add_u16(&kse_bytes, |
| ssl_get_grease_value(hs, ssl_grease_group)) || |
| !CBB_add_u16(&kse_bytes, 1 /* length */) || |
| !CBB_add_u8(&kse_bytes, 0 /* one byte key share */))) { |
| return false; |
| } |
| |
| // Predict the most preferred group. |
| Span<const uint16_t> groups = tls1_get_grouplist(hs); |
| if (groups.empty()) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_GROUPS_SPECIFIED); |
| return false; |
| } |
| |
| group_id = groups[0]; |
| |
| if (is_post_quantum_group(group_id) && groups.size() >= 2) { |
| // CECPQ2(b) is not sent as the only initial key share. We'll include the |
| // 2nd preference group too to avoid round-trips. |
| second_group_id = groups[1]; |
| assert(second_group_id != group_id); |
| } |
| } |
| |
| CBB key_exchange; |
| hs->key_shares[0] = SSLKeyShare::Create(group_id); |
| if (!hs->key_shares[0] || |
| !CBB_add_u16(&kse_bytes, group_id) || |
| !CBB_add_u16_length_prefixed(&kse_bytes, &key_exchange) || |
| !hs->key_shares[0]->Offer(&key_exchange) || |
| !CBB_flush(&kse_bytes)) { |
| return false; |
| } |
| |
| if (second_group_id != 0) { |
| hs->key_shares[1] = SSLKeyShare::Create(second_group_id); |
| if (!hs->key_shares[1] || |
| !CBB_add_u16(&kse_bytes, second_group_id) || |
| !CBB_add_u16_length_prefixed(&kse_bytes, &key_exchange) || |
| !hs->key_shares[1]->Offer(&key_exchange) || |
| !CBB_flush(&kse_bytes)) { |
| return false; |
| } |
| } |
| |
| // Save the contents of the extension to repeat it in the second |
| // ClientHello. |
| if (ssl->s3 && !ssl->s3->used_hello_retry_request && |
| !hs->key_share_bytes.CopyFrom( |
| MakeConstSpan(CBB_data(&kse_bytes), CBB_len(&kse_bytes)))) { |
| return false; |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs, |
| Array<uint8_t> *out_secret, |
| uint8_t *out_alert, CBS *contents) { |
| CBS peer_key; |
| uint16_t group_id; |
| if (!CBS_get_u16(contents, &group_id) || |
| !CBS_get_u16_length_prefixed(contents, &peer_key) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| SSLKeyShare *key_share = hs->key_shares[0].get(); |
| if (key_share->GroupID() != group_id) { |
| if (!hs->key_shares[1] || hs->key_shares[1]->GroupID() != group_id) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE); |
| return false; |
| } |
| key_share = hs->key_shares[1].get(); |
| } |
| |
| if (!key_share->Finish(out_secret, out_alert, peer_key)) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| |
| hs->new_session->group_id = group_id; |
| hs->key_shares[0].reset(); |
| hs->key_shares[1].reset(); |
| return true; |
| } |
| |
| bool ssl_ext_key_share_parse_clienthello(SSL_HANDSHAKE *hs, bool *out_found, |
| Array<uint8_t> *out_secret, |
| uint8_t *out_alert, CBS *contents) { |
| uint16_t group_id; |
| CBS key_shares; |
| if (!tls1_get_shared_group(hs, &group_id)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| |
| if (!CBS_get_u16_length_prefixed(contents, &key_shares) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| return false; |
| } |
| |
| // Find the corresponding key share. |
| CBS peer_key; |
| CBS_init(&peer_key, NULL, 0); |
| while (CBS_len(&key_shares) > 0) { |
| uint16_t id; |
| CBS peer_key_tmp; |
| if (!CBS_get_u16(&key_shares, &id) || |
| !CBS_get_u16_length_prefixed(&key_shares, &peer_key_tmp) || |
| CBS_len(&peer_key_tmp) == 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| return false; |
| } |
| |
| if (id == group_id) { |
| if (CBS_len(&peer_key) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DUPLICATE_KEY_SHARE); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| peer_key = peer_key_tmp; |
| // Continue parsing the structure to keep peers honest. |
| } |
| } |
| |
| if (CBS_len(&peer_key) == 0) { |
| *out_found = false; |
| out_secret->Reset(); |
| return true; |
| } |
| |
| // Compute the DH secret. |
| Array<uint8_t> secret; |
| ScopedCBB public_key; |
| UniquePtr<SSLKeyShare> key_share = SSLKeyShare::Create(group_id); |
| if (!key_share || |
| !CBB_init(public_key.get(), 32) || |
| !key_share->Accept(public_key.get(), &secret, out_alert, peer_key) || |
| !CBBFinishArray(public_key.get(), &hs->ecdh_public_key)) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| *out_secret = std::move(secret); |
| *out_found = true; |
| return true; |
| } |
| |
| bool ssl_ext_key_share_add_serverhello(SSL_HANDSHAKE *hs, CBB *out, |
| bool dry_run) { |
| uint16_t group_id; |
| CBB kse_bytes, public_key; |
| if (!tls1_get_shared_group(hs, &group_id) || |
| !CBB_add_u16(out, TLSEXT_TYPE_key_share) || |
| !CBB_add_u16_length_prefixed(out, &kse_bytes) || |
| !CBB_add_u16(&kse_bytes, group_id) || |
| !CBB_add_u16_length_prefixed(&kse_bytes, &public_key) || |
| !CBB_add_bytes(&public_key, hs->ecdh_public_key.data(), |
| hs->ecdh_public_key.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| if (!dry_run) { |
| hs->ecdh_public_key.Reset(); |
| hs->new_session->group_id = group_id; |
| } |
| return true; |
| } |
| |
| |
| // Supported Versions |
| // |
| // https://tools.ietf.org/html/rfc8446#section-4.2.1 |
| |
| static bool ext_supported_versions_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version <= TLS1_2_VERSION) { |
| return true; |
| } |
| |
| CBB contents, versions; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_supported_versions) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &versions)) { |
| return false; |
| } |
| |
| // Add a fake version. See draft-davidben-tls-grease-01. |
| if (ssl->ctx->grease_enabled && |
| !CBB_add_u16(&versions, ssl_get_grease_value(hs, ssl_grease_version))) { |
| return false; |
| } |
| |
| if (!ssl_add_supported_versions(hs, &versions) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Cookie |
| // |
| // https://tools.ietf.org/html/rfc8446#section-4.2.2 |
| |
| static bool ext_cookie_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (hs->cookie.empty()) { |
| return true; |
| } |
| |
| CBB contents, cookie; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_cookie) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &cookie) || |
| !CBB_add_bytes(&cookie, hs->cookie.data(), hs->cookie.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| // The cookie is no longer needed in memory. |
| hs->cookie.Reset(); |
| return true; |
| } |
| |
| |
| // Supported Groups |
| // |
| // https://tools.ietf.org/html/rfc4492#section-5.1.1 |
| // https://tools.ietf.org/html/rfc8446#section-4.2.7 |
| |
| static bool ext_supported_groups_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| CBB contents, groups_bytes; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_supported_groups) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &groups_bytes)) { |
| return false; |
| } |
| |
| // Add a fake group. See draft-davidben-tls-grease-01. |
| if (ssl->ctx->grease_enabled && |
| !CBB_add_u16(&groups_bytes, |
| ssl_get_grease_value(hs, ssl_grease_group))) { |
| return false; |
| } |
| |
| for (uint16_t group : tls1_get_grouplist(hs)) { |
| if (is_post_quantum_group(group) && |
| hs->max_version < TLS1_3_VERSION) { |
| continue; |
| } |
| if (!CBB_add_u16(&groups_bytes, group)) { |
| return false; |
| } |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| static bool ext_supported_groups_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| // This extension is not expected to be echoed by servers in TLS 1.2, but some |
| // BigIP servers send it nonetheless, so do not enforce this. |
| return true; |
| } |
| |
| static bool parse_u16_array(const CBS *cbs, Array<uint16_t> *out) { |
| CBS copy = *cbs; |
| if ((CBS_len(©) & 1) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| return false; |
| } |
| |
| Array<uint16_t> ret; |
| if (!ret.Init(CBS_len(©) / 2)) { |
| return false; |
| } |
| for (size_t i = 0; i < ret.size(); i++) { |
| if (!CBS_get_u16(©, &ret[i])) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return false; |
| } |
| } |
| |
| assert(CBS_len(©) == 0); |
| *out = std::move(ret); |
| return 1; |
| } |
| |
| static bool ext_supported_groups_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS supported_group_list; |
| if (!CBS_get_u16_length_prefixed(contents, &supported_group_list) || |
| CBS_len(&supported_group_list) == 0 || |
| CBS_len(contents) != 0 || |
| !parse_u16_array(&supported_group_list, &hs->peer_supported_group_list)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| // Token Binding |
| // |
| // https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-10 |
| |
| // The Token Binding version number currently matches the draft number of |
| // draft-ietf-tokbind-protocol, and when published as an RFC it will be 0x0100. |
| // Since there are no wire changes to the protocol from draft 13 through the |
| // current draft (16), this implementation supports all versions in that range. |
| static uint16_t kTokenBindingMaxVersion = 16; |
| static uint16_t kTokenBindingMinVersion = 13; |
| |
| static bool ext_token_binding_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->config->token_binding_params.empty() || SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| CBB contents, params; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_token_binding) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16(&contents, kTokenBindingMaxVersion) || |
| !CBB_add_u8_length_prefixed(&contents, ¶ms) || |
| !CBB_add_bytes(¶ms, hs->config->token_binding_params.data(), |
| hs->config->token_binding_params.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_token_binding_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == nullptr) { |
| return true; |
| } |
| |
| CBS params_list; |
| uint16_t version; |
| uint8_t param; |
| if (!CBS_get_u16(contents, &version) || |
| !CBS_get_u8_length_prefixed(contents, ¶ms_list) || |
| !CBS_get_u8(¶ms_list, ¶m) || |
| CBS_len(¶ms_list) > 0 || |
| CBS_len(contents) > 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // The server-negotiated version must be less than or equal to our version. |
| if (version > kTokenBindingMaxVersion) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // If the server-selected version is less than what we support, then Token |
| // Binding wasn't negotiated (but the extension was parsed successfully). |
| if (version < kTokenBindingMinVersion) { |
| return true; |
| } |
| |
| for (uint8_t config_param : hs->config->token_binding_params) { |
| if (param == config_param) { |
| ssl->s3->negotiated_token_binding_param = param; |
| ssl->s3->token_binding_negotiated = true; |
| return true; |
| } |
| } |
| |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // select_tb_param looks for the first token binding param in |
| // |hs->ssl->token_binding_params| that is also in |params| and puts it in |
| // |hs->ssl->negotiated_token_binding_param|. It returns true if a token binding |
| // param is found, and false otherwise. |
| static bool select_tb_param(SSL_HANDSHAKE *hs, |
| Span<const uint8_t> peer_params) { |
| for (uint8_t tb_param : hs->config->token_binding_params) { |
| for (uint8_t peer_param : peer_params) { |
| if (tb_param == peer_param) { |
| hs->ssl->s3->negotiated_token_binding_param = tb_param; |
| return true; |
| } |
| } |
| } |
| return false; |
| } |
| |
| static bool ext_token_binding_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == nullptr || hs->config->token_binding_params.empty()) { |
| return true; |
| } |
| |
| CBS params; |
| uint16_t version; |
| if (!CBS_get_u16(contents, &version) || |
| !CBS_get_u8_length_prefixed(contents, ¶ms) || |
| CBS_len(¶ms) == 0 || |
| CBS_len(contents) > 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // If the client-selected version is less than what we support, then Token |
| // Binding wasn't negotiated (but the extension was parsed successfully). |
| if (version < kTokenBindingMinVersion) { |
| return true; |
| } |
| |
| // If the client-selected version is higher than we support, use our max |
| // version. Otherwise, use the client's version. |
| hs->negotiated_token_binding_version = |
| std::min(version, kTokenBindingMaxVersion); |
| if (!select_tb_param(hs, params)) { |
| return true; |
| } |
| |
| ssl->s3->token_binding_negotiated = true; |
| return true; |
| } |
| |
| static bool ext_token_binding_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| |
| if (!ssl->s3->token_binding_negotiated) { |
| return true; |
| } |
| |
| CBB contents, params; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_token_binding) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16(&contents, hs->negotiated_token_binding_version) || |
| !CBB_add_u8_length_prefixed(&contents, ¶ms) || |
| !CBB_add_u8(¶ms, ssl->s3->negotiated_token_binding_param) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| // QUIC Transport Parameters |
| |
| static bool ext_quic_transport_params_add_clienthello_impl( |
| SSL_HANDSHAKE *hs, CBB *out, bool use_legacy_codepoint) { |
| if (hs->config->quic_transport_params.empty() && !hs->ssl->quic_method) { |
| return true; |
| } |
| if (hs->config->quic_transport_params.empty() || !hs->ssl->quic_method) { |
| // QUIC Transport Parameters must be sent over QUIC, and they must not be |
| // sent over non-QUIC transports. If transport params are set, then |
| // SSL(_CTX)_set_quic_method must also be called. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED); |
| return false; |
| } |
| assert(hs->min_version > TLS1_2_VERSION); |
| if (use_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { |
| // Do nothing, we'll send the other codepoint. |
| return true; |
| } |
| |
| uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters_standard; |
| if (hs->config->quic_use_legacy_codepoint) { |
| extension_type = TLSEXT_TYPE_quic_transport_parameters_legacy; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, extension_type) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_bytes(&contents, hs->config->quic_transport_params.data(), |
| hs->config->quic_transport_params.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| return true; |
| } |
| |
| static bool ext_quic_transport_params_add_clienthello(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| return ext_quic_transport_params_add_clienthello_impl( |
| hs, out, /*use_legacy_codepoint=*/false); |
| } |
| |
| static bool ext_quic_transport_params_add_clienthello_legacy(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| return ext_quic_transport_params_add_clienthello_impl( |
| hs, out, /*use_legacy_codepoint=*/true); |
| } |
| |
| static bool ext_quic_transport_params_parse_serverhello_impl( |
| SSL_HANDSHAKE *hs, uint8_t *out_alert, CBS *contents, |
| bool used_legacy_codepoint) { |
| SSL *const ssl = hs->ssl; |
| if (contents == nullptr) { |
| if (used_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { |
| // Silently ignore because we expect the other QUIC codepoint. |
| return true; |
| } |
| if (!ssl->quic_method) { |
| return true; |
| } |
| *out_alert = SSL_AD_MISSING_EXTENSION; |
| return false; |
| } |
| // The extensions parser will check for unsolicited extensions before |
| // calling the callback. |
| assert(ssl->quic_method != nullptr); |
| assert(ssl_protocol_version(ssl) == TLS1_3_VERSION); |
| assert(used_legacy_codepoint == hs->config->quic_use_legacy_codepoint); |
| return ssl->s3->peer_quic_transport_params.CopyFrom(*contents); |
| } |
| |
| static bool ext_quic_transport_params_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| return ext_quic_transport_params_parse_serverhello_impl( |
| hs, out_alert, contents, /*used_legacy_codepoint=*/false); |
| } |
| |
| static bool ext_quic_transport_params_parse_serverhello_legacy( |
| SSL_HANDSHAKE *hs, uint8_t *out_alert, CBS *contents) { |
| return ext_quic_transport_params_parse_serverhello_impl( |
| hs, out_alert, contents, /*used_legacy_codepoint=*/true); |
| } |
| |
| static bool ext_quic_transport_params_parse_clienthello_impl( |
| SSL_HANDSHAKE *hs, uint8_t *out_alert, CBS *contents, |
| bool used_legacy_codepoint) { |
| SSL *const ssl = hs->ssl; |
| if (!contents) { |
| if (!ssl->quic_method) { |
| if (hs->config->quic_transport_params.empty()) { |
| return true; |
| } |
| // QUIC transport parameters must not be set if |ssl| is not configured |
| // for QUIC. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED); |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| if (used_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { |
| // Silently ignore because we expect the other QUIC codepoint. |
| return true; |
| } |
| *out_alert = SSL_AD_MISSING_EXTENSION; |
| return false; |
| } |
| if (!ssl->quic_method) { |
| if (used_legacy_codepoint) { |
| // Ignore the legacy private-use codepoint because that could be sent |
| // to mean something else than QUIC transport parameters. |
| return true; |
| } |
| // Fail if we received the codepoint registered with IANA for QUIC |
| // because that is not allowed outside of QUIC. |
| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; |
| return false; |
| } |
| assert(ssl_protocol_version(ssl) == TLS1_3_VERSION); |
| if (used_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { |
| // Silently ignore because we expect the other QUIC codepoint. |
| return true; |
| } |
| return ssl->s3->peer_quic_transport_params.CopyFrom(*contents); |
| } |
| |
| static bool ext_quic_transport_params_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| return ext_quic_transport_params_parse_clienthello_impl( |
| hs, out_alert, contents, /*used_legacy_codepoint=*/false); |
| } |
| |
| static bool ext_quic_transport_params_parse_clienthello_legacy( |
| SSL_HANDSHAKE *hs, uint8_t *out_alert, CBS *contents) { |
| return ext_quic_transport_params_parse_clienthello_impl( |
| hs, out_alert, contents, /*used_legacy_codepoint=*/true); |
| } |
| |
| static bool ext_quic_transport_params_add_serverhello_impl( |
| SSL_HANDSHAKE *hs, CBB *out, bool use_legacy_codepoint) { |
| if (hs->ssl->quic_method == nullptr && use_legacy_codepoint) { |
| // Ignore the legacy private-use codepoint because that could be sent |
| // to mean something else than QUIC transport parameters. |
| return true; |
| } |
| assert(hs->ssl->quic_method != nullptr); |
| if (hs->config->quic_transport_params.empty()) { |
| // Transport parameters must be set when using QUIC. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED); |
| return false; |
| } |
| if (use_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { |
| // Do nothing, we'll send the other codepoint. |
| return true; |
| } |
| |
| uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters_standard; |
| if (hs->config->quic_use_legacy_codepoint) { |
| extension_type = TLSEXT_TYPE_quic_transport_parameters_legacy; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, extension_type) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_bytes(&contents, hs->config->quic_transport_params.data(), |
| hs->config->quic_transport_params.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_quic_transport_params_add_serverhello(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| return ext_quic_transport_params_add_serverhello_impl( |
| hs, out, /*use_legacy_codepoint=*/false); |
| } |
| |
| static bool ext_quic_transport_params_add_serverhello_legacy(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| return ext_quic_transport_params_add_serverhello_impl( |
| hs, out, /*use_legacy_codepoint=*/true); |
| } |
| |
| // Delegated credentials. |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-subcerts |
| |
| static bool ext_delegated_credential_add_clienthello(SSL_HANDSHAKE *hs, |
| |