1 /* 2 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright 2005 Nokia. All rights reserved. 4 * 5 * Licensed under the Apache License 2.0 (the "License"). You may not use 6 * this file except in compliance with the License. You can obtain a copy 7 * in the file LICENSE in the source distribution or at 8 * https://www.openssl.org/source/license.html 9 */ 10 11 #include <stdio.h> 12 #include "ssl_local.h" 13 #include "record/record_local.h" 14 #include "internal/ktls.h" 15 #include "internal/cryptlib.h" 16 #include <openssl/comp.h> 17 #include <openssl/evp.h> 18 #include <openssl/kdf.h> 19 #include <openssl/rand.h> 20 #include <openssl/obj_mac.h> 21 #include <openssl/core_names.h> 22 #include <openssl/trace.h> 23 24 /* seed1 through seed5 are concatenated */ 25 static int tls1_PRF(SSL *s, 26 const void *seed1, size_t seed1_len, 27 const void *seed2, size_t seed2_len, 28 const void *seed3, size_t seed3_len, 29 const void *seed4, size_t seed4_len, 30 const void *seed5, size_t seed5_len, 31 const unsigned char *sec, size_t slen, 32 unsigned char *out, size_t olen, int fatal) 33 { 34 const EVP_MD *md = ssl_prf_md(s); 35 EVP_KDF *kdf; 36 EVP_KDF_CTX *kctx = NULL; 37 OSSL_PARAM params[8], *p = params; 38 const char *mdname; 39 40 if (md == NULL) { 41 /* Should never happen */ 42 if (fatal) 43 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 44 else 45 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 46 return 0; 47 } 48 kdf = EVP_KDF_fetch(s->ctx->libctx, OSSL_KDF_NAME_TLS1_PRF, s->ctx->propq); 49 if (kdf == NULL) 50 goto err; 51 kctx = EVP_KDF_CTX_new(kdf); 52 EVP_KDF_free(kdf); 53 if (kctx == NULL) 54 goto err; 55 mdname = EVP_MD_get0_name(md); 56 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, 57 (char *)mdname, 0); 58 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, 59 (unsigned char *)sec, 60 (size_t)slen); 61 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, 62 (void *)seed1, (size_t)seed1_len); 63 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, 64 (void *)seed2, (size_t)seed2_len); 65 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, 66 (void *)seed3, (size_t)seed3_len); 67 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, 68 (void *)seed4, (size_t)seed4_len); 69 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, 70 (void *)seed5, (size_t)seed5_len); 71 *p = OSSL_PARAM_construct_end(); 72 if (EVP_KDF_derive(kctx, out, olen, params)) { 73 EVP_KDF_CTX_free(kctx); 74 return 1; 75 } 76 77 err: 78 if (fatal) 79 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 80 else 81 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 82 EVP_KDF_CTX_free(kctx); 83 return 0; 84 } 85 86 static int tls1_generate_key_block(SSL *s, unsigned char *km, size_t num) 87 { 88 int ret; 89 90 /* Calls SSLfatal() as required */ 91 ret = tls1_PRF(s, 92 TLS_MD_KEY_EXPANSION_CONST, 93 TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random, 94 SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE, 95 NULL, 0, NULL, 0, s->session->master_key, 96 s->session->master_key_length, km, num, 1); 97 98 return ret; 99 } 100 101 #ifndef OPENSSL_NO_KTLS 102 /* 103 * Count the number of records that were not processed yet from record boundary. 104 * 105 * This function assumes that there are only fully formed records read in the 106 * record layer. If read_ahead is enabled, then this might be false and this 107 * function will fail. 108 */ 109 # ifndef OPENSSL_NO_KTLS_RX 110 static int count_unprocessed_records(SSL *s) 111 { 112 SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); 113 PACKET pkt, subpkt; 114 int count = 0; 115 116 if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left)) 117 return -1; 118 119 while (PACKET_remaining(&pkt) > 0) { 120 /* Skip record type and version */ 121 if (!PACKET_forward(&pkt, 3)) 122 return -1; 123 124 /* Read until next record */ 125 if (!PACKET_get_length_prefixed_2(&pkt, &subpkt)) 126 return -1; 127 128 count += 1; 129 } 130 131 return count; 132 } 133 # endif 134 #endif 135 136 137 int tls_provider_set_tls_params(SSL *s, EVP_CIPHER_CTX *ctx, 138 const EVP_CIPHER *ciph, 139 const EVP_MD *md) 140 { 141 /* 142 * Provided cipher, the TLS padding/MAC removal is performed provider 143 * side so we need to tell the ctx about our TLS version and mac size 144 */ 145 OSSL_PARAM params[3], *pprm = params; 146 size_t macsize = 0; 147 int imacsize = -1; 148 149 if ((EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0 150 /* 151 * We look at s->ext.use_etm instead of SSL_READ_ETM() or 152 * SSL_WRITE_ETM() because this test applies to both reading 153 * and writing. 154 */ 155 && !s->ext.use_etm) 156 imacsize = EVP_MD_get_size(md); 157 if (imacsize >= 0) 158 macsize = (size_t)imacsize; 159 160 *pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION, 161 &s->version); 162 *pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE, 163 &macsize); 164 *pprm = OSSL_PARAM_construct_end(); 165 166 if (!EVP_CIPHER_CTX_set_params(ctx, params)) { 167 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 168 return 0; 169 } 170 171 return 1; 172 } 173 174 175 static int tls_iv_length_within_key_block(const EVP_CIPHER *c) 176 { 177 /* If GCM/CCM mode only part of IV comes from PRF */ 178 if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) 179 return EVP_GCM_TLS_FIXED_IV_LEN; 180 else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) 181 return EVP_CCM_TLS_FIXED_IV_LEN; 182 else 183 return EVP_CIPHER_get_iv_length(c); 184 } 185 186 int tls1_change_cipher_state(SSL *s, int which) 187 { 188 unsigned char *p, *mac_secret; 189 unsigned char *ms, *key, *iv; 190 EVP_CIPHER_CTX *dd; 191 const EVP_CIPHER *c; 192 #ifndef OPENSSL_NO_COMP 193 const SSL_COMP *comp; 194 #endif 195 const EVP_MD *m; 196 int mac_type; 197 size_t *mac_secret_size; 198 EVP_MD_CTX *mac_ctx; 199 EVP_PKEY *mac_key; 200 size_t n, i, j, k, cl; 201 int reuse_dd = 0; 202 #ifndef OPENSSL_NO_KTLS 203 ktls_crypto_info_t crypto_info; 204 unsigned char *rec_seq; 205 void *rl_sequence; 206 # ifndef OPENSSL_NO_KTLS_RX 207 int count_unprocessed; 208 int bit; 209 # endif 210 BIO *bio; 211 #endif 212 213 c = s->s3.tmp.new_sym_enc; 214 m = s->s3.tmp.new_hash; 215 mac_type = s->s3.tmp.new_mac_pkey_type; 216 #ifndef OPENSSL_NO_COMP 217 comp = s->s3.tmp.new_compression; 218 #endif 219 220 if (which & SSL3_CC_READ) { 221 if (s->ext.use_etm) 222 s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; 223 else 224 s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; 225 226 if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) 227 s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; 228 else 229 s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; 230 231 if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) 232 s->mac_flags |= SSL_MAC_FLAG_READ_MAC_TLSTREE; 233 else 234 s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_TLSTREE; 235 236 if (s->enc_read_ctx != NULL) { 237 reuse_dd = 1; 238 } else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) { 239 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); 240 goto err; 241 } else { 242 /* 243 * make sure it's initialised in case we exit later with an error 244 */ 245 EVP_CIPHER_CTX_reset(s->enc_read_ctx); 246 } 247 dd = s->enc_read_ctx; 248 mac_ctx = ssl_replace_hash(&s->read_hash, NULL); 249 if (mac_ctx == NULL) { 250 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 251 goto err; 252 } 253 #ifndef OPENSSL_NO_COMP 254 COMP_CTX_free(s->expand); 255 s->expand = NULL; 256 if (comp != NULL) { 257 s->expand = COMP_CTX_new(comp->method); 258 if (s->expand == NULL) { 259 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 260 SSL_R_COMPRESSION_LIBRARY_ERROR); 261 goto err; 262 } 263 } 264 #endif 265 /* 266 * this is done by dtls1_reset_seq_numbers for DTLS 267 */ 268 if (!SSL_IS_DTLS(s)) 269 RECORD_LAYER_reset_read_sequence(&s->rlayer); 270 mac_secret = &(s->s3.read_mac_secret[0]); 271 mac_secret_size = &(s->s3.read_mac_secret_size); 272 } else { 273 s->statem.enc_write_state = ENC_WRITE_STATE_INVALID; 274 if (s->ext.use_etm) 275 s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; 276 else 277 s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; 278 279 if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) 280 s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; 281 else 282 s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; 283 284 if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) 285 s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_TLSTREE; 286 else 287 s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_TLSTREE; 288 if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) { 289 reuse_dd = 1; 290 } else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) { 291 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); 292 goto err; 293 } 294 dd = s->enc_write_ctx; 295 if (SSL_IS_DTLS(s)) { 296 mac_ctx = EVP_MD_CTX_new(); 297 if (mac_ctx == NULL) { 298 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); 299 goto err; 300 } 301 s->write_hash = mac_ctx; 302 } else { 303 mac_ctx = ssl_replace_hash(&s->write_hash, NULL); 304 if (mac_ctx == NULL) { 305 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); 306 goto err; 307 } 308 } 309 #ifndef OPENSSL_NO_COMP 310 COMP_CTX_free(s->compress); 311 s->compress = NULL; 312 if (comp != NULL) { 313 s->compress = COMP_CTX_new(comp->method); 314 if (s->compress == NULL) { 315 SSLfatal(s, SSL_AD_INTERNAL_ERROR, 316 SSL_R_COMPRESSION_LIBRARY_ERROR); 317 goto err; 318 } 319 } 320 #endif 321 /* 322 * this is done by dtls1_reset_seq_numbers for DTLS 323 */ 324 if (!SSL_IS_DTLS(s)) 325 RECORD_LAYER_reset_write_sequence(&s->rlayer); 326 mac_secret = &(s->s3.write_mac_secret[0]); 327 mac_secret_size = &(s->s3.write_mac_secret_size); 328 } 329 330 if (reuse_dd) 331 EVP_CIPHER_CTX_reset(dd); 332 333 p = s->s3.tmp.key_block; 334 i = *mac_secret_size = s->s3.tmp.new_mac_secret_size; 335 336 cl = EVP_CIPHER_get_key_length(c); 337 j = cl; 338 k = tls_iv_length_within_key_block(c); 339 if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || 340 (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { 341 ms = &(p[0]); 342 n = i + i; 343 key = &(p[n]); 344 n += j + j; 345 iv = &(p[n]); 346 n += k + k; 347 } else { 348 n = i; 349 ms = &(p[n]); 350 n += i + j; 351 key = &(p[n]); 352 n += j + k; 353 iv = &(p[n]); 354 n += k; 355 } 356 357 if (n > s->s3.tmp.key_block_length) { 358 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 359 goto err; 360 } 361 362 memcpy(mac_secret, ms, i); 363 364 if (!(EVP_CIPHER_get_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) { 365 if (mac_type == EVP_PKEY_HMAC) { 366 mac_key = EVP_PKEY_new_raw_private_key_ex(s->ctx->libctx, "HMAC", 367 s->ctx->propq, mac_secret, 368 *mac_secret_size); 369 } else { 370 /* 371 * If its not HMAC then the only other types of MAC we support are 372 * the GOST MACs, so we need to use the old style way of creating 373 * a MAC key. 374 */ 375 mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret, 376 (int)*mac_secret_size); 377 } 378 if (mac_key == NULL 379 || EVP_DigestSignInit_ex(mac_ctx, NULL, EVP_MD_get0_name(m), 380 s->ctx->libctx, s->ctx->propq, mac_key, 381 NULL) <= 0) { 382 EVP_PKEY_free(mac_key); 383 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 384 goto err; 385 } 386 EVP_PKEY_free(mac_key); 387 } 388 389 OSSL_TRACE_BEGIN(TLS) { 390 BIO_printf(trc_out, "which = %04X, mac key:\n", which); 391 BIO_dump_indent(trc_out, ms, i, 4); 392 } OSSL_TRACE_END(TLS); 393 394 if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) { 395 if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE)) 396 || EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k, 397 iv) <= 0) { 398 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 399 goto err; 400 } 401 } else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) { 402 int taglen; 403 if (s->s3.tmp. 404 new_cipher->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) 405 taglen = EVP_CCM8_TLS_TAG_LEN; 406 else 407 taglen = EVP_CCM_TLS_TAG_LEN; 408 if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE)) 409 || (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) <= 0) 410 || (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) <= 0) 411 || (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) <= 0) 412 || !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) { 413 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 414 goto err; 415 } 416 } else { 417 if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) { 418 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 419 goto err; 420 } 421 } 422 /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ 423 if ((EVP_CIPHER_get_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) 424 && *mac_secret_size 425 && EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY, 426 (int)*mac_secret_size, mac_secret) <= 0) { 427 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 428 goto err; 429 } 430 431 /* 432 * The cipher we actually ended up using in the EVP_CIPHER_CTX may be 433 * different to that in c if we have an ENGINE in use 434 */ 435 if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL 436 && !tls_provider_set_tls_params(s, dd, c, m)) { 437 /* SSLfatal already called */ 438 goto err; 439 } 440 441 #ifndef OPENSSL_NO_KTLS 442 if (s->compress || (s->options & SSL_OP_ENABLE_KTLS) == 0) 443 goto skip_ktls; 444 445 /* ktls supports only the maximum fragment size */ 446 if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH) 447 goto skip_ktls; 448 449 /* check that cipher is supported */ 450 if (!ktls_check_supported_cipher(s, c, dd)) 451 goto skip_ktls; 452 453 if (which & SSL3_CC_WRITE) 454 bio = s->wbio; 455 else 456 bio = s->rbio; 457 458 if (!ossl_assert(bio != NULL)) { 459 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 460 goto err; 461 } 462 463 /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */ 464 if (which & SSL3_CC_WRITE) { 465 if (BIO_flush(bio) <= 0) 466 goto skip_ktls; 467 } 468 469 /* ktls doesn't support renegotiation */ 470 if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) || 471 (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) { 472 SSLfatal(s, SSL_AD_NO_RENEGOTIATION, ERR_R_INTERNAL_ERROR); 473 goto err; 474 } 475 476 if (which & SSL3_CC_WRITE) 477 rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer); 478 else 479 rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer); 480 481 if (!ktls_configure_crypto(s, c, dd, rl_sequence, &crypto_info, &rec_seq, 482 iv, key, ms, *mac_secret_size)) 483 goto skip_ktls; 484 485 if (which & SSL3_CC_READ) { 486 # ifndef OPENSSL_NO_KTLS_RX 487 count_unprocessed = count_unprocessed_records(s); 488 if (count_unprocessed < 0) 489 goto skip_ktls; 490 491 /* increment the crypto_info record sequence */ 492 while (count_unprocessed) { 493 for (bit = 7; bit >= 0; bit--) { /* increment */ 494 ++rec_seq[bit]; 495 if (rec_seq[bit] != 0) 496 break; 497 } 498 count_unprocessed--; 499 } 500 # else 501 goto skip_ktls; 502 # endif 503 } 504 505 /* ktls works with user provided buffers directly */ 506 if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) { 507 if (which & SSL3_CC_WRITE) 508 ssl3_release_write_buffer(s); 509 SSL_set_options(s, SSL_OP_NO_RENEGOTIATION); 510 } 511 512 skip_ktls: 513 #endif /* OPENSSL_NO_KTLS */ 514 s->statem.enc_write_state = ENC_WRITE_STATE_VALID; 515 516 OSSL_TRACE_BEGIN(TLS) { 517 BIO_printf(trc_out, "which = %04X, key:\n", which); 518 BIO_dump_indent(trc_out, key, EVP_CIPHER_get_key_length(c), 4); 519 BIO_printf(trc_out, "iv:\n"); 520 BIO_dump_indent(trc_out, iv, k, 4); 521 } OSSL_TRACE_END(TLS); 522 523 return 1; 524 err: 525 return 0; 526 } 527 528 int tls1_setup_key_block(SSL *s) 529 { 530 unsigned char *p; 531 const EVP_CIPHER *c; 532 const EVP_MD *hash; 533 SSL_COMP *comp; 534 int mac_type = NID_undef; 535 size_t num, mac_secret_size = 0; 536 int ret = 0; 537 538 if (s->s3.tmp.key_block_length != 0) 539 return 1; 540 541 if (!ssl_cipher_get_evp(s->ctx, s->session, &c, &hash, &mac_type, 542 &mac_secret_size, &comp, s->ext.use_etm)) { 543 /* Error is already recorded */ 544 SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); 545 return 0; 546 } 547 548 ssl_evp_cipher_free(s->s3.tmp.new_sym_enc); 549 s->s3.tmp.new_sym_enc = c; 550 ssl_evp_md_free(s->s3.tmp.new_hash); 551 s->s3.tmp.new_hash = hash; 552 s->s3.tmp.new_mac_pkey_type = mac_type; 553 s->s3.tmp.new_mac_secret_size = mac_secret_size; 554 num = mac_secret_size + EVP_CIPHER_get_key_length(c) 555 + tls_iv_length_within_key_block(c); 556 num *= 2; 557 558 ssl3_cleanup_key_block(s); 559 560 if ((p = OPENSSL_malloc(num)) == NULL) { 561 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE); 562 goto err; 563 } 564 565 s->s3.tmp.key_block_length = num; 566 s->s3.tmp.key_block = p; 567 568 OSSL_TRACE_BEGIN(TLS) { 569 BIO_printf(trc_out, "key block length: %zu\n", num); 570 BIO_printf(trc_out, "client random\n"); 571 BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); 572 BIO_printf(trc_out, "server random\n"); 573 BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); 574 BIO_printf(trc_out, "master key\n"); 575 BIO_dump_indent(trc_out, 576 s->session->master_key, 577 s->session->master_key_length, 4); 578 } OSSL_TRACE_END(TLS); 579 580 if (!tls1_generate_key_block(s, p, num)) { 581 /* SSLfatal() already called */ 582 goto err; 583 } 584 585 OSSL_TRACE_BEGIN(TLS) { 586 BIO_printf(trc_out, "key block\n"); 587 BIO_dump_indent(trc_out, p, num, 4); 588 } OSSL_TRACE_END(TLS); 589 590 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) 591 && s->method->version <= TLS1_VERSION) { 592 /* 593 * enable vulnerability countermeasure for CBC ciphers with known-IV 594 * problem (http://www.openssl.org/~bodo/tls-cbc.txt) 595 */ 596 s->s3.need_empty_fragments = 1; 597 598 if (s->session->cipher != NULL) { 599 if (s->session->cipher->algorithm_enc == SSL_eNULL) 600 s->s3.need_empty_fragments = 0; 601 602 if (s->session->cipher->algorithm_enc == SSL_RC4) 603 s->s3.need_empty_fragments = 0; 604 } 605 } 606 607 ret = 1; 608 err: 609 return ret; 610 } 611 612 size_t tls1_final_finish_mac(SSL *s, const char *str, size_t slen, 613 unsigned char *out) 614 { 615 size_t hashlen; 616 unsigned char hash[EVP_MAX_MD_SIZE]; 617 size_t finished_size = TLS1_FINISH_MAC_LENGTH; 618 619 if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kGOST18) 620 finished_size = 32; 621 622 if (!ssl3_digest_cached_records(s, 0)) { 623 /* SSLfatal() already called */ 624 return 0; 625 } 626 627 if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { 628 /* SSLfatal() already called */ 629 return 0; 630 } 631 632 if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, 633 s->session->master_key, s->session->master_key_length, 634 out, finished_size, 1)) { 635 /* SSLfatal() already called */ 636 return 0; 637 } 638 OPENSSL_cleanse(hash, hashlen); 639 return finished_size; 640 } 641 642 int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 643 size_t len, size_t *secret_size) 644 { 645 if (s->session->flags & SSL_SESS_FLAG_EXTMS) { 646 unsigned char hash[EVP_MAX_MD_SIZE * 2]; 647 size_t hashlen; 648 /* 649 * Digest cached records keeping record buffer (if present): this won't 650 * affect client auth because we're freezing the buffer at the same 651 * point (after client key exchange and before certificate verify) 652 */ 653 if (!ssl3_digest_cached_records(s, 1) 654 || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { 655 /* SSLfatal() already called */ 656 return 0; 657 } 658 OSSL_TRACE_BEGIN(TLS) { 659 BIO_printf(trc_out, "Handshake hashes:\n"); 660 BIO_dump(trc_out, (char *)hash, hashlen); 661 } OSSL_TRACE_END(TLS); 662 if (!tls1_PRF(s, 663 TLS_MD_EXTENDED_MASTER_SECRET_CONST, 664 TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, 665 hash, hashlen, 666 NULL, 0, 667 NULL, 0, 668 NULL, 0, p, len, out, 669 SSL3_MASTER_SECRET_SIZE, 1)) { 670 /* SSLfatal() already called */ 671 return 0; 672 } 673 OPENSSL_cleanse(hash, hashlen); 674 } else { 675 if (!tls1_PRF(s, 676 TLS_MD_MASTER_SECRET_CONST, 677 TLS_MD_MASTER_SECRET_CONST_SIZE, 678 s->s3.client_random, SSL3_RANDOM_SIZE, 679 NULL, 0, 680 s->s3.server_random, SSL3_RANDOM_SIZE, 681 NULL, 0, p, len, out, 682 SSL3_MASTER_SECRET_SIZE, 1)) { 683 /* SSLfatal() already called */ 684 return 0; 685 } 686 } 687 688 OSSL_TRACE_BEGIN(TLS) { 689 BIO_printf(trc_out, "Premaster Secret:\n"); 690 BIO_dump_indent(trc_out, p, len, 4); 691 BIO_printf(trc_out, "Client Random:\n"); 692 BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); 693 BIO_printf(trc_out, "Server Random:\n"); 694 BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); 695 BIO_printf(trc_out, "Master Secret:\n"); 696 BIO_dump_indent(trc_out, 697 s->session->master_key, 698 SSL3_MASTER_SECRET_SIZE, 4); 699 } OSSL_TRACE_END(TLS); 700 701 *secret_size = SSL3_MASTER_SECRET_SIZE; 702 return 1; 703 } 704 705 int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, 706 const char *label, size_t llen, 707 const unsigned char *context, 708 size_t contextlen, int use_context) 709 { 710 unsigned char *val = NULL; 711 size_t vallen = 0, currentvalpos; 712 int rv; 713 714 /* 715 * construct PRF arguments we construct the PRF argument ourself rather 716 * than passing separate values into the TLS PRF to ensure that the 717 * concatenation of values does not create a prohibited label. 718 */ 719 vallen = llen + SSL3_RANDOM_SIZE * 2; 720 if (use_context) { 721 vallen += 2 + contextlen; 722 } 723 724 val = OPENSSL_malloc(vallen); 725 if (val == NULL) 726 goto err2; 727 currentvalpos = 0; 728 memcpy(val + currentvalpos, (unsigned char *)label, llen); 729 currentvalpos += llen; 730 memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE); 731 currentvalpos += SSL3_RANDOM_SIZE; 732 memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE); 733 currentvalpos += SSL3_RANDOM_SIZE; 734 735 if (use_context) { 736 val[currentvalpos] = (contextlen >> 8) & 0xff; 737 currentvalpos++; 738 val[currentvalpos] = contextlen & 0xff; 739 currentvalpos++; 740 if ((contextlen > 0) || (context != NULL)) { 741 memcpy(val + currentvalpos, context, contextlen); 742 } 743 } 744 745 /* 746 * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited 747 * label len) = 15, so size of val > max(prohibited label len) = 15 and 748 * the comparisons won't have buffer overflow 749 */ 750 if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, 751 TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) 752 goto err1; 753 if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, 754 TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) 755 goto err1; 756 if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, 757 TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) 758 goto err1; 759 if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, 760 TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) 761 goto err1; 762 if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, 763 TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) 764 goto err1; 765 766 rv = tls1_PRF(s, 767 val, vallen, 768 NULL, 0, 769 NULL, 0, 770 NULL, 0, 771 NULL, 0, 772 s->session->master_key, s->session->master_key_length, 773 out, olen, 0); 774 775 goto ret; 776 err1: 777 ERR_raise(ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); 778 rv = 0; 779 goto ret; 780 err2: 781 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE); 782 rv = 0; 783 ret: 784 OPENSSL_clear_free(val, vallen); 785 return rv; 786 } 787 788 int tls1_alert_code(int code) 789 { 790 switch (code) { 791 case SSL_AD_CLOSE_NOTIFY: 792 return SSL3_AD_CLOSE_NOTIFY; 793 case SSL_AD_UNEXPECTED_MESSAGE: 794 return SSL3_AD_UNEXPECTED_MESSAGE; 795 case SSL_AD_BAD_RECORD_MAC: 796 return SSL3_AD_BAD_RECORD_MAC; 797 case SSL_AD_DECRYPTION_FAILED: 798 return TLS1_AD_DECRYPTION_FAILED; 799 case SSL_AD_RECORD_OVERFLOW: 800 return TLS1_AD_RECORD_OVERFLOW; 801 case SSL_AD_DECOMPRESSION_FAILURE: 802 return SSL3_AD_DECOMPRESSION_FAILURE; 803 case SSL_AD_HANDSHAKE_FAILURE: 804 return SSL3_AD_HANDSHAKE_FAILURE; 805 case SSL_AD_NO_CERTIFICATE: 806 return -1; 807 case SSL_AD_BAD_CERTIFICATE: 808 return SSL3_AD_BAD_CERTIFICATE; 809 case SSL_AD_UNSUPPORTED_CERTIFICATE: 810 return SSL3_AD_UNSUPPORTED_CERTIFICATE; 811 case SSL_AD_CERTIFICATE_REVOKED: 812 return SSL3_AD_CERTIFICATE_REVOKED; 813 case SSL_AD_CERTIFICATE_EXPIRED: 814 return SSL3_AD_CERTIFICATE_EXPIRED; 815 case SSL_AD_CERTIFICATE_UNKNOWN: 816 return SSL3_AD_CERTIFICATE_UNKNOWN; 817 case SSL_AD_ILLEGAL_PARAMETER: 818 return SSL3_AD_ILLEGAL_PARAMETER; 819 case SSL_AD_UNKNOWN_CA: 820 return TLS1_AD_UNKNOWN_CA; 821 case SSL_AD_ACCESS_DENIED: 822 return TLS1_AD_ACCESS_DENIED; 823 case SSL_AD_DECODE_ERROR: 824 return TLS1_AD_DECODE_ERROR; 825 case SSL_AD_DECRYPT_ERROR: 826 return TLS1_AD_DECRYPT_ERROR; 827 case SSL_AD_EXPORT_RESTRICTION: 828 return TLS1_AD_EXPORT_RESTRICTION; 829 case SSL_AD_PROTOCOL_VERSION: 830 return TLS1_AD_PROTOCOL_VERSION; 831 case SSL_AD_INSUFFICIENT_SECURITY: 832 return TLS1_AD_INSUFFICIENT_SECURITY; 833 case SSL_AD_INTERNAL_ERROR: 834 return TLS1_AD_INTERNAL_ERROR; 835 case SSL_AD_USER_CANCELLED: 836 return TLS1_AD_USER_CANCELLED; 837 case SSL_AD_NO_RENEGOTIATION: 838 return TLS1_AD_NO_RENEGOTIATION; 839 case SSL_AD_UNSUPPORTED_EXTENSION: 840 return TLS1_AD_UNSUPPORTED_EXTENSION; 841 case SSL_AD_CERTIFICATE_UNOBTAINABLE: 842 return TLS1_AD_CERTIFICATE_UNOBTAINABLE; 843 case SSL_AD_UNRECOGNIZED_NAME: 844 return TLS1_AD_UNRECOGNIZED_NAME; 845 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: 846 return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; 847 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: 848 return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; 849 case SSL_AD_UNKNOWN_PSK_IDENTITY: 850 return TLS1_AD_UNKNOWN_PSK_IDENTITY; 851 case SSL_AD_INAPPROPRIATE_FALLBACK: 852 return TLS1_AD_INAPPROPRIATE_FALLBACK; 853 case SSL_AD_NO_APPLICATION_PROTOCOL: 854 return TLS1_AD_NO_APPLICATION_PROTOCOL; 855 case SSL_AD_CERTIFICATE_REQUIRED: 856 return SSL_AD_HANDSHAKE_FAILURE; 857 case TLS13_AD_MISSING_EXTENSION: 858 return SSL_AD_HANDSHAKE_FAILURE; 859 default: 860 return -1; 861 } 862 } 863
Indexes created Thu Jul 16 00:26:27 UTC 2026