| /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| * All rights reserved. |
| * |
| * This package is an SSL implementation written |
| * by Eric Young (eay@cryptsoft.com). |
| * The implementation was written so as to conform with Netscapes SSL. |
| * |
| * This library is free for commercial and non-commercial use as long as |
| * the following conditions are aheared to. The following conditions |
| * apply to all code found in this distribution, be it the RC4, RSA, |
| * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| * included with this distribution is covered by the same copyright terms |
| * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| * |
| * Copyright remains Eric Young's, and as such any Copyright notices in |
| * the code are not to be removed. |
| * If this package is used in a product, Eric Young should be given attribution |
| * as the author of the parts of the library used. |
| * This can be in the form of a textual message at program startup or |
| * in documentation (online or textual) provided with the package. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * 1. Redistributions of source code must retain the copyright |
| * notice, this list of conditions and the following disclaimer. |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in the |
| * documentation and/or other materials provided with the distribution. |
| * 3. All advertising materials mentioning features or use of this software |
| * must display the following acknowledgement: |
| * "This product includes cryptographic software written by |
| * Eric Young (eay@cryptsoft.com)" |
| * The word 'cryptographic' can be left out if the rouines from the library |
| * being used are not cryptographic related :-). |
| * 4. If you include any Windows specific code (or a derivative thereof) from |
| * the apps directory (application code) you must include an acknowledgement: |
| * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| * |
| * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| * SUCH DAMAGE. |
| * |
| * The licence and distribution terms for any publically available version or |
| * derivative of this code cannot be changed. i.e. this code cannot simply be |
| * copied and put under another distribution licence |
| * [including the GNU Public Licence.] |
| */ |
| /* ==================================================================== |
| * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * |
| * 1. Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in |
| * the documentation and/or other materials provided with the |
| * distribution. |
| * |
| * 3. All advertising materials mentioning features or use of this |
| * software must display the following acknowledgment: |
| * "This product includes software developed by the OpenSSL Project |
| * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
| * |
| * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| * endorse or promote products derived from this software without |
| * prior written permission. For written permission, please contact |
| * openssl-core@openssl.org. |
| * |
| * 5. Products derived from this software may not be called "OpenSSL" |
| * nor may "OpenSSL" appear in their names without prior written |
| * permission of the OpenSSL Project. |
| * |
| * 6. Redistributions of any form whatsoever must retain the following |
| * acknowledgment: |
| * "This product includes software developed by the OpenSSL Project |
| * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| * OF THE POSSIBILITY OF SUCH DAMAGE. |
| * ==================================================================== |
| * |
| * This product includes cryptographic software written by Eric Young |
| * (eay@cryptsoft.com). This product includes software written by Tim |
| * Hudson (tjh@cryptsoft.com). */ |
| |
| #include <openssl/ssl.h> |
| |
| #include <assert.h> |
| #include <limits.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include <utility> |
| |
| #include <openssl/bytestring.h> |
| #include <openssl/chacha.h> |
| #include <openssl/digest.h> |
| #include <openssl/err.h> |
| #include <openssl/evp.h> |
| #include <openssl/hmac.h> |
| #include <openssl/mem.h> |
| #include <openssl/nid.h> |
| #include <openssl/rand.h> |
| |
| #include "internal.h" |
| #include "../crypto/internal.h" |
| |
| |
| namespace bssl { |
| |
| static int ssl_check_clienthello_tlsext(SSL_HANDSHAKE *hs); |
| |
| static int compare_uint16_t(const void *p1, const void *p2) { |
| uint16_t u1 = *((const uint16_t *)p1); |
| uint16_t u2 = *((const uint16_t *)p2); |
| if (u1 < u2) { |
| return -1; |
| } else if (u1 > u2) { |
| return 1; |
| } else { |
| return 0; |
| } |
| } |
| |
| // Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be |
| // more than one extension of the same type in a ClientHello or ServerHello. |
| // This function does an initial scan over the extensions block to filter those |
| // out. |
| static int tls1_check_duplicate_extensions(const CBS *cbs) { |
| // First pass: count the extensions. |
| size_t num_extensions = 0; |
| CBS extensions = *cbs; |
| while (CBS_len(&extensions) > 0) { |
| uint16_t type; |
| CBS extension; |
| |
| if (!CBS_get_u16(&extensions, &type) || |
| !CBS_get_u16_length_prefixed(&extensions, &extension)) { |
| return 0; |
| } |
| |
| num_extensions++; |
| } |
| |
| if (num_extensions == 0) { |
| return 1; |
| } |
| |
| Array<uint16_t> extension_types; |
| if (!extension_types.Init(num_extensions)) { |
| return 0; |
| } |
| |
| // Second pass: gather the extension types. |
| extensions = *cbs; |
| for (size_t i = 0; i < extension_types.size(); i++) { |
| CBS extension; |
| |
| if (!CBS_get_u16(&extensions, &extension_types[i]) || |
| !CBS_get_u16_length_prefixed(&extensions, &extension)) { |
| // This should not happen. |
| return 0; |
| } |
| } |
| assert(CBS_len(&extensions) == 0); |
| |
| // Sort the extensions and make sure there are no duplicates. |
| qsort(extension_types.data(), extension_types.size(), sizeof(uint16_t), |
| compare_uint16_t); |
| for (size_t i = 1; i < num_extensions; i++) { |
| if (extension_types[i - 1] == extension_types[i]) { |
| return 0; |
| } |
| } |
| |
| return 1; |
| } |
| |
| int ssl_client_hello_init(SSL *ssl, SSL_CLIENT_HELLO *out, |
| const SSLMessage &msg) { |
| OPENSSL_memset(out, 0, sizeof(*out)); |
| out->ssl = ssl; |
| out->client_hello = CBS_data(&msg.body); |
| out->client_hello_len = CBS_len(&msg.body); |
| |
| CBS client_hello, random, session_id; |
| CBS_init(&client_hello, out->client_hello, out->client_hello_len); |
| if (!CBS_get_u16(&client_hello, &out->version) || |
| !CBS_get_bytes(&client_hello, &random, SSL3_RANDOM_SIZE) || |
| !CBS_get_u8_length_prefixed(&client_hello, &session_id) || |
| CBS_len(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) { |
| return 0; |
| } |
| |
| out->random = CBS_data(&random); |
| out->random_len = CBS_len(&random); |
| out->session_id = CBS_data(&session_id); |
| out->session_id_len = CBS_len(&session_id); |
| |
| // Skip past DTLS cookie |
| if (SSL_is_dtls(out->ssl)) { |
| CBS cookie; |
| if (!CBS_get_u8_length_prefixed(&client_hello, &cookie) || |
| CBS_len(&cookie) > DTLS1_COOKIE_LENGTH) { |
| return 0; |
| } |
| } |
| |
| CBS cipher_suites, compression_methods; |
| if (!CBS_get_u16_length_prefixed(&client_hello, &cipher_suites) || |
| CBS_len(&cipher_suites) < 2 || (CBS_len(&cipher_suites) & 1) != 0 || |
| !CBS_get_u8_length_prefixed(&client_hello, &compression_methods) || |
| CBS_len(&compression_methods) < 1) { |
| return 0; |
| } |
| |
| out->cipher_suites = CBS_data(&cipher_suites); |
| out->cipher_suites_len = CBS_len(&cipher_suites); |
| out->compression_methods = CBS_data(&compression_methods); |
| out->compression_methods_len = CBS_len(&compression_methods); |
| |
| // If the ClientHello ends here then it's valid, but doesn't have any |
| // extensions. (E.g. SSLv3.) |
| if (CBS_len(&client_hello) == 0) { |
| out->extensions = NULL; |
| out->extensions_len = 0; |
| return 1; |
| } |
| |
| // Extract extensions and check it is valid. |
| CBS extensions; |
| if (!CBS_get_u16_length_prefixed(&client_hello, &extensions) || |
| !tls1_check_duplicate_extensions(&extensions) || |
| CBS_len(&client_hello) != 0) { |
| return 0; |
| } |
| |
| out->extensions = CBS_data(&extensions); |
| out->extensions_len = CBS_len(&extensions); |
| |
| return 1; |
| } |
| |
| int ssl_client_hello_get_extension(const SSL_CLIENT_HELLO *client_hello, |
| CBS *out, uint16_t extension_type) { |
| CBS extensions; |
| CBS_init(&extensions, client_hello->extensions, client_hello->extensions_len); |
| while (CBS_len(&extensions) != 0) { |
| // Decode the next extension. |
| uint16_t type; |
| CBS extension; |
| if (!CBS_get_u16(&extensions, &type) || |
| !CBS_get_u16_length_prefixed(&extensions, &extension)) { |
| return 0; |
| } |
| |
| if (type == extension_type) { |
| *out = extension; |
| return 1; |
| } |
| } |
| |
| return 0; |
| } |
| |
| static const uint16_t kDefaultGroups[] = { |
| SSL_CURVE_X25519, |
| SSL_CURVE_SECP256R1, |
| SSL_CURVE_SECP384R1, |
| }; |
| |
| Span<const uint16_t> tls1_get_grouplist(const SSL *ssl) { |
| if (ssl->supported_group_list != nullptr) { |
| return MakeConstSpan(ssl->supported_group_list, |
| ssl->supported_group_list_len); |
| } |
| return Span<const uint16_t>(kDefaultGroups); |
| } |
| |
| int tls1_get_shared_group(SSL_HANDSHAKE *hs, uint16_t *out_group_id) { |
| SSL *const ssl = hs->ssl; |
| assert(ssl->server); |
| |
| // Clients are not required to send a supported_groups extension. In this |
| // case, the server is free to pick any group it likes. See RFC 4492, |
| // section 4, paragraph 3. |
| // |
| // However, in the interests of compatibility, we will skip ECDH if the |
| // client didn't send an extension because we can't be sure that they'll |
| // support our favoured group. Thus we do not special-case an emtpy |
| // |peer_supported_group_list|. |
| |
| Span<const uint16_t> groups = tls1_get_grouplist(ssl); |
| Span<const uint16_t> pref, supp; |
| if (ssl->options & SSL_OP_CIPHER_SERVER_PREFERENCE) { |
| pref = groups; |
| supp = hs->peer_supported_group_list; |
| } else { |
| pref = hs->peer_supported_group_list; |
| supp = groups; |
| } |
| |
| for (uint16_t pref_group : pref) { |
| for (uint16_t supp_group : supp) { |
| if (pref_group == supp_group) { |
| *out_group_id = pref_group; |
| return 1; |
| } |
| } |
| } |
| |
| return 0; |
| } |
| |
| int tls1_set_curves(uint16_t **out_group_ids, size_t *out_group_ids_len, |
| const int *curves, size_t ncurves) { |
| uint16_t *group_ids = (uint16_t *)OPENSSL_malloc(ncurves * sizeof(uint16_t)); |
| if (group_ids == NULL) { |
| return 0; |
| } |
| |
| for (size_t i = 0; i < ncurves; i++) { |
| if (!ssl_nid_to_group_id(&group_ids[i], curves[i])) { |
| OPENSSL_free(group_ids); |
| return 0; |
| } |
| } |
| |
| OPENSSL_free(*out_group_ids); |
| *out_group_ids = group_ids; |
| *out_group_ids_len = ncurves; |
| |
| return 1; |
| } |
| |
| int tls1_set_curves_list(uint16_t **out_group_ids, size_t *out_group_ids_len, |
| const char *curves) { |
| uint16_t *group_ids = NULL; |
| size_t ncurves = 0; |
| |
| const char *col; |
| const char *ptr = curves; |
| |
| do { |
| col = strchr(ptr, ':'); |
| |
| uint16_t group_id; |
| if (!ssl_name_to_group_id(&group_id, ptr, |
| col ? (size_t)(col - ptr) : strlen(ptr))) { |
| goto err; |
| } |
| |
| uint16_t *new_group_ids = (uint16_t *)OPENSSL_realloc( |
| group_ids, (ncurves + 1) * sizeof(uint16_t)); |
| if (new_group_ids == NULL) { |
| goto err; |
| } |
| group_ids = new_group_ids; |
| |
| group_ids[ncurves] = group_id; |
| ncurves++; |
| |
| if (col) { |
| ptr = col + 1; |
| } |
| } while (col); |
| |
| OPENSSL_free(*out_group_ids); |
| *out_group_ids = group_ids; |
| *out_group_ids_len = ncurves; |
| |
| return 1; |
| |
| err: |
| OPENSSL_free(group_ids); |
| return 0; |
| } |
| |
| int tls1_check_group_id(const SSL *ssl, uint16_t group_id) { |
| for (uint16_t supported : tls1_get_grouplist(ssl)) { |
| if (supported == group_id) { |
| return 1; |
| } |
| } |
| |
| return 0; |
| } |
| |
| // kVerifySignatureAlgorithms is the default list of accepted signature |
| // algorithms for verifying. |
| // |
| // For now, RSA-PSS signature algorithms are not enabled on Android's system |
| // BoringSSL. Once the change in Chrome has stuck and the values are finalized, |
| // restore them. |
| static const uint16_t kVerifySignatureAlgorithms[] = { |
| // List our preferred algorithms first. |
| SSL_SIGN_ED25519, |
| SSL_SIGN_ECDSA_SECP256R1_SHA256, |
| SSL_SIGN_RSA_PSS_SHA256, |
| SSL_SIGN_RSA_PKCS1_SHA256, |
| |
| // Larger hashes are acceptable. |
| SSL_SIGN_ECDSA_SECP384R1_SHA384, |
| SSL_SIGN_RSA_PSS_SHA384, |
| SSL_SIGN_RSA_PKCS1_SHA384, |
| |
| SSL_SIGN_RSA_PSS_SHA512, |
| SSL_SIGN_RSA_PKCS1_SHA512, |
| |
| // For now, SHA-1 is still accepted but least preferable. |
| SSL_SIGN_RSA_PKCS1_SHA1, |
| |
| }; |
| |
| // kSignSignatureAlgorithms is the default list of supported signature |
| // algorithms for signing. |
| // |
| // For now, RSA-PSS signature algorithms are not enabled on Android's system |
| // BoringSSL. Once the change in Chrome has stuck and the values are finalized, |
| // restore them. |
| static const uint16_t kSignSignatureAlgorithms[] = { |
| // List our preferred algorithms first. |
| SSL_SIGN_ED25519, |
| SSL_SIGN_ECDSA_SECP256R1_SHA256, |
| SSL_SIGN_RSA_PSS_SHA256, |
| SSL_SIGN_RSA_PKCS1_SHA256, |
| |
| // If needed, sign larger hashes. |
| // |
| // TODO(davidben): Determine which of these may be pruned. |
| SSL_SIGN_ECDSA_SECP384R1_SHA384, |
| SSL_SIGN_RSA_PSS_SHA384, |
| SSL_SIGN_RSA_PKCS1_SHA384, |
| |
| SSL_SIGN_ECDSA_SECP521R1_SHA512, |
| SSL_SIGN_RSA_PSS_SHA512, |
| SSL_SIGN_RSA_PKCS1_SHA512, |
| |
| // If the peer supports nothing else, sign with SHA-1. |
| SSL_SIGN_ECDSA_SHA1, |
| SSL_SIGN_RSA_PKCS1_SHA1, |
| }; |
| |
| bool tls12_add_verify_sigalgs(const SSL *ssl, CBB *out) { |
| bool use_default = ssl->ctx->num_verify_sigalgs == 0; |
| Span<const uint16_t> sigalgs = kVerifySignatureAlgorithms; |
| if (!use_default) { |
| sigalgs = MakeConstSpan(ssl->ctx->verify_sigalgs, |
| ssl->ctx->num_verify_sigalgs); |
| } |
| |
| for (uint16_t sigalg : sigalgs) { |
| if (use_default && |
| sigalg == SSL_SIGN_ED25519 && |
| !ssl->ctx->ed25519_enabled) { |
| continue; |
| } |
| if (!CBB_add_u16(out, sigalg)) { |
| return false; |
| } |
| } |
| |
| return true; |
| } |
| |
| bool tls12_check_peer_sigalg(const SSL *ssl, uint8_t *out_alert, |
| uint16_t sigalg) { |
| const uint16_t *sigalgs = kVerifySignatureAlgorithms; |
| size_t num_sigalgs = OPENSSL_ARRAY_SIZE(kVerifySignatureAlgorithms); |
| if (ssl->ctx->num_verify_sigalgs != 0) { |
| sigalgs = ssl->ctx->verify_sigalgs; |
| num_sigalgs = ssl->ctx->num_verify_sigalgs; |
| } |
| |
| for (size_t i = 0; i < num_sigalgs; i++) { |
| if (sigalgs == kVerifySignatureAlgorithms && |
| sigalgs[i] == SSL_SIGN_ED25519 && |
| !ssl->ctx->ed25519_enabled) { |
| continue; |
| } |
| if (sigalg == sigalgs[i]) { |
| return true; |
| } |
| } |
| |
| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // tls_extension represents a TLS extension that is handled internally. The |
| // |init| function is called for each handshake, before any other functions of |
| // the extension. Then the add and parse callbacks are called as needed. |
| // |
| // The parse callbacks receive a |CBS| that contains the contents of the |
| // extension (i.e. not including the type and length bytes). If an extension is |
| // not received then the parse callbacks will be called with a NULL CBS so that |
| // they can do any processing needed to handle the absence of an extension. |
| // |
| // The add callbacks receive a |CBB| to which the extension can be appended but |
| // the function is responsible for appending the type and length bytes too. |
| // |
| // All callbacks return true for success and false for error. If a parse |
| // function returns zero then a fatal alert with value |*out_alert| will be |
| // sent. If |*out_alert| isn't set, then a |decode_error| alert will be sent. |
| struct tls_extension { |
| uint16_t value; |
| void (*init)(SSL_HANDSHAKE *hs); |
| |
| bool (*add_clienthello)(SSL_HANDSHAKE *hs, CBB *out); |
| bool (*parse_serverhello)(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents); |
| |
| bool (*parse_clienthello)(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents); |
| bool (*add_serverhello)(SSL_HANDSHAKE *hs, CBB *out); |
| }; |
| |
| static bool forbid_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents != NULL) { |
| // Servers MUST NOT send this extension. |
| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ignore_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| // This extension from the client is handled elsewhere. |
| return true; |
| } |
| |
| static bool dont_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| return true; |
| } |
| |
| // Server name indication (SNI). |
| // |
| // https://tools.ietf.org/html/rfc6066#section-3. |
| |
| static bool ext_sni_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->tlsext_hostname == NULL) { |
| return true; |
| } |
| |
| CBB contents, server_name_list, name; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &server_name_list) || |
| !CBB_add_u8(&server_name_list, TLSEXT_NAMETYPE_host_name) || |
| !CBB_add_u16_length_prefixed(&server_name_list, &name) || |
| !CBB_add_bytes(&name, (const uint8_t *)ssl->tlsext_hostname, |
| strlen(ssl->tlsext_hostname)) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sni_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| // The server may acknowledge SNI with an empty extension. We check the syntax |
| // but otherwise ignore this signal. |
| return contents == NULL || CBS_len(contents) == 0; |
| } |
| |
| static bool ext_sni_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS server_name_list, host_name; |
| uint8_t name_type; |
| if (!CBS_get_u16_length_prefixed(contents, &server_name_list) || |
| !CBS_get_u8(&server_name_list, &name_type) || |
| // Although the server_name extension was intended to be extensible to |
| // new name types and multiple names, OpenSSL 1.0.x had a bug which meant |
| // different name types will cause an error. Further, RFC 4366 originally |
| // defined syntax inextensibly. RFC 6066 corrected this mistake, but |
| // adding new name types is no longer feasible. |
| // |
| // Act as if the extensibility does not exist to simplify parsing. |
| !CBS_get_u16_length_prefixed(&server_name_list, &host_name) || |
| CBS_len(&server_name_list) != 0 || |
| CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| if (name_type != TLSEXT_NAMETYPE_host_name || |
| CBS_len(&host_name) == 0 || |
| CBS_len(&host_name) > TLSEXT_MAXLEN_host_name || |
| CBS_contains_zero_byte(&host_name)) { |
| *out_alert = SSL_AD_UNRECOGNIZED_NAME; |
| return false; |
| } |
| |
| // Copy the hostname as a string. |
| char *raw = nullptr; |
| if (!CBS_strdup(&host_name, &raw)) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| ssl->s3->hostname.reset(raw); |
| |
| hs->should_ack_sni = true; |
| return true; |
| } |
| |
| static bool ext_sni_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (hs->ssl->s3->session_reused || |
| !hs->should_ack_sni) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Renegotiation indication. |
| // |
| // https://tools.ietf.org/html/rfc5746 |
| |
| static bool ext_ri_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // Renegotiation indication is not necessary in TLS 1.3. |
| if (hs->min_version >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| assert(ssl->s3->initial_handshake_complete == |
| (ssl->s3->previous_client_finished_len != 0)); |
| |
| CBB contents, prev_finished; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &prev_finished) || |
| !CBB_add_bytes(&prev_finished, ssl->s3->previous_client_finished, |
| ssl->s3->previous_client_finished_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ri_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents != NULL && ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // Servers may not switch between omitting the extension and supporting it. |
| // See RFC 5746, sections 3.5 and 4.2. |
| if (ssl->s3->initial_handshake_complete && |
| (contents != NULL) != ssl->s3->send_connection_binding) { |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| return false; |
| } |
| |
| if (contents == NULL) { |
| // Strictly speaking, if we want to avoid an attack we should *always* see |
| // RI even on initial ServerHello because the client doesn't see any |
| // renegotiation during an attack. However this would mean we could not |
| // connect to any server which doesn't support RI. |
| // |
| // OpenSSL has |SSL_OP_LEGACY_SERVER_CONNECT| to control this, but in |
| // practical terms every client sets it so it's just assumed here. |
| return true; |
| } |
| |
| const size_t expected_len = ssl->s3->previous_client_finished_len + |
| ssl->s3->previous_server_finished_len; |
| |
| // Check for logic errors |
| assert(!expected_len || ssl->s3->previous_client_finished_len); |
| assert(!expected_len || ssl->s3->previous_server_finished_len); |
| assert(ssl->s3->initial_handshake_complete == |
| (ssl->s3->previous_client_finished_len != 0)); |
| assert(ssl->s3->initial_handshake_complete == |
| (ssl->s3->previous_server_finished_len != 0)); |
| |
| // Parse out the extension contents. |
| CBS renegotiated_connection; |
| if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // Check that the extension matches. |
| if (CBS_len(&renegotiated_connection) != expected_len) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| |
| const uint8_t *d = CBS_data(&renegotiated_connection); |
| bool ok = CRYPTO_memcmp(d, ssl->s3->previous_client_finished, |
| ssl->s3->previous_client_finished_len) == 0; |
| #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) |
| ok = true; |
| #endif |
| if (!ok) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| d += ssl->s3->previous_client_finished_len; |
| |
| ok = CRYPTO_memcmp(d, ssl->s3->previous_server_finished, |
| ssl->s3->previous_server_finished_len) == 0; |
| #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) |
| ok = true; |
| #endif |
| if (!ok) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| ssl->s3->send_connection_binding = true; |
| |
| return true; |
| } |
| |
| static bool ext_ri_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| // Renegotiation isn't supported as a server so this function should never be |
| // called after the initial handshake. |
| assert(!ssl->s3->initial_handshake_complete); |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS renegotiated_connection; |
| if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR); |
| return false; |
| } |
| |
| // Check that the extension matches. We do not support renegotiation as a |
| // server, so this must be empty. |
| if (CBS_len(&renegotiated_connection) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| |
| ssl->s3->send_connection_binding = true; |
| |
| return true; |
| } |
| |
| static bool ext_ri_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // Renegotiation isn't supported as a server so this function should never be |
| // called after the initial handshake. |
| assert(!ssl->s3->initial_handshake_complete); |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) || |
| !CBB_add_u16(out, 1 /* length */) || |
| !CBB_add_u8(out, 0 /* empty renegotiation info */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Extended Master Secret. |
| // |
| // https://tools.ietf.org/html/rfc7627 |
| |
| static bool ext_ems_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| // Extended master secret is not necessary in TLS 1.3. |
| if (hs->min_version >= TLS1_3_VERSION || hs->max_version <= SSL3_VERSION) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ems_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| |
| if (contents != NULL) { |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || |
| ssl->version == SSL3_VERSION || |
| CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->extended_master_secret = true; |
| } |
| |
| // Whether EMS is negotiated may not change on renegotiation. |
| if (ssl->s3->established_session != nullptr && |
| hs->extended_master_secret != |
| !!ssl->s3->established_session->extended_master_secret) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_EMS_MISMATCH); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ems_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| uint16_t version = ssl_protocol_version(hs->ssl); |
| if (version >= TLS1_3_VERSION || |
| version == SSL3_VERSION) { |
| return true; |
| } |
| |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->extended_master_secret = true; |
| return true; |
| } |
| |
| static bool ext_ems_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->extended_master_secret) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Session tickets. |
| // |
| // https://tools.ietf.org/html/rfc5077 |
| |
| static bool ext_ticket_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // TLS 1.3 uses a different ticket extension. |
| if (hs->min_version >= TLS1_3_VERSION || |
| SSL_get_options(ssl) & SSL_OP_NO_TICKET) { |
| return true; |
| } |
| |
| const uint8_t *ticket_data = NULL; |
| int ticket_len = 0; |
| |
| // Renegotiation does not participate in session resumption. However, still |
| // advertise the extension to avoid potentially breaking servers which carry |
| // over the state from the previous handshake, such as OpenSSL servers |
| // without upstream's 3c3f0259238594d77264a78944d409f2127642c4. |
| if (!ssl->s3->initial_handshake_complete && |
| ssl->session != NULL && |
| ssl->session->tlsext_tick != NULL && |
| // Don't send TLS 1.3 session tickets in the ticket extension. |
| ssl_session_protocol_version(ssl->session) < TLS1_3_VERSION) { |
| ticket_data = ssl->session->tlsext_tick; |
| ticket_len = ssl->session->tlsext_ticklen; |
| } |
| |
| CBB ticket; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) || |
| !CBB_add_u16_length_prefixed(out, &ticket) || |
| !CBB_add_bytes(&ticket, ticket_data, ticket_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ticket_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| // If |SSL_OP_NO_TICKET| is set then no extension will have been sent and |
| // this function should never be called, even if the server tries to send the |
| // extension. |
| assert((SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0); |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->ticket_expected = true; |
| return true; |
| } |
| |
| static bool ext_ticket_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->ticket_expected) { |
| return true; |
| } |
| |
| // If |SSL_OP_NO_TICKET| is set, |ticket_expected| should never be true. |
| assert((SSL_get_options(hs->ssl) & SSL_OP_NO_TICKET) == 0); |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Signature Algorithms. |
| // |
| // https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 |
| |
| static bool ext_sigalgs_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version < TLS1_2_VERSION) { |
| return true; |
| } |
| |
| CBB contents, sigalgs_cbb; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_signature_algorithms) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &sigalgs_cbb) || |
| !tls12_add_verify_sigalgs(ssl, &sigalgs_cbb) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sigalgs_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| hs->peer_sigalgs.Reset(); |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS supported_signature_algorithms; |
| if (!CBS_get_u16_length_prefixed(contents, &supported_signature_algorithms) || |
| CBS_len(contents) != 0 || |
| CBS_len(&supported_signature_algorithms) == 0 || |
| !tls1_parse_peer_sigalgs(hs, &supported_signature_algorithms)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // OCSP Stapling. |
| // |
| // https://tools.ietf.org/html/rfc6066#section-8 |
| |
| static bool ext_ocsp_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->ocsp_stapling_enabled) { |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_status_request) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8(&contents, TLSEXT_STATUSTYPE_ocsp) || |
| !CBB_add_u16(&contents, 0 /* empty responder ID list */) || |
| !CBB_add_u16(&contents, 0 /* empty request extensions */) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ocsp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // TLS 1.3 OCSP responses are included in the Certificate extensions. |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| // OCSP stapling is forbidden on non-certificate ciphers. |
| if (CBS_len(contents) != 0 || |
| !ssl_cipher_uses_certificate_auth(hs->new_cipher)) { |
| return false; |
| } |
| |
| // Note this does not check for resumption in TLS 1.2. Sending |
| // status_request here does not make sense, but OpenSSL does so and the |
| // specification does not say anything. Tolerate it but ignore it. |
| |
| hs->certificate_status_expected = true; |
| return true; |
| } |
| |
| static bool ext_ocsp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| uint8_t status_type; |
| if (!CBS_get_u8(contents, &status_type)) { |
| return false; |
| } |
| |
| // We cannot decide whether OCSP stapling will occur yet because the correct |
| // SSL_CTX might not have been selected. |
| hs->ocsp_stapling_requested = status_type == TLSEXT_STATUSTYPE_ocsp; |
| |
| return true; |
| } |
| |
| static bool ext_ocsp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || |
| !hs->ocsp_stapling_requested || |
| ssl->cert->ocsp_response == NULL || |
| ssl->s3->session_reused || |
| !ssl_cipher_uses_certificate_auth(hs->new_cipher)) { |
| return true; |
| } |
| |
| hs->certificate_status_expected = true; |
| |
| return CBB_add_u16(out, TLSEXT_TYPE_status_request) && |
| CBB_add_u16(out, 0 /* length */); |
| } |
| |
| |
| // Next protocol negotiation. |
| // |
| // https://htmlpreview.github.io/?https://github.com/agl/technotes/blob/master/nextprotoneg.html |
| |
| static bool ext_npn_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->s3->initial_handshake_complete || |
| ssl->ctx->next_proto_select_cb == NULL || |
| SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_npn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| // If any of these are false then we should never have sent the NPN |
| // extension in the ClientHello and thus this function should never have been |
| // called. |
| assert(!ssl->s3->initial_handshake_complete); |
| assert(!SSL_is_dtls(ssl)); |
| assert(ssl->ctx->next_proto_select_cb != NULL); |
| |
| if (!ssl->s3->alpn_selected.empty()) { |
| // NPN and ALPN may not be negotiated in the same connection. |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN); |
| return false; |
| } |
| |
| const uint8_t *const orig_contents = CBS_data(contents); |
| const size_t orig_len = CBS_len(contents); |
| |
| while (CBS_len(contents) != 0) { |
| CBS proto; |
| if (!CBS_get_u8_length_prefixed(contents, &proto) || |
| CBS_len(&proto) == 0) { |
| return false; |
| } |
| } |
| |
| uint8_t *selected; |
| uint8_t selected_len; |
| if (ssl->ctx->next_proto_select_cb( |
| ssl, &selected, &selected_len, orig_contents, orig_len, |
| ssl->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK || |
| !ssl->s3->next_proto_negotiated.CopyFrom( |
| MakeConstSpan(selected, selected_len))) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| |
| hs->next_proto_neg_seen = true; |
| return true; |
| } |
| |
| static bool ext_npn_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (contents != NULL && CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| if (contents == NULL || |
| ssl->s3->initial_handshake_complete || |
| ssl->ctx->next_protos_advertised_cb == NULL || |
| SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| hs->next_proto_neg_seen = true; |
| return true; |
| } |
| |
| static bool ext_npn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // |next_proto_neg_seen| might have been cleared when an ALPN extension was |
| // parsed. |
| if (!hs->next_proto_neg_seen) { |
| return true; |
| } |
| |
| const uint8_t *npa; |
| unsigned npa_len; |
| |
| if (ssl->ctx->next_protos_advertised_cb( |
| ssl, &npa, &npa_len, ssl->ctx->next_protos_advertised_cb_arg) != |
| SSL_TLSEXT_ERR_OK) { |
| hs->next_proto_neg_seen = false; |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_bytes(&contents, npa, npa_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Signed certificate timestamps. |
| // |
| // https://tools.ietf.org/html/rfc6962#section-3.3.1 |
| |
| static bool ext_sct_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->signed_cert_timestamps_enabled) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_certificate_timestamp) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sct_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // TLS 1.3 SCTs are included in the Certificate extensions. |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // If this is false then we should never have sent the SCT extension in the |
| // ClientHello and thus this function should never have been called. |
| assert(ssl->signed_cert_timestamps_enabled); |
| |
| if (!ssl_is_sct_list_valid(contents)) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // Session resumption uses the original session information. The extension |
| // should not be sent on resumption, but RFC 6962 did not make it a |
| // requirement, so tolerate this. |
| // |
| // TODO(davidben): Enforce this anyway. |
| if (!ssl->s3->session_reused) { |
| CRYPTO_BUFFER_free(hs->new_session->signed_cert_timestamp_list); |
| hs->new_session->signed_cert_timestamp_list = |
| CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool); |
| if (hs->new_session->signed_cert_timestamp_list == nullptr) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| } |
| |
| return true; |
| } |
| |
| static bool ext_sct_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| hs->scts_requested = true; |
| return true; |
| } |
| |
| static bool ext_sct_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| // The extension shouldn't be sent when resuming sessions. |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || |
| ssl->s3->session_reused || |
| ssl->cert->signed_cert_timestamp_list == NULL) { |
| return true; |
| } |
| |
| CBB contents; |
| return CBB_add_u16(out, TLSEXT_TYPE_certificate_timestamp) && |
| CBB_add_u16_length_prefixed(out, &contents) && |
| CBB_add_bytes( |
| &contents, |
| CRYPTO_BUFFER_data(ssl->cert->signed_cert_timestamp_list), |
| CRYPTO_BUFFER_len(ssl->cert->signed_cert_timestamp_list)) && |
| CBB_flush(out); |
| } |
| |
| |
| // Application-level Protocol Negotiation. |
| // |
| // https://tools.ietf.org/html/rfc7301 |
| |
| static bool ext_alpn_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->alpn_client_proto_list == NULL || |
| ssl->s3->initial_handshake_complete) { |
| return true; |
| } |
| |
| CBB contents, proto_list; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_application_layer_protocol_negotiation) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &proto_list) || |
| !CBB_add_bytes(&proto_list, ssl->alpn_client_proto_list, |
| ssl->alpn_client_proto_list_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_alpn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| assert(!ssl->s3->initial_handshake_complete); |
| assert(ssl->alpn_client_proto_list != NULL); |
| |
| if (hs->next_proto_neg_seen) { |
| // NPN and ALPN may not be negotiated in the same connection. |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN); |
| return false; |
| } |
| |
| // The extension data consists of a ProtocolNameList which must have |
| // exactly one ProtocolName. Each of these is length-prefixed. |
| CBS protocol_name_list, protocol_name; |
| if (!CBS_get_u16_length_prefixed(contents, &protocol_name_list) || |
| CBS_len(contents) != 0 || |
| !CBS_get_u8_length_prefixed(&protocol_name_list, &protocol_name) || |
| // Empty protocol names are forbidden. |
| CBS_len(&protocol_name) == 0 || |
| CBS_len(&protocol_name_list) != 0) { |
| return false; |
| } |
| |
| if (!ssl_is_alpn_protocol_allowed(ssl, protocol_name)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| if (!ssl->s3->alpn_selected.CopyFrom(protocol_name)) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool ssl_is_alpn_protocol_allowed(const SSL *ssl, |
| Span<const uint8_t> protocol) { |
| if (ssl->alpn_client_proto_list == nullptr) { |
| return false; |
| } |
| |
| if (ssl->ctx->allow_unknown_alpn_protos) { |
| return true; |
| } |
| |
| // Check that the protocol name is one of the ones we advertised. |
| CBS client_protocol_name_list, client_protocol_name; |
| CBS_init(&client_protocol_name_list, ssl->alpn_client_proto_list, |
| ssl->alpn_client_proto_list_len); |
| while (CBS_len(&client_protocol_name_list) > 0) { |
| if (!CBS_get_u8_length_prefixed(&client_protocol_name_list, |
| &client_protocol_name)) { |
| return false; |
| } |
| |
| if (client_protocol_name == protocol) { |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| bool ssl_negotiate_alpn(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| const SSL_CLIENT_HELLO *client_hello) { |
| SSL *const ssl = hs->ssl; |
| CBS contents; |
| if (ssl->ctx->alpn_select_cb == NULL || |
| !ssl_client_hello_get_extension( |
| client_hello, &contents, |
| TLSEXT_TYPE_application_layer_protocol_negotiation)) { |
| // Ignore ALPN if not configured or no extension was supplied. |
| return true; |
| } |
| |
| // ALPN takes precedence over NPN. |
| hs->next_proto_neg_seen = false; |
| |
| CBS protocol_name_list; |
| if (!CBS_get_u16_length_prefixed(&contents, &protocol_name_list) || |
| CBS_len(&contents) != 0 || |
| CBS_len(&protocol_name_list) < 2) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // Validate the protocol list. |
| CBS protocol_name_list_copy = protocol_name_list; |
| while (CBS_len(&protocol_name_list_copy) > 0) { |
| CBS protocol_name; |
| |
| if (!CBS_get_u8_length_prefixed(&protocol_name_list_copy, &protocol_name) || |
| // Empty protocol names are forbidden. |
| CBS_len(&protocol_name) == 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| } |
| |
| const uint8_t *selected; |
| uint8_t selected_len; |
| if (ssl->ctx->alpn_select_cb( |
| ssl, &selected, &selected_len, CBS_data(&protocol_name_list), |
| CBS_len(&protocol_name_list), |
| ssl->ctx->alpn_select_cb_arg) == SSL_TLSEXT_ERR_OK) { |
| if (!ssl->s3->alpn_selected.CopyFrom( |
| MakeConstSpan(selected, selected_len))) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| } |
| |
| return true; |
| } |
| |
| static bool ext_alpn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->s3->alpn_selected.empty()) { |
| return true; |
| } |
| |
| CBB contents, proto_list, proto; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_application_layer_protocol_negotiation) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &proto_list) || |
| !CBB_add_u8_length_prefixed(&proto_list, &proto) || |
| !CBB_add_bytes(&proto, ssl->s3->alpn_selected.data(), |
| ssl->s3->alpn_selected.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Channel ID. |
| // |
| // https://tools.ietf.org/html/draft-balfanz-tls-channelid-01 |
| |
| static void ext_channel_id_init(SSL_HANDSHAKE *hs) { |
| hs->ssl->s3->tlsext_channel_id_valid = false; |
| } |
| |
| static bool ext_channel_id_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->tlsext_channel_id_enabled || |
| SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_channel_id_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| assert(!SSL_is_dtls(ssl)); |
| assert(ssl->tlsext_channel_id_enabled); |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| ssl->s3->tlsext_channel_id_valid = true; |
| return true; |
| } |
| |
| static bool ext_channel_id_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL || |
| !ssl->tlsext_channel_id_enabled || |
| SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| ssl->s3->tlsext_channel_id_valid = true; |
| return true; |
| } |
| |
| static bool ext_channel_id_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->s3->tlsext_channel_id_valid) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) || |
| !CBB_add_u16(out, 0 /* length */)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Secure Real-time Transport Protocol (SRTP) extension. |
| // |
| // https://tools.ietf.org/html/rfc5764 |
| |
| |
| static void ext_srtp_init(SSL_HANDSHAKE *hs) { |
| hs->ssl->srtp_profile = NULL; |
| } |
| |
| static bool ext_srtp_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = SSL_get_srtp_profiles(ssl); |
| if (profiles == NULL || |
| sk_SRTP_PROTECTION_PROFILE_num(profiles) == 0) { |
| return true; |
| } |
| |
| CBB contents, profile_ids; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_srtp) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &profile_ids)) { |
| return false; |
| } |
| |
| for (const SRTP_PROTECTION_PROFILE *profile : profiles) { |
| if (!CBB_add_u16(&profile_ids, profile->id)) { |
| return false; |
| } |
| } |
| |
| if (!CBB_add_u8(&contents, 0 /* empty use_mki value */) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_srtp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| // The extension consists of a u16-prefixed profile ID list containing a |
| // single uint16_t profile ID, then followed by a u8-prefixed srtp_mki field. |
| // |
| // See https://tools.ietf.org/html/rfc5764#section-4.1.1 |
| CBS profile_ids, srtp_mki; |
| uint16_t profile_id; |
| if (!CBS_get_u16_length_prefixed(contents, &profile_ids) || |
| !CBS_get_u16(&profile_ids, &profile_id) || |
| CBS_len(&profile_ids) != 0 || |
| !CBS_get_u8_length_prefixed(contents, &srtp_mki) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); |
| return false; |
| } |
| |
| if (CBS_len(&srtp_mki) != 0) { |
| // Must be no MKI, since we never offer one. |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_MKI_VALUE); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = SSL_get_srtp_profiles(ssl); |
| |
| // Check to see if the server gave us something we support (and presumably |
| // offered). |
| for (const SRTP_PROTECTION_PROFILE *profile : profiles) { |
| if (profile->id == profile_id) { |
| ssl->srtp_profile = profile; |
| return true; |
| } |
| } |
| |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| static bool ext_srtp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS profile_ids, srtp_mki; |
| if (!CBS_get_u16_length_prefixed(contents, &profile_ids) || |
| CBS_len(&profile_ids) < 2 || |
| !CBS_get_u8_length_prefixed(contents, &srtp_mki) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); |
| return false; |
| } |
| // Discard the MKI value for now. |
| |
| const STACK_OF(SRTP_PROTECTION_PROFILE) *server_profiles = |
| SSL_get_srtp_profiles(ssl); |
| |
| // Pick the server's most preferred profile. |
| for (const SRTP_PROTECTION_PROFILE *server_profile : server_profiles) { |
| CBS profile_ids_tmp; |
| CBS_init(&profile_ids_tmp, CBS_data(&profile_ids), CBS_len(&profile_ids)); |
| |
| while (CBS_len(&profile_ids_tmp) > 0) { |
| uint16_t profile_id; |
| if (!CBS_get_u16(&profile_ids_tmp, &profile_id)) { |
| return false; |
| } |
| |
| if (server_profile->id == profile_id) { |
| ssl->srtp_profile = server_profile; |
| return true; |
| } |
| } |
| } |
| |
| return true; |
| } |
| |
| static bool ext_srtp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->srtp_profile == NULL) { |
| return true; |
| } |
| |
| CBB contents, profile_ids; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_srtp) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &profile_ids) || |
| !CBB_add_u16(&profile_ids, ssl->srtp_profile->id) || |
| !CBB_add_u8(&contents, 0 /* empty MKI */) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // EC point formats. |
| // |
| // https://tools.ietf.org/html/rfc4492#section-5.1.2 |
| |
| static bool ext_ec_point_add_extension(SSL_HANDSHAKE *hs, CBB *out) { |
| CBB contents, formats; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_ec_point_formats) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &formats) || |
| !CBB_add_u8(&formats, TLSEXT_ECPOINTFORMAT_uncompressed) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ec_point_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| // The point format extension is unneccessary in TLS 1.3. |
| if (hs->min_version >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| return ext_ec_point_add_extension(hs, out); |
| } |
| |
| static bool ext_ec_point_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) { |
| return false; |
| } |
| |
| CBS ec_point_format_list; |
| if (!CBS_get_u8_length_prefixed(contents, &ec_point_format_list) || |
| CBS_len(contents) != 0) { |
| return false; |
| } |
| |
| // Per RFC 4492, section 5.1.2, implementations MUST support the uncompressed |
| // point format. |
| if (OPENSSL_memchr(CBS_data(&ec_point_format_list), |
| TLSEXT_ECPOINTFORMAT_uncompressed, |
| CBS_len(&ec_point_format_list)) == NULL) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_ec_point_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert, |
| CBS *contents) { |
| if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| return ext_ec_point_parse_serverhello(hs, out_alert, contents); |
| } |
| |
| static bool ext_ec_point_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| return true; |
| } |
| |
| const uint32_t alg_k = hs->new_cipher->algorithm_mkey; |
| const uint32_t alg_a = hs->new_cipher->algorithm_auth; |
| const bool using_ecc = (alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA); |
| |
| if (!using_ecc) { |
| return true; |
| } |
| |
| return ext_ec_point_add_extension(hs, out); |
| } |
| |
| |
| // Pre Shared Key |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.2.6 |
| |
| static size_t ext_pre_shared_key_clienthello_length(SSL_HANDSHAKE *hs) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version < TLS1_3_VERSION || ssl->session == NULL || |
| ssl_session_protocol_version(ssl->session) < TLS1_3_VERSION) { |
| return 0; |
| } |
| |
| size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session)); |
| return 15 + ssl->session->tlsext_ticklen + binder_len; |
| } |
| |
| static bool ext_pre_shared_key_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| hs->needs_psk_binder = false; |
| if (hs->max_version < TLS1_3_VERSION || ssl->session == NULL || |
| ssl_session_protocol_version(ssl->session) < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| // Per draft-ietf-tls-tls13-21 section 4.1.4, skip offering the session if the |
| // selected cipher in HelloRetryRequest does not match. This avoids performing |
| // the transcript hash transformation for multiple hashes. |
| if (hs->received_hello_retry_request && |
| ssl->session->cipher->algorithm_prf != hs->new_cipher->algorithm_prf) { |
| return true; |
| } |
| |
| struct OPENSSL_timeval now; |
| ssl_get_current_time(ssl, &now); |
| uint32_t ticket_age = 1000 * (now.tv_sec - ssl->session->time); |
| uint32_t obfuscated_ticket_age = ticket_age + ssl->session->ticket_age_add; |
| |
| // Fill in a placeholder zero binder of the appropriate length. It will be |
| // computed and filled in later after length prefixes are computed. |
| uint8_t zero_binder[EVP_MAX_MD_SIZE] = {0}; |
| size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session)); |
| |
| CBB contents, identity, ticket, binders, binder; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &identity) || |
| !CBB_add_u16_length_prefixed(&identity, &ticket) || |
| !CBB_add_bytes(&ticket, ssl->session->tlsext_tick, |
| ssl->session->tlsext_ticklen) || |
| !CBB_add_u32(&identity, obfuscated_ticket_age) || |
| !CBB_add_u16_length_prefixed(&contents, &binders) || |
| !CBB_add_u8_length_prefixed(&binders, &binder) || |
| !CBB_add_bytes(&binder, zero_binder, binder_len)) { |
| return false; |
| } |
| |
| hs->needs_psk_binder = true; |
| return CBB_flush(out); |
| } |
| |
| bool ssl_ext_pre_shared_key_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| uint16_t psk_id; |
| if (!CBS_get_u16(contents, &psk_id) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // We only advertise one PSK identity, so the only legal index is zero. |
| if (psk_id != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND); |
| *out_alert = SSL_AD_UNKNOWN_PSK_IDENTITY; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool ssl_ext_pre_shared_key_parse_clienthello( |
| SSL_HANDSHAKE *hs, CBS *out_ticket, CBS *out_binders, |
| uint32_t *out_obfuscated_ticket_age, uint8_t *out_alert, CBS *contents) { |
| // We only process the first PSK identity since we don't support pure PSK. |
| CBS identities, binders; |
| if (!CBS_get_u16_length_prefixed(contents, &identities) || |
| !CBS_get_u16_length_prefixed(&identities, out_ticket) || |
| !CBS_get_u32(&identities, out_obfuscated_ticket_age) || |
| !CBS_get_u16_length_prefixed(contents, &binders) || |
| CBS_len(&binders) == 0 || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| *out_binders = binders; |
| |
| // Check the syntax of the remaining identities, but do not process them. |
| size_t num_identities = 1; |
| while (CBS_len(&identities) != 0) { |
| CBS unused_ticket; |
| uint32_t unused_obfuscated_ticket_age; |
| if (!CBS_get_u16_length_prefixed(&identities, &unused_ticket) || |
| !CBS_get_u32(&identities, &unused_obfuscated_ticket_age)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| num_identities++; |
| } |
| |
| // Check the syntax of the binders. The value will be checked later if |
| // resuming. |
| size_t num_binders = 0; |
| while (CBS_len(&binders) != 0) { |
| CBS binder; |
| if (!CBS_get_u8_length_prefixed(&binders, &binder)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| num_binders++; |
| } |
| |
| if (num_identities != num_binders) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_BINDER_COUNT_MISMATCH); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool ssl_ext_pre_shared_key_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->ssl->s3->session_reused) { |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| // We only consider the first identity for resumption |
| !CBB_add_u16(&contents, 0) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Pre-Shared Key Exchange Modes |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.2.7 |
| |
| static bool ext_psk_key_exchange_modes_add_clienthello(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| if (hs->max_version < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| CBB contents, ke_modes; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_psk_key_exchange_modes) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &ke_modes) || |
| !CBB_add_u8(&ke_modes, SSL_PSK_DHE_KE)) { |
| return false; |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| static bool ext_psk_key_exchange_modes_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS ke_modes; |
| if (!CBS_get_u8_length_prefixed(contents, &ke_modes) || |
| CBS_len(&ke_modes) == 0 || |
| CBS_len(contents) != 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // We only support tickets with PSK_DHE_KE. |
| hs->accept_psk_mode = OPENSSL_memchr(CBS_data(&ke_modes), SSL_PSK_DHE_KE, |
| CBS_len(&ke_modes)) != NULL; |
| |
| return true; |
| } |
| |
| |
| // Early Data Indication |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.2.8 |
| |
| static bool ext_early_data_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->cert->enable_early_data || |
| // Session must be 0-RTT capable. |
| ssl->session == NULL || |
| ssl_session_protocol_version(ssl->session) < TLS1_3_VERSION || |
| ssl->session->ticket_max_early_data == 0 || |
| // The second ClientHello never offers early data. |
| hs->received_hello_retry_request || |
| // In case ALPN preferences changed since this session was established, |
| // avoid reporting a confusing value in |SSL_get0_alpn_selected|. |
| (ssl->session->early_alpn_len != 0 && |
| !ssl_is_alpn_protocol_allowed( |
| ssl, MakeConstSpan(ssl->session->early_alpn, |
| ssl->session->early_alpn_len)))) { |
| return true; |
| } |
| |
| hs->early_data_offered = true; |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_early_data) || |
| !CBB_add_u16(out, 0) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_early_data_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| if (!ssl->s3->session_reused) { |
| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); |
| return false; |
| } |
| |
| ssl->s3->early_data_accepted = true; |
| return true; |
| } |
| |
| static bool ext_early_data_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == NULL || |
| ssl_protocol_version(ssl) < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| hs->early_data_offered = true; |
| return true; |
| } |
| |
| static bool ext_early_data_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->ssl->s3->early_data_accepted) { |
| return true; |
| } |
| |
| if (!CBB_add_u16(out, TLSEXT_TYPE_early_data) || |
| !CBB_add_u16(out, 0) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Key Share |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-16#section-4.2.5 |
| |
| static bool ext_key_share_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| CBB contents, kse_bytes; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_key_share) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &kse_bytes)) { |
| return false; |
| } |
| |
| uint16_t group_id = hs->retry_group; |
| if (hs->received_hello_retry_request) { |
| // We received a HelloRetryRequest without a new curve, so there is no new |
| // share to append. Leave |hs->key_share| as-is. |
| if (group_id == 0 && |
| !CBB_add_bytes(&kse_bytes, hs->key_share_bytes.data(), |
| hs->key_share_bytes.size())) { |
| return false; |
| } |
| hs->key_share_bytes.Reset(); |
| if (group_id == 0) { |
| return CBB_flush(out); |
| } |
| } else { |
| // Add a fake group. See draft-davidben-tls-grease-01. |
| if (ssl->ctx->grease_enabled && |
| (!CBB_add_u16(&kse_bytes, |
| ssl_get_grease_value(hs, ssl_grease_group)) || |
| !CBB_add_u16(&kse_bytes, 1 /* length */) || |
| !CBB_add_u8(&kse_bytes, 0 /* one byte key share */))) { |
| return false; |
| } |
| |
| // Predict the most preferred group. |
| Span<const uint16_t> groups = tls1_get_grouplist(ssl); |
| if (groups.empty()) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_GROUPS_SPECIFIED); |
| return false; |
| } |
| |
| group_id = groups[0]; |
| } |
| |
| hs->key_share = SSLKeyShare::Create(group_id); |
| CBB key_exchange; |
| if (!hs->key_share || |
| !CBB_add_u16(&kse_bytes, group_id) || |
| !CBB_add_u16_length_prefixed(&kse_bytes, &key_exchange) || |
| !hs->key_share->Offer(&key_exchange) || |
| !CBB_flush(&kse_bytes)) { |
| return false; |
| } |
| |
| // Save the contents of the extension to repeat it in the second ClientHello. |
| if (!hs->received_hello_retry_request && |
| !hs->key_share_bytes.CopyFrom( |
| MakeConstSpan(CBB_data(&kse_bytes), CBB_len(&kse_bytes)))) { |
| return false; |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs, |
| Array<uint8_t> *out_secret, |
| uint8_t *out_alert, CBS *contents) { |
| CBS peer_key; |
| uint16_t group_id; |
| if (!CBS_get_u16(contents, &group_id) || |
| !CBS_get_u16_length_prefixed(contents, &peer_key) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| if (hs->key_share->GroupID() != group_id) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE); |
| return false; |
| } |
| |
| if (!hs->key_share->Finish(out_secret, out_alert, peer_key)) { |
| *out_alert = SSL_AD_INTERNAL_ERROR; |
| return false; |
| } |
| |
| hs->new_session->group_id = group_id; |
| hs->key_share.reset(); |
| return true; |
| } |
| |
| bool ssl_ext_key_share_parse_clienthello(SSL_HANDSHAKE *hs, bool *out_found, |
| Array<uint8_t> *out_secret, |
| uint8_t *out_alert, CBS *contents) { |
| uint16_t group_id; |
| CBS key_shares; |
| if (!tls1_get_shared_group(hs, &group_id)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP); |
| *out_alert = SSL_AD_HANDSHAKE_FAILURE; |
| return false; |
| } |
| |
| if (!CBS_get_u16_length_prefixed(contents, &key_shares) || |
| CBS_len(contents) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| return false; |
| } |
| |
| // Find the corresponding key share. |
| CBS peer_key; |
| CBS_init(&peer_key, NULL, 0); |
| while (CBS_len(&key_shares) > 0) { |
| uint16_t id; |
| CBS peer_key_tmp; |
| if (!CBS_get_u16(&key_shares, &id) || |
| !CBS_get_u16_length_prefixed(&key_shares, &peer_key_tmp) || |
| CBS_len(&peer_key_tmp) == 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| return false; |
| } |
| |
| if (id == group_id) { |
| if (CBS_len(&peer_key) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DUPLICATE_KEY_SHARE); |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| peer_key = peer_key_tmp; |
| // Continue parsing the structure to keep peers honest. |
| } |
| } |
| |
| if (CBS_len(&peer_key) == 0) { |
| *out_found = false; |
| out_secret->Reset(); |
| return true; |
| } |
| |
| // Compute the DH secret. |
| Array<uint8_t> secret; |
| ScopedCBB public_key; |
| UniquePtr<SSLKeyShare> key_share = SSLKeyShare::Create(group_id); |
| if (!key_share || |
| !CBB_init(public_key.get(), 32) || |
| !key_share->Accept(public_key.get(), &secret, out_alert, peer_key) || |
| !CBBFinishArray(public_key.get(), &hs->ecdh_public_key)) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| *out_secret = std::move(secret); |
| *out_found = true; |
| return true; |
| } |
| |
| bool ssl_ext_key_share_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| uint16_t group_id; |
| CBB kse_bytes, public_key; |
| if (!tls1_get_shared_group(hs, &group_id) || |
| !CBB_add_u16(out, TLSEXT_TYPE_key_share) || |
| !CBB_add_u16_length_prefixed(out, &kse_bytes) || |
| !CBB_add_u16(&kse_bytes, group_id) || |
| !CBB_add_u16_length_prefixed(&kse_bytes, &public_key) || |
| !CBB_add_bytes(&public_key, hs->ecdh_public_key.data(), |
| hs->ecdh_public_key.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| hs->ecdh_public_key.Reset(); |
| |
| hs->new_session->group_id = group_id; |
| return true; |
| } |
| |
| |
| // Supported Versions |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-16#section-4.2.1 |
| |
| static bool ext_supported_versions_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (hs->max_version <= TLS1_2_VERSION) { |
| return true; |
| } |
| |
| CBB contents, versions; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_supported_versions) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u8_length_prefixed(&contents, &versions)) { |
| return false; |
| } |
| |
| // Add a fake version. See draft-davidben-tls-grease-01. |
| if (ssl->ctx->grease_enabled && |
| !CBB_add_u16(&versions, ssl_get_grease_value(hs, ssl_grease_version))) { |
| return false; |
| } |
| |
| if (!ssl_add_supported_versions(hs, &versions) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // Cookie |
| // |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-16#section-4.2.2 |
| |
| static bool ext_cookie_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (hs->cookie.empty()) { |
| return true; |
| } |
| |
| CBB contents, cookie; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_cookie) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &cookie) || |
| !CBB_add_bytes(&cookie, hs->cookie.data(), hs->cookie.size()) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| // The cookie is no longer needed in memory. |
| hs->cookie.Reset(); |
| return true; |
| } |
| |
| |
| // Dummy PQ Padding extension |
| // |
| // Dummy post-quantum padding invovles the client (and later server) sending |
| // useless, random-looking bytes in an extension in their ClientHello or |
| // ServerHello. These extensions are sized to simulate a post-quantum |
| // key-exchange and so enable measurement of the latency impact of the |
| // additional bandwidth. |
| |
| static bool ext_dummy_pq_padding_add(CBB *out, size_t len) { |
| CBB contents; |
| uint8_t *buffer; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_dummy_pq_padding) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_space(&contents, &buffer, len)) { |
| return false; |
| } |
| |
| // The length is used as the nonce so that different length extensions have |
| // different contents. There's no reason this has to be the case, it just |
| // makes things a little more obvious in a packet dump. |
| uint8_t nonce[12] = {0}; |
| memcpy(nonce, &len, sizeof(len)); |
| |
| memset(buffer, 0, len); |
| static const uint8_t kZeroKey[32] = {0}; |
| CRYPTO_chacha_20(buffer, buffer, len, kZeroKey, nonce, 0); |
| |
| return CBB_flush(out); |
| } |
| |
| static bool ext_dummy_pq_padding_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| const size_t len = hs->ssl->dummy_pq_padding_len; |
| if (len == 0) { |
| return true; |
| } |
| |
| return ext_dummy_pq_padding_add(out, len); |
| } |
| |
| static bool ext_dummy_pq_padding_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == nullptr) { |
| return true; |
| } |
| |
| if (CBS_len(contents) != hs->ssl->dummy_pq_padding_len) { |
| return false; |
| } |
| |
| hs->ssl->did_dummy_pq_padding = true; |
| return true; |
| } |
| |
| static bool ext_dummy_pq_padding_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents != nullptr && |
| 0 < CBS_len(contents) && CBS_len(contents) < (1 << 12)) { |
| hs->dummy_pq_padding_len = CBS_len(contents); |
| } |
| |
| return true; |
| } |
| |
| static bool ext_dummy_pq_padding_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| if (!hs->dummy_pq_padding_len) { |
| return true; |
| } |
| |
| return ext_dummy_pq_padding_add(out, hs->dummy_pq_padding_len); |
| } |
| |
| // Negotiated Groups |
| // |
| // https://tools.ietf.org/html/rfc4492#section-5.1.2 |
| // https://tools.ietf.org/html/draft-ietf-tls-tls13-16#section-4.2.4 |
| |
| static bool ext_supported_groups_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| CBB contents, groups_bytes; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_supported_groups) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16_length_prefixed(&contents, &groups_bytes)) { |
| return false; |
| } |
| |
| // Add a fake group. See draft-davidben-tls-grease-01. |
| if (ssl->ctx->grease_enabled && |
| !CBB_add_u16(&groups_bytes, |
| ssl_get_grease_value(hs, ssl_grease_group))) { |
| return false; |
| } |
| |
| for (uint16_t group : tls1_get_grouplist(ssl)) { |
| if (!CBB_add_u16(&groups_bytes, group)) { |
| return false; |
| } |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| static bool ext_supported_groups_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| // This extension is not expected to be echoed by servers in TLS 1.2, but some |
| // BigIP servers send it nonetheless, so do not enforce this. |
| return true; |
| } |
| |
| static bool parse_u16_array(const CBS *cbs, Array<uint16_t> *out) { |
| CBS copy = *cbs; |
| if ((CBS_len(©) & 1) != 0) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); |
| return false; |
| } |
| |
| Array<uint16_t> ret; |
| if (!ret.Init(CBS_len(©) / 2)) { |
| return false; |
| } |
| for (size_t i = 0; i < ret.size(); i++) { |
| if (!CBS_get_u16(©, &ret[i])) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return false; |
| } |
| } |
| |
| assert(CBS_len(©) == 0); |
| *out = std::move(ret); |
| return 1; |
| } |
| |
| static bool ext_supported_groups_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| if (contents == NULL) { |
| return true; |
| } |
| |
| CBS supported_group_list; |
| if (!CBS_get_u16_length_prefixed(contents, &supported_group_list) || |
| CBS_len(&supported_group_list) == 0 || |
| CBS_len(contents) != 0 || |
| !parse_u16_array(&supported_group_list, &hs->peer_supported_group_list)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| // Token Binding |
| // |
| // https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-10 |
| |
| // The Token Binding version number currently matches the draft number of |
| // draft-ietf-tokbind-protocol, and when published as an RFC it will be 0x0100. |
| // Since there are no wire changes to the protocol from draft 13 through the |
| // current draft (16), this implementation supports all versions in that range. |
| static uint16_t kTokenBindingMaxVersion = 16; |
| static uint16_t kTokenBindingMinVersion = 13; |
| |
| static bool ext_token_binding_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (ssl->token_binding_params == nullptr || SSL_is_dtls(ssl)) { |
| return true; |
| } |
| |
| CBB contents, params; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_token_binding) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16(&contents, kTokenBindingMaxVersion) || |
| !CBB_add_u8_length_prefixed(&contents, ¶ms) || |
| !CBB_add_bytes(¶ms, ssl->token_binding_params, |
| ssl->token_binding_params_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| static bool ext_token_binding_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == nullptr) { |
| return true; |
| } |
| |
| CBS params_list; |
| uint16_t version; |
| uint8_t param; |
| if (!CBS_get_u16(contents, &version) || |
| !CBS_get_u8_length_prefixed(contents, ¶ms_list) || |
| !CBS_get_u8(¶ms_list, ¶m) || |
| CBS_len(¶ms_list) > 0 || |
| CBS_len(contents) > 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // The server-negotiated version must be less than or equal to our version. |
| if (version > kTokenBindingMaxVersion) { |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // If the server-selected version is less than what we support, then Token |
| // Binding wasn't negotiated (but the extension was parsed successfully). |
| if (version < kTokenBindingMinVersion) { |
| return true; |
| } |
| |
| for (size_t i = 0; i < ssl->token_binding_params_len; ++i) { |
| if (param == ssl->token_binding_params[i]) { |
| ssl->negotiated_token_binding_param = param; |
| ssl->token_binding_negotiated = true; |
| return true; |
| } |
| } |
| |
| *out_alert = SSL_AD_ILLEGAL_PARAMETER; |
| return false; |
| } |
| |
| // select_tb_param looks for the first token binding param in |
| // |ssl->token_binding_params| that is also in |params| and puts it in |
| // |ssl->negotiated_token_binding_param|. It returns true if a token binding |
| // param is found, and false otherwise. |
| static bool select_tb_param(SSL *ssl, Span<const uint8_t> peer_params) { |
| for (size_t i = 0; i < ssl->token_binding_params_len; ++i) { |
| uint8_t tb_param = ssl->token_binding_params[i]; |
| for (uint8_t peer_param : peer_params) { |
| if (tb_param == peer_param) { |
| ssl->negotiated_token_binding_param = tb_param; |
| return true; |
| } |
| } |
| } |
| return false; |
| } |
| |
| static bool ext_token_binding_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == nullptr || ssl->token_binding_params == nullptr) { |
| return true; |
| } |
| |
| CBS params; |
| uint16_t version; |
| if (!CBS_get_u16(contents, &version) || |
| !CBS_get_u8_length_prefixed(contents, ¶ms) || |
| CBS_len(¶ms) == 0 || |
| CBS_len(contents) > 0) { |
| *out_alert = SSL_AD_DECODE_ERROR; |
| return false; |
| } |
| |
| // If the client-selected version is less than what we support, then Token |
| // Binding wasn't negotiated (but the extension was parsed successfully). |
| if (version < kTokenBindingMinVersion) { |
| return true; |
| } |
| |
| // If the client-selected version is higher than we support, use our max |
| // version. Otherwise, use the client's version. |
| hs->negotiated_token_binding_version = |
| std::min(version, kTokenBindingMaxVersion); |
| if (!select_tb_param(ssl, params)) { |
| return true; |
| } |
| |
| ssl->token_binding_negotiated = true; |
| return true; |
| } |
| |
| static bool ext_token_binding_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| |
| if (!ssl->token_binding_negotiated) { |
| return true; |
| } |
| |
| CBB contents, params; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_token_binding) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_u16(&contents, hs->negotiated_token_binding_version) || |
| !CBB_add_u8_length_prefixed(&contents, ¶ms) || |
| !CBB_add_u8(¶ms, ssl->negotiated_token_binding_param) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| // QUIC Transport Parameters |
| |
| static bool ext_quic_transport_params_add_clienthello(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->quic_transport_params || hs->max_version <= TLS1_2_VERSION) { |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_quic_transport_parameters) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_bytes(&contents, ssl->quic_transport_params, |
| ssl->quic_transport_params_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| return true; |
| } |
| |
| static bool ext_quic_transport_params_parse_serverhello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (contents == nullptr) { |
| return true; |
| } |
| // QUIC requires TLS 1.3. |
| if (ssl_protocol_version(ssl) < TLS1_3_VERSION) { |
| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; |
| return false; |
| } |
| |
| return ssl->s3->peer_quic_transport_params.CopyFrom(*contents); |
| } |
| |
| static bool ext_quic_transport_params_parse_clienthello(SSL_HANDSHAKE *hs, |
| uint8_t *out_alert, |
| CBS *contents) { |
| SSL *const ssl = hs->ssl; |
| if (!contents || !ssl->quic_transport_params) { |
| return true; |
| } |
| // Ignore the extension before TLS 1.3. |
| if (ssl_protocol_version(ssl) < TLS1_3_VERSION) { |
| return true; |
| } |
| |
| return ssl->s3->peer_quic_transport_params.CopyFrom(*contents); |
| } |
| |
| static bool ext_quic_transport_params_add_serverhello(SSL_HANDSHAKE *hs, |
| CBB *out) { |
| SSL *const ssl = hs->ssl; |
| if (!ssl->quic_transport_params) { |
| return true; |
| } |
| |
| CBB contents; |
| if (!CBB_add_u16(out, TLSEXT_TYPE_quic_transport_parameters) || |
| !CBB_add_u16_length_prefixed(out, &contents) || |
| !CBB_add_bytes(&contents, ssl->quic_transport_params, |
| ssl->quic_transport_params_len) || |
| !CBB_flush(out)) { |
| return false; |
| } |
| |
| return true; |
| } |
| |
| |
| // kExtensions contains all the supported extensions. |
| static const struct tls_extension kExtensions[] = { |
| { |
| TLSEXT_TYPE_renegotiate, |
| NULL, |
| ext_ri_add_clienthello, |
| ext_ri_parse_serverhello, |
| ext_ri_parse_clienthello, |
| ext_ri_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_server_name, |
| NULL, |
| ext_sni_add_clienthello, |
| ext_sni_parse_serverhello, |
| ext_sni_parse_clienthello, |
| ext_sni_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_extended_master_secret, |
| NULL, |
| ext_ems_add_clienthello, |
| ext_ems_parse_serverhello, |
| ext_ems_parse_clienthello, |
| ext_ems_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_session_ticket, |
| NULL, |
| ext_ticket_add_clienthello, |
| ext_ticket_parse_serverhello, |
| // Ticket extension client parsing is handled in ssl_session.c |
| ignore_parse_clienthello, |
| ext_ticket_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_signature_algorithms, |
| NULL, |
| ext_sigalgs_add_clienthello, |
| forbid_parse_serverhello, |
| ext_sigalgs_parse_clienthello, |
| dont_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_status_request, |
| NULL, |
| ext_ocsp_add_clienthello, |
| ext_ocsp_parse_serverhello, |
| ext_ocsp_parse_clienthello, |
| ext_ocsp_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_next_proto_neg, |
| NULL, |
| ext_npn_add_clienthello, |
| ext_npn_parse_serverhello, |
| ext_npn_parse_clienthello, |
| ext_npn_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_certificate_timestamp, |
| NULL, |
| ext_sct_add_clienthello, |
| ext_sct_parse_serverhello, |
| ext_sct_parse_clienthello, |
| ext_sct_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_application_layer_protocol_negotiation, |
| NULL, |
| ext_alpn_add_clienthello, |
| ext_alpn_parse_serverhello, |
| // ALPN is negotiated late in |ssl_negotiate_alpn|. |
| ignore_parse_clienthello, |
| ext_alpn_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_channel_id, |
| ext_channel_id_init, |
| ext_channel_id_add_clienthello, |
| ext_channel_id_parse_serverhello, |
| ext_channel_id_parse_clienthello, |
| ext_channel_id_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_srtp, |
| ext_srtp_init, |
| ext_srtp_add_clienthello, |
| ext_srtp_parse_serverhello, |
| ext_srtp_parse_clienthello, |
| ext_srtp_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_ec_point_formats, |
| NULL, |
| ext_ec_point_add_clienthello, |
| ext_ec_point_parse_serverhello, |
| ext_ec_point_parse_clienthello, |
| ext_ec_point_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_key_share, |
| NULL, |
| ext_key_share_add_clienthello, |
| forbid_parse_serverhello, |
| ignore_parse_clienthello, |
| dont_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_psk_key_exchange_modes, |
| NULL, |
| ext_psk_key_exchange_modes_add_clienthello, |
| forbid_parse_serverhello, |
| ext_psk_key_exchange_modes_parse_clienthello, |
| dont_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_early_data, |
| NULL, |
| ext_early_data_add_clienthello, |
| ext_early_data_parse_serverhello, |
| ext_early_data_parse_clienthello, |
| ext_early_data_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_supported_versions, |
| NULL, |
| ext_supported_versions_add_clienthello, |
| forbid_parse_serverhello, |
| ignore_parse_clienthello, |
| dont_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_cookie, |
| NULL, |
| ext_cookie_add_clienthello, |
| forbid_parse_serverhello, |
| ignore_parse_clienthello, |
| dont_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_dummy_pq_padding, |
| NULL, |
| ext_dummy_pq_padding_add_clienthello, |
| ext_dummy_pq_padding_parse_serverhello, |
| ext_dummy_pq_padding_parse_clienthello, |
| ext_dummy_pq_padding_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_quic_transport_parameters, |
| NULL, |
| ext_quic_transport_params_add_clienthello, |
| ext_quic_transport_params_parse_serverhello, |
| ext_quic_transport_params_parse_clienthello, |
| ext_quic_transport_params_add_serverhello, |
| }, |
| // The final extension must be non-empty. WebSphere Application Server 7.0 is |
| // intolerant to the last extension being zero-length. See |
| // https://crbug.com/363583. |
| { |
| TLSEXT_TYPE_supported_groups, |
| NULL, |
| ext_supported_groups_add_clienthello, |
| ext_supported_groups_parse_serverhello, |
| ext_supported_groups_parse_clienthello, |
| dont_add_serverhello, |
| }, |
| { |
| TLSEXT_TYPE_token_binding, |
| NULL, |
| ext_token_binding_add_clienthello, |
| ext_token_binding_parse_serverhello, |
| ext_token_binding_parse_clienthello, |
| ext_token_binding_add_serverhello, |
| }, |
| }; |
| |
| #define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) |
| |
| static_assert(kNumExtensions <= |
| sizeof(((SSL_HANDSHAKE *)NULL)->extensions.sent) * 8, |
| "too many extensions for sent bitset"); |
| static_assert(kNumExtensions <= |
| sizeof(((SSL_HANDSHAKE *)NULL)->extensions.received) * 8, |
| "too many extensions for received bitset"); |
| |
| static const struct tls_extension *tls_extension_find(uint32_t *out_index, |
| uint16_t value) { |
| unsigned i; |
| for (i = 0; i < kNumExtensions; i++) { |
| if (kExtensions[i].value == value) { |
| *out_index = i; |
| return &kExtensions[i]; |
| } |
| } |
| |
| return NULL; |
| } |
| |
| int ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out, size_t header_len) { |
| SSL *const ssl = hs->ssl; |
| // Don't add extensions for SSLv3 unless doing secure renegotiation. |
| if (hs->client_version == SSL3_VERSION && |
| !ssl->s3->send_connection_binding) { |
| return 1; |
| } |
| |
| CBB extensions; |
| if (!CBB_add_u16_length_prefixed(out, &extensions)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| } |
| |
| hs->extensions.sent = 0; |
| hs->custom_extensions.sent = 0; |
| |
| for (size_t i = 0; i < kNumExtensions; i++) { |
| if (kExtensions[i].init != NULL) { |
| kExtensions[i].init(hs); |
| } |
| } |
| |
| uint16_t grease_ext1 = 0; |
| if (ssl->ctx->grease_enabled) { |
| // Add a fake empty extension. See draft-davidben-tls-grease-01. |
| grease_ext1 = ssl_get_grease_value(hs, ssl_grease_extension1); |
| if (!CBB_add_u16(&extensions, grease_ext1) || |
| !CBB_add_u16(&extensions, 0 /* zero length */)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| } |
| } |
| |
| for (size_t i = 0; i < kNumExtensions; i++) { |
| const size_t len_before = CBB_len(&extensions); |
| if (!kExtensions[i].add_clienthello(hs, &extensions)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_ADDING_EXTENSION); |
| ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value); |
| return 0; |
| } |
| |
| if (CBB_len(&extensions) != len_before) { |
| hs->extensions.sent |= (1u << i); |
| } |
| } |
| |
| if (!custom_ext_add_clienthello(hs, &extensions)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| } |
| |
| if (ssl->ctx->grease_enabled) { |
| // Add a fake non-empty extension. See draft-davidben-tls-grease-01. |
| uint16_t grease_ext2 = ssl_get_grease_value(hs, ssl_grease_extension2); |
| |
| // The two fake extensions must not have the same value. GREASE values are |
| // of the form 0x1a1a, 0x2a2a, 0x3a3a, etc., so XOR to generate a different |
| // one. |
| if (grease_ext1 == grease_ext2) { |
| grease_ext2 ^= 0x1010; |
| } |
| |
| if (!CBB_add_u16(&extensions, grease_ext2) || |
| !CBB_add_u16(&extensions, 1 /* one byte length */) || |
| !CBB_add_u8(&extensions, 0 /* single zero byte as contents */)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| } |
| } |
| |
| if (!SSL_is_dtls(ssl)) { |
| size_t psk_extension_len = ext_pre_shared_key_clienthello_length(hs); |
| header_len += 2 + CBB_len(&extensions) + psk_extension_len; |
| if (header_len > 0xff && header_len < 0x200) { |
| // Add padding to workaround bugs in F5 terminators. See RFC 7685. |
| // |
| // NB: because this code works out the length of all existing extensions |
| // it MUST always appear last. |
| size_t padding_len = 0x200 - header_len; |
| // Extensions take at least four bytes to encode. Always include at least |
| // one byte of data if including the extension. WebSphere Application |
| // Server 7.0 is intolerant to the last extension being zero-length. See |
| // https://crbug.com/363583. |
| if (padding_len >= 4 + 1) { |
| padding_len -= 4; |
| } else { |
| padding_len = 1; |
| } |
| |
| uint8_t *padding_bytes; |
| if (!CBB_add_u16(&extensions, TLSEXT_TYPE_padding) || |
| !CBB_add_u16(&extensions, padding_len) || |
| !CBB_add_space(&extensions, &padding_bytes, padding_len)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| } |
| |
| OPENSSL_memset(padding_bytes, 0, padding_len); |
| } |
| } |
| |
| // The PSK extension must be last, including after the padding. |
| if (!ext_pre_shared_key_add_clienthello(hs, &extensions)) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| } |
| |
| // Discard empty extensions blocks. |
| if (CBB_len(&extensions) == 0) { |
| CBB_discard_child(out); |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| int ssl_add_serverhello_tlsext(SSL_HANDSHAKE *hs, CBB *out) { |
| SSL *const ssl = hs->ssl; |
| CBB extensions; |
| if (!CBB_add_u16_length_prefixed(out, &extensions)) { |
| goto err; |
| } |
| |
| for (unsigned i = 0; i < kNumExtensions; i++) { |
| if (!(hs->extensions.received & (1u << i))) { |
| // Don't send extensions that were not received. |
| continue; |
| } |
| |
| if (!kExtensions[i].add_serverhello(hs, &extensions)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_ADDING_EXTENSION); |
| ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value); |
| goto err; |
| } |
| } |
| |
| if (!custom_ext_add_serverhello(hs, &extensions)) { |
| goto err; |
| } |
| |
| // Discard empty extensions blocks before TLS 1.3. |
| if (ssl_protocol_version(ssl) < TLS1_3_VERSION && |
| CBB_len(&extensions) == 0) { |
| CBB_discard_child(out); |
| } |
| |
| return CBB_flush(out); |
| |
| err: |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return 0; |
| |