Clang formatting. Change-Id: I31e9fb52fb2f7e800ded73076f3da1b7fac716c5
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index fe3910e..4c94270 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h
@@ -3909,15 +3909,28 @@ // ESNI functions. + +// SSL_set_enable_esni configures whether to use ESNI as part of this +// connection. OPENSSL_EXPORT void SSL_set_enable_esni(SSL *ssl, int enable); +// SSL_set_esni_keys sets the ESNIKeys structure that should be used for +// connections to the server. OPENSSL_EXPORT int SSL_set_esni_keys(SSL *ssl, const uint8_t *key_struct, size_t key_len); -OPENSSL_EXPORT int SSL_set_esni_private_key(SSL *ssl, const uint8_t *pub, size_t pub_len, const uint8_t *priv, size_t priv_len); +// SSL_set_esni_private_key sets the keypair that the server should use to decrypt ESNI. +// +// TODO: Support multiple keypairs. +OPENSSL_EXPORT int SSL_set_esni_private_key(SSL *ssl, const uint8_t *pub, + size_t pub_len, const uint8_t *priv, + size_t priv_len); +// SSL_get_retry_keys returns the ESNIKeys structure that was returned by the +// server if ESNI was rejected or a retry was requested. OPENSSL_EXPORT void SSL_get_retry_keys(SSL *ssl); + // Deprecated functions. // SSL_library_init calls |CRYPTO_library_init| and returns one.
diff --git a/ssl/handshake_server.cc b/ssl/handshake_server.cc index f225d0a..bab2333 100644 --- a/ssl/handshake_server.cc +++ b/ssl/handshake_server.cc
@@ -544,7 +544,7 @@ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); return ssl_hs_error; } - + if (!CBS_get_u16_length_prefixed(&key_share, &kse_bytes) || !hs->key_share_bytes.CopyFrom( MakeConstSpan(CBS_data(&kse_bytes), CBS_len(&kse_bytes)))) { @@ -552,13 +552,14 @@ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); return ssl_hs_error; } + uint8_t alert = SSL_AD_DECODE_ERROR; if (!ssl_ext_encrypted_server_name_parse_clienthello(hs, &alert, &encrypted_sni)) { ssl_send_alert(ssl, SSL3_AL_FATAL, alert); return ssl_hs_error; } } - + // Run the early callback. if (ssl->ctx->select_certificate_cb != NULL) { switch (ssl->ctx->select_certificate_cb(&client_hello)) { @@ -602,7 +603,6 @@ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); return ssl_hs_error; } - // TLS extensions. if (!ssl_parse_clienthello_tlsext(hs, &client_hello)) { OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT);
diff --git a/ssl/internal.h b/ssl/internal.h index 0c32d30..e478340 100644 --- a/ssl/internal.h +++ b/ssl/internal.h
@@ -1327,7 +1327,8 @@ bool tls13_derive_esni_secrets(SSL_HANDSHAKE *hs, Array<uint8_t> shared_secret); bool ssl_ext_encrypted_server_name_parse_clienthello(SSL_HANDSHAKE *hs, - uint8_t *out_alert, CBS *contents); + uint8_t *out_alert, + CBS *contents); // Handshake functions. @@ -1585,10 +1586,10 @@ uint8_t esni_iv[EVP_AEAD_MAX_NONCE_LENGTH]; size_t esni_iv_len; - + // esni_aead_ctx is the AEAD CTX to use with ESNI. ScopedEVP_AEAD_CTX esni_aead_ctx; - + // scts_requested is true if the SCT extension is in the ClientHello. bool scts_requested : 1;
diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc index 547fc66..3fb1f9c 100644 --- a/ssl/ssl_lib.cc +++ b/ssl/ssl_lib.cc
@@ -2867,7 +2867,8 @@ CBS_init(&esni_keys, key_struct, key_len); if (!CBS_get_u16(&esni_keys, &version) || version != ESNI_VERSION || - !CBS_get_u16_length_prefixed(&esni_keys, &ssl->config->esni_public_name) || + !CBS_get_u16_length_prefixed(&esni_keys, + &ssl->config->esni_public_name) || !CBS_get_u16_length_prefixed(&esni_keys, &keys) || !CBS_get_u16_length_prefixed(&esni_keys, &cipher_suites) || !CBS_get_u16(&esni_keys, &ssl->config->esni_padded_length) || @@ -2878,9 +2879,9 @@ // TODO(svaldez): Handle extensions. static const uint16_t kDefaultGroups[] = { - SSL_CURVE_X25519, - SSL_CURVE_SECP256R1, - SSL_CURVE_SECP384R1, + SSL_CURVE_X25519, + SSL_CURVE_SECP256R1, + SSL_CURVE_SECP384R1, }; Span<const uint16_t> supp = Span<const uint16_t>(kDefaultGroups); if (!ssl->config->supported_group_list.empty()) { @@ -2911,27 +2912,30 @@ } ssl->config->esni_server_keyshare.CopyFrom(esni_keyshare_bytes); - ssl->config->esni_cipher = ssl_choose_tls13_cipher(cipher_suites, - TLS1_3_VERSION, - ssl->config->esni_group); + ssl->config->esni_cipher = ssl_choose_tls13_cipher( + cipher_suites, TLS1_3_VERSION, ssl->config->esni_group); if (!ssl->config->esni_cipher) { return false; } - const EVP_MD *digest = ssl_get_handshake_digest(TLS1_3_VERSION, ssl->config->esni_cipher); + const EVP_MD *digest = + ssl_get_handshake_digest(TLS1_3_VERSION, ssl->config->esni_cipher); uint8_t esni_digest[EVP_MAX_MD_SIZE]; unsigned esni_digest_len; - if (!EVP_Digest(key_struct, key_len, esni_digest, &esni_digest_len, digest, NULL) || - !ssl->config->esni_record_digest.CopyFrom(Span<uint8_t>(esni_digest, esni_digest_len))) { + if (!EVP_Digest(key_struct, key_len, esni_digest, &esni_digest_len, digest, + NULL) || + !ssl->config->esni_record_digest.CopyFrom( + Span<uint8_t>(esni_digest, esni_digest_len))) { return false; } - + return true; } // TODO(svaldez): Support multiple ESNIKeys structs on the server. -int SSL_set_esni_private_key(SSL *ssl, const uint8_t *pub, size_t pub_len, const uint8_t *priv, size_t priv_len) { +int SSL_set_esni_private_key(SSL *ssl, const uint8_t *pub, size_t pub_len, + const uint8_t *priv, size_t priv_len) { if (!ssl->config->enable_esni) { return false; } @@ -2940,7 +2944,7 @@ return true; } -// Get Retry Keys. +// TODO: Get Retry Keys. int SSL_clear(SSL *ssl) { if (!ssl->config) {
diff --git a/ssl/ssl_test.cc b/ssl/ssl_test.cc index ee30dc8..5290426 100644 --- a/ssl/ssl_test.cc +++ b/ssl/ssl_test.cc
@@ -4096,7 +4096,8 @@ ASSERT_TRUE(SSL_CTX_set_max_proto_version(client_ctx.get(), TLS1_3_VERSION)); ASSERT_TRUE(SSL_CTX_set_max_proto_version(server_ctx.get(), TLS1_3_VERSION)); - bssl::UniquePtr<SSL> client(SSL_new(client_ctx.get())), server(SSL_new(server_ctx.get())); + bssl::UniquePtr<SSL> client(SSL_new(client_ctx.get())), + server(SSL_new(server_ctx.get())); ASSERT_TRUE(client); ASSERT_TRUE(server); SSL_set_connect_state(client.get()); @@ -4107,12 +4108,13 @@ SSL_set_enable_esni(server.get(), true); UniquePtr<SSLKeyShare> keyshare = SSLKeyShare::Create(SSL_CURVE_X25519); - + CBB key_struct, public_name, keys, kse_bytes, kse_bytes_c, cipher_suites; if (!CBB_init(&key_struct, 0) || !CBB_add_u16(&key_struct, ESNI_VERSION) || !CBB_add_u16_length_prefixed(&key_struct, &public_name) || - !CBB_add_bytes(&public_name, (const uint8_t*)"pn-test.com", strlen("pn-test.com")) || + !CBB_add_bytes(&public_name, (const uint8_t *)"pn-test.com", + strlen("pn-test.com")) || !CBB_add_u16_length_prefixed(&key_struct, &keys) || !CBB_add_u16(&keys, SSL_CURVE_X25519) || !CBB_add_u16_length_prefixed(&keys, &kse_bytes)) { @@ -4128,12 +4130,15 @@ !CBB_flush(&key_struct)) { ASSERT_TRUE(false); } - ASSERT_TRUE(SSL_set_esni_keys(client.get(), CBB_data(&key_struct), CBB_len(&key_struct))); + ASSERT_TRUE(SSL_set_esni_keys(client.get(), CBB_data(&key_struct), + CBB_len(&key_struct))); CBB private_key; ASSERT_TRUE(CBB_init(&private_key, 0)); ASSERT_TRUE(keyshare->Serialize(&private_key)); - ASSERT_TRUE(SSL_set_esni_private_key(server.get(), CBB_data(&kse_bytes_c), CBB_len(&kse_bytes_c) - 8, CBB_data(&private_key), CBB_len(&private_key))); - + ASSERT_TRUE(SSL_set_esni_private_key( + server.get(), CBB_data(&kse_bytes_c), CBB_len(&kse_bytes_c) - 8, + CBB_data(&private_key), CBB_len(&private_key))); + BIO *bio1, *bio2; ASSERT_TRUE(BIO_new_bio_pair(&bio1, 0, &bio2, 0)); // SSL_set_bio takes ownership.
diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc index 09e3816..3560444 100644 --- a/ssl/t1_lib.cc +++ b/ssl/t1_lib.cc
@@ -2963,7 +2963,8 @@ static bool ext_encrypted_server_name_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) { SSL *const ssl = hs->ssl; - if (!hs->config->enable_esni || SSL_is_dtls(ssl) || hs->config->esni_group == 0) { + if (!hs->config->enable_esni || SSL_is_dtls(ssl) || + hs->config->esni_group == 0) { return true; } @@ -2979,11 +2980,13 @@ return false; } - UniquePtr<SSLKeyShare> esni_client_share = SSLKeyShare::Create(ssl->config->esni_group); + UniquePtr<SSLKeyShare> esni_client_share = + SSLKeyShare::Create(ssl->config->esni_group); Array<uint8_t> shared_secret; uint8_t alert; if (!esni_client_share || - !esni_client_share->Accept(&key_exchange, &shared_secret, &alert, ssl->config->esni_server_keyshare)) { + !esni_client_share->Accept(&key_exchange, &shared_secret, &alert, + ssl->config->esni_server_keyshare)) { return false; } @@ -2993,7 +2996,7 @@ !CBB_add_u16_length_prefixed(&contents, &esni)) { return false; } - + if (!RAND_bytes(hs->esni_nonce, sizeof(hs->esni_nonce))) { return false; } @@ -3002,8 +3005,8 @@ return false; } - size_t padding_len = ssl->config->esni_padded_length - strlen(ssl->hostname.get()); - + size_t padding_len = ssl->config->esni_padded_length - strlen(ssl->hostname.get()); + CBB client_esni, dns_name; uint8_t *padding; if (!CBB_init(&client_esni, 0) || @@ -3017,11 +3020,16 @@ } OPENSSL_memset(padding, padding_len, 0); - size_t esni_max_len = CBB_len(&client_esni) + EVP_AEAD_max_overhead(hs->esni_aead_ctx->aead); + size_t esni_max_len = + CBB_len(&client_esni) + EVP_AEAD_max_overhead(hs->esni_aead_ctx->aead); Array<uint8_t> inner_esni; size_t inner_esni_len = 0; if (!inner_esni.Init(esni_max_len) || - !EVP_AEAD_CTX_seal(hs->esni_aead_ctx.get(), inner_esni.data(), &inner_esni_len, esni_max_len, hs->esni_iv, hs->esni_iv_len, CBB_data(&client_esni), CBB_len(&client_esni), hs->key_share_bytes.data(), hs->key_share_bytes.size())) { + !EVP_AEAD_CTX_seal(hs->esni_aead_ctx.get(), inner_esni.data(), + &inner_esni_len, esni_max_len, hs->esni_iv, + hs->esni_iv_len, CBB_data(&client_esni), + CBB_len(&client_esni), hs->key_share_bytes.data(), + hs->key_share_bytes.size())) { return false; } @@ -3029,7 +3037,7 @@ !CBB_flush(&esni)) { return false; } - + return CBB_flush(out); } @@ -3089,12 +3097,15 @@ return false; } hs->config->esni_cipher = SSL_get_cipher_by_value(cipher_id); - if (!hs->config->esni_record_digest.CopyFrom(MakeSpan(CBS_data(&record_digest), CBS_len(&record_digest)))) { + if (!hs->config->esni_record_digest.CopyFrom( + MakeSpan(CBS_data(&record_digest), CBS_len(&record_digest)))) { return false; } CBS server_keyshare; - CBS_init(&server_keyshare, ssl->config->esni_private.data(), ssl->config->esni_private.size()); - UniquePtr<SSLKeyShare> esni_server_share = SSLKeyShare::Create(&server_keyshare); + CBS_init(&server_keyshare, ssl->config->esni_private.data(), + ssl->config->esni_private.size()); + UniquePtr<SSLKeyShare> esni_server_share = + SSLKeyShare::Create(&server_keyshare); Array<uint8_t> shared_secret; uint8_t alert; @@ -3110,7 +3121,11 @@ size_t inner_esni_len; size_t esni_max_len = CBS_len(&esni); if (!inner_esni.Init(esni_max_len) || - !EVP_AEAD_CTX_open(hs->esni_aead_ctx.get(), inner_esni.data(), &inner_esni_len, esni_max_len, hs->esni_iv, hs->esni_iv_len, CBS_data(&esni), CBS_len(&esni), hs->key_share_bytes.data(), hs->key_share_bytes.size())) { + !EVP_AEAD_CTX_open(hs->esni_aead_ctx.get(), inner_esni.data(), + &inner_esni_len, esni_max_len, hs->esni_iv, + hs->esni_iv_len, CBS_data(&esni), CBS_len(&esni), + hs->key_share_bytes.data(), + hs->key_share_bytes.size())) { return false; }
diff --git a/ssl/tls13_enc.cc b/ssl/tls13_enc.cc index 4ad1b48..99c11d8 100644 --- a/ssl/tls13_enc.cc +++ b/ssl/tls13_enc.cc
@@ -568,13 +568,15 @@ //TODO(svaldez): Support HRR case. bool tls13_derive_esni_secrets(SSL_HANDSHAKE *hs, Array<uint8_t> shared_secret) { SSL const *ssl = hs->ssl; - - const EVP_MD *digest = ssl_get_handshake_digest(TLS1_3_VERSION, hs->config->esni_cipher); + + const EVP_MD *digest = + ssl_get_handshake_digest(TLS1_3_VERSION, hs->config->esni_cipher); uint8_t zeroes[EVP_MAX_MD_SIZE] = {0}; - uint8_t zx[EVP_MAX_MD_SIZE] = {0}; + uint8_t zx[EVP_MAX_MD_SIZE] = {0}; size_t zx_len; - if (!HKDF_extract(zx, &zx_len, digest, shared_secret.data(), shared_secret.size(), zeroes, EVP_MD_size(digest))) { + if (!HKDF_extract(zx, &zx_len, digest, shared_secret.data(), + shared_secret.size(), zeroes, EVP_MD_size(digest))) { return false; } @@ -582,18 +584,21 @@ Array<uint8_t> esni_contents; if (!CBB_init(&esni_cbb, 0) || !CBB_add_u16_length_prefixed(&esni_cbb, &record_digest) || - !CBB_add_bytes(&record_digest, ssl->config->esni_record_digest.data(), ssl->config->esni_record_digest.size()) || + !CBB_add_bytes(&record_digest, ssl->config->esni_record_digest.data(), + ssl->config->esni_record_digest.size()) || !CBB_add_u16(&esni_cbb, ssl->config->esni_group) || !CBB_add_u16_length_prefixed(&esni_cbb, &keyshare) || - !CBB_add_bytes(&keyshare, ssl->config->esni_server_keyshare.data(), ssl->config->esni_server_keyshare.size()) || + !CBB_add_bytes(&keyshare, ssl->config->esni_server_keyshare.data(), + ssl->config->esni_server_keyshare.size()) || !CBB_add_bytes(&esni_cbb, ssl->s3->client_random, SSL3_RANDOM_SIZE) || !CBBFinishArray(&esni_cbb, &esni_contents)) { return false; } - + uint8_t esni_hash[EVP_MAX_MD_SIZE]; unsigned esni_hash_len; - if (!EVP_Digest(esni_contents.data(), esni_contents.size(), esni_hash, &esni_hash_len, digest, nullptr)) { + if (!EVP_Digest(esni_contents.data(), esni_contents.size(), esni_hash, + &esni_hash_len, digest, nullptr)) { return false; } @@ -609,12 +614,15 @@ uint8_t key[EVP_AEAD_MAX_KEY_LENGTH]; hs->esni_iv_len = EVP_AEAD_nonce_length(aead); - if (!hkdf_expand_label(key, digest, zx, zx_len, "esni key", 8, esni_hash, esni_hash_len, key_len) || - !hkdf_expand_label(hs->esni_iv, digest, zx, zx_len, "esni iv", 7, esni_hash, esni_hash_len, hs->esni_iv_len)) { + if (!hkdf_expand_label(key, digest, zx, zx_len, "esni key", 8, esni_hash, + esni_hash_len, key_len) || + !hkdf_expand_label(hs->esni_iv, digest, zx, zx_len, "esni iv", 7, + esni_hash, esni_hash_len, hs->esni_iv_len)) { return false; } - return EVP_AEAD_CTX_init(hs->esni_aead_ctx.get(), aead, key, key_len, hs->esni_iv_len, nullptr); + return EVP_AEAD_CTX_init(hs->esni_aead_ctx.get(), aead, key, key_len, + hs->esni_iv_len, nullptr); } BSSL_NAMESPACE_END