1 /* Copyright (c) 2018, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/ssl.h>
16
17 #include <openssl/bytestring.h>
18
19 #include "internal.h"
20
21
22 BSSL_NAMESPACE_BEGIN
23
24 constexpr int kHandoffVersion = 0;
25 constexpr int kHandbackVersion = 0;
26
27 // serialize_features adds a description of features supported by this binary to
28 // |out|. Returns true on success and false on error.
serialize_features(CBB * out)29 static bool serialize_features(CBB *out) {
30 CBB ciphers;
31 if (!CBB_add_asn1(out, &ciphers, CBS_ASN1_OCTETSTRING)) {
32 return false;
33 }
34 Span<const SSL_CIPHER> all_ciphers = AllCiphers();
35 for (const SSL_CIPHER& cipher : all_ciphers) {
36 if (!CBB_add_u16(&ciphers, static_cast<uint16_t>(cipher.id))) {
37 return false;
38 }
39 }
40 CBB curves;
41 if (!CBB_add_asn1(out, &curves, CBS_ASN1_OCTETSTRING)) {
42 return false;
43 }
44 for (const NamedGroup& g : NamedGroups()) {
45 if (!CBB_add_u16(&curves, g.group_id)) {
46 return false;
47 }
48 }
49 return CBB_flush(out);
50 }
51
SSL_serialize_handoff(const SSL * ssl,CBB * out)52 bool SSL_serialize_handoff(const SSL *ssl, CBB *out) {
53 const SSL3_STATE *const s3 = ssl->s3;
54 if (!ssl->server ||
55 s3->hs == nullptr ||
56 s3->rwstate != SSL_HANDOFF) {
57 return false;
58 }
59
60 CBB seq;
61 Span<const uint8_t> transcript = s3->hs->transcript.buffer();
62 if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
63 !CBB_add_asn1_uint64(&seq, kHandoffVersion) ||
64 !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) ||
65 !CBB_add_asn1_octet_string(&seq,
66 reinterpret_cast<uint8_t *>(s3->hs_buf->data),
67 s3->hs_buf->length) ||
68 !serialize_features(&seq) ||
69 !CBB_flush(out)) {
70 return false;
71 }
72
73 return true;
74 }
75
SSL_decline_handoff(SSL * ssl)76 bool SSL_decline_handoff(SSL *ssl) {
77 const SSL3_STATE *const s3 = ssl->s3;
78 if (!ssl->server ||
79 s3->hs == nullptr ||
80 s3->rwstate != SSL_HANDOFF) {
81 return false;
82 }
83
84 s3->hs->config->handoff = false;
85 return true;
86 }
87
88 // apply_remote_features reads a list of supported features from |in| and
89 // (possibly) reconfigures |ssl| to disallow the negotation of features whose
90 // support has not been indicated. (This prevents the the handshake from
91 // committing to features that are not supported on the handoff/handback side.)
apply_remote_features(SSL * ssl,CBS * in)92 static bool apply_remote_features(SSL *ssl, CBS *in) {
93 CBS ciphers;
94 if (!CBS_get_asn1(in, &ciphers, CBS_ASN1_OCTETSTRING)) {
95 return false;
96 }
97 bssl::UniquePtr<STACK_OF(SSL_CIPHER)> supported(sk_SSL_CIPHER_new_null());
98 while (CBS_len(&ciphers)) {
99 uint16_t id;
100 if (!CBS_get_u16(&ciphers, &id)) {
101 return false;
102 }
103 const SSL_CIPHER *cipher = SSL_get_cipher_by_value(id);
104 if (!cipher) {
105 continue;
106 }
107 if (!sk_SSL_CIPHER_push(supported.get(), cipher)) {
108 return false;
109 }
110 }
111 STACK_OF(SSL_CIPHER) *configured =
112 ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get()
113 : ssl->ctx->cipher_list->ciphers.get();
114 bssl::UniquePtr<STACK_OF(SSL_CIPHER)> unsupported(sk_SSL_CIPHER_new_null());
115 for (const SSL_CIPHER *configured_cipher : configured) {
116 if (sk_SSL_CIPHER_find(supported.get(), nullptr, configured_cipher)) {
117 continue;
118 }
119 if (!sk_SSL_CIPHER_push(unsupported.get(), configured_cipher)) {
120 return false;
121 }
122 }
123 if (sk_SSL_CIPHER_num(unsupported.get()) && !ssl->config->cipher_list) {
124 ssl->config->cipher_list = bssl::MakeUnique<SSLCipherPreferenceList>();
125 if (!ssl->config->cipher_list->Init(*ssl->ctx->cipher_list)) {
126 return false;
127 }
128 }
129 for (const SSL_CIPHER *unsupported_cipher : unsupported.get()) {
130 ssl->config->cipher_list->Remove(unsupported_cipher);
131 }
132 if (sk_SSL_CIPHER_num(SSL_get_ciphers(ssl)) == 0) {
133 return false;
134 }
135
136 CBS curves;
137 if (!CBS_get_asn1(in, &curves, CBS_ASN1_OCTETSTRING)) {
138 return false;
139 }
140 Array<uint16_t> supported_curves;
141 if (!supported_curves.Init(CBS_len(&curves) / 2)) {
142 return false;
143 }
144 size_t idx = 0;
145 while (CBS_len(&curves)) {
146 uint16_t curve;
147 if (!CBS_get_u16(&curves, &curve)) {
148 return false;
149 }
150 supported_curves[idx++] = curve;
151 }
152 Span<const uint16_t> configured_curves =
153 tls1_get_grouplist(ssl->s3->hs.get());
154 Array<uint16_t> new_configured_curves;
155 if (!new_configured_curves.Init(configured_curves.size())) {
156 return false;
157 }
158 idx = 0;
159 for (uint16_t configured_curve : configured_curves) {
160 bool ok = false;
161 for (uint16_t supported_curve : supported_curves) {
162 if (supported_curve == configured_curve) {
163 ok = true;
164 break;
165 }
166 }
167 if (ok) {
168 new_configured_curves[idx++] = configured_curve;
169 }
170 }
171 if (idx == 0) {
172 return false;
173 }
174 new_configured_curves.Shrink(idx);
175 ssl->config->supported_group_list = std::move(new_configured_curves);
176
177 return true;
178 }
179
SSL_apply_handoff(SSL * ssl,Span<const uint8_t> handoff)180 bool SSL_apply_handoff(SSL *ssl, Span<const uint8_t> handoff) {
181 if (ssl->method->is_dtls) {
182 return false;
183 }
184
185 CBS seq, handoff_cbs(handoff);
186 uint64_t handoff_version;
187 if (!CBS_get_asn1(&handoff_cbs, &seq, CBS_ASN1_SEQUENCE) ||
188 !CBS_get_asn1_uint64(&seq, &handoff_version) ||
189 handoff_version != kHandoffVersion) {
190 return false;
191 }
192
193 CBS transcript, hs_buf;
194 if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) ||
195 !CBS_get_asn1(&seq, &hs_buf, CBS_ASN1_OCTETSTRING) ||
196 !apply_remote_features(ssl, &seq)) {
197 return false;
198 }
199
200 SSL_set_accept_state(ssl);
201
202 SSL3_STATE *const s3 = ssl->s3;
203 s3->v2_hello_done = true;
204 s3->has_message = true;
205
206 s3->hs_buf.reset(BUF_MEM_new());
207 if (!s3->hs_buf ||
208 !BUF_MEM_append(s3->hs_buf.get(), CBS_data(&hs_buf), CBS_len(&hs_buf))) {
209 return false;
210 }
211
212 if (CBS_len(&transcript) != 0) {
213 s3->hs->transcript.Update(transcript);
214 s3->is_v2_hello = true;
215 }
216 s3->hs->handback = true;
217
218 return true;
219 }
220
SSL_serialize_handback(const SSL * ssl,CBB * out)221 bool SSL_serialize_handback(const SSL *ssl, CBB *out) {
222 if (!ssl->server || ssl->method->is_dtls) {
223 return false;
224 }
225 handback_t type;
226 switch (ssl->s3->hs->state) {
227 case state12_read_change_cipher_spec:
228 type = handback_after_session_resumption;
229 break;
230 case state12_read_client_certificate:
231 type = handback_after_ecdhe;
232 break;
233 case state12_finish_server_handshake:
234 type = handback_after_handshake;
235 break;
236 default:
237 return false;
238 }
239
240 const SSL3_STATE *const s3 = ssl->s3;
241 size_t hostname_len = 0;
242 if (s3->hostname) {
243 hostname_len = strlen(s3->hostname.get());
244 }
245
246 Span<const uint8_t> transcript;
247 if (type == handback_after_ecdhe ||
248 type == handback_after_session_resumption) {
249 transcript = s3->hs->transcript.buffer();
250 }
251 size_t write_iv_len = 0;
252 const uint8_t *write_iv = nullptr;
253 if ((type == handback_after_session_resumption ||
254 type == handback_after_handshake) &&
255 ssl->version == TLS1_VERSION &&
256 SSL_CIPHER_is_block_cipher(s3->aead_write_ctx->cipher()) &&
257 !s3->aead_write_ctx->GetIV(&write_iv, &write_iv_len)) {
258 return false;
259 }
260 size_t read_iv_len = 0;
261 const uint8_t *read_iv = nullptr;
262 if (type == handback_after_handshake &&
263 ssl->version == TLS1_VERSION &&
264 SSL_CIPHER_is_block_cipher(s3->aead_read_ctx->cipher()) &&
265 !s3->aead_read_ctx->GetIV(&read_iv, &read_iv_len)) {
266 return false;
267 }
268
269 // TODO(mab): make sure everything is serialized.
270 CBB seq, key_share;
271 const SSL_SESSION *session =
272 s3->session_reused ? ssl->session.get() : s3->hs->new_session.get();
273 if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
274 !CBB_add_asn1_uint64(&seq, kHandbackVersion) ||
275 !CBB_add_asn1_uint64(&seq, type) ||
276 !CBB_add_asn1_octet_string(&seq, s3->read_sequence,
277 sizeof(s3->read_sequence)) ||
278 !CBB_add_asn1_octet_string(&seq, s3->write_sequence,
279 sizeof(s3->write_sequence)) ||
280 !CBB_add_asn1_octet_string(&seq, s3->server_random,
281 sizeof(s3->server_random)) ||
282 !CBB_add_asn1_octet_string(&seq, s3->client_random,
283 sizeof(s3->client_random)) ||
284 !CBB_add_asn1_octet_string(&seq, read_iv, read_iv_len) ||
285 !CBB_add_asn1_octet_string(&seq, write_iv, write_iv_len) ||
286 !CBB_add_asn1_bool(&seq, s3->session_reused) ||
287 !CBB_add_asn1_bool(&seq, s3->channel_id_valid) ||
288 !ssl_session_serialize(session, &seq) ||
289 !CBB_add_asn1_octet_string(&seq, s3->next_proto_negotiated.data(),
290 s3->next_proto_negotiated.size()) ||
291 !CBB_add_asn1_octet_string(&seq, s3->alpn_selected.data(),
292 s3->alpn_selected.size()) ||
293 !CBB_add_asn1_octet_string(
294 &seq, reinterpret_cast<uint8_t *>(s3->hostname.get()),
295 hostname_len) ||
296 !CBB_add_asn1_octet_string(&seq, s3->channel_id,
297 sizeof(s3->channel_id)) ||
298 !CBB_add_asn1_bool(&seq, ssl->s3->token_binding_negotiated) ||
299 !CBB_add_asn1_uint64(&seq, ssl->s3->negotiated_token_binding_param) ||
300 !CBB_add_asn1_bool(&seq, s3->hs->next_proto_neg_seen) ||
301 !CBB_add_asn1_bool(&seq, s3->hs->cert_request) ||
302 !CBB_add_asn1_bool(&seq, s3->hs->extended_master_secret) ||
303 !CBB_add_asn1_bool(&seq, s3->hs->ticket_expected) ||
304 !CBB_add_asn1_uint64(&seq, SSL_CIPHER_get_id(s3->hs->new_cipher)) ||
305 !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) ||
306 !CBB_add_asn1(&seq, &key_share, CBS_ASN1_SEQUENCE)) {
307 return false;
308 }
309 if (type == handback_after_ecdhe &&
310 !s3->hs->key_shares[0]->Serialize(&key_share)) {
311 return false;
312 }
313 return CBB_flush(out);
314 }
315
SSL_apply_handback(SSL * ssl,Span<const uint8_t> handback)316 bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) {
317 if (ssl->do_handshake != nullptr ||
318 ssl->method->is_dtls) {
319 return false;
320 }
321
322 SSL3_STATE *const s3 = ssl->s3;
323 uint64_t handback_version, negotiated_token_binding_param, cipher, type;
324
325 CBS seq, read_seq, write_seq, server_rand, client_rand, read_iv, write_iv,
326 next_proto, alpn, hostname, channel_id, transcript, key_share;
327 int session_reused, channel_id_valid, cert_request, extended_master_secret,
328 ticket_expected, token_binding_negotiated, next_proto_neg_seen;
329 SSL_SESSION *session = nullptr;
330
331 CBS handback_cbs(handback);
332 if (!CBS_get_asn1(&handback_cbs, &seq, CBS_ASN1_SEQUENCE) ||
333 !CBS_get_asn1_uint64(&seq, &handback_version) ||
334 handback_version != kHandbackVersion ||
335 !CBS_get_asn1_uint64(&seq, &type)) {
336 return false;
337 }
338
339 if (!CBS_get_asn1(&seq, &read_seq, CBS_ASN1_OCTETSTRING) ||
340 CBS_len(&read_seq) != sizeof(s3->read_sequence) ||
341 !CBS_get_asn1(&seq, &write_seq, CBS_ASN1_OCTETSTRING) ||
342 CBS_len(&write_seq) != sizeof(s3->write_sequence) ||
343 !CBS_get_asn1(&seq, &server_rand, CBS_ASN1_OCTETSTRING) ||
344 CBS_len(&server_rand) != sizeof(s3->server_random) ||
345 !CBS_copy_bytes(&server_rand, s3->server_random,
346 sizeof(s3->server_random)) ||
347 !CBS_get_asn1(&seq, &client_rand, CBS_ASN1_OCTETSTRING) ||
348 CBS_len(&client_rand) != sizeof(s3->client_random) ||
349 !CBS_copy_bytes(&client_rand, s3->client_random,
350 sizeof(s3->client_random)) ||
351 !CBS_get_asn1(&seq, &read_iv, CBS_ASN1_OCTETSTRING) ||
352 !CBS_get_asn1(&seq, &write_iv, CBS_ASN1_OCTETSTRING) ||
353 !CBS_get_asn1_bool(&seq, &session_reused) ||
354 !CBS_get_asn1_bool(&seq, &channel_id_valid)) {
355 return false;
356 }
357
358 s3->hs = ssl_handshake_new(ssl);
359 if (session_reused) {
360 ssl->session =
361 SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
362 session = ssl->session.get();
363 } else {
364 s3->hs->new_session =
365 SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
366 session = s3->hs->new_session.get();
367 }
368
369 if (!session || !CBS_get_asn1(&seq, &next_proto, CBS_ASN1_OCTETSTRING) ||
370 !CBS_get_asn1(&seq, &alpn, CBS_ASN1_OCTETSTRING) ||
371 !CBS_get_asn1(&seq, &hostname, CBS_ASN1_OCTETSTRING) ||
372 !CBS_get_asn1(&seq, &channel_id, CBS_ASN1_OCTETSTRING) ||
373 CBS_len(&channel_id) != sizeof(s3->channel_id) ||
374 !CBS_copy_bytes(&channel_id, s3->channel_id,
375 sizeof(s3->channel_id)) ||
376 !CBS_get_asn1_bool(&seq, &token_binding_negotiated) ||
377 !CBS_get_asn1_uint64(&seq, &negotiated_token_binding_param) ||
378 !CBS_get_asn1_bool(&seq, &next_proto_neg_seen) ||
379 !CBS_get_asn1_bool(&seq, &cert_request) ||
380 !CBS_get_asn1_bool(&seq, &extended_master_secret) ||
381 !CBS_get_asn1_bool(&seq, &ticket_expected) ||
382 !CBS_get_asn1_uint64(&seq, &cipher)) {
383 return false;
384 }
385 if ((s3->hs->new_cipher =
386 SSL_get_cipher_by_value(static_cast<uint16_t>(cipher))) == nullptr) {
387 return false;
388 }
389 if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) ||
390 !CBS_get_asn1(&seq, &key_share, CBS_ASN1_SEQUENCE)) {
391 return false;
392 }
393
394 ssl->version = session->ssl_version;
395 s3->have_version = true;
396 if (!ssl_method_supports_version(ssl->method, ssl->version) ||
397 session->cipher != s3->hs->new_cipher ||
398 ssl_protocol_version(ssl) < SSL_CIPHER_get_min_version(session->cipher) ||
399 SSL_CIPHER_get_max_version(session->cipher) < ssl_protocol_version(ssl)) {
400 return false;
401 }
402 ssl->do_handshake = ssl_server_handshake;
403 ssl->server = true;
404 switch (type) {
405 case handback_after_session_resumption:
406 ssl->s3->hs->state = state12_read_change_cipher_spec;
407 if (!session_reused) {
408 return false;
409 }
410 break;
411 case handback_after_ecdhe:
412 ssl->s3->hs->state = state12_read_client_certificate;
413 if (session_reused) {
414 return false;
415 }
416 break;
417 case handback_after_handshake:
418 ssl->s3->hs->state = state12_finish_server_handshake;
419 break;
420 default:
421 return false;
422 }
423 s3->session_reused = session_reused;
424 s3->channel_id_valid = channel_id_valid;
425 s3->next_proto_negotiated.CopyFrom(next_proto);
426 s3->alpn_selected.CopyFrom(alpn);
427
428 const size_t hostname_len = CBS_len(&hostname);
429 if (hostname_len == 0) {
430 s3->hostname.reset();
431 } else {
432 char *hostname_str = nullptr;
433 if (!CBS_strdup(&hostname, &hostname_str)) {
434 return false;
435 }
436 s3->hostname.reset(hostname_str);
437 }
438
439 s3->token_binding_negotiated = token_binding_negotiated;
440 s3->negotiated_token_binding_param =
441 static_cast<uint8_t>(negotiated_token_binding_param);
442 s3->hs->next_proto_neg_seen = next_proto_neg_seen;
443 s3->hs->wait = ssl_hs_flush;
444 s3->hs->extended_master_secret = extended_master_secret;
445 s3->hs->ticket_expected = ticket_expected;
446 s3->aead_write_ctx->SetVersionIfNullCipher(ssl->version);
447 s3->hs->cert_request = cert_request;
448
449 Array<uint8_t> key_block;
450 if ((type == handback_after_session_resumption ||
451 type == handback_after_handshake) &&
452 (!tls1_configure_aead(ssl, evp_aead_seal, &key_block, session->cipher,
453 write_iv) ||
454 !CBS_copy_bytes(&write_seq, s3->write_sequence,
455 sizeof(s3->write_sequence)))) {
456 return false;
457 }
458 if (type == handback_after_handshake &&
459 (!tls1_configure_aead(ssl, evp_aead_open, &key_block, session->cipher,
460 read_iv) ||
461 !CBS_copy_bytes(&read_seq, s3->read_sequence,
462 sizeof(s3->read_sequence)))) {
463 return false;
464 }
465 if ((type == handback_after_ecdhe ||
466 type == handback_after_session_resumption) &&
467 (!s3->hs->transcript.Init() ||
468 !s3->hs->transcript.InitHash(ssl_protocol_version(ssl),
469 s3->hs->new_cipher) ||
470 !s3->hs->transcript.Update(transcript))) {
471 return false;
472 }
473 if (type == handback_after_ecdhe &&
474 (s3->hs->key_shares[0] = SSLKeyShare::Create(&key_share)) == nullptr) {
475 return false;
476 }
477
478 return CBS_len(&seq) == 0;
479 }
480
481 BSSL_NAMESPACE_END
482