1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57 /* ====================================================================
58 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com). */
108
109 #include <openssl/ssl.h>
110
111 #include <assert.h>
112 #include <limits.h>
113 #include <string.h>
114
115 #include <openssl/buf.h>
116 #include <openssl/err.h>
117 #include <openssl/evp.h>
118 #include <openssl/mem.h>
119 #include <openssl/rand.h>
120
121 #include "../crypto/internal.h"
122 #include "internal.h"
123
124
125 static int do_ssl3_write(SSL *ssl, int type, const uint8_t *buf, unsigned len);
126
127 /* ssl3_get_record reads a new input record. On success, it places it in
128 * |ssl->s3->rrec| and returns one. Otherwise it returns <= 0 on error or if
129 * more data is needed. */
ssl3_get_record(SSL * ssl)130 static int ssl3_get_record(SSL *ssl) {
131 again:
132 switch (ssl->s3->recv_shutdown) {
133 case ssl_shutdown_none:
134 break;
135 case ssl_shutdown_fatal_alert:
136 OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
137 return -1;
138 case ssl_shutdown_close_notify:
139 return 0;
140 }
141
142 CBS body;
143 uint8_t type, alert = SSL_AD_DECODE_ERROR;
144 size_t consumed;
145 enum ssl_open_record_t open_ret =
146 tls_open_record(ssl, &type, &body, &consumed, &alert,
147 ssl_read_buffer(ssl), ssl_read_buffer_len(ssl));
148 if (open_ret != ssl_open_record_partial) {
149 ssl_read_buffer_consume(ssl, consumed);
150 }
151 switch (open_ret) {
152 case ssl_open_record_partial: {
153 int read_ret = ssl_read_buffer_extend_to(ssl, consumed);
154 if (read_ret <= 0) {
155 return read_ret;
156 }
157 goto again;
158 }
159
160 case ssl_open_record_success:
161 if (CBS_len(&body) > 0xffff) {
162 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
163 return -1;
164 }
165
166 SSL3_RECORD *rr = &ssl->s3->rrec;
167 rr->type = type;
168 rr->length = (uint16_t)CBS_len(&body);
169 rr->data = (uint8_t *)CBS_data(&body);
170 return 1;
171
172 case ssl_open_record_discard:
173 goto again;
174
175 case ssl_open_record_close_notify:
176 return 0;
177
178 case ssl_open_record_fatal_alert:
179 return -1;
180
181 case ssl_open_record_error:
182 ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
183 return -1;
184 }
185
186 assert(0);
187 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
188 return -1;
189 }
190
ssl3_write_app_data(SSL * ssl,const uint8_t * buf,int len)191 int ssl3_write_app_data(SSL *ssl, const uint8_t *buf, int len) {
192 assert(ssl_can_write(ssl));
193
194 unsigned tot, n, nw;
195
196 assert(ssl->s3->wnum <= INT_MAX);
197 tot = ssl->s3->wnum;
198 ssl->s3->wnum = 0;
199
200 /* Ensure that if we end up with a smaller value of data to write out than
201 * the the original len from a write which didn't complete for non-blocking
202 * I/O and also somehow ended up avoiding the check for this in
203 * ssl3_write_pending/SSL_R_BAD_WRITE_RETRY as it must never be possible to
204 * end up with (len-tot) as a large number that will then promptly send
205 * beyond the end of the users buffer ... so we trap and report the error in
206 * a way the user will notice. */
207 if (len < 0 || (size_t)len < tot) {
208 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_LENGTH);
209 return -1;
210 }
211
212 n = len - tot;
213 for (;;) {
214 /* max contains the maximum number of bytes that we can put into a
215 * record. */
216 unsigned max = ssl->max_send_fragment;
217 if (n > max) {
218 nw = max;
219 } else {
220 nw = n;
221 }
222
223 int ret = do_ssl3_write(ssl, SSL3_RT_APPLICATION_DATA, &buf[tot], nw);
224 if (ret <= 0) {
225 ssl->s3->wnum = tot;
226 return ret;
227 }
228
229 if (ret == (int)n || (ssl->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)) {
230 return tot + ret;
231 }
232
233 n -= ret;
234 tot += ret;
235 }
236 }
237
ssl3_write_pending(SSL * ssl,int type,const uint8_t * buf,unsigned int len)238 static int ssl3_write_pending(SSL *ssl, int type, const uint8_t *buf,
239 unsigned int len) {
240 if (ssl->s3->wpend_tot > (int)len ||
241 (!(ssl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) &&
242 ssl->s3->wpend_buf != buf) ||
243 ssl->s3->wpend_type != type) {
244 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_WRITE_RETRY);
245 return -1;
246 }
247
248 int ret = ssl_write_buffer_flush(ssl);
249 if (ret <= 0) {
250 return ret;
251 }
252 return ssl->s3->wpend_ret;
253 }
254
255 /* do_ssl3_write writes an SSL record of the given type. */
do_ssl3_write(SSL * ssl,int type,const uint8_t * buf,unsigned len)256 static int do_ssl3_write(SSL *ssl, int type, const uint8_t *buf, unsigned len) {
257 /* If there is still data from the previous record, flush it. */
258 if (ssl_write_buffer_is_pending(ssl)) {
259 return ssl3_write_pending(ssl, type, buf, len);
260 }
261
262 /* The handshake flight buffer is mutually exclusive with application data.
263 *
264 * TODO(davidben): This will not be true when closure alerts use this. */
265 if (ssl->s3->pending_flight != NULL) {
266 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
267 return -1;
268 }
269
270 if (len > SSL3_RT_MAX_PLAIN_LENGTH) {
271 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
272 return -1;
273 }
274
275 if (len == 0) {
276 return 0;
277 }
278
279 size_t max_out = len + SSL_max_seal_overhead(ssl);
280 if (max_out < len) {
281 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
282 return -1;
283 }
284 uint8_t *out;
285 size_t ciphertext_len;
286 if (!ssl_write_buffer_init(ssl, &out, max_out) ||
287 !tls_seal_record(ssl, out, &ciphertext_len, max_out, type, buf, len)) {
288 return -1;
289 }
290 ssl_write_buffer_set_len(ssl, ciphertext_len);
291
292 /* memorize arguments so that ssl3_write_pending can detect bad write retries
293 * later */
294 ssl->s3->wpend_tot = len;
295 ssl->s3->wpend_buf = buf;
296 ssl->s3->wpend_type = type;
297 ssl->s3->wpend_ret = len;
298
299 /* we now just need to write the buffer */
300 return ssl3_write_pending(ssl, type, buf, len);
301 }
302
consume_record(SSL * ssl,uint8_t * out,int len,int peek)303 static int consume_record(SSL *ssl, uint8_t *out, int len, int peek) {
304 SSL3_RECORD *rr = &ssl->s3->rrec;
305
306 if (len <= 0) {
307 return len;
308 }
309
310 if (len > (int)rr->length) {
311 len = (int)rr->length;
312 }
313
314 OPENSSL_memcpy(out, rr->data, len);
315 if (!peek) {
316 rr->length -= len;
317 rr->data += len;
318 if (rr->length == 0) {
319 /* The record has been consumed, so we may now clear the buffer. */
320 ssl_read_buffer_discard(ssl);
321 }
322 }
323 return len;
324 }
325
ssl3_read_app_data(SSL * ssl,int * out_got_handshake,uint8_t * buf,int len,int peek)326 int ssl3_read_app_data(SSL *ssl, int *out_got_handshake, uint8_t *buf, int len,
327 int peek) {
328 assert(ssl_can_read(ssl));
329 *out_got_handshake = 0;
330
331 ssl->method->release_current_message(ssl, 0 /* don't free buffer */);
332
333 SSL3_RECORD *rr = &ssl->s3->rrec;
334
335 for (;;) {
336 /* A previous iteration may have read a partial handshake message. Do not
337 * allow more app data in that case. */
338 int has_hs_data = ssl->init_buf != NULL && ssl->init_buf->length > 0;
339
340 /* Get new packet if necessary. */
341 if (rr->length == 0 && !has_hs_data) {
342 int ret = ssl3_get_record(ssl);
343 if (ret <= 0) {
344 return ret;
345 }
346 }
347
348 if (has_hs_data || rr->type == SSL3_RT_HANDSHAKE) {
349 /* If reading 0-RTT data, reject handshake data. 0-RTT data is terminated
350 * by an alert. */
351 if (SSL_in_init(ssl)) {
352 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
353 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
354 return -1;
355 }
356
357 /* Post-handshake data prior to TLS 1.3 is always renegotiation, which we
358 * never accept as a server. Otherwise |ssl3_get_message| will send
359 * |SSL_R_EXCESSIVE_MESSAGE_SIZE|. */
360 if (ssl->server && ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
361 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION);
362 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
363 return -1;
364 }
365
366 /* Parse post-handshake handshake messages. */
367 int ret = ssl3_get_message(ssl);
368 if (ret <= 0) {
369 return ret;
370 }
371 *out_got_handshake = 1;
372 return -1;
373 }
374
375 /* Handle the end_of_early_data alert. */
376 if (rr->type == SSL3_RT_ALERT &&
377 rr->length == 2 &&
378 rr->data[0] == SSL3_AL_WARNING &&
379 rr->data[1] == TLS1_AD_END_OF_EARLY_DATA &&
380 ssl->server &&
381 ssl->s3->hs != NULL &&
382 ssl->s3->hs->can_early_read &&
383 ssl3_protocol_version(ssl) >= TLS1_3_VERSION) {
384 /* Consume the record. */
385 rr->length = 0;
386 ssl_read_buffer_discard(ssl);
387 /* Stop accepting early data. */
388 ssl->s3->hs->can_early_read = 0;
389 *out_got_handshake = 1;
390 return -1;
391 }
392
393 if (rr->type != SSL3_RT_APPLICATION_DATA) {
394 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
395 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
396 return -1;
397 }
398
399 if (rr->length != 0) {
400 return consume_record(ssl, buf, len, peek);
401 }
402
403 /* Discard empty records and loop again. */
404 }
405 }
406
ssl3_read_change_cipher_spec(SSL * ssl)407 int ssl3_read_change_cipher_spec(SSL *ssl) {
408 SSL3_RECORD *rr = &ssl->s3->rrec;
409
410 if (rr->length == 0) {
411 int ret = ssl3_get_record(ssl);
412 if (ret <= 0) {
413 return ret;
414 }
415 }
416
417 if (rr->type != SSL3_RT_CHANGE_CIPHER_SPEC) {
418 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
419 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
420 return -1;
421 }
422
423 if (rr->length != 1 || rr->data[0] != SSL3_MT_CCS) {
424 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_CHANGE_CIPHER_SPEC);
425 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
426 return -1;
427 }
428
429 ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_CHANGE_CIPHER_SPEC, rr->data,
430 rr->length);
431
432 rr->length = 0;
433 ssl_read_buffer_discard(ssl);
434 return 1;
435 }
436
ssl3_read_close_notify(SSL * ssl)437 void ssl3_read_close_notify(SSL *ssl) {
438 /* Read records until an error or close_notify. */
439 while (ssl3_get_record(ssl) > 0) {
440 ;
441 }
442 }
443
ssl3_read_handshake_bytes(SSL * ssl,uint8_t * buf,int len)444 int ssl3_read_handshake_bytes(SSL *ssl, uint8_t *buf, int len) {
445 SSL3_RECORD *rr = &ssl->s3->rrec;
446
447 for (;;) {
448 /* Get new packet if necessary. */
449 if (rr->length == 0) {
450 int ret = ssl3_get_record(ssl);
451 if (ret <= 0) {
452 return ret;
453 }
454 }
455
456 if (rr->type != SSL3_RT_HANDSHAKE) {
457 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
458 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
459 return -1;
460 }
461
462 if (rr->length != 0) {
463 return consume_record(ssl, buf, len, 0 /* consume data */);
464 }
465
466 /* Discard empty records and loop again. */
467 }
468 }
469
ssl3_send_alert(SSL * ssl,int level,int desc)470 int ssl3_send_alert(SSL *ssl, int level, int desc) {
471 /* It is illegal to send an alert when we've already sent a closing one. */
472 if (ssl->s3->send_shutdown != ssl_shutdown_none) {
473 OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
474 return -1;
475 }
476
477 if (level == SSL3_AL_WARNING && desc == SSL_AD_CLOSE_NOTIFY) {
478 ssl->s3->send_shutdown = ssl_shutdown_close_notify;
479 } else {
480 assert(level == SSL3_AL_FATAL);
481 ssl->s3->send_shutdown = ssl_shutdown_fatal_alert;
482 }
483
484 ssl->s3->alert_dispatch = 1;
485 ssl->s3->send_alert[0] = level;
486 ssl->s3->send_alert[1] = desc;
487 if (!ssl_write_buffer_is_pending(ssl)) {
488 /* Nothing is being written out, so the alert may be dispatched
489 * immediately. */
490 return ssl->method->dispatch_alert(ssl);
491 }
492
493 /* The alert will be dispatched later. */
494 return -1;
495 }
496
ssl3_dispatch_alert(SSL * ssl)497 int ssl3_dispatch_alert(SSL *ssl) {
498 int ret = do_ssl3_write(ssl, SSL3_RT_ALERT, &ssl->s3->send_alert[0], 2);
499 if (ret <= 0) {
500 return ret;
501 }
502 ssl->s3->alert_dispatch = 0;
503
504 /* If the alert is fatal, flush the BIO now. */
505 if (ssl->s3->send_alert[0] == SSL3_AL_FATAL) {
506 BIO_flush(ssl->wbio);
507 }
508
509 ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_ALERT, ssl->s3->send_alert,
510 2);
511
512 int alert = (ssl->s3->send_alert[0] << 8) | ssl->s3->send_alert[1];
513 ssl_do_info_callback(ssl, SSL_CB_WRITE_ALERT, alert);
514
515 return 1;
516 }
517