/src/openssl/ssl/t1_enc.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * Copyright 2005 Nokia. All rights reserved. |
4 | | * |
5 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
6 | | * this file except in compliance with the License. You can obtain a copy |
7 | | * in the file LICENSE in the source distribution or at |
8 | | * https://www.openssl.org/source/license.html |
9 | | */ |
10 | | |
11 | | #include <stdio.h> |
12 | | #include "ssl_local.h" |
13 | | #include "record/record_local.h" |
14 | | #include "internal/ktls.h" |
15 | | #include "internal/cryptlib.h" |
16 | | #include <openssl/comp.h> |
17 | | #include <openssl/evp.h> |
18 | | #include <openssl/kdf.h> |
19 | | #include <openssl/rand.h> |
20 | | #include <openssl/obj_mac.h> |
21 | | #include <openssl/core_names.h> |
22 | | #include <openssl/trace.h> |
23 | | |
24 | | /* seed1 through seed5 are concatenated */ |
25 | | static int tls1_PRF(SSL_CONNECTION *s, |
26 | | const void *seed1, size_t seed1_len, |
27 | | const void *seed2, size_t seed2_len, |
28 | | const void *seed3, size_t seed3_len, |
29 | | const void *seed4, size_t seed4_len, |
30 | | const void *seed5, size_t seed5_len, |
31 | | const unsigned char *sec, size_t slen, |
32 | | unsigned char *out, size_t olen, int fatal) |
33 | 0 | { |
34 | 0 | const EVP_MD *md = ssl_prf_md(s); |
35 | 0 | EVP_KDF *kdf; |
36 | 0 | EVP_KDF_CTX *kctx = NULL; |
37 | 0 | OSSL_PARAM params[8], *p = params; |
38 | 0 | const char *mdname; |
39 | |
|
40 | 0 | if (md == NULL) { |
41 | | /* Should never happen */ |
42 | 0 | if (fatal) |
43 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
44 | 0 | else |
45 | 0 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
46 | 0 | return 0; |
47 | 0 | } |
48 | 0 | kdf = EVP_KDF_fetch(SSL_CONNECTION_GET_CTX(s)->libctx, |
49 | 0 | OSSL_KDF_NAME_TLS1_PRF, |
50 | 0 | SSL_CONNECTION_GET_CTX(s)->propq); |
51 | 0 | if (kdf == NULL) |
52 | 0 | goto err; |
53 | 0 | kctx = EVP_KDF_CTX_new(kdf); |
54 | 0 | EVP_KDF_free(kdf); |
55 | 0 | if (kctx == NULL) |
56 | 0 | goto err; |
57 | 0 | mdname = EVP_MD_get0_name(md); |
58 | 0 | *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, |
59 | 0 | (char *)mdname, 0); |
60 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, |
61 | 0 | (unsigned char *)sec, |
62 | 0 | (size_t)slen); |
63 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
64 | 0 | (void *)seed1, (size_t)seed1_len); |
65 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
66 | 0 | (void *)seed2, (size_t)seed2_len); |
67 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
68 | 0 | (void *)seed3, (size_t)seed3_len); |
69 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
70 | 0 | (void *)seed4, (size_t)seed4_len); |
71 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
72 | 0 | (void *)seed5, (size_t)seed5_len); |
73 | 0 | *p = OSSL_PARAM_construct_end(); |
74 | 0 | if (EVP_KDF_derive(kctx, out, olen, params)) { |
75 | 0 | EVP_KDF_CTX_free(kctx); |
76 | 0 | return 1; |
77 | 0 | } |
78 | | |
79 | 0 | err: |
80 | 0 | if (fatal) |
81 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
82 | 0 | else |
83 | 0 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
84 | 0 | EVP_KDF_CTX_free(kctx); |
85 | 0 | return 0; |
86 | 0 | } |
87 | | |
88 | | static int tls1_generate_key_block(SSL_CONNECTION *s, unsigned char *km, |
89 | | size_t num) |
90 | 0 | { |
91 | 0 | int ret; |
92 | | |
93 | | /* Calls SSLfatal() as required */ |
94 | 0 | ret = tls1_PRF(s, |
95 | 0 | TLS_MD_KEY_EXPANSION_CONST, |
96 | 0 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random, |
97 | 0 | SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE, |
98 | 0 | NULL, 0, NULL, 0, s->session->master_key, |
99 | 0 | s->session->master_key_length, km, num, 1); |
100 | |
|
101 | 0 | return ret; |
102 | 0 | } |
103 | | |
104 | | int tls_provider_set_tls_params(SSL_CONNECTION *s, EVP_CIPHER_CTX *ctx, |
105 | | const EVP_CIPHER *ciph, |
106 | | const EVP_MD *md) |
107 | 0 | { |
108 | | /* |
109 | | * Provided cipher, the TLS padding/MAC removal is performed provider |
110 | | * side so we need to tell the ctx about our TLS version and mac size |
111 | | */ |
112 | 0 | OSSL_PARAM params[3], *pprm = params; |
113 | 0 | size_t macsize = 0; |
114 | 0 | int imacsize = -1; |
115 | |
|
116 | 0 | if ((EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0 |
117 | | /* |
118 | | * We look at s->ext.use_etm instead of SSL_READ_ETM() or |
119 | | * SSL_WRITE_ETM() because this test applies to both reading |
120 | | * and writing. |
121 | | */ |
122 | 0 | && !s->ext.use_etm) |
123 | 0 | imacsize = EVP_MD_get_size(md); |
124 | 0 | if (imacsize >= 0) |
125 | 0 | macsize = (size_t)imacsize; |
126 | |
|
127 | 0 | *pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION, |
128 | 0 | &s->version); |
129 | 0 | *pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE, |
130 | 0 | &macsize); |
131 | 0 | *pprm = OSSL_PARAM_construct_end(); |
132 | |
|
133 | 0 | if (!EVP_CIPHER_CTX_set_params(ctx, params)) { |
134 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
135 | 0 | return 0; |
136 | 0 | } |
137 | | |
138 | 0 | return 1; |
139 | 0 | } |
140 | | |
141 | | |
142 | | static int tls_iv_length_within_key_block(const EVP_CIPHER *c) |
143 | 0 | { |
144 | | /* If GCM/CCM mode only part of IV comes from PRF */ |
145 | 0 | if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) |
146 | 0 | return EVP_GCM_TLS_FIXED_IV_LEN; |
147 | 0 | else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) |
148 | 0 | return EVP_CCM_TLS_FIXED_IV_LEN; |
149 | 0 | else |
150 | 0 | return EVP_CIPHER_get_iv_length(c); |
151 | 0 | } |
152 | | |
153 | | int tls1_change_cipher_state(SSL_CONNECTION *s, int which) |
154 | 0 | { |
155 | 0 | unsigned char *p, *mac_secret; |
156 | 0 | unsigned char *key, *iv; |
157 | 0 | const EVP_CIPHER *c; |
158 | 0 | const SSL_COMP *comp = NULL; |
159 | 0 | const EVP_MD *m; |
160 | 0 | int mac_type; |
161 | 0 | size_t mac_secret_size; |
162 | 0 | size_t n, i, j, k, cl; |
163 | 0 | int iivlen; |
164 | | /* |
165 | | * Taglen is only relevant for CCM ciphersuites. Other ciphersuites |
166 | | * ignore this value so we can default it to 0. |
167 | | */ |
168 | 0 | size_t taglen = 0; |
169 | 0 | int direction; |
170 | |
|
171 | 0 | c = s->s3.tmp.new_sym_enc; |
172 | 0 | m = s->s3.tmp.new_hash; |
173 | 0 | mac_type = s->s3.tmp.new_mac_pkey_type; |
174 | 0 | #ifndef OPENSSL_NO_COMP |
175 | 0 | comp = s->s3.tmp.new_compression; |
176 | 0 | #endif |
177 | |
|
178 | 0 | p = s->s3.tmp.key_block; |
179 | 0 | i = mac_secret_size = s->s3.tmp.new_mac_secret_size; |
180 | |
|
181 | 0 | cl = EVP_CIPHER_get_key_length(c); |
182 | 0 | j = cl; |
183 | 0 | iivlen = tls_iv_length_within_key_block(c); |
184 | 0 | if (iivlen < 0) { |
185 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
186 | 0 | goto err; |
187 | 0 | } |
188 | 0 | k = iivlen; |
189 | 0 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || |
190 | 0 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { |
191 | 0 | mac_secret = &(p[0]); |
192 | 0 | n = i + i; |
193 | 0 | key = &(p[n]); |
194 | 0 | n += j + j; |
195 | 0 | iv = &(p[n]); |
196 | 0 | n += k + k; |
197 | 0 | } else { |
198 | 0 | n = i; |
199 | 0 | mac_secret = &(p[n]); |
200 | 0 | n += i + j; |
201 | 0 | key = &(p[n]); |
202 | 0 | n += j + k; |
203 | 0 | iv = &(p[n]); |
204 | 0 | n += k; |
205 | 0 | } |
206 | |
|
207 | 0 | if (n > s->s3.tmp.key_block_length) { |
208 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
209 | 0 | goto err; |
210 | 0 | } |
211 | | |
212 | 0 | switch (EVP_CIPHER_get_mode(c)) { |
213 | 0 | case EVP_CIPH_GCM_MODE: |
214 | 0 | taglen = EVP_GCM_TLS_TAG_LEN; |
215 | 0 | break; |
216 | 0 | case EVP_CIPH_CCM_MODE: |
217 | 0 | if ((s->s3.tmp.new_cipher->algorithm_enc |
218 | 0 | & (SSL_AES128CCM8 | SSL_AES256CCM8)) != 0) |
219 | 0 | taglen = EVP_CCM8_TLS_TAG_LEN; |
220 | 0 | else |
221 | 0 | taglen = EVP_CCM_TLS_TAG_LEN; |
222 | 0 | break; |
223 | 0 | default: |
224 | 0 | if (EVP_CIPHER_is_a(c, "CHACHA20-POLY1305")) { |
225 | 0 | taglen = EVP_CHACHAPOLY_TLS_TAG_LEN; |
226 | 0 | } else { |
227 | | /* MAC secret size corresponds to the MAC output size */ |
228 | 0 | taglen = s->s3.tmp.new_mac_secret_size; |
229 | 0 | } |
230 | 0 | break; |
231 | 0 | } |
232 | | |
233 | 0 | if (which & SSL3_CC_READ) { |
234 | 0 | if (s->ext.use_etm) |
235 | 0 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; |
236 | 0 | else |
237 | 0 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; |
238 | |
|
239 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
240 | 0 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; |
241 | 0 | else |
242 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; |
243 | |
|
244 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) |
245 | 0 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_TLSTREE; |
246 | 0 | else |
247 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_TLSTREE; |
248 | |
|
249 | 0 | direction = OSSL_RECORD_DIRECTION_READ; |
250 | 0 | } else { |
251 | 0 | if (s->ext.use_etm) |
252 | 0 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
253 | 0 | else |
254 | 0 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
255 | |
|
256 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
257 | 0 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; |
258 | 0 | else |
259 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; |
260 | |
|
261 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) |
262 | 0 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_TLSTREE; |
263 | 0 | else |
264 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_TLSTREE; |
265 | |
|
266 | 0 | direction = OSSL_RECORD_DIRECTION_WRITE; |
267 | 0 | } |
268 | |
|
269 | 0 | if (!ssl_set_new_record_layer(s, s->version, direction, |
270 | 0 | OSSL_RECORD_PROTECTION_LEVEL_APPLICATION, |
271 | 0 | NULL, 0, key, cl, iv, (size_t)k, mac_secret, |
272 | 0 | mac_secret_size, c, taglen, mac_type, |
273 | 0 | m, comp, NULL)) { |
274 | | /* SSLfatal already called */ |
275 | 0 | goto err; |
276 | 0 | } |
277 | | |
278 | 0 | OSSL_TRACE_BEGIN(TLS) { |
279 | 0 | BIO_printf(trc_out, "which = %04X, key:\n", which); |
280 | 0 | BIO_dump_indent(trc_out, key, EVP_CIPHER_get_key_length(c), 4); |
281 | 0 | BIO_printf(trc_out, "iv:\n"); |
282 | 0 | BIO_dump_indent(trc_out, iv, k, 4); |
283 | 0 | } OSSL_TRACE_END(TLS); |
284 | |
|
285 | 0 | return 1; |
286 | 0 | err: |
287 | 0 | return 0; |
288 | 0 | } |
289 | | |
290 | | int tls1_setup_key_block(SSL_CONNECTION *s) |
291 | 0 | { |
292 | 0 | unsigned char *p; |
293 | 0 | const EVP_CIPHER *c; |
294 | 0 | const EVP_MD *hash; |
295 | 0 | SSL_COMP *comp; |
296 | 0 | int mac_type = NID_undef; |
297 | 0 | size_t num, mac_secret_size = 0; |
298 | 0 | int ret = 0; |
299 | 0 | int ivlen; |
300 | |
|
301 | 0 | if (s->s3.tmp.key_block_length != 0) |
302 | 0 | return 1; |
303 | | |
304 | 0 | if (!ssl_cipher_get_evp(SSL_CONNECTION_GET_CTX(s), s->session, &c, &hash, |
305 | 0 | &mac_type, &mac_secret_size, &comp, |
306 | 0 | s->ext.use_etm)) { |
307 | | /* Error is already recorded */ |
308 | 0 | SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); |
309 | 0 | return 0; |
310 | 0 | } |
311 | | |
312 | 0 | ssl_evp_cipher_free(s->s3.tmp.new_sym_enc); |
313 | 0 | s->s3.tmp.new_sym_enc = c; |
314 | 0 | ssl_evp_md_free(s->s3.tmp.new_hash); |
315 | 0 | s->s3.tmp.new_hash = hash; |
316 | 0 | s->s3.tmp.new_mac_pkey_type = mac_type; |
317 | 0 | s->s3.tmp.new_mac_secret_size = mac_secret_size; |
318 | 0 | ivlen = tls_iv_length_within_key_block(c); |
319 | 0 | if (ivlen < 0) { |
320 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
321 | 0 | return 0; |
322 | 0 | } |
323 | 0 | num = mac_secret_size + EVP_CIPHER_get_key_length(c) + ivlen; |
324 | 0 | num *= 2; |
325 | |
|
326 | 0 | ssl3_cleanup_key_block(s); |
327 | |
|
328 | 0 | if ((p = OPENSSL_malloc(num)) == NULL) { |
329 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); |
330 | 0 | goto err; |
331 | 0 | } |
332 | | |
333 | 0 | s->s3.tmp.key_block_length = num; |
334 | 0 | s->s3.tmp.key_block = p; |
335 | |
|
336 | 0 | OSSL_TRACE_BEGIN(TLS) { |
337 | 0 | BIO_printf(trc_out, "key block length: %zu\n", num); |
338 | 0 | BIO_printf(trc_out, "client random\n"); |
339 | 0 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
340 | 0 | BIO_printf(trc_out, "server random\n"); |
341 | 0 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
342 | 0 | BIO_printf(trc_out, "master key\n"); |
343 | 0 | BIO_dump_indent(trc_out, |
344 | 0 | s->session->master_key, |
345 | 0 | s->session->master_key_length, 4); |
346 | 0 | } OSSL_TRACE_END(TLS); |
347 | |
|
348 | 0 | if (!tls1_generate_key_block(s, p, num)) { |
349 | | /* SSLfatal() already called */ |
350 | 0 | goto err; |
351 | 0 | } |
352 | | |
353 | 0 | OSSL_TRACE_BEGIN(TLS) { |
354 | 0 | BIO_printf(trc_out, "key block\n"); |
355 | 0 | BIO_dump_indent(trc_out, p, num, 4); |
356 | 0 | } OSSL_TRACE_END(TLS); |
357 | |
|
358 | 0 | ret = 1; |
359 | 0 | err: |
360 | 0 | return ret; |
361 | 0 | } |
362 | | |
363 | | size_t tls1_final_finish_mac(SSL_CONNECTION *s, const char *str, |
364 | | size_t slen, unsigned char *out) |
365 | 0 | { |
366 | 0 | size_t hashlen; |
367 | 0 | unsigned char hash[EVP_MAX_MD_SIZE]; |
368 | 0 | size_t finished_size = TLS1_FINISH_MAC_LENGTH; |
369 | |
|
370 | 0 | if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kGOST18) |
371 | 0 | finished_size = 32; |
372 | |
|
373 | 0 | if (!ssl3_digest_cached_records(s, 0)) { |
374 | | /* SSLfatal() already called */ |
375 | 0 | return 0; |
376 | 0 | } |
377 | | |
378 | 0 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
379 | | /* SSLfatal() already called */ |
380 | 0 | return 0; |
381 | 0 | } |
382 | | |
383 | 0 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
384 | 0 | s->session->master_key, s->session->master_key_length, |
385 | 0 | out, finished_size, 1)) { |
386 | | /* SSLfatal() already called */ |
387 | 0 | return 0; |
388 | 0 | } |
389 | 0 | OPENSSL_cleanse(hash, hashlen); |
390 | 0 | return finished_size; |
391 | 0 | } |
392 | | |
393 | | int tls1_generate_master_secret(SSL_CONNECTION *s, unsigned char *out, |
394 | | unsigned char *p, size_t len, |
395 | | size_t *secret_size) |
396 | 0 | { |
397 | 0 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
398 | 0 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
399 | 0 | size_t hashlen; |
400 | | /* |
401 | | * Digest cached records keeping record buffer (if present): this won't |
402 | | * affect client auth because we're freezing the buffer at the same |
403 | | * point (after client key exchange and before certificate verify) |
404 | | */ |
405 | 0 | if (!ssl3_digest_cached_records(s, 1) |
406 | 0 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
407 | | /* SSLfatal() already called */ |
408 | 0 | return 0; |
409 | 0 | } |
410 | 0 | OSSL_TRACE_BEGIN(TLS) { |
411 | 0 | BIO_printf(trc_out, "Handshake hashes:\n"); |
412 | 0 | BIO_dump(trc_out, (char *)hash, hashlen); |
413 | 0 | } OSSL_TRACE_END(TLS); |
414 | 0 | if (!tls1_PRF(s, |
415 | 0 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
416 | 0 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, |
417 | 0 | hash, hashlen, |
418 | 0 | NULL, 0, |
419 | 0 | NULL, 0, |
420 | 0 | NULL, 0, p, len, out, |
421 | 0 | SSL3_MASTER_SECRET_SIZE, 1)) { |
422 | | /* SSLfatal() already called */ |
423 | 0 | return 0; |
424 | 0 | } |
425 | 0 | OPENSSL_cleanse(hash, hashlen); |
426 | 0 | } else { |
427 | 0 | if (!tls1_PRF(s, |
428 | 0 | TLS_MD_MASTER_SECRET_CONST, |
429 | 0 | TLS_MD_MASTER_SECRET_CONST_SIZE, |
430 | 0 | s->s3.client_random, SSL3_RANDOM_SIZE, |
431 | 0 | NULL, 0, |
432 | 0 | s->s3.server_random, SSL3_RANDOM_SIZE, |
433 | 0 | NULL, 0, p, len, out, |
434 | 0 | SSL3_MASTER_SECRET_SIZE, 1)) { |
435 | | /* SSLfatal() already called */ |
436 | 0 | return 0; |
437 | 0 | } |
438 | 0 | } |
439 | | |
440 | 0 | OSSL_TRACE_BEGIN(TLS) { |
441 | 0 | BIO_printf(trc_out, "Premaster Secret:\n"); |
442 | 0 | BIO_dump_indent(trc_out, p, len, 4); |
443 | 0 | BIO_printf(trc_out, "Client Random:\n"); |
444 | 0 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
445 | 0 | BIO_printf(trc_out, "Server Random:\n"); |
446 | 0 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
447 | 0 | BIO_printf(trc_out, "Master Secret:\n"); |
448 | 0 | BIO_dump_indent(trc_out, |
449 | 0 | s->session->master_key, |
450 | 0 | SSL3_MASTER_SECRET_SIZE, 4); |
451 | 0 | } OSSL_TRACE_END(TLS); |
452 | |
|
453 | 0 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
454 | 0 | return 1; |
455 | 0 | } |
456 | | |
457 | | int tls1_export_keying_material(SSL_CONNECTION *s, unsigned char *out, |
458 | | size_t olen, const char *label, size_t llen, |
459 | | const unsigned char *context, |
460 | | size_t contextlen, int use_context) |
461 | 0 | { |
462 | 0 | unsigned char *val = NULL; |
463 | 0 | size_t vallen = 0, currentvalpos; |
464 | 0 | int rv = 0; |
465 | | |
466 | | /* |
467 | | * construct PRF arguments we construct the PRF argument ourself rather |
468 | | * than passing separate values into the TLS PRF to ensure that the |
469 | | * concatenation of values does not create a prohibited label. |
470 | | */ |
471 | 0 | vallen = llen + SSL3_RANDOM_SIZE * 2; |
472 | 0 | if (use_context) { |
473 | 0 | vallen += 2 + contextlen; |
474 | 0 | } |
475 | |
|
476 | 0 | val = OPENSSL_malloc(vallen); |
477 | 0 | if (val == NULL) |
478 | 0 | goto ret; |
479 | 0 | currentvalpos = 0; |
480 | 0 | memcpy(val + currentvalpos, (unsigned char *)label, llen); |
481 | 0 | currentvalpos += llen; |
482 | 0 | memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE); |
483 | 0 | currentvalpos += SSL3_RANDOM_SIZE; |
484 | 0 | memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE); |
485 | 0 | currentvalpos += SSL3_RANDOM_SIZE; |
486 | |
|
487 | 0 | if (use_context) { |
488 | 0 | val[currentvalpos] = (contextlen >> 8) & 0xff; |
489 | 0 | currentvalpos++; |
490 | 0 | val[currentvalpos] = contextlen & 0xff; |
491 | 0 | currentvalpos++; |
492 | 0 | if ((contextlen > 0) || (context != NULL)) { |
493 | 0 | memcpy(val + currentvalpos, context, contextlen); |
494 | 0 | } |
495 | 0 | } |
496 | | |
497 | | /* |
498 | | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited |
499 | | * label len) = 15, so size of val > max(prohibited label len) = 15 and |
500 | | * the comparisons won't have buffer overflow |
501 | | */ |
502 | 0 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, |
503 | 0 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) |
504 | 0 | goto err1; |
505 | 0 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, |
506 | 0 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) |
507 | 0 | goto err1; |
508 | 0 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, |
509 | 0 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) |
510 | 0 | goto err1; |
511 | 0 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
512 | 0 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) |
513 | 0 | goto err1; |
514 | 0 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
515 | 0 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) |
516 | 0 | goto err1; |
517 | | |
518 | 0 | rv = tls1_PRF(s, |
519 | 0 | val, vallen, |
520 | 0 | NULL, 0, |
521 | 0 | NULL, 0, |
522 | 0 | NULL, 0, |
523 | 0 | NULL, 0, |
524 | 0 | s->session->master_key, s->session->master_key_length, |
525 | 0 | out, olen, 0); |
526 | |
|
527 | 0 | goto ret; |
528 | 0 | err1: |
529 | 0 | ERR_raise(ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
530 | 0 | ret: |
531 | 0 | OPENSSL_clear_free(val, vallen); |
532 | 0 | return rv; |
533 | 0 | } |
534 | | |
535 | | int tls1_alert_code(int code) |
536 | 0 | { |
537 | 0 | switch (code) { |
538 | 0 | case SSL_AD_CLOSE_NOTIFY: |
539 | 0 | return SSL3_AD_CLOSE_NOTIFY; |
540 | 0 | case SSL_AD_UNEXPECTED_MESSAGE: |
541 | 0 | return SSL3_AD_UNEXPECTED_MESSAGE; |
542 | 0 | case SSL_AD_BAD_RECORD_MAC: |
543 | 0 | return SSL3_AD_BAD_RECORD_MAC; |
544 | 0 | case SSL_AD_DECRYPTION_FAILED: |
545 | 0 | return TLS1_AD_DECRYPTION_FAILED; |
546 | 0 | case SSL_AD_RECORD_OVERFLOW: |
547 | 0 | return TLS1_AD_RECORD_OVERFLOW; |
548 | 0 | case SSL_AD_DECOMPRESSION_FAILURE: |
549 | 0 | return SSL3_AD_DECOMPRESSION_FAILURE; |
550 | 0 | case SSL_AD_HANDSHAKE_FAILURE: |
551 | 0 | return SSL3_AD_HANDSHAKE_FAILURE; |
552 | 0 | case SSL_AD_NO_CERTIFICATE: |
553 | 0 | return -1; |
554 | 0 | case SSL_AD_BAD_CERTIFICATE: |
555 | 0 | return SSL3_AD_BAD_CERTIFICATE; |
556 | 0 | case SSL_AD_UNSUPPORTED_CERTIFICATE: |
557 | 0 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; |
558 | 0 | case SSL_AD_CERTIFICATE_REVOKED: |
559 | 0 | return SSL3_AD_CERTIFICATE_REVOKED; |
560 | 0 | case SSL_AD_CERTIFICATE_EXPIRED: |
561 | 0 | return SSL3_AD_CERTIFICATE_EXPIRED; |
562 | 0 | case SSL_AD_CERTIFICATE_UNKNOWN: |
563 | 0 | return SSL3_AD_CERTIFICATE_UNKNOWN; |
564 | 0 | case SSL_AD_ILLEGAL_PARAMETER: |
565 | 0 | return SSL3_AD_ILLEGAL_PARAMETER; |
566 | 0 | case SSL_AD_UNKNOWN_CA: |
567 | 0 | return TLS1_AD_UNKNOWN_CA; |
568 | 0 | case SSL_AD_ACCESS_DENIED: |
569 | 0 | return TLS1_AD_ACCESS_DENIED; |
570 | 0 | case SSL_AD_DECODE_ERROR: |
571 | 0 | return TLS1_AD_DECODE_ERROR; |
572 | 0 | case SSL_AD_DECRYPT_ERROR: |
573 | 0 | return TLS1_AD_DECRYPT_ERROR; |
574 | 0 | case SSL_AD_EXPORT_RESTRICTION: |
575 | 0 | return TLS1_AD_EXPORT_RESTRICTION; |
576 | 0 | case SSL_AD_PROTOCOL_VERSION: |
577 | 0 | return TLS1_AD_PROTOCOL_VERSION; |
578 | 0 | case SSL_AD_INSUFFICIENT_SECURITY: |
579 | 0 | return TLS1_AD_INSUFFICIENT_SECURITY; |
580 | 0 | case SSL_AD_INTERNAL_ERROR: |
581 | 0 | return TLS1_AD_INTERNAL_ERROR; |
582 | 0 | case SSL_AD_USER_CANCELLED: |
583 | 0 | return TLS1_AD_USER_CANCELLED; |
584 | 0 | case SSL_AD_NO_RENEGOTIATION: |
585 | 0 | return TLS1_AD_NO_RENEGOTIATION; |
586 | 0 | case SSL_AD_UNSUPPORTED_EXTENSION: |
587 | 0 | return TLS1_AD_UNSUPPORTED_EXTENSION; |
588 | 0 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: |
589 | 0 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; |
590 | 0 | case SSL_AD_UNRECOGNIZED_NAME: |
591 | 0 | return TLS1_AD_UNRECOGNIZED_NAME; |
592 | 0 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: |
593 | 0 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; |
594 | 0 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: |
595 | 0 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; |
596 | 0 | case SSL_AD_UNKNOWN_PSK_IDENTITY: |
597 | 0 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; |
598 | 0 | case SSL_AD_INAPPROPRIATE_FALLBACK: |
599 | 0 | return TLS1_AD_INAPPROPRIATE_FALLBACK; |
600 | 0 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
601 | 0 | return TLS1_AD_NO_APPLICATION_PROTOCOL; |
602 | 0 | case SSL_AD_CERTIFICATE_REQUIRED: |
603 | 0 | return SSL_AD_HANDSHAKE_FAILURE; |
604 | 0 | case TLS13_AD_MISSING_EXTENSION: |
605 | 0 | return SSL_AD_HANDSHAKE_FAILURE; |
606 | 0 | default: |
607 | 0 | return -1; |
608 | 0 | } |
609 | 0 | } |