/src/openssl/ssl/t1_enc.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * Copyright 2005 Nokia. All rights reserved. |
4 | | * |
5 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
6 | | * this file except in compliance with the License. You can obtain a copy |
7 | | * in the file LICENSE in the source distribution or at |
8 | | * https://www.openssl.org/source/license.html |
9 | | */ |
10 | | |
11 | | #include <stdio.h> |
12 | | #include "ssl_local.h" |
13 | | #include "record/record_local.h" |
14 | | #include "internal/ktls.h" |
15 | | #include "internal/cryptlib.h" |
16 | | #include <openssl/comp.h> |
17 | | #include <openssl/evp.h> |
18 | | #include <openssl/kdf.h> |
19 | | #include <openssl/rand.h> |
20 | | #include <openssl/obj_mac.h> |
21 | | #include <openssl/core_names.h> |
22 | | #include <openssl/trace.h> |
23 | | |
24 | | /* seed1 through seed5 are concatenated */ |
25 | | static int tls1_PRF(SSL_CONNECTION *s, |
26 | | const void *seed1, size_t seed1_len, |
27 | | const void *seed2, size_t seed2_len, |
28 | | const void *seed3, size_t seed3_len, |
29 | | const void *seed4, size_t seed4_len, |
30 | | const void *seed5, size_t seed5_len, |
31 | | const unsigned char *sec, size_t slen, |
32 | | unsigned char *out, size_t olen, int fatal) |
33 | 0 | { |
34 | 0 | const EVP_MD *md = ssl_prf_md(s); |
35 | 0 | EVP_KDF *kdf; |
36 | 0 | EVP_KDF_CTX *kctx = NULL; |
37 | 0 | OSSL_PARAM params[8], *p = params; |
38 | 0 | const char *mdname; |
39 | |
|
40 | 0 | if (md == NULL) { |
41 | | /* Should never happen */ |
42 | 0 | if (fatal) |
43 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
44 | 0 | else |
45 | 0 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
46 | 0 | return 0; |
47 | 0 | } |
48 | 0 | kdf = EVP_KDF_fetch(SSL_CONNECTION_GET_CTX(s)->libctx, |
49 | 0 | OSSL_KDF_NAME_TLS1_PRF, |
50 | 0 | SSL_CONNECTION_GET_CTX(s)->propq); |
51 | 0 | if (kdf == NULL) |
52 | 0 | goto err; |
53 | 0 | kctx = EVP_KDF_CTX_new(kdf); |
54 | 0 | EVP_KDF_free(kdf); |
55 | 0 | if (kctx == NULL) |
56 | 0 | goto err; |
57 | 0 | mdname = EVP_MD_get0_name(md); |
58 | 0 | *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, |
59 | 0 | (char *)mdname, 0); |
60 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET, |
61 | 0 | (unsigned char *)sec, |
62 | 0 | (size_t)slen); |
63 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
64 | 0 | (void *)seed1, (size_t)seed1_len); |
65 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
66 | 0 | (void *)seed2, (size_t)seed2_len); |
67 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
68 | 0 | (void *)seed3, (size_t)seed3_len); |
69 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
70 | 0 | (void *)seed4, (size_t)seed4_len); |
71 | 0 | *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, |
72 | 0 | (void *)seed5, (size_t)seed5_len); |
73 | 0 | *p = OSSL_PARAM_construct_end(); |
74 | 0 | if (EVP_KDF_derive(kctx, out, olen, params)) { |
75 | 0 | EVP_KDF_CTX_free(kctx); |
76 | 0 | return 1; |
77 | 0 | } |
78 | | |
79 | 0 | err: |
80 | 0 | if (fatal) |
81 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
82 | 0 | else |
83 | 0 | ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); |
84 | 0 | EVP_KDF_CTX_free(kctx); |
85 | 0 | return 0; |
86 | 0 | } |
87 | | |
88 | | static int tls1_generate_key_block(SSL_CONNECTION *s, unsigned char *km, |
89 | | size_t num) |
90 | 0 | { |
91 | 0 | int ret; |
92 | | |
93 | | /* Calls SSLfatal() as required */ |
94 | 0 | ret = tls1_PRF(s, |
95 | 0 | TLS_MD_KEY_EXPANSION_CONST, |
96 | 0 | TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random, |
97 | 0 | SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE, |
98 | 0 | NULL, 0, NULL, 0, s->session->master_key, |
99 | 0 | s->session->master_key_length, km, num, 1); |
100 | |
|
101 | 0 | return ret; |
102 | 0 | } |
103 | | |
104 | | static int tls_iv_length_within_key_block(const EVP_CIPHER *c) |
105 | 0 | { |
106 | | /* If GCM/CCM mode only part of IV comes from PRF */ |
107 | 0 | if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) |
108 | 0 | return EVP_GCM_TLS_FIXED_IV_LEN; |
109 | 0 | else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) |
110 | 0 | return EVP_CCM_TLS_FIXED_IV_LEN; |
111 | 0 | else |
112 | 0 | return EVP_CIPHER_get_iv_length(c); |
113 | 0 | } |
114 | | |
115 | | int tls1_change_cipher_state(SSL_CONNECTION *s, int which) |
116 | 0 | { |
117 | 0 | unsigned char *p, *mac_secret; |
118 | 0 | unsigned char *key, *iv; |
119 | 0 | const EVP_CIPHER *c; |
120 | 0 | const SSL_COMP *comp = NULL; |
121 | 0 | const EVP_MD *m; |
122 | 0 | int mac_type; |
123 | 0 | size_t mac_secret_size; |
124 | 0 | size_t n, i, j, k, cl; |
125 | 0 | int iivlen; |
126 | | /* |
127 | | * Taglen is only relevant for CCM ciphersuites. Other ciphersuites |
128 | | * ignore this value so we can default it to 0. |
129 | | */ |
130 | 0 | size_t taglen = 0; |
131 | 0 | int direction; |
132 | |
|
133 | 0 | c = s->s3.tmp.new_sym_enc; |
134 | 0 | m = s->s3.tmp.new_hash; |
135 | 0 | mac_type = s->s3.tmp.new_mac_pkey_type; |
136 | 0 | #ifndef OPENSSL_NO_COMP |
137 | 0 | comp = s->s3.tmp.new_compression; |
138 | 0 | #endif |
139 | |
|
140 | 0 | p = s->s3.tmp.key_block; |
141 | 0 | i = mac_secret_size = s->s3.tmp.new_mac_secret_size; |
142 | |
|
143 | 0 | cl = EVP_CIPHER_get_key_length(c); |
144 | 0 | j = cl; |
145 | 0 | iivlen = tls_iv_length_within_key_block(c); |
146 | 0 | if (iivlen < 0) { |
147 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
148 | 0 | goto err; |
149 | 0 | } |
150 | 0 | k = iivlen; |
151 | 0 | if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || |
152 | 0 | (which == SSL3_CHANGE_CIPHER_SERVER_READ)) { |
153 | 0 | mac_secret = &(p[0]); |
154 | 0 | n = i + i; |
155 | 0 | key = &(p[n]); |
156 | 0 | n += j + j; |
157 | 0 | iv = &(p[n]); |
158 | 0 | n += k + k; |
159 | 0 | } else { |
160 | 0 | n = i; |
161 | 0 | mac_secret = &(p[n]); |
162 | 0 | n += i + j; |
163 | 0 | key = &(p[n]); |
164 | 0 | n += j + k; |
165 | 0 | iv = &(p[n]); |
166 | 0 | n += k; |
167 | 0 | } |
168 | |
|
169 | 0 | if (n > s->s3.tmp.key_block_length) { |
170 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
171 | 0 | goto err; |
172 | 0 | } |
173 | | |
174 | 0 | switch (EVP_CIPHER_get_mode(c)) { |
175 | 0 | case EVP_CIPH_GCM_MODE: |
176 | 0 | taglen = EVP_GCM_TLS_TAG_LEN; |
177 | 0 | break; |
178 | 0 | case EVP_CIPH_CCM_MODE: |
179 | 0 | if ((s->s3.tmp.new_cipher->algorithm_enc |
180 | 0 | & (SSL_AES128CCM8 | SSL_AES256CCM8)) != 0) |
181 | 0 | taglen = EVP_CCM8_TLS_TAG_LEN; |
182 | 0 | else |
183 | 0 | taglen = EVP_CCM_TLS_TAG_LEN; |
184 | 0 | break; |
185 | 0 | default: |
186 | 0 | if (EVP_CIPHER_is_a(c, "CHACHA20-POLY1305")) { |
187 | 0 | taglen = EVP_CHACHAPOLY_TLS_TAG_LEN; |
188 | 0 | } else { |
189 | | /* MAC secret size corresponds to the MAC output size */ |
190 | 0 | taglen = s->s3.tmp.new_mac_secret_size; |
191 | 0 | } |
192 | 0 | break; |
193 | 0 | } |
194 | | |
195 | 0 | if (which & SSL3_CC_READ) { |
196 | 0 | if (s->ext.use_etm) |
197 | 0 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; |
198 | 0 | else |
199 | 0 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ; |
200 | |
|
201 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
202 | 0 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; |
203 | 0 | else |
204 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM; |
205 | |
|
206 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) |
207 | 0 | s->mac_flags |= SSL_MAC_FLAG_READ_MAC_TLSTREE; |
208 | 0 | else |
209 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_TLSTREE; |
210 | |
|
211 | 0 | direction = OSSL_RECORD_DIRECTION_READ; |
212 | 0 | } else { |
213 | 0 | if (s->ext.use_etm) |
214 | 0 | s->s3.flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
215 | 0 | else |
216 | 0 | s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE; |
217 | |
|
218 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) |
219 | 0 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; |
220 | 0 | else |
221 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; |
222 | |
|
223 | 0 | if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE) |
224 | 0 | s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_TLSTREE; |
225 | 0 | else |
226 | 0 | s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_TLSTREE; |
227 | |
|
228 | 0 | direction = OSSL_RECORD_DIRECTION_WRITE; |
229 | 0 | } |
230 | |
|
231 | 0 | if (SSL_CONNECTION_IS_DTLS(s)) |
232 | 0 | dtls1_increment_epoch(s, which); |
233 | |
|
234 | 0 | if (!ssl_set_new_record_layer(s, s->version, direction, |
235 | 0 | OSSL_RECORD_PROTECTION_LEVEL_APPLICATION, |
236 | 0 | NULL, 0, key, cl, iv, (size_t)k, mac_secret, |
237 | 0 | mac_secret_size, c, taglen, mac_type, |
238 | 0 | m, comp, NULL)) { |
239 | | /* SSLfatal already called */ |
240 | 0 | goto err; |
241 | 0 | } |
242 | | |
243 | 0 | OSSL_TRACE_BEGIN(TLS) { |
244 | 0 | BIO_printf(trc_out, "which = %04X, key:\n", which); |
245 | 0 | BIO_dump_indent(trc_out, key, EVP_CIPHER_get_key_length(c), 4); |
246 | 0 | BIO_printf(trc_out, "iv:\n"); |
247 | 0 | BIO_dump_indent(trc_out, iv, k, 4); |
248 | 0 | } OSSL_TRACE_END(TLS); |
249 | |
|
250 | 0 | return 1; |
251 | 0 | err: |
252 | 0 | return 0; |
253 | 0 | } |
254 | | |
255 | | int tls1_setup_key_block(SSL_CONNECTION *s) |
256 | 0 | { |
257 | 0 | unsigned char *p; |
258 | 0 | const EVP_CIPHER *c; |
259 | 0 | const EVP_MD *hash; |
260 | 0 | SSL_COMP *comp; |
261 | 0 | int mac_type = NID_undef; |
262 | 0 | size_t num, mac_secret_size = 0; |
263 | 0 | int ret = 0; |
264 | 0 | int ivlen; |
265 | |
|
266 | 0 | if (s->s3.tmp.key_block_length != 0) |
267 | 0 | return 1; |
268 | | |
269 | 0 | if (!ssl_cipher_get_evp(SSL_CONNECTION_GET_CTX(s), s->session, &c, &hash, |
270 | 0 | &mac_type, &mac_secret_size, &comp, |
271 | 0 | s->ext.use_etm)) { |
272 | | /* Error is already recorded */ |
273 | 0 | SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR); |
274 | 0 | return 0; |
275 | 0 | } |
276 | | |
277 | 0 | ssl_evp_cipher_free(s->s3.tmp.new_sym_enc); |
278 | 0 | s->s3.tmp.new_sym_enc = c; |
279 | 0 | ssl_evp_md_free(s->s3.tmp.new_hash); |
280 | 0 | s->s3.tmp.new_hash = hash; |
281 | 0 | s->s3.tmp.new_mac_pkey_type = mac_type; |
282 | 0 | s->s3.tmp.new_mac_secret_size = mac_secret_size; |
283 | 0 | ivlen = tls_iv_length_within_key_block(c); |
284 | 0 | if (ivlen < 0) { |
285 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
286 | 0 | return 0; |
287 | 0 | } |
288 | 0 | num = mac_secret_size + EVP_CIPHER_get_key_length(c) + ivlen; |
289 | 0 | num *= 2; |
290 | |
|
291 | 0 | ssl3_cleanup_key_block(s); |
292 | |
|
293 | 0 | if ((p = OPENSSL_malloc(num)) == NULL) { |
294 | 0 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); |
295 | 0 | goto err; |
296 | 0 | } |
297 | | |
298 | 0 | s->s3.tmp.key_block_length = num; |
299 | 0 | s->s3.tmp.key_block = p; |
300 | |
|
301 | 0 | OSSL_TRACE_BEGIN(TLS) { |
302 | 0 | BIO_printf(trc_out, "key block length: %zu\n", num); |
303 | 0 | BIO_printf(trc_out, "client random\n"); |
304 | 0 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
305 | 0 | BIO_printf(trc_out, "server random\n"); |
306 | 0 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
307 | 0 | BIO_printf(trc_out, "master key\n"); |
308 | 0 | BIO_dump_indent(trc_out, |
309 | 0 | s->session->master_key, |
310 | 0 | s->session->master_key_length, 4); |
311 | 0 | } OSSL_TRACE_END(TLS); |
312 | |
|
313 | 0 | if (!tls1_generate_key_block(s, p, num)) { |
314 | | /* SSLfatal() already called */ |
315 | 0 | goto err; |
316 | 0 | } |
317 | | |
318 | 0 | OSSL_TRACE_BEGIN(TLS) { |
319 | 0 | BIO_printf(trc_out, "key block\n"); |
320 | 0 | BIO_dump_indent(trc_out, p, num, 4); |
321 | 0 | } OSSL_TRACE_END(TLS); |
322 | |
|
323 | 0 | ret = 1; |
324 | 0 | err: |
325 | 0 | return ret; |
326 | 0 | } |
327 | | |
328 | | size_t tls1_final_finish_mac(SSL_CONNECTION *s, const char *str, |
329 | | size_t slen, unsigned char *out) |
330 | 0 | { |
331 | 0 | size_t hashlen; |
332 | 0 | unsigned char hash[EVP_MAX_MD_SIZE]; |
333 | 0 | size_t finished_size = TLS1_FINISH_MAC_LENGTH; |
334 | |
|
335 | 0 | if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kGOST18) |
336 | 0 | finished_size = 32; |
337 | |
|
338 | 0 | if (!ssl3_digest_cached_records(s, 0)) { |
339 | | /* SSLfatal() already called */ |
340 | 0 | return 0; |
341 | 0 | } |
342 | | |
343 | 0 | if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
344 | | /* SSLfatal() already called */ |
345 | 0 | return 0; |
346 | 0 | } |
347 | | |
348 | 0 | if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0, |
349 | 0 | s->session->master_key, s->session->master_key_length, |
350 | 0 | out, finished_size, 1)) { |
351 | | /* SSLfatal() already called */ |
352 | 0 | return 0; |
353 | 0 | } |
354 | 0 | OPENSSL_cleanse(hash, hashlen); |
355 | 0 | return finished_size; |
356 | 0 | } |
357 | | |
358 | | int tls1_generate_master_secret(SSL_CONNECTION *s, unsigned char *out, |
359 | | unsigned char *p, size_t len, |
360 | | size_t *secret_size) |
361 | 0 | { |
362 | 0 | if (s->session->flags & SSL_SESS_FLAG_EXTMS) { |
363 | 0 | unsigned char hash[EVP_MAX_MD_SIZE * 2]; |
364 | 0 | size_t hashlen; |
365 | | /* |
366 | | * Digest cached records keeping record buffer (if present): this won't |
367 | | * affect client auth because we're freezing the buffer at the same |
368 | | * point (after client key exchange and before certificate verify) |
369 | | */ |
370 | 0 | if (!ssl3_digest_cached_records(s, 1) |
371 | 0 | || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) { |
372 | | /* SSLfatal() already called */ |
373 | 0 | return 0; |
374 | 0 | } |
375 | 0 | OSSL_TRACE_BEGIN(TLS) { |
376 | 0 | BIO_printf(trc_out, "Handshake hashes:\n"); |
377 | 0 | BIO_dump(trc_out, (char *)hash, hashlen); |
378 | 0 | } OSSL_TRACE_END(TLS); |
379 | 0 | if (!tls1_PRF(s, |
380 | 0 | TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
381 | 0 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE, |
382 | 0 | hash, hashlen, |
383 | 0 | NULL, 0, |
384 | 0 | NULL, 0, |
385 | 0 | NULL, 0, p, len, out, |
386 | 0 | SSL3_MASTER_SECRET_SIZE, 1)) { |
387 | | /* SSLfatal() already called */ |
388 | 0 | return 0; |
389 | 0 | } |
390 | 0 | OPENSSL_cleanse(hash, hashlen); |
391 | 0 | } else { |
392 | 0 | if (!tls1_PRF(s, |
393 | 0 | TLS_MD_MASTER_SECRET_CONST, |
394 | 0 | TLS_MD_MASTER_SECRET_CONST_SIZE, |
395 | 0 | s->s3.client_random, SSL3_RANDOM_SIZE, |
396 | 0 | NULL, 0, |
397 | 0 | s->s3.server_random, SSL3_RANDOM_SIZE, |
398 | 0 | NULL, 0, p, len, out, |
399 | 0 | SSL3_MASTER_SECRET_SIZE, 1)) { |
400 | | /* SSLfatal() already called */ |
401 | 0 | return 0; |
402 | 0 | } |
403 | 0 | } |
404 | | |
405 | 0 | OSSL_TRACE_BEGIN(TLS) { |
406 | 0 | BIO_printf(trc_out, "Premaster Secret:\n"); |
407 | 0 | BIO_dump_indent(trc_out, p, len, 4); |
408 | 0 | BIO_printf(trc_out, "Client Random:\n"); |
409 | 0 | BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4); |
410 | 0 | BIO_printf(trc_out, "Server Random:\n"); |
411 | 0 | BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4); |
412 | 0 | BIO_printf(trc_out, "Master Secret:\n"); |
413 | 0 | BIO_dump_indent(trc_out, |
414 | 0 | s->session->master_key, |
415 | 0 | SSL3_MASTER_SECRET_SIZE, 4); |
416 | 0 | } OSSL_TRACE_END(TLS); |
417 | |
|
418 | 0 | *secret_size = SSL3_MASTER_SECRET_SIZE; |
419 | 0 | return 1; |
420 | 0 | } |
421 | | |
422 | | int tls1_export_keying_material(SSL_CONNECTION *s, unsigned char *out, |
423 | | size_t olen, const char *label, size_t llen, |
424 | | const unsigned char *context, |
425 | | size_t contextlen, int use_context) |
426 | 0 | { |
427 | 0 | unsigned char *val = NULL; |
428 | 0 | size_t vallen = 0, currentvalpos; |
429 | 0 | int rv = 0; |
430 | | |
431 | | /* |
432 | | * RFC 5705 embeds context length as uint16; reject longer context |
433 | | * before proceeding. |
434 | | */ |
435 | 0 | if (contextlen > 0xffff) { |
436 | 0 | ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT); |
437 | 0 | return 0; |
438 | 0 | } |
439 | | |
440 | | /* |
441 | | * construct PRF arguments we construct the PRF argument ourself rather |
442 | | * than passing separate values into the TLS PRF to ensure that the |
443 | | * concatenation of values does not create a prohibited label. |
444 | | */ |
445 | 0 | vallen = llen + SSL3_RANDOM_SIZE * 2; |
446 | 0 | if (use_context) { |
447 | 0 | vallen += 2 + contextlen; |
448 | 0 | } |
449 | |
|
450 | 0 | val = OPENSSL_malloc(vallen); |
451 | 0 | if (val == NULL) |
452 | 0 | goto ret; |
453 | 0 | currentvalpos = 0; |
454 | 0 | memcpy(val + currentvalpos, (unsigned char *)label, llen); |
455 | 0 | currentvalpos += llen; |
456 | 0 | memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE); |
457 | 0 | currentvalpos += SSL3_RANDOM_SIZE; |
458 | 0 | memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE); |
459 | 0 | currentvalpos += SSL3_RANDOM_SIZE; |
460 | |
|
461 | 0 | if (use_context) { |
462 | 0 | val[currentvalpos] = (contextlen >> 8) & 0xff; |
463 | 0 | currentvalpos++; |
464 | 0 | val[currentvalpos] = contextlen & 0xff; |
465 | 0 | currentvalpos++; |
466 | 0 | if ((contextlen > 0) || (context != NULL)) { |
467 | 0 | memcpy(val + currentvalpos, context, contextlen); |
468 | 0 | } |
469 | 0 | } |
470 | | |
471 | | /* |
472 | | * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited |
473 | | * label len) = 15, so size of val > max(prohibited label len) = 15 and |
474 | | * the comparisons won't have buffer overflow |
475 | | */ |
476 | 0 | if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, |
477 | 0 | TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) |
478 | 0 | goto err1; |
479 | 0 | if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, |
480 | 0 | TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) |
481 | 0 | goto err1; |
482 | 0 | if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, |
483 | 0 | TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) |
484 | 0 | goto err1; |
485 | 0 | if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST, |
486 | 0 | TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0) |
487 | 0 | goto err1; |
488 | 0 | if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, |
489 | 0 | TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) |
490 | 0 | goto err1; |
491 | | |
492 | 0 | rv = tls1_PRF(s, |
493 | 0 | val, vallen, |
494 | 0 | NULL, 0, |
495 | 0 | NULL, 0, |
496 | 0 | NULL, 0, |
497 | 0 | NULL, 0, |
498 | 0 | s->session->master_key, s->session->master_key_length, |
499 | 0 | out, olen, 0); |
500 | |
|
501 | 0 | goto ret; |
502 | 0 | err1: |
503 | 0 | ERR_raise(ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); |
504 | 0 | ret: |
505 | 0 | OPENSSL_clear_free(val, vallen); |
506 | 0 | return rv; |
507 | 0 | } |
508 | | |
509 | | int tls1_alert_code(int code) |
510 | 2.07k | { |
511 | 2.07k | switch (code) { |
512 | 271 | case SSL_AD_CLOSE_NOTIFY: |
513 | 271 | return SSL3_AD_CLOSE_NOTIFY; |
514 | 813 | case SSL_AD_UNEXPECTED_MESSAGE: |
515 | 813 | return SSL3_AD_UNEXPECTED_MESSAGE; |
516 | 0 | case SSL_AD_BAD_RECORD_MAC: |
517 | 0 | return SSL3_AD_BAD_RECORD_MAC; |
518 | 0 | case SSL_AD_DECRYPTION_FAILED: |
519 | 0 | return TLS1_AD_DECRYPTION_FAILED; |
520 | 0 | case SSL_AD_RECORD_OVERFLOW: |
521 | 0 | return TLS1_AD_RECORD_OVERFLOW; |
522 | 0 | case SSL_AD_DECOMPRESSION_FAILURE: |
523 | 0 | return SSL3_AD_DECOMPRESSION_FAILURE; |
524 | 0 | case SSL_AD_HANDSHAKE_FAILURE: |
525 | 0 | return SSL3_AD_HANDSHAKE_FAILURE; |
526 | 0 | case SSL_AD_NO_CERTIFICATE: |
527 | 0 | return -1; |
528 | 513 | case SSL_AD_BAD_CERTIFICATE: |
529 | 513 | return SSL3_AD_BAD_CERTIFICATE; |
530 | 0 | case SSL_AD_UNSUPPORTED_CERTIFICATE: |
531 | 0 | return SSL3_AD_UNSUPPORTED_CERTIFICATE; |
532 | 0 | case SSL_AD_CERTIFICATE_REVOKED: |
533 | 0 | return SSL3_AD_CERTIFICATE_REVOKED; |
534 | 0 | case SSL_AD_CERTIFICATE_EXPIRED: |
535 | 0 | return SSL3_AD_CERTIFICATE_EXPIRED; |
536 | 0 | case SSL_AD_CERTIFICATE_UNKNOWN: |
537 | 0 | return SSL3_AD_CERTIFICATE_UNKNOWN; |
538 | 147 | case SSL_AD_ILLEGAL_PARAMETER: |
539 | 147 | return SSL3_AD_ILLEGAL_PARAMETER; |
540 | 0 | case SSL_AD_UNKNOWN_CA: |
541 | 0 | return TLS1_AD_UNKNOWN_CA; |
542 | 0 | case SSL_AD_ACCESS_DENIED: |
543 | 0 | return TLS1_AD_ACCESS_DENIED; |
544 | 269 | case SSL_AD_DECODE_ERROR: |
545 | 269 | return TLS1_AD_DECODE_ERROR; |
546 | 1 | case SSL_AD_DECRYPT_ERROR: |
547 | 1 | return TLS1_AD_DECRYPT_ERROR; |
548 | 0 | case SSL_AD_EXPORT_RESTRICTION: |
549 | 0 | return TLS1_AD_EXPORT_RESTRICTION; |
550 | 29 | case SSL_AD_PROTOCOL_VERSION: |
551 | 29 | return TLS1_AD_PROTOCOL_VERSION; |
552 | 0 | case SSL_AD_INSUFFICIENT_SECURITY: |
553 | 0 | return TLS1_AD_INSUFFICIENT_SECURITY; |
554 | 27 | case SSL_AD_INTERNAL_ERROR: |
555 | 27 | return TLS1_AD_INTERNAL_ERROR; |
556 | 0 | case SSL_AD_USER_CANCELLED: |
557 | 0 | return TLS1_AD_USER_CANCELLED; |
558 | 0 | case SSL_AD_NO_RENEGOTIATION: |
559 | 0 | return TLS1_AD_NO_RENEGOTIATION; |
560 | 7 | case SSL_AD_UNSUPPORTED_EXTENSION: |
561 | 7 | return TLS1_AD_UNSUPPORTED_EXTENSION; |
562 | 0 | case SSL_AD_CERTIFICATE_UNOBTAINABLE: |
563 | 0 | return TLS1_AD_CERTIFICATE_UNOBTAINABLE; |
564 | 0 | case SSL_AD_UNRECOGNIZED_NAME: |
565 | 0 | return TLS1_AD_UNRECOGNIZED_NAME; |
566 | 0 | case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: |
567 | 0 | return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE; |
568 | 0 | case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: |
569 | 0 | return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE; |
570 | 0 | case SSL_AD_UNKNOWN_PSK_IDENTITY: |
571 | 0 | return TLS1_AD_UNKNOWN_PSK_IDENTITY; |
572 | 0 | case SSL_AD_INAPPROPRIATE_FALLBACK: |
573 | 0 | return TLS1_AD_INAPPROPRIATE_FALLBACK; |
574 | 0 | case SSL_AD_NO_APPLICATION_PROTOCOL: |
575 | 0 | return TLS1_AD_NO_APPLICATION_PROTOCOL; |
576 | 0 | case SSL_AD_CERTIFICATE_REQUIRED: |
577 | 0 | return SSL_AD_HANDSHAKE_FAILURE; |
578 | 0 | case TLS13_AD_MISSING_EXTENSION: |
579 | 0 | return SSL_AD_HANDSHAKE_FAILURE; |
580 | 0 | default: |
581 | 0 | return -1; |
582 | 2.07k | } |
583 | 2.07k | } |