2015-01-22 03:40:55 +00:00
|
|
|
/*
|
2019-02-26 14:05:09 +00:00
|
|
|
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
|
2017-06-15 14:16:46 +00:00
|
|
|
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
|
2017-06-20 14:14:36 +00:00
|
|
|
* Copyright 2005 Nokia. All rights reserved.
|
2001-10-16 13:09:24 +00:00
|
|
|
*
|
2016-05-17 18:18:30 +00:00
|
|
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
|
|
* in the file LICENSE in the source distribution or at
|
|
|
|
* https://www.openssl.org/source/license.html
|
2001-10-16 13:09:24 +00:00
|
|
|
*/
|
2016-05-17 18:18:30 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
#include <stdio.h>
|
2002-07-10 07:01:54 +00:00
|
|
|
#include "ssl_locl.h"
|
1999-04-23 22:13:45 +00:00
|
|
|
#include <openssl/objects.h>
|
1999-11-29 22:35:00 +00:00
|
|
|
#include <openssl/x509v3.h>
|
2007-08-11 23:18:29 +00:00
|
|
|
#include <openssl/rand.h>
|
2018-03-05 22:45:44 +00:00
|
|
|
#include <openssl/rand_drbg.h>
|
2007-09-26 21:56:59 +00:00
|
|
|
#include <openssl/ocsp.h>
|
2016-03-18 18:30:20 +00:00
|
|
|
#include <openssl/dh.h>
|
|
|
|
#include <openssl/engine.h>
|
2015-02-13 23:28:49 +00:00
|
|
|
#include <openssl/async.h>
|
2016-03-18 18:30:20 +00:00
|
|
|
#include <openssl/ct.h>
|
2017-08-02 13:46:31 +00:00
|
|
|
#include "internal/cryptlib.h"
|
2017-08-21 21:17:35 +00:00
|
|
|
#include "internal/refcount.h"
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-09-05 12:32:58 +00:00
|
|
|
const char SSL_version_str[] = OPENSSL_VERSION_TEXT;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2017-12-15 18:33:48 +00:00
|
|
|
static int ssl_undefined_function_1(SSL *ssl, SSL3_RECORD *r, size_t s, int t)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
(void)s;
|
|
|
|
(void)t;
|
|
|
|
return ssl_undefined_function(ssl);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ssl_undefined_function_2(SSL *ssl, SSL3_RECORD *r, unsigned char *s,
|
|
|
|
int t)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
(void)s;
|
|
|
|
(void)t;
|
|
|
|
return ssl_undefined_function(ssl);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ssl_undefined_function_3(SSL *ssl, unsigned char *r,
|
|
|
|
unsigned char *s, size_t t, size_t *u)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
(void)s;
|
|
|
|
(void)t;
|
|
|
|
(void)u;
|
|
|
|
return ssl_undefined_function(ssl);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ssl_undefined_function_4(SSL *ssl, int r)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
return ssl_undefined_function(ssl);
|
|
|
|
}
|
|
|
|
|
|
|
|
static size_t ssl_undefined_function_5(SSL *ssl, const char *r, size_t s,
|
|
|
|
unsigned char *t)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
(void)s;
|
|
|
|
(void)t;
|
|
|
|
return ssl_undefined_function(ssl);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ssl_undefined_function_6(int r)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
return ssl_undefined_function(NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int ssl_undefined_function_7(SSL *ssl, unsigned char *r, size_t s,
|
|
|
|
const char *t, size_t u,
|
|
|
|
const unsigned char *v, size_t w, int x)
|
|
|
|
{
|
|
|
|
(void)r;
|
|
|
|
(void)s;
|
|
|
|
(void)t;
|
|
|
|
(void)u;
|
|
|
|
(void)v;
|
|
|
|
(void)w;
|
|
|
|
(void)x;
|
|
|
|
return ssl_undefined_function(ssl);
|
|
|
|
}
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
SSL3_ENC_METHOD ssl3_undef_enc_method = {
|
2017-12-15 18:33:48 +00:00
|
|
|
ssl_undefined_function_1,
|
|
|
|
ssl_undefined_function_2,
|
2015-01-22 03:40:55 +00:00
|
|
|
ssl_undefined_function,
|
2017-12-15 18:33:48 +00:00
|
|
|
ssl_undefined_function_3,
|
|
|
|
ssl_undefined_function_4,
|
|
|
|
ssl_undefined_function_5,
|
2015-01-22 03:40:55 +00:00
|
|
|
NULL, /* client_finished_label */
|
|
|
|
0, /* client_finished_label_len */
|
|
|
|
NULL, /* server_finished_label */
|
|
|
|
0, /* server_finished_label_len */
|
2017-12-15 18:33:48 +00:00
|
|
|
ssl_undefined_function_6,
|
|
|
|
ssl_undefined_function_7,
|
2015-01-22 03:40:55 +00:00
|
|
|
};
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-02-13 23:28:49 +00:00
|
|
|
struct ssl_async_args {
|
|
|
|
SSL *s;
|
|
|
|
void *buf;
|
2016-10-19 14:11:24 +00:00
|
|
|
size_t num;
|
2016-08-05 17:03:17 +00:00
|
|
|
enum { READFUNC, WRITEFUNC, OTHERFUNC } type;
|
2015-10-06 14:57:50 +00:00
|
|
|
union {
|
2016-09-06 11:05:25 +00:00
|
|
|
int (*func_read) (SSL *, void *, size_t, size_t *);
|
2016-09-07 10:34:39 +00:00
|
|
|
int (*func_write) (SSL *, const void *, size_t, size_t *);
|
2016-08-05 17:03:17 +00:00
|
|
|
int (*func_other) (SSL *);
|
2015-10-06 14:57:50 +00:00
|
|
|
} f;
|
2015-02-13 23:28:49 +00:00
|
|
|
};
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
static const struct {
|
|
|
|
uint8_t mtype;
|
|
|
|
uint8_t ord;
|
2016-08-05 17:03:17 +00:00
|
|
|
int nid;
|
2015-12-29 18:28:28 +00:00
|
|
|
} dane_mds[] = {
|
2016-08-05 17:03:17 +00:00
|
|
|
{
|
|
|
|
DANETLS_MATCHING_FULL, 0, NID_undef
|
|
|
|
},
|
|
|
|
{
|
|
|
|
DANETLS_MATCHING_2256, 1, NID_sha256
|
|
|
|
},
|
|
|
|
{
|
|
|
|
DANETLS_MATCHING_2512, 2, NID_sha512
|
|
|
|
},
|
2015-12-29 18:28:28 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
static int dane_ctx_enable(struct dane_ctx_st *dctx)
|
|
|
|
{
|
|
|
|
const EVP_MD **mdevp;
|
|
|
|
uint8_t *mdord;
|
|
|
|
uint8_t mdmax = DANETLS_MATCHING_LAST;
|
2016-08-05 17:03:17 +00:00
|
|
|
int n = ((int)mdmax) + 1; /* int to handle PrivMatch(255) */
|
2015-12-29 18:28:28 +00:00
|
|
|
size_t i;
|
|
|
|
|
2016-07-11 00:36:02 +00:00
|
|
|
if (dctx->mdevp != NULL)
|
|
|
|
return 1;
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
mdevp = OPENSSL_zalloc(n * sizeof(*mdevp));
|
|
|
|
mdord = OPENSSL_zalloc(n * sizeof(*mdord));
|
|
|
|
|
|
|
|
if (mdord == NULL || mdevp == NULL) {
|
2016-04-27 13:22:20 +00:00
|
|
|
OPENSSL_free(mdord);
|
2015-12-29 18:28:28 +00:00
|
|
|
OPENSSL_free(mdevp);
|
|
|
|
SSLerr(SSL_F_DANE_CTX_ENABLE, ERR_R_MALLOC_FAILURE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Install default entries */
|
|
|
|
for (i = 0; i < OSSL_NELEM(dane_mds); ++i) {
|
|
|
|
const EVP_MD *md;
|
|
|
|
|
|
|
|
if (dane_mds[i].nid == NID_undef ||
|
|
|
|
(md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL)
|
|
|
|
continue;
|
|
|
|
mdevp[dane_mds[i].mtype] = md;
|
|
|
|
mdord[dane_mds[i].mtype] = dane_mds[i].ord;
|
|
|
|
}
|
|
|
|
|
|
|
|
dctx->mdevp = mdevp;
|
|
|
|
dctx->mdord = mdord;
|
|
|
|
dctx->mdmax = mdmax;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void dane_ctx_final(struct dane_ctx_st *dctx)
|
|
|
|
{
|
|
|
|
OPENSSL_free(dctx->mdevp);
|
|
|
|
dctx->mdevp = NULL;
|
|
|
|
|
|
|
|
OPENSSL_free(dctx->mdord);
|
|
|
|
dctx->mdord = NULL;
|
|
|
|
dctx->mdmax = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void tlsa_free(danetls_record *t)
|
|
|
|
{
|
|
|
|
if (t == NULL)
|
|
|
|
return;
|
|
|
|
OPENSSL_free(t->data);
|
|
|
|
EVP_PKEY_free(t->spki);
|
|
|
|
OPENSSL_free(t);
|
|
|
|
}
|
|
|
|
|
2016-04-08 13:10:06 +00:00
|
|
|
static void dane_final(SSL_DANE *dane)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
sk_danetls_record_pop_free(dane->trecs, tlsa_free);
|
|
|
|
dane->trecs = NULL;
|
|
|
|
|
|
|
|
sk_X509_pop_free(dane->certs, X509_free);
|
|
|
|
dane->certs = NULL;
|
|
|
|
|
|
|
|
X509_free(dane->mcert);
|
|
|
|
dane->mcert = NULL;
|
|
|
|
dane->mtlsa = NULL;
|
|
|
|
dane->mdpth = -1;
|
|
|
|
dane->pdpth = -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* dane_copy - Copy dane configuration, sans verification state.
|
|
|
|
*/
|
|
|
|
static int ssl_dane_dup(SSL *to, SSL *from)
|
|
|
|
{
|
|
|
|
int num;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (!DANETLS_ENABLED(&from->dane))
|
|
|
|
return 1;
|
|
|
|
|
2017-09-18 22:48:14 +00:00
|
|
|
num = sk_danetls_record_num(from->dane.trecs);
|
2015-12-29 18:28:28 +00:00
|
|
|
dane_final(&to->dane);
|
2016-07-11 00:36:02 +00:00
|
|
|
to->dane.flags = from->dane.flags;
|
2016-04-22 00:00:58 +00:00
|
|
|
to->dane.dctx = &to->ctx->dane;
|
2017-10-26 17:56:14 +00:00
|
|
|
to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);
|
2016-04-22 00:00:58 +00:00
|
|
|
|
|
|
|
if (to->dane.trecs == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_DANE_DUP, ERR_R_MALLOC_FAILURE);
|
|
|
|
return 0;
|
|
|
|
}
|
2015-12-29 18:28:28 +00:00
|
|
|
|
|
|
|
for (i = 0; i < num; ++i) {
|
|
|
|
danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);
|
2016-04-22 00:00:58 +00:00
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
if (SSL_dane_tlsa_add(to, t->usage, t->selector, t->mtype,
|
|
|
|
t->data, t->dlen) <= 0)
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
static int dane_mtype_set(struct dane_ctx_st *dctx,
|
|
|
|
const EVP_MD *md, uint8_t mtype, uint8_t ord)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (mtype == DANETLS_MATCHING_FULL && md != NULL) {
|
2016-08-05 17:03:17 +00:00
|
|
|
SSLerr(SSL_F_DANE_MTYPE_SET, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);
|
2015-12-29 18:28:28 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (mtype > dctx->mdmax) {
|
|
|
|
const EVP_MD **mdevp;
|
|
|
|
uint8_t *mdord;
|
2016-08-05 17:03:17 +00:00
|
|
|
int n = ((int)mtype) + 1;
|
2015-12-29 18:28:28 +00:00
|
|
|
|
|
|
|
mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
|
|
|
|
if (mdevp == NULL) {
|
|
|
|
SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
dctx->mdevp = mdevp;
|
|
|
|
|
|
|
|
mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));
|
|
|
|
if (mdord == NULL) {
|
|
|
|
SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
dctx->mdord = mdord;
|
|
|
|
|
|
|
|
/* Zero-fill any gaps */
|
2016-08-05 17:03:17 +00:00
|
|
|
for (i = dctx->mdmax + 1; i < mtype; ++i) {
|
2015-12-29 18:28:28 +00:00
|
|
|
mdevp[i] = NULL;
|
|
|
|
mdord[i] = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
dctx->mdmax = mtype;
|
|
|
|
}
|
|
|
|
|
|
|
|
dctx->mdevp[mtype] = md;
|
|
|
|
/* Coerce ordinal of disabled matching types to 0 */
|
|
|
|
dctx->mdord[mtype] = (md == NULL) ? 0 : ord;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-04-08 13:10:06 +00:00
|
|
|
static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
if (mtype > dane->dctx->mdmax)
|
|
|
|
return NULL;
|
|
|
|
return dane->dctx->mdevp[mtype];
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
static int dane_tlsa_add(SSL_DANE *dane,
|
|
|
|
uint8_t usage,
|
|
|
|
uint8_t selector,
|
2018-01-10 17:06:35 +00:00
|
|
|
uint8_t mtype, unsigned const char *data, size_t dlen)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
danetls_record *t;
|
|
|
|
const EVP_MD *md = NULL;
|
|
|
|
int ilen = (int)dlen;
|
|
|
|
int i;
|
2016-04-22 00:00:58 +00:00
|
|
|
int num;
|
2015-12-29 18:28:28 +00:00
|
|
|
|
|
|
|
if (dane->trecs == NULL) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_NOT_ENABLED);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ilen < 0 || dlen != (size_t)ilen) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (usage > DANETLS_USAGE_LAST) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (selector > DANETLS_SELECTOR_LAST) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_SELECTOR);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (mtype != DANETLS_MATCHING_FULL) {
|
|
|
|
md = tlsa_md_get(dane, mtype);
|
|
|
|
if (md == NULL) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (md != NULL && dlen != (size_t)EVP_MD_size(md)) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!data) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_NULL_DATA);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
t->usage = usage;
|
|
|
|
t->selector = selector;
|
|
|
|
t->mtype = mtype;
|
2016-10-19 14:11:24 +00:00
|
|
|
t->data = OPENSSL_malloc(dlen);
|
2015-12-29 18:28:28 +00:00
|
|
|
if (t->data == NULL) {
|
|
|
|
tlsa_free(t);
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
|
|
|
|
return -1;
|
|
|
|
}
|
2016-10-19 14:11:24 +00:00
|
|
|
memcpy(t->data, data, dlen);
|
|
|
|
t->dlen = dlen;
|
2015-12-29 18:28:28 +00:00
|
|
|
|
|
|
|
/* Validate and cache full certificate or public key */
|
|
|
|
if (mtype == DANETLS_MATCHING_FULL) {
|
|
|
|
const unsigned char *p = data;
|
|
|
|
X509 *cert = NULL;
|
|
|
|
EVP_PKEY *pkey = NULL;
|
|
|
|
|
|
|
|
switch (selector) {
|
|
|
|
case DANETLS_SELECTOR_CERT:
|
2016-10-19 14:11:24 +00:00
|
|
|
if (!d2i_X509(&cert, &p, ilen) || p < data ||
|
2015-12-29 18:28:28 +00:00
|
|
|
dlen != (size_t)(p - data)) {
|
|
|
|
tlsa_free(t);
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (X509_get0_pubkey(cert) == NULL) {
|
|
|
|
tlsa_free(t);
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) {
|
|
|
|
X509_free(cert);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For usage DANE-TA(2), we support authentication via "2 0 0" TLSA
|
|
|
|
* records that contain full certificates of trust-anchors that are
|
|
|
|
* not present in the wire chain. For usage PKIX-TA(0), we augment
|
|
|
|
* the chain with untrusted Full(0) certificates from DNS, in case
|
|
|
|
* they are missing from the chain.
|
|
|
|
*/
|
|
|
|
if ((dane->certs == NULL &&
|
|
|
|
(dane->certs = sk_X509_new_null()) == NULL) ||
|
|
|
|
!sk_X509_push(dane->certs, cert)) {
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
|
|
|
|
X509_free(cert);
|
|
|
|
tlsa_free(t);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case DANETLS_SELECTOR_SPKI:
|
2016-10-19 14:11:24 +00:00
|
|
|
if (!d2i_PUBKEY(&pkey, &p, ilen) || p < data ||
|
2015-12-29 18:28:28 +00:00
|
|
|
dlen != (size_t)(p - data)) {
|
|
|
|
tlsa_free(t);
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For usage DANE-TA(2), we support authentication via "2 1 0" TLSA
|
|
|
|
* records that contain full bare keys of trust-anchors that are
|
|
|
|
* not present in the wire chain.
|
|
|
|
*/
|
|
|
|
if (usage == DANETLS_USAGE_DANE_TA)
|
|
|
|
t->spki = pkey;
|
|
|
|
else
|
|
|
|
EVP_PKEY_free(pkey);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*-
|
|
|
|
* Find the right insertion point for the new record.
|
|
|
|
*
|
|
|
|
* See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that
|
|
|
|
* they can be processed first, as they require no chain building, and no
|
|
|
|
* expiration or hostname checks. Because DANE-EE(3) is numerically
|
|
|
|
* largest, this is accomplished via descending sort by "usage".
|
|
|
|
*
|
|
|
|
* We also sort in descending order by matching ordinal to simplify
|
|
|
|
* the implementation of digest agility in the verification code.
|
|
|
|
*
|
|
|
|
* The choice of order for the selector is not significant, so we
|
|
|
|
* use the same descending order for consistency.
|
|
|
|
*/
|
2016-04-22 00:00:58 +00:00
|
|
|
num = sk_danetls_record_num(dane->trecs);
|
|
|
|
for (i = 0; i < num; ++i) {
|
2015-12-29 18:28:28 +00:00
|
|
|
danetls_record *rec = sk_danetls_record_value(dane->trecs, i);
|
2016-04-22 00:00:58 +00:00
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
if (rec->usage > usage)
|
|
|
|
continue;
|
|
|
|
if (rec->usage < usage)
|
|
|
|
break;
|
|
|
|
if (rec->selector > selector)
|
|
|
|
continue;
|
|
|
|
if (rec->selector < selector)
|
|
|
|
break;
|
|
|
|
if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])
|
|
|
|
continue;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!sk_danetls_record_insert(dane->trecs, t, i)) {
|
|
|
|
tlsa_free(t);
|
|
|
|
SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
dane->umask |= DANETLS_USAGE_BIT(usage);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-05-09 23:39:50 +00:00
|
|
|
/*
|
|
|
|
* Return 0 if there is only one version configured and it was disabled
|
|
|
|
* at configure time. Return 1 otherwise.
|
|
|
|
*/
|
|
|
|
static int ssl_check_allowed_versions(int min_version, int max_version)
|
|
|
|
{
|
|
|
|
int minisdtls = 0, maxisdtls = 0;
|
|
|
|
|
|
|
|
/* Figure out if we're doing DTLS versions or TLS versions */
|
|
|
|
if (min_version == DTLS1_BAD_VER
|
|
|
|
|| min_version >> 8 == DTLS1_VERSION_MAJOR)
|
|
|
|
minisdtls = 1;
|
|
|
|
if (max_version == DTLS1_BAD_VER
|
|
|
|
|| max_version >> 8 == DTLS1_VERSION_MAJOR)
|
|
|
|
maxisdtls = 1;
|
|
|
|
/* A wildcard version of 0 could be DTLS or TLS. */
|
|
|
|
if ((minisdtls && !maxisdtls && max_version != 0)
|
|
|
|
|| (maxisdtls && !minisdtls && min_version != 0)) {
|
|
|
|
/* Mixing DTLS and TLS versions will lead to sadness; deny it. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (minisdtls || maxisdtls) {
|
|
|
|
/* Do DTLS version checks. */
|
|
|
|
if (min_version == 0)
|
|
|
|
/* Ignore DTLS1_BAD_VER */
|
|
|
|
min_version = DTLS1_VERSION;
|
|
|
|
if (max_version == 0)
|
|
|
|
max_version = DTLS1_2_VERSION;
|
|
|
|
#ifdef OPENSSL_NO_DTLS1_2
|
|
|
|
if (max_version == DTLS1_2_VERSION)
|
|
|
|
max_version = DTLS1_VERSION;
|
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_DTLS1
|
|
|
|
if (min_version == DTLS1_VERSION)
|
|
|
|
min_version = DTLS1_2_VERSION;
|
|
|
|
#endif
|
2017-09-21 13:26:42 +00:00
|
|
|
/* Done massaging versions; do the check. */
|
|
|
|
if (0
|
2017-05-09 23:39:50 +00:00
|
|
|
#ifdef OPENSSL_NO_DTLS1
|
|
|
|
|| (DTLS_VERSION_GE(min_version, DTLS1_VERSION)
|
|
|
|
&& DTLS_VERSION_GE(DTLS1_VERSION, max_version))
|
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_DTLS1_2
|
|
|
|
|| (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION)
|
|
|
|
&& DTLS_VERSION_GE(DTLS1_2_VERSION, max_version))
|
|
|
|
#endif
|
|
|
|
)
|
|
|
|
return 0;
|
|
|
|
} else {
|
|
|
|
/* Regular TLS version checks. */
|
2017-09-21 13:26:42 +00:00
|
|
|
if (min_version == 0)
|
|
|
|
min_version = SSL3_VERSION;
|
|
|
|
if (max_version == 0)
|
|
|
|
max_version = TLS1_3_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#ifdef OPENSSL_NO_TLS1_3
|
2017-09-21 13:26:42 +00:00
|
|
|
if (max_version == TLS1_3_VERSION)
|
|
|
|
max_version = TLS1_2_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_2
|
2017-09-21 13:26:42 +00:00
|
|
|
if (max_version == TLS1_2_VERSION)
|
|
|
|
max_version = TLS1_1_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_1
|
2017-09-21 13:26:42 +00:00
|
|
|
if (max_version == TLS1_1_VERSION)
|
|
|
|
max_version = TLS1_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1
|
2017-09-21 13:26:42 +00:00
|
|
|
if (max_version == TLS1_VERSION)
|
|
|
|
max_version = SSL3_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_SSL3
|
2017-09-21 13:26:42 +00:00
|
|
|
if (min_version == SSL3_VERSION)
|
|
|
|
min_version = TLS1_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1
|
2017-09-21 13:26:42 +00:00
|
|
|
if (min_version == TLS1_VERSION)
|
|
|
|
min_version = TLS1_1_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_1
|
2017-09-21 13:26:42 +00:00
|
|
|
if (min_version == TLS1_1_VERSION)
|
|
|
|
min_version = TLS1_2_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_2
|
2017-09-21 13:26:42 +00:00
|
|
|
if (min_version == TLS1_2_VERSION)
|
|
|
|
min_version = TLS1_3_VERSION;
|
2017-05-09 23:39:50 +00:00
|
|
|
#endif
|
2017-09-21 13:26:42 +00:00
|
|
|
/* Done massaging versions; do the check. */
|
|
|
|
if (0
|
2017-05-09 23:39:50 +00:00
|
|
|
#ifdef OPENSSL_NO_SSL3
|
|
|
|
|| (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version)
|
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1
|
|
|
|
|| (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version)
|
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_1
|
|
|
|
|| (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version)
|
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_2
|
|
|
|
|| (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version)
|
|
|
|
#endif
|
|
|
|
#ifdef OPENSSL_NO_TLS1_3
|
|
|
|
|| (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version)
|
|
|
|
#endif
|
|
|
|
)
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2015-06-13 14:50:00 +00:00
|
|
|
static void clear_ciphers(SSL *s)
|
|
|
|
{
|
|
|
|
/* clear the current cipher */
|
|
|
|
ssl_clear_cipher_ctx(s);
|
|
|
|
ssl_clear_hash_ctx(&s->read_hash);
|
|
|
|
ssl_clear_hash_ctx(&s->write_hash);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_clear(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s->method == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);
|
2017-05-22 11:33:29 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (ssl_clear_bad_session(s)) {
|
|
|
|
SSL_SESSION_free(s->session);
|
|
|
|
s->session = NULL;
|
|
|
|
}
|
2017-06-12 12:30:21 +00:00
|
|
|
SSL_SESSION_free(s->psksession);
|
|
|
|
s->psksession = NULL;
|
2017-07-05 19:53:03 +00:00
|
|
|
OPENSSL_free(s->psksession_id);
|
|
|
|
s->psksession_id = NULL;
|
|
|
|
s->psksession_id_len = 0;
|
2017-09-28 12:23:49 +00:00
|
|
|
s->hello_retry_request = 0;
|
2018-03-14 19:22:48 +00:00
|
|
|
s->sent_tickets = 0;
|
2002-02-27 11:23:05 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
s->error = 0;
|
|
|
|
s->hit = 0;
|
|
|
|
s->shutdown = 0;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (s->renegotiate) {
|
|
|
|
SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
|
|
|
|
return 0;
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-10-05 09:39:54 +00:00
|
|
|
ossl_statem_clear(s);
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
s->version = s->method->version;
|
|
|
|
s->client_version = s->version;
|
|
|
|
s->rwstate = SSL_NOTHING;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-05-01 18:37:16 +00:00
|
|
|
BUF_MEM_free(s->init_buf);
|
|
|
|
s->init_buf = NULL;
|
2015-06-13 14:50:00 +00:00
|
|
|
clear_ciphers(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->first_packet = 0;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2017-02-08 09:15:22 +00:00
|
|
|
s->key_update = SSL_KEY_UPDATE_NONE;
|
|
|
|
|
2018-01-31 21:20:52 +00:00
|
|
|
EVP_MD_CTX_free(s->pha_dgst);
|
|
|
|
s->pha_dgst = NULL;
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
/* Reset DANE verification result state */
|
|
|
|
s->dane.mdpth = -1;
|
|
|
|
s->dane.pdpth = -1;
|
|
|
|
X509_free(s->dane.mcert);
|
|
|
|
s->dane.mcert = NULL;
|
|
|
|
s->dane.mtlsa = NULL;
|
|
|
|
|
|
|
|
/* Clear the verification result peername */
|
|
|
|
X509_VERIFY_PARAM_move_peername(s->param, NULL);
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* Check to see if we were changed into a different method, if so, revert
|
2017-07-18 15:28:38 +00:00
|
|
|
* back.
|
2015-01-22 03:40:55 +00:00
|
|
|
*/
|
2017-07-18 15:28:38 +00:00
|
|
|
if (s->method != s->ctx->method) {
|
2015-01-22 03:40:55 +00:00
|
|
|
s->method->ssl_free(s);
|
|
|
|
s->method = s->ctx->method;
|
|
|
|
if (!s->method->ssl_new(s))
|
2017-05-22 11:33:29 +00:00
|
|
|
return 0;
|
2017-05-22 11:33:42 +00:00
|
|
|
} else {
|
|
|
|
if (!s->method->ssl_clear(s))
|
|
|
|
return 0;
|
|
|
|
}
|
2015-01-30 15:38:10 +00:00
|
|
|
|
2015-02-02 11:53:20 +00:00
|
|
|
RECORD_LAYER_clear(&s->rlayer);
|
2015-01-30 15:38:10 +00:00
|
|
|
|
2017-05-22 11:33:29 +00:00
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** Used to change an SSL_CTXs default SSL method type */
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
|
|
|
|
{
|
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
|
|
|
|
|
|
|
ctx->method = meth;
|
|
|
|
|
2018-09-19 14:02:04 +00:00
|
|
|
if (!SSL_CTX_set_ciphersuites(ctx, TLS_DEFAULT_CIPHERSUITES)) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
|
|
|
|
return 0;
|
|
|
|
}
|
2018-02-16 11:26:02 +00:00
|
|
|
sk = ssl_create_cipher_list(ctx->method,
|
|
|
|
ctx->tls13_ciphersuites,
|
|
|
|
&(ctx->cipher_list),
|
2015-01-22 03:40:55 +00:00
|
|
|
&(ctx->cipher_list_by_id),
|
|
|
|
SSL_DEFAULT_CIPHER_LIST, ctx->cert);
|
|
|
|
if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
|
2016-08-05 17:03:17 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2017-10-09 11:05:58 +00:00
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
SSL *SSL_new(SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
SSL *s;
|
|
|
|
|
|
|
|
if (ctx == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
if (ctx->method == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2015-08-25 17:25:58 +00:00
|
|
|
s = OPENSSL_zalloc(sizeof(*s));
|
2015-01-22 03:40:55 +00:00
|
|
|
if (s == NULL)
|
|
|
|
goto err;
|
|
|
|
|
2017-10-24 14:06:28 +00:00
|
|
|
s->references = 1;
|
2016-02-29 17:26:07 +00:00
|
|
|
s->lock = CRYPTO_THREAD_lock_new();
|
2017-10-24 14:06:28 +00:00
|
|
|
if (s->lock == NULL) {
|
|
|
|
OPENSSL_free(s);
|
|
|
|
s = NULL;
|
2017-08-03 14:24:03 +00:00
|
|
|
goto err;
|
2017-10-24 14:06:28 +00:00
|
|
|
}
|
2017-08-03 14:24:03 +00:00
|
|
|
|
2015-02-02 13:57:12 +00:00
|
|
|
RECORD_LAYER_init(&s->rlayer, s);
|
2015-01-30 14:57:54 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
s->options = ctx->options;
|
2016-07-11 00:36:02 +00:00
|
|
|
s->dane.flags = ctx->dane.flags;
|
2015-12-06 16:56:41 +00:00
|
|
|
s->min_proto_version = ctx->min_proto_version;
|
|
|
|
s->max_proto_version = ctx->max_proto_version;
|
2015-01-22 03:40:55 +00:00
|
|
|
s->mode = ctx->mode;
|
|
|
|
s->max_cert_list = ctx->max_cert_list;
|
2017-02-17 16:52:12 +00:00
|
|
|
s->max_early_data = ctx->max_early_data;
|
2018-07-05 13:40:39 +00:00
|
|
|
s->recv_max_early_data = ctx->recv_max_early_data;
|
2018-01-31 17:26:46 +00:00
|
|
|
s->num_tickets = ctx->num_tickets;
|
2018-08-13 14:53:42 +00:00
|
|
|
s->pha_enabled = ctx->pha_enabled;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2018-02-16 11:26:02 +00:00
|
|
|
/* Shallow copy of the ciphersuites stack */
|
|
|
|
s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites);
|
|
|
|
if (s->tls13_ciphersuites == NULL)
|
|
|
|
goto err;
|
|
|
|
|
2015-03-14 17:09:44 +00:00
|
|
|
/*
|
|
|
|
* Earlier library versions used to copy the pointer to the CERT, not
|
|
|
|
* its contents; only when setting new parameters for the per-SSL
|
|
|
|
* copy, ssl_cert_new would be called (and the direct reference to
|
|
|
|
* the per-SSL_CTX settings would be lost, but those still were
|
|
|
|
* indirectly accessed for various purposes, and for that reason they
|
|
|
|
* used to be known as s->ctx->default_cert). Now we don't look at the
|
|
|
|
* SSL_CTX's CERT after having duplicated it once.
|
|
|
|
*/
|
|
|
|
s->cert = ssl_cert_dup(ctx->cert);
|
|
|
|
if (s->cert == NULL)
|
|
|
|
goto err;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-01-30 13:46:43 +00:00
|
|
|
RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->msg_callback = ctx->msg_callback;
|
|
|
|
s->msg_callback_arg = ctx->msg_callback_arg;
|
|
|
|
s->verify_mode = ctx->verify_mode;
|
|
|
|
s->not_resumable_session_cb = ctx->not_resumable_session_cb;
|
2017-04-05 16:35:25 +00:00
|
|
|
s->record_padding_cb = ctx->record_padding_cb;
|
|
|
|
s->record_padding_arg = ctx->record_padding_arg;
|
|
|
|
s->block_padding = ctx->block_padding;
|
2015-01-22 03:40:55 +00:00
|
|
|
s->sid_ctx_length = ctx->sid_ctx_length;
|
2017-12-07 18:39:34 +00:00
|
|
|
if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx)))
|
2017-05-19 08:35:19 +00:00
|
|
|
goto err;
|
2015-01-22 03:40:55 +00:00
|
|
|
memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
|
|
|
|
s->verify_callback = ctx->default_verify_callback;
|
|
|
|
s->generate_session_id = ctx->generate_session_id;
|
|
|
|
|
|
|
|
s->param = X509_VERIFY_PARAM_new();
|
2015-10-30 10:05:53 +00:00
|
|
|
if (s->param == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
goto err;
|
|
|
|
X509_VERIFY_PARAM_inherit(s->param, ctx->param);
|
|
|
|
s->quiet_shutdown = ctx->quiet_shutdown;
|
2017-11-05 16:46:48 +00:00
|
|
|
|
|
|
|
s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode;
|
2015-01-22 03:40:55 +00:00
|
|
|
s->max_send_fragment = ctx->max_send_fragment;
|
2015-09-22 10:12:50 +00:00
|
|
|
s->split_send_fragment = ctx->split_send_fragment;
|
|
|
|
s->max_pipelines = ctx->max_pipelines;
|
2016-01-12 14:52:35 +00:00
|
|
|
if (s->max_pipelines > 1)
|
|
|
|
RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
|
2016-01-13 14:20:25 +00:00
|
|
|
if (ctx->default_read_buf_len > 0)
|
|
|
|
SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len);
|
2001-10-16 13:09:24 +00:00
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
SSL_CTX_up_ref(ctx);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->ctx = ctx;
|
2016-12-08 19:18:40 +00:00
|
|
|
s->ext.debug_cb = 0;
|
|
|
|
s->ext.debug_arg = NULL;
|
|
|
|
s->ext.ticket_expected = 0;
|
|
|
|
s->ext.status_type = ctx->ext.status_type;
|
|
|
|
s->ext.status_expected = 0;
|
|
|
|
s->ext.ocsp.ids = NULL;
|
|
|
|
s->ext.ocsp.exts = NULL;
|
|
|
|
s->ext.ocsp.resp = NULL;
|
|
|
|
s->ext.ocsp.resp_len = 0;
|
2016-02-29 17:26:07 +00:00
|
|
|
SSL_CTX_up_ref(ctx);
|
2017-01-31 20:32:50 +00:00
|
|
|
s->session_ctx = ctx;
|
2016-08-05 17:03:17 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2016-12-08 19:18:40 +00:00
|
|
|
if (ctx->ext.ecpointformats) {
|
|
|
|
s->ext.ecpointformats =
|
|
|
|
OPENSSL_memdup(ctx->ext.ecpointformats,
|
|
|
|
ctx->ext.ecpointformats_len);
|
|
|
|
if (!s->ext.ecpointformats)
|
2015-01-22 03:40:55 +00:00
|
|
|
goto err;
|
2016-12-08 19:18:40 +00:00
|
|
|
s->ext.ecpointformats_len =
|
|
|
|
ctx->ext.ecpointformats_len;
|
|
|
|
}
|
|
|
|
if (ctx->ext.supportedgroups) {
|
|
|
|
s->ext.supportedgroups =
|
|
|
|
OPENSSL_memdup(ctx->ext.supportedgroups,
|
2017-09-22 15:06:52 +00:00
|
|
|
ctx->ext.supportedgroups_len
|
2017-09-23 14:17:22 +00:00
|
|
|
* sizeof(*ctx->ext.supportedgroups));
|
2016-12-08 19:18:40 +00:00
|
|
|
if (!s->ext.supportedgroups)
|
2015-01-22 03:40:55 +00:00
|
|
|
goto err;
|
2016-12-08 19:18:40 +00:00
|
|
|
s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
#endif
|
|
|
|
#ifndef OPENSSL_NO_NEXTPROTONEG
|
2016-12-08 19:18:40 +00:00
|
|
|
s->ext.npn = NULL;
|
2016-08-05 17:03:17 +00:00
|
|
|
#endif
|
2013-04-15 22:07:47 +00:00
|
|
|
|
2016-12-08 19:18:40 +00:00
|
|
|
if (s->ctx->ext.alpn) {
|
|
|
|
s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len);
|
|
|
|
if (s->ext.alpn == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
goto err;
|
2016-12-08 19:18:40 +00:00
|
|
|
memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len);
|
|
|
|
s->ext.alpn_len = s->ctx->ext.alpn_len;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-02-06 03:17:23 +00:00
|
|
|
s->verified_chain = NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
s->verify_result = X509_V_OK;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-11-09 14:38:59 +00:00
|
|
|
s->default_passwd_callback = ctx->default_passwd_callback;
|
|
|
|
s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
s->method = ctx->method;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2017-02-08 09:15:22 +00:00
|
|
|
s->key_update = SSL_KEY_UPDATE_NONE;
|
|
|
|
|
2018-06-07 14:14:36 +00:00
|
|
|
s->allow_early_data_cb = ctx->allow_early_data_cb;
|
|
|
|
s->allow_early_data_cb_data = ctx->allow_early_data_cb_data;
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (!s->method->ssl_new(s))
|
|
|
|
goto err;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
|
2001-10-16 13:09:24 +00:00
|
|
|
|
2015-04-16 05:50:03 +00:00
|
|
|
if (!SSL_clear(s))
|
2015-03-06 14:37:17 +00:00
|
|
|
goto err;
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2016-02-13 18:29:34 +00:00
|
|
|
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data))
|
|
|
|
goto err;
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2006-03-10 23:06:27 +00:00
|
|
|
#ifndef OPENSSL_NO_PSK
|
2015-01-22 03:40:55 +00:00
|
|
|
s->psk_client_callback = ctx->psk_client_callback;
|
|
|
|
s->psk_server_callback = ctx->psk_server_callback;
|
2006-03-10 23:06:27 +00:00
|
|
|
#endif
|
2017-06-12 14:59:00 +00:00
|
|
|
s->psk_find_session_cb = ctx->psk_find_session_cb;
|
|
|
|
s->psk_use_session_cb = ctx->psk_use_session_cb;
|
2006-03-10 23:06:27 +00:00
|
|
|
|
2015-02-13 23:28:49 +00:00
|
|
|
s->job = NULL;
|
|
|
|
|
2016-03-03 16:19:23 +00:00
|
|
|
#ifndef OPENSSL_NO_CT
|
|
|
|
if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback,
|
2016-08-05 17:03:17 +00:00
|
|
|
ctx->ct_validation_callback_arg))
|
2016-03-03 16:19:23 +00:00
|
|
|
goto err;
|
|
|
|
#endif
|
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
return s;
|
2015-01-22 03:40:55 +00:00
|
|
|
err:
|
2015-04-11 14:22:36 +00:00
|
|
|
SSL_free(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
|
2016-02-29 17:26:07 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-06-08 15:37:06 +00:00
|
|
|
int SSL_is_dtls(const SSL *s)
|
|
|
|
{
|
|
|
|
return SSL_IS_DTLS(s) ? 1 : 0;
|
|
|
|
}
|
|
|
|
|
2016-03-07 21:45:58 +00:00
|
|
|
int SSL_up_ref(SSL *s)
|
2016-01-26 11:31:41 +00:00
|
|
|
{
|
2016-02-29 17:26:07 +00:00
|
|
|
int i;
|
2016-03-07 21:45:58 +00:00
|
|
|
|
2016-08-27 14:01:08 +00:00
|
|
|
if (CRYPTO_UP_REF(&s->references, &i, s->lock) <= 0)
|
2016-03-07 21:45:58 +00:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
REF_PRINT_COUNT("SSL", s);
|
|
|
|
REF_ASSERT_ISNT(i < 2);
|
|
|
|
return ((i > 1) ? 1 : 0);
|
2016-01-26 11:31:41 +00:00
|
|
|
}
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
|
|
|
|
unsigned int sid_ctx_len)
|
|
|
|
{
|
2017-12-07 18:39:34 +00:00
|
|
|
if (sid_ctx_len > sizeof(ctx->sid_ctx)) {
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,
|
|
|
|
SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
ctx->sid_ctx_length = sid_ctx_len;
|
|
|
|
memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
|
1999-04-30 17:15:56 +00:00
|
|
|
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1999-04-30 17:15:56 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
|
|
|
|
unsigned int sid_ctx_len)
|
|
|
|
{
|
|
|
|
if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
|
|
|
|
SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,
|
|
|
|
SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
ssl->sid_ctx_length = sid_ctx_len;
|
|
|
|
memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len);
|
1999-03-22 12:22:14 +00:00
|
|
|
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1999-03-22 12:22:14 +00:00
|
|
|
|
2001-02-21 18:06:26 +00:00
|
|
|
int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-29 17:26:07 +00:00
|
|
|
CRYPTO_THREAD_write_lock(ctx->lock);
|
2015-01-22 03:40:55 +00:00
|
|
|
ctx->generate_session_id = cb;
|
2016-02-29 17:26:07 +00:00
|
|
|
CRYPTO_THREAD_unlock(ctx->lock);
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2001-02-21 18:06:26 +00:00
|
|
|
|
|
|
|
int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-29 17:26:07 +00:00
|
|
|
CRYPTO_THREAD_write_lock(ssl->lock);
|
2015-01-22 03:40:55 +00:00
|
|
|
ssl->generate_session_id = cb;
|
2016-02-29 17:26:07 +00:00
|
|
|
CRYPTO_THREAD_unlock(ssl->lock);
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2001-02-21 18:06:26 +00:00
|
|
|
|
2001-02-23 00:02:56 +00:00
|
|
|
int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
|
2015-01-22 03:40:55 +00:00
|
|
|
unsigned int id_len)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
|
2017-03-28 21:57:28 +00:00
|
|
|
* we can "construct" a session to give us the desired check - i.e. to
|
2015-01-22 03:40:55 +00:00
|
|
|
* find if there's a session in the hash table that would conflict with
|
|
|
|
* any new session built out of this id/id_len and the ssl_version in use
|
|
|
|
* by this SSL.
|
|
|
|
*/
|
|
|
|
SSL_SESSION r, *p;
|
|
|
|
|
2017-12-07 18:39:34 +00:00
|
|
|
if (id_len > sizeof(r.session_id))
|
2015-01-22 03:40:55 +00:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
r.ssl_version = ssl->version;
|
|
|
|
r.session_id_length = id_len;
|
|
|
|
memcpy(r.session_id, id, id_len);
|
|
|
|
|
2016-05-26 17:49:36 +00:00
|
|
|
CRYPTO_THREAD_read_lock(ssl->session_ctx->lock);
|
|
|
|
p = lh_SSL_SESSION_retrieve(ssl->session_ctx->sessions, &r);
|
|
|
|
CRYPTO_THREAD_unlock(ssl->session_ctx->lock);
|
2015-01-22 03:40:55 +00:00
|
|
|
return (p != NULL);
|
|
|
|
}
|
2001-02-21 18:06:26 +00:00
|
|
|
|
1999-11-29 22:35:00 +00:00
|
|
|
int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
|
|
|
|
}
|
1999-11-29 22:35:00 +00:00
|
|
|
|
|
|
|
int SSL_set_purpose(SSL *s, int purpose)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
|
|
|
|
}
|
2001-05-10 00:13:59 +00:00
|
|
|
|
1999-11-29 22:35:00 +00:00
|
|
|
int SSL_CTX_set_trust(SSL_CTX *s, int trust)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set_trust(s->param, trust);
|
|
|
|
}
|
1999-11-29 22:35:00 +00:00
|
|
|
|
|
|
|
int SSL_set_trust(SSL *s, int trust)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set_trust(s->param, trust);
|
|
|
|
}
|
1999-11-29 22:35:00 +00:00
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
int SSL_set1_host(SSL *s, const char *hostname)
|
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_add1_host(SSL *s, const char *hostname)
|
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_hostflags(SSL *s, unsigned int flags)
|
|
|
|
{
|
|
|
|
X509_VERIFY_PARAM_set_hostflags(s->param, flags);
|
|
|
|
}
|
|
|
|
|
2016-09-21 14:37:03 +00:00
|
|
|
const char *SSL_get0_peername(SSL *s)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_get0_peername(s->param);
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_CTX_dane_enable(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return dane_ctx_enable(&ctx->dane);
|
|
|
|
}
|
|
|
|
|
2016-07-11 00:36:02 +00:00
|
|
|
unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags)
|
|
|
|
{
|
|
|
|
unsigned long orig = ctx->dane.flags;
|
|
|
|
|
|
|
|
ctx->dane.flags |= flags;
|
|
|
|
return orig;
|
|
|
|
}
|
|
|
|
|
|
|
|
unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags)
|
|
|
|
{
|
|
|
|
unsigned long orig = ctx->dane.flags;
|
|
|
|
|
|
|
|
ctx->dane.flags &= ~flags;
|
|
|
|
return orig;
|
|
|
|
}
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
int SSL_dane_enable(SSL *s, const char *basedomain)
|
|
|
|
{
|
2016-04-08 13:10:06 +00:00
|
|
|
SSL_DANE *dane = &s->dane;
|
2015-12-29 18:28:28 +00:00
|
|
|
|
|
|
|
if (s->ctx->dane.mdmax == 0) {
|
|
|
|
SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_CONTEXT_NOT_DANE_ENABLED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (dane->trecs != NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_DANE_ALREADY_ENABLED);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-01-16 18:25:17 +00:00
|
|
|
/*
|
|
|
|
* Default SNI name. This rejects empty names, while set1_host below
|
|
|
|
* accepts them and disables host name checks. To avoid side-effects with
|
|
|
|
* invalid input, set the SNI name first.
|
|
|
|
*/
|
2016-12-08 19:18:40 +00:00
|
|
|
if (s->ext.hostname == NULL) {
|
2016-05-03 20:40:33 +00:00
|
|
|
if (!SSL_set_tlsext_host_name(s, basedomain)) {
|
2016-01-16 18:25:17 +00:00
|
|
|
SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
|
2016-05-03 20:40:33 +00:00
|
|
|
return -1;
|
2016-01-16 18:25:17 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
/* Primary RFC6125 reference identifier */
|
|
|
|
if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, 0)) {
|
|
|
|
SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
dane->mdpth = -1;
|
|
|
|
dane->pdpth = -1;
|
|
|
|
dane->dctx = &s->ctx->dane;
|
|
|
|
dane->trecs = sk_danetls_record_new_null();
|
|
|
|
|
|
|
|
if (dane->trecs == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_DANE_ENABLE, ERR_R_MALLOC_FAILURE);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-07-11 00:36:02 +00:00
|
|
|
unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags)
|
|
|
|
{
|
|
|
|
unsigned long orig = ssl->dane.flags;
|
|
|
|
|
|
|
|
ssl->dane.flags |= flags;
|
|
|
|
return orig;
|
|
|
|
}
|
|
|
|
|
|
|
|
unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags)
|
|
|
|
{
|
|
|
|
unsigned long orig = ssl->dane.flags;
|
|
|
|
|
|
|
|
ssl->dane.flags &= ~flags;
|
|
|
|
return orig;
|
|
|
|
}
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki)
|
|
|
|
{
|
2016-04-08 13:10:06 +00:00
|
|
|
SSL_DANE *dane = &s->dane;
|
2015-12-29 18:28:28 +00:00
|
|
|
|
Suppress DANE TLSA reflection when verification fails
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa()
are expected to return a negative match depth and nothing else when
verification fails. However, this only happened when verification
failed during chain construction. Errors in verification of the
constructed chain did not have the intended effect on these functions.
This commit updates the functions to check for verify_result ==
X509_V_OK, and no longer erases any accumulated match information
when chain construction fails. Sophisticated developers can, with
care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA
info even when verification fail. They must of course first check
and save the real error, and restore the original error as quickly
as possible. Hiding by default seems to be the safer interface.
Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find
matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED.
This also changes the "-brief" output from s_client to include
verification results and TLSA match information.
Mentioned session resumption in code example in SSL_CTX_dane_enable(3).
Also mentioned that depths returned are relative to the verified chain
which is now available via SSL_get0_verified_chain(3).
Added a few more test-cases to danetest, that exercise the new
code.
Resolved thread safety issue in use of static buffer in
X509_verify_cert_error_string().
Fixed long-stating issue in apps/s_cb.c which always sets verify_error
to either X509_V_OK or "chain to long", code elsewhere (e.g.
s_time.c), seems to expect the actual error. [ The new chain
construction code is expected to correctly generate "chain
too long" errors, so at some point we need to drop the
work-arounds, once SSL_set_verify_depth() is also fixed to
propagate the depth to X509_STORE_CTX reliably. ]
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08 00:07:57 +00:00
|
|
|
if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
|
2015-12-29 18:28:28 +00:00
|
|
|
return -1;
|
|
|
|
if (dane->mtlsa) {
|
|
|
|
if (mcert)
|
|
|
|
*mcert = dane->mcert;
|
|
|
|
if (mspki)
|
|
|
|
*mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;
|
|
|
|
}
|
|
|
|
return dane->mdpth;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector,
|
|
|
|
uint8_t *mtype, unsigned const char **data, size_t *dlen)
|
|
|
|
{
|
2016-04-08 13:10:06 +00:00
|
|
|
SSL_DANE *dane = &s->dane;
|
2015-12-29 18:28:28 +00:00
|
|
|
|
Suppress DANE TLSA reflection when verification fails
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa()
are expected to return a negative match depth and nothing else when
verification fails. However, this only happened when verification
failed during chain construction. Errors in verification of the
constructed chain did not have the intended effect on these functions.
This commit updates the functions to check for verify_result ==
X509_V_OK, and no longer erases any accumulated match information
when chain construction fails. Sophisticated developers can, with
care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA
info even when verification fail. They must of course first check
and save the real error, and restore the original error as quickly
as possible. Hiding by default seems to be the safer interface.
Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find
matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED.
This also changes the "-brief" output from s_client to include
verification results and TLSA match information.
Mentioned session resumption in code example in SSL_CTX_dane_enable(3).
Also mentioned that depths returned are relative to the verified chain
which is now available via SSL_get0_verified_chain(3).
Added a few more test-cases to danetest, that exercise the new
code.
Resolved thread safety issue in use of static buffer in
X509_verify_cert_error_string().
Fixed long-stating issue in apps/s_cb.c which always sets verify_error
to either X509_V_OK or "chain to long", code elsewhere (e.g.
s_time.c), seems to expect the actual error. [ The new chain
construction code is expected to correctly generate "chain
too long" errors, so at some point we need to drop the
work-arounds, once SSL_set_verify_depth() is also fixed to
propagate the depth to X509_STORE_CTX reliably. ]
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08 00:07:57 +00:00
|
|
|
if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
|
2015-12-29 18:28:28 +00:00
|
|
|
return -1;
|
|
|
|
if (dane->mtlsa) {
|
|
|
|
if (usage)
|
|
|
|
*usage = dane->mtlsa->usage;
|
|
|
|
if (selector)
|
|
|
|
*selector = dane->mtlsa->selector;
|
|
|
|
if (mtype)
|
|
|
|
*mtype = dane->mtlsa->mtype;
|
|
|
|
if (data)
|
|
|
|
*data = dane->mtlsa->data;
|
|
|
|
if (dlen)
|
|
|
|
*dlen = dane->mtlsa->dlen;
|
|
|
|
}
|
|
|
|
return dane->mdpth;
|
|
|
|
}
|
|
|
|
|
2016-04-08 13:10:06 +00:00
|
|
|
SSL_DANE *SSL_get0_dane(SSL *s)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
return &s->dane;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,
|
2018-01-10 17:06:35 +00:00
|
|
|
uint8_t mtype, unsigned const char *data, size_t dlen)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, uint8_t mtype,
|
|
|
|
uint8_t ord)
|
2015-12-29 18:28:28 +00:00
|
|
|
{
|
|
|
|
return dane_mtype_set(&ctx->dane, md, mtype, ord);
|
|
|
|
}
|
|
|
|
|
2009-06-30 11:58:10 +00:00
|
|
|
int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set1(ctx->param, vpm);
|
|
|
|
}
|
2009-06-30 11:58:10 +00:00
|
|
|
|
|
|
|
int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_set1(ssl->param, vpm);
|
|
|
|
}
|
2009-06-30 11:58:10 +00:00
|
|
|
|
2013-12-13 13:59:53 +00:00
|
|
|
X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return ctx->param;
|
|
|
|
}
|
2013-12-13 13:59:53 +00:00
|
|
|
|
|
|
|
X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return ssl->param;
|
|
|
|
}
|
2013-12-13 13:59:53 +00:00
|
|
|
|
2012-06-18 12:56:59 +00:00
|
|
|
void SSL_certs_clear(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ssl_cert_clear_certs(s->cert);
|
|
|
|
}
|
2012-06-18 12:56:59 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_free(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
int i;
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2018-03-27 20:25:08 +00:00
|
|
|
if (s == NULL)
|
|
|
|
return;
|
2016-08-27 14:01:08 +00:00
|
|
|
CRYPTO_DOWN_REF(&s->references, &i, s->lock);
|
2016-01-30 17:04:25 +00:00
|
|
|
REF_PRINT_COUNT("SSL", s);
|
2015-01-22 03:40:55 +00:00
|
|
|
if (i > 0)
|
|
|
|
return;
|
2016-01-30 17:04:25 +00:00
|
|
|
REF_ASSERT_ISNT(i < 0);
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-04-30 21:33:59 +00:00
|
|
|
X509_VERIFY_PARAM_free(s->param);
|
2015-12-29 18:28:28 +00:00
|
|
|
dane_final(&s->dane);
|
2015-01-22 03:40:55 +00:00
|
|
|
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
|
|
|
|
|
2017-05-22 11:33:42 +00:00
|
|
|
/* Ignore return value */
|
2016-06-17 12:59:59 +00:00
|
|
|
ssl_free_wbio_buffer(s);
|
|
|
|
|
2016-07-21 11:17:29 +00:00
|
|
|
BIO_free_all(s->wbio);
|
2016-06-05 18:48:08 +00:00
|
|
|
BIO_free_all(s->rbio);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-05-01 18:37:16 +00:00
|
|
|
BUF_MEM_free(s->init_buf);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/* add extra stuff */
|
2015-05-01 18:37:16 +00:00
|
|
|
sk_SSL_CIPHER_free(s->cipher_list);
|
|
|
|
sk_SSL_CIPHER_free(s->cipher_list_by_id);
|
2018-02-16 11:26:02 +00:00
|
|
|
sk_SSL_CIPHER_free(s->tls13_ciphersuites);
|
2019-06-14 13:06:55 +00:00
|
|
|
sk_SSL_CIPHER_free(s->peer_ciphers);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/* Make the next call work :-) */
|
|
|
|
if (s->session != NULL) {
|
|
|
|
ssl_clear_bad_session(s);
|
|
|
|
SSL_SESSION_free(s->session);
|
|
|
|
}
|
2017-06-12 12:30:21 +00:00
|
|
|
SSL_SESSION_free(s->psksession);
|
2017-07-05 19:53:03 +00:00
|
|
|
OPENSSL_free(s->psksession_id);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-06-13 14:50:00 +00:00
|
|
|
clear_ciphers(s);
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-04-11 20:32:54 +00:00
|
|
|
ssl_cert_free(s->cert);
|
2015-01-22 03:40:55 +00:00
|
|
|
/* Free up if allocated */
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(s->ext.hostname);
|
2017-01-31 20:32:50 +00:00
|
|
|
SSL_CTX_free(s->session_ctx);
|
2015-05-15 09:49:56 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(s->ext.ecpointformats);
|
2019-06-18 10:45:26 +00:00
|
|
|
OPENSSL_free(s->ext.peer_ecpointformats);
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(s->ext.supportedgroups);
|
2019-06-14 11:46:13 +00:00
|
|
|
OPENSSL_free(s->ext.peer_supportedgroups);
|
2016-08-05 17:03:17 +00:00
|
|
|
#endif /* OPENSSL_NO_EC */
|
2016-12-08 19:18:40 +00:00
|
|
|
sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
|
2016-03-21 16:54:53 +00:00
|
|
|
#ifndef OPENSSL_NO_OCSP
|
2016-12-08 19:18:40 +00:00
|
|
|
sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
|
2016-03-21 16:54:53 +00:00
|
|
|
#endif
|
2016-03-03 16:19:23 +00:00
|
|
|
#ifndef OPENSSL_NO_CT
|
|
|
|
SCT_LIST_free(s->scts);
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(s->ext.scts);
|
2016-03-03 16:19:23 +00:00
|
|
|
#endif
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(s->ext.ocsp.resp);
|
|
|
|
OPENSSL_free(s->ext.alpn);
|
2017-03-02 17:37:03 +00:00
|
|
|
OPENSSL_free(s->ext.tls13_cookie);
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
OPENSSL_free(s->clienthello);
|
Add TLSv1.3 post-handshake authentication (PHA)
Add SSL_verify_client_post_handshake() for servers to initiate PHA
Add SSL_force_post_handshake_auth() for clients that don't have certificates
initially configured, but use a certificate callback.
Update SSL_CTX_set_verify()/SSL_set_verify() mode:
* Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after
the initial handshake.
* Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless
of when the certificate authentication takes place; either initial handshake,
re-negotiation, or post-handshake authentication.
Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that
add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options
Add support to s_client:
* Enabled automatically when cert is configured
* Can be forced enabled via -force_pha
Add support to s_server:
* Use 'c' to invoke PHA in s_server
* Remove some dead code
Update documentation
Update unit tests:
* Illegal use of PHA extension
* TLSv1.3 certificate tests
DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is
implemented, it's PHA support state machine may need to be different.
Add a TODO and a #error
Update handshake context to deal with PHA.
The handshake context for TLSv1.3 post-handshake auth is up through the
ClientFinish message, plus the CertificateRequest message. Subsequent
Certificate, CertificateVerify, and Finish messages are based on this
handshake context (not the Certificate message per se, but it's included
after the hash). KeyUpdate, NewSessionTicket, and prior Certificate
Request messages are not included in post-handshake authentication.
After the ClientFinished message is processed, save off the digest state
for future post-handshake authentication. When post-handshake auth occurs,
copy over the saved handshake context into the "main" handshake digest.
This effectively discards the any KeyUpdate or NewSessionTicket messages
and any prior post-handshake authentication.
This, of course, assumes that the ID-22 did not mean to include any
previous post-handshake authentication into the new handshake transcript.
This is implied by section 4.4.1 that lists messages only up to the
first ClientFinished.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4964)
2017-12-18 21:52:28 +00:00
|
|
|
OPENSSL_free(s->pha_context);
|
|
|
|
EVP_MD_CTX_free(s->pha_dgst);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2017-03-13 15:00:36 +00:00
|
|
|
sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
|
2018-10-26 10:43:19 +00:00
|
|
|
sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-02-06 03:17:23 +00:00
|
|
|
sk_X509_pop_free(s->verified_chain, X509_free);
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (s->method != NULL)
|
|
|
|
s->method->ssl_free(s);
|
|
|
|
|
2015-02-02 12:18:03 +00:00
|
|
|
RECORD_LAYER_release(&s->rlayer);
|
2015-01-30 15:38:10 +00:00
|
|
|
|
2015-04-11 20:32:54 +00:00
|
|
|
SSL_CTX_free(s->ctx);
|
2009-10-16 13:41:39 +00:00
|
|
|
|
2016-01-25 15:28:57 +00:00
|
|
|
ASYNC_WAIT_CTX_free(s->waitctx);
|
|
|
|
|
2015-05-15 09:49:56 +00:00
|
|
|
#if !defined(OPENSSL_NO_NEXTPROTONEG)
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(s->ext.npn);
|
2010-07-28 10:06:55 +00:00
|
|
|
#endif
|
|
|
|
|
2014-12-22 11:15:51 +00:00
|
|
|
#ifndef OPENSSL_NO_SRTP
|
2015-05-01 18:37:16 +00:00
|
|
|
sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
|
2015-01-22 03:40:55 +00:00
|
|
|
#endif
|
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
CRYPTO_THREAD_lock_free(s->lock);
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
OPENSSL_free(s);
|
|
|
|
}
|
|
|
|
|
2016-07-21 11:17:29 +00:00
|
|
|
void SSL_set0_rbio(SSL *s, BIO *rbio)
|
2015-02-07 00:08:59 +00:00
|
|
|
{
|
2016-07-21 11:17:29 +00:00
|
|
|
BIO_free_all(s->rbio);
|
2015-02-07 00:08:59 +00:00
|
|
|
s->rbio = rbio;
|
|
|
|
}
|
|
|
|
|
2016-07-21 11:17:29 +00:00
|
|
|
void SSL_set0_wbio(SSL *s, BIO *wbio)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* If the output buffering BIO is still in place, remove it
|
|
|
|
*/
|
2016-06-17 12:59:59 +00:00
|
|
|
if (s->bbio != NULL)
|
|
|
|
s->wbio = BIO_pop(s->wbio);
|
|
|
|
|
2016-07-21 11:17:29 +00:00
|
|
|
BIO_free_all(s->wbio);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->wbio = wbio;
|
2016-06-17 12:59:59 +00:00
|
|
|
|
|
|
|
/* Re-attach |bbio| to the new |wbio|. */
|
|
|
|
if (s->bbio != NULL)
|
|
|
|
s->wbio = BIO_push(s->bbio, s->wbio);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-02-07 00:08:59 +00:00
|
|
|
void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
|
|
|
|
{
|
2016-07-21 11:17:29 +00:00
|
|
|
/*
|
|
|
|
* For historical reasons, this function has many different cases in
|
|
|
|
* ownership handling.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* If nothing has changed, do nothing */
|
|
|
|
if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s))
|
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the two arguments are equal then one fewer reference is granted by the
|
|
|
|
* caller than we want to take
|
|
|
|
*/
|
|
|
|
if (rbio != NULL && rbio == wbio)
|
|
|
|
BIO_up_ref(rbio);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If only the wbio is changed only adopt one reference.
|
|
|
|
*/
|
|
|
|
if (rbio == SSL_get_rbio(s)) {
|
|
|
|
SSL_set0_wbio(s, wbio);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* There is an asymmetry here for historical reasons. If only the rbio is
|
|
|
|
* changed AND the rbio and wbio were originally different, then we only
|
|
|
|
* adopt one reference.
|
|
|
|
*/
|
|
|
|
if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) {
|
|
|
|
SSL_set0_rbio(s, rbio);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Otherwise, adopt both references. */
|
|
|
|
SSL_set0_rbio(s, rbio);
|
|
|
|
SSL_set0_wbio(s, wbio);
|
2015-02-07 00:08:59 +00:00
|
|
|
}
|
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
BIO *SSL_get_rbio(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-06-17 12:59:59 +00:00
|
|
|
return s->rbio;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
BIO *SSL_get_wbio(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-06-17 12:59:59 +00:00
|
|
|
if (s->bbio != NULL) {
|
|
|
|
/*
|
|
|
|
* If |bbio| is active, the true caller-configured BIO is its
|
|
|
|
* |next_bio|.
|
|
|
|
*/
|
|
|
|
return BIO_next(s->bbio);
|
|
|
|
}
|
|
|
|
return s->wbio;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_fd(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-06-17 12:59:59 +00:00
|
|
|
return SSL_get_rfd(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2001-07-15 20:11:57 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_rfd(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
int ret = -1;
|
|
|
|
BIO *b, *r;
|
|
|
|
|
|
|
|
b = SSL_get_rbio(s);
|
|
|
|
r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
|
|
|
|
if (r != NULL)
|
|
|
|
BIO_get_fd(r, &ret);
|
2017-10-17 14:04:09 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_wfd(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
int ret = -1;
|
|
|
|
BIO *b, *r;
|
|
|
|
|
|
|
|
b = SSL_get_wbio(s);
|
|
|
|
r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
|
|
|
|
if (r != NULL)
|
|
|
|
BIO_get_fd(r, &ret);
|
2017-10-17 14:04:09 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2001-07-15 20:11:57 +00:00
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_SOCK
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_set_fd(SSL *s, int fd)
|
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
BIO *bio = NULL;
|
|
|
|
|
|
|
|
bio = BIO_new(BIO_s_socket());
|
|
|
|
|
|
|
|
if (bio == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
BIO_set_fd(bio, fd, BIO_NOCLOSE);
|
|
|
|
SSL_set_bio(s, bio, bio);
|
|
|
|
ret = 1;
|
|
|
|
err:
|
2017-10-17 14:04:09 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_set_wfd(SSL *s, int fd)
|
|
|
|
{
|
2016-06-17 12:59:59 +00:00
|
|
|
BIO *rbio = SSL_get_rbio(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-06-17 12:59:59 +00:00
|
|
|
if (rbio == NULL || BIO_method_type(rbio) != BIO_TYPE_SOCKET
|
|
|
|
|| (int)BIO_get_fd(rbio, NULL) != fd) {
|
|
|
|
BIO *bio = BIO_new(BIO_s_socket());
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
if (bio == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB);
|
2016-06-17 12:59:59 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
BIO_set_fd(bio, fd, BIO_NOCLOSE);
|
2016-07-21 11:17:29 +00:00
|
|
|
SSL_set0_wbio(s, bio);
|
2016-06-17 12:59:59 +00:00
|
|
|
} else {
|
2016-07-21 11:17:29 +00:00
|
|
|
BIO_up_ref(rbio);
|
|
|
|
SSL_set0_wbio(s, rbio);
|
2016-06-17 12:59:59 +00:00
|
|
|
}
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_set_rfd(SSL *s, int fd)
|
|
|
|
{
|
2016-06-17 12:59:59 +00:00
|
|
|
BIO *wbio = SSL_get_wbio(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-06-17 12:59:59 +00:00
|
|
|
if (wbio == NULL || BIO_method_type(wbio) != BIO_TYPE_SOCKET
|
|
|
|
|| ((int)BIO_get_fd(wbio, NULL) != fd)) {
|
|
|
|
BIO *bio = BIO_new(BIO_s_socket());
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
if (bio == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB);
|
2016-06-17 12:59:59 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
BIO_set_fd(bio, fd, BIO_NOCLOSE);
|
2016-07-21 11:17:29 +00:00
|
|
|
SSL_set0_rbio(s, bio);
|
2016-06-17 12:59:59 +00:00
|
|
|
} else {
|
2016-07-21 11:17:29 +00:00
|
|
|
BIO_up_ref(wbio);
|
|
|
|
SSL_set0_rbio(s, wbio);
|
2016-06-17 12:59:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
#endif
|
2000-01-06 01:19:17 +00:00
|
|
|
|
|
|
|
/* return length of latest Finished message we sent, copy to 'buf' */
|
2005-03-30 10:26:02 +00:00
|
|
|
size_t SSL_get_finished(const SSL *s, void *buf, size_t count)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
size_t ret = 0;
|
|
|
|
|
|
|
|
if (s->s3 != NULL) {
|
|
|
|
ret = s->s3->tmp.finish_md_len;
|
|
|
|
if (count > ret)
|
|
|
|
count = ret;
|
|
|
|
memcpy(buf, s->s3->tmp.finish_md, count);
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
2000-01-06 01:19:17 +00:00
|
|
|
|
|
|
|
/* return length of latest Finished message we expected, copy to 'buf' */
|
2005-03-30 10:26:02 +00:00
|
|
|
size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
size_t ret = 0;
|
2000-01-06 01:19:17 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (s->s3 != NULL) {
|
|
|
|
ret = s->s3->tmp.peer_finish_md_len;
|
|
|
|
if (count > ret)
|
|
|
|
count = ret;
|
|
|
|
memcpy(buf, s->s3->tmp.peer_finish_md, count);
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
2000-01-06 01:19:17 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_verify_mode(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->verify_mode;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_verify_depth(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_get_depth(s->param);
|
|
|
|
}
|
1999-05-01 03:20:40 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
int (*SSL_get_verify_callback(const SSL *s)) (int, X509_STORE_CTX *) {
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->verify_callback;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->verify_mode;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return X509_VERIFY_PARAM_get_depth(ctx->param);
|
|
|
|
}
|
|
|
|
|
|
|
|
int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx)) (int, X509_STORE_CTX *) {
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->default_verify_callback;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_verify(SSL *s, int mode,
|
|
|
|
int (*callback) (int ok, X509_STORE_CTX *ctx))
|
|
|
|
{
|
|
|
|
s->verify_mode = mode;
|
|
|
|
if (callback != NULL)
|
|
|
|
s->verify_callback = callback;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_verify_depth(SSL *s, int depth)
|
|
|
|
{
|
|
|
|
X509_VERIFY_PARAM_set_depth(s->param, depth);
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_read_ahead(SSL *s, int yes)
|
|
|
|
{
|
2015-01-30 13:46:43 +00:00
|
|
|
RECORD_LAYER_set_read_ahead(&s->rlayer, yes);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_read_ahead(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2015-01-30 13:46:43 +00:00
|
|
|
return RECORD_LAYER_get_read_ahead(&s->rlayer);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_pending(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-10-06 18:17:54 +00:00
|
|
|
size_t pending = s->method->ssl_pending(s);
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* SSL_pending cannot work properly if read-ahead is enabled
|
|
|
|
* (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is
|
|
|
|
* impossible to fix since SSL_pending cannot report errors that may be
|
|
|
|
* observed while scanning the new data. (Note that SSL_pending() is
|
|
|
|
* often used as a boolean value, so we'd better not return -1.)
|
2016-10-06 18:17:54 +00:00
|
|
|
*
|
|
|
|
* SSL_pending also cannot work properly if the value >INT_MAX. In that case
|
|
|
|
* we just return INT_MAX.
|
2015-01-22 03:40:55 +00:00
|
|
|
*/
|
2016-10-19 14:11:24 +00:00
|
|
|
return pending < INT_MAX ? (int)pending : INT_MAX;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-02-12 12:03:58 +00:00
|
|
|
int SSL_has_pending(const SSL *s)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Similar to SSL_pending() but returns a 1 to indicate that we have
|
|
|
|
* unprocessed data available or 0 otherwise (as opposed to the number of
|
|
|
|
* bytes available). Unlike SSL_pending() this will take into account
|
|
|
|
* read_ahead data. A 1 return simply indicates that we have unprocessed
|
|
|
|
* data. That data may not result in any application data, or we may fail
|
|
|
|
* to parse the records for some reason.
|
|
|
|
*/
|
2017-03-03 12:41:39 +00:00
|
|
|
if (RECORD_LAYER_processed_read_pending(&s->rlayer))
|
2016-02-12 12:03:58 +00:00
|
|
|
return 1;
|
|
|
|
|
|
|
|
return RECORD_LAYER_read_pending(&s->rlayer);
|
|
|
|
}
|
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
X509 *SSL_get_peer_certificate(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
X509 *r;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if ((s == NULL) || (s->session == NULL))
|
|
|
|
r = NULL;
|
|
|
|
else
|
|
|
|
r = s->session->peer;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (r == NULL)
|
2017-10-17 14:04:09 +00:00
|
|
|
return r;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-08-31 19:29:57 +00:00
|
|
|
X509_up_ref(r);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2017-10-17 14:04:09 +00:00
|
|
|
return r;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
STACK_OF(X509) *r;
|
|
|
|
|
2015-06-21 18:34:33 +00:00
|
|
|
if ((s == NULL) || (s->session == NULL))
|
2015-01-22 03:40:55 +00:00
|
|
|
r = NULL;
|
|
|
|
else
|
2015-06-21 18:34:33 +00:00
|
|
|
r = s->session->peer_chain;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If we are a client, cert_chain includes the peer's own certificate; if
|
|
|
|
* we are a server, it does not.
|
|
|
|
*/
|
|
|
|
|
2017-10-17 14:04:09 +00:00
|
|
|
return r;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Now in theory, since the calling process own 't' it should be safe to
|
|
|
|
* modify. We need to be able to read f without being hassled
|
|
|
|
*/
|
2015-03-24 15:10:15 +00:00
|
|
|
int SSL_copy_session_id(SSL *t, const SSL *f)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-29 17:26:07 +00:00
|
|
|
int i;
|
2015-01-22 03:40:55 +00:00
|
|
|
/* Do we need to to SSL locking? */
|
2015-04-16 05:50:03 +00:00
|
|
|
if (!SSL_set_session(t, SSL_get_session(f))) {
|
2015-03-24 15:10:15 +00:00
|
|
|
return 0;
|
2015-03-06 14:37:17 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/*
|
2015-10-29 14:50:40 +00:00
|
|
|
* what if we are setup for one protocol version but want to talk another
|
2015-01-22 03:40:55 +00:00
|
|
|
*/
|
|
|
|
if (t->method != f->method) {
|
2015-12-29 18:28:28 +00:00
|
|
|
t->method->ssl_free(t);
|
|
|
|
t->method = f->method;
|
|
|
|
if (t->method->ssl_new(t) == 0)
|
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2016-08-27 14:01:08 +00:00
|
|
|
CRYPTO_UP_REF(&f->cert->references, &i, f->cert->lock);
|
2015-03-18 18:02:50 +00:00
|
|
|
ssl_cert_free(t->cert);
|
|
|
|
t->cert = f->cert;
|
2016-10-19 14:11:24 +00:00
|
|
|
if (!SSL_set_session_id_context(t, f->sid_ctx, (int)f->sid_ctx_length)) {
|
2015-03-24 15:10:15 +00:00
|
|
|
return 0;
|
2015-03-06 14:37:17 +00:00
|
|
|
}
|
2015-03-24 15:10:15 +00:00
|
|
|
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Fix this so it checks all the valid key/cert options */
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_CTX_check_private_key(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-08-05 17:03:17 +00:00
|
|
|
if ((ctx == NULL) || (ctx->cert->key->x509 == NULL)) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
if (ctx->cert->key->privatekey == NULL) {
|
2016-08-05 17:03:17 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2017-10-17 14:04:09 +00:00
|
|
|
return X509_check_private_key
|
|
|
|
(ctx->cert->key->x509, ctx->cert->key->privatekey);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1998-12-21 10:56:39 +00:00
|
|
|
/* Fix this function so that it takes an optional type parameter */
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_check_private_key(const SSL *ssl)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (ssl == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
if (ssl->cert->key->x509 == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
if (ssl->cert->key->privatekey == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2017-10-17 14:04:09 +00:00
|
|
|
return X509_check_private_key(ssl->cert->key->x509,
|
|
|
|
ssl->cert->key->privatekey);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-02-13 23:28:49 +00:00
|
|
|
int SSL_waiting_for_async(SSL *s)
|
|
|
|
{
|
2016-06-28 22:18:50 +00:00
|
|
|
if (s->job)
|
2015-03-26 10:15:59 +00:00
|
|
|
return 1;
|
|
|
|
|
2015-02-13 23:28:49 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-01-25 15:28:57 +00:00
|
|
|
int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds)
|
2015-07-24 07:15:31 +00:00
|
|
|
{
|
2016-01-25 15:28:57 +00:00
|
|
|
ASYNC_WAIT_CTX *ctx = s->waitctx;
|
|
|
|
|
|
|
|
if (ctx == NULL)
|
|
|
|
return 0;
|
|
|
|
return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds);
|
|
|
|
}
|
2015-07-24 07:15:31 +00:00
|
|
|
|
2016-01-25 15:28:57 +00:00
|
|
|
int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds,
|
|
|
|
OSSL_ASYNC_FD *delfd, size_t *numdelfds)
|
|
|
|
{
|
|
|
|
ASYNC_WAIT_CTX *ctx = s->waitctx;
|
|
|
|
|
|
|
|
if (ctx == NULL)
|
|
|
|
return 0;
|
|
|
|
return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd,
|
|
|
|
numdelfds);
|
2015-07-24 07:15:31 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_accept(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-18 13:59:32 +00:00
|
|
|
if (s->handshake_func == NULL) {
|
2015-01-22 03:40:55 +00:00
|
|
|
/* Not properly initialized yet */
|
|
|
|
SSL_set_accept_state(s);
|
2015-02-13 23:28:49 +00:00
|
|
|
}
|
2015-10-06 14:57:50 +00:00
|
|
|
|
|
|
|
return SSL_do_handshake(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_connect(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-18 13:59:32 +00:00
|
|
|
if (s->handshake_func == NULL) {
|
2015-01-22 03:40:55 +00:00
|
|
|
/* Not properly initialized yet */
|
|
|
|
SSL_set_connect_state(s);
|
2015-10-06 14:57:50 +00:00
|
|
|
}
|
1999-05-11 07:43:16 +00:00
|
|
|
|
2015-10-06 14:57:50 +00:00
|
|
|
return SSL_do_handshake(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
long SSL_get_default_timeout(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->method->get_timeout();
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2015-10-09 15:47:43 +00:00
|
|
|
static int ssl_start_async_job(SSL *s, struct ssl_async_args *args,
|
2016-08-05 17:03:17 +00:00
|
|
|
int (*func) (void *))
|
|
|
|
{
|
2015-10-06 14:57:50 +00:00
|
|
|
int ret;
|
2016-01-25 15:28:57 +00:00
|
|
|
if (s->waitctx == NULL) {
|
|
|
|
s->waitctx = ASYNC_WAIT_CTX_new();
|
|
|
|
if (s->waitctx == NULL)
|
|
|
|
return -1;
|
|
|
|
}
|
2016-06-28 22:18:50 +00:00
|
|
|
switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args,
|
2016-08-05 17:03:17 +00:00
|
|
|
sizeof(struct ssl_async_args))) {
|
2015-10-06 14:57:50 +00:00
|
|
|
case ASYNC_ERR:
|
|
|
|
s->rwstate = SSL_NOTHING;
|
2015-10-09 15:47:43 +00:00
|
|
|
SSLerr(SSL_F_SSL_START_ASYNC_JOB, SSL_R_FAILED_TO_INIT_ASYNC);
|
2015-10-06 14:57:50 +00:00
|
|
|
return -1;
|
|
|
|
case ASYNC_PAUSE:
|
|
|
|
s->rwstate = SSL_ASYNC_PAUSED;
|
|
|
|
return -1;
|
2016-05-03 16:55:00 +00:00
|
|
|
case ASYNC_NO_JOBS:
|
|
|
|
s->rwstate = SSL_ASYNC_NO_JOBS;
|
|
|
|
return -1;
|
2015-10-06 14:57:50 +00:00
|
|
|
case ASYNC_FINISH:
|
|
|
|
s->job = NULL;
|
|
|
|
return ret;
|
|
|
|
default:
|
|
|
|
s->rwstate = SSL_NOTHING;
|
2015-10-09 15:47:43 +00:00
|
|
|
SSLerr(SSL_F_SSL_START_ASYNC_JOB, ERR_R_INTERNAL_ERROR);
|
2015-10-06 14:57:50 +00:00
|
|
|
/* Shouldn't happen */
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
2015-02-13 23:28:49 +00:00
|
|
|
|
2015-10-06 14:57:50 +00:00
|
|
|
static int ssl_io_intern(void *vargs)
|
2015-02-13 23:28:49 +00:00
|
|
|
{
|
|
|
|
struct ssl_async_args *args;
|
|
|
|
SSL *s;
|
|
|
|
void *buf;
|
2016-10-19 14:11:24 +00:00
|
|
|
size_t num;
|
2015-02-13 23:28:49 +00:00
|
|
|
|
|
|
|
args = (struct ssl_async_args *)vargs;
|
|
|
|
s = args->s;
|
|
|
|
buf = args->buf;
|
|
|
|
num = args->num;
|
2016-01-25 15:00:10 +00:00
|
|
|
switch (args->type) {
|
|
|
|
case READFUNC:
|
2016-09-07 10:34:39 +00:00
|
|
|
return args->f.func_read(s, buf, num, &s->asyncrw);
|
2016-01-25 15:00:10 +00:00
|
|
|
case WRITEFUNC:
|
2016-09-07 10:34:39 +00:00
|
|
|
return args->f.func_write(s, buf, num, &s->asyncrw);
|
2016-01-25 15:00:10 +00:00
|
|
|
case OTHERFUNC:
|
|
|
|
return args->f.func_other(s);
|
|
|
|
}
|
|
|
|
return -1;
|
2015-02-13 23:28:49 +00:00
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-18 13:59:32 +00:00
|
|
|
if (s->handshake_func == NULL) {
|
2016-11-19 19:15:35 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ_INTERNAL, SSL_R_UNINITIALIZED);
|
2015-01-22 03:40:55 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
|
|
|
|
s->rwstate = SSL_NOTHING;
|
2016-11-19 19:15:35 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2015-02-13 23:28:49 +00:00
|
|
|
|
2017-02-25 15:34:07 +00:00
|
|
|
if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
|
|
|
|
|| s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) {
|
2017-02-24 16:11:03 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
|
|
|
return 0;
|
|
|
|
}
|
2017-02-25 15:34:07 +00:00
|
|
|
/*
|
|
|
|
* If we are a client and haven't received the ServerHello etc then we
|
|
|
|
* better do that
|
|
|
|
*/
|
|
|
|
ossl_statem_check_finish_init(s, 0);
|
2017-02-24 16:11:03 +00:00
|
|
|
|
2016-06-28 22:18:50 +00:00
|
|
|
if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
|
2015-10-06 14:57:50 +00:00
|
|
|
struct ssl_async_args args;
|
2016-09-06 11:05:25 +00:00
|
|
|
int ret;
|
2015-10-06 14:57:50 +00:00
|
|
|
|
|
|
|
args.s = s;
|
|
|
|
args.buf = buf;
|
|
|
|
args.num = num;
|
2016-01-25 15:00:10 +00:00
|
|
|
args.type = READFUNC;
|
|
|
|
args.f.func_read = s->method->ssl_read;
|
2015-10-06 14:57:50 +00:00
|
|
|
|
2016-09-06 11:05:25 +00:00
|
|
|
ret = ssl_start_async_job(s, &args, ssl_io_intern);
|
2016-10-26 09:43:34 +00:00
|
|
|
*readbytes = s->asyncrw;
|
2016-09-06 11:05:25 +00:00
|
|
|
return ret;
|
2015-02-13 23:28:49 +00:00
|
|
|
} else {
|
2016-10-26 09:43:34 +00:00
|
|
|
return s->method->ssl_read(s, buf, num, readbytes);
|
2015-02-13 23:28:49 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
int SSL_read(SSL *s, void *buf, int num)
|
2016-09-06 11:05:25 +00:00
|
|
|
{
|
|
|
|
int ret;
|
2016-10-26 09:43:34 +00:00
|
|
|
size_t readbytes;
|
2016-09-06 11:05:25 +00:00
|
|
|
|
|
|
|
if (num < 0) {
|
2016-11-19 19:15:35 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ, SSL_R_BAD_LENGTH);
|
2016-09-06 11:05:25 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
ret = ssl_read_internal(s, buf, (size_t)num, &readbytes);
|
2016-09-06 11:05:25 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* The cast is safe here because ret should be <= INT_MAX because num is
|
|
|
|
* <= INT_MAX
|
|
|
|
*/
|
|
|
|
if (ret > 0)
|
2016-10-26 09:43:34 +00:00
|
|
|
ret = (int)readbytes;
|
2016-09-06 11:05:25 +00:00
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
|
|
|
|
{
|
|
|
|
int ret = ssl_read_internal(s, buf, num, readbytes);
|
|
|
|
|
|
|
|
if (ret < 0)
|
|
|
|
ret = 0;
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2017-03-02 14:42:55 +00:00
|
|
|
int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes)
|
2017-02-21 17:14:42 +00:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if (!s->server) {
|
2017-03-02 14:42:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
|
|
|
return SSL_READ_EARLY_DATA_ERROR;
|
2017-02-21 17:14:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
switch (s->early_data_state) {
|
|
|
|
case SSL_EARLY_DATA_NONE:
|
|
|
|
if (!SSL_in_before(s)) {
|
2017-03-02 14:42:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ_EARLY_DATA,
|
|
|
|
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
|
|
|
return SSL_READ_EARLY_DATA_ERROR;
|
2017-02-21 17:14:42 +00:00
|
|
|
}
|
|
|
|
/* fall through */
|
|
|
|
|
|
|
|
case SSL_EARLY_DATA_ACCEPT_RETRY:
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_ACCEPTING;
|
|
|
|
ret = SSL_accept(s);
|
|
|
|
if (ret <= 0) {
|
|
|
|
/* NBIO or error */
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY;
|
2017-03-02 14:42:55 +00:00
|
|
|
return SSL_READ_EARLY_DATA_ERROR;
|
2017-02-21 17:14:42 +00:00
|
|
|
}
|
|
|
|
/* fall through */
|
|
|
|
|
|
|
|
case SSL_EARLY_DATA_READ_RETRY:
|
|
|
|
if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_READING;
|
|
|
|
ret = SSL_read_ex(s, buf, num, readbytes);
|
|
|
|
/*
|
2017-03-09 15:03:07 +00:00
|
|
|
* State machine will update early_data_state to
|
|
|
|
* SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData
|
|
|
|
* message
|
2017-02-21 17:14:42 +00:00
|
|
|
*/
|
|
|
|
if (ret > 0 || (ret <= 0 && s->early_data_state
|
|
|
|
!= SSL_EARLY_DATA_FINISHED_READING)) {
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_READ_RETRY;
|
2017-03-02 14:42:55 +00:00
|
|
|
return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS
|
|
|
|
: SSL_READ_EARLY_DATA_ERROR;
|
2017-02-21 17:14:42 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
|
|
|
|
}
|
|
|
|
*readbytes = 0;
|
2017-03-02 14:42:55 +00:00
|
|
|
return SSL_READ_EARLY_DATA_FINISH;
|
2017-02-21 17:14:42 +00:00
|
|
|
|
|
|
|
default:
|
2017-03-02 14:42:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
|
|
|
return SSL_READ_EARLY_DATA_ERROR;
|
2017-02-21 17:14:42 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:17:41 +00:00
|
|
|
int SSL_get_early_data_status(const SSL *s)
|
2017-02-22 13:01:48 +00:00
|
|
|
{
|
|
|
|
return s->ext.early_data;
|
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-18 13:59:32 +00:00
|
|
|
if (s->handshake_func == NULL) {
|
2016-11-19 19:15:35 +00:00
|
|
|
SSLerr(SSL_F_SSL_PEEK_INTERNAL, SSL_R_UNINITIALIZED);
|
2015-01-22 03:40:55 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
|
2016-11-19 19:15:35 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2016-06-28 22:18:50 +00:00
|
|
|
if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
|
2015-10-06 14:57:50 +00:00
|
|
|
struct ssl_async_args args;
|
2016-09-06 11:05:25 +00:00
|
|
|
int ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-10-06 14:57:50 +00:00
|
|
|
args.s = s;
|
|
|
|
args.buf = buf;
|
|
|
|
args.num = num;
|
2016-01-25 15:00:10 +00:00
|
|
|
args.type = READFUNC;
|
|
|
|
args.f.func_read = s->method->ssl_peek;
|
2015-02-13 23:28:49 +00:00
|
|
|
|
2016-09-06 11:05:25 +00:00
|
|
|
ret = ssl_start_async_job(s, &args, ssl_io_intern);
|
2016-10-26 09:43:34 +00:00
|
|
|
*readbytes = s->asyncrw;
|
2016-09-06 11:05:25 +00:00
|
|
|
return ret;
|
2015-10-06 14:57:50 +00:00
|
|
|
} else {
|
2016-10-26 09:43:34 +00:00
|
|
|
return s->method->ssl_peek(s, buf, num, readbytes);
|
2015-10-06 14:57:50 +00:00
|
|
|
}
|
2015-02-13 23:28:49 +00:00
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
int SSL_peek(SSL *s, void *buf, int num)
|
2016-09-07 10:34:39 +00:00
|
|
|
{
|
|
|
|
int ret;
|
2016-11-19 19:15:35 +00:00
|
|
|
size_t readbytes;
|
2016-09-07 10:34:39 +00:00
|
|
|
|
|
|
|
if (num < 0) {
|
2016-11-19 19:15:35 +00:00
|
|
|
SSLerr(SSL_F_SSL_PEEK, SSL_R_BAD_LENGTH);
|
2016-09-07 10:34:39 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes);
|
2016-09-07 10:34:39 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* The cast is safe here because ret should be <= INT_MAX because num is
|
|
|
|
* <= INT_MAX
|
|
|
|
*/
|
|
|
|
if (ret > 0)
|
2016-11-19 19:15:35 +00:00
|
|
|
ret = (int)readbytes;
|
2016-09-07 10:34:39 +00:00
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
|
|
|
|
int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
|
|
|
|
{
|
|
|
|
int ret = ssl_peek_internal(s, buf, num, readbytes);
|
|
|
|
|
|
|
|
if (ret < 0)
|
|
|
|
ret = 0;
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-18 13:59:32 +00:00
|
|
|
if (s->handshake_func == NULL) {
|
2016-11-19 19:15:35 +00:00
|
|
|
SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_UNINITIALIZED);
|
2015-01-22 03:40:55 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (s->shutdown & SSL_SENT_SHUTDOWN) {
|
|
|
|
s->rwstate = SSL_NOTHING;
|
2016-11-19 19:15:35 +00:00
|
|
|
SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_PROTOCOL_IS_SHUTDOWN);
|
|
|
|
return -1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2015-02-13 23:28:49 +00:00
|
|
|
|
2017-03-09 15:03:07 +00:00
|
|
|
if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
|
2017-03-02 15:49:33 +00:00
|
|
|
|| s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY
|
|
|
|
|| s->early_data_state == SSL_EARLY_DATA_READ_RETRY) {
|
2017-02-24 16:11:03 +00:00
|
|
|
SSLerr(SSL_F_SSL_WRITE_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
2017-02-21 09:22:22 +00:00
|
|
|
return 0;
|
2017-02-24 16:11:03 +00:00
|
|
|
}
|
2017-02-25 15:34:07 +00:00
|
|
|
/* If we are a client and haven't sent the Finished we better do that */
|
|
|
|
ossl_statem_check_finish_init(s, 1);
|
2017-02-21 09:22:22 +00:00
|
|
|
|
2016-06-28 22:18:50 +00:00
|
|
|
if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
|
2016-09-07 10:34:39 +00:00
|
|
|
int ret;
|
2015-10-06 14:57:50 +00:00
|
|
|
struct ssl_async_args args;
|
|
|
|
|
|
|
|
args.s = s;
|
|
|
|
args.buf = (void *)buf;
|
|
|
|
args.num = num;
|
2016-01-25 15:00:10 +00:00
|
|
|
args.type = WRITEFUNC;
|
|
|
|
args.f.func_write = s->method->ssl_write;
|
2015-10-06 14:57:50 +00:00
|
|
|
|
2016-09-07 10:34:39 +00:00
|
|
|
ret = ssl_start_async_job(s, &args, ssl_io_intern);
|
|
|
|
*written = s->asyncrw;
|
|
|
|
return ret;
|
2015-02-13 23:28:49 +00:00
|
|
|
} else {
|
2016-09-07 10:34:39 +00:00
|
|
|
return s->method->ssl_write(s, buf, num, written);
|
2015-02-13 23:28:49 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-11-19 19:15:35 +00:00
|
|
|
int SSL_write(SSL *s, const void *buf, int num)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
size_t written;
|
|
|
|
|
|
|
|
if (num < 0) {
|
|
|
|
SSLerr(SSL_F_SSL_WRITE, SSL_R_BAD_LENGTH);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = ssl_write_internal(s, buf, (size_t)num, &written);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The cast is safe here because ret should be <= INT_MAX because num is
|
|
|
|
* <= INT_MAX
|
|
|
|
*/
|
|
|
|
if (ret > 0)
|
|
|
|
ret = (int)written;
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written)
|
|
|
|
{
|
|
|
|
int ret = ssl_write_internal(s, buf, num, written);
|
|
|
|
|
|
|
|
if (ret < 0)
|
|
|
|
ret = 0;
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2017-03-02 15:05:36 +00:00
|
|
|
int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written)
|
2017-02-21 09:22:22 +00:00
|
|
|
{
|
2017-04-03 13:22:26 +00:00
|
|
|
int ret, early_data_state;
|
2017-11-27 15:20:06 +00:00
|
|
|
size_t writtmp;
|
2017-12-27 13:36:45 +00:00
|
|
|
uint32_t partialwrite;
|
2017-02-21 09:22:22 +00:00
|
|
|
|
|
|
|
switch (s->early_data_state) {
|
|
|
|
case SSL_EARLY_DATA_NONE:
|
2017-03-02 15:49:33 +00:00
|
|
|
if (s->server
|
|
|
|
|| !SSL_in_before(s)
|
2017-07-05 19:53:03 +00:00
|
|
|
|| ((s->session == NULL || s->session->ext.max_early_data == 0)
|
|
|
|
&& (s->psk_use_session_cb == NULL))) {
|
2017-03-02 15:49:33 +00:00
|
|
|
SSLerr(SSL_F_SSL_WRITE_EARLY_DATA,
|
|
|
|
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
2017-02-21 09:22:22 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
/* fall through */
|
|
|
|
|
|
|
|
case SSL_EARLY_DATA_CONNECT_RETRY:
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_CONNECTING;
|
|
|
|
ret = SSL_connect(s);
|
|
|
|
if (ret <= 0) {
|
|
|
|
/* NBIO or error */
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
/* fall through */
|
|
|
|
|
|
|
|
case SSL_EARLY_DATA_WRITE_RETRY:
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_WRITING;
|
2017-12-27 13:36:45 +00:00
|
|
|
/*
|
|
|
|
* We disable partial write for early data because we don't keep track
|
|
|
|
* of how many bytes we've written between the SSL_write_ex() call and
|
|
|
|
* the flush if the flush needs to be retried)
|
|
|
|
*/
|
|
|
|
partialwrite = s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE;
|
|
|
|
s->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE;
|
2017-11-27 15:20:06 +00:00
|
|
|
ret = SSL_write_ex(s, buf, num, &writtmp);
|
2017-12-27 13:36:45 +00:00
|
|
|
s->mode |= partialwrite;
|
2017-11-27 15:20:06 +00:00
|
|
|
if (!ret) {
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH;
|
|
|
|
/* fall through */
|
|
|
|
|
|
|
|
case SSL_EARLY_DATA_WRITE_FLUSH:
|
|
|
|
/* The buffering BIO is still in place so we need to flush it */
|
|
|
|
if (statem_flush(s) != 1)
|
|
|
|
return 0;
|
|
|
|
*written = num;
|
2017-02-21 09:22:22 +00:00
|
|
|
s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
|
2017-11-27 15:20:06 +00:00
|
|
|
return 1;
|
2017-02-21 09:22:22 +00:00
|
|
|
|
2017-03-30 14:24:07 +00:00
|
|
|
case SSL_EARLY_DATA_FINISHED_READING:
|
2017-04-03 13:22:26 +00:00
|
|
|
case SSL_EARLY_DATA_READ_RETRY:
|
|
|
|
early_data_state = s->early_data_state;
|
2017-03-02 15:49:33 +00:00
|
|
|
/* We are a server writing to an unauthenticated client */
|
|
|
|
s->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING;
|
|
|
|
ret = SSL_write_ex(s, buf, num, written);
|
2018-05-08 13:34:27 +00:00
|
|
|
/* The buffering BIO is still in place */
|
|
|
|
if (ret)
|
|
|
|
(void)BIO_flush(s->wbio);
|
2017-04-03 13:17:58 +00:00
|
|
|
s->early_data_state = early_data_state;
|
2017-03-02 15:49:33 +00:00
|
|
|
return ret;
|
|
|
|
|
2017-02-21 09:22:22 +00:00
|
|
|
default:
|
2017-03-02 15:49:33 +00:00
|
|
|
SSLerr(SSL_F_SSL_WRITE_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
2017-02-21 09:22:22 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_shutdown(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Note that this function behaves differently from what one might
|
|
|
|
* expect. Return values are 0 for no success (yet), 1 for success; but
|
|
|
|
* calling it once is usually not enough, even if blocking I/O is used
|
|
|
|
* (see ssl3_shutdown).
|
|
|
|
*/
|
|
|
|
|
2016-02-18 13:59:32 +00:00
|
|
|
if (s->handshake_func == NULL) {
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2016-02-02 10:05:43 +00:00
|
|
|
if (!SSL_in_init(s)) {
|
2016-06-28 22:18:50 +00:00
|
|
|
if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
|
2016-02-02 10:05:43 +00:00
|
|
|
struct ssl_async_args args;
|
2016-01-25 15:00:10 +00:00
|
|
|
|
2016-02-02 10:05:43 +00:00
|
|
|
args.s = s;
|
|
|
|
args.type = OTHERFUNC;
|
|
|
|
args.f.func_other = s->method->ssl_shutdown;
|
2016-01-25 15:00:10 +00:00
|
|
|
|
2016-02-02 10:05:43 +00:00
|
|
|
return ssl_start_async_job(s, &args, ssl_io_intern);
|
|
|
|
} else {
|
|
|
|
return s->method->ssl_shutdown(s);
|
|
|
|
}
|
2016-01-25 15:00:10 +00:00
|
|
|
} else {
|
2016-02-02 10:05:43 +00:00
|
|
|
SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_SHUTDOWN_WHILE_IN_INIT);
|
|
|
|
return -1;
|
2016-01-25 15:00:10 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2017-02-16 17:04:40 +00:00
|
|
|
int SSL_key_update(SSL *s, int updatetype)
|
2017-02-08 09:15:22 +00:00
|
|
|
{
|
2017-02-14 11:20:44 +00:00
|
|
|
/*
|
2017-02-16 17:09:28 +00:00
|
|
|
* TODO(TLS1.3): How will applications know whether TLSv1.3 has been
|
2017-02-14 11:20:44 +00:00
|
|
|
* negotiated, and that it is appropriate to call SSL_key_update() instead
|
|
|
|
* of SSL_renegotiate().
|
|
|
|
*/
|
2017-02-08 09:15:22 +00:00
|
|
|
if (!SSL_IS_TLS13(s)) {
|
|
|
|
SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_WRONG_SSL_VERSION);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
|
|
|
|
&& updatetype != SSL_KEY_UPDATE_REQUESTED) {
|
|
|
|
SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_INVALID_KEY_UPDATE_TYPE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!SSL_is_init_finished(s)) {
|
|
|
|
SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_STILL_IN_INIT);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
ossl_statem_set_in_init(s, 1);
|
|
|
|
s->key_update = updatetype;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
int SSL_get_key_update_type(const SSL *s)
|
2017-02-09 15:05:46 +00:00
|
|
|
{
|
|
|
|
return s->key_update;
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_renegotiate(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-02-08 09:15:22 +00:00
|
|
|
if (SSL_IS_TLS13(s)) {
|
|
|
|
SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_WRONG_SSL_VERSION);
|
2017-01-20 17:00:03 +00:00
|
|
|
return 0;
|
2017-02-08 09:15:22 +00:00
|
|
|
}
|
2017-01-11 16:29:38 +00:00
|
|
|
|
2017-05-10 20:46:14 +00:00
|
|
|
if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
|
|
|
|
SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_NO_RENEGOTIATION);
|
|
|
|
return 0;
|
|
|
|
}
|
2010-08-26 14:23:52 +00:00
|
|
|
|
2017-05-10 20:46:14 +00:00
|
|
|
s->renegotiate = 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
s->new_session = 1;
|
2010-08-26 14:23:52 +00:00
|
|
|
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->method->ssl_renegotiate(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2010-08-26 14:23:52 +00:00
|
|
|
int SSL_renegotiate_abbreviated(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-05-10 20:46:14 +00:00
|
|
|
if (SSL_IS_TLS13(s)) {
|
|
|
|
SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_WRONG_SSL_VERSION);
|
2017-01-20 17:00:03 +00:00
|
|
|
return 0;
|
2017-05-10 20:46:14 +00:00
|
|
|
}
|
2017-01-11 16:29:38 +00:00
|
|
|
|
2017-05-10 20:46:14 +00:00
|
|
|
if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
|
|
|
|
SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_NO_RENEGOTIATION);
|
|
|
|
return 0;
|
|
|
|
}
|
2011-09-05 13:36:23 +00:00
|
|
|
|
2017-05-10 20:46:14 +00:00
|
|
|
s->renegotiate = 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
s->new_session = 0;
|
2011-09-05 13:36:23 +00:00
|
|
|
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->method->ssl_renegotiate(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2010-08-26 14:23:52 +00:00
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
int SSL_renegotiate_pending(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* becomes true when negotiation is requested; false again once a
|
|
|
|
* handshake has finished
|
|
|
|
*/
|
|
|
|
return (s->renegotiate != 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
|
|
|
|
{
|
|
|
|
long l;
|
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case SSL_CTRL_GET_READ_AHEAD:
|
2017-10-17 14:04:09 +00:00
|
|
|
return RECORD_LAYER_get_read_ahead(&s->rlayer);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SET_READ_AHEAD:
|
2015-01-30 13:46:43 +00:00
|
|
|
l = RECORD_LAYER_get_read_ahead(&s->rlayer);
|
|
|
|
RECORD_LAYER_set_read_ahead(&s->rlayer, larg);
|
2017-10-17 14:04:09 +00:00
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
|
|
|
|
s->msg_callback_arg = parg;
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
case SSL_CTRL_MODE:
|
|
|
|
return (s->mode |= larg);
|
|
|
|
case SSL_CTRL_CLEAR_MODE:
|
|
|
|
return (s->mode &= ~larg);
|
|
|
|
case SSL_CTRL_GET_MAX_CERT_LIST:
|
2017-10-17 14:04:09 +00:00
|
|
|
return (long)s->max_cert_list;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SET_MAX_CERT_LIST:
|
2016-10-19 14:11:24 +00:00
|
|
|
if (larg < 0)
|
|
|
|
return 0;
|
|
|
|
l = (long)s->max_cert_list;
|
|
|
|
s->max_cert_list = (size_t)larg;
|
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
|
|
|
|
if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
|
|
|
|
return 0;
|
|
|
|
s->max_send_fragment = larg;
|
2015-09-22 10:12:50 +00:00
|
|
|
if (s->max_send_fragment < s->split_send_fragment)
|
|
|
|
s->split_send_fragment = s->max_send_fragment;
|
|
|
|
return 1;
|
|
|
|
case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
|
2016-09-07 10:34:39 +00:00
|
|
|
if ((size_t)larg > s->max_send_fragment || larg == 0)
|
2015-09-22 10:12:50 +00:00
|
|
|
return 0;
|
|
|
|
s->split_send_fragment = larg;
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
2015-09-22 10:12:50 +00:00
|
|
|
case SSL_CTRL_SET_MAX_PIPELINES:
|
|
|
|
if (larg < 1 || larg > SSL_MAX_PIPELINES)
|
|
|
|
return 0;
|
|
|
|
s->max_pipelines = larg;
|
2016-01-12 14:52:35 +00:00
|
|
|
if (larg > 1)
|
|
|
|
RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
|
2016-02-15 15:43:28 +00:00
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_GET_RI_SUPPORT:
|
|
|
|
if (s->s3)
|
|
|
|
return s->s3->send_connection_binding;
|
|
|
|
else
|
|
|
|
return 0;
|
|
|
|
case SSL_CTRL_CERT_FLAGS:
|
|
|
|
return (s->cert->cert_flags |= larg);
|
|
|
|
case SSL_CTRL_CLEAR_CERT_FLAGS:
|
|
|
|
return (s->cert->cert_flags &= ~larg);
|
|
|
|
|
|
|
|
case SSL_CTRL_GET_RAW_CIPHERLIST:
|
|
|
|
if (parg) {
|
2015-05-12 16:17:37 +00:00
|
|
|
if (s->s3->tmp.ciphers_raw == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
return 0;
|
2015-05-12 16:17:37 +00:00
|
|
|
*(unsigned char **)parg = s->s3->tmp.ciphers_raw;
|
|
|
|
return (int)s->s3->tmp.ciphers_rawlen;
|
2015-09-18 13:00:37 +00:00
|
|
|
} else {
|
|
|
|
return TLS_CIPHER_LEN;
|
|
|
|
}
|
2015-01-23 02:52:20 +00:00
|
|
|
case SSL_CTRL_GET_EXTMS_SUPPORT:
|
2015-10-22 12:57:18 +00:00
|
|
|
if (!s->session || SSL_in_init(s) || ossl_statem_get_in_handshake(s))
|
2016-08-05 17:03:17 +00:00
|
|
|
return -1;
|
2016-05-03 20:40:33 +00:00
|
|
|
if (s->session->flags & SSL_SESS_FLAG_EXTMS)
|
2015-01-23 02:52:20 +00:00
|
|
|
return 1;
|
|
|
|
else
|
|
|
|
return 0;
|
2015-12-06 16:56:41 +00:00
|
|
|
case SSL_CTRL_SET_MIN_PROTO_VERSION:
|
2017-05-09 23:39:50 +00:00
|
|
|
return ssl_check_allowed_versions(larg, s->max_proto_version)
|
|
|
|
&& ssl_set_version_bound(s->ctx->method->version, (int)larg,
|
|
|
|
&s->min_proto_version);
|
2017-09-14 07:28:39 +00:00
|
|
|
case SSL_CTRL_GET_MIN_PROTO_VERSION:
|
|
|
|
return s->min_proto_version;
|
2015-12-06 16:56:41 +00:00
|
|
|
case SSL_CTRL_SET_MAX_PROTO_VERSION:
|
2017-05-09 23:39:50 +00:00
|
|
|
return ssl_check_allowed_versions(s->min_proto_version, larg)
|
|
|
|
&& ssl_set_version_bound(s->ctx->method->version, (int)larg,
|
|
|
|
&s->max_proto_version);
|
2017-09-14 07:28:39 +00:00
|
|
|
case SSL_CTRL_GET_MAX_PROTO_VERSION:
|
|
|
|
return s->max_proto_version;
|
2015-01-22 03:40:55 +00:00
|
|
|
default:
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->method->ssl_ctrl(s, cmd, larg, parg);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
|
|
|
|
{
|
|
|
|
switch (cmd) {
|
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK:
|
|
|
|
s->msg_callback = (void (*)
|
|
|
|
(int write_p, int version, int content_type,
|
|
|
|
const void *buf, size_t len, SSL *ssl,
|
|
|
|
void *arg))(fp);
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
default:
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->method->ssl_callback_ctrl(s, cmd, fp);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
2000-02-20 23:43:02 +00:00
|
|
|
|
2008-05-26 11:24:29 +00:00
|
|
|
LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return ctx->sessions;
|
|
|
|
}
|
|
|
|
|
|
|
|
long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
|
|
|
|
{
|
|
|
|
long l;
|
|
|
|
/* For some cases with ctx == NULL perform syntax checks */
|
|
|
|
if (ctx == NULL) {
|
|
|
|
switch (cmd) {
|
2013-08-17 16:40:08 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2016-11-09 14:51:06 +00:00
|
|
|
case SSL_CTRL_SET_GROUPS_LIST:
|
|
|
|
return tls1_set_groups_list(NULL, NULL, parg);
|
2015-01-22 03:40:55 +00:00
|
|
|
#endif
|
|
|
|
case SSL_CTRL_SET_SIGALGS_LIST:
|
|
|
|
case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
|
|
|
|
return tls1_set_sigalgs_list(NULL, parg, 0);
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case SSL_CTRL_GET_READ_AHEAD:
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->read_ahead;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SET_READ_AHEAD:
|
|
|
|
l = ctx->read_ahead;
|
|
|
|
ctx->read_ahead = larg;
|
2017-10-17 14:04:09 +00:00
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
|
|
|
|
ctx->msg_callback_arg = parg;
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
case SSL_CTRL_GET_MAX_CERT_LIST:
|
2017-10-17 14:04:09 +00:00
|
|
|
return (long)ctx->max_cert_list;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SET_MAX_CERT_LIST:
|
2016-10-19 14:11:24 +00:00
|
|
|
if (larg < 0)
|
|
|
|
return 0;
|
|
|
|
l = (long)ctx->max_cert_list;
|
|
|
|
ctx->max_cert_list = (size_t)larg;
|
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SET_SESS_CACHE_SIZE:
|
2016-10-19 14:11:24 +00:00
|
|
|
if (larg < 0)
|
|
|
|
return 0;
|
|
|
|
l = (long)ctx->session_cache_size;
|
|
|
|
ctx->session_cache_size = (size_t)larg;
|
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_GET_SESS_CACHE_SIZE:
|
2017-10-17 14:04:09 +00:00
|
|
|
return (long)ctx->session_cache_size;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SET_SESS_CACHE_MODE:
|
|
|
|
l = ctx->session_cache_mode;
|
|
|
|
ctx->session_cache_mode = larg;
|
2017-10-17 14:04:09 +00:00
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_GET_SESS_CACHE_MODE:
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->session_cache_mode;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
case SSL_CTRL_SESS_NUMBER:
|
2017-10-17 14:04:09 +00:00
|
|
|
return lh_SSL_SESSION_num_items(ctx->sessions);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_CONNECT:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_connect);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_CONNECT_GOOD:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_connect_good);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_connect_renegotiate);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_ACCEPT:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_accept);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_ACCEPT_GOOD:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_accept_good);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_accept_renegotiate);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_HIT:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_hit);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_CB_HIT:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_cb_hit);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_MISSES:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_miss);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_TIMEOUTS:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_timeout);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_SESS_CACHE_FULL:
|
2018-07-29 12:12:53 +00:00
|
|
|
return tsan_load(&ctx->stats.sess_cache_full);
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_MODE:
|
|
|
|
return (ctx->mode |= larg);
|
|
|
|
case SSL_CTRL_CLEAR_MODE:
|
|
|
|
return (ctx->mode &= ~larg);
|
|
|
|
case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
|
|
|
|
if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
|
|
|
|
return 0;
|
|
|
|
ctx->max_send_fragment = larg;
|
2015-09-22 10:12:50 +00:00
|
|
|
if (ctx->max_send_fragment < ctx->split_send_fragment)
|
2016-04-26 17:01:24 +00:00
|
|
|
ctx->split_send_fragment = ctx->max_send_fragment;
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
2015-09-22 10:12:50 +00:00
|
|
|
case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
|
2016-09-07 10:34:39 +00:00
|
|
|
if ((size_t)larg > ctx->max_send_fragment || larg == 0)
|
2015-09-22 10:12:50 +00:00
|
|
|
return 0;
|
|
|
|
ctx->split_send_fragment = larg;
|
|
|
|
return 1;
|
|
|
|
case SSL_CTRL_SET_MAX_PIPELINES:
|
|
|
|
if (larg < 1 || larg > SSL_MAX_PIPELINES)
|
|
|
|
return 0;
|
|
|
|
ctx->max_pipelines = larg;
|
2016-02-15 15:43:28 +00:00
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
case SSL_CTRL_CERT_FLAGS:
|
|
|
|
return (ctx->cert->cert_flags |= larg);
|
|
|
|
case SSL_CTRL_CLEAR_CERT_FLAGS:
|
|
|
|
return (ctx->cert->cert_flags &= ~larg);
|
2015-12-06 16:56:41 +00:00
|
|
|
case SSL_CTRL_SET_MIN_PROTO_VERSION:
|
2017-05-09 23:39:50 +00:00
|
|
|
return ssl_check_allowed_versions(larg, ctx->max_proto_version)
|
|
|
|
&& ssl_set_version_bound(ctx->method->version, (int)larg,
|
|
|
|
&ctx->min_proto_version);
|
2017-09-14 07:28:39 +00:00
|
|
|
case SSL_CTRL_GET_MIN_PROTO_VERSION:
|
|
|
|
return ctx->min_proto_version;
|
2015-12-06 16:56:41 +00:00
|
|
|
case SSL_CTRL_SET_MAX_PROTO_VERSION:
|
2017-05-09 23:39:50 +00:00
|
|
|
return ssl_check_allowed_versions(ctx->min_proto_version, larg)
|
|
|
|
&& ssl_set_version_bound(ctx->method->version, (int)larg,
|
|
|
|
&ctx->max_proto_version);
|
2017-09-14 07:28:39 +00:00
|
|
|
case SSL_CTRL_GET_MAX_PROTO_VERSION:
|
|
|
|
return ctx->max_proto_version;
|
2015-01-22 03:40:55 +00:00
|
|
|
default:
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
|
|
|
|
{
|
|
|
|
switch (cmd) {
|
|
|
|
case SSL_CTRL_SET_MSG_CALLBACK:
|
|
|
|
ctx->msg_callback = (void (*)
|
|
|
|
(int write_p, int version, int content_type,
|
|
|
|
const void *buf, size_t len, SSL *ssl,
|
|
|
|
void *arg))(fp);
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
default:
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
2000-02-20 23:43:02 +00:00
|
|
|
|
2000-06-01 02:36:58 +00:00
|
|
|
int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2015-11-05 16:14:17 +00:00
|
|
|
if (a->id > b->id)
|
|
|
|
return 1;
|
|
|
|
if (a->id < b->id)
|
|
|
|
return -1;
|
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
|
|
|
|
const SSL_CIPHER *const *bp)
|
|
|
|
{
|
2015-11-05 16:14:17 +00:00
|
|
|
if ((*ap)->id > (*bp)->id)
|
|
|
|
return 1;
|
|
|
|
if ((*ap)->id < (*bp)->id)
|
|
|
|
return -1;
|
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** return a STACK of the ciphers available for the SSL and in order of
|
1998-12-21 10:52:47 +00:00
|
|
|
* preference */
|
2005-03-30 10:26:02 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s != NULL) {
|
|
|
|
if (s->cipher_list != NULL) {
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->cipher_list;
|
2015-01-22 03:40:55 +00:00
|
|
|
} else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->ctx->cipher_list;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2015-05-26 01:16:53 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s)
|
|
|
|
{
|
2019-06-14 13:06:55 +00:00
|
|
|
if ((s == NULL) || !s->server)
|
2015-05-26 01:16:53 +00:00
|
|
|
return NULL;
|
2019-06-14 13:06:55 +00:00
|
|
|
return s->peer_ciphers;
|
2015-05-26 01:16:53 +00:00
|
|
|
}
|
|
|
|
|
2014-01-14 14:55:21 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
STACK_OF(SSL_CIPHER) *sk = NULL, *ciphers;
|
|
|
|
int i;
|
2018-02-09 18:03:08 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
ciphers = SSL_get_ciphers(s);
|
|
|
|
if (!ciphers)
|
|
|
|
return NULL;
|
2018-02-09 18:03:08 +00:00
|
|
|
if (!ssl_set_client_disabled(s))
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
|
|
|
|
const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
|
2017-04-12 16:02:42 +00:00
|
|
|
if (!ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) {
|
2015-01-22 03:40:55 +00:00
|
|
|
if (!sk)
|
|
|
|
sk = sk_SSL_CIPHER_new_null();
|
|
|
|
if (!sk)
|
|
|
|
return NULL;
|
|
|
|
if (!sk_SSL_CIPHER_push(sk, c)) {
|
|
|
|
sk_SSL_CIPHER_free(sk);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return sk;
|
|
|
|
}
|
2014-01-14 14:55:21 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** return a STACK of the ciphers available for the SSL and in order of
|
1998-12-21 10:52:47 +00:00
|
|
|
* algorithm id */
|
1999-04-12 17:23:57 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s != NULL) {
|
|
|
|
if (s->cipher_list_by_id != NULL) {
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->cipher_list_by_id;
|
2015-01-22 03:40:55 +00:00
|
|
|
} else if ((s->ctx != NULL) && (s->ctx->cipher_list_by_id != NULL)) {
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->ctx->cipher_list_by_id;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** The old interface to get the same thing as SSL_get_ciphers() */
|
2015-01-22 03:40:55 +00:00
|
|
|
const char *SSL_get_cipher_list(const SSL *s, int n)
|
|
|
|
{
|
2015-12-23 00:47:28 +00:00
|
|
|
const SSL_CIPHER *c;
|
2015-01-22 03:40:55 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
|
|
|
|
|
|
|
if (s == NULL)
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
sk = SSL_get_ciphers(s);
|
|
|
|
if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
c = sk_SSL_CIPHER_value(sk, n);
|
|
|
|
if (c == NULL)
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
|
|
|
return c->name;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-04-10 04:18:50 +00:00
|
|
|
/** return a STACK of the ciphers available for the SSL_CTX and in order of
|
|
|
|
* preference */
|
|
|
|
STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
if (ctx != NULL)
|
|
|
|
return ctx->cipher_list;
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2018-11-26 21:58:52 +00:00
|
|
|
/*
|
|
|
|
* Distinguish between ciphers controlled by set_ciphersuite() and
|
|
|
|
* set_cipher_list() when counting.
|
|
|
|
*/
|
|
|
|
static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk)
|
|
|
|
{
|
|
|
|
int i, num = 0;
|
|
|
|
const SSL_CIPHER *c;
|
|
|
|
|
|
|
|
if (sk == NULL)
|
|
|
|
return 0;
|
|
|
|
for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) {
|
|
|
|
c = sk_SSL_CIPHER_value(sk, i);
|
|
|
|
if (c->min_tls >= TLS1_3_VERSION)
|
|
|
|
continue;
|
|
|
|
num++;
|
|
|
|
}
|
|
|
|
return num;
|
|
|
|
}
|
|
|
|
|
2000-01-09 14:21:40 +00:00
|
|
|
/** specify the ciphers to be used by default by the SSL_CTX */
|
2000-01-22 03:17:06 +00:00
|
|
|
int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
|
|
|
|
2018-02-16 11:26:02 +00:00
|
|
|
sk = ssl_create_cipher_list(ctx->method, ctx->tls13_ciphersuites,
|
|
|
|
&ctx->cipher_list, &ctx->cipher_list_by_id, str,
|
|
|
|
ctx->cert);
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* ssl_create_cipher_list may return an empty stack if it was unable to
|
|
|
|
* find a cipher matching the given rule string (for example if the rule
|
|
|
|
* string specifies a cipher which has been disabled). This is not an
|
|
|
|
* error as far as ssl_create_cipher_list is concerned, and hence
|
|
|
|
* ctx->cipher_list and ctx->cipher_list_by_id has been updated.
|
|
|
|
*/
|
|
|
|
if (sk == NULL)
|
|
|
|
return 0;
|
2018-11-26 21:58:52 +00:00
|
|
|
else if (cipher_list_tls12_num(sk) == 0) {
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
/** specify the ciphers to be used by the SSL */
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_set_cipher_list(SSL *s, const char *str)
|
|
|
|
{
|
|
|
|
STACK_OF(SSL_CIPHER) *sk;
|
|
|
|
|
2018-02-16 11:26:02 +00:00
|
|
|
sk = ssl_create_cipher_list(s->ctx->method, s->tls13_ciphersuites,
|
|
|
|
&s->cipher_list, &s->cipher_list_by_id, str,
|
|
|
|
s->cert);
|
2015-01-22 03:40:55 +00:00
|
|
|
/* see comment in SSL_CTX_set_cipher_list */
|
|
|
|
if (sk == NULL)
|
|
|
|
return 0;
|
2018-11-26 21:58:52 +00:00
|
|
|
else if (cipher_list_tls12_num(sk) == 0) {
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2018-04-27 10:20:52 +00:00
|
|
|
char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
char *p;
|
2018-04-27 10:20:52 +00:00
|
|
|
STACK_OF(SSL_CIPHER) *clntsk, *srvrsk;
|
2015-12-23 00:47:28 +00:00
|
|
|
const SSL_CIPHER *c;
|
2015-01-22 03:40:55 +00:00
|
|
|
int i;
|
|
|
|
|
2018-04-27 10:20:52 +00:00
|
|
|
if (!s->server
|
2019-06-14 13:06:55 +00:00
|
|
|
|| s->peer_ciphers == NULL
|
2018-04-27 10:20:52 +00:00
|
|
|
|| size < 2)
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
p = buf;
|
2019-06-14 13:06:55 +00:00
|
|
|
clntsk = s->peer_ciphers;
|
2018-04-27 10:20:52 +00:00
|
|
|
srvrsk = SSL_get_ciphers(s);
|
|
|
|
if (clntsk == NULL || srvrsk == NULL)
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2018-04-27 10:20:52 +00:00
|
|
|
if (sk_SSL_CIPHER_num(clntsk) == 0 || sk_SSL_CIPHER_num(srvrsk) == 0)
|
2015-01-22 03:40:55 +00:00
|
|
|
return NULL;
|
|
|
|
|
2018-04-27 10:20:52 +00:00
|
|
|
for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) {
|
2015-01-22 03:40:55 +00:00
|
|
|
int n;
|
|
|
|
|
2018-04-27 10:20:52 +00:00
|
|
|
c = sk_SSL_CIPHER_value(clntsk, i);
|
|
|
|
if (sk_SSL_CIPHER_find(srvrsk, c) < 0)
|
|
|
|
continue;
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
n = strlen(c->name);
|
2018-04-27 10:20:52 +00:00
|
|
|
if (n + 1 > size) {
|
2015-01-22 03:40:55 +00:00
|
|
|
if (p != buf)
|
|
|
|
--p;
|
|
|
|
*p = '\0';
|
|
|
|
return buf;
|
|
|
|
}
|
2017-09-11 23:13:00 +00:00
|
|
|
strcpy(p, c->name);
|
2015-01-22 03:40:55 +00:00
|
|
|
p += n;
|
|
|
|
*(p++) = ':';
|
2018-04-27 10:20:52 +00:00
|
|
|
size -= n + 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
p[-1] = '\0';
|
2017-10-17 14:04:09 +00:00
|
|
|
return buf;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2007-02-17 06:45:38 +00:00
|
|
|
/** return a servername extension value if provided in Client Hello, or NULL.
|
2006-01-03 03:27:19 +00:00
|
|
|
* So far, only host_name types are defined (RFC 3546).
|
2006-01-02 23:14:37 +00:00
|
|
|
*/
|
|
|
|
|
2006-01-03 03:27:19 +00:00
|
|
|
const char *SSL_get_servername(const SSL *s, const int type)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (type != TLSEXT_NAMETYPE_host_name)
|
|
|
|
return NULL;
|
2006-01-09 19:49:05 +00:00
|
|
|
|
Normalize SNI hostname handling for SSL and SSL_SESSION
In particular, adhere to the rule that we must not modify any
property of an SSL_SESSION object once it is (or might be) in
a session cache. Such modifications are thread-unsafe and have
been observed to cause crashes at runtime.
To effect this change, standardize on the property that
SSL_SESSION->ext.hostname is set only when that SNI value
has been negotiated by both parties for use with that session.
For session resumption this is trivially the case, so only new
handshakes are affected.
On the client, the new semantics are that the SSL->ext.hostname is
for storing the value configured by the caller, and this value is
used when constructing the ClientHello. On the server, SSL->ext.hostname
is used to hold the value received from the client. Only if the
SNI negotiation is successful will the hostname be stored into the
session object; the server can do this after it sends the ServerHello,
and the client after it has received and processed the ServerHello.
This obviates the need to remove the hostname from the session object
in case of failed negotiation (a change that was introduced in commit
9fb6cb810b769abbd60f11ef6e936a4e4456b19d in order to allow TLS 1.3
early data when SNI was present in the ClientHello but not the session
being resumed), which was modifying cached sessions in certain cases.
(In TLS 1.3 we always produce a new SSL_SESSION object for new
connections, even in the case of resumption, so no TLS 1.3 handshakes
were affected.)
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6378)
2018-05-30 14:49:29 +00:00
|
|
|
/*
|
2018-09-04 17:30:00 +00:00
|
|
|
* SNI is not negotiated in pre-TLS-1.3 resumption flows, so fake up an
|
|
|
|
* SNI value to return if we are resuming/resumed. N.B. that we still
|
|
|
|
* call the relevant callbacks for such resumption flows, and callbacks
|
|
|
|
* might error out if there is not a SNI value available.
|
Normalize SNI hostname handling for SSL and SSL_SESSION
In particular, adhere to the rule that we must not modify any
property of an SSL_SESSION object once it is (or might be) in
a session cache. Such modifications are thread-unsafe and have
been observed to cause crashes at runtime.
To effect this change, standardize on the property that
SSL_SESSION->ext.hostname is set only when that SNI value
has been negotiated by both parties for use with that session.
For session resumption this is trivially the case, so only new
handshakes are affected.
On the client, the new semantics are that the SSL->ext.hostname is
for storing the value configured by the caller, and this value is
used when constructing the ClientHello. On the server, SSL->ext.hostname
is used to hold the value received from the client. Only if the
SNI negotiation is successful will the hostname be stored into the
session object; the server can do this after it sends the ServerHello,
and the client after it has received and processed the ServerHello.
This obviates the need to remove the hostname from the session object
in case of failed negotiation (a change that was introduced in commit
9fb6cb810b769abbd60f11ef6e936a4e4456b19d in order to allow TLS 1.3
early data when SNI was present in the ClientHello but not the session
being resumed), which was modifying cached sessions in certain cases.
(In TLS 1.3 we always produce a new SSL_SESSION object for new
connections, even in the case of resumption, so no TLS 1.3 handshakes
were affected.)
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6378)
2018-05-30 14:49:29 +00:00
|
|
|
*/
|
2018-09-04 17:30:00 +00:00
|
|
|
if (s->hit)
|
|
|
|
return s->session->ext.hostname;
|
|
|
|
return s->ext.hostname;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2006-01-02 23:14:37 +00:00
|
|
|
|
2006-01-03 03:27:19 +00:00
|
|
|
int SSL_get_servername_type(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s->session
|
2016-12-08 19:18:40 +00:00
|
|
|
&& (!s->ext.hostname ? s->session->
|
|
|
|
ext.hostname : s->ext.hostname))
|
2015-01-22 03:40:55 +00:00
|
|
|
return TLSEXT_NAMETYPE_host_name;
|
|
|
|
return -1;
|
|
|
|
}
|
2010-07-28 10:06:55 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* SSL_select_next_proto implements the standard protocol selection. It is
|
2010-07-28 10:06:55 +00:00
|
|
|
* expected that this function is called from the callback set by
|
2015-01-22 03:40:55 +00:00
|
|
|
* SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a
|
|
|
|
* vector of 8-bit, length prefixed byte strings. The length byte itself is
|
|
|
|
* not included in the length. A byte string of length 0 is invalid. No byte
|
|
|
|
* string may be truncated. The current, but experimental algorithm for
|
|
|
|
* selecting the protocol is: 1) If the server doesn't support NPN then this
|
|
|
|
* is indicated to the callback. In this case, the client application has to
|
|
|
|
* abort the connection or have a default application level protocol. 2) If
|
|
|
|
* the server supports NPN, but advertises an empty list then the client
|
2016-06-19 17:39:01 +00:00
|
|
|
* selects the first protocol in its list, but indicates via the API that this
|
2015-01-22 03:40:55 +00:00
|
|
|
* fallback case was enacted. 3) Otherwise, the client finds the first
|
|
|
|
* protocol in the server's list that it supports and selects this protocol.
|
|
|
|
* This is because it's assumed that the server has better information about
|
|
|
|
* which protocol a client should use. 4) If the client doesn't support any
|
|
|
|
* of the server's advertised protocols, then this is treated the same as
|
|
|
|
* case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was
|
|
|
|
* found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
|
2010-07-28 10:06:55 +00:00
|
|
|
*/
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,
|
|
|
|
const unsigned char *server,
|
|
|
|
unsigned int server_len,
|
2016-08-05 17:03:17 +00:00
|
|
|
const unsigned char *client, unsigned int client_len)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
unsigned int i, j;
|
|
|
|
const unsigned char *result;
|
|
|
|
int status = OPENSSL_NPN_UNSUPPORTED;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For each protocol in server preference order, see if we support it.
|
|
|
|
*/
|
|
|
|
for (i = 0; i < server_len;) {
|
|
|
|
for (j = 0; j < client_len;) {
|
|
|
|
if (server[i] == client[j] &&
|
|
|
|
memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) {
|
|
|
|
/* We found a match */
|
|
|
|
result = &server[i];
|
|
|
|
status = OPENSSL_NPN_NEGOTIATED;
|
|
|
|
goto found;
|
|
|
|
}
|
|
|
|
j += client[j];
|
|
|
|
j++;
|
|
|
|
}
|
|
|
|
i += server[i];
|
|
|
|
i++;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* There's no overlap between our protocols and the server's list. */
|
|
|
|
result = client;
|
|
|
|
status = OPENSSL_NPN_NO_OVERLAP;
|
|
|
|
|
|
|
|
found:
|
|
|
|
*out = (unsigned char *)result + 1;
|
|
|
|
*outlen = result[0];
|
|
|
|
return status;
|
|
|
|
}
|
2010-07-28 10:06:55 +00:00
|
|
|
|
2015-05-15 09:49:56 +00:00
|
|
|
#ifndef OPENSSL_NO_NEXTPROTONEG
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* SSL_get0_next_proto_negotiated sets *data and *len to point to the
|
|
|
|
* client's requested protocol for this connection and returns 0. If the
|
|
|
|
* client didn't request any protocol, then *data is set to NULL. Note that
|
|
|
|
* the client can request any protocol it chooses. The value returned from
|
|
|
|
* this function need not be a member of the list of supported protocols
|
2010-07-28 10:06:55 +00:00
|
|
|
* provided by the callback.
|
|
|
|
*/
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
|
|
|
|
unsigned *len)
|
|
|
|
{
|
2016-12-08 19:18:40 +00:00
|
|
|
*data = s->ext.npn;
|
2015-01-22 03:40:55 +00:00
|
|
|
if (!*data) {
|
|
|
|
*len = 0;
|
|
|
|
} else {
|
2016-12-08 19:18:40 +00:00
|
|
|
*len = (unsigned int)s->ext.npn_len;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2016-12-08 19:18:40 +00:00
|
|
|
* SSL_CTX_set_npn_advertised_cb sets a callback that is called when
|
2015-01-22 03:40:55 +00:00
|
|
|
* a TLS server needs a list of supported protocols for Next Protocol
|
|
|
|
* Negotiation. The returned list must be in wire format. The list is
|
|
|
|
* returned by setting |out| to point to it and |outlen| to its length. This
|
|
|
|
* memory will not be modified, but one should assume that the SSL* keeps a
|
|
|
|
* reference to it. The callback should return SSL_TLSEXT_ERR_OK if it
|
|
|
|
* wishes to advertise. Otherwise, no such extension will be included in the
|
|
|
|
* ServerHello.
|
|
|
|
*/
|
2016-12-08 19:18:40 +00:00
|
|
|
void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx,
|
2016-12-11 20:01:28 +00:00
|
|
|
SSL_CTX_npn_advertised_cb_func cb,
|
2016-12-08 19:18:40 +00:00
|
|
|
void *arg)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-12-08 19:18:40 +00:00
|
|
|
ctx->ext.npn_advertised_cb = cb;
|
|
|
|
ctx->ext.npn_advertised_cb_arg = arg;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
|
2010-07-28 10:06:55 +00:00
|
|
|
* client needs to select a protocol from the server's provided list. |out|
|
|
|
|
* must be set to point to the selected protocol (which may be within |in|).
|
2015-01-22 03:40:55 +00:00
|
|
|
* The length of the protocol name must be written into |outlen|. The
|
|
|
|
* server's advertised protocols are provided in |in| and |inlen|. The
|
|
|
|
* callback can assume that |in| is syntactically valid. The client must
|
|
|
|
* select a protocol. It is fatal to the connection if this callback returns
|
|
|
|
* a value other than SSL_TLSEXT_ERR_OK.
|
2010-07-28 10:06:55 +00:00
|
|
|
*/
|
2016-12-08 19:18:40 +00:00
|
|
|
void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
|
2016-12-11 20:01:28 +00:00
|
|
|
SSL_CTX_npn_select_cb_func cb,
|
2016-12-08 19:18:40 +00:00
|
|
|
void *arg)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-12-08 19:18:40 +00:00
|
|
|
ctx->ext.npn_select_cb = cb;
|
|
|
|
ctx->ext.npn_select_cb_arg = arg;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2015-05-15 09:49:56 +00:00
|
|
|
#endif
|
2013-05-13 01:55:27 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|.
|
2013-04-15 22:07:47 +00:00
|
|
|
* |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
|
2015-01-22 03:40:55 +00:00
|
|
|
* length-prefixed strings). Returns 0 on success.
|
|
|
|
*/
|
|
|
|
int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
|
2016-03-05 13:47:55 +00:00
|
|
|
unsigned int protos_len)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(ctx->ext.alpn);
|
|
|
|
ctx->ext.alpn = OPENSSL_memdup(protos, protos_len);
|
|
|
|
if (ctx->ext.alpn == NULL) {
|
2016-02-25 05:45:08 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
2016-02-25 05:45:08 +00:00
|
|
|
}
|
2016-12-08 19:18:40 +00:00
|
|
|
ctx->ext.alpn_len = protos_len;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* SSL_set_alpn_protos sets the ALPN protocol list on |ssl| to |protos|.
|
2013-04-15 22:07:47 +00:00
|
|
|
* |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
|
2015-01-22 03:40:55 +00:00
|
|
|
* length-prefixed strings). Returns 0 on success.
|
|
|
|
*/
|
|
|
|
int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
|
2016-03-05 13:47:55 +00:00
|
|
|
unsigned int protos_len)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(ssl->ext.alpn);
|
|
|
|
ssl->ext.alpn = OPENSSL_memdup(protos, protos_len);
|
|
|
|
if (ssl->ext.alpn == NULL) {
|
2016-02-25 05:45:08 +00:00
|
|
|
SSLerr(SSL_F_SSL_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
2016-02-25 05:45:08 +00:00
|
|
|
}
|
2016-12-08 19:18:40 +00:00
|
|
|
ssl->ext.alpn_len = protos_len;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* SSL_CTX_set_alpn_select_cb sets a callback function on |ctx| that is
|
|
|
|
* called during ClientHello processing in order to select an ALPN protocol
|
|
|
|
* from the client's list of offered protocols.
|
|
|
|
*/
|
|
|
|
void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
|
2016-12-11 20:01:28 +00:00
|
|
|
SSL_CTX_alpn_select_cb_func cb,
|
|
|
|
void *arg)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-12-08 19:18:40 +00:00
|
|
|
ctx->ext.alpn_select_cb = cb;
|
|
|
|
ctx->ext.alpn_select_cb_arg = arg;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2017-03-28 21:57:28 +00:00
|
|
|
* SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from |ssl|.
|
|
|
|
* On return it sets |*data| to point to |*len| bytes of protocol name
|
2015-01-22 03:40:55 +00:00
|
|
|
* (not including the leading length-prefix byte). If the server didn't
|
|
|
|
* respond with a negotiated protocol then |*len| will be zero.
|
|
|
|
*/
|
2013-04-15 22:07:47 +00:00
|
|
|
void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
|
2016-03-05 13:47:55 +00:00
|
|
|
unsigned int *len)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
*data = NULL;
|
|
|
|
if (ssl->s3)
|
|
|
|
*data = ssl->s3->alpn_selected;
|
|
|
|
if (*data == NULL)
|
|
|
|
*len = 0;
|
|
|
|
else
|
2016-10-19 14:11:24 +00:00
|
|
|
*len = (unsigned int)ssl->s3->alpn_selected_len;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2012-02-22 15:06:56 +00:00
|
|
|
int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
|
2015-01-22 03:40:55 +00:00
|
|
|
const char *label, size_t llen,
|
2017-06-21 12:55:02 +00:00
|
|
|
const unsigned char *context, size_t contextlen,
|
2015-01-22 03:40:55 +00:00
|
|
|
int use_context)
|
|
|
|
{
|
2016-07-08 19:46:07 +00:00
|
|
|
if (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER)
|
2015-01-22 03:40:55 +00:00
|
|
|
return -1;
|
2011-11-15 23:50:52 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
|
2017-06-21 12:55:02 +00:00
|
|
|
llen, context,
|
|
|
|
contextlen, use_context);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2011-11-15 23:50:52 +00:00
|
|
|
|
2018-02-04 03:20:37 +00:00
|
|
|
int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
|
|
|
|
const char *label, size_t llen,
|
|
|
|
const unsigned char *context,
|
|
|
|
size_t contextlen)
|
|
|
|
{
|
|
|
|
if (s->version != TLS1_3_VERSION)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return tls13_export_keying_material_early(s, out, olen, label, llen,
|
|
|
|
context, contextlen);
|
|
|
|
}
|
|
|
|
|
2008-05-26 11:24:29 +00:00
|
|
|
static unsigned long ssl_session_hash(const SSL_SESSION *a)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-02-09 20:13:13 +00:00
|
|
|
const unsigned char *session_id = a->session_id;
|
2015-01-22 03:40:55 +00:00
|
|
|
unsigned long l;
|
2017-02-09 20:13:13 +00:00
|
|
|
unsigned char tmp_storage[4];
|
|
|
|
|
|
|
|
if (a->session_id_length < sizeof(tmp_storage)) {
|
|
|
|
memset(tmp_storage, 0, sizeof(tmp_storage));
|
|
|
|
memcpy(tmp_storage, a->session_id, a->session_id_length);
|
|
|
|
session_id = tmp_storage;
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
l = (unsigned long)
|
2017-02-09 20:13:13 +00:00
|
|
|
((unsigned long)session_id[0]) |
|
|
|
|
((unsigned long)session_id[1] << 8L) |
|
|
|
|
((unsigned long)session_id[2] << 16L) |
|
|
|
|
((unsigned long)session_id[3] << 24L);
|
2017-10-17 14:04:09 +00:00
|
|
|
return l;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* NB: If this function (or indeed the hash function which uses a sort of
|
2001-02-21 18:06:26 +00:00
|
|
|
* coarser function than this one) is changed, ensure
|
2015-01-22 03:40:55 +00:00
|
|
|
* SSL_CTX_has_matching_session_id() is checked accordingly. It relies on
|
|
|
|
* being able to construct an SSL_SESSION that will collide with any existing
|
|
|
|
* session with a matching session ID.
|
|
|
|
*/
|
|
|
|
static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
|
|
|
|
{
|
|
|
|
if (a->ssl_version != b->ssl_version)
|
2017-10-09 11:05:58 +00:00
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
if (a->session_id_length != b->session_id_length)
|
2017-10-09 11:05:58 +00:00
|
|
|
return 1;
|
2017-10-17 14:04:09 +00:00
|
|
|
return memcmp(a->session_id, b->session_id, a->session_id_length);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* These wrapper functions should remain rather than redeclaring
|
2000-12-08 20:02:01 +00:00
|
|
|
* SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
|
2015-01-22 03:40:55 +00:00
|
|
|
* variable. The reason is that the functions aren't static, they're exposed
|
|
|
|
* via ssl.h.
|
|
|
|
*/
|
2000-12-04 03:02:44 +00:00
|
|
|
|
2005-08-14 21:48:33 +00:00
|
|
|
SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
SSL_CTX *ret = NULL;
|
|
|
|
|
|
|
|
if (meth == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2016-02-10 13:59:15 +00:00
|
|
|
if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))
|
|
|
|
return NULL;
|
2016-02-08 16:44:26 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
|
|
|
|
goto err;
|
|
|
|
}
|
2015-08-25 17:25:58 +00:00
|
|
|
ret = OPENSSL_zalloc(sizeof(*ret));
|
2015-01-22 03:40:55 +00:00
|
|
|
if (ret == NULL)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
ret->method = meth;
|
2015-12-06 16:56:41 +00:00
|
|
|
ret->min_proto_version = 0;
|
|
|
|
ret->max_proto_version = 0;
|
2018-05-15 17:01:41 +00:00
|
|
|
ret->mode = SSL_MODE_AUTO_RETRY;
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
|
|
|
|
ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
|
2015-09-03 13:15:26 +00:00
|
|
|
/* We take the system default. */
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->session_timeout = meth->get_timeout();
|
|
|
|
ret->references = 1;
|
2016-02-29 17:26:07 +00:00
|
|
|
ret->lock = CRYPTO_THREAD_lock_new();
|
|
|
|
if (ret->lock == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
|
|
|
|
OPENSSL_free(ret);
|
|
|
|
return NULL;
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
|
|
|
|
ret->verify_mode = SSL_VERIFY_NONE;
|
|
|
|
if ((ret->cert = ssl_cert_new()) == NULL)
|
|
|
|
goto err;
|
|
|
|
|
2015-12-24 15:51:23 +00:00
|
|
|
ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
|
2015-01-22 03:40:55 +00:00
|
|
|
if (ret->sessions == NULL)
|
|
|
|
goto err;
|
|
|
|
ret->cert_store = X509_STORE_new();
|
|
|
|
if (ret->cert_store == NULL)
|
|
|
|
goto err;
|
2016-03-03 16:19:23 +00:00
|
|
|
#ifndef OPENSSL_NO_CT
|
|
|
|
ret->ctlog_store = CTLOG_STORE_new();
|
|
|
|
if (ret->ctlog_store == NULL)
|
|
|
|
goto err;
|
|
|
|
#endif
|
2018-02-16 11:26:02 +00:00
|
|
|
|
2018-03-14 10:43:53 +00:00
|
|
|
if (!SSL_CTX_set_ciphersuites(ret, TLS_DEFAULT_CIPHERSUITES))
|
2018-02-16 11:26:02 +00:00
|
|
|
goto err;
|
|
|
|
|
2015-04-16 05:50:03 +00:00
|
|
|
if (!ssl_create_cipher_list(ret->method,
|
2018-02-16 11:26:02 +00:00
|
|
|
ret->tls13_ciphersuites,
|
2016-08-05 17:03:17 +00:00
|
|
|
&ret->cipher_list, &ret->cipher_list_by_id,
|
|
|
|
SSL_DEFAULT_CIPHER_LIST, ret->cert)
|
|
|
|
|| sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret->param = X509_VERIFY_PARAM_new();
|
2015-10-30 10:05:53 +00:00
|
|
|
if (ret->param == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
goto err;
|
|
|
|
|
|
|
|
if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
|
|
|
|
goto err2;
|
|
|
|
}
|
|
|
|
|
2017-03-13 15:00:36 +00:00
|
|
|
if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
goto err;
|
|
|
|
|
2018-10-26 10:43:19 +00:00
|
|
|
if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL)
|
|
|
|
goto err;
|
|
|
|
|
2016-02-13 18:29:34 +00:00
|
|
|
if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data))
|
|
|
|
goto err;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2018-03-19 14:50:51 +00:00
|
|
|
if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL)
|
|
|
|
goto err;
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/* No compression for DTLS */
|
|
|
|
if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))
|
|
|
|
ret->comp_methods = SSL_COMP_get_compression_methods();
|
|
|
|
|
|
|
|
ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
|
2015-09-22 10:12:50 +00:00
|
|
|
ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
|
2005-10-08 00:18:53 +00:00
|
|
|
|
2016-02-27 18:36:00 +00:00
|
|
|
/* Setup RFC5077 ticket keys */
|
2016-12-08 19:18:40 +00:00
|
|
|
if ((RAND_bytes(ret->ext.tick_key_name,
|
|
|
|
sizeof(ret->ext.tick_key_name)) <= 0)
|
2017-11-03 19:59:16 +00:00
|
|
|
|| (RAND_priv_bytes(ret->ext.secure->tick_hmac_key,
|
2018-03-19 14:50:51 +00:00
|
|
|
sizeof(ret->ext.secure->tick_hmac_key)) <= 0)
|
2017-11-03 19:59:16 +00:00
|
|
|
|| (RAND_priv_bytes(ret->ext.secure->tick_aes_key,
|
2018-03-19 14:50:51 +00:00
|
|
|
sizeof(ret->ext.secure->tick_aes_key)) <= 0))
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->options |= SSL_OP_NO_TICKET;
|
2007-08-11 23:18:29 +00:00
|
|
|
|
2017-11-03 19:59:16 +00:00
|
|
|
if (RAND_priv_bytes(ret->ext.cookie_hmac_key,
|
2017-09-11 14:43:56 +00:00
|
|
|
sizeof(ret->ext.cookie_hmac_key)) <= 0)
|
|
|
|
goto err;
|
|
|
|
|
2011-03-12 17:01:19 +00:00
|
|
|
#ifndef OPENSSL_NO_SRP
|
2015-04-16 05:50:03 +00:00
|
|
|
if (!SSL_CTX_SRP_CTX_init(ret))
|
2015-03-06 14:37:17 +00:00
|
|
|
goto err;
|
2011-03-12 17:01:19 +00:00
|
|
|
#endif
|
2008-06-04 22:34:38 +00:00
|
|
|
#ifndef OPENSSL_NO_ENGINE
|
2015-01-22 03:40:55 +00:00
|
|
|
# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
|
|
|
|
# define eng_strx(x) #x
|
|
|
|
# define eng_str(x) eng_strx(x)
|
|
|
|
/* Use specific client engine automatically... ignore errors */
|
|
|
|
{
|
|
|
|
ENGINE *eng;
|
|
|
|
eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
|
|
|
|
if (!eng) {
|
|
|
|
ERR_clear_error();
|
|
|
|
ENGINE_load_builtin_engines();
|
|
|
|
eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
|
|
|
|
}
|
|
|
|
if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))
|
|
|
|
ERR_clear_error();
|
|
|
|
}
|
|
|
|
# endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
|
|
* Default is to connect to non-RI servers. When RI is more widely
|
|
|
|
* deployed might change this.
|
|
|
|
*/
|
|
|
|
ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
|
2016-02-02 15:26:38 +00:00
|
|
|
/*
|
|
|
|
* Disable compression by default to prevent CRIME. Applications can
|
|
|
|
* re-enable compression by configuring
|
|
|
|
* SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION);
|
2017-11-07 10:45:43 +00:00
|
|
|
* or by using the SSL_CONF library. Similarly we also enable TLSv1.3
|
|
|
|
* middlebox compatibility by default. This may be disabled by default in
|
|
|
|
* a later OpenSSL version.
|
2016-02-02 15:26:38 +00:00
|
|
|
*/
|
2017-11-07 10:45:43 +00:00
|
|
|
ret->options |= SSL_OP_NO_COMPRESSION | SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-12-08 19:18:40 +00:00
|
|
|
ret->ext.status_type = TLSEXT_STATUSTYPE_nothing;
|
2014-12-02 20:44:49 +00:00
|
|
|
|
2017-02-23 16:41:15 +00:00
|
|
|
/*
|
Do not set a nonzero default max_early_data
When early data support was first added, this seemed like a good
idea, as it would allow applications to just add SSL_read_early_data()
calls as needed and have things "Just Work". However, for applications
that do not use TLS 1.3 early data, there is a negative side effect.
Having a nonzero max_early_data in a SSL_CTX (and thus, SSL objects
derived from it) means that when generating a session ticket,
tls_construct_stoc_early_data() will indicate to the client that
the server supports early data. This is true, in that the implementation
of TLS 1.3 (i.e., OpenSSL) does support early data, but does not
necessarily indicate that the server application supports early data,
when the default value is nonzero. In this case a well-intentioned
client would send early data along with its resumption attempt, which
would then be ignored by the server application, a waste of network
bandwidth.
Since, in order to successfully use TLS 1.3 early data, the application
must introduce calls to SSL_read_early_data(), it is not much additional
burden to require that the application also calls
SSL_{CTX_,}set_max_early_data() in order to enable the feature; doing
so closes this scenario where early data packets would be sent on
the wire but ignored.
Update SSL_read_early_data.pod accordingly, and make s_server and
our test programs into applications that are compliant with the new
requirements on applications that use early data.
Fixes #4725
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5483)
2018-02-28 20:49:59 +00:00
|
|
|
* We cannot usefully set a default max_early_data here (which gets
|
|
|
|
* propagated in SSL_new(), for the following reason: setting the
|
|
|
|
* SSL field causes tls_construct_stoc_early_data() to tell the
|
|
|
|
* client that early data will be accepted when constructing a TLS 1.3
|
|
|
|
* session ticket, and the client will accordingly send us early data
|
|
|
|
* when using that ticket (if the client has early data to send).
|
|
|
|
* However, in order for the early data to actually be consumed by
|
|
|
|
* the application, the application must also have calls to
|
|
|
|
* SSL_read_early_data(); otherwise we'll just skip past the early data
|
|
|
|
* and ignore it. So, since the application must add calls to
|
|
|
|
* SSL_read_early_data(), we also require them to add
|
|
|
|
* calls to SSL_CTX_set_max_early_data() in order to use early data,
|
|
|
|
* eliminating the bandwidth-wasting early data in the case described
|
|
|
|
* above.
|
2017-02-23 16:41:15 +00:00
|
|
|
*/
|
Do not set a nonzero default max_early_data
When early data support was first added, this seemed like a good
idea, as it would allow applications to just add SSL_read_early_data()
calls as needed and have things "Just Work". However, for applications
that do not use TLS 1.3 early data, there is a negative side effect.
Having a nonzero max_early_data in a SSL_CTX (and thus, SSL objects
derived from it) means that when generating a session ticket,
tls_construct_stoc_early_data() will indicate to the client that
the server supports early data. This is true, in that the implementation
of TLS 1.3 (i.e., OpenSSL) does support early data, but does not
necessarily indicate that the server application supports early data,
when the default value is nonzero. In this case a well-intentioned
client would send early data along with its resumption attempt, which
would then be ignored by the server application, a waste of network
bandwidth.
Since, in order to successfully use TLS 1.3 early data, the application
must introduce calls to SSL_read_early_data(), it is not much additional
burden to require that the application also calls
SSL_{CTX_,}set_max_early_data() in order to enable the feature; doing
so closes this scenario where early data packets would be sent on
the wire but ignored.
Update SSL_read_early_data.pod accordingly, and make s_server and
our test programs into applications that are compliant with the new
requirements on applications that use early data.
Fixes #4725
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5483)
2018-02-28 20:49:59 +00:00
|
|
|
ret->max_early_data = 0;
|
2017-02-23 16:41:15 +00:00
|
|
|
|
2018-07-05 13:40:39 +00:00
|
|
|
/*
|
|
|
|
* Default recv_max_early_data is a fully loaded single record. Could be
|
|
|
|
* split across multiple records in practice. We set this differently to
|
|
|
|
* max_early_data so that, in the default case, we do not advertise any
|
|
|
|
* support for early_data, but if a client were to send us some (e.g.
|
|
|
|
* because of an old, stale ticket) then we will tolerate it and skip over
|
|
|
|
* it.
|
|
|
|
*/
|
|
|
|
ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH;
|
|
|
|
|
2018-03-14 19:22:48 +00:00
|
|
|
/* By default we send two session tickets automatically in TLSv1.3 */
|
|
|
|
ret->num_tickets = 2;
|
2018-01-31 17:26:46 +00:00
|
|
|
|
2018-03-19 14:01:39 +00:00
|
|
|
ssl_ctx_system_config(ret);
|
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
err:
|
|
|
|
SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
|
|
|
|
err2:
|
2015-04-11 20:32:54 +00:00
|
|
|
SSL_CTX_free(ret);
|
2016-02-29 17:26:07 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-03-07 21:45:58 +00:00
|
|
|
int SSL_CTX_up_ref(SSL_CTX *ctx)
|
2016-01-26 11:31:41 +00:00
|
|
|
{
|
2016-02-29 17:26:07 +00:00
|
|
|
int i;
|
2016-03-07 21:45:58 +00:00
|
|
|
|
2016-08-27 14:01:08 +00:00
|
|
|
if (CRYPTO_UP_REF(&ctx->references, &i, ctx->lock) <= 0)
|
2016-03-07 21:45:58 +00:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
REF_PRINT_COUNT("SSL_CTX", ctx);
|
|
|
|
REF_ASSERT_ISNT(i < 2);
|
|
|
|
return ((i > 1) ? 1 : 0);
|
2016-01-26 11:31:41 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_CTX_free(SSL_CTX *a)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
int i;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (a == NULL)
|
|
|
|
return;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-08-27 14:01:08 +00:00
|
|
|
CRYPTO_DOWN_REF(&a->references, &i, a->lock);
|
2016-01-30 17:04:25 +00:00
|
|
|
REF_PRINT_COUNT("SSL_CTX", a);
|
2015-01-22 03:40:55 +00:00
|
|
|
if (i > 0)
|
|
|
|
return;
|
2016-01-30 17:04:25 +00:00
|
|
|
REF_ASSERT_ISNT(i < 0);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-04-30 21:33:59 +00:00
|
|
|
X509_VERIFY_PARAM_free(a->param);
|
2015-12-29 18:28:28 +00:00
|
|
|
dane_ctx_final(&a->dane);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Free internal session cache. However: the remove_cb() may reference
|
|
|
|
* the ex_data of SSL_CTX, thus the ex_data store can only be removed
|
|
|
|
* after the sessions were flushed.
|
|
|
|
* As the ex_data handling routines might also touch the session cache,
|
|
|
|
* the most secure solution seems to be: empty (flush) the cache, then
|
|
|
|
* free ex_data, then finally free the cache.
|
|
|
|
* (See ticket [openssl.org #212].)
|
|
|
|
*/
|
|
|
|
if (a->sessions != NULL)
|
|
|
|
SSL_CTX_flush_sessions(a, 0);
|
|
|
|
|
|
|
|
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
|
2015-05-01 18:37:16 +00:00
|
|
|
lh_SSL_SESSION_free(a->sessions);
|
2015-04-30 21:33:59 +00:00
|
|
|
X509_STORE_free(a->cert_store);
|
2016-03-03 16:19:23 +00:00
|
|
|
#ifndef OPENSSL_NO_CT
|
|
|
|
CTLOG_STORE_free(a->ctlog_store);
|
|
|
|
#endif
|
2015-05-01 18:37:16 +00:00
|
|
|
sk_SSL_CIPHER_free(a->cipher_list);
|
|
|
|
sk_SSL_CIPHER_free(a->cipher_list_by_id);
|
2018-02-16 11:26:02 +00:00
|
|
|
sk_SSL_CIPHER_free(a->tls13_ciphersuites);
|
2015-04-11 20:32:54 +00:00
|
|
|
ssl_cert_free(a->cert);
|
2017-03-13 15:00:36 +00:00
|
|
|
sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);
|
2018-10-26 10:43:19 +00:00
|
|
|
sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);
|
2015-04-30 21:33:59 +00:00
|
|
|
sk_X509_pop_free(a->extra_certs, X509_free);
|
2015-01-22 03:40:55 +00:00
|
|
|
a->comp_methods = NULL;
|
2014-12-22 11:15:51 +00:00
|
|
|
#ifndef OPENSSL_NO_SRTP
|
2015-05-01 18:37:16 +00:00
|
|
|
sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
|
2014-12-22 11:15:51 +00:00
|
|
|
#endif
|
2011-03-12 17:01:19 +00:00
|
|
|
#ifndef OPENSSL_NO_SRP
|
2015-01-22 03:40:55 +00:00
|
|
|
SSL_CTX_SRP_CTX_free(a);
|
2011-03-12 17:01:19 +00:00
|
|
|
#endif
|
2008-06-01 23:06:48 +00:00
|
|
|
#ifndef OPENSSL_NO_ENGINE
|
2016-02-25 17:09:06 +00:00
|
|
|
ENGINE_finish(a->client_cert_engine);
|
2006-03-10 23:06:27 +00:00
|
|
|
#endif
|
2008-06-03 02:48:34 +00:00
|
|
|
|
2015-05-15 09:49:56 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(a->ext.ecpointformats);
|
|
|
|
OPENSSL_free(a->ext.supportedgroups);
|
2008-06-03 02:48:34 +00:00
|
|
|
#endif
|
2016-12-08 19:18:40 +00:00
|
|
|
OPENSSL_free(a->ext.alpn);
|
2018-03-19 14:50:51 +00:00
|
|
|
OPENSSL_secure_free(a->ext.secure);
|
2008-06-03 02:48:34 +00:00
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
CRYPTO_THREAD_lock_free(a->lock);
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
OPENSSL_free(a);
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-05-14 11:52:49 +00:00
|
|
|
void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ctx->default_passwd_callback = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)
|
|
|
|
{
|
|
|
|
ctx->default_passwd_callback_userdata = u;
|
|
|
|
}
|
|
|
|
|
2016-03-02 11:53:40 +00:00
|
|
|
pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->default_passwd_callback;
|
|
|
|
}
|
|
|
|
|
|
|
|
void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->default_passwd_callback_userdata;
|
|
|
|
}
|
|
|
|
|
2015-11-09 14:38:59 +00:00
|
|
|
void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb)
|
|
|
|
{
|
|
|
|
s->default_passwd_callback = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_default_passwd_cb_userdata(SSL *s, void *u)
|
|
|
|
{
|
|
|
|
s->default_passwd_callback_userdata = u;
|
|
|
|
}
|
|
|
|
|
2016-03-02 11:53:40 +00:00
|
|
|
pem_password_cb *SSL_get_default_passwd_cb(SSL *s)
|
|
|
|
{
|
|
|
|
return s->default_passwd_callback;
|
|
|
|
}
|
|
|
|
|
|
|
|
void *SSL_get_default_passwd_cb_userdata(SSL *s)
|
|
|
|
{
|
|
|
|
return s->default_passwd_callback_userdata;
|
|
|
|
}
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
|
|
|
|
int (*cb) (X509_STORE_CTX *, void *),
|
|
|
|
void *arg)
|
|
|
|
{
|
|
|
|
ctx->app_verify_callback = cb;
|
|
|
|
ctx->app_verify_arg = arg;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_verify(SSL_CTX *ctx, int mode,
|
|
|
|
int (*cb) (int, X509_STORE_CTX *))
|
|
|
|
{
|
|
|
|
ctx->verify_mode = mode;
|
|
|
|
ctx->default_verify_callback = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
|
|
|
|
{
|
|
|
|
X509_VERIFY_PARAM_set_depth(ctx->param, depth);
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg), void *arg)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ssl_cert_set_cert_cb(c->cert, cb, arg);
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg)
|
|
|
|
{
|
|
|
|
ssl_cert_set_cert_cb(s->cert, cb, arg);
|
|
|
|
}
|
2012-06-29 14:24:42 +00:00
|
|
|
|
2016-02-17 15:39:25 +00:00
|
|
|
void ssl_set_masks(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2015-05-12 21:17:34 +00:00
|
|
|
CERT *c = s->cert;
|
2015-07-14 22:19:11 +00:00
|
|
|
uint32_t *pvalid = s->s3->tmp.valid_flags;
|
2015-12-15 23:57:18 +00:00
|
|
|
int rsa_enc, rsa_sign, dh_tmp, dsa_sign;
|
2015-12-05 01:04:41 +00:00
|
|
|
unsigned long mask_k, mask_a;
|
2015-03-10 23:09:27 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2015-12-05 01:04:41 +00:00
|
|
|
int have_ecc_cert, ecdsa_ok;
|
2013-08-17 16:40:08 +00:00
|
|
|
#endif
|
2015-01-22 03:40:55 +00:00
|
|
|
if (c == NULL)
|
|
|
|
return;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_DH
|
2015-01-22 03:40:55 +00:00
|
|
|
dh_tmp = (c->dh_tmp != NULL || c->dh_tmp_cb != NULL || c->dh_tmp_auto);
|
1998-12-21 10:52:47 +00:00
|
|
|
#else
|
2015-12-05 01:04:41 +00:00
|
|
|
dh_tmp = 0;
|
1998-12-21 10:52:47 +00:00
|
|
|
#endif
|
|
|
|
|
2017-02-10 04:23:53 +00:00
|
|
|
rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
|
2017-02-19 21:16:46 +00:00
|
|
|
rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
|
|
|
|
dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID;
|
2013-08-17 16:40:08 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2015-05-12 21:17:34 +00:00
|
|
|
have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
|
2013-08-17 16:40:08 +00:00
|
|
|
#endif
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_k = 0;
|
|
|
|
mask_a = 0;
|
1. Changes for s_client.c to make it return non-zero exit code in case
of handshake failure
2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to
make it recognize GOST certificates as EVP_PKT_SIGN|EVP_PKT_EXCH
(required for s3_srvr to accept GOST client certificates).
3. Changes to EVP
- adding of function EVP_PKEY_CTX_get0_peerkey
- Make function EVP_PKEY_derive_set_peerkey work for context with
ENCRYPT operation, because we use peerkey field in the context to
pass non-ephemeral secret key to GOST encrypt operation.
- added EVP_PKEY_CTRL_SET_IV control command. It is really
GOST-specific, but it is used in SSL code, so it has to go
in some header file, available during libssl compilation
4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data
5. Include des.h if KSSL_DEBUG is defined into some libssl files, to
make debugging output which depends on constants defined there, work
and other KSSL_DEBUG output fixes
6. Declaration of real GOST ciphersuites, two authentication methods
SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST
7. Implementation of these methods.
8. Support for sending unsolicited serverhello extension if GOST
ciphersuite is selected. It is require for interoperability with
CryptoPro CSP 3.0 and 3.6 and controlled by
SSL_OP_CRYPTOPRO_TLSEXT_BUG constant.
This constant is added to SSL_OP_ALL, because it does nothing, if
non-GOST ciphersuite is selected, and all implementation of GOST
include compatibility with CryptoPro.
9. Support for CertificateVerify message without length field. It is
another CryptoPro bug, but support is made unconditional, because it
does no harm for draft-conforming implementation.
10. In tls1_mac extra copy of stream mac context is no more done.
When I've written currently commited code I haven't read
EVP_DigestSignFinal manual carefully enough and haven't noticed that
it does an internal digest ctx copying.
This implementation was tested against
1. CryptoPro CSP 3.6 client and server
2. Cryptopro CSP 3.0 server
2007-10-26 12:06:36 +00:00
|
|
|
|
1998-12-21 10:52:47 +00:00
|
|
|
#ifdef CIPHER_DEBUG
|
2016-01-19 21:15:33 +00:00
|
|
|
fprintf(stderr, "dht=%d re=%d rs=%d ds=%d\n",
|
|
|
|
dh_tmp, rsa_enc, rsa_sign, dsa_sign);
|
2015-01-22 03:40:55 +00:00
|
|
|
#endif
|
|
|
|
|
2015-11-24 13:52:07 +00:00
|
|
|
#ifndef OPENSSL_NO_GOST
|
2017-02-13 15:40:21 +00:00
|
|
|
if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) {
|
2015-11-17 15:32:30 +00:00
|
|
|
mask_k |= SSL_kGOST;
|
|
|
|
mask_a |= SSL_aGOST12;
|
|
|
|
}
|
2017-02-13 15:40:21 +00:00
|
|
|
if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) {
|
2015-11-17 15:32:30 +00:00
|
|
|
mask_k |= SSL_kGOST;
|
|
|
|
mask_a |= SSL_aGOST12;
|
|
|
|
}
|
2017-02-13 15:40:21 +00:00
|
|
|
if (ssl_has_cert(s, SSL_PKEY_GOST01)) {
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_k |= SSL_kGOST;
|
|
|
|
mask_a |= SSL_aGOST01;
|
|
|
|
}
|
2015-11-24 13:52:07 +00:00
|
|
|
#endif
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-12-05 01:04:41 +00:00
|
|
|
if (rsa_enc)
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_k |= SSL_kRSA;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (dh_tmp)
|
|
|
|
mask_k |= SSL_kDHE;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2017-09-14 13:48:39 +00:00
|
|
|
/*
|
|
|
|
* If we only have an RSA-PSS certificate allow RSA authentication
|
|
|
|
* if TLS 1.2 and peer supports it.
|
|
|
|
*/
|
|
|
|
|
|
|
|
if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN)
|
|
|
|
&& pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN
|
|
|
|
&& TLS1_get_version(s) == TLS1_2_VERSION))
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_a |= SSL_aRSA;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
if (dsa_sign) {
|
|
|
|
mask_a |= SSL_aDSS;
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_a |= SSL_aNULL;
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* An ECC certificate may be usable for ECDH and/or ECDSA cipher suites
|
|
|
|
* depending on the key usage extension.
|
|
|
|
*/
|
2013-08-17 16:40:08 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2015-01-22 03:40:55 +00:00
|
|
|
if (have_ecc_cert) {
|
2015-09-02 21:01:18 +00:00
|
|
|
uint32_t ex_kusage;
|
2017-02-13 15:40:21 +00:00
|
|
|
ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509);
|
2015-09-02 21:01:18 +00:00
|
|
|
ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE;
|
2015-05-12 21:17:34 +00:00
|
|
|
if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN))
|
2015-01-22 03:40:55 +00:00
|
|
|
ecdsa_ok = 0;
|
2016-02-17 12:44:30 +00:00
|
|
|
if (ecdsa_ok)
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_a |= SSL_aECDSA;
|
|
|
|
}
|
2017-06-16 17:55:28 +00:00
|
|
|
/* Allow Ed25519 for TLS 1.2 if peer supports it */
|
|
|
|
if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519)
|
|
|
|
&& pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN
|
|
|
|
&& TLS1_get_version(s) == TLS1_2_VERSION)
|
|
|
|
mask_a |= SSL_aECDSA;
|
2018-02-27 10:12:02 +00:00
|
|
|
|
|
|
|
/* Allow Ed448 for TLS 1.2 if peer supports it */
|
|
|
|
if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448)
|
|
|
|
&& pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN
|
|
|
|
&& TLS1_get_version(s) == TLS1_2_VERSION)
|
|
|
|
mask_a |= SSL_aECDSA;
|
2013-08-17 16:40:08 +00:00
|
|
|
#endif
|
2002-08-09 08:56:08 +00:00
|
|
|
|
2015-03-10 23:09:27 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
2015-12-04 21:30:36 +00:00
|
|
|
mask_k |= SSL_kECDHE;
|
2002-08-09 08:56:08 +00:00
|
|
|
#endif
|
2006-03-10 23:06:27 +00:00
|
|
|
|
|
|
|
#ifndef OPENSSL_NO_PSK
|
2015-01-22 03:40:55 +00:00
|
|
|
mask_k |= SSL_kPSK;
|
|
|
|
mask_a |= SSL_aPSK;
|
2015-06-28 16:02:56 +00:00
|
|
|
if (mask_k & SSL_kRSA)
|
|
|
|
mask_k |= SSL_kRSAPSK;
|
|
|
|
if (mask_k & SSL_kDHE)
|
|
|
|
mask_k |= SSL_kDHEPSK;
|
|
|
|
if (mask_k & SSL_kECDHE)
|
|
|
|
mask_k |= SSL_kECDHEPSK;
|
2006-03-10 23:06:27 +00:00
|
|
|
#endif
|
|
|
|
|
2015-05-18 22:29:57 +00:00
|
|
|
s->s3->tmp.mask_k = mask_k;
|
|
|
|
s->s3->tmp.mask_a = mask_a;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2009-04-23 16:32:42 +00:00
|
|
|
#ifndef OPENSSL_NO_EC
|
|
|
|
|
2011-05-09 15:44:01 +00:00
|
|
|
int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-02-11 18:19:27 +00:00
|
|
|
if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
|
2015-01-22 03:40:55 +00:00
|
|
|
/* key usage, if present, must allow signing */
|
2016-02-11 18:19:27 +00:00
|
|
|
if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) {
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG,
|
|
|
|
SSL_R_ECC_CERT_NOT_FOR_SIGNING);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 1; /* all checks are ok */
|
|
|
|
}
|
2002-08-09 08:56:08 +00:00
|
|
|
|
2009-04-23 16:32:42 +00:00
|
|
|
#endif
|
|
|
|
|
2013-05-13 01:55:27 +00:00
|
|
|
int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
|
2015-01-22 03:40:55 +00:00
|
|
|
size_t *serverinfo_length)
|
|
|
|
{
|
2017-02-14 00:35:26 +00:00
|
|
|
CERT_PKEY *cpk = s->s3->tmp.cert;
|
2015-01-22 03:40:55 +00:00
|
|
|
*serverinfo_length = 0;
|
|
|
|
|
2017-02-14 00:35:26 +00:00
|
|
|
if (cpk == NULL || cpk->serverinfo == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
return 0;
|
|
|
|
|
2017-02-14 00:35:26 +00:00
|
|
|
*serverinfo = cpk->serverinfo;
|
|
|
|
*serverinfo_length = cpk->serverinfo_length;
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
void ssl_update_cache(SSL *s, int mode)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the session_id_length is 0, we are not supposed to cache it, and it
|
|
|
|
* would be rather hard to do anyway :-)
|
|
|
|
*/
|
|
|
|
if (s->session->session_id_length == 0)
|
|
|
|
return;
|
|
|
|
|
2018-01-26 17:16:21 +00:00
|
|
|
/*
|
|
|
|
* If sid_ctx_length is 0 there is no specific application context
|
|
|
|
* associated with this session, so when we try to resume it and
|
2018-04-16 12:32:02 +00:00
|
|
|
* SSL_VERIFY_PEER is requested to verify the client identity, we have no
|
|
|
|
* indication that this is actually a session for the proper application
|
|
|
|
* context, and the *handshake* will fail, not just the resumption attempt.
|
|
|
|
* Do not cache (on the server) these sessions that are not resumable
|
|
|
|
* (clients can set SSL_VERIFY_PEER without needing a sid_ctx set).
|
2018-01-26 17:16:21 +00:00
|
|
|
*/
|
2018-04-16 12:32:02 +00:00
|
|
|
if (s->server && s->session->sid_ctx_length == 0
|
2018-01-26 17:16:21 +00:00
|
|
|
&& (s->verify_mode & SSL_VERIFY_PEER) != 0)
|
|
|
|
return;
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
i = s->session_ctx->session_cache_mode;
|
2017-08-01 09:49:47 +00:00
|
|
|
if ((i & mode) != 0
|
2018-05-18 10:31:31 +00:00
|
|
|
&& (!s->hit || SSL_IS_TLS13(s))) {
|
|
|
|
/*
|
|
|
|
* Add the session to the internal cache. In server side TLSv1.3 we
|
2018-06-13 14:57:39 +00:00
|
|
|
* normally don't do this because by default it's a full stateless ticket
|
|
|
|
* with only a dummy session id so there is no reason to cache it,
|
|
|
|
* unless:
|
2018-05-18 10:31:31 +00:00
|
|
|
* - we are doing early_data, in which case we cache so that we can
|
|
|
|
* detect replays
|
|
|
|
* - the application has set a remove_session_cb so needs to know about
|
|
|
|
* session timeout events
|
2018-06-13 14:57:39 +00:00
|
|
|
* - SSL_OP_NO_TICKET is set in which case it is a stateful ticket
|
2018-05-18 10:31:31 +00:00
|
|
|
*/
|
|
|
|
if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0
|
|
|
|
&& (!SSL_IS_TLS13(s)
|
|
|
|
|| !s->server
|
2018-06-07 08:11:05 +00:00
|
|
|
|| (s->max_early_data > 0
|
|
|
|
&& (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)
|
2018-06-13 14:57:39 +00:00
|
|
|
|| s->session_ctx->remove_session_cb != NULL
|
|
|
|
|| (s->options & SSL_OP_NO_TICKET) != 0))
|
2018-05-18 10:31:31 +00:00
|
|
|
SSL_CTX_add_session(s->session_ctx, s->session);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Add the session to the external cache. We do this even in server side
|
|
|
|
* TLSv1.3 without early data because some applications just want to
|
|
|
|
* know about the creation of a session and aren't doing a full cache.
|
|
|
|
*/
|
|
|
|
if (s->session_ctx->new_session_cb != NULL) {
|
|
|
|
SSL_SESSION_up_ref(s->session);
|
|
|
|
if (!s->session_ctx->new_session_cb(s, s->session))
|
|
|
|
SSL_SESSION_free(s->session);
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* auto flush every 255 connections */
|
|
|
|
if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) {
|
2018-07-29 12:12:53 +00:00
|
|
|
TSAN_QUALIFIER int *stat;
|
2017-10-17 19:46:58 +00:00
|
|
|
if (mode & SSL_SESS_CACHE_CLIENT)
|
|
|
|
stat = &s->session_ctx->stats.sess_connect_good;
|
|
|
|
else
|
|
|
|
stat = &s->session_ctx->stats.sess_accept_good;
|
2018-07-29 12:12:53 +00:00
|
|
|
if ((tsan_load(stat) & 0xff) == 0xff)
|
2015-01-22 03:40:55 +00:00
|
|
|
SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL));
|
|
|
|
}
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return ctx->method;
|
|
|
|
}
|
2014-01-16 14:06:19 +00:00
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
const SSL_METHOD *SSL_get_ssl_method(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->method;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-08-14 21:48:33 +00:00
|
|
|
int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
int ret = 1;
|
|
|
|
|
|
|
|
if (s->method != meth) {
|
2015-12-29 18:28:28 +00:00
|
|
|
const SSL_METHOD *sm = s->method;
|
2016-08-05 17:03:17 +00:00
|
|
|
int (*hf) (SSL *) = s->handshake_func;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
if (sm->version == meth->version)
|
2015-01-22 03:40:55 +00:00
|
|
|
s->method = meth;
|
|
|
|
else {
|
2015-12-29 18:28:28 +00:00
|
|
|
sm->ssl_free(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->method = meth;
|
|
|
|
ret = s->method->ssl_new(s);
|
|
|
|
}
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
if (hf == sm->ssl_connect)
|
2015-01-22 03:40:55 +00:00
|
|
|
s->handshake_func = meth->ssl_connect;
|
2015-12-29 18:28:28 +00:00
|
|
|
else if (hf == sm->ssl_accept)
|
2015-01-22 03:40:55 +00:00
|
|
|
s->handshake_func = meth->ssl_accept;
|
|
|
|
}
|
2017-10-17 14:04:09 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_get_error(const SSL *s, int i)
|
|
|
|
{
|
|
|
|
int reason;
|
|
|
|
unsigned long l;
|
|
|
|
BIO *bio;
|
|
|
|
|
|
|
|
if (i > 0)
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_NONE;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
|
|
|
|
* where we do encode the error
|
|
|
|
*/
|
|
|
|
if ((l = ERR_peek_error()) != 0) {
|
|
|
|
if (ERR_GET_LIB(l) == ERR_LIB_SYS)
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_SYSCALL;
|
2015-01-22 03:40:55 +00:00
|
|
|
else
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_SSL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2016-10-19 13:09:02 +00:00
|
|
|
if (SSL_want_read(s)) {
|
|
|
|
bio = SSL_get_rbio(s);
|
|
|
|
if (BIO_should_read(bio))
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_READ;
|
2016-10-19 13:09:02 +00:00
|
|
|
else if (BIO_should_write(bio))
|
|
|
|
/*
|
|
|
|
* This one doesn't make too much sense ... We never try to write
|
|
|
|
* to the rbio, and an application program where rbio and wbio
|
|
|
|
* are separate couldn't even know what it should wait for.
|
|
|
|
* However if we ever set s->rwstate incorrectly (so that we have
|
|
|
|
* SSL_want_read(s) instead of SSL_want_write(s)) and rbio and
|
|
|
|
* wbio *are* the same, this test works around that bug; so it
|
|
|
|
* might be safer to keep it.
|
|
|
|
*/
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_WRITE;
|
2016-10-19 13:09:02 +00:00
|
|
|
else if (BIO_should_io_special(bio)) {
|
|
|
|
reason = BIO_get_retry_reason(bio);
|
|
|
|
if (reason == BIO_RR_CONNECT)
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_CONNECT;
|
2016-10-19 13:09:02 +00:00
|
|
|
else if (reason == BIO_RR_ACCEPT)
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_ACCEPT;
|
2016-10-19 13:09:02 +00:00
|
|
|
else
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_SYSCALL; /* unknown */
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2016-10-19 13:09:02 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-10-19 13:09:02 +00:00
|
|
|
if (SSL_want_write(s)) {
|
2017-03-28 21:57:28 +00:00
|
|
|
/* Access wbio directly - in order to use the buffered bio if present */
|
2016-10-19 13:09:02 +00:00
|
|
|
bio = s->wbio;
|
|
|
|
if (BIO_should_write(bio))
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_WRITE;
|
2016-10-19 13:09:02 +00:00
|
|
|
else if (BIO_should_read(bio))
|
2016-06-17 12:59:59 +00:00
|
|
|
/*
|
2016-10-19 13:09:02 +00:00
|
|
|
* See above (SSL_want_read(s) with BIO_should_write(bio))
|
2016-06-17 12:59:59 +00:00
|
|
|
*/
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_READ;
|
2016-10-19 13:09:02 +00:00
|
|
|
else if (BIO_should_io_special(bio)) {
|
|
|
|
reason = BIO_get_retry_reason(bio);
|
|
|
|
if (reason == BIO_RR_CONNECT)
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_CONNECT;
|
2016-10-19 13:09:02 +00:00
|
|
|
else if (reason == BIO_RR_ACCEPT)
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_ACCEPT;
|
2016-10-19 13:09:02 +00:00
|
|
|
else
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_SYSCALL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2015-02-13 23:28:49 +00:00
|
|
|
}
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
if (SSL_want_x509_lookup(s))
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_WANT_X509_LOOKUP;
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
if (SSL_want_async(s))
|
2016-10-19 13:09:02 +00:00
|
|
|
return SSL_ERROR_WANT_ASYNC;
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
if (SSL_want_async_job(s))
|
2016-10-19 13:09:02 +00:00
|
|
|
return SSL_ERROR_WANT_ASYNC_JOB;
|
2017-09-07 22:39:40 +00:00
|
|
|
if (SSL_want_client_hello_cb(s))
|
|
|
|
return SSL_ERROR_WANT_CLIENT_HELLO_CB;
|
2016-10-19 13:09:02 +00:00
|
|
|
|
|
|
|
if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
|
|
|
|
(s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_ZERO_RETURN;
|
2016-10-19 13:09:02 +00:00
|
|
|
|
2017-10-17 14:04:09 +00:00
|
|
|
return SSL_ERROR_SYSCALL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2015-10-06 14:57:50 +00:00
|
|
|
static int ssl_do_handshake_intern(void *vargs)
|
|
|
|
{
|
|
|
|
struct ssl_async_args *args;
|
|
|
|
SSL *s;
|
|
|
|
|
|
|
|
args = (struct ssl_async_args *)vargs;
|
|
|
|
s = args->s;
|
|
|
|
|
|
|
|
return s->handshake_func(s);
|
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_do_handshake(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
int ret = 1;
|
|
|
|
|
|
|
|
if (s->handshake_func == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET);
|
2015-10-06 14:57:50 +00:00
|
|
|
return -1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2017-02-27 20:54:39 +00:00
|
|
|
ossl_statem_check_finish_init(s, -1);
|
2017-02-21 09:22:22 +00:00
|
|
|
|
2017-01-10 23:02:28 +00:00
|
|
|
s->method->ssl_renegotiate_check(s, 0);
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
if (SSL_in_init(s) || SSL_in_before(s)) {
|
2016-06-28 22:18:50 +00:00
|
|
|
if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
|
2015-10-06 14:57:50 +00:00
|
|
|
struct ssl_async_args args;
|
|
|
|
|
|
|
|
args.s = s;
|
|
|
|
|
2015-10-09 15:47:43 +00:00
|
|
|
ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
|
2015-10-06 14:57:50 +00:00
|
|
|
} else {
|
|
|
|
ret = s->handshake_func(s);
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2015-10-06 14:57:50 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_accept_state(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->server = 1;
|
|
|
|
s->shutdown = 0;
|
2015-10-05 09:39:54 +00:00
|
|
|
ossl_statem_clear(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->handshake_func = s->method->ssl_accept;
|
2015-06-13 14:50:00 +00:00
|
|
|
clear_ciphers(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void SSL_set_connect_state(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->server = 0;
|
|
|
|
s->shutdown = 0;
|
2015-10-05 09:39:54 +00:00
|
|
|
ossl_statem_clear(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->handshake_func = s->method->ssl_connect;
|
2015-06-13 14:50:00 +00:00
|
|
|
clear_ciphers(s);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int ssl_undefined_function(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-31 09:26:39 +00:00
|
|
|
int ssl_undefined_void_function(void)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,
|
|
|
|
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2005-03-31 09:26:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int ssl_undefined_const_function(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2005-03-30 10:26:02 +00:00
|
|
|
|
2016-03-02 21:39:40 +00:00
|
|
|
const SSL_METHOD *ssl_bad_method(int ver)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-02-07 19:17:07 +00:00
|
|
|
const char *ssl_protocol_to_string(int version)
|
2016-02-07 19:56:40 +00:00
|
|
|
{
|
2016-10-31 10:00:45 +00:00
|
|
|
switch(version)
|
|
|
|
{
|
|
|
|
case TLS1_3_VERSION:
|
2016-10-21 16:39:33 +00:00
|
|
|
return "TLSv1.3";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case TLS1_2_VERSION:
|
2016-02-07 19:56:40 +00:00
|
|
|
return "TLSv1.2";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case TLS1_1_VERSION:
|
2016-02-07 19:56:40 +00:00
|
|
|
return "TLSv1.1";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case TLS1_VERSION:
|
2016-03-17 00:47:52 +00:00
|
|
|
return "TLSv1";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case SSL3_VERSION:
|
2016-02-07 19:56:40 +00:00
|
|
|
return "SSLv3";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case DTLS1_BAD_VER:
|
2016-02-07 19:56:40 +00:00
|
|
|
return "DTLSv0.9";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case DTLS1_VERSION:
|
2016-02-07 19:56:40 +00:00
|
|
|
return "DTLSv1";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
case DTLS1_2_VERSION:
|
2016-02-07 19:56:40 +00:00
|
|
|
return "DTLSv1.2";
|
2016-10-31 10:00:45 +00:00
|
|
|
|
|
|
|
default:
|
|
|
|
return "unknown";
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2016-02-07 19:56:40 +00:00
|
|
|
const char *SSL_get_version(const SSL *s)
|
|
|
|
{
|
2016-02-07 19:17:07 +00:00
|
|
|
return ssl_protocol_to_string(s->version);
|
2016-02-07 19:56:40 +00:00
|
|
|
}
|
|
|
|
|
2018-10-26 10:43:19 +00:00
|
|
|
static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
STACK_OF(X509_NAME) *sk;
|
|
|
|
X509_NAME *xn;
|
2018-10-26 10:43:19 +00:00
|
|
|
int i;
|
|
|
|
|
|
|
|
if (src == NULL) {
|
|
|
|
*dst = NULL;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((sk = sk_X509_NAME_new_null()) == NULL)
|
|
|
|
return 0;
|
|
|
|
for (i = 0; i < sk_X509_NAME_num(src); i++) {
|
|
|
|
xn = X509_NAME_dup(sk_X509_NAME_value(src, i));
|
|
|
|
if (xn == NULL) {
|
|
|
|
sk_X509_NAME_pop_free(sk, X509_NAME_free);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (sk_X509_NAME_insert(sk, xn, i) == 0) {
|
|
|
|
X509_NAME_free(xn);
|
|
|
|
sk_X509_NAME_pop_free(sk, X509_NAME_free);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
*dst = sk;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
SSL *SSL_dup(SSL *s)
|
|
|
|
{
|
2015-01-22 03:40:55 +00:00
|
|
|
SSL *ret;
|
|
|
|
int i;
|
|
|
|
|
2015-12-29 18:28:28 +00:00
|
|
|
/* If we're not quiescent, just up_ref! */
|
|
|
|
if (!SSL_in_init(s) || !SSL_in_before(s)) {
|
2016-08-27 14:01:08 +00:00
|
|
|
CRYPTO_UP_REF(&s->references, &i, s->lock);
|
2015-12-29 18:28:28 +00:00
|
|
|
return s;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Otherwise, copy configuration state, and session if set.
|
|
|
|
*/
|
2015-01-22 03:40:55 +00:00
|
|
|
if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
if (s->session != NULL) {
|
2015-12-29 18:28:28 +00:00
|
|
|
/*
|
|
|
|
* Arranges to share the same session via up_ref. This "copies"
|
|
|
|
* session-id, SSL_METHOD, sid_ctx, and 'cert'
|
|
|
|
*/
|
2015-04-16 05:50:03 +00:00
|
|
|
if (!SSL_copy_session_id(ret, s))
|
2015-03-24 15:10:15 +00:00
|
|
|
goto err;
|
2015-01-22 03:40:55 +00:00
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* No session has been established yet, so we have to expect that
|
|
|
|
* s->cert or ret->cert will be changed later -- they should not both
|
|
|
|
* point to the same object, and thus we can't use
|
|
|
|
* SSL_copy_session_id.
|
|
|
|
*/
|
2015-12-29 18:28:28 +00:00
|
|
|
if (!SSL_set_ssl_method(ret, s->method))
|
|
|
|
goto err;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
if (s->cert != NULL) {
|
2015-04-11 20:32:54 +00:00
|
|
|
ssl_cert_free(ret->cert);
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->cert = ssl_cert_dup(s->cert);
|
|
|
|
if (ret->cert == NULL)
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2016-10-19 14:11:24 +00:00
|
|
|
if (!SSL_set_session_id_context(ret, s->sid_ctx,
|
|
|
|
(int)s->sid_ctx_length))
|
2015-03-06 14:37:17 +00:00
|
|
|
goto err;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2016-04-22 00:00:58 +00:00
|
|
|
if (!ssl_dane_dup(ret, s))
|
|
|
|
goto err;
|
2015-12-29 18:28:28 +00:00
|
|
|
ret->version = s->version;
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->options = s->options;
|
|
|
|
ret->mode = s->mode;
|
|
|
|
SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
|
|
|
|
SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
|
|
|
|
ret->msg_callback = s->msg_callback;
|
|
|
|
ret->msg_callback_arg = s->msg_callback_arg;
|
|
|
|
SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s));
|
|
|
|
SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
|
|
|
|
ret->generate_session_id = s->generate_session_id;
|
|
|
|
|
|
|
|
SSL_set_info_callback(ret, SSL_get_info_callback(s));
|
|
|
|
|
|
|
|
/* copy app data, a little dangerous perhaps */
|
|
|
|
if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
/* setup rbio, and wbio */
|
|
|
|
if (s->rbio != NULL) {
|
|
|
|
if (!BIO_dup_state(s->rbio, (char *)&ret->rbio))
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
if (s->wbio != NULL) {
|
|
|
|
if (s->wbio != s->rbio) {
|
|
|
|
if (!BIO_dup_state(s->wbio, (char *)&ret->wbio))
|
|
|
|
goto err;
|
2016-07-21 11:17:29 +00:00
|
|
|
} else {
|
|
|
|
BIO_up_ref(ret->rbio);
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->wbio = ret->rbio;
|
2016-07-21 11:17:29 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2015-12-29 18:28:28 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->server = s->server;
|
2015-12-29 18:28:28 +00:00
|
|
|
if (s->handshake_func) {
|
|
|
|
if (s->server)
|
|
|
|
SSL_set_accept_state(ret);
|
|
|
|
else
|
|
|
|
SSL_set_connect_state(ret);
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
ret->shutdown = s->shutdown;
|
|
|
|
ret->hit = s->hit;
|
|
|
|
|
2015-11-09 14:38:59 +00:00
|
|
|
ret->default_passwd_callback = s->default_passwd_callback;
|
|
|
|
ret->default_passwd_callback_userdata = s->default_passwd_callback_userdata;
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
X509_VERIFY_PARAM_inherit(ret->param, s->param);
|
|
|
|
|
|
|
|
/* dup the cipher_list and cipher_list_by_id stacks */
|
|
|
|
if (s->cipher_list != NULL) {
|
|
|
|
if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
if (s->cipher_list_by_id != NULL)
|
|
|
|
if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
|
|
|
|
== NULL)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
/* Dup the client_CA list */
|
2018-10-26 10:43:19 +00:00
|
|
|
if (!dup_ca_names(&ret->ca_names, s->ca_names)
|
|
|
|
|| !dup_ca_names(&ret->client_ca_names, s->client_ca_names))
|
|
|
|
goto err;
|
|
|
|
|
2015-05-01 18:29:48 +00:00
|
|
|
return ret;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
err:
|
2015-05-01 18:29:48 +00:00
|
|
|
SSL_free(ret);
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
void ssl_clear_cipher_ctx(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s->enc_read_ctx != NULL) {
|
2015-12-13 21:08:41 +00:00
|
|
|
EVP_CIPHER_CTX_free(s->enc_read_ctx);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->enc_read_ctx = NULL;
|
|
|
|
}
|
|
|
|
if (s->enc_write_ctx != NULL) {
|
2015-12-13 21:08:41 +00:00
|
|
|
EVP_CIPHER_CTX_free(s->enc_write_ctx);
|
2015-01-22 03:40:55 +00:00
|
|
|
s->enc_write_ctx = NULL;
|
|
|
|
}
|
2005-09-30 23:35:33 +00:00
|
|
|
#ifndef OPENSSL_NO_COMP
|
2015-05-01 14:15:18 +00:00
|
|
|
COMP_CTX_free(s->expand);
|
|
|
|
s->expand = NULL;
|
|
|
|
COMP_CTX_free(s->compress);
|
|
|
|
s->compress = NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
#endif
|
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
X509 *SSL_get_certificate(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s->cert != NULL)
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->cert->key->x509;
|
2015-01-22 03:40:55 +00:00
|
|
|
else
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2013-11-18 18:49:46 +00:00
|
|
|
EVP_PKEY *SSL_get_privatekey(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s->cert != NULL)
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->cert->key->privatekey;
|
2015-01-22 03:40:55 +00:00
|
|
|
else
|
2017-10-17 14:04:09 +00:00
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:52:47 +00:00
|
|
|
|
2013-11-18 18:49:46 +00:00
|
|
|
X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (ctx->cert != NULL)
|
|
|
|
return ctx->cert->key->x509;
|
|
|
|
else
|
|
|
|
return NULL;
|
|
|
|
}
|
2013-11-18 18:49:46 +00:00
|
|
|
|
|
|
|
EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (ctx->cert != NULL)
|
|
|
|
return ctx->cert->key->privatekey;
|
|
|
|
else
|
|
|
|
return NULL;
|
|
|
|
}
|
2013-11-18 18:49:46 +00:00
|
|
|
|
2008-10-12 14:32:47 +00:00
|
|
|
const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if ((s->session != NULL) && (s->session->cipher != NULL))
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->session->cipher;
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 20:28:14 +00:00
|
|
|
const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s)
|
|
|
|
{
|
|
|
|
return s->s3->tmp.new_cipher;
|
|
|
|
}
|
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
const COMP_METHOD *SSL_get_current_compression(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2015-05-08 16:05:36 +00:00
|
|
|
#ifndef OPENSSL_NO_COMP
|
|
|
|
return s->compress ? COMP_CTX_get_method(s->compress) : NULL;
|
|
|
|
#else
|
|
|
|
return NULL;
|
|
|
|
#endif
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2003-10-06 12:18:39 +00:00
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
const COMP_METHOD *SSL_get_current_expansion(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2015-05-08 16:05:36 +00:00
|
|
|
#ifndef OPENSSL_NO_COMP
|
|
|
|
return s->expand ? COMP_CTX_get_method(s->expand) : NULL;
|
|
|
|
#else
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
#endif
|
2015-05-08 16:05:36 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-05-17 11:28:14 +00:00
|
|
|
int ssl_init_wbio_buffer(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
BIO *bbio;
|
|
|
|
|
2016-06-17 12:59:59 +00:00
|
|
|
if (s->bbio != NULL) {
|
|
|
|
/* Already buffered. */
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2016-05-17 11:28:14 +00:00
|
|
|
|
2016-06-17 12:59:59 +00:00
|
|
|
bbio = BIO_new(BIO_f_buffer());
|
|
|
|
if (bbio == NULL || !BIO_set_read_buffer_size(bbio, 1)) {
|
|
|
|
BIO_free(bbio);
|
2015-01-22 03:40:55 +00:00
|
|
|
SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB);
|
2016-05-17 11:28:14 +00:00
|
|
|
return 0;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2016-06-17 12:59:59 +00:00
|
|
|
s->bbio = bbio;
|
|
|
|
s->wbio = BIO_push(bbio, s->wbio);
|
2016-05-17 11:28:14 +00:00
|
|
|
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
2017-05-22 11:33:42 +00:00
|
|
|
int ssl_free_wbio_buffer(SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2015-04-11 14:22:36 +00:00
|
|
|
/* callers ensure s is never null */
|
2015-01-22 03:40:55 +00:00
|
|
|
if (s->bbio == NULL)
|
2017-05-22 11:33:42 +00:00
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
2016-06-17 12:59:59 +00:00
|
|
|
s->wbio = BIO_pop(s->wbio);
|
2015-01-22 03:40:55 +00:00
|
|
|
BIO_free(s->bbio);
|
|
|
|
s->bbio = NULL;
|
2017-05-22 11:33:42 +00:00
|
|
|
|
|
|
|
return 1;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
|
|
|
|
{
|
|
|
|
ctx->quiet_shutdown = mode;
|
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->quiet_shutdown;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_set_quiet_shutdown(SSL *s, int mode)
|
|
|
|
{
|
|
|
|
s->quiet_shutdown = mode;
|
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_quiet_shutdown(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->quiet_shutdown;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_set_shutdown(SSL *s, int mode)
|
|
|
|
{
|
|
|
|
s->shutdown = mode;
|
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_get_shutdown(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-05-09 11:58:01 +00:00
|
|
|
return s->shutdown;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_version(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-05-09 11:58:01 +00:00
|
|
|
return s->version;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_client_version(const SSL *s)
|
|
|
|
{
|
|
|
|
return s->client_version;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2016-05-09 11:58:01 +00:00
|
|
|
return ssl->ctx;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
|
|
|
|
{
|
2015-03-18 18:02:50 +00:00
|
|
|
CERT *new_cert;
|
2015-01-22 03:40:55 +00:00
|
|
|
if (ssl->ctx == ctx)
|
|
|
|
return ssl->ctx;
|
|
|
|
if (ctx == NULL)
|
2017-01-31 20:32:50 +00:00
|
|
|
ctx = ssl->session_ctx;
|
2015-03-18 18:02:50 +00:00
|
|
|
new_cert = ssl_cert_dup(ctx->cert);
|
|
|
|
if (new_cert == NULL) {
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2017-05-10 10:28:53 +00:00
|
|
|
|
|
|
|
if (!custom_exts_copy_flags(&new_cert->custext, &ssl->cert->custext)) {
|
|
|
|
ssl_cert_free(new_cert);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2015-03-18 18:02:50 +00:00
|
|
|
ssl_cert_free(ssl->cert);
|
|
|
|
ssl->cert = new_cert;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH),
|
|
|
|
* so setter APIs must prevent invalid lengths from entering the system.
|
|
|
|
*/
|
2017-05-19 08:35:19 +00:00
|
|
|
if (!ossl_assert(ssl->sid_ctx_length <= sizeof(ssl->sid_ctx)))
|
|
|
|
return NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If the session ID context matches that of the parent SSL_CTX,
|
|
|
|
* inherit it from the new SSL_CTX as well. If however the context does
|
|
|
|
* not match (i.e., it was set per-ssl with SSL_set_session_id_context),
|
|
|
|
* leave it unchanged.
|
|
|
|
*/
|
|
|
|
if ((ssl->ctx != NULL) &&
|
|
|
|
(ssl->sid_ctx_length == ssl->ctx->sid_ctx_length) &&
|
|
|
|
(memcmp(ssl->sid_ctx, ssl->ctx->sid_ctx, ssl->sid_ctx_length) == 0)) {
|
|
|
|
ssl->sid_ctx_length = ctx->sid_ctx_length;
|
|
|
|
memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
|
|
|
|
}
|
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
SSL_CTX_up_ref(ctx);
|
2016-08-05 17:03:17 +00:00
|
|
|
SSL_CTX_free(ssl->ctx); /* decrement reference count */
|
2015-01-22 03:40:55 +00:00
|
|
|
ssl->ctx = ctx;
|
|
|
|
|
2016-02-29 17:26:07 +00:00
|
|
|
return ssl->ctx;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2006-01-02 23:14:37 +00:00
|
|
|
|
1999-02-28 12:41:50 +00:00
|
|
|
int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return X509_STORE_set_default_paths(ctx->cert_store);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2015-09-22 15:50:32 +00:00
|
|
|
int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
X509_LOOKUP *lookup;
|
|
|
|
|
|
|
|
lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir());
|
|
|
|
if (lookup == NULL)
|
|
|
|
return 0;
|
|
|
|
X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
|
|
|
|
|
|
|
|
/* Clear any errors if the default directory does not exist */
|
|
|
|
ERR_clear_error();
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_CTX_set_default_verify_file(SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
X509_LOOKUP *lookup;
|
|
|
|
|
|
|
|
lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file());
|
|
|
|
if (lookup == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
|
|
|
|
|
|
|
|
/* Clear any errors if the default file does not exist */
|
|
|
|
ERR_clear_error();
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
1999-05-09 10:12:10 +00:00
|
|
|
int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
|
2015-01-22 03:40:55 +00:00
|
|
|
const char *CApath)
|
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return X509_STORE_load_locations(ctx->cert_store, CAfile, CApath);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2002-01-12 15:56:13 +00:00
|
|
|
void SSL_set_info_callback(SSL *ssl,
|
2015-01-22 03:40:55 +00:00
|
|
|
void (*cb) (const SSL *ssl, int type, int val))
|
|
|
|
{
|
|
|
|
ssl->info_callback = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* One compiler (Diab DCC) doesn't like argument names in returned function
|
|
|
|
* pointer.
|
|
|
|
*/
|
|
|
|
void (*SSL_get_info_callback(const SSL *ssl)) (const SSL * /* ssl */ ,
|
|
|
|
int /* type */ ,
|
|
|
|
int /* val */ ) {
|
|
|
|
return ssl->info_callback;
|
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_set_verify_result(SSL *ssl, long arg)
|
|
|
|
{
|
|
|
|
ssl->verify_result = arg;
|
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
long SSL_get_verify_result(const SSL *ssl)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return ssl->verify_result;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
2015-05-28 15:36:51 +00:00
|
|
|
size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen)
|
2015-05-25 21:12:49 +00:00
|
|
|
{
|
2015-05-28 10:12:54 +00:00
|
|
|
if (outlen == 0)
|
2015-05-25 21:12:49 +00:00
|
|
|
return sizeof(ssl->s3->client_random);
|
|
|
|
if (outlen > sizeof(ssl->s3->client_random))
|
|
|
|
outlen = sizeof(ssl->s3->client_random);
|
|
|
|
memcpy(out, ssl->s3->client_random, outlen);
|
2015-05-28 15:36:51 +00:00
|
|
|
return outlen;
|
2015-05-25 21:12:49 +00:00
|
|
|
}
|
|
|
|
|
2015-05-28 15:36:51 +00:00
|
|
|
size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen)
|
2015-05-25 21:12:49 +00:00
|
|
|
{
|
2015-05-28 10:12:54 +00:00
|
|
|
if (outlen == 0)
|
2015-05-25 21:12:49 +00:00
|
|
|
return sizeof(ssl->s3->server_random);
|
|
|
|
if (outlen > sizeof(ssl->s3->server_random))
|
|
|
|
outlen = sizeof(ssl->s3->server_random);
|
|
|
|
memcpy(out, ssl->s3->server_random, outlen);
|
2015-05-28 15:36:51 +00:00
|
|
|
return outlen;
|
2015-05-25 21:12:49 +00:00
|
|
|
}
|
|
|
|
|
2015-05-28 15:36:51 +00:00
|
|
|
size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
|
2016-08-05 17:03:17 +00:00
|
|
|
unsigned char *out, size_t outlen)
|
2015-05-25 21:12:49 +00:00
|
|
|
{
|
2015-05-28 15:36:51 +00:00
|
|
|
if (outlen == 0)
|
|
|
|
return session->master_key_length;
|
2016-10-03 22:22:07 +00:00
|
|
|
if (outlen > session->master_key_length)
|
2015-05-25 21:12:49 +00:00
|
|
|
outlen = session->master_key_length;
|
|
|
|
memcpy(out, session->master_key, outlen);
|
2015-05-28 15:36:51 +00:00
|
|
|
return outlen;
|
2015-05-25 21:12:49 +00:00
|
|
|
}
|
|
|
|
|
2017-06-20 13:24:39 +00:00
|
|
|
int SSL_SESSION_set1_master_key(SSL_SESSION *sess, const unsigned char *in,
|
2017-06-12 17:38:30 +00:00
|
|
|
size_t len)
|
|
|
|
{
|
|
|
|
if (len > sizeof(sess->master_key))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
memcpy(sess->master_key, in, len);
|
|
|
|
sess->master_key_length = len;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
int SSL_set_ex_data(SSL *s, int idx, void *arg)
|
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void *SSL_get_ex_data(const SSL *s, int idx)
|
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return CRYPTO_get_ex_data(&s->ex_data, idx);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
|
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
|
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return CRYPTO_get_ex_data(&s->ex_data, idx);
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
1998-12-21 10:56:39 +00:00
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return ctx->cert_store;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store)
|
|
|
|
{
|
2015-04-30 21:33:59 +00:00
|
|
|
X509_STORE_free(ctx->cert_store);
|
2015-01-22 03:40:55 +00:00
|
|
|
ctx->cert_store = store;
|
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
2015-03-31 20:20:03 +00:00
|
|
|
void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store)
|
|
|
|
{
|
|
|
|
if (store != NULL)
|
|
|
|
X509_STORE_up_ref(store);
|
|
|
|
SSL_CTX_set_cert_store(ctx, store);
|
|
|
|
}
|
|
|
|
|
2005-03-30 10:26:02 +00:00
|
|
|
int SSL_want(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->rwstate;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
Updates to the new SSL compression code
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Fix so that the version number in the master secret, when passed
via RSA, checks that if TLS was proposed, but we roll back to SSLv3
(because the server will not accept higher), that the version number
is 0x03,0x01, not 0x03,0x00
[Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
Submitted by:
Reviewed by:
PR:
1999-02-16 09:22:21 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/**
|
1999-02-28 12:41:50 +00:00
|
|
|
* \brief Set the callback for generating temporary DH keys.
|
|
|
|
* \param ctx the SSL context.
|
|
|
|
* \param dh the callback
|
|
|
|
*/
|
|
|
|
|
2001-02-20 08:13:47 +00:00
|
|
|
#ifndef OPENSSL_NO_DH
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,
|
|
|
|
DH *(*dh) (SSL *ssl, int is_export,
|
|
|
|
int keylength))
|
|
|
|
{
|
|
|
|
SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_DH_CB, (void (*)(void))dh);
|
|
|
|
}
|
1999-01-06 22:53:34 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_set_tmp_dh_callback(SSL *ssl, DH *(*dh) (SSL *ssl, int is_export,
|
|
|
|
int keylength))
|
|
|
|
{
|
|
|
|
SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_DH_CB, (void (*)(void))dh);
|
|
|
|
}
|
1999-04-27 03:19:12 +00:00
|
|
|
#endif
|
1999-02-25 14:40:29 +00:00
|
|
|
|
2006-03-10 23:06:27 +00:00
|
|
|
#ifndef OPENSSL_NO_PSK
|
|
|
|
int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
|
2016-08-05 17:03:17 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
|
2015-01-22 03:40:55 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2015-09-14 16:58:04 +00:00
|
|
|
OPENSSL_free(ctx->cert->psk_identity_hint);
|
2015-01-22 03:40:55 +00:00
|
|
|
if (identity_hint != NULL) {
|
Rename some BUF_xxx to OPENSSL_xxx
Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen}
to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen}
Add #define's for the old names.
Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-12-16 21:12:24 +00:00
|
|
|
ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
|
2015-09-14 16:58:04 +00:00
|
|
|
if (ctx->cert->psk_identity_hint == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
return 0;
|
|
|
|
} else
|
2015-09-14 16:58:04 +00:00
|
|
|
ctx->cert->psk_identity_hint = NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2006-03-10 23:06:27 +00:00
|
|
|
|
|
|
|
int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
|
|
|
|
SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
|
|
|
|
return 0;
|
|
|
|
}
|
2015-09-14 16:58:04 +00:00
|
|
|
OPENSSL_free(s->cert->psk_identity_hint);
|
2015-01-22 03:40:55 +00:00
|
|
|
if (identity_hint != NULL) {
|
Rename some BUF_xxx to OPENSSL_xxx
Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen}
to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen}
Add #define's for the old names.
Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-12-16 21:12:24 +00:00
|
|
|
s->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
|
2015-09-14 16:58:04 +00:00
|
|
|
if (s->cert->psk_identity_hint == NULL)
|
2015-01-22 03:40:55 +00:00
|
|
|
return 0;
|
|
|
|
} else
|
2015-09-14 16:58:04 +00:00
|
|
|
s->cert->psk_identity_hint = NULL;
|
2015-01-22 03:40:55 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2006-03-10 23:06:27 +00:00
|
|
|
|
|
|
|
const char *SSL_get_psk_identity_hint(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s == NULL || s->session == NULL)
|
|
|
|
return NULL;
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->session->psk_identity_hint;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2006-03-10 23:06:27 +00:00
|
|
|
|
|
|
|
const char *SSL_get_psk_identity(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
if (s == NULL || s->session == NULL)
|
|
|
|
return NULL;
|
2017-10-17 14:04:09 +00:00
|
|
|
return s->session->psk_identity;
|
2015-01-22 03:40:55 +00:00
|
|
|
}
|
2006-11-29 20:54:57 +00:00
|
|
|
|
2016-12-11 20:01:28 +00:00
|
|
|
void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->psk_client_callback = cb;
|
|
|
|
}
|
2006-11-29 20:54:57 +00:00
|
|
|
|
2016-12-11 20:01:28 +00:00
|
|
|
void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ctx->psk_client_callback = cb;
|
|
|
|
}
|
2006-11-29 20:54:57 +00:00
|
|
|
|
2016-12-11 20:01:28 +00:00
|
|
|
void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->psk_server_callback = cb;
|
|
|
|
}
|
2006-11-29 20:54:57 +00:00
|
|
|
|
2016-12-11 20:01:28 +00:00
|
|
|
void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ctx->psk_server_callback = cb;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2017-06-12 14:59:00 +00:00
|
|
|
void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb)
|
|
|
|
{
|
|
|
|
s->psk_find_session_cb = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx,
|
|
|
|
SSL_psk_find_session_cb_func cb)
|
|
|
|
{
|
|
|
|
ctx->psk_find_session_cb = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb)
|
|
|
|
{
|
|
|
|
s->psk_use_session_cb = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx,
|
|
|
|
SSL_psk_use_session_cb_func cb)
|
|
|
|
{
|
|
|
|
ctx->psk_use_session_cb = cb;
|
|
|
|
}
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
|
|
|
|
void (*cb) (int write_p, int version,
|
|
|
|
int content_type, const void *buf,
|
|
|
|
size_t len, SSL *ssl, void *arg))
|
|
|
|
{
|
|
|
|
SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_msg_callback(SSL *ssl,
|
|
|
|
void (*cb) (int write_p, int version,
|
|
|
|
int content_type, const void *buf,
|
|
|
|
size_t len, SSL *ssl, void *arg))
|
|
|
|
{
|
|
|
|
SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
|
|
|
|
}
|
2001-10-20 17:56:36 +00:00
|
|
|
|
2010-08-26 15:15:47 +00:00
|
|
|
void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,
|
2015-01-22 03:40:55 +00:00
|
|
|
int (*cb) (SSL *ssl,
|
|
|
|
int
|
|
|
|
is_forward_secure))
|
|
|
|
{
|
|
|
|
SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
|
|
|
|
(void (*)(void))cb);
|
|
|
|
}
|
|
|
|
|
2010-08-26 15:15:47 +00:00
|
|
|
void SSL_set_not_resumable_session_callback(SSL *ssl,
|
2015-01-22 03:40:55 +00:00
|
|
|
int (*cb) (SSL *ssl,
|
|
|
|
int is_forward_secure))
|
|
|
|
{
|
|
|
|
SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
|
|
|
|
(void (*)(void))cb);
|
|
|
|
}
|
|
|
|
|
2017-04-05 16:35:25 +00:00
|
|
|
void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,
|
|
|
|
size_t (*cb) (SSL *ssl, int type,
|
|
|
|
size_t len, void *arg))
|
|
|
|
{
|
|
|
|
ctx->record_padding_cb = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg)
|
|
|
|
{
|
|
|
|
ctx->record_padding_arg = arg;
|
|
|
|
}
|
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx)
|
2017-04-05 16:35:25 +00:00
|
|
|
{
|
|
|
|
return ctx->record_padding_arg;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
|
|
|
|
{
|
|
|
|
/* block size of 0 or 1 is basically no padding */
|
|
|
|
if (block_size == 1)
|
|
|
|
ctx->block_padding = 0;
|
|
|
|
else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
|
|
|
|
ctx->block_padding = block_size;
|
|
|
|
else
|
|
|
|
return 0;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_record_padding_callback(SSL *ssl,
|
|
|
|
size_t (*cb) (SSL *ssl, int type,
|
|
|
|
size_t len, void *arg))
|
|
|
|
{
|
|
|
|
ssl->record_padding_cb = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg)
|
|
|
|
{
|
|
|
|
ssl->record_padding_arg = arg;
|
|
|
|
}
|
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
void *SSL_get_record_padding_callback_arg(const SSL *ssl)
|
2017-04-05 16:35:25 +00:00
|
|
|
{
|
|
|
|
return ssl->record_padding_arg;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_set_block_padding(SSL *ssl, size_t block_size)
|
|
|
|
{
|
|
|
|
/* block size of 0 or 1 is basically no padding */
|
|
|
|
if (block_size == 1)
|
|
|
|
ssl->block_padding = 0;
|
|
|
|
else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
|
|
|
|
ssl->block_padding = block_size;
|
|
|
|
else
|
|
|
|
return 0;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2018-01-31 17:26:46 +00:00
|
|
|
int SSL_set_num_tickets(SSL *s, size_t num_tickets)
|
|
|
|
{
|
|
|
|
s->num_tickets = num_tickets;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
size_t SSL_get_num_tickets(const SSL *s)
|
2018-01-31 17:26:46 +00:00
|
|
|
{
|
|
|
|
return s->num_tickets;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets)
|
|
|
|
{
|
|
|
|
ctx->num_tickets = num_tickets;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2019-02-01 23:06:26 +00:00
|
|
|
size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx)
|
2018-01-31 17:26:46 +00:00
|
|
|
{
|
|
|
|
return ctx->num_tickets;
|
|
|
|
}
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
/*
|
|
|
|
* Allocates new EVP_MD_CTX and sets pointer to it into given pointer
|
2016-03-10 20:34:48 +00:00
|
|
|
* variable, freeing EVP_MD_CTX previously stored in that variable, if any.
|
2017-03-28 21:57:28 +00:00
|
|
|
* If EVP_MD pointer is passed, initializes ctx with this |md|.
|
2016-11-17 22:55:43 +00:00
|
|
|
* Returns the newly allocated ctx;
|
2008-06-03 02:48:34 +00:00
|
|
|
*/
|
2007-06-04 17:04:40 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
|
2007-06-04 17:04:40 +00:00
|
|
|
{
|
2015-01-22 03:40:55 +00:00
|
|
|
ssl_clear_hash_ctx(hash);
|
2015-12-01 23:49:35 +00:00
|
|
|
*hash = EVP_MD_CTX_new();
|
2015-11-06 16:31:21 +00:00
|
|
|
if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {
|
2015-12-01 23:49:35 +00:00
|
|
|
EVP_MD_CTX_free(*hash);
|
2015-11-06 16:31:21 +00:00
|
|
|
*hash = NULL;
|
|
|
|
return NULL;
|
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
return *hash;
|
2007-06-04 17:04:40 +00:00
|
|
|
}
|
2015-01-22 03:40:55 +00:00
|
|
|
|
|
|
|
void ssl_clear_hash_ctx(EVP_MD_CTX **hash)
|
2007-06-04 17:04:40 +00:00
|
|
|
{
|
|
|
|
|
2016-11-08 23:20:31 +00:00
|
|
|
EVP_MD_CTX_free(*hash);
|
2015-01-22 03:40:55 +00:00
|
|
|
*hash = NULL;
|
2007-06-04 17:04:40 +00:00
|
|
|
}
|
2001-10-20 17:56:36 +00:00
|
|
|
|
2015-01-23 02:37:27 +00:00
|
|
|
/* Retrieve handshake hashes */
|
2016-10-03 22:22:07 +00:00
|
|
|
int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
|
|
|
|
size_t *hashlen)
|
2015-01-23 02:37:27 +00:00
|
|
|
{
|
2015-11-27 13:02:12 +00:00
|
|
|
EVP_MD_CTX *ctx = NULL;
|
2015-11-25 18:20:50 +00:00
|
|
|
EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
|
2016-10-03 22:22:07 +00:00
|
|
|
int hashleni = EVP_MD_CTX_size(hdgst);
|
|
|
|
int ret = 0;
|
|
|
|
|
2017-11-21 17:18:43 +00:00
|
|
|
if (hashleni < 0 || (size_t)hashleni > outlen) {
|
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
|
|
|
|
ERR_R_INTERNAL_ERROR);
|
2015-11-25 18:20:50 +00:00
|
|
|
goto err;
|
2017-11-21 17:18:43 +00:00
|
|
|
}
|
2016-10-03 22:22:07 +00:00
|
|
|
|
2015-12-01 23:49:35 +00:00
|
|
|
ctx = EVP_MD_CTX_new();
|
2016-10-03 22:22:07 +00:00
|
|
|
if (ctx == NULL)
|
2015-11-27 13:02:12 +00:00
|
|
|
goto err;
|
2016-10-03 22:22:07 +00:00
|
|
|
|
2015-11-27 13:02:12 +00:00
|
|
|
if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
|
2017-11-21 17:18:43 +00:00
|
|
|
|| EVP_DigestFinal_ex(ctx, out, NULL) <= 0) {
|
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
|
|
|
|
ERR_R_INTERNAL_ERROR);
|
2016-10-03 22:22:07 +00:00
|
|
|
goto err;
|
2017-11-21 17:18:43 +00:00
|
|
|
}
|
2016-10-03 22:22:07 +00:00
|
|
|
|
|
|
|
*hashlen = hashleni;
|
|
|
|
|
|
|
|
ret = 1;
|
2015-01-23 02:37:27 +00:00
|
|
|
err:
|
2015-12-01 23:49:35 +00:00
|
|
|
EVP_MD_CTX_free(ctx);
|
2015-01-23 02:37:27 +00:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2019-05-17 10:35:33 +00:00
|
|
|
int SSL_session_reused(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return s->hit;
|
|
|
|
}
|
2011-04-29 22:37:12 +00:00
|
|
|
|
2017-05-02 10:00:50 +00:00
|
|
|
int SSL_is_server(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return s->server;
|
|
|
|
}
|
2012-07-03 14:25:17 +00:00
|
|
|
|
2016-01-14 17:16:00 +00:00
|
|
|
#if OPENSSL_API_COMPAT < 0x10100000L
|
|
|
|
void SSL_set_debug(SSL *s, int debug)
|
|
|
|
{
|
|
|
|
/* Old function was do-nothing anyway... */
|
|
|
|
(void)s;
|
|
|
|
(void)debug;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2013-12-15 13:32:24 +00:00
|
|
|
void SSL_set_security_level(SSL *s, int level)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->cert->sec_level = level;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
int SSL_get_security_level(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return s->cert->sec_level;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_set_security_callback(SSL *s,
|
2016-08-05 17:03:17 +00:00
|
|
|
int (*cb) (const SSL *s, const SSL_CTX *ctx,
|
|
|
|
int op, int bits, int nid,
|
|
|
|
void *other, void *ex))
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->cert->sec_cb = cb;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
int (*SSL_get_security_callback(const SSL *s)) (const SSL *s,
|
|
|
|
const SSL_CTX *ctx, int op,
|
|
|
|
int bits, int nid, void *other,
|
|
|
|
void *ex) {
|
2015-01-22 03:40:55 +00:00
|
|
|
return s->cert->sec_cb;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
void SSL_set0_security_ex_data(SSL *s, void *ex)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
s->cert->sec_ex = ex;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
void *SSL_get0_security_ex_data(const SSL *s)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return s->cert->sec_ex;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
void SSL_CTX_set_security_level(SSL_CTX *ctx, int level)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ctx->cert->sec_level = level;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
int SSL_CTX_get_security_level(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return ctx->cert->sec_level;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
void SSL_CTX_set_security_callback(SSL_CTX *ctx,
|
2016-08-05 17:03:17 +00:00
|
|
|
int (*cb) (const SSL *s, const SSL_CTX *ctx,
|
|
|
|
int op, int bits, int nid,
|
|
|
|
void *other, void *ex))
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ctx->cert->sec_cb = cb;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
2016-02-07 19:44:27 +00:00
|
|
|
int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s,
|
|
|
|
const SSL_CTX *ctx,
|
2015-01-22 03:40:55 +00:00
|
|
|
int op, int bits,
|
|
|
|
int nid,
|
|
|
|
void *other,
|
|
|
|
void *ex) {
|
|
|
|
return ctx->cert->sec_cb;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
ctx->cert->sec_ex = ex;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
|
|
|
void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx)
|
2015-01-22 03:40:55 +00:00
|
|
|
{
|
|
|
|
return ctx->cert->sec_ex;
|
|
|
|
}
|
2013-12-15 13:32:24 +00:00
|
|
|
|
2016-01-11 01:15:04 +00:00
|
|
|
/*
|
|
|
|
* Get/Set/Clear options in SSL_CTX or SSL, formerly macros, now functions that
|
|
|
|
* can return unsigned long, instead of the generic long return value from the
|
|
|
|
* control interface.
|
|
|
|
*/
|
|
|
|
unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->options;
|
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
|
|
|
|
unsigned long SSL_get_options(const SSL *s)
|
2016-01-11 01:15:04 +00:00
|
|
|
{
|
|
|
|
return s->options;
|
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
|
2016-01-11 01:15:04 +00:00
|
|
|
unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long op)
|
|
|
|
{
|
|
|
|
return ctx->options |= op;
|
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
|
2016-01-11 01:15:04 +00:00
|
|
|
unsigned long SSL_set_options(SSL *s, unsigned long op)
|
|
|
|
{
|
|
|
|
return s->options |= op;
|
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
|
2016-01-11 01:15:04 +00:00
|
|
|
unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op)
|
|
|
|
{
|
|
|
|
return ctx->options &= ~op;
|
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
|
2016-01-11 01:15:04 +00:00
|
|
|
unsigned long SSL_clear_options(SSL *s, unsigned long op)
|
|
|
|
{
|
|
|
|
return s->options &= ~op;
|
|
|
|
}
|
|
|
|
|
2016-02-06 03:17:23 +00:00
|
|
|
STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s)
|
|
|
|
{
|
|
|
|
return s->verified_chain;
|
|
|
|
}
|
|
|
|
|
2015-01-22 03:40:55 +00:00
|
|
|
IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
|
2016-03-03 16:19:23 +00:00
|
|
|
|
|
|
|
#ifndef OPENSSL_NO_CT
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Moves SCTs from the |src| stack to the |dst| stack.
|
|
|
|
* The source of each SCT will be set to |origin|.
|
|
|
|
* If |dst| points to a NULL pointer, a new stack will be created and owned by
|
|
|
|
* the caller.
|
|
|
|
* Returns the number of SCTs moved, or a negative integer if an error occurs.
|
|
|
|
*/
|
2016-08-05 17:03:17 +00:00
|
|
|
static int ct_move_scts(STACK_OF(SCT) **dst, STACK_OF(SCT) *src,
|
|
|
|
sct_source_t origin)
|
2016-03-03 16:19:23 +00:00
|
|
|
{
|
|
|
|
int scts_moved = 0;
|
|
|
|
SCT *sct = NULL;
|
|
|
|
|
|
|
|
if (*dst == NULL) {
|
|
|
|
*dst = sk_SCT_new_null();
|
|
|
|
if (*dst == NULL) {
|
|
|
|
SSLerr(SSL_F_CT_MOVE_SCTS, ERR_R_MALLOC_FAILURE);
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
while ((sct = sk_SCT_pop(src)) != NULL) {
|
|
|
|
if (SCT_set_source(sct, origin) != 1)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
if (sk_SCT_push(*dst, sct) <= 0)
|
|
|
|
goto err;
|
|
|
|
scts_moved += 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return scts_moved;
|
2016-08-05 17:03:17 +00:00
|
|
|
err:
|
2016-03-03 16:19:23 +00:00
|
|
|
if (sct != NULL)
|
2016-08-05 17:03:17 +00:00
|
|
|
sk_SCT_push(src, sct); /* Put the SCT back */
|
2016-05-27 12:37:11 +00:00
|
|
|
return -1;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2016-08-05 17:03:17 +00:00
|
|
|
* Look for data collected during ServerHello and parse if found.
|
2016-08-01 14:36:38 +00:00
|
|
|
* Returns the number of SCTs extracted.
|
2016-08-05 17:03:17 +00:00
|
|
|
*/
|
2016-03-03 16:19:23 +00:00
|
|
|
static int ct_extract_tls_extension_scts(SSL *s)
|
|
|
|
{
|
|
|
|
int scts_extracted = 0;
|
|
|
|
|
2016-12-08 19:18:40 +00:00
|
|
|
if (s->ext.scts != NULL) {
|
|
|
|
const unsigned char *p = s->ext.scts;
|
|
|
|
STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len);
|
2016-03-03 16:19:23 +00:00
|
|
|
|
|
|
|
scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION);
|
|
|
|
|
|
|
|
SCT_LIST_free(scts);
|
|
|
|
}
|
|
|
|
|
|
|
|
return scts_extracted;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Checks for an OCSP response and then attempts to extract any SCTs found if it
|
|
|
|
* contains an SCT X509 extension. They will be stored in |s->scts|.
|
|
|
|
* Returns:
|
|
|
|
* - The number of SCTs extracted, assuming an OCSP response exists.
|
|
|
|
* - 0 if no OCSP response exists or it contains no SCTs.
|
|
|
|
* - A negative integer if an error occurs.
|
|
|
|
*/
|
|
|
|
static int ct_extract_ocsp_response_scts(SSL *s)
|
|
|
|
{
|
2016-08-05 17:03:17 +00:00
|
|
|
# ifndef OPENSSL_NO_OCSP
|
2016-03-03 16:19:23 +00:00
|
|
|
int scts_extracted = 0;
|
|
|
|
const unsigned char *p;
|
|
|
|
OCSP_BASICRESP *br = NULL;
|
|
|
|
OCSP_RESPONSE *rsp = NULL;
|
|
|
|
STACK_OF(SCT) *scts = NULL;
|
|
|
|
int i;
|
|
|
|
|
2016-12-08 19:18:40 +00:00
|
|
|
if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0)
|
2016-03-03 16:19:23 +00:00
|
|
|
goto err;
|
|
|
|
|
2016-12-08 19:18:40 +00:00
|
|
|
p = s->ext.ocsp.resp;
|
|
|
|
rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len);
|
2016-03-03 16:19:23 +00:00
|
|
|
if (rsp == NULL)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
br = OCSP_response_get1_basic(rsp);
|
|
|
|
if (br == NULL)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
for (i = 0; i < OCSP_resp_count(br); ++i) {
|
|
|
|
OCSP_SINGLERESP *single = OCSP_resp_get0(br, i);
|
|
|
|
|
|
|
|
if (single == NULL)
|
|
|
|
continue;
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
scts =
|
|
|
|
OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL);
|
|
|
|
scts_extracted =
|
|
|
|
ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE);
|
2016-03-03 16:19:23 +00:00
|
|
|
if (scts_extracted < 0)
|
|
|
|
goto err;
|
|
|
|
}
|
2016-08-05 17:03:17 +00:00
|
|
|
err:
|
2016-03-03 16:19:23 +00:00
|
|
|
SCT_LIST_free(scts);
|
|
|
|
OCSP_BASICRESP_free(br);
|
|
|
|
OCSP_RESPONSE_free(rsp);
|
|
|
|
return scts_extracted;
|
2016-08-05 17:03:17 +00:00
|
|
|
# else
|
2016-03-21 16:54:53 +00:00
|
|
|
/* Behave as if no OCSP response exists */
|
|
|
|
return 0;
|
2016-08-05 17:03:17 +00:00
|
|
|
# endif
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Attempts to extract SCTs from the peer certificate.
|
|
|
|
* Return the number of SCTs extracted, or a negative integer if an error
|
|
|
|
* occurs.
|
|
|
|
*/
|
|
|
|
static int ct_extract_x509v3_extension_scts(SSL *s)
|
|
|
|
{
|
|
|
|
int scts_extracted = 0;
|
2016-03-07 18:05:53 +00:00
|
|
|
X509 *cert = s->session != NULL ? s->session->peer : NULL;
|
2016-03-03 16:19:23 +00:00
|
|
|
|
|
|
|
if (cert != NULL) {
|
|
|
|
STACK_OF(SCT) *scts =
|
|
|
|
X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL);
|
|
|
|
|
|
|
|
scts_extracted =
|
|
|
|
ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION);
|
|
|
|
|
|
|
|
SCT_LIST_free(scts);
|
|
|
|
}
|
|
|
|
|
|
|
|
return scts_extracted;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Attempts to find all received SCTs by checking TLS extensions, the OCSP
|
|
|
|
* response (if it exists) and X509v3 extensions in the certificate.
|
|
|
|
* Returns NULL if an error occurs.
|
|
|
|
*/
|
|
|
|
const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s)
|
|
|
|
{
|
|
|
|
if (!s->scts_parsed) {
|
|
|
|
if (ct_extract_tls_extension_scts(s) < 0 ||
|
|
|
|
ct_extract_ocsp_response_scts(s) < 0 ||
|
|
|
|
ct_extract_x509v3_extension_scts(s) < 0)
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
s->scts_parsed = 1;
|
|
|
|
}
|
|
|
|
return s->scts;
|
2016-08-05 17:03:17 +00:00
|
|
|
err:
|
2016-03-03 16:19:23 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
static int ct_permissive(const CT_POLICY_EVAL_CTX * ctx,
|
2016-04-07 18:17:37 +00:00
|
|
|
const STACK_OF(SCT) *scts, void *unused_arg)
|
2016-03-03 16:19:23 +00:00
|
|
|
{
|
2016-04-07 18:17:37 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
static int ct_strict(const CT_POLICY_EVAL_CTX * ctx,
|
2016-04-07 18:17:37 +00:00
|
|
|
const STACK_OF(SCT) *scts, void *unused_arg)
|
|
|
|
{
|
|
|
|
int count = scts != NULL ? sk_SCT_num(scts) : 0;
|
|
|
|
int i;
|
2016-03-03 16:19:23 +00:00
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
for (i = 0; i < count; ++i) {
|
|
|
|
SCT *sct = sk_SCT_value(scts, i);
|
|
|
|
int status = SCT_get_validation_status(sct);
|
|
|
|
|
|
|
|
if (status == SCT_VALIDATION_STATUS_VALID)
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
SSLerr(SSL_F_CT_STRICT, SSL_R_NO_VALID_SCTS);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,
|
|
|
|
void *arg)
|
|
|
|
{
|
2016-03-03 16:19:23 +00:00
|
|
|
/*
|
|
|
|
* Since code exists that uses the custom extension handler for CT, look
|
|
|
|
* for this and throw an error if they have already registered to use CT.
|
|
|
|
*/
|
|
|
|
if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx,
|
2016-08-05 17:03:17 +00:00
|
|
|
TLSEXT_TYPE_signed_certificate_timestamp))
|
|
|
|
{
|
2016-03-03 16:19:23 +00:00
|
|
|
SSLerr(SSL_F_SSL_SET_CT_VALIDATION_CALLBACK,
|
|
|
|
SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
|
2016-04-07 18:17:37 +00:00
|
|
|
return 0;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (callback != NULL) {
|
2016-08-05 17:03:17 +00:00
|
|
|
/*
|
|
|
|
* If we are validating CT, then we MUST accept SCTs served via OCSP
|
|
|
|
*/
|
2016-03-03 16:19:23 +00:00
|
|
|
if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp))
|
2016-04-07 18:17:37 +00:00
|
|
|
return 0;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
s->ct_validation_callback = callback;
|
|
|
|
s->ct_validation_callback_arg = arg;
|
|
|
|
|
|
|
|
return 1;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,
|
2016-08-05 17:03:17 +00:00
|
|
|
ssl_ct_validation_cb callback, void *arg)
|
2016-03-03 16:19:23 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Since code exists that uses the custom extension handler for CT, look for
|
|
|
|
* this and throw an error if they have already registered to use CT.
|
|
|
|
*/
|
|
|
|
if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx,
|
2016-08-05 17:03:17 +00:00
|
|
|
TLSEXT_TYPE_signed_certificate_timestamp))
|
|
|
|
{
|
2016-03-03 16:19:23 +00:00
|
|
|
SSLerr(SSL_F_SSL_CTX_SET_CT_VALIDATION_CALLBACK,
|
|
|
|
SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
|
2016-04-07 18:17:37 +00:00
|
|
|
return 0;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
ctx->ct_validation_callback = callback;
|
|
|
|
ctx->ct_validation_callback_arg = arg;
|
2016-04-07 18:17:37 +00:00
|
|
|
return 1;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
int SSL_ct_is_enabled(const SSL *s)
|
2016-03-03 16:19:23 +00:00
|
|
|
{
|
2016-04-07 18:17:37 +00:00
|
|
|
return s->ct_validation_callback != NULL;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx)
|
2016-03-03 16:19:23 +00:00
|
|
|
{
|
2016-04-07 18:17:37 +00:00
|
|
|
return ctx->ct_validation_callback != NULL;
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
2016-03-07 18:03:34 +00:00
|
|
|
int ssl_validate_ct(SSL *s)
|
2016-03-03 16:19:23 +00:00
|
|
|
{
|
|
|
|
int ret = 0;
|
2016-03-07 18:05:53 +00:00
|
|
|
X509 *cert = s->session != NULL ? s->session->peer : NULL;
|
2016-04-07 18:17:37 +00:00
|
|
|
X509 *issuer;
|
2016-04-08 13:10:06 +00:00
|
|
|
SSL_DANE *dane = &s->dane;
|
2016-03-03 16:19:23 +00:00
|
|
|
CT_POLICY_EVAL_CTX *ctx = NULL;
|
|
|
|
const STACK_OF(SCT) *scts;
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
/*
|
|
|
|
* If no callback is set, the peer is anonymous, or its chain is invalid,
|
|
|
|
* skip SCT validation - just return success. Applications that continue
|
|
|
|
* handshakes without certificates, with unverified chains, or pinned leaf
|
|
|
|
* certificates are outside the scope of the WebPKI and CT.
|
|
|
|
*
|
|
|
|
* The above exclusions notwithstanding the vast majority of peers will
|
|
|
|
* have rather ordinary certificate chains validated by typical
|
|
|
|
* applications that perform certificate verification and therefore will
|
|
|
|
* process SCTs when enabled.
|
|
|
|
*/
|
|
|
|
if (s->ct_validation_callback == NULL || cert == NULL ||
|
|
|
|
s->verify_result != X509_V_OK ||
|
2016-08-05 17:03:17 +00:00
|
|
|
s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1)
|
2016-03-03 16:19:23 +00:00
|
|
|
return 1;
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
/*
|
|
|
|
* CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3)
|
|
|
|
* trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2
|
|
|
|
*/
|
|
|
|
if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {
|
|
|
|
switch (dane->mtlsa->usage) {
|
|
|
|
case DANETLS_USAGE_DANE_TA:
|
|
|
|
case DANETLS_USAGE_DANE_EE:
|
|
|
|
return 1;
|
|
|
|
}
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
ctx = CT_POLICY_EVAL_CTX_new();
|
|
|
|
if (ctx == NULL) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_VALIDATE_CT,
|
|
|
|
ERR_R_MALLOC_FAILURE);
|
2016-03-03 16:19:23 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
issuer = sk_X509_value(s->verified_chain, 1);
|
2016-08-05 13:17:31 +00:00
|
|
|
CT_POLICY_EVAL_CTX_set1_cert(ctx, cert);
|
|
|
|
CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer);
|
|
|
|
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, s->ctx->ctlog_store);
|
2017-04-04 22:24:28 +00:00
|
|
|
CT_POLICY_EVAL_CTX_set_time(
|
|
|
|
ctx, (uint64_t)SSL_SESSION_get_time(SSL_get0_session(s)) * 1000);
|
2016-03-03 16:19:23 +00:00
|
|
|
|
|
|
|
scts = SSL_get0_peer_scts(s);
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
/*
|
|
|
|
* This function returns success (> 0) only when all the SCTs are valid, 0
|
|
|
|
* when some are invalid, and < 0 on various internal errors (out of
|
|
|
|
* memory, etc.). Having some, or even all, invalid SCTs is not sufficient
|
|
|
|
* reason to abort the handshake, that decision is up to the callback.
|
|
|
|
* Therefore, we error out only in the unexpected case that the return
|
|
|
|
* value is negative.
|
|
|
|
*
|
|
|
|
* XXX: One might well argue that the return value of this function is an
|
2016-06-19 17:39:01 +00:00
|
|
|
* unfortunate design choice. Its job is only to determine the validation
|
2016-04-07 18:17:37 +00:00
|
|
|
* status of each of the provided SCTs. So long as it correctly separates
|
|
|
|
* the wheat from the chaff it should return success. Failure in this case
|
|
|
|
* ought to correspond to an inability to carry out its duties.
|
|
|
|
*/
|
|
|
|
if (SCT_LIST_validate(scts, ctx) < 0) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT,
|
|
|
|
SSL_R_SCT_VERIFICATION_FAILED);
|
2016-03-03 16:19:23 +00:00
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg);
|
|
|
|
if (ret < 0)
|
2016-08-05 17:03:17 +00:00
|
|
|
ret = 0; /* This function returns 0 on failure */
|
2017-11-21 17:18:43 +00:00
|
|
|
if (!ret)
|
|
|
|
SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT,
|
|
|
|
SSL_R_CALLBACK_FAILED);
|
2016-03-03 16:19:23 +00:00
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
end:
|
2016-03-03 16:19:23 +00:00
|
|
|
CT_POLICY_EVAL_CTX_free(ctx);
|
2016-05-13 04:36:56 +00:00
|
|
|
/*
|
|
|
|
* With SSL_VERIFY_NONE the session may be cached and re-used despite a
|
|
|
|
* failure return code here. Also the application may wish the complete
|
|
|
|
* the handshake, and then disconnect cleanly at a higher layer, after
|
|
|
|
* checking the verification status of the completed connection.
|
|
|
|
*
|
|
|
|
* We therefore force a certificate verification failure which will be
|
|
|
|
* visible via SSL_get_verify_result() and cached as part of any resumed
|
|
|
|
* session.
|
|
|
|
*
|
|
|
|
* Note: the permissive callback is for information gathering only, always
|
|
|
|
* returns success, and does not affect verification status. Only the
|
|
|
|
* strict callback or a custom application-specified callback can trigger
|
|
|
|
* connection failure or record a verification error.
|
|
|
|
*/
|
|
|
|
if (ret <= 0)
|
|
|
|
s->verify_result = X509_V_ERR_NO_VALID_SCTS;
|
2016-03-03 16:19:23 +00:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2016-04-07 18:17:37 +00:00
|
|
|
int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode)
|
|
|
|
{
|
|
|
|
switch (validation_mode) {
|
|
|
|
default:
|
|
|
|
SSLerr(SSL_F_SSL_CTX_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE);
|
|
|
|
return 0;
|
|
|
|
case SSL_CT_VALIDATION_PERMISSIVE:
|
|
|
|
return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL);
|
|
|
|
case SSL_CT_VALIDATION_STRICT:
|
|
|
|
return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_enable_ct(SSL *s, int validation_mode)
|
|
|
|
{
|
|
|
|
switch (validation_mode) {
|
|
|
|
default:
|
|
|
|
SSLerr(SSL_F_SSL_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE);
|
|
|
|
return 0;
|
|
|
|
case SSL_CT_VALIDATION_PERMISSIVE:
|
|
|
|
return SSL_set_ct_validation_callback(s, ct_permissive, NULL);
|
|
|
|
case SSL_CT_VALIDATION_STRICT:
|
|
|
|
return SSL_set_ct_validation_callback(s, ct_strict, NULL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-03 16:19:23 +00:00
|
|
|
int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
|
|
|
|
{
|
2016-03-04 19:06:43 +00:00
|
|
|
return CTLOG_STORE_load_default_file(ctx->ctlog_store);
|
2016-03-03 16:19:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path)
|
|
|
|
{
|
|
|
|
return CTLOG_STORE_load_file(ctx->ctlog_store, path);
|
|
|
|
}
|
|
|
|
|
2016-08-05 17:03:17 +00:00
|
|
|
void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE * logs)
|
2016-03-10 18:17:23 +00:00
|
|
|
{
|
|
|
|
CTLOG_STORE_free(ctx->ctlog_store);
|
|
|
|
ctx->ctlog_store = logs;
|
|
|
|
}
|
|
|
|
|
|
|
|
const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->ctlog_store;
|
|
|
|
}
|
|
|
|
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
#endif /* OPENSSL_NO_CT */
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb,
|
|
|
|
void *arg)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
2017-09-07 22:39:40 +00:00
|
|
|
c->client_hello_cb = cb;
|
|
|
|
c->client_hello_cb_arg = arg;
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
int SSL_client_hello_isv2(SSL *s)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
return s->clienthello->isv2;
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
unsigned int SSL_client_hello_get0_legacy_version(SSL *s)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
return s->clienthello->legacy_version;
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
if (out != NULL)
|
|
|
|
*out = s->clienthello->random;
|
|
|
|
return SSL3_RANDOM_SIZE;
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
if (out != NULL)
|
|
|
|
*out = s->clienthello->session_id;
|
|
|
|
return s->clienthello->session_id_len;
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
if (out != NULL)
|
|
|
|
*out = PACKET_data(&s->clienthello->ciphersuites);
|
|
|
|
return PACKET_remaining(&s->clienthello->ciphersuites);
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out)
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
{
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
if (out != NULL)
|
|
|
|
*out = s->clienthello->compressions;
|
|
|
|
return s->clienthello->compressions_len;
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
|
2017-03-16 22:17:16 +00:00
|
|
|
{
|
|
|
|
RAW_EXTENSION *ext;
|
|
|
|
int *present;
|
|
|
|
size_t num = 0, i;
|
|
|
|
|
|
|
|
if (s->clienthello == NULL || out == NULL || outlen == NULL)
|
|
|
|
return 0;
|
|
|
|
for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
|
|
|
|
ext = s->clienthello->pre_proc_exts + i;
|
|
|
|
if (ext->present)
|
|
|
|
num++;
|
|
|
|
}
|
2019-04-15 16:01:58 +00:00
|
|
|
if (num == 0) {
|
|
|
|
*out = NULL;
|
|
|
|
*outlen = 0;
|
|
|
|
return 1;
|
|
|
|
}
|
2018-04-03 15:31:16 +00:00
|
|
|
if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
|
|
|
|
SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
|
|
|
|
ERR_R_MALLOC_FAILURE);
|
2017-03-16 22:17:16 +00:00
|
|
|
return 0;
|
2018-04-03 15:31:16 +00:00
|
|
|
}
|
2017-03-16 22:17:16 +00:00
|
|
|
for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
|
|
|
|
ext = s->clienthello->pre_proc_exts + i;
|
|
|
|
if (ext->present) {
|
|
|
|
if (ext->received_order >= num)
|
|
|
|
goto err;
|
|
|
|
present[ext->received_order] = ext->type;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
*out = present;
|
|
|
|
*outlen = num;
|
|
|
|
return 1;
|
|
|
|
err:
|
|
|
|
OPENSSL_free(present);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-09-07 22:39:40 +00:00
|
|
|
int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out,
|
Add SSL_CTX early callback
Provide a callback interface that gives the application the ability
to adjust the nascent SSL object at the earliest stage of ClientHello
processing, immediately after extensions have been collected but
before they have been processed.
This is akin to BoringSSL's "select_certificate_cb" (though it is not
API compatible), and as the name indicates, one major use is to examine
the supplied server name indication and select what certificate to
present to the client. However, it can also be used to make more
sweeping configuration changes to the SSL object according to the
selected server identity and configuration. That may include adjusting
the permitted TLS versions, swapping out the SSL_CTX object (as is
traditionally done in a tlsext_servername_callback), changing the
server's cipher list, and more.
We also wish to allow an early callback to indicate that it needs to perform
additional work asynchronously and resume processing later. To that effect,
refactor the second half of tls_process_client_hello() into a subroutine to be
called at the post-processing stage (including the early callback itself), to
allow the callback to result in remaining in the same work stage for a later
call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG
in the SSL object to be preserved across such calls, but the storage is
reclaimed after ClientHello processing finishes.
Information about the CliehtHello is available to the callback by means of
accessor functions that can only be used from the early callback. This allows
extensions to make use of the existing internal parsing machinery without
exposing structure internals (e.g., of PACKET), so that applications do not
have to write fragile parsing code.
Applications are encouraged to utilize an early callback and not use
a servername_callback, in order to avoid unexpected behavior that
occurs due to the relative order of processing between things like
session resumption and the historical servername callback.
Also tidy up nearby style by removing unnecessary braces around one-line
conditional bodies.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
2017-01-23 23:03:16 +00:00
|
|
|
size_t *outlen)
|
|
|
|
{
|
|
|
|
size_t i;
|
|
|
|
RAW_EXTENSION *r;
|
|
|
|
|
|
|
|
if (s->clienthello == NULL)
|
|
|
|
return 0;
|
|
|
|
for (i = 0; i < s->clienthello->pre_proc_exts_len; ++i) {
|
|
|
|
r = s->clienthello->pre_proc_exts + i;
|
|
|
|
if (r->present && r->type == type) {
|
|
|
|
if (out != NULL)
|
|
|
|
*out = PACKET_data(&r->data);
|
|
|
|
if (outlen != NULL)
|
|
|
|
*outlen = PACKET_remaining(&r->data);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
2017-01-20 16:22:30 +00:00
|
|
|
|
2017-01-13 16:00:26 +00:00
|
|
|
int SSL_free_buffers(SSL *ssl)
|
|
|
|
{
|
|
|
|
RECORD_LAYER *rl = &ssl->rlayer;
|
|
|
|
|
|
|
|
if (RECORD_LAYER_read_pending(rl) || RECORD_LAYER_write_pending(rl))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
RECORD_LAYER_release(rl);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_alloc_buffers(SSL *ssl)
|
|
|
|
{
|
|
|
|
return ssl3_setup_buffers(ssl);
|
|
|
|
}
|
|
|
|
|
2017-01-20 16:22:30 +00:00
|
|
|
void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb)
|
|
|
|
{
|
|
|
|
ctx->keylog_callback = cb;
|
|
|
|
}
|
|
|
|
|
|
|
|
SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->keylog_callback;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int nss_keylog_int(const char *prefix,
|
|
|
|
SSL *ssl,
|
|
|
|
const uint8_t *parameter_1,
|
|
|
|
size_t parameter_1_len,
|
|
|
|
const uint8_t *parameter_2,
|
|
|
|
size_t parameter_2_len)
|
|
|
|
{
|
|
|
|
char *out = NULL;
|
|
|
|
char *cursor = NULL;
|
|
|
|
size_t out_len = 0;
|
|
|
|
size_t i;
|
|
|
|
size_t prefix_len;
|
|
|
|
|
2018-11-05 21:06:25 +00:00
|
|
|
if (ssl->ctx->keylog_callback == NULL)
|
|
|
|
return 1;
|
2017-01-20 16:22:30 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Our output buffer will contain the following strings, rendered with
|
|
|
|
* space characters in between, terminated by a NULL character: first the
|
|
|
|
* prefix, then the first parameter, then the second parameter. The
|
|
|
|
* meaning of each parameter depends on the specific key material being
|
|
|
|
* logged. Note that the first and second parameters are encoded in
|
|
|
|
* hexadecimal, so we need a buffer that is twice their lengths.
|
|
|
|
*/
|
|
|
|
prefix_len = strlen(prefix);
|
2018-11-05 01:04:23 +00:00
|
|
|
out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
|
2017-01-20 16:22:30 +00:00
|
|
|
if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_NSS_KEYLOG_INT,
|
|
|
|
ERR_R_MALLOC_FAILURE);
|
2017-01-20 16:22:30 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
strcpy(cursor, prefix);
|
|
|
|
cursor += prefix_len;
|
|
|
|
*cursor++ = ' ';
|
|
|
|
|
|
|
|
for (i = 0; i < parameter_1_len; i++) {
|
|
|
|
sprintf(cursor, "%02x", parameter_1[i]);
|
|
|
|
cursor += 2;
|
|
|
|
}
|
|
|
|
*cursor++ = ' ';
|
|
|
|
|
|
|
|
for (i = 0; i < parameter_2_len; i++) {
|
|
|
|
sprintf(cursor, "%02x", parameter_2[i]);
|
|
|
|
cursor += 2;
|
|
|
|
}
|
|
|
|
*cursor = '\0';
|
|
|
|
|
|
|
|
ssl->ctx->keylog_callback(ssl, (const char *)out);
|
2018-11-05 01:04:23 +00:00
|
|
|
OPENSSL_clear_free(out, out_len);
|
2017-01-20 16:22:30 +00:00
|
|
|
return 1;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
int ssl_log_rsa_client_key_exchange(SSL *ssl,
|
|
|
|
const uint8_t *encrypted_premaster,
|
|
|
|
size_t encrypted_premaster_len,
|
|
|
|
const uint8_t *premaster,
|
|
|
|
size_t premaster_len)
|
|
|
|
{
|
|
|
|
if (encrypted_premaster_len < 8) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(ssl, SSL_AD_INTERNAL_ERROR,
|
|
|
|
SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
|
2017-01-20 16:22:30 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2017-01-25 19:42:16 +00:00
|
|
|
/* We only want the first 8 bytes of the encrypted premaster as a tag. */
|
2017-01-20 16:22:30 +00:00
|
|
|
return nss_keylog_int("RSA",
|
|
|
|
ssl,
|
|
|
|
encrypted_premaster,
|
2017-01-25 19:42:16 +00:00
|
|
|
8,
|
2017-01-20 16:22:30 +00:00
|
|
|
premaster,
|
|
|
|
premaster_len);
|
|
|
|
}
|
|
|
|
|
2017-01-31 14:56:15 +00:00
|
|
|
int ssl_log_secret(SSL *ssl,
|
|
|
|
const char *label,
|
|
|
|
const uint8_t *secret,
|
|
|
|
size_t secret_len)
|
2017-01-20 16:22:30 +00:00
|
|
|
{
|
2017-01-31 14:56:15 +00:00
|
|
|
return nss_keylog_int(label,
|
2017-01-20 16:22:30 +00:00
|
|
|
ssl,
|
2017-01-31 14:56:15 +00:00
|
|
|
ssl->s3->client_random,
|
|
|
|
SSL3_RANDOM_SIZE,
|
|
|
|
secret,
|
|
|
|
secret_len);
|
2017-01-20 16:22:30 +00:00
|
|
|
}
|
|
|
|
|
2017-01-30 17:24:17 +00:00
|
|
|
#define SSLV2_CIPHER_LEN 3
|
|
|
|
|
2017-11-21 17:18:43 +00:00
|
|
|
int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
|
2017-01-30 17:24:17 +00:00
|
|
|
{
|
|
|
|
int n;
|
|
|
|
|
|
|
|
n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
|
|
|
|
|
|
|
|
if (PACKET_remaining(cipher_suites) == 0) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL_CACHE_CIPHERLIST,
|
|
|
|
SSL_R_NO_CIPHERS_SPECIFIED);
|
2017-01-31 01:20:14 +00:00
|
|
|
return 0;
|
2017-01-30 17:24:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (PACKET_remaining(cipher_suites) % n != 0) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
|
2017-12-04 13:37:01 +00:00
|
|
|
SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
|
2017-01-31 01:20:14 +00:00
|
|
|
return 0;
|
2017-01-30 17:24:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
OPENSSL_free(s->s3->tmp.ciphers_raw);
|
|
|
|
s->s3->tmp.ciphers_raw = NULL;
|
|
|
|
s->s3->tmp.ciphers_rawlen = 0;
|
|
|
|
|
|
|
|
if (sslv2format) {
|
|
|
|
size_t numciphers = PACKET_remaining(cipher_suites) / n;
|
|
|
|
PACKET sslv2ciphers = *cipher_suites;
|
|
|
|
unsigned int leadbyte;
|
|
|
|
unsigned char *raw;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We store the raw ciphers list in SSLv3+ format so we need to do some
|
|
|
|
* preprocessing to convert the list first. If there are any SSLv2 only
|
|
|
|
* ciphersuites with a non-zero leading byte then we are going to
|
|
|
|
* slightly over allocate because we won't store those. But that isn't a
|
|
|
|
* problem.
|
|
|
|
*/
|
|
|
|
raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
|
|
|
|
s->s3->tmp.ciphers_raw = raw;
|
|
|
|
if (raw == NULL) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
|
|
|
|
ERR_R_MALLOC_FAILURE);
|
|
|
|
return 0;
|
2017-01-30 17:24:17 +00:00
|
|
|
}
|
|
|
|
for (s->s3->tmp.ciphers_rawlen = 0;
|
|
|
|
PACKET_remaining(&sslv2ciphers) > 0;
|
|
|
|
raw += TLS_CIPHER_LEN) {
|
|
|
|
if (!PACKET_get_1(&sslv2ciphers, &leadbyte)
|
|
|
|
|| (leadbyte == 0
|
|
|
|
&& !PACKET_copy_bytes(&sslv2ciphers, raw,
|
|
|
|
TLS_CIPHER_LEN))
|
|
|
|
|| (leadbyte != 0
|
|
|
|
&& !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
|
|
|
|
SSL_R_BAD_PACKET);
|
2017-01-30 17:24:17 +00:00
|
|
|
OPENSSL_free(s->s3->tmp.ciphers_raw);
|
|
|
|
s->s3->tmp.ciphers_raw = NULL;
|
|
|
|
s->s3->tmp.ciphers_rawlen = 0;
|
2017-11-21 17:18:43 +00:00
|
|
|
return 0;
|
2017-01-30 17:24:17 +00:00
|
|
|
}
|
|
|
|
if (leadbyte == 0)
|
|
|
|
s->s3->tmp.ciphers_rawlen += TLS_CIPHER_LEN;
|
|
|
|
}
|
|
|
|
} else if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw,
|
|
|
|
&s->s3->tmp.ciphers_rawlen)) {
|
2017-11-21 17:18:43 +00:00
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
|
|
|
|
ERR_R_INTERNAL_ERROR);
|
|
|
|
return 0;
|
2017-01-30 17:24:17 +00:00
|
|
|
}
|
2017-01-31 01:20:14 +00:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len,
|
|
|
|
int isv2format, STACK_OF(SSL_CIPHER) **sk,
|
|
|
|
STACK_OF(SSL_CIPHER) **scsvs)
|
|
|
|
{
|
|
|
|
PACKET pkt;
|
|
|
|
|
|
|
|
if (!PACKET_buf_init(&pkt, bytes, len))
|
|
|
|
return 0;
|
2017-11-21 17:18:43 +00:00
|
|
|
return bytes_to_cipher_list(s, &pkt, sk, scsvs, isv2format, 0);
|
2017-01-31 01:20:14 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
|
|
|
|
STACK_OF(SSL_CIPHER) **skp,
|
|
|
|
STACK_OF(SSL_CIPHER) **scsvs_out,
|
2017-11-21 17:18:43 +00:00
|
|
|
int sslv2format, int fatal)
|
2017-01-31 01:20:14 +00:00
|
|
|
{
|
|
|
|
const SSL_CIPHER *c;
|
|
|
|
STACK_OF(SSL_CIPHER) *sk = NULL;
|
|
|
|
STACK_OF(SSL_CIPHER) *scsvs = NULL;
|
|
|
|
int n;
|
|
|
|
/* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */
|
|
|
|
unsigned char cipher[SSLV2_CIPHER_LEN];
|
|
|
|
|
|
|
|
n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
|
|
|
|
|
|
|
|
if (PACKET_remaining(cipher_suites) == 0) {
|
2017-11-21 17:18:43 +00:00
|
|
|
if (fatal)
|
|
|
|
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_BYTES_TO_CIPHER_LIST,
|
|
|
|
SSL_R_NO_CIPHERS_SPECIFIED);
|
|
|
|
else
|
|
|
|
SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);
|
2017-01-31 01:20:14 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (PACKET_remaining(cipher_suites) % n != 0) {
|
2017-11-21 17:18:43 +00:00
|
|
|
if (fatal)
|
|
|
|
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
|
|
|
|
SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
|
|
|
|
else
|
|
|
|
SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,
|
|
|
|
SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
|
2017-01-31 01:20:14 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
sk = sk_SSL_CIPHER_new_null();
|
|
|
|
scsvs = sk_SSL_CIPHER_new_null();
|
|
|
|
if (sk == NULL || scsvs == NULL) {
|
2017-11-21 17:18:43 +00:00
|
|
|
if (fatal)
|
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
|
|
|
|
ERR_R_MALLOC_FAILURE);
|
|
|
|
else
|
|
|
|
SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
|
2017-01-31 01:20:14 +00:00
|
|
|
goto err;
|
|
|
|
}
|
2017-01-30 17:24:17 +00:00
|
|
|
|
|
|
|
while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
|
|
|
|
/*
|
|
|
|
* SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
|
|
|
|
* first byte set to zero, while true SSLv2 ciphers have a non-zero
|
|
|
|
* first byte. We don't support any true SSLv2 ciphers, so skip them.
|
|
|
|
*/
|
|
|
|
if (sslv2format && cipher[0] != '\0')
|
|
|
|
continue;
|
|
|
|
|
|
|
|
/* For SSLv2-compat, ignore leading 0-byte. */
|
|
|
|
c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);
|
|
|
|
if (c != NULL) {
|
2017-01-31 01:20:14 +00:00
|
|
|
if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) ||
|
|
|
|
(!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {
|
2017-11-21 17:18:43 +00:00
|
|
|
if (fatal)
|
|
|
|
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
|
|
|
|
SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
|
|
|
|
else
|
|
|
|
SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
|
2017-01-30 17:24:17 +00:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (PACKET_remaining(cipher_suites) > 0) {
|
2017-11-21 17:18:43 +00:00
|
|
|
if (fatal)
|
|
|
|
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
|
|
|
|
SSL_R_BAD_LENGTH);
|
|
|
|
else
|
|
|
|
SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_BAD_LENGTH);
|
2017-01-30 17:24:17 +00:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2017-01-31 01:20:14 +00:00
|
|
|
if (skp != NULL)
|
|
|
|
*skp = sk;
|
|
|
|
else
|
|
|
|
sk_SSL_CIPHER_free(sk);
|
|
|
|
if (scsvs_out != NULL)
|
|
|
|
*scsvs_out = scsvs;
|
|
|
|
else
|
|
|
|
sk_SSL_CIPHER_free(scsvs);
|
|
|
|
return 1;
|
2017-01-30 17:24:17 +00:00
|
|
|
err:
|
|
|
|
sk_SSL_CIPHER_free(sk);
|
2017-01-31 01:20:14 +00:00
|
|
|
sk_SSL_CIPHER_free(scsvs);
|
|
|
|
return 0;
|
2017-01-30 17:24:17 +00:00
|
|
|
}
|
2017-02-17 16:52:12 +00:00
|
|
|
|
|
|
|
int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data)
|
|
|
|
{
|
|
|
|
ctx->max_early_data = max_early_data;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-02-24 14:08:59 +00:00
|
|
|
uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx)
|
2017-02-17 16:52:12 +00:00
|
|
|
{
|
|
|
|
return ctx->max_early_data;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_set_max_early_data(SSL *s, uint32_t max_early_data)
|
|
|
|
{
|
|
|
|
s->max_early_data = max_early_data;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2017-03-30 16:54:39 +00:00
|
|
|
uint32_t SSL_get_max_early_data(const SSL *s)
|
2017-02-17 16:52:12 +00:00
|
|
|
{
|
|
|
|
return s->max_early_data;
|
|
|
|
}
|
2017-08-03 14:24:03 +00:00
|
|
|
|
2018-07-05 13:40:39 +00:00
|
|
|
int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data)
|
|
|
|
{
|
|
|
|
ctx->recv_max_early_data = recv_max_early_data;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx)
|
|
|
|
{
|
|
|
|
return ctx->recv_max_early_data;
|
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data)
|
|
|
|
{
|
|
|
|
s->recv_max_early_data = recv_max_early_data;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint32_t SSL_get_recv_max_early_data(const SSL *s)
|
|
|
|
{
|
|
|
|
return s->recv_max_early_data;
|
|
|
|
}
|
|
|
|
|
2017-11-05 16:46:48 +00:00
|
|
|
__owur unsigned int ssl_get_max_send_fragment(const SSL *ssl)
|
|
|
|
{
|
|
|
|
/* Return any active Max Fragment Len extension */
|
|
|
|
if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session))
|
|
|
|
return GET_MAX_FRAGMENT_LENGTH(ssl->session);
|
|
|
|
|
|
|
|
/* return current SSL connection setting */
|
|
|
|
return ssl->max_send_fragment;
|
|
|
|
}
|
|
|
|
|
|
|
|
__owur unsigned int ssl_get_split_send_fragment(const SSL *ssl)
|
|
|
|
{
|
|
|
|
/* Return a value regarding an active Max Fragment Len extension */
|
|
|
|
if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session)
|
|
|
|
&& ssl->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(ssl->session))
|
|
|
|
return GET_MAX_FRAGMENT_LENGTH(ssl->session);
|
|
|
|
|
|
|
|
/* else limit |split_send_fragment| to current |max_send_fragment| */
|
|
|
|
if (ssl->split_send_fragment > ssl->max_send_fragment)
|
|
|
|
return ssl->max_send_fragment;
|
|
|
|
|
|
|
|
/* return current SSL connection setting */
|
|
|
|
return ssl->split_send_fragment;
|
|
|
|
}
|
2017-09-13 12:48:48 +00:00
|
|
|
|
|
|
|
int SSL_stateless(SSL *s)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
/* Ensure there is no state left over from a previous invocation */
|
|
|
|
if (!SSL_clear(s))
|
2017-09-28 12:24:58 +00:00
|
|
|
return 0;
|
2017-09-13 12:48:48 +00:00
|
|
|
|
|
|
|
ERR_clear_error();
|
|
|
|
|
|
|
|
s->s3->flags |= TLS1_FLAGS_STATELESS;
|
|
|
|
ret = SSL_accept(s);
|
|
|
|
s->s3->flags &= ~TLS1_FLAGS_STATELESS;
|
|
|
|
|
2017-09-28 12:24:58 +00:00
|
|
|
if (ret > 0 && s->ext.cookieok)
|
2017-09-13 13:50:49 +00:00
|
|
|
return 1;
|
|
|
|
|
2018-03-08 17:44:12 +00:00
|
|
|
if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return -1;
|
2017-09-13 12:48:48 +00:00
|
|
|
}
|
Add TLSv1.3 post-handshake authentication (PHA)
Add SSL_verify_client_post_handshake() for servers to initiate PHA
Add SSL_force_post_handshake_auth() for clients that don't have certificates
initially configured, but use a certificate callback.
Update SSL_CTX_set_verify()/SSL_set_verify() mode:
* Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after
the initial handshake.
* Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless
of when the certificate authentication takes place; either initial handshake,
re-negotiation, or post-handshake authentication.
Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that
add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options
Add support to s_client:
* Enabled automatically when cert is configured
* Can be forced enabled via -force_pha
Add support to s_server:
* Use 'c' to invoke PHA in s_server
* Remove some dead code
Update documentation
Update unit tests:
* Illegal use of PHA extension
* TLSv1.3 certificate tests
DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is
implemented, it's PHA support state machine may need to be different.
Add a TODO and a #error
Update handshake context to deal with PHA.
The handshake context for TLSv1.3 post-handshake auth is up through the
ClientFinish message, plus the CertificateRequest message. Subsequent
Certificate, CertificateVerify, and Finish messages are based on this
handshake context (not the Certificate message per se, but it's included
after the hash). KeyUpdate, NewSessionTicket, and prior Certificate
Request messages are not included in post-handshake authentication.
After the ClientFinished message is processed, save off the digest state
for future post-handshake authentication. When post-handshake auth occurs,
copy over the saved handshake context into the "main" handshake digest.
This effectively discards the any KeyUpdate or NewSessionTicket messages
and any prior post-handshake authentication.
This, of course, assumes that the ID-22 did not mean to include any
previous post-handshake authentication into the new handshake transcript.
This is implied by section 4.4.1 that lists messages only up to the
first ClientFinished.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4964)
2017-12-18 21:52:28 +00:00
|
|
|
|
2018-08-13 14:53:42 +00:00
|
|
|
void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val)
|
|
|
|
{
|
|
|
|
ctx->pha_enabled = val;
|
|
|
|
}
|
|
|
|
|
2018-08-13 14:23:27 +00:00
|
|
|
void SSL_set_post_handshake_auth(SSL *ssl, int val)
|
Add TLSv1.3 post-handshake authentication (PHA)
Add SSL_verify_client_post_handshake() for servers to initiate PHA
Add SSL_force_post_handshake_auth() for clients that don't have certificates
initially configured, but use a certificate callback.
Update SSL_CTX_set_verify()/SSL_set_verify() mode:
* Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after
the initial handshake.
* Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless
of when the certificate authentication takes place; either initial handshake,
re-negotiation, or post-handshake authentication.
Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that
add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options
Add support to s_client:
* Enabled automatically when cert is configured
* Can be forced enabled via -force_pha
Add support to s_server:
* Use 'c' to invoke PHA in s_server
* Remove some dead code
Update documentation
Update unit tests:
* Illegal use of PHA extension
* TLSv1.3 certificate tests
DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is
implemented, it's PHA support state machine may need to be different.
Add a TODO and a #error
Update handshake context to deal with PHA.
The handshake context for TLSv1.3 post-handshake auth is up through the
ClientFinish message, plus the CertificateRequest message. Subsequent
Certificate, CertificateVerify, and Finish messages are based on this
handshake context (not the Certificate message per se, but it's included
after the hash). KeyUpdate, NewSessionTicket, and prior Certificate
Request messages are not included in post-handshake authentication.
After the ClientFinished message is processed, save off the digest state
for future post-handshake authentication. When post-handshake auth occurs,
copy over the saved handshake context into the "main" handshake digest.
This effectively discards the any KeyUpdate or NewSessionTicket messages
and any prior post-handshake authentication.
This, of course, assumes that the ID-22 did not mean to include any
previous post-handshake authentication into the new handshake transcript.
This is implied by section 4.4.1 that lists messages only up to the
first ClientFinished.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4964)
2017-12-18 21:52:28 +00:00
|
|
|
{
|
2018-08-13 14:23:27 +00:00
|
|
|
ssl->pha_enabled = val;
|
Add TLSv1.3 post-handshake authentication (PHA)
Add SSL_verify_client_post_handshake() for servers to initiate PHA
Add SSL_force_post_handshake_auth() for clients that don't have certificates
initially configured, but use a certificate callback.
Update SSL_CTX_set_verify()/SSL_set_verify() mode:
* Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after
the initial handshake.
* Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless
of when the certificate authentication takes place; either initial handshake,
re-negotiation, or post-handshake authentication.
Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that
add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options
Add support to s_client:
* Enabled automatically when cert is configured
* Can be forced enabled via -force_pha
Add support to s_server:
* Use 'c' to invoke PHA in s_server
* Remove some dead code
Update documentation
Update unit tests:
* Illegal use of PHA extension
* TLSv1.3 certificate tests
DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is
implemented, it's PHA support state machine may need to be different.
Add a TODO and a #error
Update handshake context to deal with PHA.
The handshake context for TLSv1.3 post-handshake auth is up through the
ClientFinish message, plus the CertificateRequest message. Subsequent
Certificate, CertificateVerify, and Finish messages are based on this
handshake context (not the Certificate message per se, but it's included
after the hash). KeyUpdate, NewSessionTicket, and prior Certificate
Request messages are not included in post-handshake authentication.
After the ClientFinished message is processed, save off the digest state
for future post-handshake authentication. When post-handshake auth occurs,
copy over the saved handshake context into the "main" handshake digest.
This effectively discards the any KeyUpdate or NewSessionTicket messages
and any prior post-handshake authentication.
This, of course, assumes that the ID-22 did not mean to include any
previous post-handshake authentication into the new handshake transcript.
This is implied by section 4.4.1 that lists messages only up to the
first ClientFinished.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4964)
2017-12-18 21:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int SSL_verify_client_post_handshake(SSL *ssl)
|
|
|
|
{
|
|
|
|
if (!SSL_IS_TLS13(ssl)) {
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_WRONG_SSL_VERSION);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!ssl->server) {
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_NOT_SERVER);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!SSL_is_init_finished(ssl)) {
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_STILL_IN_INIT);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (ssl->post_handshake_auth) {
|
|
|
|
case SSL_PHA_NONE:
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_EXTENSION_NOT_RECEIVED);
|
|
|
|
return 0;
|
|
|
|
default:
|
|
|
|
case SSL_PHA_EXT_SENT:
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, ERR_R_INTERNAL_ERROR);
|
|
|
|
return 0;
|
|
|
|
case SSL_PHA_EXT_RECEIVED:
|
|
|
|
break;
|
|
|
|
case SSL_PHA_REQUEST_PENDING:
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_PENDING);
|
|
|
|
return 0;
|
|
|
|
case SSL_PHA_REQUESTED:
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_SENT);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
ssl->post_handshake_auth = SSL_PHA_REQUEST_PENDING;
|
|
|
|
|
|
|
|
/* checks verify_mode and algorithm_auth */
|
|
|
|
if (!send_certificate_request(ssl)) {
|
|
|
|
ssl->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */
|
|
|
|
SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_INVALID_CONFIG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
ossl_statem_set_in_init(ssl, 1);
|
|
|
|
return 1;
|
|
|
|
}
|
2017-03-15 17:25:55 +00:00
|
|
|
|
|
|
|
int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,
|
|
|
|
SSL_CTX_generate_session_ticket_fn gen_cb,
|
|
|
|
SSL_CTX_decrypt_session_ticket_fn dec_cb,
|
|
|
|
void *arg)
|
|
|
|
{
|
|
|
|
ctx->generate_ticket_cb = gen_cb;
|
|
|
|
ctx->decrypt_ticket_cb = dec_cb;
|
|
|
|
ctx->ticket_cb_data = arg;
|
|
|
|
return 1;
|
|
|
|
}
|
2018-06-07 14:14:36 +00:00
|
|
|
|
|
|
|
void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx,
|
|
|
|
SSL_allow_early_data_cb_fn cb,
|
|
|
|
void *arg)
|
|
|
|
{
|
|
|
|
ctx->allow_early_data_cb = cb;
|
|
|
|
ctx->allow_early_data_cb_data = arg;
|
|
|
|
}
|
|
|
|
|
|
|
|
void SSL_set_allow_early_data_cb(SSL *s,
|
|
|
|
SSL_allow_early_data_cb_fn cb,
|
|
|
|
void *arg)
|
|
|
|
{
|
|
|
|
s->allow_early_data_cb = cb;
|
|
|
|
s->allow_early_data_cb_data = arg;
|
|
|
|
}
|