wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/ssl/t1_lib.c

4704 lines
120 KiB
C
Raw Normal View History

Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
/* ssl/t1_lib.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
/* ====================================================================
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
* Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
#include <stdio.h>
Change #include filenames from <foo.h> to <openssl.h>. Submitted by: Reviewed by: PR:
1999-04-23 22:13:45 +00:00
#include <openssl/objects.h>
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
#include <openssl/evp.h>
#include <openssl/hmac.h>
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
#include <openssl/ocsp.h>
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#include <openssl/rand.h>
Auto DH support. Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
2014-01-22 16:22:48 +00:00
#ifndef OPENSSL_NO_DH
#include <openssl/dh.h>
#include <openssl/bn.h>
#endif
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
#include "ssl_locl.h"
Constify version strings is ssl lib.
2007-01-21 16:06:05 +00:00
const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
Fix warning and make no-tlsext work.
2007-08-12 18:56:14 +00:00
#ifndef OPENSSL_NO_TLSEXT
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
const unsigned char *sess_id, int sesslen,
SSL_SESSION **psess);
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
static int ssl_check_clienthello_tlsext_early(SSL *s);
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Improved localisation of TLS extension handling and code tidy.
2012-04-24 12:22:23 +00:00
int ssl_check_serverhello_tlsext(SSL *s);
Fix warning and make no-tlsext work.
2007-08-12 18:56:14 +00:00
#endif
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
Initialize SSL_METHOD structures at compile time. This removes the need for locking code. The CRYPTO_LOCK_SSL_METHOD lock is now no longer used.
2005-08-05 23:56:11 +00:00
SSL3_ENC_METHOD TLSv1_enc_data={
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
tls1_enc,
tls1_mac,
tls1_setup_key_block,
tls1_generate_master_secret,
tls1_change_cipher_state,
tls1_final_finish_mac,
TLS1_FINISH_MAC_LENGTH,
tls1_cert_verify_mac,
TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
tls1_alert_code,
Add TLS exporter.
2011-11-15 23:50:52 +00:00
tls1_export_keying_material,
DTLS revision. Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
2013-03-11 15:34:28 +00:00
0,
SSL3_HM_HEADER_LENGTH,
ssl3_set_handshake_header,
ssl3_handshake_write
};
SSL3_ENC_METHOD TLSv1_1_enc_data={
tls1_enc,
tls1_mac,
tls1_setup_key_block,
tls1_generate_master_secret,
tls1_change_cipher_state,
tls1_final_finish_mac,
TLS1_FINISH_MAC_LENGTH,
tls1_cert_verify_mac,
TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
tls1_alert_code,
tls1_export_keying_material,
SSL_ENC_FLAG_EXPLICIT_IV,
SSL3_HM_HEADER_LENGTH,
ssl3_set_handshake_header,
ssl3_handshake_write
};
SSL3_ENC_METHOD TLSv1_2_enc_data={
tls1_enc,
tls1_mac,
tls1_setup_key_block,
tls1_generate_master_secret,
tls1_change_cipher_state,
tls1_final_finish_mac,
TLS1_FINISH_MAC_LENGTH,
tls1_cert_verify_mac,
TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
tls1_alert_code,
tls1_export_keying_material,
Enable TLS 1.2 ciphers in DTLS 1.2. Port TLS 1.2 GCM code to DTLS. Enable use of TLS 1.2 only ciphers when in DTLS 1.2 mode too.
2013-03-27 19:54:48 +00:00
SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|SSL_ENC_FLAG_SHA256_PRF
|SSL_ENC_FLAG_TLS1_2_CIPHERS,
DTLS revision. Revise DTLS code. There was a *lot* of code duplication in the DTLS code that generates records. This makes it harder to maintain and sometimes a TLS update is omitted by accident from the DTLS code. Specifically almost all of the record generation functions have code like this: some_pointer = buffer + HANDSHAKE_HEADER_LENGTH; ... Record creation stuff ... set_handshake_header(ssl, SSL_MT_SOMETHING, message_len); ... write_handshake_message(ssl); Where the "Record creation stuff" is identical between SSL/TLS and DTLS or in some cases has very minor differences. By adding a few fields to SSL3_ENC to include the header length, some flags and function pointers for handshake header setting and handshake writing the code can cope with both cases. Note: although this passes "make test" and some simple DTLS tests there may be some minor differences in the DTLS code that have to be accounted for.
2013-03-11 15:34:28 +00:00
SSL3_HM_HEADER_LENGTH,
ssl3_set_handshake_header,
ssl3_handshake_write
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
};
Initialize SSL_METHOD structures at compile time. This removes the need for locking code. The CRYPTO_LOCK_SSL_METHOD lock is now no longer used.
2005-08-05 23:56:11 +00:00
long tls1_default_timeout(void)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
{
/* 2 hours, the 24 hours mentioned in the TLSv1 spec
* is way too long for http, the cache would over fill */
return(60*60*2);
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
int tls1_new(SSL *s)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
{
if (!ssl3_new(s)) return(0);
s->method->ssl_clear(s);
return(1);
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
void tls1_free(SSL *s)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
{
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
#ifndef OPENSSL_NO_TLSEXT
if (s->tlsext_session_ticket)
{
OPENSSL_free(s->tlsext_session_ticket);
}
#endif /* OPENSSL_NO_TLSEXT */
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
ssl3_free(s);
}
Change functions to ANSI C.
1999-04-19 21:31:43 +00:00
void tls1_clear(SSL *s)
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
{
ssl3_clear(s);
Initial experimental TLSv1.1 support
2009-12-07 13:31:02 +00:00
s->version = s->method->version;
Import of old SSLeay release: SSLeay 0.9.0b
1998-12-21 10:56:39 +00:00
}
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
#ifndef OPENSSL_NO_EC
Output supported curves in preference order instead of numerically.
2011-05-30 17:58:13 +00:00
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
typedef struct
{
int nid; /* Curve NID */
int secbits; /* Bits of security (from SP800-57) */
unsigned int flags; /* Flags: currently just field type */
} tls_curve_info;
#define TLS_CURVE_CHAR2 0x1
#define TLS_CURVE_PRIME 0x0
static tls_curve_info nid_list[] =
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
{
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */
{NID_sect163r1, 80, TLS_CURVE_CHAR2},/* sect163r1 (2) */
{NID_sect163r2, 80, TLS_CURVE_CHAR2},/* sect163r2 (3) */
{NID_sect193r1, 80, TLS_CURVE_CHAR2},/* sect193r1 (4) */
{NID_sect193r2, 80, TLS_CURVE_CHAR2},/* sect193r2 (5) */
{NID_sect233k1, 112, TLS_CURVE_CHAR2},/* sect233k1 (6) */
{NID_sect233r1, 112, TLS_CURVE_CHAR2},/* sect233r1 (7) */
{NID_sect239k1, 112, TLS_CURVE_CHAR2},/* sect239k1 (8) */
{NID_sect283k1, 128, TLS_CURVE_CHAR2},/* sect283k1 (9) */
{NID_sect283r1, 128, TLS_CURVE_CHAR2},/* sect283r1 (10) */
{NID_sect409k1, 192, TLS_CURVE_CHAR2},/* sect409k1 (11) */
{NID_sect409r1, 192, TLS_CURVE_CHAR2},/* sect409r1 (12) */
{NID_sect571k1, 256, TLS_CURVE_CHAR2},/* sect571k1 (13) */
{NID_sect571r1, 256, TLS_CURVE_CHAR2},/* sect571r1 (14) */
{NID_secp160k1, 80, TLS_CURVE_PRIME},/* secp160k1 (15) */
{NID_secp160r1, 80, TLS_CURVE_PRIME},/* secp160r1 (16) */
{NID_secp160r2, 80, TLS_CURVE_PRIME},/* secp160r2 (17) */
{NID_secp192k1, 80, TLS_CURVE_PRIME},/* secp192k1 (18) */
{NID_X9_62_prime192v1, 80, TLS_CURVE_PRIME},/* secp192r1 (19) */
{NID_secp224k1, 112, TLS_CURVE_PRIME},/* secp224k1 (20) */
{NID_secp224r1, 112, TLS_CURVE_PRIME},/* secp224r1 (21) */
{NID_secp256k1, 128, TLS_CURVE_PRIME},/* secp256k1 (22) */
{NID_X9_62_prime256v1, 128, TLS_CURVE_PRIME},/* secp256r1 (23) */
{NID_secp384r1, 192, TLS_CURVE_PRIME},/* secp384r1 (24) */
{NID_secp521r1, 256, TLS_CURVE_PRIME},/* secp521r1 (25) */
{NID_brainpoolP256r1, 128, TLS_CURVE_PRIME}, /* brainpoolP256r1 (26) */
{NID_brainpoolP384r1, 192, TLS_CURVE_PRIME}, /* brainpoolP384r1 (27) */
{NID_brainpoolP512r1, 256, TLS_CURVE_PRIME},/* brainpool512r1 (28) */
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
};
Output supported curves in preference order instead of numerically.
2011-05-30 17:58:13 +00:00
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
static const unsigned char ecformats_default[] =
Output supported curves in preference order instead of numerically.
2011-05-30 17:58:13 +00:00
{
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
TLSEXT_ECPOINTFORMAT_uncompressed,
TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
};
static const unsigned char eccurves_default[] =
{
0,14, /* sect571r1 (14) */
0,13, /* sect571k1 (13) */
0,25, /* secp521r1 (25) */
RFC7027 (Brainpool for TLS) support.
2013-10-14 17:44:44 +00:00
0,28, /* brainpool512r1 (28) */
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
0,11, /* sect409k1 (11) */
0,12, /* sect409r1 (12) */
RFC7027 (Brainpool for TLS) support.
2013-10-14 17:44:44 +00:00
0,27, /* brainpoolP384r1 (27) */
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
0,24, /* secp384r1 (24) */
0,9, /* sect283k1 (9) */
0,10, /* sect283r1 (10) */
RFC7027 (Brainpool for TLS) support.
2013-10-14 17:44:44 +00:00
0,26, /* brainpoolP256r1 (26) */
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
0,22, /* secp256k1 (22) */
0,23, /* secp256r1 (23) */
0,8, /* sect239k1 (8) */
0,6, /* sect233k1 (6) */
0,7, /* sect233r1 (7) */
0,20, /* secp224k1 (20) */
0,21, /* secp224r1 (21) */
0,4, /* sect193r1 (4) */
0,5, /* sect193r2 (5) */
0,18, /* secp192k1 (18) */
0,19, /* secp192r1 (19) */
0,1, /* sect163k1 (1) */
0,2, /* sect163r1 (2) */
0,3, /* sect163r2 (3) */
0,15, /* secp160k1 (15) */
0,16, /* secp160r1 (16) */
0,17, /* secp160r2 (17) */
Output supported curves in preference order instead of numerically.
2011-05-30 17:58:13 +00:00
};
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
static const unsigned char suiteb_curves[] =
{
0, TLSEXT_curve_P_256,
0, TLSEXT_curve_P_384
};
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
int tls1_ec_curve_id2nid(int curve_id)
{
/* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
Fix a variety of warnings generated by some elevated compiler-fascism, OPENSSL_NO_DEPRECATED, etc. Steve, please double-check the CMS stuff...
2008-03-16 21:05:46 +00:00
if ((curve_id < 1) || ((unsigned int)curve_id >
sizeof(nid_list)/sizeof(nid_list[0])))
return 0;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return nid_list[curve_id-1].nid;
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
}
int tls1_ec_nid2curve_id(int nid)
{
/* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
switch (nid)
{
case NID_sect163k1: /* sect163k1 (1) */
return 1;
case NID_sect163r1: /* sect163r1 (2) */
return 2;
case NID_sect163r2: /* sect163r2 (3) */
return 3;
case NID_sect193r1: /* sect193r1 (4) */
return 4;
case NID_sect193r2: /* sect193r2 (5) */
return 5;
case NID_sect233k1: /* sect233k1 (6) */
return 6;
case NID_sect233r1: /* sect233r1 (7) */
return 7;
case NID_sect239k1: /* sect239k1 (8) */
return 8;
case NID_sect283k1: /* sect283k1 (9) */
return 9;
case NID_sect283r1: /* sect283r1 (10) */
return 10;
case NID_sect409k1: /* sect409k1 (11) */
return 11;
case NID_sect409r1: /* sect409r1 (12) */
return 12;
case NID_sect571k1: /* sect571k1 (13) */
return 13;
case NID_sect571r1: /* sect571r1 (14) */
return 14;
case NID_secp160k1: /* secp160k1 (15) */
return 15;
case NID_secp160r1: /* secp160r1 (16) */
return 16;
case NID_secp160r2: /* secp160r2 (17) */
return 17;
case NID_secp192k1: /* secp192k1 (18) */
return 18;
case NID_X9_62_prime192v1: /* secp192r1 (19) */
return 19;
case NID_secp224k1: /* secp224k1 (20) */
return 20;
case NID_secp224r1: /* secp224r1 (21) */
return 21;
case NID_secp256k1: /* secp256k1 (22) */
return 22;
case NID_X9_62_prime256v1: /* secp256r1 (23) */
return 23;
case NID_secp384r1: /* secp384r1 (24) */
return 24;
case NID_secp521r1: /* secp521r1 (25) */
return 25;
Add brainpool curves to NID table too.
2013-10-15 11:08:47 +00:00
case NID_brainpoolP256r1: /* brainpoolP256r1 (26) */
return 26;
case NID_brainpoolP384r1: /* brainpoolP384r1 (27) */
return 27;
case NID_brainpoolP512r1: /* brainpool512r1 (28) */
return 28;
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
default:
return 0;
}
}
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
/* Get curves list, if "sess" is set return client curves otherwise
* preferred list
*/
static void tls1_get_curvelist(SSL *s, int sess,
const unsigned char **pcurves,
size_t *pcurveslen)
{
if (sess)
{
*pcurves = s->session->tlsext_ellipticcurvelist;
*pcurveslen = s->session->tlsext_ellipticcurvelist_length;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
return;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
}
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* For Suite B mode only include P-256, P-384 */
switch (tls1_suiteb(s))
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
{
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
case SSL_CERT_FLAG_SUITEB_128_LOS:
*pcurves = suiteb_curves;
allow ECDSA+SHA384 signature algorithm in SUITEB128ONLY mode
2012-12-09 16:03:34 +00:00
*pcurveslen = sizeof(suiteb_curves);
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
break;
revert SUITEB128ONLY patch, anything wanting to use P-384 can use SUITEB128 instead
2012-12-10 02:02:16 +00:00
case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
*pcurves = suiteb_curves;
*pcurveslen = 2;
break;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
case SSL_CERT_FLAG_SUITEB_192_LOS:
*pcurves = suiteb_curves + 2;
*pcurveslen = 2;
break;
default:
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
*pcurves = s->tlsext_ellipticcurvelist;
*pcurveslen = s->tlsext_ellipticcurvelist_length;
}
if (!*pcurves)
{
*pcurves = eccurves_default;
*pcurveslen = sizeof(eccurves_default);
}
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
/* See if curve is allowed by security callback */
static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
{
tls_curve_info *cinfo;
if (curve[0])
return 1;
if ((curve[1] < 1) || ((size_t)curve[1] >
sizeof(nid_list)/sizeof(nid_list[0])))
return 0;
cinfo = &nid_list[curve[1]-1];
return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
}
check EC tmp key matches preferences
2012-07-24 13:47:40 +00:00
/* Check a curve is one of our preferences */
int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
{
const unsigned char *curves;
size_t curveslen, i;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
unsigned int suiteb_flags = tls1_suiteb(s);
check EC tmp key matches preferences
2012-07-24 13:47:40 +00:00
if (len != 3 || p[0] != NAMED_CURVE_TYPE)
return 0;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* Check curve matches Suite B preferences */
if (suiteb_flags)
{
unsigned long cid = s->s3->tmp.new_cipher->id;
if (p[1])
return 0;
if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
{
if (p[2] != TLSEXT_curve_P_256)
return 0;
}
else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
{
if (p[2] != TLSEXT_curve_P_384)
return 0;
}
else /* Should never happen */
return 0;
}
check EC tmp key matches preferences
2012-07-24 13:47:40 +00:00
tls1_get_curvelist(s, 0, &curves, &curveslen);
for (i = 0; i < curveslen; i += 2, curves += 2)
{
if (p[1] == curves[0] && p[2] == curves[1])
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
check EC tmp key matches preferences
2012-07-24 13:47:40 +00:00
}
return 0;
}
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
/* Return nth shared curve. If nmatch == -1 return number of
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
* matches. For nmatch == -2 return the NID of the curve to use for
* an EC tmp key.
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
*/
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
int tls1_shared_curve(SSL *s, int nmatch)
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
{
const unsigned char *pref, *supp;
size_t preflen, supplen, i, j;
int k;
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
/* Can't do anything on client side */
if (s->server == 0)
return -1;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (nmatch == -2)
{
if (tls1_suiteb(s))
{
/* For Suite B ciphersuite determines curve: we
* already know these are acceptable due to previous
* checks.
*/
unsigned long cid = s->s3->tmp.new_cipher->id;
if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
return NID_X9_62_prime256v1; /* P-256 */
if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
return NID_secp384r1; /* P-384 */
/* Should never happen */
return NID_undef;
}
/* If not Suite B just return first preference shared curve */
nmatch = 0;
}
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
&supp, &supplen);
tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
&pref, &preflen);
preflen /= 2;
supplen /= 2;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
k = 0;
for (i = 0; i < preflen; i++, pref+=2)
{
const unsigned char *tsupp = supp;
for (j = 0; j < supplen; j++, tsupp+=2)
{
if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
{
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (!tls_curve_allowed(s, pref, SSL_SECOP_CURVE_SHARED))
continue;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
if (nmatch == k)
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
{
int id = (pref[0] << 8) | pref[1];
return tls1_ec_curve_id2nid(id);
}
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
k++;
}
}
}
if (nmatch == -1)
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
return k;
return 0;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
}
int tls1_set_curves(unsigned char **pext, size_t *pextlen,
int *curves, size_t ncurves)
{
unsigned char *clist, *p;
size_t i;
/* Bitmap of curves included to detect duplicates: only works
* while curve ids < 32
*/
unsigned long dup_list = 0;
clist = OPENSSL_malloc(ncurves * 2);
if (!clist)
return 0;
for (i = 0, p = clist; i < ncurves; i++)
{
unsigned long idmask;
int id;
id = tls1_ec_nid2curve_id(curves[i]);
idmask = 1L << id;
if (!id || (dup_list & idmask))
{
OPENSSL_free(clist);
return 0;
}
dup_list |= idmask;
s2n(id, p);
}
if (*pext)
OPENSSL_free(*pext);
*pext = clist;
*pextlen = ncurves * 2;
return 1;
}
Update curve list size. (cherry picked from commit cfa86987a8d9d2b8cc5e5fea2d3260c46542cdb9)
2013-12-24 18:15:28 +00:00
#define MAX_CURVELIST 28
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
typedef struct
{
size_t nidcnt;
int nid_arr[MAX_CURVELIST];
} nid_cb_st;
static int nid_cb(const char *elem, int len, void *arg)
{
nid_cb_st *narg = arg;
size_t i;
int nid;
char etmp[20];
if (narg->nidcnt == MAX_CURVELIST)
return 0;
if (len > (int)(sizeof(etmp) - 1))
return 0;
memcpy(etmp, elem, len);
etmp[len] = 0;
nid = EC_curve_nist2nid(etmp);
if (nid == NID_undef)
nid = OBJ_sn2nid(etmp);
if (nid == NID_undef)
nid = OBJ_ln2nid(etmp);
if (nid == NID_undef)
return 0;
for (i = 0; i < narg->nidcnt; i++)
if (narg->nid_arr[i] == nid)
return 0;
narg->nid_arr[narg->nidcnt++] = nid;
return 1;
}
/* Set curves based on a colon separate list */
int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
const char *str)
{
nid_cb_st ncb;
ncb.nidcnt = 0;
if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
return 0;
new feature: if ctx==NULL in SSL_CTX_ctrl perform syntax checking only for some operations (currently curves and signature algorithms)
2012-11-08 14:24:51 +00:00
if (pext == NULL)
return 1;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
}
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
/* For an EC key set TLS id and required compression based on parameters */
static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
EC_KEY *ec)
{
int is_prime, id;
const EC_GROUP *grp;
const EC_METHOD *meth;
if (!ec)
return 0;
/* Determine if it is a prime field */
grp = EC_KEY_get0_group(ec);
Fix SSL_OP_SINGLE_ECDH_USE Don't require a public key in tls1_set_ec_id if compression status is not needed. This fixes a bug where SSL_OP_SINGLE_ECDH_USE wouldn't work. (cherry picked from commit 5ff68e8f6dac3b0d8997b8bc379f9111c2bab74f)
2013-11-01 21:35:46 +00:00
if (!grp)
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
return 0;
meth = EC_GROUP_method_of(grp);
if (!meth)
return 0;
if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
is_prime = 1;
else
is_prime = 0;
/* Determine curve ID */
id = EC_GROUP_get_curve_name(grp);
id = tls1_ec_nid2curve_id(id);
/* If we have an ID set it, otherwise set arbitrary explicit curve */
if (id)
{
curve_id[0] = 0;
curve_id[1] = (unsigned char)id;
}
else
{
curve_id[0] = 0xff;
if (is_prime)
curve_id[1] = 0x01;
else
curve_id[1] = 0x02;
}
if (comp_id)
{
Fix SSL_OP_SINGLE_ECDH_USE Don't require a public key in tls1_set_ec_id if compression status is not needed. This fixes a bug where SSL_OP_SINGLE_ECDH_USE wouldn't work. (cherry picked from commit 5ff68e8f6dac3b0d8997b8bc379f9111c2bab74f)
2013-11-01 21:35:46 +00:00
if (EC_KEY_get0_public_key(ec) == NULL)
return 0;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
{
if (is_prime)
*comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
else
*comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
}
else
*comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
}
return 1;
}
/* Check an EC key is compatible with extensions */
static int tls1_check_ec_key(SSL *s,
unsigned char *curve_id, unsigned char *comp_id)
{
const unsigned char *p;
size_t plen, i;
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
int j;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
/* If point formats extension present check it, otherwise everything
* is supported (see RFC4492).
*/
if (comp_id && s->session->tlsext_ecpointformatlist)
{
p = s->session->tlsext_ecpointformatlist;
plen = s->session->tlsext_ecpointformatlist_length;
for (i = 0; i < plen; i++, p++)
{
if (*comp_id == *p)
break;
}
if (i == plen)
return 0;
}
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (!curve_id)
return 1;
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
/* Check curve is consistent with client and server preferences */
for (j = 0; j <= 1; j++)
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
{
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
tls1_get_curvelist(s, j, &p, &plen);
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
for (i = 0; i < plen; i+=2, p+=2)
{
if (p[0] == curve_id[0] && p[1] == curve_id[1])
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
break;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
}
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
if (i == plen)
return 0;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* For clients can only check sent curve list */
if (!s->server)
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
break;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
}
return 1;
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
size_t *pformatslen)
{
/* If we have a custom point format list use it otherwise
* use default */
if (s->tlsext_ecpointformatlist)
{
*pformats = s->tlsext_ecpointformatlist;
*pformatslen = s->tlsext_ecpointformatlist_length;
}
else
{
*pformats = ecformats_default;
/* For Suite B we don't support char2 fields */
if (tls1_suiteb(s))
*pformatslen = sizeof(ecformats_default) - 1;
else
*pformatslen = sizeof(ecformats_default);
}
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* Check cert parameters compatible with extensions: currently just checks
* EC certificates have compatible curves and compression.
*/
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
{
unsigned char comp_id, curve_id[2];
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
EVP_PKEY *pkey;
int rv;
pkey = X509_get_pubkey(x);
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
if (!pkey)
return 0;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* If not EC nothing to do */
if (pkey->type != EVP_PKEY_EC)
{
EVP_PKEY_free(pkey);
return 1;
}
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
EVP_PKEY_free(pkey);
if (!rv)
return 0;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* Can't check curve_id for client certs as we don't have a
* supported curves extension.
*/
rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
if (!rv)
return 0;
/* Special case for suite B. We *MUST* sign using SHA256+P-256 or
* SHA384+P-384, adjust digest if necessary.
*/
if (set_ee_md && tls1_suiteb(s))
{
int check_md;
size_t i;
CERT *c = s->cert;
if (curve_id[0])
return 0;
/* Check to see we have necessary signing algorithm */
if (curve_id[1] == TLSEXT_curve_P_256)
check_md = NID_ecdsa_with_SHA256;
else if (curve_id[1] == TLSEXT_curve_P_384)
check_md = NID_ecdsa_with_SHA384;
else
return 0; /* Should never happen */
for (i = 0; i < c->shared_sigalgslen; i++)
if (check_md == c->shared_sigalgs[i].signandhash_nid)
break;
if (i == c->shared_sigalgslen)
return 0;
if (set_ee_md == 2)
{
if (check_md == NID_ecdsa_with_SHA256)
c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
else
c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
}
}
return rv;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
}
/* Check EC temporary key is compatible with client extensions */
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
{
unsigned char curve_id[2];
EC_KEY *ec = s->cert->ecdh_tmp;
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
/* Allow any curve: not just those peer supports */
fix typo and warning
2012-11-19 02:46:46 +00:00
if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
return 1;
#endif
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
* no other curves permitted.
*/
if (tls1_suiteb(s))
{
/* Curve to check determined by ciphersuite */
if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
curve_id[1] = TLSEXT_curve_P_256;
else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
curve_id[1] = TLSEXT_curve_P_384;
else
return 0;
curve_id[0] = 0;
/* Check this curve is acceptable */
if (!tls1_check_ec_key(s, curve_id, NULL))
return 0;
/* If auto or setting curve from callback assume OK */
if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
return 1;
/* Otherwise check curve is acceptable */
else
{
unsigned char curve_tmp[2];
if (!ec)
return 0;
if (!tls1_set_ec_id(curve_tmp, NULL, ec))
return 0;
if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
return 1;
return 0;
}
}
Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.
2012-04-05 13:38:27 +00:00
if (s->cert->ecdh_tmp_auto)
{
/* Need a shared curve */
if (tls1_shared_curve(s, 0))
return 1;
else return 0;
}
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
if (!ec)
{
if (s->cert->ecdh_tmp_cb)
return 1;
else
return 0;
}
if (!tls1_set_ec_id(curve_id, NULL, ec))
typo
2012-07-24 13:32:40 +00:00
return 0;
check EC tmp key matches preferences
2012-07-24 13:47:40 +00:00
/* Set this to allow use of invalid curves for testing */
#if 0
return 1;
#else
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
return tls1_check_ec_key(s, curve_id, NULL);
check EC tmp key matches preferences
2012-07-24 13:47:40 +00:00
#endif
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
}
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#else
static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
{
return 1;
}
OPENSSL_NO_TLS1 WIN32 build support. Fix so normal build works again.
2007-08-12 23:59:05 +00:00
#endif /* OPENSSL_NO_EC */
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
#ifndef OPENSSL_NO_TLSEXT
Reorder signature algorithms in strongest hash first order.
2011-05-11 16:33:28 +00:00
/* List of supported signature algorithms and hashes. Should make this
* customisable at some point, for now include everything we support.
*/
#ifdef OPENSSL_NO_RSA
#define tlsext_sigalg_rsa(md) /* */
#else
#define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
#endif
#ifdef OPENSSL_NO_DSA
#define tlsext_sigalg_dsa(md) /* */
#else
#define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
#endif
#ifdef OPENSSL_NO_ECDSA
#define tlsext_sigalg_ecdsa(md) /* */
#else
typo
2011-06-01 11:10:35 +00:00
#define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
Reorder signature algorithms in strongest hash first order.
2011-05-11 16:33:28 +00:00
#endif
#define tlsext_sigalg(md) \
tlsext_sigalg_rsa(md) \
tlsext_sigalg_dsa(md) \
tlsext_sigalg_ecdsa(md)
static unsigned char tls12_sigalgs[] = {
#ifndef OPENSSL_NO_SHA512
tlsext_sigalg(TLSEXT_hash_sha512)
tlsext_sigalg(TLSEXT_hash_sha384)
#endif
#ifndef OPENSSL_NO_SHA256
tlsext_sigalg(TLSEXT_hash_sha256)
tlsext_sigalg(TLSEXT_hash_sha224)
#endif
#ifndef OPENSSL_NO_SHA
tlsext_sigalg(TLSEXT_hash_sha1)
#endif
};
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#ifndef OPENSSL_NO_ECDSA
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
static unsigned char suiteb_sigalgs[] = {
tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
};
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#endif
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
PR: 2295 Submitted by: Alexei Khlebnikov <alexei.khlebnikov@opera.com> Reviewed by: steve OOM checking. Leak in OOM fix. Fall-through comment. Duplicate code elimination.
2011-05-20 14:56:29 +00:00
{
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* If Suite B mode use Suite B sigalgs only, ignore any other
* preferences.
*/
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#ifndef OPENSSL_NO_EC
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
switch (tls1_suiteb(s))
{
case SSL_CERT_FLAG_SUITEB_128_LOS:
*psigs = suiteb_sigalgs;
return sizeof(suiteb_sigalgs);
case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
*psigs = suiteb_sigalgs;
return 2;
case SSL_CERT_FLAG_SUITEB_192_LOS:
*psigs = suiteb_sigalgs + 2;
return 2;
}
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#endif
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
/* If server use client authentication sigalgs if not NULL */
if (s->server && s->cert->client_sigalgs)
{
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
*psigs = s->cert->client_sigalgs;
return s->cert->client_sigalgslen;
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
}
else if (s->cert->conf_sigalgs)
{
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
*psigs = s->cert->conf_sigalgs;
return s->cert->conf_sigalgslen;
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
else
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
{
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
*psigs = tls12_sigalgs;
Prevent use of RSA+MD5 in TLS 1.2 by default. Removing RSA+MD5 from the default signature algorithm list prevents its use by default. If a broken implementation attempts to use RSA+MD5 anyway the sanity checking of signature algorithms will cause a fatal alert.
2013-10-15 12:37:01 +00:00
return sizeof(tls12_sigalgs);
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
}
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
}
Abort handshake if signature algorithm used not supported by peer.
2012-07-24 18:11:27 +00:00
/* Check signature algorithm is consistent with sent supported signature
* algorithms and if so return relevant digest.
*/
int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
const unsigned char *sig, EVP_PKEY *pkey)
{
const unsigned char *sent_sigs;
size_t sent_sigslen, i;
int sigalg = tls12_get_sigid(pkey);
/* Should never happen */
if (sigalg == -1)
return -1;
/* Check key type is consistent with signature */
if (sigalg != (int)sig[1])
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#ifndef OPENSSL_NO_EC
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (pkey->type == EVP_PKEY_EC)
{
unsigned char curve_id[2], comp_id;
/* Check compression and curve matches extensions */
if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
return 0;
if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_CURVE);
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
return 0;
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
}
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
if (tls1_suiteb(s))
{
if (curve_id[0])
return 0;
if (curve_id[1] == TLSEXT_curve_P_256)
{
if (sig[0] != TLSEXT_hash_sha256)
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
SSL_R_ILLEGAL_SUITEB_DIGEST);
return 0;
}
}
else if (curve_id[1] == TLSEXT_curve_P_384)
{
if (sig[0] != TLSEXT_hash_sha384)
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
SSL_R_ILLEGAL_SUITEB_DIGEST);
return 0;
}
}
else
return 0;
}
}
else if (tls1_suiteb(s))
return 0;
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#endif
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
Abort handshake if signature algorithm used not supported by peer.
2012-07-24 18:11:27 +00:00
/* Check signature matches a type we sent */
sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
{
if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
break;
}
/* Allow fallback to SHA1 if not strict mode */
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
Abort handshake if signature algorithm used not supported by peer.
2012-07-24 18:11:27 +00:00
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
*pmd = tls12_get_hash(sig[0]);
if (*pmd == NULL)
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
return 0;
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
/* Make sure security callback allows algorithm */
if (!ssl_security(s, SSL_SECOP_SIGALG_CHECK,
EVP_MD_size(*pmd) * 4, EVP_MD_type(*pmd),
(void *)sig))
{
SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
store and print out message digest peer signed with in TLS 1.2
2012-09-07 12:53:42 +00:00
/* Store the digest used so applications can retrieve it if they
* wish.
*/
if (s->session && s->session->sess_cert)
s->session->sess_cert->peer_key->digest = *pmd;
Abort handshake if signature algorithm used not supported by peer.
2012-07-24 18:11:27 +00:00
return 1;
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
/* Get a mask of disabled algorithms: an algorithm is disabled
* if it isn't supported or doesn't appear in supported signature
* algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
* session and not global settings.
*
*/
void ssl_set_client_disabled(SSL *s)
{
CERT *c = s->cert;
c->mask_a = 0;
c->mask_k = 0;
Enable TLS 1.2 ciphers in DTLS 1.2. Port TLS 1.2 GCM code to DTLS. Enable use of TLS 1.2 only ciphers when in DTLS 1.2 mode too.
2013-03-27 19:54:48 +00:00
/* Don't allow TLS 1.2 only ciphers if we don't suppport them */
Make TLS 1.2 ciphers work again. Since s->method does not reflect the final client version when a client hello is sent for SSLv23_client_method it can't be relied on to indicate if TLS 1.2 ciphers should be used. So use the client version instead.
2013-04-04 17:19:18 +00:00
if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s))
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
c->mask_ssl = SSL_TLSV1_2;
else
c->mask_ssl = 0;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
ssl_set_sig_mask(&c->mask_a, s, SSL_SECOP_SIGALG_MASK);
/* Disable static DH if we don't include any appropriate
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
* signature algorithms.
*/
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (c->mask_a & SSL_aRSA)
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
c->mask_k |= SSL_kDHr|SSL_kECDHr;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (c->mask_a & SSL_aDSS)
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
c->mask_k |= SSL_kDHd;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (c->mask_a & SSL_aECDSA)
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
c->mask_k |= SSL_kECDHe;
#ifndef OPENSSL_NO_KRB5
if (!kssl_tgt_is_available(s->kssl_ctx))
{
c->mask_a |= SSL_aKRB5;
c->mask_k |= SSL_kKRB5;
}
#endif
#ifndef OPENSSL_NO_PSK
/* with PSK there must be client callback set */
if (!s->psk_client_callback)
{
c->mask_a |= SSL_aPSK;
c->mask_k |= SSL_kPSK;
}
#endif /* OPENSSL_NO_PSK */
c->valid = 1;
PR: 2295 Submitted by: Alexei Khlebnikov <alexei.khlebnikov@opera.com> Reviewed by: steve OOM checking. Leak in OOM fix. Fall-through comment. Duplicate code elimination.
2011-05-20 14:56:29 +00:00
}
Reorder signature algorithms in strongest hash first order.
2011-05-11 16:33:28 +00:00
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op)
Allow return of supported ciphers. New function ssl_cipher_disabled. Check for disabled client ciphers using ssl_cipher_disabled. New function to return only supported ciphers. New option to ciphers utility to print only supported ciphers.
2014-01-14 14:55:21 +00:00
{
CERT *ct = s->cert;
if (c->algorithm_ssl & ct->mask_ssl || c->algorithm_mkey & ct->mask_k || c->algorithm_auth & ct->mask_a)
return 1;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return !ssl_security(s, op, c->strength_bits, 0, (void *)c);
}
static int tls_use_ticket(SSL *s)
{
if (s->options & SSL_OP_NO_TICKET)
return 0;
return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
Allow return of supported ciphers. New function ssl_cipher_disabled. Check for disabled client ciphers using ssl_cipher_disabled. New function to return only supported ciphers. New option to ciphers utility to print only supported ciphers.
2014-01-14 14:55:21 +00:00
}
Update custom TLS extension and supplemental data 'generate' callbacks to support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.
2013-09-12 19:03:40 +00:00
unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit, int *al)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
int extdatalen=0;
unsigned char *ret = p;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
#ifndef OPENSSL_NO_EC
/* See if we support any ECC ciphersuites */
int using_ecc = 0;
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
if (s->version >= TLS1_VERSION || SSL_IS_DTLS(s))
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
{
int i;
unsigned long alg_k, alg_a;
STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
{
SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
alg_k = c->algorithm_mkey;
alg_a = c->algorithm_auth;
use SSL_kECDHE throughout instead of SSL_kEECDH ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
2013-12-19 18:57:49 +00:00
if ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
|| (alg_a & SSL_aECDSA)))
{
using_ecc = 1;
break;
}
}
}
#endif
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Add support for magic cipher suite value (MCSV). Make secure renegotiation work in SSLv3: initial handshake has no extensions but includes MCSV, if server indicates RI support then renegotiation handshakes include RI. NB: current MCSV value is bogus for testing only, will be updated when we have an official value. Change mismatch alerts to handshake_failure as required by spec. Also have some debugging fprintfs so we can clearly see what is going on if OPENSSL_RI_DEBUG is set.
2009-12-08 13:14:03 +00:00
/* don't add extensions for SSLv3 unless doing secure renegotiation */
if (s->client_version == SSL3_VERSION
&& !s->s3->send_connection_binding)
Update from 1.0.0-stable.
2009-04-28 22:10:54 +00:00
return p;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
ret+=2;
if (ret>=limit) return NULL; /* this really never occurs, but ... */
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
if (s->tlsext_hostname != NULL)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
/* Add TLS extension servername to the Client Hello message */
unsigned long size_str;
long lenmax;
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
/* check for enough space.
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
4 for the servername type and entension length
2 for servernamelist length
1 for the hostname type
2 for hostname length
+ hostname length
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
*/
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((lenmax = limit - ret - 9) < 0
|| (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
return NULL;
/* extension type and length */
s2n(TLSEXT_TYPE_server_name,ret);
s2n(size_str+5,ret);
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
/* length of servername list */
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
s2n(size_str+3,ret);
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
/* hostname type, length and hostname */
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
*(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
s2n(size_str,ret);
memcpy(ret, s->tlsext_hostname, size_str);
ret+=size_str;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
Simplify RI+SCSV logic: 1. Send SCSV is not renegotiating, never empty RI. 2. Send RI if renegotiating.
2010-01-07 19:04:52 +00:00
/* Add RI if renegotiating */
PR: 1833 Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de> Fix other cases not covered by original patch.
2010-08-27 11:29:15 +00:00
if (s->renegotiate)
Simplify RI+SCSV logic: 1. Send SCSV is not renegotiating, never empty RI. 2. Send RI if renegotiating.
2010-01-07 19:04:52 +00:00
{
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
int el;
if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
if((limit - p - 4 - el) < 0) return NULL;
s2n(TLSEXT_TYPE_renegotiate,ret);
s2n(el,ret);
if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
ret += el;
}
Add SRP support.
2011-03-12 17:01:19 +00:00
#ifndef OPENSSL_NO_SRP
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
/* Add SRP username if there is one */
Add SRP support.
2011-03-12 17:01:19 +00:00
if (s->srp_ctx.login != NULL)
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
{ /* Add TLS extension SRP username to the Client Hello message */
Add SRP support.
2011-03-12 17:01:19 +00:00
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
int login_len = strlen(s->srp_ctx.login);
if (login_len > 255 || login_len == 0)
Add SRP support.
2011-03-12 17:01:19 +00:00
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
}
/* check for enough space.
4 for the srp type type and entension length
1 for the srp user identity
+ srp user identity length
*/
if ((limit - ret - 5 - login_len) < 0) return NULL;
/* fill in the extension */
Add SRP support.
2011-03-12 17:01:19 +00:00
s2n(TLSEXT_TYPE_srp,ret);
s2n(login_len+1,ret);
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
(*ret++) = (unsigned char) login_len;
memcpy(ret, s->srp_ctx.login, login_len);
Add SRP support.
2011-03-12 17:01:19 +00:00
ret+=login_len;
}
#endif
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#ifndef OPENSSL_NO_EC
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
if (using_ecc)
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
/* Add TLS extension ECPointFormats to the ClientHello message */
long lenmax;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
const unsigned char *plist;
size_t plistlen;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
size_t i;
unsigned char *etmp;
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
tls1_get_formatlist(s, &plist, &plistlen);
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((lenmax = limit - ret - 5) < 0) return NULL;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
if (plistlen > (size_t)lenmax) return NULL;
if (plistlen > 255)
fix sign problems
2006-03-13 09:55:06 +00:00
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
s2n(TLSEXT_TYPE_ec_point_formats,ret);
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
s2n(plistlen + 1,ret);
*(ret++) = (unsigned char)plistlen ;
memcpy(ret, plist, plistlen);
ret+=plistlen;
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
/* Add TLS extension EllipticCurves to the ClientHello message */
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
plist = s->tlsext_ellipticcurvelist;
Tidy up EC parameter check code: instead of accessing internal structures add utility functions to t1_lib.c to check if EC certificates and parameters are consistent with peer.
2012-04-04 14:41:01 +00:00
tls1_get_curvelist(s, 0, &plist, &plistlen);
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((lenmax = limit - ret - 6) < 0) return NULL;
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
if (plistlen > (size_t)lenmax) return NULL;
if (plistlen > 65532)
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
s2n(TLSEXT_TYPE_elliptic_curves,ret);
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
etmp = ret + 4;
/* Copy curve ID if supported */
for (i = 0; i < plistlen; i += 2, plist += 2)
{
if (tls_curve_allowed(s, plist, SSL_SECOP_CURVE_SUPPORTED))
{
*etmp++ = plist[0];
*etmp++ = plist[1];
}
}
plistlen = etmp - ret - 4;
clarification
2006-04-03 14:11:23 +00:00
/* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
* elliptic_curve_list, but the examples use two bytes.
* http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
* resolves this to two bytes.
*/
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
s2n(plistlen + 2, ret);
Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.
2012-03-28 15:05:04 +00:00
s2n(plistlen, ret);
ret+=plistlen;
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#endif /* OPENSSL_NO_EC */
Move the registration of callback functions to special functions designed for that. This removes the potential error to mix data and function pointers. Please note that I'm a little unsure how incorrect calls to the old ctrl functions should be handled, in som cases. I currently return 0 and that's it, but it may be more correct to generate a genuine error in those cases.
2000-02-20 23:43:02 +00:00
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (tls_use_ticket(s))
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
{
int ticklen;
If it is a new session don't send the old TLS ticket: send a zero length ticket to request a new session.
2009-11-08 14:36:12 +00:00
if (!s->new_session && s->session && s->session->tlsext_tick)
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
ticklen = s->session->tlsext_ticklen;
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
else if (s->session && s->tlsext_session_ticket &&
s->tlsext_session_ticket->data)
{
ticklen = s->tlsext_session_ticket->length;
s->session->tlsext_tick = OPENSSL_malloc(ticklen);
if (!s->session->tlsext_tick)
return NULL;
memcpy(s->session->tlsext_tick,
s->tlsext_session_ticket->data,
ticklen);
s->session->tlsext_ticklen = ticklen;
}
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
else
ticklen = 0;
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
if (ticklen == 0 && s->tlsext_session_ticket &&
s->tlsext_session_ticket->data == NULL)
goto skip_ext;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
/* Check for enough room 2 for extension type, 2 for len
* rest for ticket
*/
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
s2n(TLSEXT_TYPE_session_ticket,ret);
s2n(ticklen,ret);
if (ticklen)
{
memcpy(ret, s->session->tlsext_tick, ticklen);
ret += ticklen;
}
}
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
skip_ext:
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
Use enc_flags when deciding protocol variations. Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement.
2013-03-13 15:33:24 +00:00
if (SSL_USE_SIGALGS(s))
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
{
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
size_t salglen;
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
const unsigned char *salg;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
unsigned char *etmp;
New function ssl_set_client_disabled to set masks for any ciphersuites that are disabled for this session (as opposed to always disabled by configuration).
2012-07-18 14:09:46 +00:00
salglen = tls12_get_psigalgs(s, &salg);
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
if ((size_t)(limit - ret) < salglen + 6)
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
return NULL;
s2n(TLSEXT_TYPE_signature_algorithms,ret);
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
etmp = ret;
/* Skip over lengths for now */
ret += 4;
salglen = tls12_copy_sigalgs(s, etmp, salg, salglen);
/* Fill in lengths */
s2n(salglen + 2, etmp);
s2n(salglen, etmp);
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
ret += salglen;
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
if (s->s3->client_opaque_prf_input != NULL)
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
{
size_t col = s->s3->client_opaque_prf_input_len;
if ((long)(limit - ret - 6 - col < 0))
return NULL;
if (col > 0xFFFD) /* can't happen */
return NULL;
s2n(TLSEXT_TYPE_opaque_prf_input, ret);
s2n(col + 2, ret);
s2n(col, ret);
memcpy(ret, s->s3->client_opaque_prf_input, col);
ret += col;
}
#endif
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
{
int i;
long extlen, idlen, itmp;
OCSP_RESPID *id;
idlen = 0;
for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
{
id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
itmp = i2d_OCSP_RESPID(id, NULL);
if (itmp <= 0)
return NULL;
idlen += itmp + 2;
}
if (s->tlsext_ocsp_exts)
{
extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
if (extlen < 0)
return NULL;
}
else
extlen = 0;
if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
s2n(TLSEXT_TYPE_status_request, ret);
if (extlen + idlen > 0xFFF0)
return NULL;
s2n(extlen + idlen + 5, ret);
*(ret++) = TLSEXT_STATUSTYPE_ocsp;
s2n(idlen, ret);
for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
{
/* save position of id len */
unsigned char *q = ret;
id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
/* skip over id len */
ret += 2;
itmp = i2d_OCSP_RESPID(id, &ret);
/* write id len */
s2n(itmp, q);
}
s2n(extlen, ret);
if (extlen > 0)
i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
/* Add Heartbeat extension */
s2n(TLSEXT_TYPE_heartbeat,ret);
s2n(1,ret);
/* Set mode:
* 1: peer may send requests
* 2: peer not allowed to send requests
*/
if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
*(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
else
*(ret++) = SSL_TLSEXT_HB_ENABLED;
#endif
Fixes to NPN from Adam Langley.
2010-09-05 17:14:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
{
/* The client advertises an emtpy extension to indicate its
* support for Next Protocol Negotiation */
if (limit - ret - 4 < 0)
return NULL;
s2n(TLSEXT_TYPE_next_proto_neg,ret);
s2n(0,ret);
}
#endif
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len)
{
if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
return NULL;
s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
s2n(2 + s->alpn_client_proto_list_len,ret);
s2n(s->alpn_client_proto_list_len,ret);
memcpy(ret, s->alpn_client_proto_list,
s->alpn_client_proto_list_len);
ret += s->alpn_client_proto_list_len;
}
Add DTLS-SRTP.
2011-11-15 22:59:20 +00:00
if(SSL_get_srtp_profiles(s))
{
int el;
ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
if((limit - p - 4 - el) < 0) return NULL;
s2n(TLSEXT_TYPE_use_srtp,ret);
s2n(el,ret);
if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
{
SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
ret += el;
}
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
/* Add custom TLS Extensions to ClientHello */
if (s->ctx->custom_cli_ext_records_count)
{
size_t i;
custom_cli_ext_record* record;
for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
{
const unsigned char* out = NULL;
unsigned short outlen = 0;
record = &s->ctx->custom_cli_ext_records[i];
Cleanup of custom extension stuff. serverinfo rejects non-empty extensions. Omit extension if no relevant serverinfo data. Improve error-handling in serverinfo callback. Cosmetic cleanups. s_client documentation. s_server documentation. SSL_CTX_serverinfo documentation. Cleaup -1 and NULL callback handling for custom extensions, add tests. Cleanup ssl_rsa.c serverinfo code. Whitespace cleanup. Improve comments in ssl.h for serverinfo. Whitespace. Cosmetic cleanup. Reject non-zero-len serverinfo extensions. Whitespace. Make it build.
2013-06-14 05:36:45 +00:00
/* NULL callback sends empty extension */
/* -1 from callback omits extension */
if (record->fn1)
{
int cb_retval = 0;
cb_retval = record->fn1(s, record->ext_type,
Fix whitespace, new-style comments.
2014-02-04 23:16:46 +00:00
&out, &outlen, al,
record->arg);
Cleanup of custom extension stuff. serverinfo rejects non-empty extensions. Omit extension if no relevant serverinfo data. Improve error-handling in serverinfo callback. Cosmetic cleanups. s_client documentation. s_server documentation. SSL_CTX_serverinfo documentation. Cleaup -1 and NULL callback handling for custom extensions, add tests. Cleanup ssl_rsa.c serverinfo code. Whitespace cleanup. Improve comments in ssl.h for serverinfo. Whitespace. Cosmetic cleanup. Reject non-zero-len serverinfo extensions. Whitespace. Make it build.
2013-06-14 05:36:45 +00:00
if (cb_retval == 0)
return NULL; /* error */
if (cb_retval == -1)
continue; /* skip this extension */
}
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
if (limit < ret + 4 + outlen)
return NULL;
s2n(record->ext_type, ret);
s2n(outlen, ret);
memcpy(ret, out, outlen);
ret += outlen;
}
}
Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-03-22 17:12:33 +00:00
#ifdef TLSEXT_TYPE_encrypt_then_mac
s2n(TLSEXT_TYPE_encrypt_then_mac,ret);
s2n(0,ret);
#endif
Update to pad extension. Fix padding calculation for different SSL_METHOD types. Use the standard name as used in draft-agl-tls-padding-02
2013-12-12 03:21:06 +00:00
#ifdef TLSEXT_TYPE_padding
/* Add padding to workaround bugs in F5 terminators.
Set TLS padding extension value. Enable TLS padding extension using official value from: http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
2014-04-05 19:43:54 +00:00
* See https://tools.ietf.org/html/draft-agl-tls-padding-03
Update to pad extension. Fix padding calculation for different SSL_METHOD types. Use the standard name as used in draft-agl-tls-padding-02
2013-12-12 03:21:06 +00:00
*
* NB: because this code works out the length of all existing
* extensions it MUST always appear last.
Experimental workaround TLS filler (WTF) extension. Based on a suggested workaround for the "TLS hang bug" (see FAQ and PR#2771): if the TLS Client Hello record length value would otherwise be > 255 and less that 512 pad with a dummy extension containing zeroes so it is at least 512. To enable it use an unused extension number (for example 0x4242) using e.g. -DTLSEXT_TYPE_wtf=0x4242 WARNING: EXPERIMENTAL, SUBJECT TO CHANGE.
2013-11-06 20:45:12 +00:00
*/
Update to pad extension. Fix padding calculation for different SSL_METHOD types. Use the standard name as used in draft-agl-tls-padding-02
2013-12-12 03:21:06 +00:00
{
int hlen = ret - (unsigned char *)s->init_buf->data;
/* The code in s23_clnt.c to build ClientHello messages includes the
* 5-byte record header in the buffer, while the code in s3_clnt.c does
* not. */
if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
hlen -= 5;
Experimental workaround TLS filler (WTF) extension. Based on a suggested workaround for the "TLS hang bug" (see FAQ and PR#2771): if the TLS Client Hello record length value would otherwise be > 255 and less that 512 pad with a dummy extension containing zeroes so it is at least 512. To enable it use an unused extension number (for example 0x4242) using e.g. -DTLSEXT_TYPE_wtf=0x4242 WARNING: EXPERIMENTAL, SUBJECT TO CHANGE.
2013-11-06 20:45:12 +00:00
if (hlen > 0xff && hlen < 0x200)
{
hlen = 0x200 - hlen;
Update to pad extension. Fix padding calculation for different SSL_METHOD types. Use the standard name as used in draft-agl-tls-padding-02
2013-12-12 03:21:06 +00:00
if (hlen >= 4)
hlen -= 4;
else
hlen = 0;
s2n(TLSEXT_TYPE_padding, ret);
s2n(hlen, ret);
Experimental workaround TLS filler (WTF) extension. Based on a suggested workaround for the "TLS hang bug" (see FAQ and PR#2771): if the TLS Client Hello record length value would otherwise be > 255 and less that 512 pad with a dummy extension containing zeroes so it is at least 512. To enable it use an unused extension number (for example 0x4242) using e.g. -DTLSEXT_TYPE_wtf=0x4242 WARNING: EXPERIMENTAL, SUBJECT TO CHANGE.
2013-11-06 20:45:12 +00:00
memset(ret, 0, hlen);
ret += hlen;
}
}
#endif
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
RFC 5878 support.
2012-05-30 10:10:58 +00:00
if ((extdatalen = ret-p-2) == 0)
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
return p;
s2n(extdatalen,p);
return ret;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Update custom TLS extension and supplemental data 'generate' callbacks to support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.
2013-09-12 19:03:40 +00:00
unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit, int *al)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
int extdatalen=0;
unsigned char *ret = p;
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
size_t i;
custom_srv_ext_record *record;
Fixes to NPN from Adam Langley.
2010-09-05 17:14:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
int next_proto_neg_seen;
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
#endif
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#ifndef OPENSSL_NO_EC
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
use SSL_kECDHE throughout instead of SSL_kEECDH ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
2013-12-19 18:57:49 +00:00
int using_ecc = (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
Make no-ec compilation work.
2013-08-17 16:40:08 +00:00
#endif
Add support for magic cipher suite value (MCSV). Make secure renegotiation work in SSLv3: initial handshake has no extensions but includes MCSV, if server indicates RI support then renegotiation handshakes include RI. NB: current MCSV value is bogus for testing only, will be updated when we have an official value. Change mismatch alerts to handshake_failure as required by spec. Also have some debugging fprintfs so we can clearly see what is going on if OPENSSL_RI_DEBUG is set.
2009-12-08 13:14:03 +00:00
/* don't add extensions for SSLv3, unless doing secure renegotiation */
if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
Update from 1.0.0-stable.
2009-04-28 22:10:54 +00:00
return p;
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
ret+=2;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
if (ret>=limit) return NULL; /* this really never occurs, but ... */
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((long)(limit - ret - 4) < 0) return NULL;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
s2n(TLSEXT_TYPE_server_name,ret);
s2n(0,ret);
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
PR: 2121 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Add extension support to DTLS code mainly using existing implementation for TLS.
2009-12-08 11:37:40 +00:00
if(s->s3->send_connection_binding)
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
{
int el;
if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
{
SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
if((limit - p - 4 - el) < 0) return NULL;
s2n(TLSEXT_TYPE_renegotiate,ret);
s2n(el,ret);
if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
{
SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
ret += el;
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#ifndef OPENSSL_NO_EC
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
if (using_ecc)
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
const unsigned char *plist;
size_t plistlen;
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
/* Add TLS extension ECPointFormats to the ServerHello message */
long lenmax;
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
tls1_get_formatlist(s, &plist, &plistlen);
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((lenmax = limit - ret - 5) < 0) return NULL;
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
if (plistlen > (size_t)lenmax) return NULL;
if (plistlen > 255)
fix sign problems
2006-03-13 09:55:06 +00:00
{
SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
return NULL;
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
s2n(TLSEXT_TYPE_ec_point_formats,ret);
Use default point formats extension for server side as well as client side, if possible. Don't advertise compressed char2 for SuiteB as it is not supported.
2012-11-26 18:38:10 +00:00
s2n(plistlen + 1,ret);
*(ret++) = (unsigned char) plistlen;
memcpy(ret, plist, plistlen);
ret+=plistlen;
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
}
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
/* Currently the server should not respond with a SupportedCurves extension */
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#endif /* OPENSSL_NO_EC */
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (s->tlsext_ticket_expected && tls_use_ticket(s))
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
{
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((long)(limit - ret - 4) < 0) return NULL;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
s2n(TLSEXT_TYPE_session_ticket,ret);
s2n(0,ret);
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
if (s->tlsext_status_expected)
{
if ((long)(limit - ret - 4) < 0) return NULL;
s2n(TLSEXT_TYPE_status_request,ret);
s2n(0,ret);
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
if (s->s3->server_opaque_prf_input != NULL)
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
{
size_t sol = s->s3->server_opaque_prf_input_len;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if ((long)(limit - ret - 6 - sol) < 0)
return NULL;
if (sol > 0xFFFD) /* can't happen */
return NULL;
s2n(TLSEXT_TYPE_opaque_prf_input, ret);
s2n(sol + 2, ret);
s2n(sol, ret);
memcpy(ret, s->s3->server_opaque_prf_input, sol);
ret += sol;
}
#endif
Add DTLS-SRTP.
2011-11-15 22:59:20 +00:00
if(s->srtp_profile)
{
int el;
ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
if((limit - p - 4 - el) < 0) return NULL;
s2n(TLSEXT_TYPE_use_srtp,ret);
s2n(el,ret);
if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
{
fix error discrepancy
2011-12-07 12:28:40 +00:00
SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
Add DTLS-SRTP.
2011-11-15 22:59:20 +00:00
return NULL;
}
ret+=el;
}
1. Changes for s_client.c to make it return non-zero exit code in case of handshake failure 2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to make it recognize GOST certificates as EVP_PKT_SIGN|EVP_PKT_EXCH (required for s3_srvr to accept GOST client certificates). 3. Changes to EVP - adding of function EVP_PKEY_CTX_get0_peerkey - Make function EVP_PKEY_derive_set_peerkey work for context with ENCRYPT operation, because we use peerkey field in the context to pass non-ephemeral secret key to GOST encrypt operation. - added EVP_PKEY_CTRL_SET_IV control command. It is really GOST-specific, but it is used in SSL code, so it has to go in some header file, available during libssl compilation 4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data 5. Include des.h if KSSL_DEBUG is defined into some libssl files, to make debugging output which depends on constants defined there, work and other KSSL_DEBUG output fixes 6. Declaration of real GOST ciphersuites, two authentication methods SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST 7. Implementation of these methods. 8. Support for sending unsolicited serverhello extension if GOST ciphersuite is selected. It is require for interoperability with CryptoPro CSP 3.0 and 3.6 and controlled by SSL_OP_CRYPTOPRO_TLSEXT_BUG constant. This constant is added to SSL_OP_ALL, because it does nothing, if non-GOST ciphersuite is selected, and all implementation of GOST include compatibility with CryptoPro. 9. Support for CertificateVerify message without length field. It is another CryptoPro bug, but support is made unconditional, because it does no harm for draft-conforming implementation. 10. In tls1_mac extra copy of stream mac context is no more done. When I've written currently commited code I haven't read EVP_DigestSignFinal manual carefully enough and haven't noticed that it does an internal digest ctx copying. This implementation was tested against 1. CryptoPro CSP 3.6 client and server 2. Cryptopro CSP 3.0 server
2007-10-26 12:06:36 +00:00
if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
&& (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
{ const unsigned char cryptopro_ext[36] = {
0xfd, 0xe8, /*65000*/
0x00, 0x20, /*32 bytes length*/
0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
if (limit-ret<36) return NULL;
memcpy(ret,cryptopro_ext,36);
ret+=36;
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
only send heartbeat extension from server if client sent one
2012-01-03 22:03:20 +00:00
/* Add Heartbeat extension if we've received one */
if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
{
s2n(TLSEXT_TYPE_heartbeat,ret);
s2n(1,ret);
/* Set mode:
* 1: peer may send requests
* 2: peer not allowed to send requests
*/
if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
*(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
else
*(ret++) = SSL_TLSEXT_HB_ENABLED;
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Send fatal alert if heartbeat extension has an illegal value.
2012-01-05 00:23:17 +00:00
only send heartbeat extension from server if client sent one
2012-01-03 22:03:20 +00:00
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#endif
Fixes to NPN from Adam Langley.
2010-09-05 17:14:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
next_proto_neg_seen = s->s3->next_proto_neg_seen;
s->s3->next_proto_neg_seen = 0;
if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
{
const unsigned char *npa;
unsigned int npalen;
int r;
r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
if (r == SSL_TLSEXT_ERR_OK)
{
if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
s2n(TLSEXT_TYPE_next_proto_neg,ret);
s2n(npalen,ret);
memcpy(ret, npa, npalen);
ret += npalen;
s->s3->next_proto_neg_seen = 1;
}
}
#endif
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
for (i = 0; i < s->ctx->custom_srv_ext_records_count; i++)
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
{
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
const unsigned char *out = NULL;
unsigned short outlen = 0;
int cb_retval = 0;
Fix whitespace, new-style comments.
2014-02-04 23:16:46 +00:00
record = &s->ctx->custom_srv_ext_records[i];
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
/* NULL callback or -1 omits extension */
if (!record->fn2)
Don't break out of the custom extension callback loop - continue instead The contract for custom extension callbacks has changed - all custom extension callbacks are triggered
2014-02-05 02:48:59 +00:00
continue;
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
cb_retval = record->fn2(s, record->ext_type,
&out, &outlen, al,
record->arg);
if (cb_retval == 0)
return NULL; /* error */
if (cb_retval == -1)
Don't break out of the custom extension callback loop - continue instead The contract for custom extension callbacks has changed - all custom extension callbacks are triggered
2014-02-05 02:48:59 +00:00
continue; /* skip this extension */
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
if (limit < ret + 4 + outlen)
return NULL;
s2n(record->ext_type, ret);
s2n(outlen, ret);
memcpy(ret, out, outlen);
ret += outlen;
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
}
Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-03-22 17:12:33 +00:00
#ifdef TLSEXT_TYPE_encrypt_then_mac
if (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC)
{
/* Don't use encrypt_then_mac if AEAD: might want
* to disable for other ciphersuites too.
*/
if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD)
s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
else
{
s2n(TLSEXT_TYPE_encrypt_then_mac,ret);
s2n(0,ret);
}
}
#endif
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
if (s->s3->alpn_selected)
{
const unsigned char *selected = s->s3->alpn_selected;
unsigned len = s->s3->alpn_selected_len;
if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
return NULL;
s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
s2n(3 + len,ret);
s2n(1 + len,ret);
*ret++ = len;
memcpy(ret, selected, len);
ret += len;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
if ((extdatalen = ret-p-2)== 0)
return p;
s2n(extdatalen,p);
return ret;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
/* tls1_alpn_handle_client_hello is called to process the ALPN extension in a
* ClientHello.
* data: the contents of the extension, not including the type and length.
* data_len: the number of bytes in |data|
* al: a pointer to the alert value to send in the event of a non-zero
* return.
*
* returns: 0 on success. */
static int tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
unsigned data_len, int *al)
{
unsigned i;
unsigned proto_len;
const unsigned char *selected;
unsigned char selected_len;
int r;
if (s->ctx->alpn_select_cb == NULL)
return 0;
if (data_len < 2)
goto parse_error;
/* data should contain a uint16 length followed by a series of 8-bit,
* length-prefixed strings. */
i = ((unsigned) data[0]) << 8 |
((unsigned) data[1]);
data_len -= 2;
data += 2;
if (data_len != i)
goto parse_error;
if (data_len < 2)
goto parse_error;
for (i = 0; i < data_len;)
{
proto_len = data[i];
i++;
if (proto_len == 0)
goto parse_error;
if (i + proto_len < i || i + proto_len > data_len)
goto parse_error;
i += proto_len;
}
r = s->ctx->alpn_select_cb(s, &selected, &selected_len, data, data_len,
s->ctx->alpn_select_cb_arg);
if (r == SSL_TLSEXT_ERR_OK) {
if (s->s3->alpn_selected)
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = OPENSSL_malloc(selected_len);
if (!s->s3->alpn_selected)
{
*al = SSL_AD_INTERNAL_ERROR;
return -1;
}
memcpy(s->s3->alpn_selected, selected, selected_len);
s->s3->alpn_selected_len = selected_len;
}
return 0;
parse_error:
*al = SSL_AD_DECODE_ERROR;
return -1;
}
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 12:09:03 +00:00
#ifndef OPENSSL_NO_EC
/* ssl_check_for_safari attempts to fingerprint Safari using OS X
* SecureTransport using the TLS extension block in |d|, of length |n|.
* Safari, since 10.6, sends exactly these extensions, in this order:
* SNI,
* elliptic_curves
* ec_point_formats
*
* We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
* but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
* Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
* 10.8..10.8.3 (which don't work).
*/
static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
unsigned short type, size;
static const unsigned char kSafariExtensionsBlock[] = {
0x00, 0x0a, /* elliptic_curves extension */
0x00, 0x08, /* 8 bytes */
0x00, 0x06, /* 6 bytes of curve ids */
0x00, 0x17, /* P-256 */
0x00, 0x18, /* P-384 */
0x00, 0x19, /* P-521 */
0x00, 0x0b, /* ec_point_formats */
0x00, 0x02, /* 2 bytes */
0x01, /* 1 point format */
0x00, /* uncompressed */
};
/* The following is only present in TLS 1.2 */
static const unsigned char kSafariTLS12ExtensionsBlock[] = {
0x00, 0x0d, /* signature_algorithms */
0x00, 0x0c, /* 12 bytes */
0x00, 0x0a, /* 10 bytes */
0x05, 0x01, /* SHA-384/RSA */
0x04, 0x01, /* SHA-256/RSA */
0x02, 0x01, /* SHA-1/RSA */
0x04, 0x03, /* SHA-256/ECDSA */
0x02, 0x03, /* SHA-1/ECDSA */
};
if (data >= (d+n-2))
return;
data += 2;
if (data > (d+n-4))
return;
n2s(data,type);
n2s(data,size);
if (type != TLSEXT_TYPE_server_name)
return;
if (data+size > d+n)
return;
data += size;
Use TLS version supplied by client when fingerprinting Safari.
2013-09-10 11:21:27 +00:00
if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 12:09:03 +00:00
{
const size_t len1 = sizeof(kSafariExtensionsBlock);
const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
if (data + len1 + len2 != d+n)
return;
if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
return;
if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
return;
}
else
{
const size_t len = sizeof(kSafariExtensionsBlock);
if (data + len != d+n)
return;
if (memcmp(data, kSafariExtensionsBlock, len) != 0)
return;
}
s->s3->is_probably_safari = 1;
}
Tidy up comments.
2013-09-10 11:25:57 +00:00
#endif /* !OPENSSL_NO_EC */
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 12:09:03 +00:00
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Localize client hello extension parsing in t1_lib.c
2012-04-06 11:18:40 +00:00
static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
unsigned short type;
unsigned short size;
unsigned short len;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
unsigned char *data = *p;
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
int renegotiate_seen = 0;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
size_t i;
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
s->servername_done = 0;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
s->tlsext_status_type = -1;
Fix NPN implementation for renegotiation. (Problem pointed out by Ben Murphy.) Submitted by: Adam Langley
2011-11-24 21:07:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
s->s3->next_proto_neg_seen = 0;
#endif
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
if (s->s3->alpn_selected)
{
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = NULL;
}
Various custom extension fixes. Force no SSL2 when custom extensions in use. Don't clear extension state when cert is set. Clear on renegotiate.
2013-07-28 06:10:14 +00:00
/* Clear observed custom extensions */
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
s->s3->serverinfo_client_tlsext_custom_types_count = 0;
if (s->s3->serverinfo_client_tlsext_custom_types != NULL)
Various custom extension fixes. Force no SSL2 when custom extensions in use. Don't clear extension state when cert is set. Clear on renegotiate.
2013-07-28 06:10:14 +00:00
{
Re-add alert variables removed during rebase Whitespace fixes
2014-02-04 21:08:43 +00:00
OPENSSL_free(s->s3->serverinfo_client_tlsext_custom_types);
s->s3->serverinfo_client_tlsext_custom_types = NULL;
}
Various custom extension fixes. Force no SSL2 when custom extensions in use. Don't clear extension state when cert is set. Clear on renegotiate.
2013-07-28 06:10:14 +00:00
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
#endif
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 12:09:03 +00:00
#ifndef OPENSSL_NO_EC
if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
ssl_check_for_safari(s, data, d, n);
Tidy up comments.
2013-09-10 11:25:57 +00:00
#endif /* !OPENSSL_NO_EC */
Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-09-05 12:09:03 +00:00
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
/* Clear any signature algorithms extension received */
if (s->cert->peer_sigalgs)
{
OPENSSL_free(s->cert->peer_sigalgs);
s->cert->peer_sigalgs = NULL;
}
/* Clear any shared sigtnature algorithms */
if (s->cert->shared_sigalgs)
{
OPENSSL_free(s->cert->shared_sigalgs);
s->cert->shared_sigalgs = NULL;
}
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
/* Clear certificate digests and validity flags */
for (i = 0; i < SSL_PKEY_NUM; i++)
{
s->cert->pkeys[i].digest = NULL;
s->cert->pkeys[i].valid_flags = 0;
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-03-22 17:12:33 +00:00
#ifdef TLSEXT_TYPE_encrypt_then_mac
s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
#endif
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
if (data >= (d+n-2))
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
goto ri_check;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
n2s(data,len);
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
if (data > (d+n-len))
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
goto ri_check;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
while (data <= (d+n-4))
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
n2s(data,type);
n2s(data,size);
if (data+size > (d+n))
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
goto ri_check;
Disable debugging fprintf.
2008-04-25 11:33:32 +00:00
#if 0
1. Changes for s_client.c to make it return non-zero exit code in case of handshake failure 2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to make it recognize GOST certificates as EVP_PKT_SIGN|EVP_PKT_EXCH (required for s3_srvr to accept GOST client certificates). 3. Changes to EVP - adding of function EVP_PKEY_CTX_get0_peerkey - Make function EVP_PKEY_derive_set_peerkey work for context with ENCRYPT operation, because we use peerkey field in the context to pass non-ephemeral secret key to GOST encrypt operation. - added EVP_PKEY_CTRL_SET_IV control command. It is really GOST-specific, but it is used in SSL code, so it has to go in some header file, available during libssl compilation 4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data 5. Include des.h if KSSL_DEBUG is defined into some libssl files, to make debugging output which depends on constants defined there, work and other KSSL_DEBUG output fixes 6. Declaration of real GOST ciphersuites, two authentication methods SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST 7. Implementation of these methods. 8. Support for sending unsolicited serverhello extension if GOST ciphersuite is selected. It is require for interoperability with CryptoPro CSP 3.0 and 3.6 and controlled by SSL_OP_CRYPTOPRO_TLSEXT_BUG constant. This constant is added to SSL_OP_ALL, because it does nothing, if non-GOST ciphersuite is selected, and all implementation of GOST include compatibility with CryptoPro. 9. Support for CertificateVerify message without length field. It is another CryptoPro bug, but support is made unconditional, because it does no harm for draft-conforming implementation. 10. In tls1_mac extra copy of stream mac context is no more done. When I've written currently commited code I haven't read EVP_DigestSignFinal manual carefully enough and haven't noticed that it does an internal digest ctx copying. This implementation was tested against 1. CryptoPro CSP 3.6 client and server 2. Cryptopro CSP 3.0 server
2007-10-26 12:06:36 +00:00
fprintf(stderr,"Received extension type %d size %d\n",type,size);
Disable debugging fprintf.
2008-04-25 11:33:32 +00:00
#endif
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if (s->tlsext_debug_cb)
s->tlsext_debug_cb(s, 0, type, data, size,
s->tlsext_debug_arg);
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
/* The servername extension is treated as follows:
- Only the hostname type is supported with a maximum length of 255.
- The servername is rejected if too long or if it contains zeros,
in which case an fatal alert is generated.
- The servername field is maintained together with the session cache.
- When a session is resumed, the servername call back invoked in order
to allow the application to position itself to the right context.
- The servername is acknowledged if it is new for a session or when
it is identical to a previously used for the same session.
Applications can control the behaviour. They can at any time
set a 'desirable' servername for a new SSL object. This can be the
case for example with HTTPS when a Host: header field is received and
a renegotiation is requested. In this case, a possible servername
presented in the new client hello is only acknowledged if it matches
the value of the Host: field.
- Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
if they provide for changing an explicit servername context for the session,
i.e. when the session has been established with a servername extension.
- On session reconnect, the servername extension may be absent.
*/
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
if (type == TLSEXT_TYPE_server_name)
{
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
unsigned char *sdata;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
int servname_type;
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
int dsize;
if (size < 2)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
n2s(data,dsize);
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
size -= 2;
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
if (dsize > size )
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
*al = SSL_AD_DECODE_ERROR;
return 0;
}
sdata = data;
while (dsize > 3)
{
servname_type = *(sdata++);
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
n2s(sdata,len);
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
dsize -= 3;
if (len > dsize)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
if (s->servername_done == 0)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
switch (servname_type)
{
case TLSEXT_NAMETYPE_host_name:
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if (!s->hit)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if(s->session->tlsext_hostname)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (len > TLSEXT_MAXLEN_host_name)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
*al = TLS1_AD_UNRECOGNIZED_NAME;
return 0;
}
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
memcpy(s->session->tlsext_hostname, sdata, len);
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
s->session->tlsext_hostname[len]='\0';
if (strlen(s->session->tlsext_hostname) != len) {
OPENSSL_free(s->session->tlsext_hostname);
From HEAD: Fix double-free in TLS server name extensions which could lead to a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) Reviewed by: openssl-security@openssl.org Obtained from: jorton@redhat.com
2008-05-28 22:15:48 +00:00
s->session->tlsext_hostname = NULL;
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
*al = TLS1_AD_UNRECOGNIZED_NAME;
return 0;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
s->servername_done = 1;
}
else
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
s->servername_done = s->session->tlsext_hostname
&& strlen(s->session->tlsext_hostname) == len
signed vs. unsigned clash.
2006-01-14 11:49:24 +00:00
&& strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
Further TLS extension updates Submitted by: Peter Sylvester
2006-01-09 19:49:05 +00:00
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
break;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
default:
break;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
dsize -= len;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
fix for hostname extension Submitted by: Kaspar Brand, Peter Sylvester
2006-03-30 02:53:30 +00:00
if (dsize != 0)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
}
Add SRP support.
2011-03-12 17:01:19 +00:00
#ifndef OPENSSL_NO_SRP
else if (type == TLSEXT_TYPE_srp)
{
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
if (size <= 0 || ((len = data[0])) != (size -1))
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (s->srp_ctx.login != NULL)
Add SRP support.
2011-03-12 17:01:19 +00:00
{
PR: 2704 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10 20:08:36 +00:00
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
return -1;
memcpy(s->srp_ctx.login, &data[1], len);
s->srp_ctx.login[len]='\0';
if (strlen(s->srp_ctx.login) != len)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
Add SRP support.
2011-03-12 17:01:19 +00:00
}
}
#endif
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#ifndef OPENSSL_NO_EC
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
else if (type == TLSEXT_TYPE_ec_point_formats)
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
unsigned char *sdata = data;
int ecpointformatlist_length = *(sdata++);
reject zero length point format list or supported curves extensions
2012-11-22 14:15:44 +00:00
if (ecpointformatlist_length != size - 1 ||
ecpointformatlist_length < 1)
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if (!s->hit)
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if(s->session->tlsext_ecpointformatlist)
{
Don't assume a decode error if session tlsext_ecpointformatlist is not NULL: it can be legitimately set elsewhere.
2010-11-17 17:37:23 +00:00
OPENSSL_free(s->session->tlsext_ecpointformatlist);
s->session->tlsext_ecpointformatlist = NULL;
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
}
s->session->tlsext_ecpointformatlist_length = 0;
if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
}
#if 0
fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
sdata = s->session->tlsext_ecpointformatlist;
for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
fprintf(stderr,"%i ",*(sdata++));
fprintf(stderr,"\n");
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
#endif
}
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
else if (type == TLSEXT_TYPE_elliptic_curves)
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
{
unsigned char *sdata = data;
int ellipticcurvelist_length = (*(sdata++) << 8);
ellipticcurvelist_length += (*(sdata++));
reject zero length point format list or supported curves extensions
2012-11-22 14:15:44 +00:00
if (ellipticcurvelist_length != size - 2 ||
ellipticcurvelist_length < 1)
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if (!s->hit)
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
{
bring HEAD up to date, add CVE-2010-3864 fix, update NEWS files
2010-11-16 14:18:51 +00:00
if(s->session->tlsext_ellipticcurvelist)
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
s->session->tlsext_ellipticcurvelist_length = 0;
if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
}
#if 0
fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
sdata = s->session->tlsext_ellipticcurvelist;
for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
fprintf(stderr,"%i ",*(sdata++));
fprintf(stderr,"\n");
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#endif
}
fix for OPENSSL_NO_EC PR: 1293
2006-03-15 19:17:56 +00:00
#endif /* OPENSSL_NO_EC */
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
else if (type == TLSEXT_TYPE_opaque_prf_input)
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
{
unsigned char *sdata = data;
if (size < 2)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
n2s(sdata, s->s3->client_opaque_prf_input_len);
if (s->s3->client_opaque_prf_input_len != size - 2)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
OPENSSL_free(s->s3->client_opaque_prf_input);
properly handle length-zero opaque PRF input values (which are pointless, but still might occur)
2007-09-23 11:30:53 +00:00
if (s->s3->client_opaque_prf_input_len == 0)
s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
else
s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if (s->s3->client_opaque_prf_input == NULL)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
}
#endif
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
else if (type == TLSEXT_TYPE_session_ticket)
{
if (s->tls_session_ticket_ext_cb &&
!s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
}
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
else if (type == TLSEXT_TYPE_renegotiate)
{
if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
return 0;
renegotiate_seen = 1;
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
else if (type == TLSEXT_TYPE_signature_algorithms)
{
int dsize;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
if (s->cert->peer_sigalgs || size < 2)
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
n2s(data,dsize);
size -= 2;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
if (dsize != size || dsize & 1 || !dsize)
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (!tls1_process_sigalgs(s, data, dsize))
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
/* If sigalgs received and no shared algorithms fatal
* error.
*/
if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
{
SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
*al = SSL_AD_ILLEGAL_PARAMETER;
return 0;
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
}
Omit initial status request callback check. PR#3178
2014-01-16 13:46:31 +00:00
else if (type == TLSEXT_TYPE_status_request)
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
{
if (size < 5)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
s->tlsext_status_type = *data++;
size--;
if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
{
const unsigned char *sdata;
int dsize;
/* Read in responder_id_list */
n2s(data,dsize);
size -= 2;
if (dsize > size )
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
while (dsize > 0)
{
OCSP_RESPID *id;
int idsize;
if (dsize < 4)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
n2s(data, idsize);
dsize -= 2 + idsize;
OCSP stapling fix (OpenSSL 0.9.8r/1.0.0d) Submitted by: Neel Mehta, Adam Langley, Bodo Moeller
2011-02-08 17:48:57 +00:00
size -= 2 + idsize;
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
if (dsize < 0)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
sdata = data;
data += idsize;
id = d2i_OCSP_RESPID(NULL,
&sdata, idsize);
if (!id)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (data != sdata)
{
OCSP_RESPID_free(id);
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (!s->tlsext_ocsp_ids
&& !(s->tlsext_ocsp_ids =
sk_OCSP_RESPID_new_null()))
{
OCSP_RESPID_free(id);
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
if (!sk_OCSP_RESPID_push(
s->tlsext_ocsp_ids, id))
{
OCSP_RESPID_free(id);
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
}
/* Read in request_extensions */
OCSP stapling fix (OpenSSL 0.9.8r/1.0.0d) Submitted by: Neel Mehta, Adam Langley, Bodo Moeller
2011-02-08 17:48:57 +00:00
if (size < 2)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
n2s(data,dsize);
size -= 2;
OCSP stapling fix (OpenSSL 0.9.8r/1.0.0d) Submitted by: Neel Mehta, Adam Langley, Bodo Moeller
2011-02-08 17:48:57 +00:00
if (dsize != size)
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
sdata = data;
if (dsize > 0)
{
Submitted by: Adam Langley <agl@chromium.org> Reviewed by: steve Fix memory leaks.
2012-01-04 14:25:42 +00:00
if (s->tlsext_ocsp_exts)
{
sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
X509_EXTENSION_free);
}
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
s->tlsext_ocsp_exts =
d2i_X509_EXTENSIONS(NULL,
&sdata, dsize);
if (!s->tlsext_ocsp_exts
|| (data + dsize != sdata))
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
}
}
/* We don't know what to do with any other type
* so ignore it.
*/
else
s->tlsext_status_type = -1;
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
else if (type == TLSEXT_TYPE_heartbeat)
{
switch(data[0])
{
case 0x01: /* Client allows us to send HB requests */
s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
break;
case 0x02: /* Client doesn't accept HB requests */
s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
break;
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Send fatal alert if heartbeat extension has an illegal value.
2012-01-05 00:23:17 +00:00
default: *al = SSL_AD_ILLEGAL_PARAMETER;
return 0;
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
}
}
#endif
Fixes to NPN from Adam Langley.
2010-09-05 17:14:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
else if (type == TLSEXT_TYPE_next_proto_neg &&
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
s->s3->tmp.finish_md_len == 0 &&
s->s3->alpn_selected == NULL)
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
{
/* We shouldn't accept this extension on a
* renegotiation.
*
* s->new_session will be set on renegotiation, but we
* probably shouldn't rely that it couldn't be set on
* the initial renegotation too in certain cases (when
* there's some other reason to disallow resuming an
* earlier session -- the current code won't be doing
* anything like that, but this might change).
* A valid sign that there's been a previous handshake
* in this connection is if s->s3->tmp.finish_md_len >
* 0. (We are talking about a check that will happen
* in the Hello protocol round, well before a new
* Finished message could have been computed.) */
s->s3->next_proto_neg_seen = 1;
}
#endif
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&
s->ctx->alpn_select_cb &&
s->s3->tmp.finish_md_len == 0)
{
if (tls1_alpn_handle_client_hello(s, data, size, al) != 0)
return 0;
Fix compilation with no-nextprotoneg. PR#3106
2013-11-13 23:20:22 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
/* ALPN takes precedence over NPN. */
s->s3->next_proto_neg_seen = 0;
Fix compilation with no-nextprotoneg. PR#3106
2013-11-13 23:20:22 +00:00
#endif
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
}
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
/* session ticket processed earlier */
Add DTLS-SRTP.
2011-11-15 22:59:20 +00:00
else if (type == TLSEXT_TYPE_use_srtp)
{
if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
al))
return 0;
}
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
/* If this ClientHello extension was unhandled and this is
* a nonresumed connection, check whether the extension is a
* custom TLS Extension (has a custom_srv_ext_record), and if
* so call the callback and record the extension number so that
* an appropriate ServerHello may be later returned.
*/
else if (!s->hit && s->ctx->custom_srv_ext_records_count)
{
custom_srv_ext_record *record;
for (i=0; i < s->ctx->custom_srv_ext_records_count; i++)
{
record = &s->ctx->custom_srv_ext_records[i];
if (type == record->ext_type)
{
if (record->fn1 && !record->fn1(s, type, data, size, al, record->arg))
return 0;
}
}
}
Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-03-22 17:12:33 +00:00
#ifdef TLSEXT_TYPE_encrypt_then_mac
else if (type == TLSEXT_TYPE_encrypt_then_mac)
s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
#endif
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
data+=size;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
RFC 5878 support.
2012-05-30 10:10:58 +00:00
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
*p = data;
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
ri_check:
/* Need RI if renegotiating */
PR: 1833 Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de> Fix other cases not covered by original patch.
2010-08-27 11:29:15 +00:00
if (!renegotiate_seen && s->renegotiate &&
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
{
Alert to use is now defined in spec: update code
2009-12-17 15:42:52 +00:00
*al = SSL_AD_HANDSHAKE_FAILURE;
correct error codes
2012-04-18 15:36:12 +00:00
SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
return 0;
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
/* If no signature algorithms extension set default values */
if (!s->cert->peer_sigalgs)
ssl_cert_set_default_md(s->cert);
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
return 1;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Localize client hello extension parsing in t1_lib.c
2012-04-06 11:18:40 +00:00
int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
{
int al = -1;
if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
{
ssl3_send_alert(s,SSL3_AL_FATAL,al);
return 0;
}
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
if (ssl_check_clienthello_tlsext_early(s) <= 0)
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Localize client hello extension parsing in t1_lib.c
2012-04-06 11:18:40 +00:00
{
correct error codes
2012-04-18 15:36:12 +00:00
SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Localize client hello extension parsing in t1_lib.c
2012-04-06 11:18:40 +00:00
return 0;
}
return 1;
}
Fixes to NPN from Adam Langley.
2010-09-05 17:14:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
/* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
* elements of zero length are allowed and the set of elements must exactly fill
* the length of the block. */
Version skew reduction: trivia (I hope).
2012-06-03 22:00:21 +00:00
static char ssl_next_proto_validate(unsigned char *d, unsigned len)
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
{
unsigned int off = 0;
while (off < len)
{
if (d[off] == 0)
return 0;
off += d[off];
off++;
}
return off == len;
}
#endif
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Improved localisation of TLS extension handling and code tidy.
2012-04-24 12:22:23 +00:00
static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
Fix warnings.
2010-06-12 14:13:23 +00:00
unsigned short length;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
unsigned short type;
unsigned short size;
unsigned char *data = *p;
int tlsext_servername = 0;
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
int renegotiate_seen = 0;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Fix NPN implementation for renegotiation. (Problem pointed out by Ben Murphy.) Submitted by: Adam Langley
2011-11-24 21:07:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
s->s3->next_proto_neg_seen = 0;
#endif
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
if (s->s3->alpn_selected)
{
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = NULL;
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
#endif
Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-03-22 17:12:33 +00:00
#ifdef TLSEXT_TYPE_encrypt_then_mac
s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
#endif
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
if (data >= (d+n-2))
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
goto ri_check;
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Fix warnings.
2010-06-12 14:13:23 +00:00
n2s(data,length);
if (data+length != d+n)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
while(data <= (d+n-4))
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
n2s(data,type);
n2s(data,size);
if (data+size > (d+n))
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
goto ri_check;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if (s->tlsext_debug_cb)
s->tlsext_debug_cb(s, 1, type, data, size,
s->tlsext_debug_arg);
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
if (type == TLSEXT_TYPE_server_name)
{
if (s->tlsext_hostname == NULL || size > 0)
{
*al = TLS1_AD_UNRECOGNIZED_NAME;
return 0;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
tlsext_servername = 1;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#ifndef OPENSSL_NO_EC
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
else if (type == TLSEXT_TYPE_ec_point_formats)
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
unsigned char *sdata = data;
int ecpointformatlist_length = *(sdata++);
if (ecpointformatlist_length != size - 1)
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
s->session->tlsext_ecpointformatlist_length = 0;
udpate Supported Point Formats Extension code Submitted by: Douglas Stebila
2006-03-13 01:24:38 +00:00
if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
#if 0
fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
sdata = s->session->tlsext_ecpointformatlist;
for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
fprintf(stderr,"%i ",*(sdata++));
fprintf(stderr,"\n");
#endif
}
fix for OPENSSL_NO_EC PR: 1293
2006-03-15 19:17:56 +00:00
#endif /* OPENSSL_NO_EC */
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
else if (type == TLSEXT_TYPE_session_ticket)
{
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
if (s->tls_session_ticket_ext_cb &&
!s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (!tls_use_ticket(s) || (size > 0))
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
{
*al = TLS1_AD_UNSUPPORTED_EXTENSION;
return 0;
}
s->tlsext_ticket_expected = 1;
}
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
else if (type == TLSEXT_TYPE_opaque_prf_input)
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
{
unsigned char *sdata = data;
if (size < 2)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
n2s(sdata, s->s3->server_opaque_prf_input_len);
if (s->s3->server_opaque_prf_input_len != size - 2)
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
OPENSSL_free(s->s3->server_opaque_prf_input);
properly handle length-zero opaque PRF input values (which are pointless, but still might occur)
2007-09-23 11:30:53 +00:00
if (s->s3->server_opaque_prf_input_len == 0)
s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
else
s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if (s->s3->server_opaque_prf_input == NULL)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
}
#endif
Enable various DTLS extensions. Some TLS extensions were disabled for DTLS. Possibly because they caused problems with the old duplicated code. Enable them again.
2013-03-19 15:49:35 +00:00
else if (type == TLSEXT_TYPE_status_request)
Support for certificate status TLS extension.
2007-09-26 21:56:59 +00:00
{
/* MUST be empty and only sent if we've requested
* a status request message.
*/
if ((s->tlsext_status_type == -1) || (size > 0))
{
*al = TLS1_AD_UNSUPPORTED_EXTENSION;
return 0;
}
/* Set flag to expect CertificateStatus message */
s->tlsext_status_expected = 1;
}
Fixes to NPN from Adam Langley.
2010-09-05 17:14:01 +00:00
#ifndef OPENSSL_NO_NEXTPROTONEG
Fix NPN implementation for renegotiation. (Problem pointed out by Ben Murphy.) Submitted by: Adam Langley
2011-11-24 21:07:01 +00:00
else if (type == TLSEXT_TYPE_next_proto_neg &&
s->s3->tmp.finish_md_len == 0)
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
{
unsigned char *selected;
unsigned char selected_len;
/* We must have requested it. */
Remove extraneous brackets (clang doesn't like them).
2013-01-19 15:12:08 +00:00
if (s->ctx->next_proto_select_cb == NULL)
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
{
*al = TLS1_AD_UNSUPPORTED_EXTENSION;
return 0;
}
/* The data must be valid */
if (!ssl_next_proto_validate(data, size))
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
s->next_proto_negotiated = OPENSSL_malloc(selected_len);
if (!s->next_proto_negotiated)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
memcpy(s->next_proto_negotiated, selected, selected_len);
s->next_proto_negotiated_len = selected_len;
Fix NPN implementation for renegotiation. (Problem pointed out by Ben Murphy.) Submitted by: Adam Langley
2011-11-24 21:07:01 +00:00
s->s3->next_proto_neg_seen = 1;
Add Next Protocol Negotiation.
2010-07-28 10:06:55 +00:00
}
#endif
Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
2013-04-15 22:07:47 +00:00
else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation)
{
unsigned len;
/* We must have requested it. */
if (s->alpn_client_proto_list == NULL)
{
*al = TLS1_AD_UNSUPPORTED_EXTENSION;
return 0;
}
if (size < 4)
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
/* The extension data consists of:
* uint16 list_length
* uint8 proto_length;
* uint8 proto[proto_length]; */
len = data[0];
len <<= 8;
len |= data[1];
if (len != (unsigned) size - 2)
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
len = data[2];
if (len != (unsigned) size - 3)
{
*al = TLS1_AD_DECODE_ERROR;
return 0;
}
if (s->s3->alpn_selected)
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = OPENSSL_malloc(len);
if (!s->s3->alpn_selected)
{
*al = TLS1_AD_INTERNAL_ERROR;
return 0;
}
memcpy(s->s3->alpn_selected, data + 3, len);
s->s3->alpn_selected_len = len;
}
add missing parts of reneg port, fix apps patch
2009-11-11 14:51:19 +00:00
else if (type == TLSEXT_TYPE_renegotiate)
{
if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
return 0;
renegotiate_seen = 1;
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
else if (type == TLSEXT_TYPE_heartbeat)
{
switch(data[0])
{
case 0x01: /* Server allows us to send HB requests */
s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
break;
case 0x02: /* Server doesn't accept HB requests */
s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
break;
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Send fatal alert if heartbeat extension has an illegal value.
2012-01-05 00:23:17 +00:00
default: *al = SSL_AD_ILLEGAL_PARAMETER;
return 0;
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
}
}
#endif
Add DTLS-SRTP.
2011-11-15 22:59:20 +00:00
else if (type == TLSEXT_TYPE_use_srtp)
{
if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
al))
return 0;
}
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.
2013-05-13 01:55:27 +00:00
/* If this extension type was not otherwise handled, but
* matches a custom_cli_ext_record, then send it to the c
* callback */
else if (s->ctx->custom_cli_ext_records_count)
{
size_t i;
custom_cli_ext_record* record;
for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
{
record = &s->ctx->custom_cli_ext_records[i];
if (record->ext_type == type)
{
if (record->fn2 && !record->fn2(s, type, data, size, al, record->arg))
return 0;
break;
}
}
}
Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.
2013-03-22 17:12:33 +00:00
#ifdef TLSEXT_TYPE_encrypt_then_mac
else if (type == TLSEXT_TYPE_encrypt_then_mac)
{
/* Ignore if inappropriate ciphersuite */
if (s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD)
s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
}
#endif
RFC 5878 support.
2012-05-30 10:10:58 +00:00
data += size;
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
if (data != d+n)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
if (!s->hit && tlsext_servername == 1)
{
if (s->tlsext_hostname)
{
if (s->session->tlsext_hostname == NULL)
{
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
if (!s->session->tlsext_hostname)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
*al = SSL_AD_UNRECOGNIZED_NAME;
return 0;
}
}
else
{
*al = SSL_AD_DECODE_ERROR;
return 0;
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
}
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
*p = data;
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
ri_check:
/* Determine if we need to see RI. Strictly speaking if we want to
* avoid an attack we should *always* see RI even on initial server
* hello because the client doesn't see any renegotiation during an
* attack. However this would mean we could not connect to any server
* which doesn't support RI so for the immediate future tolerate RI
* absence on initial connect only.
*/
Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as initial connection to unpatched servers. There are no additional security concerns in doing this as clients don't see renegotiation during an attack anyway.
2010-02-17 18:38:31 +00:00
if (!renegotiate_seen
&& !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
New option to enable/disable connection to unpatched servers
2009-12-16 20:25:59 +00:00
&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
{
Alert to use is now defined in spec: update code
2009-12-17 15:42:52 +00:00
*al = SSL_AD_HANDSHAKE_FAILURE;
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Improved localisation of TLS extension handling and code tidy.
2012-04-24 12:22:23 +00:00
SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
Allow initial connection (but no renegoriation) to servers which don't support RI. Reorganise RI checking code and handle some missing cases.
2009-12-14 13:56:04 +00:00
SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
return 0;
}
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
return 1;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Support TLS extensions (specifically, HostName) Submitted by: Peter Sylvester
2006-01-02 23:14:37 +00:00
Avoid hard-coded table length where we can use sizeof. Submitted by: Peter Sylvester Reviewed by: Bodo Moeller
2006-04-03 11:56:30 +00:00
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
int ssl_prepare_clienthello_tlsext(SSL *s)
{
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
{
int r = 1;
if (s->ctx->tlsext_opaque_prf_input_callback != 0)
{
r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
if (!r)
return -1;
}
if (s->tlsext_opaque_prf_input != NULL)
{
if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
OPENSSL_free(s->s3->client_opaque_prf_input);
properly handle length-zero opaque PRF input values (which are pointless, but still might occur)
2007-09-23 11:30:53 +00:00
if (s->tlsext_opaque_prf_input_len == 0)
s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
else
s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if (s->s3->client_opaque_prf_input == NULL)
{
SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
return -1;
}
s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
}
if (r == 2)
/* at callback's request, insist on receiving an appropriate server opaque PRF input */
s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
}
#endif
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
return 1;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
int ssl_prepare_serverhello_tlsext(SSL *s)
{
return 1;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
static int ssl_check_clienthello_tlsext_early(SSL *s)
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
{
More TLS extension related changes. Submitted by: Peter Sylvester
2006-01-11 06:10:40 +00:00
int ret=SSL_TLSEXT_ERR_NOACK;
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
int al = SSL_AD_UNRECOGNIZED_NAME;
#ifndef OPENSSL_NO_EC
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
/* The handling of the ECPointFormats extension is done elsewhere, namely in
* ssl3_choose_cipher in s3_lib.c.
*/
/* The handling of the EllipticCurves extension is done elsewhere, namely in
* ssl3_choose_cipher in s3_lib.c.
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
*/
#endif
if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
{
/* This sort of belongs into ssl_prepare_serverhello_tlsext(),
* but we might be sending an alert in response to the client hello,
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
* so this has to happen here in
* ssl_check_clienthello_tlsext_early(). */
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
int r = 1;
if (s->ctx->tlsext_opaque_prf_input_callback != 0)
{
r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
if (!r)
{
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
al = SSL_AD_INTERNAL_ERROR;
goto err;
}
}
if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
OPENSSL_free(s->s3->server_opaque_prf_input);
s->s3->server_opaque_prf_input = NULL;
if (s->tlsext_opaque_prf_input != NULL)
{
if (s->s3->client_opaque_prf_input != NULL &&
s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
{
/* can only use this extension if we have a server opaque PRF input
* of the same length as the client opaque PRF input! */
properly handle length-zero opaque PRF input values (which are pointless, but still might occur)
2007-09-23 11:30:53 +00:00
if (s->tlsext_opaque_prf_input_len == 0)
s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
else
s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
if (s->s3->server_opaque_prf_input == NULL)
{
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
al = SSL_AD_INTERNAL_ERROR;
goto err;
}
s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
}
}
if (r == 2 && s->s3->server_opaque_prf_input == NULL)
{
/* The callback wants to enforce use of the extension,
* but we can't do that with the client opaque PRF input;
* abort the handshake.
*/
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
al = SSL_AD_HANDSHAKE_FAILURE;
}
}
err:
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
#endif
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
switch (ret)
{
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
case SSL_TLSEXT_ERR_ALERT_FATAL:
ssl3_send_alert(s,SSL3_AL_FATAL,al);
return -1;
case SSL_TLSEXT_ERR_ALERT_WARNING:
ssl3_send_alert(s,SSL3_AL_WARNING,al);
return 1;
case SSL_TLSEXT_ERR_NOACK:
s->servername_done=0;
default:
return 1;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
}
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
int ssl_check_clienthello_tlsext_late(SSL *s)
{
int ret = SSL_TLSEXT_ERR_OK;
int al;
/* If status request then ask callback what to do.
* Note: this must be called after servername callbacks in case
* the certificate has changed, and must be called after the cipher
* has been chosen because this may influence which certificate is sent
*/
if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
{
int r;
Minor enhancement to PR#2836 fix. Instead of modifying SSL_get_certificate change the current certificate (in s->cert->key) to the one used and then SSL_get_certificate and SSL_get_privatekey will automatically work.
2012-09-11 13:34:08 +00:00
CERT_PKEY *certpkey;
certpkey = ssl_get_server_send_pkey(s);
/* If no certificate can't return certificate status */
if (certpkey == NULL)
{
s->tlsext_status_expected = 0;
return 1;
}
/* Set current certificate to one we will use so
* SSL_get_certificate et al can pick it up.
*/
s->cert->key = certpkey;
Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
2012-09-11 12:57:46 +00:00
r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
switch (r)
{
/* We don't want to send a status request response */
case SSL_TLSEXT_ERR_NOACK:
s->tlsext_status_expected = 0;
break;
/* status request response should be sent */
case SSL_TLSEXT_ERR_OK:
if (s->tlsext_ocsp_resp)
s->tlsext_status_expected = 1;
else
s->tlsext_status_expected = 0;
break;
/* something bad happened */
case SSL_TLSEXT_ERR_ALERT_FATAL:
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
al = SSL_AD_INTERNAL_ERROR;
goto err;
}
}
else
s->tlsext_status_expected = 0;
err:
switch (ret)
{
case SSL_TLSEXT_ERR_ALERT_FATAL:
ssl3_send_alert(s, SSL3_AL_FATAL, al);
return -1;
case SSL_TLSEXT_ERR_ALERT_WARNING:
ssl3_send_alert(s, SSL3_AL_WARNING, al);
return 1;
default:
return 1;
}
}
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
int ssl_check_serverhello_tlsext(SSL *s)
{
int ret=SSL_TLSEXT_ERR_NOACK;
Further TLS extension improvements Submitted by: Peter Sylvester
2006-01-13 09:21:10 +00:00
int al = SSL_AD_UNRECOGNIZED_NAME;
More TLS extension related changes. Submitted by: Peter Sylvester
2006-01-11 06:10:40 +00:00
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
#ifndef OPENSSL_NO_EC
PR: 2240 Submitted by: Jack Lloyd <lloyd@randombit.net>, "Mounir IDRASSI" <mounir.idrassi@idrix.net>, steve Reviewed by: steve As required by RFC4492 an absent supported points format by a server is not an error: it should be treated as equivalent to an extension only containing uncompressed.
2010-11-25 12:27:09 +00:00
/* If we are client and using an elliptic curve cryptography cipher
* suite, then if server returns an EC point formats lists extension
* it must contain uncompressed.
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
*/
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
PR: 2240 Submitted by: Jack Lloyd <lloyd@randombit.net>, "Mounir IDRASSI" <mounir.idrassi@idrix.net>, steve Reviewed by: steve As required by RFC4492 an absent supported points format by a server is not an error: it should be treated as equivalent to an extension only containing uncompressed.
2010-11-25 12:27:09 +00:00
(s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
use SSL_kECDHE throughout instead of SSL_kEECDH ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
2013-12-19 18:57:49 +00:00
((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
{
/* we are using an ECC cipher */
signed vs. unsigned
2006-03-13 22:07:05 +00:00
size_t i;
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
unsigned char *list;
int found_uncompressed = 0;
Oh, now I noticed Bodo's change that made tlsext_ecpointformatlist unsigned...
2006-03-13 12:37:19 +00:00
list = s->session->tlsext_ecpointformatlist;
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
{
if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
{
found_uncompressed = 1;
break;
}
}
if (!found_uncompressed)
{
fix function codes for error
2007-04-24 01:06:19 +00:00
SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
Implement the Supported Point Formats Extension for ECC ciphersuites Submitted by: Douglas Stebila
2006-03-11 23:46:37 +00:00
return -1;
}
}
ret = SSL_TLSEXT_ERR_OK;
#endif /* OPENSSL_NO_EC */
More TLS extension related changes. Submitted by: Peter Sylvester
2006-01-11 06:10:40 +00:00
if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
Further TLS extension improvements Submitted by: Peter Sylvester
2006-01-13 09:21:10 +00:00
ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
More TLS extension related changes. Submitted by: Peter Sylvester
2006-01-11 06:10:40 +00:00
else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
Further TLS extension improvements Submitted by: Peter Sylvester
2006-01-13 09:21:10 +00:00
ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
More TLS extension related changes. Submitted by: Peter Sylvester
2006-01-11 06:10:40 +00:00
Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2007-09-21 06:54:24 +00:00
#ifdef TLSEXT_TYPE_opaque_prf_input
if (s->s3->server_opaque_prf_input_len > 0)
{
/* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
* So first verify that we really have a value from the server too. */
if (s->s3->server_opaque_prf_input == NULL)
{
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
al = SSL_AD_HANDSHAKE_FAILURE;
}
/* Anytime the server *has* sent an opaque PRF input, we need to check
* that we have a client opaque PRF input of the same size. */
if (s->s3->client_opaque_prf_input == NULL ||
s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
{
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
al = SSL_AD_ILLEGAL_PARAMETER;
}
}
#endif
Move no status notification to ssl_check_serverhello_tlsext() to ensure no status is notified even if no server extensions are present.
2007-09-28 17:45:11 +00:00
/* If we've requested certificate status and we wont get one
* tell the callback
*/
if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
Apparently s->ctx could be NULL at this point (see earlier test). (Coverity ID 148).
2008-12-29 16:13:49 +00:00
&& s->ctx && s->ctx->tlsext_status_cb)
Move no status notification to ssl_check_serverhello_tlsext() to ensure no status is notified even if no server extensions are present.
2007-09-28 17:45:11 +00:00
{
int r;
/* Set resp to NULL, resplen to -1 so callback knows
* there is no response.
*/
if (s->tlsext_ocsp_resp)
{
OPENSSL_free(s->tlsext_ocsp_resp);
s->tlsext_ocsp_resp = NULL;
}
s->tlsext_ocsp_resplen = -1;
r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
if (r == 0)
{
al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
}
if (r < 0)
{
al = SSL_AD_INTERNAL_ERROR;
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
}
}
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
switch (ret)
{
Further TLS extension improvements Submitted by: Peter Sylvester
2006-01-13 09:21:10 +00:00
case SSL_TLSEXT_ERR_ALERT_FATAL:
ssl3_send_alert(s,SSL3_AL_FATAL,al);
return -1;
case SSL_TLSEXT_ERR_ALERT_WARNING:
ssl3_send_alert(s,SSL3_AL_WARNING,al);
return 1;
case SSL_TLSEXT_ERR_NOACK:
s->servername_done=0;
default:
return 1;
Reorganize the data used for SSL ciphersuite pattern matching. This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-17 06:45:38 +00:00
}
Various changes in the new TLS extension code, including the following: - fix indentation - rename some functions and macros - fix up confusion between SSL_ERROR_... and SSL_AD_... values
2006-01-03 03:27:19 +00:00
}
Implement Supported Elliptic Curves Extension. Submitted by: Douglas Stebila
2006-03-30 02:44:56 +00:00
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Improved localisation of TLS extension handling and code tidy.
2012-04-24 12:22:23 +00:00
int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
{
int al = -1;
if (s->version < SSL3_VERSION)
return 1;
if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
{
ssl3_send_alert(s,SSL3_AL_FATAL,al);
return 0;
}
if (ssl_check_serverhello_tlsext(s) <= 0)
{
SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
return 0;
}
return 1;
}
Fix session handling.
2011-09-05 13:36:23 +00:00
/* Since the server cache lookup is done early on in the processing of the
* ClientHello, and other operations depend on the result, we need to handle
* any TLS session ticket extension at the same time.
*
* session_id: points at the session ID in the ClientHello. This code will
* read past the end of this in order to parse out the session ticket
* extension, if any.
* len: the length of the session ID.
* limit: a pointer to the first byte after the ClientHello.
* ret: (output) on return, if a ticket was decrypted, then this is set to
* point to the resulting session.
*
* If s->tls_session_secret_cb is set then we are expecting a pre-shared key
* ciphersuite, in which case we have no use for session tickets and one will
* never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
*
* Returns:
* -1: fatal error, either from parsing or decrypting the ticket.
* 0: no ticket was found (or was ignored, based on settings).
* 1: a zero length extension was found, indicating that the client supports
* session tickets but doesn't currently have one to offer.
* 2: either s->tls_session_secret_cb was set, or a ticket was offered but
* couldn't be decrypted because of a non-fatal error.
* 3: a ticket was successfully decrypted and *ret was set.
*
* Side effects:
* Sets s->tlsext_ticket_expected to 1 if the server will have to issue
* a new session ticket to the client because the client indicated support
* (and s->tls_session_secret_cb is NULL) but the client either doesn't have
* a session ticket or we couldn't use the one it gave us, or if
* s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
* Otherwise, s->tlsext_ticket_expected is set to 0.
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
*/
int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
Fix session handling.
2011-09-05 13:36:23 +00:00
const unsigned char *limit, SSL_SESSION **ret)
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
{
/* Point after session ID in client hello */
const unsigned char *p = session_id + len;
unsigned short i;
Fix from stable branch.
2008-09-03 22:17:11 +00:00
Fix session handling.
2011-09-05 13:36:23 +00:00
*ret = NULL;
s->tlsext_ticket_expected = 0;
Fix from stable branch.
2008-09-03 22:17:11 +00:00
/* If tickets disabled behave as if no ticket present
Fix session handling.
2011-09-05 13:36:23 +00:00
* to permit stateful resumption.
*/
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (!tls_use_ticket(s))
Fix session handling.
2011-09-05 13:36:23 +00:00
return 0;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if ((s->version <= SSL3_VERSION) || !limit)
Fix session handling.
2011-09-05 13:36:23 +00:00
return 0;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if (p >= limit)
return -1;
PR: 2028 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org Fix DTLS cookie management bugs.
2009-09-04 17:42:53 +00:00
/* Skip past DTLS cookie */
Use enc_flags when deciding protocol variations. Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement.
2013-03-13 15:33:24 +00:00
if (SSL_IS_DTLS(s))
PR: 2028 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org Fix DTLS cookie management bugs.
2009-09-04 17:42:53 +00:00
{
i = *(p++);
p+= i;
if (p >= limit)
return -1;
}
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
/* Skip past cipher list */
n2s(p, i);
p+= i;
if (p >= limit)
return -1;
/* Skip past compression algorithm list */
i = *(p++);
p += i;
if (p > limit)
return -1;
/* Now at start of extensions */
if ((p + 2) >= limit)
Fix session handling.
2011-09-05 13:36:23 +00:00
return 0;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
n2s(p, i);
while ((p + 4) <= limit)
{
unsigned short type, size;
n2s(p, type);
n2s(p, size);
if (p + size > limit)
Fix session handling.
2011-09-05 13:36:23 +00:00
return 0;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if (type == TLSEXT_TYPE_session_ticket)
{
Fix session handling.
2011-09-05 13:36:23 +00:00
int r;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if (size == 0)
{
Fix session handling.
2011-09-05 13:36:23 +00:00
/* The client will accept a ticket but doesn't
* currently have one. */
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
s->tlsext_ticket_expected = 1;
Fix session handling.
2011-09-05 13:36:23 +00:00
return 1;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
}
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
if (s->tls_session_secret_cb)
{
Fix session handling.
2011-09-05 13:36:23 +00:00
/* Indicate that the ticket couldn't be
* decrypted rather than generating the session
* from ticket now, trigger abbreviated
* handshake based on external mechanism to
* calculate the master secret later. */
return 2;
}
r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
switch (r)
{
case 2: /* ticket couldn't be decrypted */
s->tlsext_ticket_expected = 1;
return 2;
case 3: /* ticket was decrypted */
return r;
case 4: /* ticket decrypted but need to renew */
s->tlsext_ticket_expected = 1;
return 3;
default: /* fatal error */
return -1;
PR: 1574 Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
2008-11-15 17:18:12 +00:00
}
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
}
p += size;
}
Fix session handling.
2011-09-05 13:36:23 +00:00
return 0;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
}
Fix session handling.
2011-09-05 13:36:23 +00:00
/* tls_decrypt_ticket attempts to decrypt a session ticket.
*
* etick: points to the body of the session ticket extension.
* eticklen: the length of the session tickets extenion.
* sess_id: points at the session ID.
* sesslen: the length of the session ID.
* psess: (output) on return, if a ticket was decrypted, then this is set to
* point to the resulting session.
*
* Returns:
* -1: fatal error, either from parsing or decrypting the ticket.
* 2: the ticket couldn't be decrypted.
* 3: a ticket was successfully decrypted and *psess was set.
* 4: same as 3, but the ticket needs to be renewed.
*/
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
const unsigned char *sess_id, int sesslen,
SSL_SESSION **psess)
{
SSL_SESSION *sess;
unsigned char *sdec;
const unsigned char *p;
Update from stable branch.
2008-04-30 16:14:02 +00:00
int slen, mlen, renew_ticket = 0;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
unsigned char tick_hmac[EVP_MAX_MD_SIZE];
HMAC_CTX hctx;
EVP_CIPHER_CTX ctx;
Fix statless session resumption so it can coexist with SNI
2009-10-30 13:22:24 +00:00
SSL_CTX *tctx = s->initial_ctx;
Update from stable branch.
2008-04-30 16:14:02 +00:00
/* Need at least keyname + iv + some encrypted data */
if (eticklen < 48)
Fix session handling.
2011-09-05 13:36:23 +00:00
return 2;
Update from stable branch.
2008-04-30 16:14:02 +00:00
/* Initialize session ticket encryption and HMAC contexts */
HMAC_CTX_init(&hctx);
EVP_CIPHER_CTX_init(&ctx);
Fix statless session resumption so it can coexist with SNI
2009-10-30 13:22:24 +00:00
if (tctx->tlsext_ticket_key_cb)
Update from stable branch.
2008-04-30 16:14:02 +00:00
{
unsigned char *nctick = (unsigned char *)etick;
Fix statless session resumption so it can coexist with SNI
2009-10-30 13:22:24 +00:00
int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
Update from stable branch.
2008-04-30 16:14:02 +00:00
&ctx, &hctx, 0);
if (rv < 0)
return -1;
if (rv == 0)
Fix session handling.
2011-09-05 13:36:23 +00:00
return 2;
Update from stable branch.
2008-04-30 16:14:02 +00:00
if (rv == 2)
renew_ticket = 1;
}
else
{
/* Check key name matches */
Fix statless session resumption so it can coexist with SNI
2009-10-30 13:22:24 +00:00
if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
Fix session handling.
2011-09-05 13:36:23 +00:00
return 2;
Fix statless session resumption so it can coexist with SNI
2009-10-30 13:22:24 +00:00
HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
Update from stable branch.
2008-04-30 16:14:02 +00:00
tlsext_tick_md(), NULL);
EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
Fix statless session resumption so it can coexist with SNI
2009-10-30 13:22:24 +00:00
tctx->tlsext_tick_aes_key, etick + 16);
Update from stable branch.
2008-04-30 16:14:02 +00:00
}
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
/* Attempt to process session ticket, first conduct sanity and
Fix session handling.
2011-09-05 13:36:23 +00:00
* integrity checks on ticket.
*/
Update from stable branch.
2008-04-30 16:14:02 +00:00
mlen = HMAC_size(&hctx);
If we're going to return errors (no matter how stupid), then we should test for them!
2008-12-29 16:11:58 +00:00
if (mlen < 0)
{
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
eticklen -= mlen;
/* Check HMAC of encrypted ticket */
HMAC_Update(&hctx, etick, eticklen);
HMAC_Final(&hctx, tick_hmac, NULL);
HMAC_CTX_cleanup(&hctx);
Add and use a constant-time memcmp. This change adds CRYPTO_memcmp, which compares two vectors of bytes in an amount of time that's independent of their contents. It also changes several MAC compares in the code to use this over the standard memcmp, which may leak information about the size of a matching prefix. (cherry picked from commit 2ee798880a246d648ecddadc5b91367bee4a5d98)
2013-01-28 17:30:38 +00:00
if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
Fix session handling.
2011-09-05 13:36:23 +00:00
return 2;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
/* Attempt to decrypt session data */
/* Move p after IV to start of encrypted ticket, update length */
Update from stable branch.
2008-04-30 16:14:02 +00:00
p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
sdec = OPENSSL_malloc(eticklen);
if (!sdec)
{
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
Fix session handling.
2011-09-05 13:36:23 +00:00
return 2;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
slen += mlen;
EVP_CIPHER_CTX_cleanup(&ctx);
p = sdec;
Fix session handling.
2011-09-05 13:36:23 +00:00
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
sess = d2i_SSL_SESSION(NULL, &p, slen);
OPENSSL_free(sdec);
if (sess)
{
Fix session handling.
2011-09-05 13:36:23 +00:00
/* The session ID, if non-empty, is used by some clients to
* detect that the ticket has been accepted. So we copy it to
* the session structure. If it is empty set length to zero
* as required by standard.
*/
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
if (sesslen)
memcpy(sess->session_id, sess_id, sesslen);
sess->session_id_length = sesslen;
*psess = sess;
Fix session handling.
2011-09-05 13:36:23 +00:00
if (renew_ticket)
return 4;
else
return 3;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
}
Fix session handling.
2011-09-05 13:36:23 +00:00
ERR_clear_error();
/* For session parse failure, indicate that we need to send a new
* ticket. */
return 2;
RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.
2007-08-11 23:18:29 +00:00
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
/* Tables to translate from NIDs to TLS v1.2 ids */
typedef struct
{
int nid;
int id;
} tls12_lookup;
static tls12_lookup tls12_md[] = {
{NID_md5, TLSEXT_hash_md5},
{NID_sha1, TLSEXT_hash_sha1},
{NID_sha224, TLSEXT_hash_sha224},
{NID_sha256, TLSEXT_hash_sha256},
{NID_sha384, TLSEXT_hash_sha384},
{NID_sha512, TLSEXT_hash_sha512}
};
static tls12_lookup tls12_sig[] = {
{EVP_PKEY_RSA, TLSEXT_signature_rsa},
{EVP_PKEY_DSA, TLSEXT_signature_dsa},
{EVP_PKEY_EC, TLSEXT_signature_ecdsa}
};
static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
{
size_t i;
for (i = 0; i < tlen; i++)
{
if (table[i].nid == nid)
return table[i].id;
}
return -1;
}
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
{
size_t i;
for (i = 0; i < tlen; i++)
{
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
if ((table[i].id) == id)
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
return table[i].nid;
}
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
return NID_undef;
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
}
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
{
int sig_id, md_id;
return error if md is NULL
2012-01-22 13:12:14 +00:00
if (!md)
return 0;
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
sizeof(tls12_md)/sizeof(tls12_lookup));
if (md_id == -1)
return 0;
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
sig_id = tls12_get_sigid(pk);
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
if (sig_id == -1)
return 0;
p[0] = (unsigned char)md_id;
p[1] = (unsigned char)sig_id;
return 1;
}
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
int tls12_get_sigid(const EVP_PKEY *pk)
{
return tls12_find_id(pk->type, tls12_sig,
sizeof(tls12_sig)/sizeof(tls12_lookup));
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
typedef struct
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
{
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
int nid;
int secbits;
const EVP_MD *(*mfunc)(void);
} tls12_hash_info;
static const tls12_hash_info tls12_md_info[] = {
#ifdef OPENSSL_NO_MD5
{NID_md5, 64, 0},
#else
{NID_md5, 64, EVP_md5},
Don't advertise or use MD5 for TLS v1.2 in FIPS mode
2011-05-25 15:31:32 +00:00
#endif
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
#ifdef OPENSSL_NO_SHA
{NID_sha1, 80, 0},
#else
{NID_sha1, 80, EVP_sha1},
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
#endif
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
#ifdef OPENSSL_NO_SHA256
{NID_sha224, 112, 0},
{NID_sha256, 128, 0},
#else
{NID_sha224, 112, EVP_sha224},
{NID_sha256, 128, EVP_sha256},
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
#endif
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
#ifdef OPENSSL_NO_SHA512
{NID_sha384, 192, 0},
{NID_sha512, 256, 0}
#else
{NID_sha384, 192, EVP_sha384},
{NID_sha512, 256, EVP_sha512}
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
#endif
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
};
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
static const tls12_hash_info *tls12_get_hash_info(unsigned char hash_alg)
{
if (hash_alg == 0)
return NULL;
if (hash_alg > sizeof(tls12_md_info)/sizeof(tls12_md_info[0]))
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
return NULL;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
return tls12_md_info + hash_alg - 1;
}
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
const EVP_MD *tls12_get_hash(unsigned char hash_alg)
{
const tls12_hash_info *inf;
#ifndef OPENSSL_FIPS
if (hash_alg == TLSEXT_hash_md5 && FIPS_mode())
return NULL;
#endif
inf = tls12_get_hash_info(hash_alg);
if (!inf || !inf->mfunc)
return NULL;
return inf->mfunc();
Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-09 15:44:01 +00:00
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
static int tls12_get_pkey_idx(unsigned char sig_alg)
{
switch(sig_alg)
{
#ifndef OPENSSL_NO_RSA
case TLSEXT_signature_rsa:
return SSL_PKEY_RSA_SIGN;
#endif
#ifndef OPENSSL_NO_DSA
case TLSEXT_signature_dsa:
return SSL_PKEY_DSA_SIGN;
#endif
#ifndef OPENSSL_NO_ECDSA
case TLSEXT_signature_ecdsa:
return SSL_PKEY_ECC;
#endif
}
return -1;
}
/* Convert TLS 1.2 signature algorithm extension values into NIDs */
static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
int *psignhash_nid, const unsigned char *data)
{
stop warning
2012-07-19 16:57:19 +00:00
int sign_nid = 0, hash_nid = 0;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
if (!phash_nid && !psign_nid && !psignhash_nid)
return;
if (phash_nid || psignhash_nid)
{
hash_nid = tls12_find_nid(data[0], tls12_md,
sizeof(tls12_md)/sizeof(tls12_lookup));
if (phash_nid)
*phash_nid = hash_nid;
}
if (psign_nid || psignhash_nid)
{
sign_nid = tls12_find_nid(data[1], tls12_sig,
sizeof(tls12_sig)/sizeof(tls12_lookup));
if (psign_nid)
*psign_nid = sign_nid;
}
if (psignhash_nid)
{
if (sign_nid && hash_nid)
OBJ_find_sigid_by_algs(psignhash_nid,
hash_nid, sign_nid);
else
*psignhash_nid = NID_undef;
}
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
/* Check to see if a signature algorithm is allowed */
static int tls12_sigalg_allowed(SSL *s, int op, const unsigned char *ptmp)
{
/* See if we have an entry in the hash table and it is enabled */
const tls12_hash_info *hinf = tls12_get_hash_info(ptmp[0]);
if (!hinf || !hinf->mfunc)
return 0;
/* See if public key algorithm allowed */
if (tls12_get_pkey_idx(ptmp[1]) == -1)
return 0;
/* Finally see if security callback allows it */
return ssl_security(s, op, hinf->secbits, hinf->nid, (void *)ptmp);
}
/* Get a mask of disabled public key algorithms based on supported
* signature algorithms. For example if no signature algorithm supports RSA
* then RSA is disabled.
*/
void ssl_set_sig_mask(unsigned long *pmask_a, SSL *s, int op)
{
const unsigned char *sigalgs;
size_t i, sigalgslen;
int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
/* Now go through all signature algorithms seeing if we support
* any for RSA, DSA, ECDSA. Do this for all versions not just
* TLS 1.2. To keep down calls to security callback only check
* if we have to.
*/
sigalgslen = tls12_get_psigalgs(s, &sigalgs);
for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
{
switch(sigalgs[1])
{
#ifndef OPENSSL_NO_RSA
case TLSEXT_signature_rsa:
if (!have_rsa && tls12_sigalg_allowed(s, op, sigalgs))
have_rsa = 1;
break;
#endif
#ifndef OPENSSL_NO_DSA
case TLSEXT_signature_dsa:
if (!have_dsa && tls12_sigalg_allowed(s, op, sigalgs))
have_dsa = 1;
break;
#endif
#ifndef OPENSSL_NO_ECDSA
case TLSEXT_signature_ecdsa:
if (!have_ecdsa && tls12_sigalg_allowed(s, op, sigalgs))
have_ecdsa = 1;
break;
#endif
}
}
if (!have_rsa)
*pmask_a |= SSL_aRSA;
if (!have_dsa)
*pmask_a |= SSL_aDSS;
if (!have_ecdsa)
*pmask_a |= SSL_aECDSA;
}
size_t tls12_copy_sigalgs(SSL *s, unsigned char *out,
const unsigned char *psig, size_t psiglen)
{
unsigned char *tmpout = out;
size_t i;
for (i = 0; i < psiglen; i += 2, psig += 2)
{
if (tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, psig))
{
*tmpout++ = psig[0];
*tmpout++ = psig[1];
}
}
return tmpout - out;
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
/* Given preference and allowed sigalgs set shared sigalgs */
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
static int tls12_shared_sigalgs(SSL *s, TLS_SIGALGS *shsig,
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
const unsigned char *pref, size_t preflen,
const unsigned char *allow, size_t allowlen)
{
const unsigned char *ptmp, *atmp;
size_t i, j, nmatch = 0;
for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
{
/* Skip disabled hashes or signature algorithms */
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, ptmp))
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
continue;
for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
{
if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
{
nmatch++;
if (shsig)
{
shsig->rhash = ptmp[0];
shsig->rsign = ptmp[1];
tls1_lookup_sigalg(&shsig->hash_nid,
&shsig->sign_nid,
&shsig->signandhash_nid,
ptmp);
shsig++;
}
break;
}
}
}
return nmatch;
}
/* Set shared signature algorithms for SSL structures */
static int tls1_set_shared_sigalgs(SSL *s)
{
const unsigned char *pref, *allow, *conf;
size_t preflen, allowlen, conflen;
size_t nmatch;
TLS_SIGALGS *salgs = NULL;
CERT *c = s->cert;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
unsigned int is_suiteb = tls1_suiteb(s);
Fix memory leak with client auth. (cherry picked from commit bc5ec653ba65fedb1619c8182088497de8a97a70)
2014-03-27 16:10:50 +00:00
if (c->shared_sigalgs)
{
OPENSSL_free(c->shared_sigalgs);
c->shared_sigalgs = NULL;
}
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
/* If client use client signature algorithms if not NULL */
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (!s->server && c->client_sigalgs && !is_suiteb)
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
{
conf = c->client_sigalgs;
conflen = c->client_sigalgslen;
}
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
else if (c->conf_sigalgs && !is_suiteb)
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
{
conf = c->conf_sigalgs;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
conflen = c->conf_sigalgslen;
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
else
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
conflen = tls12_get_psigalgs(s, &conf);
if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
{
pref = conf;
preflen = conflen;
allow = c->peer_sigalgs;
allowlen = c->peer_sigalgslen;
}
else
{
allow = conf;
allowlen = conflen;
pref = c->peer_sigalgs;
preflen = c->peer_sigalgslen;
}
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
if (!nmatch)
return 1;
salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
if (!salgs)
return 0;
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
c->shared_sigalgs = salgs;
c->shared_sigalgslen = nmatch;
return 1;
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
/* Set preferred digest for each key type */
Process signature algorithms during TLS v1.2 client authentication. Make sure message is long enough for signature algorithms.
2011-05-12 14:38:01 +00:00
int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
{
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
int idx;
size_t i;
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
const EVP_MD *md;
CERT *c = s->cert;
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
TLS_SIGALGS *sigptr;
Use enc_flags when deciding protocol variations. Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement.
2013-03-13 15:33:24 +00:00
/* Extension ignored for inappropriate versions */
if (!SSL_USE_SIGALGS(s))
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
return 1;
Process signature algorithms during TLS v1.2 client authentication. Make sure message is long enough for signature algorithms.
2011-05-12 14:38:01 +00:00
/* Should never happen */
if (!c)
return 0;
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
Fix memory leak with client auth. (cherry picked from commit bc5ec653ba65fedb1619c8182088497de8a97a70)
2014-03-27 16:10:50 +00:00
if (c->peer_sigalgs)
OPENSSL_free(c->peer_sigalgs);
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
c->peer_sigalgs = OPENSSL_malloc(dsize);
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
if (!c->peer_sigalgs)
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
return 0;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
c->peer_sigalgslen = dsize;
memcpy(c->peer_sigalgs, data, dsize);
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
tls1_set_shared_sigalgs(s);
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
fix typo and warning
2012-11-19 02:46:46 +00:00
if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
{
/* Use first set signature preference to force message
* digest, ignoring any peer preferences.
*/
const unsigned char *sigs = NULL;
if (s->server)
sigs = c->conf_sigalgs;
else
sigs = c->client_sigalgs;
if (sigs)
{
idx = tls12_get_pkey_idx(sigs[1]);
md = tls12_get_hash(sigs[0]);
c->pkeys[idx].digest = md;
c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
if (idx == SSL_PKEY_RSA_SIGN)
{
c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
}
}
}
#endif
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
for (i = 0, sigptr = c->shared_sigalgs;
i < c->shared_sigalgslen; i++, sigptr++)
{
idx = tls12_get_pkey_idx(sigptr->rsign);
if (idx > 0 && c->pkeys[idx].digest == NULL)
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
{
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
md = tls12_get_hash(sigptr->rhash);
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
c->pkeys[idx].digest = md;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
if (idx == SSL_PKEY_RSA_SIGN)
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
{
c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
}
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* In strict mode leave unset digests as NULL to indicate we can't
* use the certificate for signing.
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
*/
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
{
/* Set any remaining keys to default values. NOTE: if alg is
* not supported it stays as NULL.
*/
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
#ifndef OPENSSL_NO_DSA
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
#endif
#ifndef OPENSSL_NO_RSA
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
{
c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
#endif
#ifndef OPENSSL_NO_ECDSA
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
if (!c->pkeys[SSL_PKEY_ECC].digest)
c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
#endif
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-05-06 13:00:07 +00:00
return 1;
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
int SSL_get_sigalgs(SSL *s, int idx,
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
int *psign, int *phash, int *psignhash,
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
unsigned char *rsig, unsigned char *rhash)
{
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
const unsigned char *psig = s->cert->peer_sigalgs;
if (psig == NULL)
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
return 0;
if (idx >= 0)
{
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
idx <<= 1;
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
if (idx >= (int)s->cert->peer_sigalgslen)
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
return 0;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
psig += idx;
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
if (rhash)
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
*rhash = psig[0];
if (rsig)
*rsig = psig[1];
tls1_lookup_sigalg(phash, psign, psignhash, psig);
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
return s->cert->peer_sigalgslen / 2;
}
int SSL_get_shared_sigalgs(SSL *s, int idx,
int *psign, int *phash, int *psignhash,
unsigned char *rsig, unsigned char *rhash)
{
TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
return 0;
shsigalgs += idx;
if (phash)
*phash = shsigalgs->hash_nid;
if (psign)
*psign = shsigalgs->sign_nid;
if (psignhash)
*psignhash = shsigalgs->signandhash_nid;
if (rsig)
*rsig = shsigalgs->rsign;
if (rhash)
*rhash = shsigalgs->rhash;
return s->cert->shared_sigalgslen;
New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
2012-03-06 14:28:21 +00:00
}
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
#ifndef OPENSSL_NO_HEARTBEATS
int
tls1_process_heartbeat(SSL *s)
{
unsigned char *p = &s->s3->rrec.data[0], *pl;
unsigned short hbtype;
unsigned int payload;
unsigned int padding = 16; /* Use minimum padding */
if (s->msg_callback)
s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
&s->s3->rrec.data[0], s->s3->rrec.length,
s, s->msg_callback_arg);
Add heartbeat extension bounds check. A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server. Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for preparing the fix (CVE-2014-0160) (cherry picked from commit 96db9023b881d7cd9f379b0c154650d6c108e9a3)
2014-04-05 23:51:06 +00:00
/* Read type and payload length first */
if (1 + 2 + 16 > s->s3->rrec.length)
return 0; /* silently discard */
hbtype = *p++;
n2s(p, payload);
if (1 + 2 + payload + 16 > s->s3->rrec.length)
return 0; /* silently discard per RFC 6520 sec. 4 */
pl = p;
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
if (hbtype == TLS1_HB_REQUEST)
{
unsigned char *buffer, *bp;
int r;
/* Allocate memory for the response, size is 1 bytes
* message type, plus 2 bytes payload length, plus
* payload, plus padding
*/
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
/* Enter response type, length and copy payload */
*bp++ = TLS1_HB_RESPONSE;
s2n(payload, bp);
memcpy(bp, pl, payload);
PR: 2739 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Fix padding bugs in Heartbeat support.
2012-02-27 16:38:24 +00:00
bp += payload;
/* Random padding */
RAND_pseudo_bytes(bp, padding);
PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-31 22:59:57 +00:00
r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
if (r >= 0 && s->msg_callback)
s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
buffer, 3 + payload + padding,
s, s->msg_callback_arg);
OPENSSL_free(buffer);
if (r < 0)
return r;
}
else if (hbtype == TLS1_HB_RESPONSE)
{
unsigned int seq;
/* We only send sequence numbers (2 bytes unsigned int),
* and 16 random bytes, so we just try to read the
* sequence number */
n2s(pl, seq);
if (payload == 18 && seq == s->tlsext_hb_seq)
{
s->tlsext_hb_seq++;
s->tlsext_hb_pending = 0;
}
}
return 0;
}
int
tls1_heartbeat(SSL *s)
{
unsigned char *buf, *p;
int ret;
unsigned int payload = 18; /* Sequence number + random bytes */
unsigned int padding = 16; /* Use minimum padding */
/* Only send if peer supports and accepts HB requests... */
if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
{
SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
return -1;
}
/* ...and there is none in flight yet... */
if (s->tlsext_hb_pending)
{
SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
return -1;
}
/* ...and no handshake in progress. */
if (SSL_in_init(s) || s->in_handshake)
{
SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
return -1;
}
/* Check if padding is too long, payload and padding
* must not exceed 2^14 - 3 = 16381 bytes in total.
*/
OPENSSL_assert(payload + padding <= 16381);
/* Create HeartBeat message, we just use a sequence number
* as payload to distuingish different messages and add
* some random stuff.
* - Message Type, 1 byte
* - Payload Length, 2 bytes (unsigned int)
* - Payload, the sequence number (2 bytes uint)
* - Payload, random bytes (16 bytes uint)
* - Padding
*/
buf = OPENSSL_malloc(1 + 2 + payload + padding);
p = buf;
/* Message Type */
*p++ = TLS1_HB_REQUEST;
/* Payload length (18 bytes here) */
s2n(payload, p);
/* Sequence number */
s2n(s->tlsext_hb_seq, p);
/* 16 random bytes */
RAND_pseudo_bytes(p, 16);
p += 16;
/* Random padding */
RAND_pseudo_bytes(p, padding);
ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
if (ret >= 0)
{
if (s->msg_callback)
s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
buf, 3 + payload + padding,
s, s->msg_callback_arg);
s->tlsext_hb_pending = 1;
}
OPENSSL_free(buf);
return ret;
}
#endif
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
#define MAX_SIGALGLEN (TLSEXT_hash_num * TLSEXT_signature_num * 2)
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
typedef struct
{
size_t sigalgcnt;
int sigalgs[MAX_SIGALGLEN];
} sig_cb_st;
static int sig_cb(const char *elem, int len, void *arg)
{
sig_cb_st *sarg = arg;
size_t i;
char etmp[20], *p;
int sig_alg, hash_alg;
if (sarg->sigalgcnt == MAX_SIGALGLEN)
return 0;
if (len > (int)(sizeof(etmp) - 1))
return 0;
memcpy(etmp, elem, len);
etmp[len] = 0;
p = strchr(etmp, '+');
if (!p)
return 0;
*p = 0;
p++;
if (!*p)
return 0;
if (!strcmp(etmp, "RSA"))
sig_alg = EVP_PKEY_RSA;
else if (!strcmp(etmp, "DSA"))
sig_alg = EVP_PKEY_DSA;
else if (!strcmp(etmp, "ECDSA"))
sig_alg = EVP_PKEY_EC;
else return 0;
hash_alg = OBJ_sn2nid(p);
if (hash_alg == NID_undef)
hash_alg = OBJ_ln2nid(p);
if (hash_alg == NID_undef)
return 0;
for (i = 0; i < sarg->sigalgcnt; i+=2)
{
if (sarg->sigalgs[i] == sig_alg
&& sarg->sigalgs[i + 1] == hash_alg)
return 0;
}
sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
return 1;
}
/* Set suppored signature algorithms based on a colon separated list
* of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
{
sig_cb_st sig;
sig.sigalgcnt = 0;
if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
return 0;
new feature: if ctx==NULL in SSL_CTX_ctrl perform syntax checking only for some operations (currently curves and signature algorithms)
2012-11-08 14:24:51 +00:00
if (c == NULL)
return 1;
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
}
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
{
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
unsigned char *sigalgs, *sptr;
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
int rhash, rsign;
size_t i;
if (salglen & 1)
return 0;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
sigalgs = OPENSSL_malloc(salglen);
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
if (sigalgs == NULL)
return 0;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
for (i = 0, sptr = sigalgs; i < salglen; i+=2)
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
{
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
rhash = tls12_find_id(*psig_nids++, tls12_md,
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
sizeof(tls12_md)/sizeof(tls12_lookup));
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
rsign = tls12_find_id(*psig_nids++, tls12_sig,
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
sizeof(tls12_sig)/sizeof(tls12_lookup));
if (rhash == -1 || rsign == -1)
goto err;
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
*sptr++ = rhash;
*sptr++ = rsign;
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
}
Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.
2012-07-03 12:51:14 +00:00
if (client)
{
if (c->client_sigalgs)
OPENSSL_free(c->client_sigalgs);
c->client_sigalgs = sigalgs;
c->client_sigalgslen = salglen;
}
else
{
if (c->conf_sigalgs)
OPENSSL_free(c->conf_sigalgs);
c->conf_sigalgs = sigalgs;
c->conf_sigalgslen = salglen;
}
Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.
2012-06-22 14:03:31 +00:00
return 1;
err:
OPENSSL_free(sigalgs);
return 0;
}
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
{
int sig_nid;
size_t i;
if (default_nid == -1)
return 1;
sig_nid = X509_get_signature_nid(x);
if (default_nid)
return sig_nid == default_nid ? 1 : 0;
for (i = 0; i < c->shared_sigalgslen; i++)
if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
return 1;
return 0;
}
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
/* Check to see if a certificate issuer name matches list of CA names */
static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
{
X509_NAME *nm;
int i;
nm = X509_get_issuer_name(x);
for (i = 0; i < sk_X509_NAME_num(names); i++)
{
if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
return 1;
}
return 0;
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* Check certificate chain is consistent with TLS extensions and is
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
* usable by server. This servers two purposes: it allows users to
* check chains before passing them to the server and it allows the
* server to check chains before attempting to use them.
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
*/
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
/* Flags which need to be set for a certificate when stict mode not set */
#define CERT_PKEY_VALID_FLAGS \
(CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
/* Strict mode flags */
#define CERT_PKEY_STRICT_FLAGS \
(CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
| CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
int idx)
{
int i;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
int rv = 0;
int check_flags = 0, strict_mode;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
CERT_PKEY *cpk = NULL;
CERT *c = s->cert;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
unsigned int suiteb_flags = tls1_suiteb(s);
/* idx == -1 means checking server chains */
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
if (idx != -1)
{
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* idx == -2 means checking client certificate chains */
if (idx == -2)
{
cpk = c->key;
idx = cpk - c->pkeys;
}
else
cpk = c->pkeys + idx;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
x = cpk->x509;
pk = cpk->privatekey;
chain = cpk->chain;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* If no cert or key, forget it */
if (!x || !pk)
goto end;
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
/* Allow any certificate to pass test */
fix typo and warning
2012-11-19 02:46:46 +00:00
if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
2012-08-29 13:18:34 +00:00
{
rv = CERT_PKEY_STRICT_FLAGS|CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_VALID|CERT_PKEY_SIGN;
cpk->valid_flags = rv;
return rv;
}
#endif
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
else
{
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
if (!x || !pk)
goto end;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
idx = ssl_cert_type(x, pk);
if (idx == -1)
goto end;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
cpk = c->pkeys + idx;
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
check_flags = CERT_PKEY_STRICT_FLAGS;
else
check_flags = CERT_PKEY_VALID_FLAGS;
strict_mode = 1;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
if (suiteb_flags)
{
int ok;
if (check_flags)
check_flags |= CERT_PKEY_SUITEB;
ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
if (ok != X509_V_OK)
{
if (check_flags)
rv |= CERT_PKEY_SUITEB;
else
goto end;
}
}
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* Check all signature algorithms are consistent with
* signature algorithms extension if TLS 1.2 or later
* and strict mode.
*/
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
{
int default_nid;
unsigned char rsign = 0;
if (c->peer_sigalgs)
default_nid = 0;
/* If no sigalgs extension use defaults from RFC5246 */
else
{
switch(idx)
{
case SSL_PKEY_RSA_ENC:
case SSL_PKEY_RSA_SIGN:
case SSL_PKEY_DH_RSA:
rsign = TLSEXT_signature_rsa;
default_nid = NID_sha1WithRSAEncryption;
break;
case SSL_PKEY_DSA_SIGN:
case SSL_PKEY_DH_DSA:
rsign = TLSEXT_signature_dsa;
default_nid = NID_dsaWithSHA1;
break;
case SSL_PKEY_ECC:
rsign = TLSEXT_signature_ecdsa;
default_nid = NID_ecdsa_with_SHA1;
break;
default:
default_nid = -1;
break;
}
}
/* If peer sent no signature algorithms extension and we
* have set preferred signature algorithms check we support
* sha1.
*/
no need to check s->server as default_nid is never used for TLS 1.2 client authentication
2012-07-03 14:24:33 +00:00
if (default_nid > 0 && c->conf_sigalgs)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
{
size_t j;
const unsigned char *p = c->conf_sigalgs;
for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
{
if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
break;
}
if (j == c->conf_sigalgslen)
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
{
if (check_flags)
goto skip_sigs;
else
goto end;
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
/* Check signature algorithm of each cert in chain */
if (!tls1_check_sig_alg(c, x, default_nid))
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
{
if (!check_flags) goto end;
}
else
rv |= CERT_PKEY_EE_SIGNATURE;
rv |= CERT_PKEY_CA_SIGNATURE;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
for (i = 0; i < sk_X509_num(chain); i++)
{
if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
default_nid))
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
{
if (check_flags)
{
rv &= ~CERT_PKEY_CA_SIGNATURE;
break;
}
else
goto end;
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
}
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
/* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
else if(check_flags)
rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
skip_sigs:
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
/* Check cert parameters are consistent */
if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
rv |= CERT_PKEY_EE_PARAM;
else if (!check_flags)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
goto end;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
if (!s->server)
rv |= CERT_PKEY_CA_PARAM;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
/* In strict mode check rest of chain too */
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
else if (strict_mode)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
{
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
rv |= CERT_PKEY_CA_PARAM;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
for (i = 0; i < sk_X509_num(chain); i++)
{
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
X509 *ca = sk_X509_value(chain, i);
if (!tls1_check_cert_param(s, ca, 0))
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
{
if (check_flags)
{
rv &= ~CERT_PKEY_CA_PARAM;
break;
}
else
goto end;
}
}
}
if (!s->server && strict_mode)
{
STACK_OF(X509_NAME) *ca_dn;
int check_type = 0;
switch (pk->type)
{
case EVP_PKEY_RSA:
check_type = TLS_CT_RSA_SIGN;
break;
case EVP_PKEY_DSA:
check_type = TLS_CT_DSS_SIGN;
break;
case EVP_PKEY_EC:
check_type = TLS_CT_ECDSA_SIGN;
break;
case EVP_PKEY_DH:
case EVP_PKEY_DHX:
{
int cert_type = X509_certificate_type(x, pk);
if (cert_type & EVP_PKS_RSA)
check_type = TLS_CT_RSA_FIXED_DH;
if (cert_type & EVP_PKS_DSA)
check_type = TLS_CT_DSS_FIXED_DH;
}
}
if (check_type)
{
const unsigned char *ctypes;
int ctypelen;
if (c->ctypes)
{
ctypes = c->ctypes;
ctypelen = (int)c->ctype_num;
}
else
{
ctypes = (unsigned char *)s->s3->tmp.ctype;
ctypelen = s->s3->tmp.ctype_num;
}
for (i = 0; i < ctypelen; i++)
{
if (ctypes[i] == check_type)
{
rv |= CERT_PKEY_CERT_TYPE;
break;
}
}
if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
goto end;
}
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
else
rv |= CERT_PKEY_CERT_TYPE;
ca_dn = s->s3->tmp.ca_names;
if (!sk_X509_NAME_num(ca_dn))
rv |= CERT_PKEY_ISSUER_NAME;
if (!(rv & CERT_PKEY_ISSUER_NAME))
{
if (ssl_check_ca_name(ca_dn, x))
rv |= CERT_PKEY_ISSUER_NAME;
}
if (!(rv & CERT_PKEY_ISSUER_NAME))
{
for (i = 0; i < sk_X509_num(chain); i++)
{
X509 *xtmp = sk_X509_value(chain, i);
if (ssl_check_ca_name(ca_dn, xtmp))
{
rv |= CERT_PKEY_ISSUER_NAME;
break;
}
}
}
if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
goto end;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
else
rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
if (!check_flags || (rv & check_flags) == check_flags)
rv |= CERT_PKEY_VALID;
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
end:
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
if (TLS1_get_version(s) >= TLS1_2_VERSION)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
{
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
else if (cpk->digest)
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
rv |= CERT_PKEY_SIGN;
Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
2012-07-27 13:39:23 +00:00
}
else
rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
/* When checking a CERT_PKEY structure all flags are irrelevant
* if the chain is invalid.
*/
if (!check_flags)
{
if (rv & CERT_PKEY_VALID)
cpk->valid_flags = rv;
else
Add three Suite B modes to TLS code, supporting RFC6460.
2012-08-15 15:15:05 +00:00
{
/* Preserve explicit sign flag, clear rest */
cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
return 0;
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
}
return rv;
}
/* Set validity of certificates in an SSL structure */
void tls1_set_cert_validity(SSL *s)
{
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
}
Add certificate callback. If set this is called whenever a certificate is required by client or server. An application can decide which certificate chain to present based on arbitrary criteria: for example supported signature algorithms. Add very simple example to s_server. This fixes many of the problems and restrictions of the existing client certificate callback: for example you can now clear existing certificates and specify the whole chain.
2012-06-29 14:24:42 +00:00
/* User level utiity function to check a chain is suitable */
int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
{
return tls1_check_chain(s, x, pk, chain, -1);
}
Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.
2012-06-28 12:45:49 +00:00
Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
2012-06-25 14:32:30 +00:00
#endif
Auto DH support. Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
2014-01-22 16:22:48 +00:00
#ifndef OPENSSL_NO_DH
DH *ssl_get_auto_dh(SSL *s)
{
int dh_secbits = 80;
if (s->cert->dh_tmp_auto == 2)
return DH_get_1024_160();
if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
{
if (s->s3->tmp.new_cipher->strength_bits == 256)
dh_secbits = 128;
else
dh_secbits = 80;
}
else
{
CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
}
if (dh_secbits >= 128)
{
DH *dhp = DH_new();
if (!dhp)
return NULL;
dhp->g = BN_new();
if (dhp->g)
BN_set_word(dhp->g, 2);
if (dh_secbits >= 192)
dhp->p = get_rfc3526_prime_8192(NULL);
else
dhp->p = get_rfc3526_prime_3072(NULL);
if (!dhp->p || !dhp->g)
{
DH_free(dhp);
return NULL;
}
return dhp;
}
if (dh_secbits >= 112)
return DH_get_2048_224();
return DH_get_1024_160();
}
#endif
Security framework. Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2013-12-15 13:32:24 +00:00
static int ssl_security_cert_key(SSL *s, SSL_CTX *ctx, X509 *x, int op)
{
int secbits;
EVP_PKEY *pkey = X509_get_pubkey(x);
if (pkey)
{
secbits = EVP_PKEY_security_bits(pkey);
EVP_PKEY_free(pkey);
}
else
secbits = -1;
if (s)
return ssl_security(s, op, secbits, 0, x);
else
return ssl_ctx_security(ctx, op, secbits, 0, x);
}
static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op)
{
/* Lookup signature algorithm digest */
int secbits = -1, md_nid = NID_undef, sig_nid;
sig_nid = X509_get_signature_nid(x);
if (sig_nid && OBJ_find_sigid_algs(sig_nid, &md_nid, NULL))
{
const EVP_MD *md;
if (md_nid && (md = EVP_get_digestbynid(md_nid)))
secbits = EVP_MD_size(md) * 4;
}
if (s)
return ssl_security(s, op, secbits, md_nid, x);
else
return ssl_ctx_security(ctx, op, secbits, md_nid, x);
}
int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee)
{
if (vfy)
vfy = SSL_SECOP_PEER;
if (is_ee)
{
if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
return SSL_R_EE_KEY_TOO_SMALL;
}
else
{
if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
return SSL_R_CA_KEY_TOO_SMALL;
}
if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
return SSL_R_CA_MD_TOO_WEAK;
return 1;
}
/* Check security of a chain, if sk includes the end entity certificate
* then x is NULL. If vfy is 1 then we are verifying a peer chain and
* not sending one to the peer.
* Return values: 1 if ok otherwise error code to use
*/
int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *x, int vfy)
{
int rv, start_idx, i;
if (x == NULL)
{
x = sk_X509_value(sk, 0);
start_idx = 1;
}
else
start_idx = 0;
rv = ssl_security_cert(s, NULL, x, vfy, 1);
if (rv != 1)
return rv;
for (i = start_idx; i < sk_X509_num(sk); i++)
{
x = sk_X509_value(sk, i);
rv = ssl_security_cert(s, NULL, x, vfy, 0);
if (rv != 1)
return rv;
}
return 1;
}
Reference in a new issue Copy permalink