wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/ssl/s2_srvr.c
Emilia Kasper a20db08e77 Harden SSLv2-supporting servers against Bleichenbacher's attack. 
There is no indication that the timing differences are exploitable in
OpenSSL, and indeed there is some indication (Usenix '14) that they
are too small to be exploitable. Nevertheless, be careful and apply
the same countermeasures as in s3_srvr.c

Thanks to Nimrod Aviram, Sebastian Schinzel and Yuval Shavitt for
reporting this issue.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(cherry picked from commit ae50d82700)
2015-04-08 16:42:28 +02:00

1155 lines
40 KiB
C
Raw Blame History

/* ssl/s2_srvr.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* ====================================================================
* Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
#include "ssl_locl.h"
#ifndef OPENSSL_NO_SSL2
#include "../crypto/constant_time_locl.h"
# include <stdio.h>
# include <openssl/bio.h>
# include <openssl/rand.h>
# include <openssl/objects.h>
# include <openssl/evp.h>
static const SSL_METHOD *ssl2_get_server_method(int ver);
static int get_client_master_key(SSL *s);
static int get_client_hello(SSL *s);
static int server_hello(SSL *s);
static int get_client_finished(SSL *s);
static int server_verify(SSL *s);
static int server_finish(SSL *s);
static int request_certificate(SSL *s);
static int ssl_rsa_private_decrypt(CERT *c, int len, unsigned char *from,
unsigned char *to, int padding);
# define BREAK break
static const SSL_METHOD *ssl2_get_server_method(int ver)
{
if (ver == SSL2_VERSION)
return (SSLv2_server_method());
else
return (NULL);
}
IMPLEMENT_ssl2_meth_func(SSLv2_server_method,
ssl2_accept,
ssl_undefined_function, ssl2_get_server_method)
int ssl2_accept(SSL *s)
{
unsigned long l = (unsigned long)time(NULL);
BUF_MEM *buf = NULL;
int ret = -1;
long num1;
void (*cb) (const SSL *ssl, int type, int val) = NULL;
int new_state, state;
RAND_add(&l, sizeof(l), 0);
ERR_clear_error();
clear_sys_error();
if (s->info_callback != NULL)
cb = s->info_callback;
else if (s->ctx->info_callback != NULL)
cb = s->ctx->info_callback;
/* init things to blank */
s->in_handshake++;
if (!SSL_in_init(s) || SSL_in_before(s))
SSL_clear(s);
if (s->cert == NULL) {
SSLerr(SSL_F_SSL2_ACCEPT, SSL_R_NO_CERTIFICATE_SET);
return (-1);
}
clear_sys_error();
for (;;) {
state = s->state;
switch (s->state) {
case SSL_ST_BEFORE:
case SSL_ST_ACCEPT:
case SSL_ST_BEFORE | SSL_ST_ACCEPT:
case SSL_ST_OK | SSL_ST_ACCEPT:
s->server = 1;
if (cb != NULL)
cb(s, SSL_CB_HANDSHAKE_START, 1);
s->version = SSL2_VERSION;
s->type = SSL_ST_ACCEPT;
if (s->init_buf == NULL) {
if ((buf = BUF_MEM_new()) == NULL) {
ret = -1;
goto end;
}
if (!BUF_MEM_grow
(buf, (int)SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)) {
BUF_MEM_free(buf);
ret = -1;
goto end;
}
s->init_buf = buf;
}
s->init_num = 0;
s->ctx->stats.sess_accept++;
s->handshake_func = ssl2_accept;
s->state = SSL2_ST_GET_CLIENT_HELLO_A;
BREAK;
case SSL2_ST_GET_CLIENT_HELLO_A:
case SSL2_ST_GET_CLIENT_HELLO_B:
case SSL2_ST_GET_CLIENT_HELLO_C:
s->shutdown = 0;
ret = get_client_hello(s);
if (ret <= 0)
goto end;
s->init_num = 0;
s->state = SSL2_ST_SEND_SERVER_HELLO_A;
BREAK;
case SSL2_ST_SEND_SERVER_HELLO_A:
case SSL2_ST_SEND_SERVER_HELLO_B:
ret = server_hello(s);
if (ret <= 0)
goto end;
s->init_num = 0;
if (!s->hit) {
s->state = SSL2_ST_GET_CLIENT_MASTER_KEY_A;
BREAK;
} else {
s->state = SSL2_ST_SERVER_START_ENCRYPTION;
BREAK;
}
case SSL2_ST_GET_CLIENT_MASTER_KEY_A:
case SSL2_ST_GET_CLIENT_MASTER_KEY_B:
ret = get_client_master_key(s);
if (ret <= 0)
goto end;
s->init_num = 0;
s->state = SSL2_ST_SERVER_START_ENCRYPTION;
BREAK;
case SSL2_ST_SERVER_START_ENCRYPTION:
/*
* Ok we how have sent all the stuff needed to start encrypting,
* the next packet back will be encrypted.
*/
if (!ssl2_enc_init(s, 0)) {
ret = -1;
goto end;
}
s->s2->clear_text = 0;
s->state = SSL2_ST_SEND_SERVER_VERIFY_A;
BREAK;
case SSL2_ST_SEND_SERVER_VERIFY_A:
case SSL2_ST_SEND_SERVER_VERIFY_B:
ret = server_verify(s);
if (ret <= 0)
goto end;
s->init_num = 0;
if (s->hit) {
/*
* If we are in here, we have been buffering the output, so
* we need to flush it and remove buffering from future
* traffic
*/
s->state = SSL2_ST_SEND_SERVER_VERIFY_C;
BREAK;
} else {
s->state = SSL2_ST_GET_CLIENT_FINISHED_A;
break;
}
case SSL2_ST_SEND_SERVER_VERIFY_C:
/* get the number of bytes to write */
num1 = BIO_ctrl(s->wbio, BIO_CTRL_INFO, 0, NULL);
if (num1 > 0) {
s->rwstate = SSL_WRITING;
num1 = BIO_flush(s->wbio);
if (num1 <= 0) {
ret = -1;
goto end;
}
s->rwstate = SSL_NOTHING;
}
/* flushed and now remove buffering */
s->wbio = BIO_pop(s->wbio);
s->state = SSL2_ST_GET_CLIENT_FINISHED_A;
BREAK;
case SSL2_ST_GET_CLIENT_FINISHED_A:
case SSL2_ST_GET_CLIENT_FINISHED_B:
ret = get_client_finished(s);
if (ret <= 0)
goto end;
s->init_num = 0;
s->state = SSL2_ST_SEND_REQUEST_CERTIFICATE_A;
BREAK;
case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:
case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:
case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:
case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:
/*
* don't do a 'request certificate' if we don't want to, or we
* already have one, and we only want to do it once.
*/
if (!(s->verify_mode & SSL_VERIFY_PEER) ||
((s->session->peer != NULL) &&
(s->verify_mode & SSL_VERIFY_CLIENT_ONCE))) {
s->state = SSL2_ST_SEND_SERVER_FINISHED_A;
break;
} else {
ret = request_certificate(s);
if (ret <= 0)
goto end;
s->init_num = 0;
s->state = SSL2_ST_SEND_SERVER_FINISHED_A;
}
BREAK;
case SSL2_ST_SEND_SERVER_FINISHED_A:
case SSL2_ST_SEND_SERVER_FINISHED_B:
ret = server_finish(s);
if (ret <= 0)
goto end;
s->init_num = 0;
s->state = SSL_ST_OK;
break;
case SSL_ST_OK:
BUF_MEM_free(s->init_buf);
ssl_free_wbio_buffer(s);
s->init_buf = NULL;
s->init_num = 0;
/* ERR_clear_error(); */
ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
s->ctx->stats.sess_accept_good++;
/* s->server=1; */
ret = 1;
if (cb != NULL)
cb(s, SSL_CB_HANDSHAKE_DONE, 1);
goto end;
/* BREAK; */
default:
SSLerr(SSL_F_SSL2_ACCEPT, SSL_R_UNKNOWN_STATE);
ret = -1;
goto end;
/* BREAK; */
}
if ((cb != NULL) && (s->state != state)) {
new_state = s->state;
s->state = state;
cb(s, SSL_CB_ACCEPT_LOOP, 1);
s->state = new_state;
}
}
end:
s->in_handshake--;
if (cb != NULL)
cb(s, SSL_CB_ACCEPT_EXIT, ret);
return (ret);
}
static int get_client_master_key(SSL *s)
{
int is_export, i, n, keya;
unsigned int num_encrypted_key_bytes, key_length;
unsigned long len;
unsigned char *p;
const SSL_CIPHER *cp;
const EVP_CIPHER *c;
const EVP_MD *md;
unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];
unsigned char decrypt_good;
size_t j;
p = (unsigned char *)s->init_buf->data;
if (s->state == SSL2_ST_GET_CLIENT_MASTER_KEY_A) {
i = ssl2_read(s, (char *)&(p[s->init_num]), 10 - s->init_num);
if (i < (10 - s->init_num))
return (ssl2_part_read(s, SSL_F_GET_CLIENT_MASTER_KEY, i));
s->init_num = 10;
if (*(p++) != SSL2_MT_CLIENT_MASTER_KEY) {
if (p[-1] != SSL2_MT_ERROR) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,
SSL_R_READ_WRONG_PACKET_TYPE);
} else
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_PEER_ERROR);
return (-1);
}
cp = ssl2_get_cipher_by_char(p);
if (cp == NULL) {
ssl2_return_error(s, SSL2_PE_NO_CIPHER);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_CIPHER_MATCH);
return (-1);
}
s->session->cipher = cp;
p += 3;
n2s(p, i);
s->s2->tmp.clear = i;
n2s(p, i);
s->s2->tmp.enc = i;
n2s(p, i);
if (i > SSL_MAX_KEY_ARG_LENGTH) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_KEY_ARG_TOO_LONG);
return -1;
}
s->session->key_arg_length = i;
s->state = SSL2_ST_GET_CLIENT_MASTER_KEY_B;
}
/* SSL2_ST_GET_CLIENT_MASTER_KEY_B */
p = (unsigned char *)s->init_buf->data;
if (s->init_buf->length < SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
return -1;
}
keya = s->session->key_arg_length;
len =
10 + (unsigned long)s->s2->tmp.clear + (unsigned long)s->s2->tmp.enc +
(unsigned long)keya;
if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_MESSAGE_TOO_LONG);
return -1;
}
n = (int)len - s->init_num;
i = ssl2_read(s, (char *)&(p[s->init_num]), n);
if (i != n)
return (ssl2_part_read(s, SSL_F_GET_CLIENT_MASTER_KEY, i));
if (s->msg_callback) {
/* CLIENT-MASTER-KEY */
s->msg_callback(0, s->version, 0, p, (size_t)len, s,
s->msg_callback_arg);
}
p += 10;
memcpy(s->session->key_arg, &(p[s->s2->tmp.clear + s->s2->tmp.enc]),
(unsigned int)keya);
if (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_PRIVATEKEY);
return (-1);
}
is_export = SSL_C_IS_EXPORT(s->session->cipher);
if (!ssl_cipher_get_evp(s->session, &c, &md, NULL, NULL, NULL)) {
ssl2_return_error(s, SSL2_PE_NO_CIPHER);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,
SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS);
return (0);
}
/*
* The format of the CLIENT-MASTER-KEY message is
* 1 byte message type
* 3 bytes cipher
* 2-byte clear key length (stored in s->s2->tmp.clear)
* 2-byte encrypted key length (stored in s->s2->tmp.enc)
* 2-byte key args length (IV etc)
* clear key
* encrypted key
* key args
*
* If the cipher is an export cipher, then the encrypted key bytes
* are a fixed portion of the total key (5 or 8 bytes). The size of
* this portion is in |num_encrypted_key_bytes|. If the cipher is not an
* export cipher, then the entire key material is encrypted (i.e., clear
* key length must be zero).
*/
key_length = (unsigned int)EVP_CIPHER_key_length(c);
if (key_length > SSL_MAX_MASTER_KEY_LENGTH) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
return -1;
}
if (s->session->cipher->algorithm2 & SSL2_CF_8_BYTE_ENC) {
is_export = 1;
num_encrypted_key_bytes = 8;
} else if (is_export) {
num_encrypted_key_bytes = 5;
} else {
num_encrypted_key_bytes = key_length;
}
if (s->s2->tmp.clear + num_encrypted_key_bytes != key_length) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_BAD_LENGTH);
return -1;
}
/*
* The encrypted blob must decrypt to the encrypted portion of the key.
* Decryption can't be expanding, so if we don't have enough encrypted
* bytes to fit the key in the buffer, stop now.
*/
if (s->s2->tmp.enc < num_encrypted_key_bytes) {
ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_LENGTH_TOO_SHORT);
return -1;
}
/*
* We must not leak whether a decryption failure occurs because of
* Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246,
* section 7.4.7.1). The code follows that advice of the TLS RFC and
* generates a random premaster secret for the case that the decrypt
* fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1
*/
/*
* should be RAND_bytes, but we cannot work around a failure.
*/
if (RAND_pseudo_bytes(rand_premaster_secret,
(int)num_encrypted_key_bytes) <= 0)
return 0;
i = ssl_rsa_private_decrypt(s->cert, s->s2->tmp.enc,
&(p[s->s2->tmp.clear]),
&(p[s->s2->tmp.clear]),
(s->s2->ssl2_rollback) ? RSA_SSLV23_PADDING :
RSA_PKCS1_PADDING);
ERR_clear_error();
/*
* If a bad decrypt, continue with protocol but with a random master
* secret (Bleichenbacher attack)
*/
decrypt_good = constant_time_eq_int_8(i, (int)num_encrypted_key_bytes);
for (j = 0; j < num_encrypted_key_bytes; j++) {
p[s->s2->tmp.clear + j] =
constant_time_select_8(decrypt_good, p[s->s2->tmp.clear + j],
rand_premaster_secret[j]);
}
s->session->master_key_length = (int)key_length;
memcpy(s->session->master_key, p, key_length);
OPENSSL_cleanse(p, key_length);
return 1;
}
static int get_client_hello(SSL *s)
{
int i, n;
unsigned long len;
unsigned char *p;
STACK_OF(SSL_CIPHER) *cs; /* a stack of SSL_CIPHERS */
STACK_OF(SSL_CIPHER) *cl; /* the ones we want to use */
STACK_OF(SSL_CIPHER) *prio, *allow;
int z;
/*
* This is a bit of a hack to check for the correct packet type the first
* time round.
*/
if (s->state == SSL2_ST_GET_CLIENT_HELLO_A) {
s->first_packet = 1;
s->state = SSL2_ST_GET_CLIENT_HELLO_B;
}
p = (unsigned char *)s->init_buf->data;
if (s->state == SSL2_ST_GET_CLIENT_HELLO_B) {
i = ssl2_read(s, (char *)&(p[s->init_num]), 9 - s->init_num);
if (i < (9 - s->init_num))
return (ssl2_part_read(s, SSL_F_GET_CLIENT_HELLO, i));
s->init_num = 9;
if (*(p++) != SSL2_MT_CLIENT_HELLO) {
if (p[-1] != SSL2_MT_ERROR) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_READ_WRONG_PACKET_TYPE);
} else
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_PEER_ERROR);
return (-1);
}
n2s(p, i);
if (i < s->version)
s->version = i;
n2s(p, i);
s->s2->tmp.cipher_spec_length = i;
n2s(p, i);
s->s2->tmp.session_id_length = i;
n2s(p, i);
s->s2->challenge_length = i;
if ((i < SSL2_MIN_CHALLENGE_LENGTH) ||
(i > SSL2_MAX_CHALLENGE_LENGTH)) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_INVALID_CHALLENGE_LENGTH);
return (-1);
}
s->state = SSL2_ST_GET_CLIENT_HELLO_C;
}
/* SSL2_ST_GET_CLIENT_HELLO_C */
p = (unsigned char *)s->init_buf->data;
len =
9 + (unsigned long)s->s2->tmp.cipher_spec_length +
(unsigned long)s->s2->challenge_length +
(unsigned long)s->s2->tmp.session_id_length;
if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_MESSAGE_TOO_LONG);
return -1;
}
n = (int)len - s->init_num;
i = ssl2_read(s, (char *)&(p[s->init_num]), n);
if (i != n)
return (ssl2_part_read(s, SSL_F_GET_CLIENT_HELLO, i));
if (s->msg_callback) {
/* CLIENT-HELLO */
s->msg_callback(0, s->version, 0, p, (size_t)len, s,
s->msg_callback_arg);
}
p += 9;
/*
* get session-id before cipher stuff so we can get out session structure
* if it is cached
*/
/* session-id */
if ((s->s2->tmp.session_id_length != 0) &&
(s->s2->tmp.session_id_length != SSL2_SSL_SESSION_ID_LENGTH)) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_BAD_SSL_SESSION_ID_LENGTH);
return (-1);
}
if (s->s2->tmp.session_id_length == 0) {
if (!ssl_get_new_session(s, 1)) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
return (-1);
}
} else {
i = ssl_get_prev_session(s, &(p[s->s2->tmp.cipher_spec_length]),
s->s2->tmp.session_id_length, NULL);
if (i == 1) { /* previous session */
s->hit = 1;
} else if (i == -1) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
return (-1);
} else {
if (s->cert == NULL) {
ssl2_return_error(s, SSL2_PE_NO_CERTIFICATE);
SSLerr(SSL_F_GET_CLIENT_HELLO, SSL_R_NO_CERTIFICATE_SET);
return (-1);
}
if (!ssl_get_new_session(s, 1)) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
return (-1);
}
}
}
if (!s->hit) {
cs = ssl_bytes_to_cipher_list(s, p, s->s2->tmp.cipher_spec_length,
&s->session->ciphers);
if (cs == NULL)
goto mem_err;
cl = SSL_get_ciphers(s);
if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
prio = sk_SSL_CIPHER_dup(cl);
if (prio == NULL)
goto mem_err;
allow = cs;
} else {
prio = cs;
allow = cl;
}
for (z = 0; z < sk_SSL_CIPHER_num(prio); z++) {
if (sk_SSL_CIPHER_find(allow, sk_SSL_CIPHER_value(prio, z)) < 0) {
(void)sk_SSL_CIPHER_delete(prio, z);
z--;
}
}
if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
sk_SSL_CIPHER_free(s->session->ciphers);
s->session->ciphers = prio;
}
/*
* s->session->ciphers should now have a list of ciphers that are on
* both the client and server. This list is ordered by the order the
* client sent the ciphers or in the order of the server's preference
* if SSL_OP_CIPHER_SERVER_PREFERENCE was set.
*/
}
p += s->s2->tmp.cipher_spec_length;
/* done cipher selection */
/* session id extracted already */
p += s->s2->tmp.session_id_length;
/* challenge */
if (s->s2->challenge_length > sizeof s->s2->challenge) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
return -1;
}
memcpy(s->s2->challenge, p, (unsigned int)s->s2->challenge_length);
return (1);
mem_err:
SSLerr(SSL_F_GET_CLIENT_HELLO, ERR_R_MALLOC_FAILURE);
return (0);
}
static int server_hello(SSL *s)
{
unsigned char *p, *d;
int n, hit;
p = (unsigned char *)s->init_buf->data;
if (s->state == SSL2_ST_SEND_SERVER_HELLO_A) {
d = p + 11;
*(p++) = SSL2_MT_SERVER_HELLO; /* type */
hit = s->hit;
*(p++) = (unsigned char)hit;
# if 1
if (!hit) {
if (s->session->sess_cert != NULL)
/*
* This can't really happen because get_client_hello has
* called ssl_get_new_session, which does not set sess_cert.
*/
ssl_sess_cert_free(s->session->sess_cert);
s->session->sess_cert = ssl_sess_cert_new();
if (s->session->sess_cert == NULL) {
SSLerr(SSL_F_SERVER_HELLO, ERR_R_MALLOC_FAILURE);
return (-1);
}
}
/*
* If 'hit' is set, then s->sess_cert may be non-NULL or NULL,
* depending on whether it survived in the internal cache or was
* retrieved from an external cache. If it is NULL, we cannot put any
* useful data in it anyway, so we don't touch it.
*/
# else /* That's what used to be done when cert_st
* and sess_cert_st were * the same. */
if (!hit) { /* else add cert to session */
CRYPTO_add(&s->cert->references, 1, CRYPTO_LOCK_SSL_CERT);
if (s->session->sess_cert != NULL)
ssl_cert_free(s->session->sess_cert);
s->session->sess_cert = s->cert;
} else { /* We have a session id-cache hit, if the *
* session-id has no certificate listed
* against * the 'cert' structure, grab the
* 'old' one * listed against the SSL
* connection */
if (s->session->sess_cert == NULL) {
CRYPTO_add(&s->cert->references, 1, CRYPTO_LOCK_SSL_CERT);
s->session->sess_cert = s->cert;
}
}
# endif
if (s->cert == NULL) {
ssl2_return_error(s, SSL2_PE_NO_CERTIFICATE);
SSLerr(SSL_F_SERVER_HELLO, SSL_R_NO_CERTIFICATE_SPECIFIED);
return (-1);
}
if (hit) {
*(p++) = 0; /* no certificate type */
s2n(s->version, p); /* version */
s2n(0, p); /* cert len */
s2n(0, p); /* ciphers len */
} else {
/* EAY EAY */
/* put certificate type */
*(p++) = SSL2_CT_X509_CERTIFICATE;
s2n(s->version, p); /* version */
n = i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509, NULL);
s2n(n, p); /* certificate length */
i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509, &d);
n = 0;
/*
* lets send out the ciphers we like in the prefered order
*/
n = ssl_cipher_list_to_bytes(s, s->session->ciphers, d, 0);
d += n;
s2n(n, p); /* add cipher length */
}
/* make and send conn_id */
s2n(SSL2_CONNECTION_ID_LENGTH, p); /* add conn_id length */
s->s2->conn_id_length = SSL2_CONNECTION_ID_LENGTH;
if (RAND_pseudo_bytes(s->s2->conn_id, (int)s->s2->conn_id_length) <=
0)
return -1;
memcpy(d, s->s2->conn_id, SSL2_CONNECTION_ID_LENGTH);
d += SSL2_CONNECTION_ID_LENGTH;
s->state = SSL2_ST_SEND_SERVER_HELLO_B;
s->init_num = d - (unsigned char *)s->init_buf->data;
s->init_off = 0;
}
/* SSL2_ST_SEND_SERVER_HELLO_B */
/*
* If we are using TCP/IP, the performance is bad if we do 2 writes
* without a read between them. This occurs when Session-id reuse is
* used, so I will put in a buffering module
*/
if (s->hit) {
if (!ssl_init_wbio_buffer(s, 1))
return (-1);
}
return (ssl2_do_write(s));
}
static int get_client_finished(SSL *s)
{
unsigned char *p;
int i, n;
unsigned long len;
p = (unsigned char *)s->init_buf->data;
if (s->state == SSL2_ST_GET_CLIENT_FINISHED_A) {
i = ssl2_read(s, (char *)&(p[s->init_num]), 1 - s->init_num);
if (i < 1 - s->init_num)
return (ssl2_part_read(s, SSL_F_GET_CLIENT_FINISHED, i));
s->init_num += i;
if (*p != SSL2_MT_CLIENT_FINISHED) {
if (*p != SSL2_MT_ERROR) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_FINISHED,
SSL_R_READ_WRONG_PACKET_TYPE);
} else {
SSLerr(SSL_F_GET_CLIENT_FINISHED, SSL_R_PEER_ERROR);
/* try to read the error message */
i = ssl2_read(s, (char *)&(p[s->init_num]), 3 - s->init_num);
return ssl2_part_read(s, SSL_F_GET_SERVER_VERIFY, i);
}
return (-1);
}
s->state = SSL2_ST_GET_CLIENT_FINISHED_B;
}
/* SSL2_ST_GET_CLIENT_FINISHED_B */
if (s->s2->conn_id_length > sizeof s->s2->conn_id) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_FINISHED, ERR_R_INTERNAL_ERROR);
return -1;
}
len = 1 + (unsigned long)s->s2->conn_id_length;
n = (int)len - s->init_num;
i = ssl2_read(s, (char *)&(p[s->init_num]), n);
if (i < n) {
return (ssl2_part_read(s, SSL_F_GET_CLIENT_FINISHED, i));
}
if (s->msg_callback) {
/* CLIENT-FINISHED */
s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg);
}
p += 1;
if (memcmp(p, s->s2->conn_id, s->s2->conn_id_length) != 0) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_GET_CLIENT_FINISHED, SSL_R_CONNECTION_ID_IS_DIFFERENT);
return (-1);
}
return (1);
}
static int server_verify(SSL *s)
{
unsigned char *p;
if (s->state == SSL2_ST_SEND_SERVER_VERIFY_A) {
p = (unsigned char *)s->init_buf->data;
*(p++) = SSL2_MT_SERVER_VERIFY;
if (s->s2->challenge_length > sizeof s->s2->challenge) {
SSLerr(SSL_F_SERVER_VERIFY, ERR_R_INTERNAL_ERROR);
return -1;
}
memcpy(p, s->s2->challenge, (unsigned int)s->s2->challenge_length);
/* p+=s->s2->challenge_length; */
s->state = SSL2_ST_SEND_SERVER_VERIFY_B;
s->init_num = s->s2->challenge_length + 1;
s->init_off = 0;
}
return (ssl2_do_write(s));
}
static int server_finish(SSL *s)
{
unsigned char *p;
if (s->state == SSL2_ST_SEND_SERVER_FINISHED_A) {
p = (unsigned char *)s->init_buf->data;
*(p++) = SSL2_MT_SERVER_FINISHED;
if (s->session->session_id_length > sizeof s->session->session_id) {
SSLerr(SSL_F_SERVER_FINISH, ERR_R_INTERNAL_ERROR);
return -1;
}
memcpy(p, s->session->session_id,
(unsigned int)s->session->session_id_length);
/* p+=s->session->session_id_length; */
s->state = SSL2_ST_SEND_SERVER_FINISHED_B;
s->init_num = s->session->session_id_length + 1;
s->init_off = 0;
}
/* SSL2_ST_SEND_SERVER_FINISHED_B */
return (ssl2_do_write(s));
}
/* send the request and check the response */
static int request_certificate(SSL *s)
{
const unsigned char *cp;
unsigned char *p, *p2, *buf2;
unsigned char *ccd;
int i, j, ctype, ret = -1;
unsigned long len;
X509 *x509 = NULL;
STACK_OF(X509) *sk = NULL;
ccd = s->s2->tmp.ccl;
if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_A) {
p = (unsigned char *)s->init_buf->data;
*(p++) = SSL2_MT_REQUEST_CERTIFICATE;
*(p++) = SSL2_AT_MD5_WITH_RSA_ENCRYPTION;
if (RAND_pseudo_bytes(ccd, SSL2_MIN_CERT_CHALLENGE_LENGTH) <= 0)
return -1;
memcpy(p, ccd, SSL2_MIN_CERT_CHALLENGE_LENGTH);
s->state = SSL2_ST_SEND_REQUEST_CERTIFICATE_B;
s->init_num = SSL2_MIN_CERT_CHALLENGE_LENGTH + 2;
s->init_off = 0;
}
if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_B) {
i = ssl2_do_write(s);
if (i <= 0) {
ret = i;
goto end;
}
s->init_num = 0;
s->state = SSL2_ST_SEND_REQUEST_CERTIFICATE_C;
}
if (s->state == SSL2_ST_SEND_REQUEST_CERTIFICATE_C) {
p = (unsigned char *)s->init_buf->data;
/* try to read 6 octets ... */
i = ssl2_read(s, (char *)&(p[s->init_num]), 6 - s->init_num);
/*
* ... but don't call ssl2_part_read now if we got at least 3
* (probably NO-CERTIFICATE-ERROR)
*/
if (i < 3 - s->init_num) {
ret = ssl2_part_read(s, SSL_F_REQUEST_CERTIFICATE, i);
goto end;
}
s->init_num += i;
if ((s->init_num >= 3) && (p[0] == SSL2_MT_ERROR)) {
n2s(p, i);
if (i != SSL2_PE_NO_CERTIFICATE) {
/*
* not the error message we expected -- let ssl2_part_read
* handle it
*/
s->init_num -= 3;
ret = ssl2_part_read(s, SSL_F_REQUEST_CERTIFICATE, 3);
goto end;
}
if (s->msg_callback) {
/* ERROR */
s->msg_callback(0, s->version, 0, p, 3, s,
s->msg_callback_arg);
}
/*
* this is the one place where we can recover from an SSL 2.0
* error
*/
if (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
ssl2_return_error(s, SSL2_PE_BAD_CERTIFICATE);
SSLerr(SSL_F_REQUEST_CERTIFICATE,
SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
goto end;
}
ret = 1;
goto end;
}
if ((*(p++) != SSL2_MT_CLIENT_CERTIFICATE) || (s->init_num < 6)) {
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
SSLerr(SSL_F_REQUEST_CERTIFICATE, SSL_R_SHORT_READ);
goto end;
}
if (s->init_num != 6) {
SSLerr(SSL_F_REQUEST_CERTIFICATE, ERR_R_INTERNAL_ERROR);
goto end;
}
/* ok we have a response */
/* certificate type, there is only one right now. */
ctype = *(p++);
if (ctype != SSL2_AT_MD5_WITH_RSA_ENCRYPTION) {
ssl2_return_error(s, SSL2_PE_UNSUPPORTED_CERTIFICATE_TYPE);
SSLerr(SSL_F_REQUEST_CERTIFICATE, SSL_R_BAD_RESPONSE_ARGUMENT);
goto end;
}
n2s(p, i);
s->s2->tmp.clen = i;
n2s(p, i);
s->s2->tmp.rlen = i;
s->state = SSL2_ST_SEND_REQUEST_CERTIFICATE_D;
}
/* SSL2_ST_SEND_REQUEST_CERTIFICATE_D */
p = (unsigned char *)s->init_buf->data;
len = 6 + (unsigned long)s->s2->tmp.clen + (unsigned long)s->s2->tmp.rlen;
if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER) {
SSLerr(SSL_F_REQUEST_CERTIFICATE, SSL_R_MESSAGE_TOO_LONG);
goto end;
}
j = (int)len - s->init_num;
i = ssl2_read(s, (char *)&(p[s->init_num]), j);
if (i < j) {
ret = ssl2_part_read(s, SSL_F_REQUEST_CERTIFICATE, i);
goto end;
}
if (s->msg_callback) {
/* CLIENT-CERTIFICATE */
s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg);
}
p += 6;
cp = p;
x509 = (X509 *)d2i_X509(NULL, &cp, (long)s->s2->tmp.clen);
if (x509 == NULL) {
SSLerr(SSL_F_REQUEST_CERTIFICATE, ERR_R_X509_LIB);
goto msg_end;
}
if (((sk = sk_X509_new_null()) == NULL) || (!sk_X509_push(sk, x509))) {
SSLerr(SSL_F_REQUEST_CERTIFICATE, ERR_R_MALLOC_FAILURE);
goto msg_end;
}
i = ssl_verify_cert_chain(s, sk);
if (i > 0) { /* we like the packet, now check the chksum */
EVP_MD_CTX ctx;
EVP_PKEY *pkey = NULL;
EVP_MD_CTX_init(&ctx);
if (!EVP_VerifyInit_ex(&ctx, s->ctx->rsa_md5, NULL)
|| !EVP_VerifyUpdate(&ctx, s->s2->key_material,
s->s2->key_material_length)
|| !EVP_VerifyUpdate(&ctx, ccd, SSL2_MIN_CERT_CHALLENGE_LENGTH))
goto msg_end;
i = i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509, NULL);
buf2 = OPENSSL_malloc((unsigned int)i);
if (buf2 == NULL) {
SSLerr(SSL_F_REQUEST_CERTIFICATE, ERR_R_MALLOC_FAILURE);
goto msg_end;
}
p2 = buf2;
i = i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509, &p2);
if (!EVP_VerifyUpdate(&ctx, buf2, (unsigned int)i)) {
OPENSSL_free(buf2);
goto msg_end;
}
OPENSSL_free(buf2);
pkey = X509_get_pubkey(x509);
if (pkey == NULL)
goto end;
i = EVP_VerifyFinal(&ctx, cp, s->s2->tmp.rlen, pkey);
EVP_PKEY_free(pkey);
EVP_MD_CTX_cleanup(&ctx);
if (i > 0) {
if (s->session->peer != NULL)
X509_free(s->session->peer);
s->session->peer = x509;
CRYPTO_add(&x509->references, 1, CRYPTO_LOCK_X509);
s->session->verify_result = s->verify_result;
ret = 1;
goto end;
} else {
SSLerr(SSL_F_REQUEST_CERTIFICATE, SSL_R_BAD_CHECKSUM);
goto msg_end;
}
} else {
msg_end:
ssl2_return_error(s, SSL2_PE_BAD_CERTIFICATE);
}
end:
sk_X509_free(sk);
X509_free(x509);
return (ret);
}
static int ssl_rsa_private_decrypt(CERT *c, int len, unsigned char *from,
unsigned char *to, int padding)
{
RSA *rsa;
int i;
if ((c == NULL) || (c->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL)) {
SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT, SSL_R_NO_PRIVATEKEY);
return (-1);
}
if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey->type != EVP_PKEY_RSA) {
SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT, SSL_R_PUBLIC_KEY_IS_NOT_RSA);
return (-1);
}
rsa = c->pkeys[SSL_PKEY_RSA_ENC].privatekey->pkey.rsa;
/* we have the public key */
i = RSA_private_decrypt(len, from, to, rsa, padding);
if (i < 0)
SSLerr(SSL_F_SSL_RSA_PRIVATE_DECRYPT, ERR_R_RSA_LIB);
return (i);
}
#else /* !OPENSSL_NO_SSL2 */
# if PEDANTIC
static void *dummy = &dummy;
# endif
#endif
Reference in a new issue View git blame Copy permalink